2245 files changed, 85183 insertions, 30914 deletions

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 8071d61f9..b477be399 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,4 +1,4 @@
-CMAKE_MINIMUM_REQUIRED(VERSION 2.8)
+CMAKE_MINIMUM_REQUIRED(VERSION 2.8.3)
 PROJECT(WebKit)
 
 # Set a default build type if and only if user did not define one as command
diff --git a/ChangeLog b/ChangeLog
index 2d76152a0..e8cffea0e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,313 @@
+2012-08-10  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Enable relro link option for JSC executable
+        https://bugs.webkit.org/show_bug.cgi?id=93726
+
+        Reviewed by Yong Li.
+
+        Enable relro link option for JSC executable.
+
+        * Source/cmake/OptionsBlackBerry.cmake:
+
+2012-08-09  Raphael Kubo da Costa  <rakuco@webkit.org>
+
+        [CMake] Bump minimum required version to 2.8.3.
+        https://bugs.webkit.org/show_bug.cgi?id=93450
+
+        Reviewed by Daniel Bates.
+
+        Following the discussion in bug 93189, it was decided that bumping
+        the minimum required version from 2.8.0 to 2.8.3 was a good thing
+        due to additional features, such as improved
+        FIND_PACKAGE_HANDLE_STANDARD_ARGS() support and better argument
+        handling in the PKG_CHECK_MODULES() call.
+
+        CMake 2.8.3 was released almost two years ago, so people are
+        expected to have it or a later version installed.
+
+        * CMakeLists.txt:
+
+2012-08-08  Shane Stephens  <shanestephens@google.com>
+
+        Compile flag for CSS Hierarchies
+        https://bugs.webkit.org/show_bug.cgi?id=92433
+
+        Reviewed by Tony Chang.
+
+        * Source/cmake/WebKitFeatures.cmake:
+
+2012-08-08  Ming Xie  <mxie@rim.com>
+
+        [BlackBerry] Fix "-fPIC" define in the BlackBerry build
+        https://bugs.webkit.org/show_bug.cgi?id=93548
+
+        Reviewed by Rob Buis.
+
+        In the current CMake release (version 2.8.5), ${CMAKE_SHARED
+        _LIBRARY_C_FLAGS} and ${CMAKE_SHARED_LIBRARY_CXX_FLAGS} is
+        set to empty (See cmake/Modules/Platform/QNX.cmake)
+
+        This breaks the assumption which WebKit CMake build system 
+        makes in Source/cmake/WebKitHelper.cmake
+
+        * Source/cmake/OptionsBlackBerry.cmake:
+
+2012-08-08  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] 0.11 build broken (again)
+        https://bugs.webkit.org/show_bug.cgi?id=93474
+
+        Reviewed by Martin Robinson.
+
+        * configure.ac: Disable media-stream build if GStreamer 0.11
+        support is enabled, due to farstream-0.1 still messing up with
+        gstreamer-0.10 include path.
+
+2012-08-07  YoungTaeck Song  <youngtaeck.song@samsung.com>
+
+        [WK2][EFL] Implement accelerated compositing on WK2 Efl port
+        https://bugs.webkit.org/show_bug.cgi?id=89840
+
+        Reviewed by Noam Rosenthal.
+
+        Implement accelerated composition with TiledBackingStore on WK2 Efl port.
+        This implementation is based on COORDINATED_GRAPHICS.
+        Add COORDINATED_GRAPHICS related definitions in OptionsEfl.cmake.
+
+        * Source/cmake/OptionsEfl.cmake:
+
+2012-08-07  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Make it possible to build without QtQuick
+
+        Reviewed by Simon Hausmann.
+
+        * Source/QtWebKit.pro:
+        * Source/tests.pri:
+
+2012-07-19  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove Qt 4 specific code paths
+        https://bugs.webkit.org/show_bug.cgi?id=88161
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Source/api.pri:
+        * WebKit.pro:
+
+2012-08-06  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [EFL] Enable link prefetch
+        https://bugs.webkit.org/show_bug.cgi?id=93281
+
+        Reviewed by Kentaro Hara.
+
+        * Source/cmake/OptionsEfl.cmake: Enable LINK_PREFETCH by default.
+
+2012-08-06  Xan Lopez  <xlopez@igalia.com>
+
+        [GTK] Cleanup configure.ac build options output
+        https://bugs.webkit.org/show_bug.cgi?id=93245
+
+        Reviewed by Laszlo Gombos.
+
+        Remove duplicated elements, sort alphabetically.
+
+        * configure.ac: ditto.
+
+2012-08-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Update NEWS and configure.ac for 1.9.6 release
+
+        * configure.ac: Bump version numbers.
+
+2012-08-03  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake][WIN] Disable C++ exceptions and RTTI
+        https://bugs.webkit.org/show_bug.cgi?id=93104
+
+        Reviewed by Ryosuke Niwa.
+
+        Both features are not used in WebKit, so remove them to safe some code.
+        Also enable compilation of plain c files with multiple processes.
+
+        * Source/cmake/OptionsWindows.cmake:
+
+2012-08-03  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Unreviewed build fix for GTK after r124479.
+
+        * Source/autotools/symbols.filter: Removed unneeded symbol.
+
+2012-08-03  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Populate .qmake.cache from the top-level project file
+
+        This makes it possible to build webkit without using the perl build
+        script. The duplicated logic in build-webkit will be removed when we
+        remove the Qt4 code paths. The build-webkit script will then simply
+        call 'qmake WebKit.pro' from WEBKITOUTPUTDIR.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * WebKit.pro:
+
+2012-08-03  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        [cmake] Cleanup FindHarfBuzz.cmake
+        https://bugs.webkit.org/show_bug.cgi?id=92984
+
+        Reviewed by Hajime Morita.
+
+        Cleanup which didn't make it into my previous ptch.
+
+        * Source/cmake/FindHarfBuzz.cmake: Remove duplicate line, add a bit of documentation.
+
+2012-08-03  Joone Hur  <joone.hur@intel.com>
+
+        [EFL][DRT] WebKitAnimation API compile-time disabled
+        https://bugs.webkit.org/show_bug.cgi?id=84593
+
+        Reviewed by Laszlo Gombos.
+
+        Enable ENABLE_ANIMATION_API by default on the Efl port.
+
+        * Source/cmake/OptionsEfl.cmake:
+        * Source/cmakeconfig.h.cmake:
+
+2012-08-02  Zan Dobersek  <zandobersek@gmail.com>
+
+        Unreviewed attempt at fixing the GTK 64-bit debug build.
+
+        * Source/autotools/symbols.filter:
+
+2012-08-02  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] When farstream is not present do not enable MediaStream
+
+        Reviewed by Philippe Normand.
+
+        When farstream libraries are no present, simply do not build MediaStream
+        support.
+
+        * configure.ac:
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port
+        https://bugs.webkit.org/show_bug.cgi?id=90298
+
+        Reviewed by Adam Barth.
+
+        * configure.ac: Add ENABLE_WIDGET_REGION define.
+
+2012-07-31  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [BlackBerry] Enable CSS Filter Effects
+        https://bugs.webkit.org/show_bug.cgi?id=92685
+
+        Reviewed by Rob Buis.
+
+        Enable CSS filter effects, with the exception of custom effects (CSS shaders) and reference effects (SVG effects)
+
+        Internally reviewed by Arvid Nilsson <anilsson@rim.com> and Antonio Gomes <agomes@rim.com>.
+
+        * Source/cmake/OptionsBlackBerry.cmake: Add LayerFilterRenderer
+        * Source/cmakeconfig.h.cmake: Acknowledge CSS filter effects
+
+2012-07-31  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Perf-o-matic: dashboard images are not generated properly from incrementally updated JSON
+        https://bugs.webkit.org/show_bug.cgi?id=92717
+
+        Reviewed by Hajime Morita.
+
+        Sort the values by timestamp. Unfortunately, there isn't a good way of testing this fix.
+
+        * Websites/webkit-perf.appspot.com/models.py:
+        (Runs.chart_params):
+
+2012-07-31  Danilo Cesar Lemes de Paula  <danilo.cesar@collabora.co.uk>
+
+        add Farstream flags/deps to WebKit, for WebRTC
+        https://bugs.webkit.org/show_bug.cgi?id=87524
+
+        Reviewed by Philippe Normand.
+
+        Since Farstream will be used as the backend for GTK's WebRTC, this
+        patch adds it as a dependency to the build system.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        /api/test/runs/chart expires on perf-o-matic
+        https://bugs.webkit.org/show_bug.cgi?id=92714
+
+        Reviewed by Hajime Morita.
+
+        Don't update the entire JSON while generating the dashboard images.
+        This is a bug and not doing this will reduce the server load significantly.
+
+        * Websites/webkit-perf.appspot.com/controller.py:
+        (RunsChartHandler.post):
+
+2012-07-30  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Avoid Assertion Failure in HarfBuzzRun::characterIndexForXPosition
+        https://bugs.webkit.org/show_bug.cgi?id=92376
+
+        Reviewed by Tony Chang.
+
+        Added manual test to reliably reproduce assertion failure which is solved by this patch.
+
+        * ManualTests/harfbuzz-mouse-selection-crash.html: Added.
+
+2012-07-29  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Resource agent's reference to cached resources should be weak.
+        https://bugs.webkit.org/show_bug.cgi?id=92108
+
+        Reviewed by Pavel Feldman.
+
+        * Source/autotools/symbols.filter:
+
+2012-07-30  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Prohibit having AuthorShadowDOM of input or textarea element for a while and having a flag to enable it in Internals.
+        https://bugs.webkit.org/show_bug.cgi?id=92611
+
+        Reviewed by Hajime Morita.
+
+        * Source/autotools/symbols.filter:
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124000.
+        http://trac.webkit.org/changeset/124000
+        https://bugs.webkit.org/show_bug.cgi?id=92632
+
+        seems to have broken chromium Range_InstanceSizeUnknown unit
+        test across many platforms (Requested by tomhudson on
+        #webkit).
+
+        * Source/autotools/symbols.filter:
+
+2012-07-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Replace UnicodeWinCE with UnicodeWchar
+        https://bugs.webkit.org/show_bug.cgi?id=92539
+
+        Reviewed by Ryosuke Niwa.
+
+        UnicodeWinCE never contained WinCE specific code. UnicodeWchar
+        is a replacement for it, which is mainly based on the functions
+        from <wchar.h>. It is ment as a minimal Unicode backend, which
+        can be used very easy and has no external dependencies.
+
+        * Source/cmake/OptionsWinCE.cmake:
+
 2012-07-29  Vsevolod Vlasov  <vsevik@chromium.org>
 
         Web Inspector: Resource agent's reference to cached resources should be weak.
diff --git a/GNUmakefile.am b/GNUmakefile.am
index 6a4e97727..8eeb9ffe9 100644
--- a/GNUmakefile.am
+++ b/GNUmakefile.am
@@ -202,6 +202,11 @@ global_cppflags += \
 	-DWTF_USE_GSTREAMER=1
 endif
 
+if USE_FARSTREAM
+global_cppflags += \
+	-DWTF_USE_FARSTREAM=1
+endif
+
 if USE_ACCELERATED_COMPOSITING
 global_cppflags += \
 	-DWTF_USE_ACCELERATED_COMPOSITING=1 \
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 4b030ca40..146a11910 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -94,6 +94,7 @@ SET(JavaScriptCore_SOURCES
     dfg/DFGSpeculativeJIT.cpp
     dfg/DFGSpeculativeJIT32_64.cpp
     dfg/DFGSpeculativeJIT64.cpp
+    dfg/DFGStructureCheckHoistingPhase.cpp
     dfg/DFGThunks.cpp
     dfg/DFGValueSource.cpp
     dfg/DFGVariableEvent.cpp
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index c71b441e2..063b2f519 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,20 +1,2443 @@
-2012-06-13  Patrick Gansterer  <paroga@webkit.org>
+2012-08-10  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] GCActivityCallback should always schedule GC even allocated bytes is a small number
+        https://bugs.webkit.org/show_bug.cgi?id=93650
+
+        Reviewed by Rob Buis.
+
+        Even a small number of allocated JS objects could hold expensive resources.
+
+        * runtime/GCActivityCallbackBlackBerry.cpp:
+        (JSC::DefaultGCActivityCallback::didAllocate):
+
+2012-08-09  Yong Li  <yoli@rim.com>
+
+        [QNX] Implement getCPUTime() for OS(QNX)
+        https://bugs.webkit.org/show_bug.cgi?id=93516
+
+        Reviewed by George Staikos.
+
+        Implement getCPUTime() with CLOCK_THREAD_CPUTIME_ID so it will tell
+        exactly how long the current thread has spent without being impacted
+        by other things.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2012-08-08  Shane Stephens  <shanestephens@google.com>
+
+        Compile flag for CSS Hierarchies
+        https://bugs.webkit.org/show_bug.cgi?id=92433
+
+        Reviewed by Tony Chang.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-08-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Use char* instead of LChar* for the public interface of String construction from literals
+        https://bugs.webkit.org/show_bug.cgi?id=93402
+
+        Reviewed by Michael Saboff.
+
+        Update JSC' Identifier to use StringImpl::createFromLiteral with a char*.
+
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierASCIIStringTranslator::translate):
+
+2012-08-08  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove ce_time.(cpp|h) from list of source files
+        https://bugs.webkit.org/show_bug.cgi?id=93446
+
+        Reviewed by Simon Hausmann.
+
+        r125004 removed the last dependency on functions defined in ce_time.cpp.
+
+        * Target.pri:
+
+2012-08-08  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Use GetTimeZoneInformation() for getting the timezone name
+        https://bugs.webkit.org/show_bug.cgi?id=91936
+
+        Reviewed by Ryosuke Niwa.
+
+        The MS CRT implementation of strftime calls the same functions in the background.
+        Using them directly avoids the overhead of parsing the format string and removes
+        the dependency on strftime() for WinCE where this function does not exist.
+
+        * runtime/DateConversion.cpp:
+        (JSC::formatTime):
+
+2012-08-07  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        Refactor magic numbers in the ARM port of DFG-JIT
+        https://bugs.webkit.org/show_bug.cgi?id=93348
+
+        Reviewed by Eric Seidel.
+
+        Introduce new names for hard-coded magic numbers.
+        Refactor constant with confusing names to more descriptive ones.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::patchConstantPoolLoad):
+        (JSC::ARMAssembler::getOp2):
+        (JSC::ARMAssembler::genInt):
+        (JSC::ARMAssembler::getImm):
+        (JSC::ARMAssembler::moveImm):
+        (JSC::ARMAssembler::encodeComplexImm):
+        (JSC::ARMAssembler::dataTransfer32):
+        (JSC::ARMAssembler::dataTransfer16):
+        (JSC::ARMAssembler::dataTransferFloat):
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::emitInstruction):
+        (JSC::ARMAssembler::ands_r):
+        (JSC::ARMAssembler::eors_r):
+        (JSC::ARMAssembler::subs_r):
+        (JSC::ARMAssembler::rsbs_r):
+        (JSC::ARMAssembler::adds_r):
+        (JSC::ARMAssembler::adcs_r):
+        (JSC::ARMAssembler::sbcs_r):
+        (JSC::ARMAssembler::rscs_r):
+        (JSC::ARMAssembler::tst_r):
+        (JSC::ARMAssembler::teq_r):
+        (JSC::ARMAssembler::cmp_r):
+        (JSC::ARMAssembler::cmn_r):
+        (JSC::ARMAssembler::orrs_r):
+        (JSC::ARMAssembler::movs_r):
+        (JSC::ARMAssembler::bics_r):
+        (JSC::ARMAssembler::mvns_r):
+        (JSC::ARMAssembler::muls_r):
+        (JSC::ARMAssembler::ldr_imm):
+        (JSC::ARMAssembler::ldr_un_imm):
+        (JSC::ARMAssembler::dtr_u):
+        (JSC::ARMAssembler::dtr_ur):
+        (JSC::ARMAssembler::dtr_dr):
+        (JSC::ARMAssembler::dtrh_u):
+        (JSC::ARMAssembler::dtrh_ur):
+        (JSC::ARMAssembler::fdtr_u):
+        (JSC::ARMAssembler::push_r):
+        (JSC::ARMAssembler::pop_r):
+        (JSC::ARMAssembler::getLdrImmAddress):
+        (JSC::ARMAssembler::getLdrImmAddressOnPool):
+        (JSC::ARMAssembler::patchConstantPoolLoad):
+        (JSC::ARMAssembler::repatchCompact):
+        (JSC::ARMAssembler::replaceWithJump):
+        (JSC::ARMAssembler::replaceWithLoad):
+        (JSC::ARMAssembler::replaceWithAddressComputation):
+        (JSC::ARMAssembler::getOp2Byte):
+        (JSC::ARMAssembler::getOp2Half):
+        (JSC::ARMAssembler::getImm16Op2):
+        (JSC::ARMAssembler::placeConstantPoolBarrier):
+        (JSC::ARMAssembler::getConditionalField):
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::and32):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::branchTest32):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
+
+2012-08-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        Use the initialization from literal for JSC's Identifiers
+        https://bugs.webkit.org/show_bug.cgi?id=93193
+
+        Reviewed by Geoffrey Garen.
+
+        This patches modify Identifier ot take advantage of the new initialization from literal.
+
+        In addition to the memory savings (~600bytes per instance), this gives us a 2% speed
+        improvement on CommonIdentifiers on average.
+
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        Null and empty strings are forbidden for literal initialization. Use the most efficient constructors
+        instead of a literal.
+
+        * runtime/Identifier.cpp:
+        (IdentifierASCIIStringTranslator):
+        Rename IdentifierCStringTranslator to IdentifierASCIIStringTranslator to make the text encoding
+        explicit.
+        (JSC::IdentifierASCIIStringTranslator::hash):
+        (JSC::IdentifierASCIIStringTranslator::equal):
+        (JSC::IdentifierASCIIStringTranslator::translate): Use the fast initialization from literal.
+        (JSC::Identifier::add):
+        * runtime/Identifier.h:
+        (JSC::Identifier::Identifier):
+
+2012-08-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt][Win] Remove pthreads linkage
+
+        Reviewed by Csaba Osztrogonác.
+
+        After r124823 linkage to pthreads is not needed anymore for the Windows
+        build.
+
+        * JavaScriptCore.pri:
+
+2012-08-07  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        Refactor emit*Inst functions and introduce toARMWord functions in DFG-JIT's traditional ARM port
+        https://bugs.webkit.org/show_bug.cgi?id=93266
+
+        Reviewed by Csaba Osztrogonác.
+
+        First part of a bigger refactoring issue trying to make traditional
+        ARM DFG-JIT port easier to read and understand.
+
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::emitInstruction):
+        (JSC::ARMAssembler::emitDoublePrecisionInstruction):
+        (JSC::ARMAssembler::emitSinglePrecisionInstruction):
+        (JSC::ARMAssembler::and_r):
+        (JSC::ARMAssembler::ands_r):
+        (JSC::ARMAssembler::eor_r):
+        (JSC::ARMAssembler::eors_r):
+        (JSC::ARMAssembler::sub_r):
+        (JSC::ARMAssembler::subs_r):
+        (JSC::ARMAssembler::rsb_r):
+        (JSC::ARMAssembler::rsbs_r):
+        (JSC::ARMAssembler::add_r):
+        (JSC::ARMAssembler::adds_r):
+        (JSC::ARMAssembler::adc_r):
+        (JSC::ARMAssembler::adcs_r):
+        (JSC::ARMAssembler::sbc_r):
+        (JSC::ARMAssembler::sbcs_r):
+        (JSC::ARMAssembler::rsc_r):
+        (JSC::ARMAssembler::rscs_r):
+        (JSC::ARMAssembler::tst_r):
+        (JSC::ARMAssembler::teq_r):
+        (JSC::ARMAssembler::cmp_r):
+        (JSC::ARMAssembler::cmn_r):
+        (JSC::ARMAssembler::orr_r):
+        (JSC::ARMAssembler::orrs_r):
+        (JSC::ARMAssembler::mov_r):
+        (JSC::ARMAssembler::movw_r):
+        (JSC::ARMAssembler::movt_r):
+        (JSC::ARMAssembler::movs_r):
+        (JSC::ARMAssembler::bic_r):
+        (JSC::ARMAssembler::bics_r):
+        (JSC::ARMAssembler::mvn_r):
+        (JSC::ARMAssembler::mvns_r):
+        (JSC::ARMAssembler::mul_r):
+        (JSC::ARMAssembler::muls_r):
+        (JSC::ARMAssembler::mull_r):
+        (JSC::ARMAssembler::vmov_f64_r):
+        (JSC::ARMAssembler::vadd_f64_r):
+        (JSC::ARMAssembler::vdiv_f64_r):
+        (JSC::ARMAssembler::vsub_f64_r):
+        (JSC::ARMAssembler::vmul_f64_r):
+        (JSC::ARMAssembler::vcmp_f64_r):
+        (JSC::ARMAssembler::vsqrt_f64_r):
+        (JSC::ARMAssembler::vabs_f64_r):
+        (JSC::ARMAssembler::vneg_f64_r):
+        (JSC::ARMAssembler::ldr_imm):
+        (JSC::ARMAssembler::ldr_un_imm):
+        (JSC::ARMAssembler::dtr_u):
+        (JSC::ARMAssembler::dtr_ur):
+        (JSC::ARMAssembler::dtr_d):
+        (JSC::ARMAssembler::dtr_dr):
+        (JSC::ARMAssembler::dtrh_u):
+        (JSC::ARMAssembler::dtrh_ur):
+        (JSC::ARMAssembler::dtrh_d):
+        (JSC::ARMAssembler::dtrh_dr):
+        (JSC::ARMAssembler::fdtr_u):
+        (JSC::ARMAssembler::fdtr_d):
+        (JSC::ARMAssembler::push_r):
+        (JSC::ARMAssembler::pop_r):
+        (JSC::ARMAssembler::vmov_vfp64_r):
+        (JSC::ARMAssembler::vmov_arm64_r):
+        (JSC::ARMAssembler::vmov_vfp32_r):
+        (JSC::ARMAssembler::vmov_arm32_r):
+        (JSC::ARMAssembler::vcvt_f64_s32_r):
+        (JSC::ARMAssembler::vcvt_s32_f64_r):
+        (JSC::ARMAssembler::vcvt_u32_f64_r):
+        (JSC::ARMAssembler::vcvt_f64_f32_r):
+        (JSC::ARMAssembler::vcvt_f32_f64_r):
+        (JSC::ARMAssembler::vmrs_apsr):
+        (JSC::ARMAssembler::clz_r):
+        (JSC::ARMAssembler::bx):
+        (JSC::ARMAssembler::blx):
+        (JSC::ARMAssembler::linkJump):
+        (JSC::ARMAssembler::toARMWord):
+        (ARMAssembler):
+
+2012-08-06  Patrick Gansterer  <paroga@webkit.org>
 
         [WIN] Remove dependency on pthread from MachineStackMarker
         https://bugs.webkit.org/show_bug.cgi?id=68429
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Geoffrey Garen.
 
-        Implement pthread TLS functionality with native windows functions.
+        Windows has no support for calling a destructor for thread specific data.
+        Since we need more control over creating and deleting thread specific keys
+        we can not simply extend WTF::ThreadSpecific with this functionality.
 
-        * heap/MachineStackMarker.cpp: Use the new functions instead of pthread directly.
+        All thread specific keys created via the new API get stored in a list.
+        After a thread function finished we iterate over this list and call
+        the registered destructor for every item if needed.
+
+        * heap/MachineStackMarker.cpp:  Use the new functions instead of pthread directly.
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::makeUsableFromMultipleThreads):
+        (JSC::MachineThreads::addCurrentThread):
         * heap/MachineStackMarker.h:
-        * wtf/ThreadSpecific.h:
-        (WTF::ThreadSpecificKeyCreate): Added wrapper around pthread_key_create.
-        (WTF::ThreadSpecificKeyDelete): Added wrapper around pthread_key_delete.
-        (WTF::ThreadSpecificSet): Added wrapper around pthread_setspecific.
-        (WTF::ThreadSpecificGet): Added wrapper around pthread_getspecific.
-        * wtf/ThreadSpecificWin.cpp:
+        (MachineThreads):
+
+2012-08-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Unify JSC date and time formating functions
+        https://bugs.webkit.org/show_bug.cgi?id=92282
+
+        Reviewed by Geoffrey Garen.
+
+        Replace the existing functions for formating GregorianDateTime
+        with one single function. This removes some code duplications
+        in DatePrototype and is a preperation to fix encoding issues,
+        since we can add UChar* values to the resulting string now.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatDateTime):
+        * runtime/DateConversion.h:
+        (JSC):
+        * runtime/DatePrototype.cpp:
+        (JSC::formateDateInstance):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToGMTString):
+
+2012-08-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
+2012-08-05  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: [JSC] implement setting breakpoints by line:column
+        https://bugs.webkit.org/show_bug.cgi?id=53003
+
+        Reviewed by Geoffrey Garen.
+
+        Add a counter to Lexer to record the column info of each Token. Add a column parameter to
+        op_debug, cti_op_debug, and _llint_op_debug byte-code command.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::debug):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (ASTBuilder):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::createLogicalNot):
+        (JSC::ASTBuilder::createUnaryPlus):
+        (JSC::ASTBuilder::createVoid):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createObjectLiteral):
+        (JSC::ASTBuilder::createArray):
+        (JSC::ASTBuilder::createNumberExpr):
+        (JSC::ASTBuilder::createString):
+        (JSC::ASTBuilder::createBoolean):
+        (JSC::ASTBuilder::createNull):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegExp):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createPropertyList):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendConstDecl):
+        (JSC::ASTBuilder::combineCommaNodes):
+        (JSC::ASTBuilder::appendBinaryOperation):
+        (JSC::ASTBuilder::createAssignment):
+        (JSC::ASTBuilder::createNumber):
+        (JSC::ASTBuilder::makeTypeOfNode):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/Lexer.cpp:
+        (JSC::::setCode):
+        (JSC::::internalShift):
+        (JSC::::shift):
+        (JSC::::lex):
+        * parser/Lexer.h:
+        (Lexer):
+        (JSC::Lexer::currentColumnNumber):
+        (JSC::::lexExpectIdentifier):
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        (JSC::ExpressionNode::ExpressionNode):
+        (JSC::StatementNode::StatementNode):
+        (JSC::NullNode::NullNode):
+        (JSC::BooleanNode::BooleanNode):
+        (JSC::NumberNode::NumberNode):
+        (JSC::StringNode::StringNode):
+        (JSC::RegExpNode::RegExpNode):
+        (JSC::ThisNode::ThisNode):
+        (JSC::ResolveNode::ResolveNode):
+        (JSC::ArrayNode::ArrayNode):
+        (JSC::PropertyListNode::PropertyListNode):
+        (JSC::ObjectLiteralNode::ObjectLiteralNode):
+        (JSC::BracketAccessorNode::BracketAccessorNode):
+        (JSC::DotAccessorNode::DotAccessorNode):
+        (JSC::ArgumentListNode::ArgumentListNode):
+        (JSC::NewExprNode::NewExprNode):
+        (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
+        (JSC::FunctionCallValueNode::FunctionCallValueNode):
+        (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
+        (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
+        (JSC::FunctionCallDotNode::FunctionCallDotNode):
+        (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
+        (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
+        (JSC::PrePostResolveNode::PrePostResolveNode):
+        (JSC::PostfixResolveNode::PostfixResolveNode):
+        (JSC::PostfixBracketNode::PostfixBracketNode):
+        (JSC::PostfixDotNode::PostfixDotNode):
+        (JSC::PostfixErrorNode::PostfixErrorNode):
+        (JSC::DeleteResolveNode::DeleteResolveNode):
+        (JSC::DeleteBracketNode::DeleteBracketNode):
+        (JSC::DeleteDotNode::DeleteDotNode):
+        (JSC::DeleteValueNode::DeleteValueNode):
+        (JSC::VoidNode::VoidNode):
+        (JSC::TypeOfResolveNode::TypeOfResolveNode):
+        (JSC::TypeOfValueNode::TypeOfValueNode):
+        (JSC::PrefixResolveNode::PrefixResolveNode):
+        (JSC::PrefixBracketNode::PrefixBracketNode):
+        (JSC::PrefixDotNode::PrefixDotNode):
+        (JSC::PrefixErrorNode::PrefixErrorNode):
+        (JSC::UnaryOpNode::UnaryOpNode):
+        (JSC::UnaryPlusNode::UnaryPlusNode):
+        (JSC::NegateNode::NegateNode):
+        (JSC::BitwiseNotNode::BitwiseNotNode):
+        (JSC::LogicalNotNode::LogicalNotNode):
+        (JSC::BinaryOpNode::BinaryOpNode):
+        (JSC::MultNode::MultNode):
+        (JSC::DivNode::DivNode):
+        (JSC::ModNode::ModNode):
+        (JSC::AddNode::AddNode):
+        (JSC::SubNode::SubNode):
+        (JSC::LeftShiftNode::LeftShiftNode):
+        (JSC::RightShiftNode::RightShiftNode):
+        (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
+        (JSC::LessNode::LessNode):
+        (JSC::GreaterNode::GreaterNode):
+        (JSC::LessEqNode::LessEqNode):
+        (JSC::GreaterEqNode::GreaterEqNode):
+        (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode):
+        (JSC::InstanceOfNode::InstanceOfNode):
+        (JSC::InNode::InNode):
+        (JSC::EqualNode::EqualNode):
+        (JSC::NotEqualNode::NotEqualNode):
+        (JSC::StrictEqualNode::StrictEqualNode):
+        (JSC::NotStrictEqualNode::NotStrictEqualNode):
+        (JSC::BitAndNode::BitAndNode):
+        (JSC::BitOrNode::BitOrNode):
+        (JSC::BitXOrNode::BitXOrNode):
+        (JSC::LogicalOpNode::LogicalOpNode):
+        (JSC::ConditionalNode::ConditionalNode):
+        (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
+        (JSC::AssignResolveNode::AssignResolveNode):
+        (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
+        (JSC::AssignBracketNode::AssignBracketNode):
+        (JSC::AssignDotNode::AssignDotNode):
+        (JSC::ReadModifyDotNode::ReadModifyDotNode):
+        (JSC::AssignErrorNode::AssignErrorNode):
+        (JSC::CommaNode::CommaNode):
+        (JSC::ConstStatementNode::ConstStatementNode):
+        (JSC::EmptyStatementNode::EmptyStatementNode):
+        (JSC::DebuggerStatementNode::DebuggerStatementNode):
+        (JSC::ExprStatementNode::ExprStatementNode):
+        (JSC::VarStatementNode::VarStatementNode):
+        (JSC::IfNode::IfNode):
+        (JSC::IfElseNode::IfElseNode):
+        (JSC::DoWhileNode::DoWhileNode):
+        (JSC::WhileNode::WhileNode):
+        (JSC::ForNode::ForNode):
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ReturnNode::ReturnNode):
+        (JSC::WithNode::WithNode):
+        (JSC::LabelNode::LabelNode):
+        (JSC::ThrowNode::ThrowNode):
+        (JSC::TryNode::TryNode):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        (JSC::SwitchNode::SwitchNode):
+        (JSC::ConstDeclNode::ConstDeclNode):
+        (JSC::BlockNode::BlockNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.cpp:
+        (JSC::StatementNode::setLoc):
+        (JSC):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (Node):
+        (JSC::Node::columnNo):
+        (ExpressionNode):
+        (StatementNode):
+        (JSC::StatementNode::column):
+        (NullNode):
+        (BooleanNode):
+        (NumberNode):
+        (StringNode):
+        (RegExpNode):
+        (ThisNode):
+        (ResolveNode):
+        (ArrayNode):
+        (PropertyListNode):
+        (ObjectLiteralNode):
+        (BracketAccessorNode):
+        (DotAccessorNode):
+        (ArgumentListNode):
+        (NewExprNode):
+        (EvalFunctionCallNode):
+        (FunctionCallValueNode):
+        (FunctionCallResolveNode):
+        (FunctionCallBracketNode):
+        (FunctionCallDotNode):
+        (CallFunctionCallDotNode):
+        (ApplyFunctionCallDotNode):
+        (PrePostResolveNode):
+        (PostfixResolveNode):
+        (PostfixBracketNode):
+        (PostfixDotNode):
+        (PostfixErrorNode):
+        (DeleteResolveNode):
+        (DeleteBracketNode):
+        (DeleteDotNode):
+        (DeleteValueNode):
+        (VoidNode):
+        (TypeOfResolveNode):
+        (TypeOfValueNode):
+        (PrefixResolveNode):
+        (PrefixBracketNode):
+        (PrefixDotNode):
+        (PrefixErrorNode):
+        (UnaryOpNode):
+        (UnaryPlusNode):
+        (NegateNode):
+        (BitwiseNotNode):
+        (LogicalNotNode):
+        (BinaryOpNode):
+        (MultNode):
+        (DivNode):
+        (ModNode):
+        (AddNode):
+        (SubNode):
+        (LeftShiftNode):
+        (RightShiftNode):
+        (UnsignedRightShiftNode):
+        (LessNode):
+        (GreaterNode):
+        (LessEqNode):
+        (GreaterEqNode):
+        (ThrowableBinaryOpNode):
+        (InstanceOfNode):
+        (InNode):
+        (EqualNode):
+        (NotEqualNode):
+        (StrictEqualNode):
+        (NotStrictEqualNode):
+        (BitAndNode):
+        (BitOrNode):
+        (BitXOrNode):
+        (LogicalOpNode):
+        (ConditionalNode):
+        (ReadModifyResolveNode):
+        (AssignResolveNode):
+        (ReadModifyBracketNode):
+        (AssignBracketNode):
+        (AssignDotNode):
+        (ReadModifyDotNode):
+        (AssignErrorNode):
+        (CommaNode):
+        (ConstDeclNode):
+        (ConstStatementNode):
+        (BlockNode):
+        (EmptyStatementNode):
+        (DebuggerStatementNode):
+        (ExprStatementNode):
+        (VarStatementNode):
+        (IfNode):
+        (IfElseNode):
+        (DoWhileNode):
+        (WhileNode):
+        (ForNode):
+        (ForInNode):
+        (ContinueNode):
+        (BreakNode):
+        (ReturnNode):
+        (WithNode):
+        (LabelNode):
+        (ThrowNode):
+        (TryNode):
+        (ScopeNode):
+        (ProgramNode):
+        (EvalNode):
+        (FunctionBodyNode):
+        (FuncExprNode):
+        (FuncDeclNode):
+        (SwitchNode):
+        * parser/Parser.cpp:
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseConstDeclaration):
+        (JSC::::parseDoWhileStatement):
+        (JSC::::parseWhileStatement):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseConstDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseBreakStatement):
+        (JSC::::parseContinueStatement):
+        (JSC::::parseReturnStatement):
+        (JSC::::parseThrowStatement):
+        (JSC::::parseWithStatement):
+        (JSC::::parseSwitchStatement):
+        (JSC::::parseTryStatement):
+        (JSC::::parseDebuggerStatement):
+        (JSC::::parseBlockStatement):
+        (JSC::::parseStatement):
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::::parseExpressionOrLabelStatement):
+        (JSC::::parseExpressionStatement):
+        (JSC::::parseIfStatement):
+        (JSC::::parseExpression):
+        (JSC::::parseAssignmentExpression):
+        (JSC::::parseConditionalExpression):
+        (JSC::::parseBinaryExpression):
+        (JSC::::parseProperty):
+        (JSC::::parseObjectLiteral):
+        (JSC::::parseStrictObjectLiteral):
+        (JSC::::parseArrayLiteral):
+        (JSC::::parsePrimaryExpression):
+        (JSC::::parseArguments):
+        (JSC::::parseMemberExpression):
+        (JSC::::parseUnaryExpression):
+        * parser/Parser.h:
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        (JSC::Parser::tokenStart):
+        (JSC::Parser::tokenLine):
+        (JSC::Parser::tokenEnd):
+        (JSC::Parser::tokenLocation):
+        (Parser):
+        (JSC::Parser::getTokenName):
+        (JSC::::parse):
+        * parser/ParserTokens.h:
+        (JSC::JSTokenLocation::JSTokenLocation):
+        (JSTokenLocation):
+        (JSToken):
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::closeBraceToken):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegExp):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createArgumentsList):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createForLoop):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createVarStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::createDebugger):
+        (JSC::SyntaxChecker::createConstStatement):
+        (JSC::SyntaxChecker::appendConstDecl):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::combineCommaNodes):
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2012-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps
+        https://bugs.webkit.org/show_bug.cgi?id=92691
+
+        Reviewed by Mark Hahnenberg.
+
+        The state of the stubs was changing after we determined the type (by virtue of the slow path
+        function that was called), since the get or put (in this case put) could cause arbitrary
+        side effects. Perhaps a full-blown fix would be to eliminate our reliance of the slow path
+        function to determine what to do, but an easier fix for now is to have the slow path give up
+        if its assumptions were invalidated by a side effect.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2012-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG handling of get_by_id should always inject a ForceOSRExit node if there is no prediction
+        https://bugs.webkit.org/show_bug.cgi?id=93162
+
+        Reviewed by Mark Hahnenberg.
+
+        This simplifies the DFG IR by ensuring that all nodes that use value profiles will be preceded
+        by a ForceOSRExit if the value profile had no data.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2012-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::StructureCheckHoistingPhase keeps a Node& around for too long
+        https://bugs.webkit.org/show_bug.cgi?id=93157
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Move getLocalTime() as static inline function to DateMath
+        https://bugs.webkit.org/show_bug.cgi?id=92955
+
+        Reviewed by Ryosuke Niwa.
+
+        getCurrentLocalTime() and getLocalTime() has been superseded with the
+        GregorianDateTime class. So we can move it into DateMath.cpp as an static inline
+        function. This allows us to remove the dependecy on time() and localtime()
+        for Windows CE, where this functions require the ce_time library to work.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes
+        https://bugs.webkit.org/show_bug.cgi?id=91074
+
+        Reviewed by Mark Hahnenberg.
+
+        Fixes a bug where the speculative JIT was performing an unnecessary speculation that the
+        CFA had proven shouldn't be performed, leading to asserts that a node should not have
+        exit sites. This is a debug-only assert with no release symptom - we were just emitting
+        a check that was not reachable.
+        
+        Also found, and fixed, a bug where structure check hoisting was slightly confusing the
+        CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which
+        would make the backend happy - but the CFA would produce subtly wrong results.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isOtherOrEmptySpeculation):
+        (JSC):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+
+2012-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix for DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE).
+
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove all uses of ClassInfo for JSStrings in JIT code
+        https://bugs.webkit.org/show_bug.cgi?id=92935
+
+        Reviewed by Geoffrey Garen.
+
+        This is the first step in removing our dependence on in-object ClassInfo pointers
+        in JIT code. Most of the changes are to check the Structure, which is unique for 
+        JSString primitives.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromClassInfo):
+        (JSC::speculationFromStructure): Changed to check the TypeInfo in the Structure
+        since there wasn't a JSGlobalData immediately available to grab the JSString 
+        Structure out of.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadCharacterString):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_convert_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_convert_this):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::loadJSStringArgument):
+        * jit/ThunkGenerators.cpp:
+        (JSC::stringCharLoad):
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+
+2012-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, missed a style goof in the previous patch: "NodeIndex nodeIndex"
+        in a method signature is painfully redundant.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2012-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGSpeculativeJIT.h has too many inline method bodies
+        https://bugs.webkit.org/show_bug.cgi?id=92957
+
+        Reviewed by Antti Koivisto.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2012-08-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124406.
+        http://trac.webkit.org/changeset/124406
+        https://bugs.webkit.org/show_bug.cgi?id=92951
+
+        it set the Mac bots on fire (Requested by pizlo on #webkit).
+
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::debug):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * parser/ASTBuilder.h:
+        (ASTBuilder):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::createLogicalNot):
+        (JSC::ASTBuilder::createUnaryPlus):
+        (JSC::ASTBuilder::createVoid):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createObjectLiteral):
+        (JSC::ASTBuilder::createArray):
+        (JSC::ASTBuilder::createNumberExpr):
+        (JSC::ASTBuilder::createString):
+        (JSC::ASTBuilder::createBoolean):
+        (JSC::ASTBuilder::createNull):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegExp):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createPropertyList):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendConstDecl):
+        (JSC::ASTBuilder::combineCommaNodes):
+        (JSC::ASTBuilder::appendBinaryOperation):
+        (JSC::ASTBuilder::createAssignment):
+        (JSC::ASTBuilder::createNumber):
+        (JSC::ASTBuilder::makeTypeOfNode):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/Lexer.cpp:
+        (JSC::::setCode):
+        (JSC::::internalShift):
+        (JSC::::shift):
+        (JSC::::lex):
+        * parser/Lexer.h:
+        (Lexer):
+        (JSC::::lexExpectIdentifier):
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        (JSC::ExpressionNode::ExpressionNode):
+        (JSC::StatementNode::StatementNode):
+        (JSC::NullNode::NullNode):
+        (JSC::BooleanNode::BooleanNode):
+        (JSC::NumberNode::NumberNode):
+        (JSC::StringNode::StringNode):
+        (JSC::RegExpNode::RegExpNode):
+        (JSC::ThisNode::ThisNode):
+        (JSC::ResolveNode::ResolveNode):
+        (JSC::ArrayNode::ArrayNode):
+        (JSC::PropertyListNode::PropertyListNode):
+        (JSC::ObjectLiteralNode::ObjectLiteralNode):
+        (JSC::BracketAccessorNode::BracketAccessorNode):
+        (JSC::DotAccessorNode::DotAccessorNode):
+        (JSC::ArgumentListNode::ArgumentListNode):
+        (JSC::NewExprNode::NewExprNode):
+        (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
+        (JSC::FunctionCallValueNode::FunctionCallValueNode):
+        (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
+        (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
+        (JSC::FunctionCallDotNode::FunctionCallDotNode):
+        (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
+        (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
+        (JSC::PrePostResolveNode::PrePostResolveNode):
+        (JSC::PostfixResolveNode::PostfixResolveNode):
+        (JSC::PostfixBracketNode::PostfixBracketNode):
+        (JSC::PostfixDotNode::PostfixDotNode):
+        (JSC::PostfixErrorNode::PostfixErrorNode):
+        (JSC::DeleteResolveNode::DeleteResolveNode):
+        (JSC::DeleteBracketNode::DeleteBracketNode):
+        (JSC::DeleteDotNode::DeleteDotNode):
+        (JSC::DeleteValueNode::DeleteValueNode):
+        (JSC::VoidNode::VoidNode):
+        (JSC::TypeOfResolveNode::TypeOfResolveNode):
+        (JSC::TypeOfValueNode::TypeOfValueNode):
+        (JSC::PrefixResolveNode::PrefixResolveNode):
+        (JSC::PrefixBracketNode::PrefixBracketNode):
+        (JSC::PrefixDotNode::PrefixDotNode):
+        (JSC::PrefixErrorNode::PrefixErrorNode):
+        (JSC::UnaryOpNode::UnaryOpNode):
+        (JSC::UnaryPlusNode::UnaryPlusNode):
+        (JSC::NegateNode::NegateNode):
+        (JSC::BitwiseNotNode::BitwiseNotNode):
+        (JSC::LogicalNotNode::LogicalNotNode):
+        (JSC::BinaryOpNode::BinaryOpNode):
+        (JSC::MultNode::MultNode):
+        (JSC::DivNode::DivNode):
+        (JSC::ModNode::ModNode):
+        (JSC::AddNode::AddNode):
+        (JSC::SubNode::SubNode):
+        (JSC::LeftShiftNode::LeftShiftNode):
+        (JSC::RightShiftNode::RightShiftNode):
+        (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
+        (JSC::LessNode::LessNode):
+        (JSC::GreaterNode::GreaterNode):
+        (JSC::LessEqNode::LessEqNode):
+        (JSC::GreaterEqNode::GreaterEqNode):
+        (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode):
+        (JSC::InstanceOfNode::InstanceOfNode):
+        (JSC::InNode::InNode):
+        (JSC::EqualNode::EqualNode):
+        (JSC::NotEqualNode::NotEqualNode):
+        (JSC::StrictEqualNode::StrictEqualNode):
+        (JSC::NotStrictEqualNode::NotStrictEqualNode):
+        (JSC::BitAndNode::BitAndNode):
+        (JSC::BitOrNode::BitOrNode):
+        (JSC::BitXOrNode::BitXOrNode):
+        (JSC::LogicalOpNode::LogicalOpNode):
+        (JSC::ConditionalNode::ConditionalNode):
+        (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
+        (JSC::AssignResolveNode::AssignResolveNode):
+        (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
+        (JSC::AssignBracketNode::AssignBracketNode):
+        (JSC::AssignDotNode::AssignDotNode):
+        (JSC::ReadModifyDotNode::ReadModifyDotNode):
+        (JSC::AssignErrorNode::AssignErrorNode):
+        (JSC::CommaNode::CommaNode):
+        (JSC::ConstStatementNode::ConstStatementNode):
+        (JSC::EmptyStatementNode::EmptyStatementNode):
+        (JSC::DebuggerStatementNode::DebuggerStatementNode):
+        (JSC::ExprStatementNode::ExprStatementNode):
+        (JSC::VarStatementNode::VarStatementNode):
+        (JSC::IfNode::IfNode):
+        (JSC::IfElseNode::IfElseNode):
+        (JSC::DoWhileNode::DoWhileNode):
+        (JSC::WhileNode::WhileNode):
+        (JSC::ForNode::ForNode):
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ReturnNode::ReturnNode):
+        (JSC::WithNode::WithNode):
+        (JSC::LabelNode::LabelNode):
+        (JSC::ThrowNode::ThrowNode):
+        (JSC::TryNode::TryNode):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        (JSC::SwitchNode::SwitchNode):
+        (JSC::ConstDeclNode::ConstDeclNode):
+        (JSC::BlockNode::BlockNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.cpp:
+        (JSC):
+        (JSC::StatementNode::setLoc):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (Node):
+        (ExpressionNode):
+        (StatementNode):
+        (NullNode):
+        (BooleanNode):
+        (NumberNode):
+        (StringNode):
+        (RegExpNode):
+        (ThisNode):
+        (ResolveNode):
+        (ArrayNode):
+        (PropertyListNode):
+        (ObjectLiteralNode):
+        (BracketAccessorNode):
+        (DotAccessorNode):
+        (ArgumentListNode):
+        (NewExprNode):
+        (EvalFunctionCallNode):
+        (FunctionCallValueNode):
+        (FunctionCallResolveNode):
+        (FunctionCallBracketNode):
+        (FunctionCallDotNode):
+        (CallFunctionCallDotNode):
+        (ApplyFunctionCallDotNode):
+        (PrePostResolveNode):
+        (PostfixResolveNode):
+        (PostfixBracketNode):
+        (PostfixDotNode):
+        (PostfixErrorNode):
+        (DeleteResolveNode):
+        (DeleteBracketNode):
+        (DeleteDotNode):
+        (DeleteValueNode):
+        (VoidNode):
+        (TypeOfResolveNode):
+        (TypeOfValueNode):
+        (PrefixResolveNode):
+        (PrefixBracketNode):
+        (PrefixDotNode):
+        (PrefixErrorNode):
+        (UnaryOpNode):
+        (UnaryPlusNode):
+        (NegateNode):
+        (BitwiseNotNode):
+        (LogicalNotNode):
+        (BinaryOpNode):
+        (MultNode):
+        (DivNode):
+        (ModNode):
+        (AddNode):
+        (SubNode):
+        (LeftShiftNode):
+        (RightShiftNode):
+        (UnsignedRightShiftNode):
+        (LessNode):
+        (GreaterNode):
+        (LessEqNode):
+        (GreaterEqNode):
+        (ThrowableBinaryOpNode):
+        (InstanceOfNode):
+        (InNode):
+        (EqualNode):
+        (NotEqualNode):
+        (StrictEqualNode):
+        (NotStrictEqualNode):
+        (BitAndNode):
+        (BitOrNode):
+        (BitXOrNode):
+        (LogicalOpNode):
+        (ConditionalNode):
+        (ReadModifyResolveNode):
+        (AssignResolveNode):
+        (ReadModifyBracketNode):
+        (AssignBracketNode):
+        (AssignDotNode):
+        (ReadModifyDotNode):
+        (AssignErrorNode):
+        (CommaNode):
+        (ConstDeclNode):
+        (ConstStatementNode):
+        (BlockNode):
+        (EmptyStatementNode):
+        (DebuggerStatementNode):
+        (ExprStatementNode):
+        (VarStatementNode):
+        (IfNode):
+        (IfElseNode):
+        (DoWhileNode):
+        (WhileNode):
+        (ForNode):
+        (ForInNode):
+        (ContinueNode):
+        (BreakNode):
+        (ReturnNode):
+        (WithNode):
+        (LabelNode):
+        (ThrowNode):
+        (TryNode):
+        (ScopeNode):
+        (ProgramNode):
+        (EvalNode):
+        (FunctionBodyNode):
+        (FuncExprNode):
+        (FuncDeclNode):
+        (SwitchNode):
+        * parser/Parser.cpp:
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseConstDeclaration):
+        (JSC::::parseDoWhileStatement):
+        (JSC::::parseWhileStatement):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseConstDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseBreakStatement):
+        (JSC::::parseContinueStatement):
+        (JSC::::parseReturnStatement):
+        (JSC::::parseThrowStatement):
+        (JSC::::parseWithStatement):
+        (JSC::::parseSwitchStatement):
+        (JSC::::parseTryStatement):
+        (JSC::::parseDebuggerStatement):
+        (JSC::::parseBlockStatement):
+        (JSC::::parseStatement):
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::::parseExpressionOrLabelStatement):
+        (JSC::::parseExpressionStatement):
+        (JSC::::parseIfStatement):
+        (JSC::::parseExpression):
+        (JSC::::parseAssignmentExpression):
+        (JSC::::parseConditionalExpression):
+        (JSC::::parseBinaryExpression):
+        (JSC::::parseProperty):
+        (JSC::::parseObjectLiteral):
+        (JSC::::parseStrictObjectLiteral):
+        (JSC::::parseArrayLiteral):
+        (JSC::::parsePrimaryExpression):
+        (JSC::::parseArguments):
+        (JSC::::parseMemberExpression):
+        (JSC::::parseUnaryExpression):
+        * parser/Parser.h:
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        (JSC::Parser::tokenStart):
+        (JSC::Parser::tokenLine):
+        (JSC::Parser::tokenEnd):
+        (JSC::Parser::getTokenName):
+        (JSC::::parse):
+        * parser/ParserTokens.h:
+        (JSC::JSTokenInfo::JSTokenInfo):
+        (JSTokenInfo):
+        (JSToken):
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::closeBraceToken):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegExp):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createArgumentsList):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createForLoop):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createVarStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::createDebugger):
+        (JSC::SyntaxChecker::createConstStatement):
+        (JSC::SyntaxChecker::appendConstDecl):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::combineCommaNodes):
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2012-08-01  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: [JSC] implement setting breakpoints by line:column
+        https://bugs.webkit.org/show_bug.cgi?id=53003
+
+        Reviewed by Geoffrey Garen.
+
+        Add a counter in lexer to record the column of each token. Debugger will use column info
+        in "Pretty Print" debug mode of Inspector.
+
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::debug):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * parser/ASTBuilder.h:
+        (ASTBuilder):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::createLogicalNot):
+        (JSC::ASTBuilder::createUnaryPlus):
+        (JSC::ASTBuilder::createVoid):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createObjectLiteral):
+        (JSC::ASTBuilder::createArray):
+        (JSC::ASTBuilder::createNumberExpr):
+        (JSC::ASTBuilder::createString):
+        (JSC::ASTBuilder::createBoolean):
+        (JSC::ASTBuilder::createNull):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegExp):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createPropertyList):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendConstDecl):
+        (JSC::ASTBuilder::combineCommaNodes):
+        (JSC::ASTBuilder::appendBinaryOperation):
+        (JSC::ASTBuilder::createAssignment):
+        (JSC::ASTBuilder::createNumber):
+        (JSC::ASTBuilder::makeTypeOfNode):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/Lexer.cpp:
+        (JSC::::setCode):
+        (JSC::::internalShift):
+        (JSC::::shift):
+        (JSC::::lex):
+        * parser/Lexer.h:
+        (Lexer):
+        (JSC::Lexer::currentColumnNumber):
+        (JSC::::lexExpectIdentifier):
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        (JSC::ExpressionNode::ExpressionNode):
+        (JSC::StatementNode::StatementNode):
+        (JSC::NullNode::NullNode):
+        (JSC::BooleanNode::BooleanNode):
+        (JSC::NumberNode::NumberNode):
+        (JSC::StringNode::StringNode):
+        (JSC::RegExpNode::RegExpNode):
+        (JSC::ThisNode::ThisNode):
+        (JSC::ResolveNode::ResolveNode):
+        (JSC::ArrayNode::ArrayNode):
+        (JSC::PropertyListNode::PropertyListNode):
+        (JSC::ObjectLiteralNode::ObjectLiteralNode):
+        (JSC::BracketAccessorNode::BracketAccessorNode):
+        (JSC::DotAccessorNode::DotAccessorNode):
+        (JSC::ArgumentListNode::ArgumentListNode):
+        (JSC::NewExprNode::NewExprNode):
+        (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
+        (JSC::FunctionCallValueNode::FunctionCallValueNode):
+        (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
+        (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
+        (JSC::FunctionCallDotNode::FunctionCallDotNode):
+        (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
+        (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
+        (JSC::PrePostResolveNode::PrePostResolveNode):
+        (JSC::PostfixResolveNode::PostfixResolveNode):
+        (JSC::PostfixBracketNode::PostfixBracketNode):
+        (JSC::PostfixDotNode::PostfixDotNode):
+        (JSC::PostfixErrorNode::PostfixErrorNode):
+        (JSC::DeleteResolveNode::DeleteResolveNode):
+        (JSC::DeleteBracketNode::DeleteBracketNode):
+        (JSC::DeleteDotNode::DeleteDotNode):
+        (JSC::DeleteValueNode::DeleteValueNode):
+        (JSC::VoidNode::VoidNode):
+        (JSC::TypeOfResolveNode::TypeOfResolveNode):
+        (JSC::TypeOfValueNode::TypeOfValueNode):
+        (JSC::PrefixResolveNode::PrefixResolveNode):
+        (JSC::PrefixBracketNode::PrefixBracketNode):
+        (JSC::PrefixDotNode::PrefixDotNode):
+        (JSC::PrefixErrorNode::PrefixErrorNode):
+        (JSC::UnaryOpNode::UnaryOpNode):
+        (JSC::UnaryPlusNode::UnaryPlusNode):
+        (JSC::NegateNode::NegateNode):
+        (JSC::BitwiseNotNode::BitwiseNotNode):
+        (JSC::LogicalNotNode::LogicalNotNode):
+        (JSC::BinaryOpNode::BinaryOpNode):
+        (JSC::MultNode::MultNode):
+        (JSC::DivNode::DivNode):
+        (JSC::ModNode::ModNode):
+        (JSC::AddNode::AddNode):
+        (JSC::SubNode::SubNode):
+        (JSC::LeftShiftNode::LeftShiftNode):
+        (JSC::RightShiftNode::RightShiftNode):
+        (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
+        (JSC::LessNode::LessNode):
+        (JSC::GreaterNode::GreaterNode):
+        (JSC::LessEqNode::LessEqNode):
+        (JSC::GreaterEqNode::GreaterEqNode):
+        (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode):
+        (JSC::InstanceOfNode::InstanceOfNode):
+        (JSC::InNode::InNode):
+        (JSC::EqualNode::EqualNode):
+        (JSC::NotEqualNode::NotEqualNode):
+        (JSC::StrictEqualNode::StrictEqualNode):
+        (JSC::NotStrictEqualNode::NotStrictEqualNode):
+        (JSC::BitAndNode::BitAndNode):
+        (JSC::BitOrNode::BitOrNode):
+        (JSC::BitXOrNode::BitXOrNode):
+        (JSC::LogicalOpNode::LogicalOpNode):
+        (JSC::ConditionalNode::ConditionalNode):
+        (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
+        (JSC::AssignResolveNode::AssignResolveNode):
+        (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
+        (JSC::AssignBracketNode::AssignBracketNode):
+        (JSC::AssignDotNode::AssignDotNode):
+        (JSC::ReadModifyDotNode::ReadModifyDotNode):
+        (JSC::AssignErrorNode::AssignErrorNode):
+        (JSC::CommaNode::CommaNode):
+        (JSC::ConstStatementNode::ConstStatementNode):
+        (JSC::EmptyStatementNode::EmptyStatementNode):
+        (JSC::DebuggerStatementNode::DebuggerStatementNode):
+        (JSC::ExprStatementNode::ExprStatementNode):
+        (JSC::VarStatementNode::VarStatementNode):
+        (JSC::IfNode::IfNode):
+        (JSC::IfElseNode::IfElseNode):
+        (JSC::DoWhileNode::DoWhileNode):
+        (JSC::WhileNode::WhileNode):
+        (JSC::ForNode::ForNode):
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ReturnNode::ReturnNode):
+        (JSC::WithNode::WithNode):
+        (JSC::LabelNode::LabelNode):
+        (JSC::ThrowNode::ThrowNode):
+        (JSC::TryNode::TryNode):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        (JSC::SwitchNode::SwitchNode):
+        (JSC::ConstDeclNode::ConstDeclNode):
+        (JSC::BlockNode::BlockNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.cpp:
+        (JSC::StatementNode::setLoc):
+        (JSC):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (Node):
+        (JSC::Node::columnNo):
+        (ExpressionNode):
+        (StatementNode):
+        (JSC::StatementNode::column):
+        (NullNode):
+        (BooleanNode):
+        (NumberNode):
+        (StringNode):
+        (RegExpNode):
+        (ThisNode):
+        (ResolveNode):
+        (ArrayNode):
+        (PropertyListNode):
+        (ObjectLiteralNode):
+        (BracketAccessorNode):
+        (DotAccessorNode):
+        (ArgumentListNode):
+        (NewExprNode):
+        (EvalFunctionCallNode):
+        (FunctionCallValueNode):
+        (FunctionCallResolveNode):
+        (FunctionCallBracketNode):
+        (FunctionCallDotNode):
+        (CallFunctionCallDotNode):
+        (ApplyFunctionCallDotNode):
+        (PrePostResolveNode):
+        (PostfixResolveNode):
+        (PostfixBracketNode):
+        (PostfixDotNode):
+        (PostfixErrorNode):
+        (DeleteResolveNode):
+        (DeleteBracketNode):
+        (DeleteDotNode):
+        (DeleteValueNode):
+        (VoidNode):
+        (TypeOfResolveNode):
+        (TypeOfValueNode):
+        (PrefixResolveNode):
+        (PrefixBracketNode):
+        (PrefixDotNode):
+        (PrefixErrorNode):
+        (UnaryOpNode):
+        (UnaryPlusNode):
+        (NegateNode):
+        (BitwiseNotNode):
+        (LogicalNotNode):
+        (BinaryOpNode):
+        (MultNode):
+        (DivNode):
+        (ModNode):
+        (AddNode):
+        (SubNode):
+        (LeftShiftNode):
+        (RightShiftNode):
+        (UnsignedRightShiftNode):
+        (LessNode):
+        (GreaterNode):
+        (LessEqNode):
+        (GreaterEqNode):
+        (ThrowableBinaryOpNode):
+        (InstanceOfNode):
+        (InNode):
+        (EqualNode):
+        (NotEqualNode):
+        (StrictEqualNode):
+        (NotStrictEqualNode):
+        (BitAndNode):
+        (BitOrNode):
+        (BitXOrNode):
+        (LogicalOpNode):
+        (ConditionalNode):
+        (ReadModifyResolveNode):
+        (AssignResolveNode):
+        (ReadModifyBracketNode):
+        (AssignBracketNode):
+        (AssignDotNode):
+        (ReadModifyDotNode):
+        (AssignErrorNode):
+        (CommaNode):
+        (ConstDeclNode):
+        (ConstStatementNode):
+        (BlockNode):
+        (EmptyStatementNode):
+        (DebuggerStatementNode):
+        (ExprStatementNode):
+        (VarStatementNode):
+        (IfNode):
+        (IfElseNode):
+        (DoWhileNode):
+        (WhileNode):
+        (ForNode):
+        (ForInNode):
+        (ContinueNode):
+        (BreakNode):
+        (ReturnNode):
+        (WithNode):
+        (LabelNode):
+        (ThrowNode):
+        (TryNode):
+        (ScopeNode):
+        (ProgramNode):
+        (EvalNode):
+        (FunctionBodyNode):
+        (FuncExprNode):
+        (FuncDeclNode):
+        (SwitchNode):
+        * parser/Parser.cpp:
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseConstDeclaration):
+        (JSC::::parseDoWhileStatement):
+        (JSC::::parseWhileStatement):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseConstDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseBreakStatement):
+        (JSC::::parseContinueStatement):
+        (JSC::::parseReturnStatement):
+        (JSC::::parseThrowStatement):
+        (JSC::::parseWithStatement):
+        (JSC::::parseSwitchStatement):
+        (JSC::::parseTryStatement):
+        (JSC::::parseDebuggerStatement):
+        (JSC::::parseBlockStatement):
+        (JSC::::parseStatement):
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::::parseExpressionOrLabelStatement):
+        (JSC::::parseExpressionStatement):
+        (JSC::::parseIfStatement):
+        (JSC::::parseExpression):
+        (JSC::::parseAssignmentExpression):
+        (JSC::::parseConditionalExpression):
+        (JSC::::parseBinaryExpression):
+        (JSC::::parseProperty):
+        (JSC::::parseObjectLiteral):
+        (JSC::::parseStrictObjectLiteral):
+        (JSC::::parseArrayLiteral):
+        (JSC::::parsePrimaryExpression):
+        (JSC::::parseArguments):
+        (JSC::::parseMemberExpression):
+        (JSC::::parseUnaryExpression):
+        * parser/Parser.h:
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        (JSC::Parser::tokenStart):
+        (JSC::Parser::tokenLine):
+        (JSC::Parser::tokenEnd):
+        (JSC::Parser::tokenLocation):
+        (Parser):
+        (JSC::Parser::getTokenName):
+        (JSC::::parse):
+        * parser/ParserTokens.h:
+        (JSC::JSTokenLocation::JSTokenLocation):
+        (JSTokenLocation):
+        (JSToken):
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::closeBraceToken):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegExp):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createArgumentsList):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createForLoop):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createVarStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::createDebugger):
+        (JSC::SyntaxChecker::createConstStatement):
+        (JSC::SyntaxChecker::appendConstDecl):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::combineCommaNodes):
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2012-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should hoist structure checks
+        https://bugs.webkit.org/show_bug.cgi?id=92696
+
+        Reviewed by Gavin Barraclough.
+
+        This hoists structure checks in the same way that we would hoist array checks, but with added
+        complexity to cope with the fact that the structure of an object may change. This is handled
+        by performing a side effects analysis over the region in which the respective variable is
+        live. If a structure clobbering side effect may happen then we either hoist the structure
+        checks and fall back on structure transition watchpoints (if the watchpoint set is still
+        valid), or we avoid hoisting altogether.
+        
+        Doing this required teaching the CFA that we may have an expectation that an object has a
+        particular structure even after structure clobbering happens, in the sense that structure
+        proofs that were cobbered can be revived using watchpoints. CFA must know about this so that
+        OSR entry may know about it, since we cannot allow entry to happen if the variable has a
+        clobbered structure proof, will have a watchpoint to revive the proof, and the variable in
+        the baseline JIT has a completely unrelated structure.
+        
+        This is mostly performance neutral.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::isSet):
+        (JSC::ValueRecovery::operator!):
+        (ValueRecovery):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::clobberWorld):
+        (DFG):
+        (JSC::DFG::AbstractState::clobberCapturedVars):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::clear):
+        (JSC::DFG::AbstractValue::isClear):
+        (JSC::DFG::AbstractValue::makeTop):
+        (JSC::DFG::AbstractValue::isTop):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::operator==):
+        (JSC::DFG::AbstractValue::merge):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::validate):
+        (JSC::DFG::AbstractValue::validateForEntry):
+        (AbstractValue):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::getLocalLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::vote):
+        (Graph):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
+        (Node):
+        (JSC::DFG::Node::hasStructureSet):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (PredictionPropagationPhase):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (JSC::DFG::SpeculateCellOperand::gpr):
+        (SpeculateCellOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp: Added.
+        (DFG):
+        (StructureCheckHoistingPhase):
+        (JSC::DFG::StructureCheckHoistingPhase::StructureCheckHoistingPhase):
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
+        (JSC::DFG::StructureCheckHoistingPhase::clobber):
+        (CheckData):
+        (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData):
+        (JSC::DFG::performStructureCheckHoisting):
+        * dfg/DFGStructureCheckHoistingPhase.h: Added.
+        (DFG):
+        * dfg/DFGVariableAccessData.h:
+        (VariableAccessData):
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed):
+        (JSC::DFG::VariableAccessData::structureCheckHoistingFailed):
+        (JSC::DFG::VariableAccessData::clearVotes):
+        (JSC::DFG::VariableAccessData::vote):
+        (JSC::DFG::VariableAccessData::voteRatio):
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        * runtime/Options.h:
+        (JSC):
+
+2012-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should distinguish between PutByVal's that clobber the world and ones that don't
+        https://bugs.webkit.org/show_bug.cgi?id=92923
+
+        Reviewed by Mark Hahnenberg.
+
+        This is performance-neutral. I also confirmed that it's neutral if we make the
+        clobbering variant (PutByValSafe) clobber all knowledge of what is an array,
+        which should feed nicely into work on removing uses of ClassInfo.
+
+        * bytecode/DFGExitProfile.h:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port
+        https://bugs.webkit.org/show_bug.cgi?id=90298
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig: Add ENABLE_WIDGET_REGION define.
+
+2012-08-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Replace WTF::getCurrentLocalTime() with GregorianDateTime::setToCurrentLocalTime()
+        https://bugs.webkit.org/show_bug.cgi?id=92286
+
+        Reviewed by Geoffrey Garen.
+
+        Add a method to GregorianDateTime to set its values to the current locale time.
+        Replacing all occurrences of getCurrentLocalTime with the new function allows
+        us to remove getCurrentLocalTime in a next step.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        C++ code should get ClassInfo from the Structure
+        https://bugs.webkit.org/show_bug.cgi?id=92892
+
+        Reviewed by Geoffrey Garen.
+
+        In our march to remove ClassInfo from our JSCell object headers, we can switch 
+        C++ code over to grabbing the ClassInfo from the Structure since it is finally 
+        safe to do so now that Structure access is safe during finalization/destruction. 
+        The remaining JIT code changes can be done in a separate patch.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::callDestructor): We don't want to clear the Structure any more 
+        since the Structure should still be valid at this point.
+        * heap/WeakSetInlines.h:
+        (JSC::WeakBlock::finalize): Ditto.
+        * runtime/JSCell.h:
+        (JSC):
+        * runtime/Structure.h:
+        (JSC::JSCell::classInfo): Move JSCell's classInfo() to Structure.h so it can be 
+        inline. Use a different method of getting the JSCell's Structure based on 
+        whether we're in GC_VALIDATION mode or not, since always using get() will cause 
+        infinite recursion in GC_VALIDATION mode.
+        (JSC):
+
+2012-07-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        MarkedBlock::sweep() should sweep another block if it can't sweep a Structure block
+        https://bugs.webkit.org/show_bug.cgi?id=92819
+
+        Reviewed by Geoffrey Garen.
+
+        If we are forced to allocate a new block for Structures because we are unable to safely 
+        sweep our pre-existing Structure blocks, we should sweep another random block so that we 
+        can start sweeping Structure blocks sooner.
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doSweep): Change to use sweepNextBlock.
+        (JSC):
+        (JSC::IncrementalSweeper::sweepNextBlock): 
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper): When we can't safely sweep 
+        our Structure blocks, call sweepNextBlock instead.
+
+2012-07-31  Sam Weinig  <sam@webkit.org>
+
+        Fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Maybe fix the GCC build.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): Accommodate incorrect parsing in GCC.
+
+2012-07-31  Sam Weinig  <sam@webkit.org>
+
+        Stop masking 8 bits off of the visited link hash. We need all the bits!
+        https://bugs.webkit.org/show_bug.cgi?id=92799
+
+        Reviewed by Anders Carlsson.
+
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierCStringTranslator::hash):
+        (JSC::IdentifierLCharFromUCharTranslator::hash):
+        * runtime/Identifier.h:
+        (JSC::IdentifierCharBufferTranslator::hash):
+        Update for new function names.
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Maybe break the Windows build.
+
+        Reviewed by Anders Carlsson.
+
+        Formally objected to by Sam Weinig.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): Try to slightly improve this because we don't want Windows to control our lives.
+
+2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Structures should be swept after all other objects
+        https://bugs.webkit.org/show_bug.cgi?id=92679
+
+        Reviewed by Filip Pizlo.
+
+        In order to get rid of ClassInfo from our objects, we need to be able to safely get the 
+        ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the 
+        Structure, but currently it is not safe to do so because the order of destruction of objects 
+        is not guaranteed to sweep objects before their corresponding Structure. We can fix this by 
+        sweeping Structures after everything else.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
+        If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is 
+        safe to sweep structures since we'll always do Structures last anyways due to the ordering of 
+        MarkedSpace::forEachBlock.
+        (JSC):
+        (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
+        calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out 
+        these pointers after it has invalidated them to prevent accidental use-after-free in the sweep() 
+        calls during lastChanceToFinalize().
+        * heap/Heap.h:
+        (Heap):
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
+        This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
+        the first time.
+        (JSC):
+        (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we 
+        make our first pass. We now null out the slots as we sweep them so that we can quickly find the 
+        Structures during the second pass.
+        (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
+        (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify 
+        the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can 
+        assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock 
+        iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
+        (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
+        * heap/IncrementalSweeper.h: Add declarations for new stuff.
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and 
+        if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing 
+        the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that 
+        will sweep some number of other blocks in place of the current block to mitigate the cost of the floating 
+        Structure garbage.
+        (JSC::MarkedAllocator::addBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no 
+        longer valid to allocate from, so we set the current block to null.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
+        at an unsafe time.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
+        (JSC): 
+        * heap/MarkedSpace.h:
+        (JSC):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Fix all the other builds I just broke. Maybe fix the Windows build.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): WTF?
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Maybe fix the Windows build.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): WTF?
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Maybe fix the Windows build.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): WTF?
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed some public data and casting from the Heap
+        https://bugs.webkit.org/show_bug.cgi?id=92777
+
+        Reviewed by Oliver Hunt.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::releaseFreeBlocks):
+        (JSC::BlockAllocator::blockFreeingThreadMain): Use the DeadBlock class
+        since HeapBlock is a template, and not a class, now. Call destroy()
+        instead of monkeying around with DeadBlock's internal data because
+        encapsulation is good.
+
+        * heap/BlockAllocator.h:
+        (DeadBlock): Added a class to represent a dead block, since HeapBlock is
+        a template now, and can't be instantiated directly.
+
+        (JSC::DeadBlock::DeadBlock):
+        (JSC::DeadBlock::create):
+        (BlockAllocator):
+        (JSC::BlockAllocator::allocate):
+        (JSC::BlockAllocator::deallocate): Use the DeadBlock class because
+        encapsulation is good.
+
+        * heap/CopiedBlock.h:
+        (CopiedBlock::destroy): No need for a destroy() function, since we
+        inherit one now.
+
+        (JSC::CopiedBlock::CopiedBlock):
+        (JSC::CopiedBlock::payloadEnd):
+        (JSC::CopiedBlock::capacity): Updated for some encapsulation inside
+        HeapBlock.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::~CopiedSpace):
+        (JSC::CopiedSpace::doneCopying):
+        (JSC::CopiedSpace::size):
+        (JSC::CopiedSpace::capacity):
+        (JSC::isBlockListPagedOut): Removed a bunch of casting. This is no longer
+        necessary, now that our list and its nodes have the right type.
+
+        * heap/CopiedSpace.h: Use the right type in our data structures because
+        it improves clarity.
+
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::startedCopying): Use swap to avoid duplicating it.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): Made this a class template so we can return the right type
+        in linked list operations. Made our data private because encapsulation
+        is good.
+
+        (JSC::HeapBlock::destroy): Since we know our type, we can also eliminate
+        duplicate destroy() functions in our subclasses.
+
+        (JSC::HeapBlock::allocation): Added an accessor so we can hide our data.
+        By using const, this accessor prevents clients from accidentally deleting
+        our allocation.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::isPagedOut):
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::removeBlock): Removed a bunch of casting. This is
+        no longer necessary, now that our list and its nodes have the right type.
+
+        * heap/MarkedAllocator.h:
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::reset):
+        (JSC::MarkedAllocator::forEachBlock): Use the right type, do less casting.
+
+        * heap/MarkedBlock.cpp: 
+        (JSC::MarkedBlock::destroy): Removed this function because our parent
+        class provides it for us now.
+
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::capacity): Updated for encapsulation.
+
+2012-07-31  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit profiling has unusual oversights
+        https://bugs.webkit.org/show_bug.cgi?id=92728
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-07-31  Chao-ying Fu  <fu@mips.com>
+
+        Add MIPS add32 function
+        https://bugs.webkit.org/show_bug.cgi?id=91522
+
+        Reviewed by Oliver Hunt.
+
+        Add isCompactPtrAlignedAddressOffset.
+        Add a new version of add32 that accepts AbsoluteAddress as inputs.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::isCompactPtrAlignedAddressOffset): New.
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::add32): Support AbsoluteAddress as inputs.
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124123.
+        http://trac.webkit.org/changeset/124123
+        https://bugs.webkit.org/show_bug.cgi?id=92700
+
+        ASSERT crashes terminate webkit Layout tests (Requested by
+        msaboff on #webkit).
+
+        * heap/Heap.cpp:
+        * heap/Heap.h:
+        (Heap):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doSweep):
+        (JSC::IncrementalSweeper::startSweeping):
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::addBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::zapFreeList):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweepHelper):
+        * heap/MarkedSpace.cpp:
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::sweep):
+        (JSC):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData):
+
+2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Structures should be swept after all other objects
+        https://bugs.webkit.org/show_bug.cgi?id=92679
+
+        Reviewed by Filip Pizlo.
+
+        In order to get rid of ClassInfo from our objects, we need to be able to safely get the 
+        ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the 
+        Structure, but currently it is not safe to do so because the order of destruction of objects 
+        is not guaranteed to sweep objects before their corresponding Structure. We can fix this by 
+        sweeping Structures after everything else.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
+        If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is 
+        safe to sweep structures since we'll always do Structures last anyways due to the ordering of 
+        MarkedSpace::forEachBlock.
+        (JSC):
+        (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
+        calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out 
+        these pointers after it has invalidated them to prevent accidental use-after-free in the sweep() 
+        calls during lastChanceToFinalize().
+        * heap/Heap.h:
+        (Heap):
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
+        This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
+        the first time.
+        (JSC):
+        (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we 
+        make our first pass. We now null out the slots as we sweep them so that we can quickly find the 
+        Structures during the second pass.
+        (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
+        (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify 
+        the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can 
+        assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock 
+        iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
+        (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
+        * heap/IncrementalSweeper.h: Add declarations for new stuff.
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and 
+        if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing 
+        the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that 
+        will sweep some number of other blocks in place of the current block to mitigate the cost of the floating 
+        Structure garbage.
+        (JSC::MarkedAllocator::addBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no 
+        longer valid to allocate from, so we set the current block to null.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
+        at an unsafe time.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
+        (JSC): 
+        * heap/MarkedSpace.h:
+        (JSC):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
 
 2012-07-29  Filip Pizlo  <fpizlo@apple.com>
 
diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index b5f24899f..40d95cb9c 100644
--- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -39,6 +39,7 @@ ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_CSP_NEXT = ;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
+ENABLE_CSS_HIERARCHIES = ;
 ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
@@ -133,7 +134,9 @@ ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
 ENABLE_WEB_TIMING = ;
+ENABLE_WIDGET_REGION = $(ENABLE_WIDGET_REGION_$(REAL_PLATFORM_NAME));
+ENABLE_WIDGET_REGION_macosx = ENABLE_WIDGET_REGION;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WIDGET_REGION) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/JavaScriptCore/Configurations/Version.xcconfig b/Source/JavaScriptCore/Configurations/Version.xcconfig
index daf808e05..b619d3602 100644
--- a/Source/JavaScriptCore/Configurations/Version.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 3;
+MINOR_VERSION = 6;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am
index e21ad80d7..ab8b110c2 100644
--- a/Source/JavaScriptCore/GNUmakefile.list.am
+++ b/Source/JavaScriptCore/GNUmakefile.list.am
@@ -227,6 +227,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp \
 	Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp \
 	Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h \
+	Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp \
+	Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.h \
 	Source/JavaScriptCore/dfg/DFGThunks.cpp \
 	Source/JavaScriptCore/dfg/DFGThunks.h \
 	Source/JavaScriptCore/dfg/DFGValueRecoveryOverride.h \
@@ -262,6 +264,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/heap/IncrementalSweeper.h \
 	Source/JavaScriptCore/heap/IncrementalSweeper.cpp \
 	Source/JavaScriptCore/heap/SlotVisitor.h \
+	Source/JavaScriptCore/heap/SlotVisitorInlineMethods.h \
 	Source/JavaScriptCore/heap/HandleStack.cpp \
 	Source/JavaScriptCore/heap/HandleStack.h \
 	Source/JavaScriptCore/heap/HandleTypes.h \
diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index f6580c51f..fad36c974 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -32,9 +32,7 @@ INCLUDEPATH += \
     $$SOURCE_DIR/ForwardingHeaders \
     $$JAVASCRIPTCORE_GENERATED_SOURCES_DIR
 
-win32-* {
-    LIBS += -lwinmm
-}
+win32-*: LIBS += -lwinmm
 
 wince* {
     INCLUDEPATH += $$QT.core.sources/../3rdparty/ce-compat
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index 5f27859d8..8032ed178 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -81,7 +81,7 @@ EXPORTS
     ?byteCompile@Yarr@JSC@@YA?AV?$PassOwnPtr@UBytecodePattern@Yarr@JSC@@@WTF@@AAUYarrPattern@12@PAVBumpPointerAllocator@4@@Z
     ?byteSize@SourceProviderCache@JSC@@QBEIXZ
     ?calculateDSTOffset@WTF@@YANNN@Z
-    ?calculateStringHashAndLengthFromUTF8@Unicode@WTF@@YAIPBD0AAI1@Z
+    ?calculateStringHashAndLengthFromUTF8MaskingTop8Bits@Unicode@WTF@@YAIPBD0AAI1@Z
     ?calculateUTCOffset@WTF@@YAHXZ
     ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVUString@2@XZ
     ?call@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@W4CallType@1@ABTCallData@1@1ABVArgList@1@@Z
@@ -201,7 +201,6 @@ EXPORTS
     ?getCallData@JSCell@JSC@@SA?AW4CallType@2@PAV12@AATCallData@2@@Z
     ?getCallableObjectSlow@JSC@@YAPAVJSCell@1@PAV21@@Z
     ?getConstructData@JSCell@JSC@@SA?AW4ConstructType@2@PAV12@AATConstructData@2@@Z
-    ?getCurrentLocalTime@WTF@@YAXPAUtm@@@Z
     ?getObject@JSCell@JSC@@QAEPAVJSObject@2@XZ
     ?getOwnPropertyDescriptor@JSGlobalObject@JSC@@SA_NPAVJSObject@2@PAVExecState@2@VPropertyName@2@AAVPropertyDescriptor@2@@Z
     ?getOwnPropertyDescriptor@JSObject@JSC@@SA_NPAV12@PAVExecState@2@VPropertyName@2@AAVPropertyDescriptor@2@@Z
@@ -315,6 +314,7 @@ EXPORTS
     ?setOrderLowerFirst@Collator@WTF@@QAEX_N@Z
     ?setPrototype@JSObject@JSC@@QAEXAAVJSGlobalData@2@VJSValue@2@@Z
     ?setSetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z
+    ?setToCurrentLocalTime@GregorianDateTime@WTF@@QAEXXZ
     ?setUndefined@PropertyDescriptor@JSC@@QAEXXZ
     ?setUnwrappedObject@JSGlobalThis@JSC@@IAEXAAVJSGlobalData@2@PAVJSGlobalObject@2@@Z
     ?setUpStaticFunctionSlot@JSC@@YA_NPAVExecState@1@PBVHashEntry@1@PAVJSObject@1@VPropertyName@1@AAVPropertySlot@1@@Z
@@ -352,8 +352,8 @@ EXPORTS
     ?toObject@JSCell@JSC@@QBEPAVJSObject@2@PAVExecState@2@PAVJSGlobalObject@2@@Z
     ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@PAVJSGlobalObject@2@@Z
     ?toString@JSObject@JSC@@QBEPAVJSString@2@PAVExecState@2@@Z
-    ?toStringDecimal@DecimalNumber@WTF@@QBEIPA_WI@Z
-    ?toStringExponential@DecimalNumber@WTF@@QBEIPA_WI@Z
+    ?toStringDecimal@DecimalNumber@WTF@@QBEIPAEI@Z
+    ?toStringExponential@DecimalNumber@WTF@@QBEIPAEI@Z
     ?toStringSlowCase@JSValue@JSC@@ABEPAVJSString@2@PAVExecState@2@@Z
     ?toThisObject@JSObject@JSC@@SAPAV12@PAVJSCell@2@PAVExecState@2@@Z
     ?toThisObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 6caa07e6e..add311969 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -138,6 +138,8 @@
 		0F620177143FCD3F0068B77C /* DFGAbstractValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F62016F143FCD2F0068B77C /* DFGAbstractValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F620178143FCD440068B77C /* DFGAbstractState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F62016E143FCD2F0068B77C /* DFGAbstractState.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F620179143FCD480068B77C /* DFGAbstractState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F62016D143FCD2F0068B77C /* DFGAbstractState.cpp */; };
+		0F63943F15C75F19006A597C /* DFGStructureCheckHoistingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63943D15C75F14006A597C /* DFGStructureCheckHoistingPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F63944015C75F1D006A597C /* DFGStructureCheckHoistingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63943C15C75F14006A597C /* DFGStructureCheckHoistingPhase.cpp */; };
 		0F66E16B14DF3F1600B7B2E4 /* DFGAdjacencyList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F66E16C14DF3F1600B7B2E4 /* DFGEdge.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F766D2815A8CC1E008F363E /* JITStubRoutine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F766D2615A8CC1B008F363E /* JITStubRoutine.cpp */; };
@@ -885,6 +887,8 @@
 		0F62016F143FCD2F0068B77C /* DFGAbstractValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAbstractValue.h; path = dfg/DFGAbstractValue.h; sourceTree = "<group>"; };
 		0F620170143FCD2F0068B77C /* DFGBasicBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBasicBlock.h; path = dfg/DFGBasicBlock.h; sourceTree = "<group>"; };
 		0F620172143FCD2F0068B77C /* DFGVariableAccessData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVariableAccessData.h; path = dfg/DFGVariableAccessData.h; sourceTree = "<group>"; };
+		0F63943C15C75F14006A597C /* DFGStructureCheckHoistingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStructureCheckHoistingPhase.cpp; path = dfg/DFGStructureCheckHoistingPhase.cpp; sourceTree = "<group>"; };
+		0F63943D15C75F14006A597C /* DFGStructureCheckHoistingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureCheckHoistingPhase.h; path = dfg/DFGStructureCheckHoistingPhase.h; sourceTree = "<group>"; };
 		0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAdjacencyList.h; path = dfg/DFGAdjacencyList.h; sourceTree = "<group>"; };
 		0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGEdge.h; path = dfg/DFGEdge.h; sourceTree = "<group>"; };
 		0F766D1C15A5028D008F363E /* JITStubRoutine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITStubRoutine.h; sourceTree = "<group>"; };
@@ -2321,6 +2325,8 @@
 				86EC9DC31328DF82002B2AD7 /* DFGSpeculativeJIT.h */,
 				86880F1B14328BB900B08D42 /* DFGSpeculativeJIT32_64.cpp */,
 				86880F4C14353B2100B08D42 /* DFGSpeculativeJIT64.cpp */,
+				0F63943C15C75F14006A597C /* DFGStructureCheckHoistingPhase.cpp */,
+				0F63943D15C75F14006A597C /* DFGStructureCheckHoistingPhase.h */,
 				0FC0979F146B28C700CF2442 /* DFGThunks.cpp */,
 				0FC097A0146B28C700CF2442 /* DFGThunks.h */,
 				0F2BDC3F1522801700CD8910 /* DFGValueRecoveryOverride.h */,
@@ -2860,6 +2866,7 @@
 				0F766D3915AE4A1F008F363E /* StructureStubClearingWatchpoint.h in Headers */,
 				0F766D4415B2A3C0008F363E /* DFGRegisterSet.h in Headers */,
 				0F766D4615B3701F008F363E /* DFGScratchRegisterAllocator.h in Headers */,
+				0F63943F15C75F19006A597C /* DFGStructureCheckHoistingPhase.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3457,6 +3464,7 @@
 				0F766D2F15A8DCE0008F363E /* GCAwareJITStubRoutine.cpp in Sources */,
 				0F766D3415AE2538008F363E /* JumpReplacementWatchpoint.cpp in Sources */,
 				0F766D3815AE4A1C008F363E /* StructureStubClearingWatchpoint.cpp in Sources */,
+				0F63944015C75F1D006A597C /* DFGStructureCheckHoistingPhase.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/JavaScriptCore/Target.pri b/Source/JavaScriptCore/Target.pri
index 035656f0c..3d0e41df4 100644
--- a/Source/JavaScriptCore/Target.pri
+++ b/Source/JavaScriptCore/Target.pri
@@ -26,10 +26,6 @@ CONFIG += staticlib
     }
 }
 
-wince* {
-    SOURCES += $$QT.core.sources/../3rdparty/ce-compat/ce_time.c
-}
-
 include(yarr/yarr.pri)
 
 INSTALLDEPS += all
@@ -126,6 +122,7 @@ SOURCES += \
     dfg/DFGSpeculativeJIT.cpp \
     dfg/DFGSpeculativeJIT32_64.cpp \
     dfg/DFGSpeculativeJIT64.cpp \
+    dfg/DFGStructureCheckHoistingPhase.cpp \
     dfg/DFGThunks.cpp \
     dfg/DFGValueSource.cpp \
     dfg/DFGVariableEvent.cpp \
diff --git a/Source/JavaScriptCore/assembler/ARMAssembler.cpp b/Source/JavaScriptCore/assembler/ARMAssembler.cpp
index 362fcc630..533640ea8 100644
--- a/Source/JavaScriptCore/assembler/ARMAssembler.cpp
+++ b/Source/JavaScriptCore/assembler/ARMAssembler.cpp
@@ -46,7 +46,7 @@ void ARMAssembler::patchConstantPoolLoad(void* loadAddr, void* constPoolAddr)
         ASSERT(diff <= 0xfff);
         *ldr = (*ldr & ~0xfff) | diff;
     } else
-        *ldr = (*ldr & ~(0xfff | ARMAssembler::DT_UP)) | sizeof(ARMWord);
+        *ldr = (*ldr & ~(0xfff | ARMAssembler::DataTransferUp)) | sizeof(ARMWord);
 }
 
 // Handle immediates
@@ -56,7 +56,7 @@ ARMWord ARMAssembler::getOp2(ARMWord imm)
     int rol;
 
     if (imm <= 0xff)
-        return OP2_IMM | imm;
+        return Op2Immediate | imm;
 
     if ((imm & 0xff000000) == 0) {
         imm <<= 8;
@@ -83,9 +83,9 @@ ARMWord ARMAssembler::getOp2(ARMWord imm)
     }
 
     if ((imm & 0x00ffffff) == 0)
-        return OP2_IMM | (imm >> 24) | (rol << 8);
+        return Op2Immediate | (imm >> 24) | (rol << 8);
 
-    return INVALID_IMM;
+    return InvalidImmediate;
 }
 
 int ARMAssembler::genInt(int reg, ARMWord imm, bool positive)
@@ -129,10 +129,10 @@ int ARMAssembler::genInt(int reg, ARMWord imm, bool positive)
     ASSERT((imm & 0xff) == 0);
 
     if ((imm & 0xff000000) == 0) {
-        imm1 = OP2_IMM | ((imm >> 16) & 0xff) | (((rol + 4) & 0xf) << 8);
-        imm2 = OP2_IMM | ((imm >> 8) & 0xff) | (((rol + 8) & 0xf) << 8);
+        imm1 = Op2Immediate | ((imm >> 16) & 0xff) | (((rol + 4) & 0xf) << 8);
+        imm2 = Op2Immediate | ((imm >> 8) & 0xff) | (((rol + 8) & 0xf) << 8);
     } else if (imm & 0xc0000000) {
-        imm1 = OP2_IMM | ((imm >> 24) & 0xff) | ((rol & 0xf) << 8);
+        imm1 = Op2Immediate | ((imm >> 24) & 0xff) | ((rol & 0xf) << 8);
         imm <<= 8;
         rol += 4;
 
@@ -152,7 +152,7 @@ int ARMAssembler::genInt(int reg, ARMWord imm, bool positive)
         }
 
         if ((imm & 0x00ffffff) == 0)
-            imm2 = OP2_IMM | (imm >> 24) | ((rol & 0xf) << 8);
+            imm2 = Op2Immediate | (imm >> 24) | ((rol & 0xf) << 8);
         else
             return 0;
     } else {
@@ -166,7 +166,7 @@ int ARMAssembler::genInt(int reg, ARMWord imm, bool positive)
             rol += 1;
         }
 
-        imm1 = OP2_IMM | ((imm >> 24) & 0xff) | ((rol & 0xf) << 8);
+        imm1 = Op2Immediate | ((imm >> 24) & 0xff) | ((rol & 0xf) << 8);
         imm <<= 8;
         rol += 4;
 
@@ -181,7 +181,7 @@ int ARMAssembler::genInt(int reg, ARMWord imm, bool positive)
         }
 
         if ((imm & 0x00ffffff) == 0)
-            imm2 = OP2_IMM | (imm >> 24) | ((rol & 0xf) << 8);
+            imm2 = Op2Immediate | (imm >> 24) | ((rol & 0xf) << 8);
         else
             return 0;
     }
@@ -203,13 +203,13 @@ ARMWord ARMAssembler::getImm(ARMWord imm, int tmpReg, bool invert)
 
     // Do it by 1 instruction
     tmp = getOp2(imm);
-    if (tmp != INVALID_IMM)
+    if (tmp != InvalidImmediate)
         return tmp;
 
     tmp = getOp2(~imm);
-    if (tmp != INVALID_IMM) {
+    if (tmp != InvalidImmediate) {
         if (invert)
-            return tmp | OP2_INV_IMM;
+            return tmp | Op2InvertedImmediate;
         mvn_r(tmpReg, tmp);
         return tmpReg;
     }
@@ -223,13 +223,13 @@ void ARMAssembler::moveImm(ARMWord imm, int dest)
 
     // Do it by 1 instruction
     tmp = getOp2(imm);
-    if (tmp != INVALID_IMM) {
+    if (tmp != InvalidImmediate) {
         mov_r(dest, tmp);
         return;
     }
 
     tmp = getOp2(~imm);
-    if (tmp != INVALID_IMM) {
+    if (tmp != InvalidImmediate) {
         mvn_r(dest, tmp);
         return;
     }
@@ -241,7 +241,7 @@ ARMWord ARMAssembler::encodeComplexImm(ARMWord imm, int dest)
 {
 #if WTF_ARM_ARCH_AT_LEAST(7)
     ARMWord tmp = getImm16Op2(imm);
-    if (tmp != INVALID_IMM) {
+    if (tmp != InvalidImmediate) {
         movw_r(dest, tmp);
         return dest;
     }
@@ -268,7 +268,7 @@ void ARMAssembler::dataTransfer32(DataTransferTypeA transferType, RegisterID src
         if (offset <= 0xfff)
             dtr_u(transferType, srcDst, base, offset);
         else if (offset <= 0xfffff) {
-            add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
+            add_r(ARMRegisters::S0, base, Op2Immediate | (offset >> 12) | (10 << 8));
             dtr_u(transferType, srcDst, ARMRegisters::S0, (offset & 0xfff));
         } else {
             moveImm(offset, ARMRegisters::S0);
@@ -278,7 +278,7 @@ void ARMAssembler::dataTransfer32(DataTransferTypeA transferType, RegisterID src
         if (offset >= -0xfff)
             dtr_d(transferType, srcDst, base, -offset);
         else if (offset >= -0xfffff) {
-            sub_r(ARMRegisters::S0, base, OP2_IMM | (-offset >> 12) | (10 << 8));
+            sub_r(ARMRegisters::S0, base, Op2Immediate | (-offset >> 12) | (10 << 8));
             dtr_d(transferType, srcDst, ARMRegisters::S0, (-offset & 0xfff));
         } else {
             moveImm(offset, ARMRegisters::S0);
@@ -307,7 +307,7 @@ void ARMAssembler::dataTransfer16(DataTransferTypeB transferType, RegisterID src
         if (offset <= 0xff)
             dtrh_u(transferType, srcDst, base, getOp2Half(offset));
         else if (offset <= 0xffff) {
-            add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 8) | (12 << 8));
+            add_r(ARMRegisters::S0, base, Op2Immediate | (offset >> 8) | (12 << 8));
             dtrh_u(transferType, srcDst, ARMRegisters::S0, getOp2Half(offset & 0xff));
         } else {
             moveImm(offset, ARMRegisters::S0);
@@ -317,7 +317,7 @@ void ARMAssembler::dataTransfer16(DataTransferTypeB transferType, RegisterID src
         if (offset >= -0xff)
             dtrh_d(transferType, srcDst, base, getOp2Half(-offset));
         else if (offset >= -0xffff) {
-            sub_r(ARMRegisters::S0, base, OP2_IMM | (-offset >> 8) | (12 << 8));
+            sub_r(ARMRegisters::S0, base, Op2Immediate | (-offset >> 8) | (12 << 8));
             dtrh_d(transferType, srcDst, ARMRegisters::S0, getOp2Half(-offset & 0xff));
         } else {
             moveImm(offset, ARMRegisters::S0);
@@ -346,7 +346,7 @@ void ARMAssembler::dataTransferFloat(DataTransferTypeFloat transferType, FPRegis
             return;
         }
         if (offset <= 0x3ffff && offset >= 0) {
-            add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 10) | (11 << 8));
+            add_r(ARMRegisters::S0, base, Op2Immediate | (offset >> 10) | (11 << 8));
             fdtr_u(transferType, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
             return;
         }
@@ -357,7 +357,7 @@ void ARMAssembler::dataTransferFloat(DataTransferTypeFloat transferType, FPRegis
             return;
         }
         if (offset <= 0x3ffff && offset >= 0) {
-            sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 10) | (11 << 8));
+            sub_r(ARMRegisters::S0, base, Op2Immediate | (offset >> 10) | (11 << 8));
             fdtr_d(transferType, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
             return;
         }
@@ -392,10 +392,10 @@ PassRefPtr<ExecutableMemoryHandle> ARMAssembler::executableCopy(JSGlobalData& gl
         ARMWord* addr = getLdrImmAddress(ldrAddr);
         if (*addr != InvalidBranchTarget) {
             if (!(iter->m_offset & 1)) {
-                intptr_t difference = reinterpret_cast_ptr<ARMWord*>(data + *addr) - (ldrAddr + DefaultPrefetching);
+                intptr_t difference = reinterpret_cast_ptr<ARMWord*>(data + *addr) - (ldrAddr + DefaultPrefetchOffset);
 
-                if ((difference <= BOFFSET_MAX && difference >= BOFFSET_MIN)) {
-                    *ldrAddr = B | getConditionalField(*ldrAddr) | (difference & BRANCH_MASK);
+                if ((difference <= MaximumBranchOffsetDistance && difference >= MinimumBranchOffsetDistance)) {
+                    *ldrAddr = B | getConditionalField(*ldrAddr) | (difference & BranchOffsetMask);
                     continue;
                 }
             }
diff --git a/Source/JavaScriptCore/assembler/ARMAssembler.h b/Source/JavaScriptCore/assembler/ARMAssembler.h
index 87aed853e..ac918f31e 100644
--- a/Source/JavaScriptCore/assembler/ARMAssembler.h
+++ b/Source/JavaScriptCore/assembler/ARMAssembler.h
@@ -179,52 +179,50 @@ namespace JSC {
         };
 
         enum {
-            OP2_IMM = (1 << 25),
-            OP2_IMM_HALF = (1 << 22),
-            OP2_INV_IMM = (1 << 26),
-            SET_CC = (1 << 20),
-            OP2_OFSREG = (1 << 25),
+            Op2Immediate = (1 << 25),
+            ImmediateForHalfWordTransfer = (1 << 22),
+            Op2InvertedImmediate = (1 << 26),
+            SetConditionalCodes = (1 << 20),
+            Op2IsRegisterArgument = (1 << 25),
             // Data transfer flags.
-            DT_UP = (1 << 23),
-            DT_WB = (1 << 21),
-            DT_PRE = (1 << 24),
-            DT_LOAD = (1 << 20),
-            DT_BYTE = (1 << 22),
+            DataTransferUp = (1 << 23),
+            DataTransferWriteBack = (1 << 21),
+            DataTransferPostUpdate = (1 << 24),
+            DataTransferLoad = (1 << 20),
+            ByteDataTransfer = (1 << 22),
         };
 
         enum DataTransferTypeA {
-            LoadUint32 = 0x05000000 | DT_LOAD,
-            LoadUint8 = 0x05400000 | DT_LOAD,
+            LoadUint32 = 0x05000000 | DataTransferLoad,
+            LoadUint8 = 0x05400000 | DataTransferLoad,
             StoreUint32 = 0x05000000,
             StoreUint8 = 0x05400000,
         };
 
         enum DataTransferTypeB {
-            LoadUint16 = 0x010000b0 | DT_LOAD,
-            LoadInt16 = 0x010000f0 | DT_LOAD,
-            LoadInt8 = 0x010000d0 | DT_LOAD,
+            LoadUint16 = 0x010000b0 | DataTransferLoad,
+            LoadInt16 = 0x010000f0 | DataTransferLoad,
+            LoadInt8 = 0x010000d0 | DataTransferLoad,
             StoreUint16 = 0x010000b0,
         };
 
         enum DataTransferTypeFloat {
-            LoadFloat = 0x0d000a00 | DT_LOAD,
-            LoadDouble = 0x0d000b00 | DT_LOAD,
+            LoadFloat = 0x0d000a00 | DataTransferLoad,
+            LoadDouble = 0x0d000b00 | DataTransferLoad,
             StoreFloat = 0x0d000a00,
             StoreDouble = 0x0d000b00,
         };
 
         // Masks of ARM instructions
         enum {
-            BRANCH_MASK = 0x00ffffff,
-            NONARM = 0xf0000000,
-            SDT_MASK = 0x0c000000,
-            SDT_OFFSET_MASK = 0xfff,
+            BranchOffsetMask = 0x00ffffff,
+            ConditionalFieldMask = 0xf0000000,
+            DataTransferOffsetMask = 0xfff,
         };
 
         enum {
-            BOFFSET_MIN = -0x00800000,
-            BOFFSET_MAX = 0x007fffff,
-            SDT = 0x04000000,
+            MinimumBranchOffsetDistance = -0x00800000,
+            MaximumBranchOffsetDistance = 0x007fffff,
         };
 
         enum {
@@ -233,19 +231,28 @@ namespace JSC {
             padForAlign32 = 0xe12fff7f // 'bkpt 0xffff' instruction.
         };
 
-        static const ARMWord INVALID_IMM = 0xf0000000;
+        static const ARMWord InvalidImmediate = 0xf0000000;
         static const ARMWord InvalidBranchTarget = 0xffffffff;
-        static const int DefaultPrefetching = 2;
+        static const int DefaultPrefetchOffset = 2;
+
+        static const ARMWord BlxInstructionMask = 0x012fff30;
+        static const ARMWord LdrOrAddInstructionMask = 0x0ff00000;
+        static const ARMWord LdrPcImmediateInstructionMask = 0x0f7f0000;
+
+        static const ARMWord AddImmediateInstruction = 0x02800000;
+        static const ARMWord BlxInstruction = 0x012fff30;
+        static const ARMWord LdrImmediateInstruction = 0x05900000;
+        static const ARMWord LdrPcImmediateInstruction = 0x051f0000;
 
         // Instruction formating
 
-        void emitInst(ARMWord op, int rd, int rn, ARMWord op2)
+        void emitInstruction(ARMWord op, int rd, int rn, ARMWord op2)
         {
-            ASSERT(((op2 & ~OP2_IMM) <= 0xfff) || (((op2 & ~OP2_IMM_HALF) <= 0xfff)));
+            ASSERT(((op2 & ~Op2Immediate) <= 0xfff) || (((op2 & ~ImmediateForHalfWordTransfer) <= 0xfff)));
             m_buffer.putInt(op | RN(rn) | RD(rd) | op2);
         }
 
-        void emitDoublePrecisionInst(ARMWord op, int dd, int dn, int dm)
+        void emitDoublePrecisionInstruction(ARMWord op, int dd, int dn, int dm)
         {
             ASSERT((dd >= 0 && dd <= 31) && (dn >= 0 && dn <= 31) && (dm >= 0 && dm <= 31));
             m_buffer.putInt(op | ((dd & 0xf) << 12) | ((dd & 0x10) << (22 - 4))
@@ -253,7 +260,7 @@ namespace JSC {
                                | (dm & 0xf) | ((dm & 0x10) << (5 - 4)));
         }
 
-        void emitSinglePrecisionInst(ARMWord op, int sd, int sn, int sm)
+        void emitSinglePrecisionInstruction(ARMWord op, int sd, int sn, int sm)
         {
             ASSERT((sd >= 0 && sd <= 31) && (sn >= 0 && sn <= 31) && (sm >= 0 && sm <= 31));
             m_buffer.putInt(op | ((sd >> 1) << 12) | ((sd & 0x1) << 22)
@@ -263,292 +270,292 @@ namespace JSC {
 
         void and_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | AND, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | AND, rd, rn, op2);
         }
 
         void ands_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | AND | SET_CC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | AND | SetConditionalCodes, rd, rn, op2);
         }
 
         void eor_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | EOR, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | EOR, rd, rn, op2);
         }
 
         void eors_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | EOR | SET_CC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | EOR | SetConditionalCodes, rd, rn, op2);
         }
 
         void sub_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | SUB, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | SUB, rd, rn, op2);
         }
 
         void subs_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | SUB | SET_CC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | SUB | SetConditionalCodes, rd, rn, op2);
         }
 
         void rsb_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | RSB, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | RSB, rd, rn, op2);
         }
 
         void rsbs_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | RSB | SET_CC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | RSB | SetConditionalCodes, rd, rn, op2);
         }
 
         void add_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | ADD, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | ADD, rd, rn, op2);
         }
 
         void adds_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | ADD | SET_CC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | ADD | SetConditionalCodes, rd, rn, op2);
         }
 
         void adc_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | ADC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | ADC, rd, rn, op2);
         }
 
         void adcs_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | ADC | SET_CC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | ADC | SetConditionalCodes, rd, rn, op2);
         }
 
         void sbc_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | SBC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | SBC, rd, rn, op2);
         }
 
         void sbcs_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | SBC | SET_CC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | SBC | SetConditionalCodes, rd, rn, op2);
         }
 
         void rsc_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | RSC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | RSC, rd, rn, op2);
         }
 
         void rscs_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | RSC | SET_CC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | RSC | SetConditionalCodes, rd, rn, op2);
         }
 
         void tst_r(int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | TST | SET_CC, 0, rn, op2);
+            emitInstruction(toARMWord(cc) | TST | SetConditionalCodes, 0, rn, op2);
         }
 
         void teq_r(int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | TEQ | SET_CC, 0, rn, op2);
+            emitInstruction(toARMWord(cc) | TEQ | SetConditionalCodes, 0, rn, op2);
         }
 
         void cmp_r(int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | CMP | SET_CC, 0, rn, op2);
+            emitInstruction(toARMWord(cc) | CMP | SetConditionalCodes, 0, rn, op2);
         }
 
         void cmn_r(int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | CMN | SET_CC, 0, rn, op2);
+            emitInstruction(toARMWord(cc) | CMN | SetConditionalCodes, 0, rn, op2);
         }
 
         void orr_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | ORR, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | ORR, rd, rn, op2);
         }
 
         void orrs_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | ORR | SET_CC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | ORR | SetConditionalCodes, rd, rn, op2);
         }
 
         void mov_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MOV, rd, ARMRegisters::r0, op2);
+            emitInstruction(toARMWord(cc) | MOV, rd, ARMRegisters::r0, op2);
         }
 
 #if WTF_ARM_ARCH_AT_LEAST(7)
         void movw_r(int rd, ARMWord op2, Condition cc = AL)
         {
             ASSERT((op2 | 0xf0fff) == 0xf0fff);
-            m_buffer.putInt(static_cast<ARMWord>(cc) | MOVW | RD(rd) | op2);
+            m_buffer.putInt(toARMWord(cc) | MOVW | RD(rd) | op2);
         }
 
         void movt_r(int rd, ARMWord op2, Condition cc = AL)
         {
             ASSERT((op2 | 0xf0fff) == 0xf0fff);
-            m_buffer.putInt(static_cast<ARMWord>(cc) | MOVT | RD(rd) | op2);
+            m_buffer.putInt(toARMWord(cc) | MOVT | RD(rd) | op2);
         }
 #endif
 
         void movs_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MOV | SET_CC, rd, ARMRegisters::r0, op2);
+            emitInstruction(toARMWord(cc) | MOV | SetConditionalCodes, rd, ARMRegisters::r0, op2);
         }
 
         void bic_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | BIC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | BIC, rd, rn, op2);
         }
 
         void bics_r(int rd, int rn, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | BIC | SET_CC, rd, rn, op2);
+            emitInstruction(toARMWord(cc) | BIC | SetConditionalCodes, rd, rn, op2);
         }
 
         void mvn_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MVN, rd, ARMRegisters::r0, op2);
+            emitInstruction(toARMWord(cc) | MVN, rd, ARMRegisters::r0, op2);
         }
 
         void mvns_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MVN | SET_CC, rd, ARMRegisters::r0, op2);
+            emitInstruction(toARMWord(cc) | MVN | SetConditionalCodes, rd, ARMRegisters::r0, op2);
         }
 
         void mul_r(int rd, int rn, int rm, Condition cc = AL)
         {
-            m_buffer.putInt(static_cast<ARMWord>(cc) | MUL | RN(rd) | RS(rn) | RM(rm));
+            m_buffer.putInt(toARMWord(cc) | MUL | RN(rd) | RS(rn) | RM(rm));
         }
 
         void muls_r(int rd, int rn, int rm, Condition cc = AL)
         {
-            m_buffer.putInt(static_cast<ARMWord>(cc) | MUL | SET_CC | RN(rd) | RS(rn) | RM(rm));
+            m_buffer.putInt(toARMWord(cc) | MUL | SetConditionalCodes | RN(rd) | RS(rn) | RM(rm));
         }
 
         void mull_r(int rdhi, int rdlo, int rn, int rm, Condition cc = AL)
         {
-            m_buffer.putInt(static_cast<ARMWord>(cc) | MULL | RN(rdhi) | RD(rdlo) | RS(rn) | RM(rm));
+            m_buffer.putInt(toARMWord(cc) | MULL | RN(rdhi) | RD(rdlo) | RS(rn) | RM(rm));
         }
 
         void vmov_f64_r(int dd, int dm, Condition cc = AL)
         {
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VMOV_F64, dd, 0, dm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VMOV_F64, dd, 0, dm);
         }
 
         void vadd_f64_r(int dd, int dn, int dm, Condition cc = AL)
         {
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VADD_F64, dd, dn, dm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VADD_F64, dd, dn, dm);
         }
 
         void vdiv_f64_r(int dd, int dn, int dm, Condition cc = AL)
         {
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VDIV_F64, dd, dn, dm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VDIV_F64, dd, dn, dm);
         }
 
         void vsub_f64_r(int dd, int dn, int dm, Condition cc = AL)
         {
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VSUB_F64, dd, dn, dm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VSUB_F64, dd, dn, dm);
         }
 
         void vmul_f64_r(int dd, int dn, int dm, Condition cc = AL)
         {
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VMUL_F64, dd, dn, dm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VMUL_F64, dd, dn, dm);
         }
 
         void vcmp_f64_r(int dd, int dm, Condition cc = AL)
         {
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VCMP_F64, dd, 0, dm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCMP_F64, dd, 0, dm);
         }
 
         void vsqrt_f64_r(int dd, int dm, Condition cc = AL)
         {
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VSQRT_F64, dd, 0, dm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VSQRT_F64, dd, 0, dm);
         }
 
         void vabs_f64_r(int dd, int dm, Condition cc = AL)
         {
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VABS_F64, dd, 0, dm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VABS_F64, dd, 0, dm);
         }
 
         void vneg_f64_r(int dd, int dm, Condition cc = AL)
         {
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VNEG_F64, dd, 0, dm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VNEG_F64, dd, 0, dm);
         }
 
         void ldr_imm(int rd, ARMWord imm, Condition cc = AL)
         {
-            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | LoadUint32 | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm, true);
+            m_buffer.putIntWithConstantInt(toARMWord(cc) | LoadUint32 | DataTransferUp | RN(ARMRegisters::pc) | RD(rd), imm, true);
         }
 
         void ldr_un_imm(int rd, ARMWord imm, Condition cc = AL)
         {
-            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | LoadUint32 | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm);
+            m_buffer.putIntWithConstantInt(toARMWord(cc) | LoadUint32 | DataTransferUp | RN(ARMRegisters::pc) | RD(rd), imm);
         }
 
         void dtr_u(DataTransferTypeA transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | transferType | DT_UP, rd, rb, op2);
+            emitInstruction(toARMWord(cc) | transferType | DataTransferUp, rd, rb, op2);
         }
 
         void dtr_ur(DataTransferTypeA transferType, int rd, int rb, int rm, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | transferType | DT_UP | OP2_OFSREG, rd, rb, rm);
+            emitInstruction(toARMWord(cc) | transferType | DataTransferUp | Op2IsRegisterArgument, rd, rb, rm);
         }
 
         void dtr_d(DataTransferTypeA transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | transferType, rd, rb, op2);
+            emitInstruction(toARMWord(cc) | transferType, rd, rb, op2);
         }
 
         void dtr_dr(DataTransferTypeA transferType, int rd, int rb, int rm, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | transferType | OP2_OFSREG, rd, rb, rm);
+            emitInstruction(toARMWord(cc) | transferType | Op2IsRegisterArgument, rd, rb, rm);
         }
 
         void dtrh_u(DataTransferTypeB transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | transferType | DT_UP, rd, rb, op2);
+            emitInstruction(toARMWord(cc) | transferType | DataTransferUp, rd, rb, op2);
         }
 
         void dtrh_ur(DataTransferTypeB transferType, int rd, int rn, int rm, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | transferType | DT_UP, rd, rn, rm);
+            emitInstruction(toARMWord(cc) | transferType | DataTransferUp, rd, rn, rm);
         }
 
         void dtrh_d(DataTransferTypeB transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | transferType, rd, rb, op2);
+            emitInstruction(toARMWord(cc) | transferType, rd, rb, op2);
         }
 
         void dtrh_dr(DataTransferTypeB transferType, int rd, int rn, int rm, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | transferType, rd, rn, rm);
+            emitInstruction(toARMWord(cc) | transferType, rd, rn, rm);
         }
 
         void fdtr_u(DataTransferTypeFloat type, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
             ASSERT(op2 <= 0xff && rd <= 15);
             /* Only d0-d15 and s0, s2, s4 ... s30 are supported. */
-            m_buffer.putInt(static_cast<ARMWord>(cc) | DT_UP | type | (rd << 12) | RN(rb) | op2);
+            m_buffer.putInt(toARMWord(cc) | DataTransferUp | type | (rd << 12) | RN(rb) | op2);
         }
 
         void fdtr_d(DataTransferTypeFloat type, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
             ASSERT(op2 <= 0xff && rd <= 15);
             /* Only d0-d15 and s0, s2, s4 ... s30 are supported. */
-            m_buffer.putInt(static_cast<ARMWord>(cc) | type | (rd << 12) | RN(rb) | op2);
+            m_buffer.putInt(toARMWord(cc) | type | (rd << 12) | RN(rb) | op2);
         }
 
         void push_r(int reg, Condition cc = AL)
         {
             ASSERT(ARMWord(reg) <= 0xf);
-            m_buffer.putInt(static_cast<ARMWord>(cc) | StoreUint32 | DT_WB | RN(ARMRegisters::sp) | RD(reg) | 0x4);
+            m_buffer.putInt(toARMWord(cc) | StoreUint32 | DataTransferWriteBack | RN(ARMRegisters::sp) | RD(reg) | 0x4);
         }
 
         void pop_r(int reg, Condition cc = AL)
         {
             ASSERT(ARMWord(reg) <= 0xf);
-            m_buffer.putInt(static_cast<ARMWord>(cc) | (LoadUint32 ^ DT_PRE) | DT_UP | RN(ARMRegisters::sp) | RD(reg) | 0x4);
+            m_buffer.putInt(toARMWord(cc) | (LoadUint32 ^ DataTransferPostUpdate) | DataTransferUp | RN(ARMRegisters::sp) | RD(reg) | 0x4);
         }
 
         inline void poke_r(int reg, Condition cc = AL)
@@ -564,65 +571,65 @@ namespace JSC {
         void vmov_vfp64_r(int sm, int rt, int rt2, Condition cc = AL)
         {
             ASSERT(rt != rt2);
-            m_buffer.putInt(static_cast<ARMWord>(cc) | VMOV_VFP64 | RN(rt2) | RD(rt) | (sm & 0xf) | ((sm & 0x10) << (5 - 4)));
+            m_buffer.putInt(toARMWord(cc) | VMOV_VFP64 | RN(rt2) | RD(rt) | (sm & 0xf) | ((sm & 0x10) << (5 - 4)));
         }
 
         void vmov_arm64_r(int rt, int rt2, int sm, Condition cc = AL)
         {
             ASSERT(rt != rt2);
-            m_buffer.putInt(static_cast<ARMWord>(cc) | VMOV_ARM64 | RN(rt2) | RD(rt) | (sm & 0xf) | ((sm & 0x10) << (5 - 4)));
+            m_buffer.putInt(toARMWord(cc) | VMOV_ARM64 | RN(rt2) | RD(rt) | (sm & 0xf) | ((sm & 0x10) << (5 - 4)));
         }
 
         void vmov_vfp32_r(int sn, int rt, Condition cc = AL)
         {
             ASSERT(rt <= 15);
-            emitSinglePrecisionInst(static_cast<ARMWord>(cc) | VMOV_VFP32, rt << 1, sn, 0);
+            emitSinglePrecisionInstruction(toARMWord(cc) | VMOV_VFP32, rt << 1, sn, 0);
         }
 
         void vmov_arm32_r(int rt, int sn, Condition cc = AL)
         {
             ASSERT(rt <= 15);
-            emitSinglePrecisionInst(static_cast<ARMWord>(cc) | VMOV_ARM32, rt << 1, sn, 0);
+            emitSinglePrecisionInstruction(toARMWord(cc) | VMOV_ARM32, rt << 1, sn, 0);
         }
 
         void vcvt_f64_s32_r(int dd, int sm, Condition cc = AL)
         {
             ASSERT(!(sm & 0x1)); // sm must be divisible by 2
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VCVT_F64_S32, dd, 0, (sm >> 1));
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCVT_F64_S32, dd, 0, (sm >> 1));
         }
 
         void vcvt_s32_f64_r(int sd, int dm, Condition cc = AL)
         {
             ASSERT(!(sd & 0x1)); // sd must be divisible by 2
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VCVT_S32_F64, (sd >> 1), 0, dm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCVT_S32_F64, (sd >> 1), 0, dm);
         }
 
         void vcvt_u32_f64_r(int sd, int dm, Condition cc = AL)
         {
             ASSERT(!(sd & 0x1)); // sd must be divisible by 2
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VCVT_U32_F64, (sd >> 1), 0, dm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCVT_U32_F64, (sd >> 1), 0, dm);
         }
 
         void vcvt_f64_f32_r(int dd, int sm, Condition cc = AL)
         {
             ASSERT(dd <= 15 && sm <= 15);
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VCVT_F64_F32, dd, 0, sm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCVT_F64_F32, dd, 0, sm);
         }
 
         void vcvt_f32_f64_r(int dd, int sm, Condition cc = AL)
         {
             ASSERT(dd <= 15 && sm <= 15);
-            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VCVT_F32_F64, dd, 0, sm);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCVT_F32_F64, dd, 0, sm);
         }
 
         void vmrs_apsr(Condition cc = AL)
         {
-            m_buffer.putInt(static_cast<ARMWord>(cc) | VMRS_APSR);
+            m_buffer.putInt(toARMWord(cc) | VMRS_APSR);
         }
 
         void clz_r(int rd, int rm, Condition cc = AL)
         {
-            m_buffer.putInt(static_cast<ARMWord>(cc) | CLZ | RD(rd) | RM(rm));
+            m_buffer.putInt(toARMWord(cc) | CLZ | RD(rd) | RM(rm));
         }
 
         void bkpt(ARMWord value)
@@ -637,12 +644,12 @@ namespace JSC {
 
         void bx(int rm, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | BX, 0, 0, RM(rm));
+            emitInstruction(toARMWord(cc) | BX, 0, 0, RM(rm));
         }
 
         AssemblerLabel blx(int rm, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | BLX, 0, 0, RM(rm));
+            emitInstruction(toARMWord(cc) | BLX, 0, 0, RM(rm));
             return m_buffer.label();
         }
 
@@ -773,28 +780,28 @@ namespace JSC {
         static ARMWord* getLdrImmAddress(ARMWord* insn)
         {
             // Check for call
-            if ((*insn & 0x0f7f0000) != 0x051f0000) {
+            if ((*insn & LdrPcImmediateInstructionMask) != LdrPcImmediateInstruction) {
                 // Must be BLX
-                ASSERT((*insn & 0x012fff30) == 0x012fff30);
+                ASSERT((*insn & BlxInstructionMask) == BlxInstruction);
                 insn--;
             }
 
             // Must be an ldr ..., [pc +/- imm]
-            ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
+            ASSERT((*insn & LdrPcImmediateInstructionMask) == LdrPcImmediateInstruction);
 
-            ARMWord addr = reinterpret_cast<ARMWord>(insn) + DefaultPrefetching * sizeof(ARMWord);
-            if (*insn & DT_UP)
-                return reinterpret_cast<ARMWord*>(addr + (*insn & SDT_OFFSET_MASK));
-            return reinterpret_cast<ARMWord*>(addr - (*insn & SDT_OFFSET_MASK));
+            ARMWord addr = reinterpret_cast<ARMWord>(insn) + DefaultPrefetchOffset * sizeof(ARMWord);
+            if (*insn & DataTransferUp)
+                return reinterpret_cast<ARMWord*>(addr + (*insn & DataTransferOffsetMask));
+            return reinterpret_cast<ARMWord*>(addr - (*insn & DataTransferOffsetMask));
         }
 
         static ARMWord* getLdrImmAddressOnPool(ARMWord* insn, uint32_t* constPool)
         {
             // Must be an ldr ..., [pc +/- imm]
-            ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
+            ASSERT((*insn & LdrPcImmediateInstructionMask) == LdrPcImmediateInstruction);
 
             if (*insn & 0x1)
-                return reinterpret_cast<ARMWord*>(constPool + ((*insn & SDT_OFFSET_MASK) >> 1));
+                return reinterpret_cast<ARMWord*>(constPool + ((*insn & DataTransferOffsetMask) >> 1));
             return getLdrImmAddress(insn);
         }
 
@@ -808,8 +815,8 @@ namespace JSC {
         static ARMWord patchConstantPoolLoad(ARMWord load, ARMWord value)
         {
             value = (value << 1) + 1;
-            ASSERT(!(value & ~0xfff));
-            return (load & ~0xfff) | value;
+            ASSERT(!(value & ~DataTransferOffsetMask));
+            return (load & ~DataTransferOffsetMask) | value;
         }
 
         static void patchConstantPoolLoad(void* loadAddr, void* constPoolAddr);
@@ -839,7 +846,7 @@ namespace JSC {
             ARMWord* instruction = reinterpret_cast<ARMWord*>(where);
             ASSERT((*instruction & 0x0f700000) == LoadUint32);
             if (value >= 0)
-                *instruction = (*instruction & 0xff7ff000) | DT_UP | value;
+                *instruction = (*instruction & 0xff7ff000) | DataTransferUp | value;
             else
                 *instruction = (*instruction & 0xff7ff000) | -value;
             cacheFlush(instruction, sizeof(ARMWord));
@@ -860,7 +867,7 @@ namespace JSC {
         {
             ARMWord* insn = reinterpret_cast<ARMWord*>(getAbsoluteJumpAddress(m_buffer.data(), from.m_offset));
             ARMWord* addr = getLdrImmAddressOnPool(insn, m_buffer.poolAddress());
-            *addr = static_cast<ARMWord>(to.m_offset);
+            *addr = toARMWord(to.m_offset);
         }
 
         static void linkJump(void* code, AssemblerLabel from, void* to)
@@ -891,13 +898,13 @@ namespace JSC {
         static void replaceWithJump(void* instructionStart, void* to)
         {
             ARMWord* instruction = reinterpret_cast<ARMWord*>(instructionStart) - 1;
-            intptr_t difference = reinterpret_cast<intptr_t>(to) - (reinterpret_cast<intptr_t>(instruction) + DefaultPrefetching * sizeof(ARMWord));
+            intptr_t difference = reinterpret_cast<intptr_t>(to) - (reinterpret_cast<intptr_t>(instruction) + DefaultPrefetchOffset * sizeof(ARMWord));
 
             if (!(difference & 1)) {
                 difference >>= 2;
-                if ((difference <= BOFFSET_MAX && difference >= BOFFSET_MIN)) {
+                if ((difference <= MaximumBranchOffsetDistance && difference >= MinimumBranchOffsetDistance)) {
                      // Direct branch.
-                     instruction[0] = B | AL | (difference & BRANCH_MASK);
+                     instruction[0] = B | AL | (difference & BranchOffsetMask);
                      cacheFlush(instruction, sizeof(ARMWord));
                      return;
                 }
@@ -919,9 +926,9 @@ namespace JSC {
             ARMWord* instruction = reinterpret_cast<ARMWord*>(instructionStart);
             cacheFlush(instruction, sizeof(ARMWord));
 
-            ASSERT((*instruction & 0x0ff00000) == 0x02800000 || (*instruction & 0x0ff00000) == 0x05900000);
-            if ((*instruction & 0x0ff00000) == 0x02800000) {
-                 *instruction = (*instruction & 0xf00fffff) | 0x05900000;
+            ASSERT((*instruction & LdrOrAddInstructionMask) == AddImmediateInstruction || (*instruction & LdrOrAddInstructionMask) == LdrImmediateInstruction);
+            if ((*instruction & LdrOrAddInstructionMask) == AddImmediateInstruction) {
+                 *instruction = (*instruction & ~LdrOrAddInstructionMask) | LdrImmediateInstruction;
                  cacheFlush(instruction, sizeof(ARMWord));
             }
         }
@@ -931,9 +938,9 @@ namespace JSC {
             ARMWord* instruction = reinterpret_cast<ARMWord*>(instructionStart);
             cacheFlush(instruction, sizeof(ARMWord));
 
-            ASSERT((*instruction & 0x0ff00000) == 0x02800000 || (*instruction & 0x0ff00000) == 0x05900000);
-            if ((*instruction & 0x0ff00000) == 0x05900000) {
-                 *instruction = (*instruction & 0xf00fffff) | 0x02800000;
+            ASSERT((*instruction & LdrOrAddInstructionMask) == AddImmediateInstruction || (*instruction & LdrOrAddInstructionMask) == LdrImmediateInstruction);
+            if ((*instruction & LdrOrAddInstructionMask) == LdrImmediateInstruction) {
+                 *instruction = (*instruction & ~LdrOrAddInstructionMask) | AddImmediateInstruction;
                  cacheFlush(instruction, sizeof(ARMWord));
             }
         }
@@ -965,13 +972,13 @@ namespace JSC {
         static ARMWord getOp2Byte(ARMWord imm)
         {
             ASSERT(imm <= 0xff);
-            return OP2_IMM | imm;
+            return Op2Immediate | imm;
         }
 
         static ARMWord getOp2Half(ARMWord imm)
         {
             ASSERT(imm <= 0xff);
-            return OP2_IMM_HALF | (imm & 0x0f) | ((imm & 0xf0) << 4);
+            return ImmediateForHalfWordTransfer | (imm & 0x0f) | ((imm & 0xf0) << 4);
         }
 
 #if WTF_ARM_ARCH_AT_LEAST(7)
@@ -979,7 +986,7 @@ namespace JSC {
         {
             if (imm <= 0xffff)
                 return (imm & 0xf000) << 4 | (imm & 0xfff);
-            return INVALID_IMM;
+            return InvalidImmediate;
         }
 #endif
         ARMWord getImm(ARMWord imm, int tmpReg, bool invert = false);
@@ -1000,8 +1007,8 @@ namespace JSC {
         static ARMWord placeConstantPoolBarrier(int offset)
         {
             offset = (offset - sizeof(ARMWord)) >> 2;
-            ASSERT((offset <= BOFFSET_MAX && offset >= BOFFSET_MIN));
-            return AL | B | (offset & BRANCH_MASK);
+            ASSERT((offset <= MaximumBranchOffsetDistance && offset >= MinimumBranchOffsetDistance));
+            return AL | B | (offset & BranchOffsetMask);
         }
 
 #if OS(LINUX) && COMPILER(RVCT)
@@ -1067,7 +1074,17 @@ namespace JSC {
 
         static ARMWord getConditionalField(ARMWord i)
         {
-            return i & 0xf0000000;
+            return i & ConditionalFieldMask;
+        }
+
+        static ARMWord toARMWord(Condition cc)
+        {
+            return static_cast<ARMWord>(cc);
+        }
+
+        static ARMWord toARMWord(uint32_t u)
+        {
+            return static_cast<ARMWord>(u);
         }
 
         int genInt(int reg, ARMWord imm, bool positive);
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp b/Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp
index 3408c1230..a251a4376 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp
@@ -87,7 +87,7 @@ void MacroAssemblerARM::load32WithUnalignedHalfWords(BaseIndex address, Register
         m_assembler.moveImm(address.offset, ARMRegisters::S0);
         m_assembler.add_r(ARMRegisters::S0, ARMRegisters::S0, op2);
         m_assembler.dtrh_ur(ARMAssembler::LoadUint16, dest, address.base, ARMRegisters::S0);
-        m_assembler.add_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::OP2_IMM | 0x2);
+        m_assembler.add_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::Op2Immediate | 0x2);
         m_assembler.dtrh_ur(ARMAssembler::LoadUint16, ARMRegisters::S0, address.base, ARMRegisters::S0);
     }
     m_assembler.orr_r(dest, dest, m_assembler.lsl(ARMRegisters::S0, 16));
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
index 530f62b86..85d0ffbcc 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -137,8 +137,8 @@ public:
     void and32(TrustedImm32 imm, RegisterID dest)
     {
         ARMWord w = m_assembler.getImm(imm.m_value, ARMRegisters::S0, true);
-        if (w & ARMAssembler::OP2_INV_IMM)
-            m_assembler.bics_r(dest, dest, w & ~ARMAssembler::OP2_INV_IMM);
+        if (w & ARMAssembler::Op2InvertedImmediate)
+            m_assembler.bics_r(dest, dest, w & ~ARMAssembler::Op2InvertedImmediate);
         else
             m_assembler.ands_r(dest, dest, w);
     }
@@ -146,8 +146,8 @@ public:
     void and32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         ARMWord w = m_assembler.getImm(imm.m_value, ARMRegisters::S0, true);
-        if (w & ARMAssembler::OP2_INV_IMM)
-            m_assembler.bics_r(dest, src, w & ~ARMAssembler::OP2_INV_IMM);
+        if (w & ARMAssembler::Op2InvertedImmediate)
+            m_assembler.bics_r(dest, src, w & ~ARMAssembler::Op2InvertedImmediate);
         else
             m_assembler.ands_r(dest, src, w);
     }
@@ -555,8 +555,8 @@ public:
 
     Jump branch32(RelationalCondition cond, RegisterID left, TrustedImm32 right, int useConstantPool = 0)
     {
-        ARMWord tmp = (right.m_value == 0x80000000) ? ARMAssembler::INVALID_IMM : m_assembler.getOp2(-right.m_value);
-        if (tmp != ARMAssembler::INVALID_IMM)
+        ARMWord tmp = (right.m_value == 0x80000000) ? ARMAssembler::InvalidImmediate : m_assembler.getOp2(-right.m_value);
+        if (tmp != ARMAssembler::InvalidImmediate)
             m_assembler.cmn_r(left, tmp);
         else
             m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
@@ -617,8 +617,8 @@ public:
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         ARMWord w = m_assembler.getImm(mask.m_value, ARMRegisters::S0, true);
-        if (w & ARMAssembler::OP2_INV_IMM)
-            m_assembler.bics_r(ARMRegisters::S0, reg, w & ~ARMAssembler::OP2_INV_IMM);
+        if (w & ARMAssembler::Op2InvertedImmediate)
+            m_assembler.bics_r(ARMRegisters::S0, reg, w & ~ARMAssembler::Op2InvertedImmediate);
         else
             m_assembler.tst_r(reg, w);
         return Jump(m_assembler.jmp(ARMCondition(cond)));
@@ -1152,7 +1152,7 @@ public:
         m_assembler.bic_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(1));
 
         ARMWord w = ARMAssembler::getOp2(0x80000000);
-        ASSERT(w != ARMAssembler::INVALID_IMM);
+        ASSERT(w != ARMAssembler::InvalidImmediate);
         m_assembler.cmp_r(ARMRegisters::S0, w);
         return Jump(m_assembler.jmp(branchType == BranchIfTruncateFailed ? ARMAssembler::EQ : ARMAssembler::NE));
     }
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
index bc280acec..8b3ce9f03 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
@@ -43,6 +43,11 @@ public:
     {
     }
 
+    static bool isCompactPtrAlignedAddressOffset(ptrdiff_t value)
+    {
+        return value >= -2147483647 - 1 && value <= 2147483647;
+    }
+
     static const Scale ScalePtr = TimesFour;
 
     // For storing immediate number
@@ -189,6 +194,12 @@ public:
         add32(dataTempRegister, dest);
     }
 
+    void add32(AbsoluteAddress src, RegisterID dest)
+    {
+        load32(src.m_ptr, dataTempRegister);
+        add32(dataTempRegister, dest);
+    }
+
     void add32(RegisterID src, Address dest)
     {
         if (dest.offset >= -32768 && dest.offset <= 32767 && !m_fixedWidth) {
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 5374a537a..0e2a98bc5 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -1525,7 +1525,8 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int debugHookID = (++it)->u.operand;
             int firstLine = (++it)->u.operand;
             int lastLine = (++it)->u.operand;
-            dataLog("[%4d] debug\t\t %s, %d, %d", location, debugHookName(debugHookID), firstLine, lastLine);
+            int column = (++it)->u.operand;
+            dataLog("[%4d] debug\t\t %s, %d, %d, %d", location, debugHookName(debugHookID), firstLine, lastLine, column);
             dumpBytecodeCommentAndNewLine(location);
             break;
         }
diff --git a/Source/JavaScriptCore/bytecode/DFGExitProfile.h b/Source/JavaScriptCore/bytecode/DFGExitProfile.h
index d751ce654..e0aeba2bd 100644
--- a/Source/JavaScriptCore/bytecode/DFGExitProfile.h
+++ b/Source/JavaScriptCore/bytecode/DFGExitProfile.h
@@ -38,6 +38,7 @@ enum ExitKind {
     BadCache, // We exited because an inline cache was wrong.
     Overflow, // We exited because of overflow.
     NegativeZero, // We exited because we encountered negative zero.
+    OutOfBounds, // We had an out-of-bounds access to an array.
     InadequateCoverage, // We exited because we ended up in code that didn't have profiling coverage.
     ArgumentsEscaped, // We exited because arguments escaped but we didn't expect them to.
     Uncountable, // We exited for none of the above reasons, and we should not count it. Most uses of this should be viewed as a FIXME.
diff --git a/Source/JavaScriptCore/bytecode/Opcode.h b/Source/JavaScriptCore/bytecode/Opcode.h
index 14cefb9d9..4308e79df 100644
--- a/Source/JavaScriptCore/bytecode/Opcode.h
+++ b/Source/JavaScriptCore/bytecode/Opcode.h
@@ -194,7 +194,7 @@ namespace JSC {
         macro(op_throw, 2) \
         macro(op_throw_reference_error, 2) \
         \
-        macro(op_debug, 4) \
+        macro(op_debug, 5) \
         macro(op_profile_will_call, 2) \
         macro(op_profile_did_call, 2) \
         \
diff --git a/Source/JavaScriptCore/bytecode/SpeculatedType.cpp b/Source/JavaScriptCore/bytecode/SpeculatedType.cpp
index 02d0f7e77..399ab29c8 100644
--- a/Source/JavaScriptCore/bytecode/SpeculatedType.cpp
+++ b/Source/JavaScriptCore/bytecode/SpeculatedType.cpp
@@ -226,9 +226,6 @@ SpeculatedType speculationFromClassInfo(const ClassInfo* classInfo)
     if (classInfo == &JSArray::s_info)
         return SpecArray;
     
-    if (classInfo == &JSString::s_info)
-        return SpecString;
-    
     if (classInfo == &Arguments::s_info)
         return SpecArguments; // Cannot distinguish between MyArguments and ForeignArguments at this stage. That happens in the flow analysis.
     
@@ -269,6 +266,8 @@ SpeculatedType speculationFromClassInfo(const ClassInfo* classInfo)
 
 SpeculatedType speculationFromStructure(Structure* structure)
 {
+    if (structure->typeInfo().type() == StringType)
+        return SpecString;
     return speculationFromClassInfo(structure->classInfo());
 }
 
diff --git a/Source/JavaScriptCore/bytecode/SpeculatedType.h b/Source/JavaScriptCore/bytecode/SpeculatedType.h
index 91fb4fe4d..4ecc53776 100644
--- a/Source/JavaScriptCore/bytecode/SpeculatedType.h
+++ b/Source/JavaScriptCore/bytecode/SpeculatedType.h
@@ -243,6 +243,11 @@ inline bool isOtherSpeculation(SpeculatedType value)
     return value == SpecOther;
 }
 
+inline bool isOtherOrEmptySpeculation(SpeculatedType value)
+{
+    return !value || value == SpecOther;
+}
+
 inline bool isEmptySpeculation(SpeculatedType value)
 {
     return value == SpecEmpty;
diff --git a/Source/JavaScriptCore/bytecode/ValueRecovery.h b/Source/JavaScriptCore/bytecode/ValueRecovery.h
index ebca661d0..1be5201ea 100644
--- a/Source/JavaScriptCore/bytecode/ValueRecovery.h
+++ b/Source/JavaScriptCore/bytecode/ValueRecovery.h
@@ -76,6 +76,9 @@ public:
     {
     }
     
+    bool isSet() const { return m_technique != DontKnow; }
+    bool operator!() const { return !isSet(); }
+    
     static ValueRecovery alreadyInRegisterFile()
     {
         ValueRecovery result;
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 33f282c66..14a69b530 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -1249,7 +1249,7 @@ ResolveResult BytecodeGenerator::resolve(const Identifier& property)
         if (!currentScope->isVariableObject()) {
             flags |= ResolveResult::DynamicFlag;
             break;
-        }        
+        }
         JSSymbolTableObject* currentVariableObject = jsCast<JSSymbolTableObject*>(currentScope);
         SymbolTableEntry entry = currentVariableObject->symbolTable().get(property.impl());
 
@@ -2083,7 +2083,7 @@ void BytecodeGenerator::emitPopScope()
     m_dynamicScopeDepth--;
 }
 
-void BytecodeGenerator::emitDebugHook(DebugHookID debugHookID, int firstLine, int lastLine)
+void BytecodeGenerator::emitDebugHook(DebugHookID debugHookID, int firstLine, int lastLine, int column)
 {
 #if ENABLE(DEBUG_WITH_BREAKPOINT)
     if (debugHookID != DidReachBreakpoint)
@@ -2096,6 +2096,7 @@ void BytecodeGenerator::emitDebugHook(DebugHookID debugHookID, int firstLine, in
     instructions().append(debugHookID);
     instructions().append(firstLine);
     instructions().append(lastLine);
+    instructions().append(column);
 }
 
 void BytecodeGenerator::pushFinallyContext(StatementNode* finallyBlock)
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 52fd7e83c..490991fa7 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -506,7 +506,7 @@ namespace JSC {
         RegisterID* emitPushScope(RegisterID* scope);
         void emitPopScope();
 
-        void emitDebugHook(DebugHookID, int firstLine, int lastLine);
+        void emitDebugHook(DebugHookID, int firstLine, int lastLine, int column);
 
         int scopeDepth() { return m_dynamicScopeDepth + m_finallyDepth; }
         bool hasFinaliser() { return m_finallyDepth != 0; }
diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index d243e8ce0..249f822e2 100644
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -202,18 +202,21 @@ bool ArrayNode::isSimpleArray() const
     return true;
 }
 
-ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData, int lineNumber) const
+ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData, int lineNumber, int columnNumber) const
 {
     ASSERT(!m_elision && !m_optional);
     ElementNode* ptr = m_element;
     if (!ptr)
         return 0;
-    ArgumentListNode* head = new (globalData) ArgumentListNode(lineNumber, ptr->value());
+    JSTokenLocation location;
+    location.line = lineNumber;
+    location.column = columnNumber;
+    ArgumentListNode* head = new (globalData) ArgumentListNode(location, ptr->value());
     ArgumentListNode* tail = head;
     ptr = ptr->next();
     for (; ptr; ptr = ptr->next()) {
         ASSERT(!ptr->elision());
-        tail = new (globalData) ArgumentListNode(lineNumber, tail, ptr->value());
+        tail = new (globalData) ArgumentListNode(location, tail, ptr->value());
     }
     return head;
 }
@@ -536,7 +539,7 @@ RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator,
                 if (m_args->m_listNode->m_next) {
                     ASSERT(m_args->m_listNode->m_next->m_expr->isSimpleArray());
                     ASSERT(!m_args->m_listNode->m_next->m_next);
-                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_next->m_expr)->toArgumentList(generator.globalData(), 0);
+                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_next->m_expr)->toArgumentList(generator.globalData(), 0, 0);
                     RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
                     CallArguments callArguments(generator, m_args);
                     generator.emitNode(callArguments.thisRegister(), oldList->m_expr);
@@ -1385,7 +1388,7 @@ RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     return generator.emitNode(m_next);
 }
 
@@ -1428,7 +1431,7 @@ RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     return dst;
 }
 
@@ -1436,7 +1439,7 @@ RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, Regis
 
 RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine());
+    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine(), column());
     return dst;
 }
 
@@ -1445,7 +1448,7 @@ RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, Re
 RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     return generator.emitNode(dst, m_expr);
 }
 
@@ -1454,7 +1457,7 @@ RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, Regist
 RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     return generator.emitNode(m_expr);
 }
 
@@ -1462,7 +1465,7 @@ RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, Registe
 
 RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     
     RefPtr<Label> afterThen = generator.newLabel();
 
@@ -1486,7 +1489,7 @@ RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
 RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     
     RefPtr<Label> beforeElse = generator.newLabel();
     RefPtr<Label> afterElse = generator.newLabel();
@@ -1522,12 +1525,12 @@ RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
     RefPtr<Label> topOfLoop = generator.newLabel();
     generator.emitLabel(topOfLoop.get());
     generator.emitLoopHint();
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-   
+    generator.emitDebugHook(WillExecuteStatement, lastLine(), lastLine(), column());
+
     RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
+    generator.emitDebugHook(WillExecuteStatement, lastLine(), lastLine(), column());
     if (m_expr->hasConditionContextCodegen())
         generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
     else {
@@ -1546,7 +1549,7 @@ RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
     RefPtr<Label> topOfLoop = generator.newLabel();
 
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
+    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo(), m_expr->columnNo());
     if (m_expr->hasConditionContextCodegen())
         generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), true);
     else {
@@ -1560,7 +1563,7 @@ RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
 
     if (m_expr->hasConditionContextCodegen())
         generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
@@ -1581,7 +1584,7 @@ RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
 
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
 
     if (m_expr1)
         generator.emitNode(generator.ignoredResult(), m_expr1);
@@ -1602,7 +1605,7 @@ RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
     RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     if (m_expr3)
         generator.emitNode(generator.ignoredResult(), m_expr3);
 
@@ -1629,7 +1632,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     if (!m_lexpr->isLocation())
         return emitThrowReferenceError(generator, "Left side of for-in statement is not a reference.");
 
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
 
     if (m_init)
         generator.emitNode(generator.ignoredResult(), m_init);
@@ -1692,7 +1695,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
     generator.emitLabel(scope->continueTarget());
     generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     generator.emitLabel(scope->breakTarget());
     return dst;
 }
@@ -1702,7 +1705,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 // ECMA 12.7
 RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     
     LabelScope* scope = generator.continueTarget(m_ident);
     ASSERT(scope);
@@ -1716,7 +1719,7 @@ RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
 // ECMA 12.8
 RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     
     LabelScope* scope = generator.breakTarget(m_ident);
     ASSERT(scope);
@@ -1729,7 +1732,7 @@ RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     ASSERT(generator.codeType() == FunctionCode);
 
     if (dst == generator.ignoredResult())
@@ -1745,7 +1748,7 @@ RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
         generator.emitJumpScopes(l0.get(), 0);
         generator.emitLabel(l0.get());
     }
-    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine(), column());
     return generator.emitReturn(r0);
 }
 
@@ -1753,7 +1756,7 @@ RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     
     RefPtr<RegisterID> scope = generator.newTemporary();
     generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
@@ -1918,7 +1921,7 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
 
 RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
     
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
 
@@ -1933,7 +1936,7 @@ RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
 
     ASSERT(!generator.breakTarget(m_name));
 
@@ -1948,7 +1951,7 @@ RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
 
     if (dst == generator.ignoredResult())
         dst = 0;
@@ -1965,7 +1968,7 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
     // NOTE: The catch and finally blocks must be labeled explicitly, so the
     // optimizer knows they may be jumped to from anywhere.
 
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
 
     RefPtr<Label> tryStartLabel = generator.newLabel();
     if (m_finallyBlock)
@@ -2022,13 +2025,13 @@ inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, Regi
 
 RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine(), column());
 
     RefPtr<RegisterID> dstRegister = generator.newTemporary();
     generator.emitLoad(dstRegister.get(), jsUndefined());
     emitStatementsBytecode(generator, dstRegister.get());
 
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine(), column());
     generator.emitEnd(dstRegister.get());
     return 0;
 }
@@ -2037,13 +2040,13 @@ RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 
 RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine(), column());
 
     RefPtr<RegisterID> dstRegister = generator.newTemporary();
     generator.emitLoad(dstRegister.get(), jsUndefined());
     emitStatementsBytecode(generator, dstRegister.get());
 
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine(), column());
     generator.emitEnd(dstRegister.get());
     return 0;
 }
@@ -2052,7 +2055,7 @@ RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 
 RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
+    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine(), column());
     emitStatementsBytecode(generator, generator.ignoredResult());
 
     StatementNode* singleStatement = this->singleStatement();
@@ -2068,7 +2071,7 @@ RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, Registe
     // If there is no return we must automatically insert one.
     if (!returnNode) {
         RegisterID* r0 = generator.isConstructor() ? generator.thisRegister() : generator.emitLoad(0, jsUndefined());
-        generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+        generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine(), column());
         generator.emitReturn(r0);
         return 0;
     }
diff --git a/Source/JavaScriptCore/debugger/Debugger.h b/Source/JavaScriptCore/debugger/Debugger.h
index a23732918..bc743677e 100644
--- a/Source/JavaScriptCore/debugger/Debugger.h
+++ b/Source/JavaScriptCore/debugger/Debugger.h
@@ -42,14 +42,16 @@ namespace JSC {
         virtual void detach(JSGlobalObject*);
 
         virtual void sourceParsed(ExecState*, SourceProvider*, int errorLineNumber, const UString& errorMessage) = 0;
-        virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber, bool hasHandler) = 0;
-        virtual void atStatement(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
-        virtual void callEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
-        virtual void returnEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
 
-        virtual void willExecuteProgram(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
-        virtual void didExecuteProgram(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
-        virtual void didReachBreakpoint(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void exception(const DebuggerCallFrame&, intptr_t, int, int, bool) = 0;
+        virtual void atStatement(const DebuggerCallFrame&, intptr_t, int, int) = 0;
+        virtual void callEvent(const DebuggerCallFrame&, intptr_t, int, int) = 0;
+        virtual void returnEvent(const DebuggerCallFrame&, intptr_t, int, int) = 0;
+
+        virtual void willExecuteProgram(const DebuggerCallFrame&, intptr_t, int, int) = 0;
+        virtual void didExecuteProgram(const DebuggerCallFrame&, intptr_t, int, int) = 0;
+        virtual void didReachBreakpoint(const DebuggerCallFrame&, intptr_t, int, int) = 0;
+
 
         void recompileAllJSFunctions(JSGlobalData*);
 
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 01996f132..4f02ee793 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -950,7 +950,8 @@ bool AbstractState::execute(unsigned indexInBlock)
     }
             
     case PutByVal:
-    case PutByValAlias: {
+    case PutByValAlias:
+    case PutByValSafe: {
         node.setCanExit(true);
 
         Edge child1 = m_graph.varArgChild(node, 0);
@@ -966,7 +967,7 @@ bool AbstractState::execute(unsigned indexInBlock)
             || m_graph[child1].shouldSpeculateArguments()
 #endif
             ) {
-            ASSERT(node.op() == PutByVal);
+            ASSERT(node.op() == PutByVal || node.op() == PutByValSafe);
             clobberWorld(node.codeOrigin, indexInBlock);
             forNode(nodeIndex).makeTop();
             break;
@@ -1055,7 +1056,7 @@ bool AbstractState::execute(unsigned indexInBlock)
         ASSERT(m_graph[child1].shouldSpeculateArray());
         forNode(child1).filter(SpecArray);
         forNode(child2).filter(SpecInt32);
-        if (node.op() == PutByVal)
+        if (node.op() == PutByValSafe)
             clobberWorld(node.codeOrigin, indexInBlock);
         break;
     }
@@ -1335,7 +1336,7 @@ bool AbstractState::execute(unsigned indexInBlock)
             
     case PutScopedVar:
         node.setCanExit(false);
-        clobberStructures(indexInBlock);
+        clobberCapturedVars(node.codeOrigin);
         break;
             
     case GetById:
@@ -1415,7 +1416,8 @@ bool AbstractState::execute(unsigned indexInBlock)
         forNode(nodeIndex).set(SpecInt32);
         break;
             
-    case CheckStructure: {
+    case CheckStructure:
+    case ForwardCheckStructure: {
         // FIXME: We should be able to propagate the structure sets of constants (i.e. prototypes).
         AbstractValue& value = forNode(node.child1());
         node.setCanExit(
@@ -1431,6 +1433,7 @@ bool AbstractState::execute(unsigned indexInBlock)
         AbstractValue& value = forNode(node.child1());
         ASSERT(value.isClear() || isCellSpeculation(value.m_type)); // Value could be clear if we've proven must-exit due to a speculation statically known to be bad.
         value.filter(node.structure());
+        m_haveStructures = true;
         node.setCanExit(true);
         break;
     }
@@ -1609,6 +1612,12 @@ bool AbstractState::execute(unsigned indexInBlock)
 
 inline void AbstractState::clobberWorld(const CodeOrigin& codeOrigin, unsigned indexInBlock)
 {
+    clobberCapturedVars(codeOrigin);
+    clobberStructures(indexInBlock);
+}
+
+inline void AbstractState::clobberCapturedVars(const CodeOrigin& codeOrigin)
+{
     if (codeOrigin.inlineCallFrame) {
         const BitVector& capturedVars = codeOrigin.inlineCallFrame->capturedVars;
         for (size_t i = capturedVars.size(); i--;) {
@@ -1624,7 +1633,6 @@ inline void AbstractState::clobberWorld(const CodeOrigin& codeOrigin, unsigned i
         for (size_t i = m_variables.numberOfArguments(); i--;)
             m_variables.argument(i).makeTop();
     }
-    clobberStructures(indexInBlock);
 }
 
 inline void AbstractState::clobberStructures(unsigned indexInBlock)
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.h b/Source/JavaScriptCore/dfg/DFGAbstractState.h
index 95cadecbb..d2bc1a551 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.h
@@ -217,6 +217,7 @@ public:
     
 private:
     void clobberWorld(const CodeOrigin&, unsigned indexInBlock);
+    void clobberCapturedVars(const CodeOrigin&);
     void clobberStructures(unsigned indexInBlock);
     
     bool mergeStateAtTail(AbstractValue& destination, AbstractValue& inVariable, NodeIndex);
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractValue.h b/Source/JavaScriptCore/dfg/DFGAbstractValue.h
index f81af4ecf..402fd0fcd 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractValue.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractValue.h
@@ -317,13 +317,14 @@ struct AbstractValue {
     {
         m_type = SpecNone;
         m_structure.clear();
+        m_unclobberedStructure.clear();
         m_value = JSValue();
         checkConsistency();
     }
     
     bool isClear() const
     {
-        bool result = m_type == SpecNone && m_structure.isClear();
+        bool result = m_type == SpecNone && m_structure.isClear() && m_unclobberedStructure.isClear();
         if (result)
             ASSERT(!m_value);
         return result;
@@ -333,6 +334,7 @@ struct AbstractValue {
     {
         m_type = SpecTop;
         m_structure.makeTop();
+        m_unclobberedStructure.makeTop();
         m_value = JSValue();
         checkConsistency();
     }
@@ -353,7 +355,7 @@ struct AbstractValue {
     
     bool isTop() const
     {
-        return m_type == SpecTop && m_structure.isTop();
+        return m_type == SpecTop && m_structure.isTop() && m_unclobberedStructure.isTop();
     }
     
     bool valueIsTop() const
@@ -383,8 +385,11 @@ struct AbstractValue {
             // it may change in the future - for example between when we compile
             // the code and when we run it.
             m_structure.makeTop();
-        } else
+            m_unclobberedStructure.makeTop(); // FIXME: Consider not clobbering this.
+        } else {
             m_structure.clear();
+            m_unclobberedStructure.clear();
+        }
         
         m_type = speculationFromValue(value);
         m_value = value;
@@ -397,6 +402,9 @@ struct AbstractValue {
         m_structure.clear();
         m_structure.add(structure);
         
+        m_unclobberedStructure.clear();
+        m_unclobberedStructure.add(structure);
+        
         m_type = speculationFromStructure(structure);
         m_value = JSValue();
         
@@ -405,10 +413,13 @@ struct AbstractValue {
     
     void set(SpeculatedType type)
     {
-        if (type & SpecCell)
+        if (type & SpecCell) {
             m_structure.makeTop();
-        else
+            m_unclobberedStructure.makeTop();
+        } else {
             m_structure.clear();
+            m_unclobberedStructure.clear();
+        }
         m_type = type;
         m_value = JSValue();
         checkConsistency();
@@ -418,6 +429,7 @@ struct AbstractValue {
     {
         return m_type == other.m_type
             && m_structure == other.m_structure
+            && m_unclobberedStructure == other.m_unclobberedStructure
             && m_value == other.m_value;
     }
     bool operator!=(const AbstractValue& other) const
@@ -437,6 +449,7 @@ struct AbstractValue {
         } else {
             result |= mergeSpeculation(m_type, other.m_type);
             result |= m_structure.addAll(other.m_structure);
+            result |= m_unclobberedStructure.addAll(other.m_unclobberedStructure);
             if (m_value != other.m_value) {
                 result |= !!m_value;
                 m_value = JSValue();
@@ -451,8 +464,10 @@ struct AbstractValue {
     {
         mergeSpeculation(m_type, type);
         
-        if (type & SpecCell)
+        if (type & SpecCell) {
             m_structure.makeTop();
+            m_unclobberedStructure.makeTop();
+        }
         m_value = JSValue();
 
         checkConsistency();
@@ -462,6 +477,7 @@ struct AbstractValue {
     {
         m_type &= other.speculationFromStructures();
         m_structure.filter(other);
+        m_unclobberedStructure.filter(other);
         
         // It's possible that prior to the above two statements we had (Foo, TOP), where
         // Foo is a SpeculatedType that is disjoint with the passed StructureSet. In that
@@ -469,6 +485,7 @@ struct AbstractValue {
         // sure that new information gleaned from the SpeculatedType needs to be fed back
         // into the information gleaned from the StructureSet.
         m_structure.filter(m_type);
+        m_unclobberedStructure.filter(m_type);
         
         if (!!m_value && !validateIgnoringValue(m_value))
             clear();
@@ -487,6 +504,7 @@ struct AbstractValue {
         // to ensure that the structure filtering does the right thing is to filter on
         // the new type (None) rather than the one passed (Array).
         m_structure.filter(m_type);
+        m_unclobberedStructure.filter(m_type);
 
         if (!!m_value && !validateIgnoringValue(m_value))
             clear();
@@ -523,8 +541,8 @@ struct AbstractValue {
         if (isTop())
             return true;
         
-        if (!!m_value)
-            return m_value == value;
+        if (!!m_value && m_value != value)
+            return false;
         
         if (mergeSpeculations(m_type, speculationFromValue(value)) != m_type)
             return false;
@@ -545,10 +563,39 @@ struct AbstractValue {
         return true;
     }
     
+    bool validateForEntry(JSValue value) const
+    {
+        if (isTop())
+            return true;
+        
+        if (!!m_value && m_value != value)
+            return false;
+        
+        if (mergeSpeculations(m_type, speculationFromValue(value)) != m_type)
+            return false;
+        
+        if (value.isEmpty()) {
+            ASSERT(m_type & SpecEmpty);
+            return true;
+        }
+        
+        if (m_unclobberedStructure.isTop())
+            return true;
+        
+        if (!!value && value.isCell()) {
+            ASSERT(m_type & SpecCell);
+            return m_unclobberedStructure.contains(value.asCell()->structure());
+        }
+        
+        return true;
+    }
+    
     void checkConsistency() const
     {
-        if (!(m_type & SpecCell))
+        if (!(m_type & SpecCell)) {
             ASSERT(m_structure.isClear());
+            ASSERT(m_unclobberedStructure.isClear());
+        }
         
         if (isClear())
             ASSERT(!m_value);
@@ -566,12 +613,15 @@ struct AbstractValue {
     {
         fprintf(out, "(%s, ", speculationToString(m_type));
         m_structure.dump(out);
+        dataLog(", ");
+        m_unclobberedStructure.dump(out);
         if (!!m_value)
             fprintf(out, ", %s", m_value.description());
         fprintf(out, ")");
     }
 
     StructureAbstractValue m_structure;
+    StructureAbstractValue m_unclobberedStructure;
     SpeculatedType m_type;
     JSValue m_value;
 };
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index e4e94e90b..b7f48aa4b 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -257,6 +257,8 @@ private:
         }
 
         VariableAccessData* variableAccessData = newVariableAccessData(operand, isCaptured);
+        variableAccessData->mergeStructureCheckHoistingFailed(
+            m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache));
         NodeIndex nodeIndex = addToGraph(SetLocal, OpInfo(variableAccessData), value);
         m_currentBlock->variablesAtTail.local(operand) = nodeIndex;
     }
@@ -299,7 +301,8 @@ private:
                 // We're getting an argument in the first basic block; link
                 // the GetLocal to the SetArgument.
                 ASSERT(nodePtr->local() == static_cast<VirtualRegister>(operand));
-                nodeIndex = injectLazyOperandSpeculation(addToGraph(GetLocal, OpInfo(nodePtr->variableAccessData()), nodeIndex));
+                VariableAccessData* variable = nodePtr->variableAccessData();
+                nodeIndex = injectLazyOperandSpeculation(addToGraph(GetLocal, OpInfo(variable), nodeIndex));
                 m_currentBlock->variablesAtTail.argument(argument) = nodeIndex;
                 return nodeIndex;
             }
@@ -340,6 +343,8 @@ private:
             flushDirect(operand);
         
         VariableAccessData* variableAccessData = newVariableAccessData(operand, isCaptured);
+        variableAccessData->mergeStructureCheckHoistingFailed(
+            m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache));
         NodeIndex nodeIndex = addToGraph(SetLocal, OpInfo(variableAccessData), value);
         m_currentBlock->variablesAtTail.argument(argument) = nodeIndex;
     }
@@ -1723,7 +1728,11 @@ bool ByteCodeParser::parseBlock(unsigned limit)
     if (m_currentBlock == m_graph.m_blocks[0].get() && !m_inlineStackTop->m_inlineCallFrame) {
         m_graph.m_arguments.resize(m_numArguments);
         for (unsigned argument = 0; argument < m_numArguments; ++argument) {
-            NodeIndex setArgument = addToGraph(SetArgument, OpInfo(newVariableAccessData(argumentToOperand(argument), m_codeBlock->argumentIsCaptured(argument))));
+            VariableAccessData* variable = newVariableAccessData(
+                argumentToOperand(argument), m_codeBlock->argumentIsCaptured(argument));
+            variable->mergeStructureCheckHoistingFailed(
+                m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache));
+            NodeIndex setArgument = addToGraph(SetArgument, OpInfo(variable));
             m_graph.m_arguments[argument] = setArgument;
             m_currentBlock->variablesAtHead.setArgumentFirstTime(argument, setArgument);
             m_currentBlock->variablesAtTail.setArgumentFirstTime(argument, setArgument);
@@ -2152,10 +2161,14 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             NodeIndex property = get(currentInstruction[2].u.operand);
             NodeIndex value = get(currentInstruction[3].u.operand);
 
+            bool makeSafe =
+                m_inlineStackTop->m_profiledBlock->couldTakeSlowCase(m_currentIndex)
+                || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, OutOfBounds);
+            
             addVarArgChild(base);
             addVarArgChild(property);
             addVarArgChild(value);
-            addToGraph(Node::VarArg, PutByVal, OpInfo(0), OpInfo(0));
+            addToGraph(Node::VarArg, makeSafe ? PutByValSafe : PutByVal, OpInfo(0), OpInfo(0));
 
             NEXT_OPCODE(op_put_by_val);
         }
@@ -2222,7 +2235,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
         }
         case op_get_by_id:
         case op_get_by_id_out_of_line: {
-            SpeculatedType prediction = getPredictionWithoutOSRExit();
+            SpeculatedType prediction = getPrediction();
             
             NodeIndex base = get(currentInstruction[2].u.operand);
             unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[3].u.operand];
@@ -3010,6 +3023,7 @@ void ByteCodeParser::fixVariableAccessSpeculations()
         VariableAccessData* data = &m_graph.m_variableAccessData[i];
         data->find()->predict(data->nonUnifiedPrediction());
         data->find()->mergeIsCaptured(data->isCaptured());
+        data->find()->mergeStructureCheckHoistingFailed(data->structureCheckHoistingFailed());
     }
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
index 4532214ee..e9b1e0d8b 100644
--- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
@@ -284,7 +284,8 @@ private:
                     return index;
                 break;
             case PutByVal:
-            case PutByValAlias: {
+            case PutByValAlias:
+            case PutByValSafe: {
                 if (!m_graph.byValIsPure(node))
                     return NoNode;
                 if (m_graph.varArgChild(node, 0) == child1 && canonicalize(m_graph.varArgChild(node, 1)) == canonicalize(child2))
@@ -337,6 +338,7 @@ private:
             Node& node = m_graph[index];
             switch (node.op()) {
             case CheckStructure:
+            case ForwardCheckStructure:
                 if (node.child1() == child1
                     && structureSet.isSupersetOf(node.structureSet()))
                     return true;
@@ -362,6 +364,7 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
+            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -389,6 +392,7 @@ private:
             Node& node = m_graph[index];
             switch (node.op()) {
             case CheckStructure:
+            case ForwardCheckStructure:
                 if (node.child1() == child1
                     && node.structureSet().containsOnly(structure))
                     return true;
@@ -404,6 +408,7 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
+            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -437,6 +442,7 @@ private:
                 break;
             switch (node.op()) {
             case CheckStructure:
+            case ForwardCheckStructure:
                 return NoNode;
                 
             case PhantomPutStructure:
@@ -507,6 +513,7 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
+            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -551,6 +558,7 @@ private:
             case PutByVal:
             case PutByValAlias:
             case GetByVal:
+            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -603,6 +611,7 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
+            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -643,15 +652,6 @@ private:
                 // change the property storage pointer.
                 break;
                 
-            case PutByValAlias:
-                // PutByValAlias can't change the indexed storage pointer
-                break;
-                
-            case PutByVal:
-                if (isFixedIndexedStorageObjectSpeculation(m_graph[m_graph.varArgChild(node, 0)].prediction()) && m_graph.byValIsPure(node))
-                    break;
-                return NoNode;
-
             default:
                 if (m_graph.clobbersWorld(index))
                     return NoNode;
@@ -673,7 +673,7 @@ private:
         return NoNode;
     }
     
-    NodeIndex getLocalLoadElimination(VirtualRegister local, NodeIndex& relevantLocalOp)
+    NodeIndex getLocalLoadElimination(VirtualRegister local, NodeIndex& relevantLocalOp, bool careAboutClobbering)
     {
         relevantLocalOp = NoNode;
         
@@ -703,7 +703,7 @@ private:
                 break;
                 
             default:
-                if (m_graph.clobbersWorld(index))
+                if (careAboutClobbering && m_graph.clobbersWorld(index))
                     return NoNode;
                 break;
             }
@@ -944,13 +944,15 @@ private:
             
         case GetLocal: {
             VariableAccessData* variableAccessData = node.variableAccessData();
-            if (!variableAccessData->isCaptured())
+            if (m_fixpointState == FixpointNotConverged && !variableAccessData->isCaptured())
                 break;
             NodeIndex relevantLocalOp;
-            NodeIndex possibleReplacement = getLocalLoadElimination(variableAccessData->local(), relevantLocalOp);
-            ASSERT(relevantLocalOp == NoNode
-                   || m_graph[relevantLocalOp].op() == GetLocalUnlinked
-                   || m_graph[relevantLocalOp].variableAccessData() == variableAccessData);
+            NodeIndex possibleReplacement = getLocalLoadElimination(variableAccessData->local(), relevantLocalOp, variableAccessData->isCaptured());
+            if (relevantLocalOp == NoNode)
+                break;
+            if (m_graph[relevantLocalOp].op() != GetLocalUnlinked
+                && m_graph[relevantLocalOp].variableAccessData() != variableAccessData)
+                break;
             NodeIndex phiIndex = node.child1().index();
             if (!setReplacement(possibleReplacement))
                 break;
@@ -980,7 +982,7 @@ private:
             
         case GetLocalUnlinked: {
             NodeIndex relevantLocalOpIgnored;
-            m_changed |= setReplacement(getLocalLoadElimination(node.unlinkedLocal(), relevantLocalOpIgnored));
+            m_changed |= setReplacement(getLocalLoadElimination(node.unlinkedLocal(), relevantLocalOpIgnored, true));
             break;
         }
             
@@ -1093,7 +1095,8 @@ private:
                 setReplacement(getByValLoadElimination(node.child1().index(), node.child2().index()));
             break;
             
-        case PutByVal: {
+        case PutByVal:
+        case PutByValSafe: {
             Edge child1 = m_graph.varArgChild(node, 0);
             Edge child2 = m_graph.varArgChild(node, 1);
             if (isActionableMutableArraySpeculation(m_graph[child1].prediction())
@@ -1108,6 +1111,7 @@ private:
         }
             
         case CheckStructure:
+        case ForwardCheckStructure:
             if (checkStructureLoadElimination(node.structureSet(), node.child1().index()))
                 eliminate();
             break;
diff --git a/Source/JavaScriptCore/dfg/DFGDriver.cpp b/Source/JavaScriptCore/dfg/DFGDriver.cpp
index f160b6d35..ddad4f864 100644
--- a/Source/JavaScriptCore/dfg/DFGDriver.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDriver.cpp
@@ -38,6 +38,7 @@
 #include "DFGJITCompiler.h"
 #include "DFGPredictionPropagationPhase.h"
 #include "DFGRedundantPhiEliminationPhase.h"
+#include "DFGStructureCheckHoistingPhase.h"
 #include "DFGValidate.h"
 #include "DFGVirtualRegisterAllocationPhase.h"
 #include "Options.h"
@@ -101,7 +102,10 @@ inline bool compile(CompileMode compileMode, ExecState* exec, CodeBlock* codeBlo
         dfg.resetExitStates();
         performFixup(dfg);
     }
+    bool shouldRedoCFA = performStructureCheckHoisting(dfg);
     performCSE(dfg, FixpointConverged);
+    if (shouldRedoCFA)
+        performCFA(dfg);
 #if DFG_ENABLE(DEBUG_VERBOSE)
     dataLog("DFG optimization fixpoint converged in %u iterations.\n", cnt);
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index a1954d7e0..4e3cd5782 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -314,7 +314,8 @@ private:
             break;
         }
             
-        case PutByVal: {
+        case PutByVal:
+        case PutByValSafe: {
             Edge child1 = m_graph.varArgChild(node, 0);
             Edge child2 = m_graph.varArgChild(node, 1);
             Edge child3 = m_graph.varArgChild(node, 2);
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
index c7a4d94d2..9ae0648b8 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.cpp
+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -207,7 +207,7 @@ void Graph::dump(const char* prefix, NodeIndex nodeIndex)
         hasPrinted = !!node.child1();
     }
 
-    if (node.flags()) {
+    if (strlen(nodeFlagsAsString(node.flags()))) {
         dataLog("%s%s", hasPrinted ? ", " : "", nodeFlagsAsString(node.flags()));
         hasPrinted = true;
     }
@@ -287,13 +287,15 @@ void Graph::dump(const char* prefix, NodeIndex nodeIndex)
         dataLog("%sF:#%u", hasPrinted ? ", " : "", node.notTakenBlockIndex());
         hasPrinted = true;
     }
+    dataLog("%sbc#%u", hasPrinted ? ", " : "", node.codeOrigin.bytecodeIndex);
+    hasPrinted = true;
     (void)hasPrinted;
     
     dataLog(")");
 
     if (!skipped) {
         if (node.hasVariableAccessData())
-            dataLog("  predicting %s, double ratio %lf%s", speculationToString(node.variableAccessData()->prediction()), node.variableAccessData()->doubleVoteRatio(), node.variableAccessData()->shouldUseDoubleFormat() ? ", forcing double" : "");
+            dataLog("  predicting %s%s", speculationToString(node.variableAccessData()->prediction()), node.variableAccessData()->shouldUseDoubleFormat() ? ", forcing double" : "");
         else if (node.hasHeapPrediction())
             dataLog("  predicting %s", speculationToString(node.getHeapPrediction()));
     }
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index 3e6539353..fdb78cf9b 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -479,6 +479,15 @@ public:
             SpeculatedType prediction = at(varArgChild(node, 0)).prediction();
             if (!isActionableMutableArraySpeculation(prediction))
                 return false;
+            return true;
+        }
+            
+        case PutByValSafe: {
+            if (!at(varArgChild(node, 1)).shouldSpeculateInteger())
+                return false;
+            SpeculatedType prediction = at(varArgChild(node, 0)).prediction();
+            if (!isActionableMutableArraySpeculation(prediction))
+                return false;
             if (isArraySpeculation(prediction))
                 return false;
             return true;
@@ -524,6 +533,7 @@ public:
             return !isPredictedNumerical(node);
         case GetByVal:
         case PutByVal:
+        case PutByValSafe:
         case PutByValAlias:
             return !byValIsPure(node);
         default:
@@ -568,6 +578,42 @@ public:
         return node.children.child(index);
     }
     
+    void vote(Edge edge, unsigned ballot)
+    {
+        switch (at(edge).op()) {
+        case ValueToInt32:
+        case UInt32ToNumber:
+            edge = at(edge).child1();
+            break;
+        default:
+            break;
+        }
+        
+        if (at(edge).op() == GetLocal)
+            at(edge).variableAccessData()->vote(ballot);
+    }
+    
+    void vote(Node& node, unsigned ballot)
+    {
+        if (node.flags() & NodeHasVarArgs) {
+            for (unsigned childIdx = node.firstChild();
+                 childIdx < node.firstChild() + node.numChildren();
+                 childIdx++)
+                vote(m_varArgChildren[childIdx], ballot);
+            return;
+        }
+        
+        if (!node.child1())
+            return;
+        vote(node.child1(), ballot);
+        if (!node.child2())
+            return;
+        vote(node.child2(), ballot);
+        if (!node.child3())
+            return;
+        vote(node.child3(), ballot);
+    }
+    
     JSGlobalData& m_globalData;
     CodeBlock* m_codeBlock;
     CodeBlock* m_profiledBlock;
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
index e72bd5e36..60cdd4b50 100644
--- a/Source/JavaScriptCore/dfg/DFGNode.h
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -245,6 +245,13 @@ struct Node {
         children.reset();
     }
     
+    void convertToStructureTransitionWatchpoint()
+    {
+        ASSERT(m_op == CheckStructure);
+        m_opInfo = bitwise_cast<uintptr_t>(structureSet().singletonStructure());
+        m_op = StructureTransitionWatchpoint;
+    }
+    
     JSCell* weakConstant()
     {
         ASSERT(op() == WeakJSConstant);
@@ -651,7 +658,13 @@ struct Node {
     
     bool hasStructureSet()
     {
-        return op() == CheckStructure;
+        switch (op()) {
+        case CheckStructure:
+        case ForwardCheckStructure:
+            return true;
+        default:
+            return false;
+        }
     }
     
     StructureSet& structureSet()
diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
index 0ca0039b9..7657663a9 100644
--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
@@ -113,12 +113,14 @@ namespace JSC { namespace DFG {
     /* opcodes use VarArgs beause they may have up to 4 children. */\
     macro(GetByVal, NodeResultJS | NodeMustGenerate | NodeMightClobber) \
     macro(PutByVal, NodeMustGenerate | NodeHasVarArgs | NodeMightClobber) \
+    macro(PutByValSafe, NodeMustGenerate | NodeHasVarArgs | NodeMightClobber) \
     macro(PutByValAlias, NodeMustGenerate | NodeHasVarArgs | NodeMightClobber) \
     macro(GetById, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
     macro(GetByIdFlush, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
     macro(PutById, NodeMustGenerate | NodeClobbersWorld) \
     macro(PutByIdDirect, NodeMustGenerate | NodeClobbersWorld) \
     macro(CheckStructure, NodeMustGenerate) \
+    macro(ForwardCheckStructure, NodeMustGenerate) \
     /* Transition watchpoints are a contract between the party setting the watchpoint */\
     /* and the runtime system, where the party promises that the child object once had */\
     /* the structure being watched, and the runtime system in turn promises that the */\
diff --git a/Source/JavaScriptCore/dfg/DFGOSREntry.cpp b/Source/JavaScriptCore/dfg/DFGOSREntry.cpp
index 9a7bc96cc..97061bfb2 100644
--- a/Source/JavaScriptCore/dfg/DFGOSREntry.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSREntry.cpp
@@ -99,7 +99,7 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
         else
             value = exec->argument(argument - 1);
         
-        if (!entry->m_expectedValues.argument(argument).validate(value)) {
+        if (!entry->m_expectedValues.argument(argument).validateForEntry(value)) {
 #if ENABLE(JIT_VERBOSE_OSR)
             dataLog("    OSR failed because argument %zu is %s, expected ", argument, value.description());
             entry->m_expectedValues.argument(argument).dump(WTF::dataFile());
@@ -119,7 +119,7 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
             }
             continue;
         }
-        if (!entry->m_expectedValues.local(local).validate(exec->registers()[local].jsValue())) {
+        if (!entry->m_expectedValues.local(local).validateForEntry(exec->registers()[local].jsValue())) {
 #if ENABLE(JIT_VERBOSE_OSR)
             dataLog("    OSR failed because variable %zu is %s, expected ", local, exec->registers()[local].jsValue().description());
             entry->m_expectedValues.local(local).dump(WTF::dataFile());
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
index e9b02b2e3..b3701722e 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
@@ -64,7 +64,7 @@ bool OSRExit::considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, Code
     } else
         exitSite = FrequentExitSite(m_codeOriginForExitProfile.bytecodeIndex, m_kind);
     
-    return baselineCodeBlockForOriginAndBaselineCodeBlock(m_codeOrigin, profiledCodeBlock)->addFrequentExitSite(exitSite);
+    return baselineCodeBlockForOriginAndBaselineCodeBlock(m_codeOriginForExitProfile, profiledCodeBlock)->addFrequentExitSite(exitSite);
 }
 
 } } // namespace JSC::DFG
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 94479d6d0..882e1cd02 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -423,12 +423,15 @@ EncodedJSValue DFG_OPERATION operationGetByIdBuildListWithReturnAddress(ExecStat
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue baseValue = JSValue::decode(base);
     PropertySlot slot(baseValue);
     JSValue result = baseValue.get(exec, *propertyName, slot);
 
-    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
-    dfgBuildGetByIDList(exec, baseValue, *propertyName, slot, stubInfo);
+    if (accessType == static_cast<AccessType>(stubInfo.accessType))
+        dfgBuildGetByIDList(exec, baseValue, *propertyName, slot, stubInfo);
 
     return JSValue::encode(result);
 }
@@ -439,12 +442,15 @@ EncodedJSValue DFG_OPERATION operationGetByIdProtoBuildListWithReturnAddress(Exe
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue baseValue = JSValue::decode(base);
     PropertySlot slot(baseValue);
     JSValue result = baseValue.get(exec, *propertyName, slot);
-
-    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
-    dfgBuildGetByIDProtoList(exec, baseValue, *propertyName, slot, stubInfo);
+    
+    if (accessType == static_cast<AccessType>(stubInfo.accessType))
+        dfgBuildGetByIDProtoList(exec, baseValue, *propertyName, slot, stubInfo);
 
     return JSValue::encode(result);
 }
@@ -455,15 +461,19 @@ EncodedJSValue DFG_OPERATION operationGetByIdOptimizeWithReturnAddress(ExecState
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue baseValue = JSValue::decode(base);
     PropertySlot slot(baseValue);
     JSValue result = baseValue.get(exec, *propertyName, slot);
     
-    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
-    if (stubInfo.seen)
-        dfgRepatchGetByID(exec, baseValue, *propertyName, slot, stubInfo);
-    else
-        stubInfo.seen = true;
+    if (accessType == static_cast<AccessType>(stubInfo.accessType)) {
+        if (stubInfo.seen)
+            dfgRepatchGetByID(exec, baseValue, *propertyName, slot, stubInfo);
+        else
+            stubInfo.seen = true;
+    }
 
     return JSValue::encode(result);
 }
@@ -645,13 +655,18 @@ void DFG_OPERATION operationPutByIdStrictOptimizeWithReturnAddress(ExecState* ex
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue value = JSValue::decode(encodedValue);
     JSValue baseValue(base);
     PutPropertySlot slot(true);
     
     baseValue.put(exec, *propertyName, value, slot);
     
-    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    if (accessType != static_cast<AccessType>(stubInfo.accessType))
+        return;
+    
     if (stubInfo.seen)
         dfgRepatchPutByID(exec, baseValue, *propertyName, slot, stubInfo, NotDirect);
     else
@@ -664,13 +679,18 @@ void DFG_OPERATION operationPutByIdNonStrictOptimizeWithReturnAddress(ExecState*
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue value = JSValue::decode(encodedValue);
     JSValue baseValue(base);
     PutPropertySlot slot(false);
     
     baseValue.put(exec, *propertyName, value, slot);
     
-    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    if (accessType != static_cast<AccessType>(stubInfo.accessType))
+        return;
+    
     if (stubInfo.seen)
         dfgRepatchPutByID(exec, baseValue, *propertyName, slot, stubInfo, NotDirect);
     else
@@ -683,13 +703,18 @@ void DFG_OPERATION operationPutByIdDirectStrictOptimizeWithReturnAddress(ExecSta
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue value = JSValue::decode(encodedValue);
     PutPropertySlot slot(true);
     
     ASSERT(base->isObject());
     asObject(base)->putDirect(exec->globalData(), *propertyName, value, slot);
     
-    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    if (accessType != static_cast<AccessType>(stubInfo.accessType))
+        return;
+    
     if (stubInfo.seen)
         dfgRepatchPutByID(exec, base, *propertyName, slot, stubInfo, Direct);
     else
@@ -702,13 +727,18 @@ void DFG_OPERATION operationPutByIdDirectNonStrictOptimizeWithReturnAddress(Exec
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue value = JSValue::decode(encodedValue);
     PutPropertySlot slot(false);
     
     ASSERT(base->isObject());
     asObject(base)->putDirect(exec->globalData(), *propertyName, value, slot);
     
-    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    if (accessType != static_cast<AccessType>(stubInfo.accessType))
+        return;
+    
     if (stubInfo.seen)
         dfgRepatchPutByID(exec, base, *propertyName, slot, stubInfo, Direct);
     else
@@ -721,13 +751,18 @@ void DFG_OPERATION operationPutByIdStrictBuildListWithReturnAddress(ExecState* e
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue value = JSValue::decode(encodedValue);
     JSValue baseValue(base);
     PutPropertySlot slot(true);
     
     baseValue.put(exec, *propertyName, value, slot);
     
-    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    if (accessType != static_cast<AccessType>(stubInfo.accessType))
+        return;
+    
     dfgBuildPutByIdList(exec, baseValue, *propertyName, slot, stubInfo, NotDirect);
 }
 
@@ -737,13 +772,18 @@ void DFG_OPERATION operationPutByIdNonStrictBuildListWithReturnAddress(ExecState
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue value = JSValue::decode(encodedValue);
     JSValue baseValue(base);
     PutPropertySlot slot(false);
     
     baseValue.put(exec, *propertyName, value, slot);
     
-    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    if (accessType != static_cast<AccessType>(stubInfo.accessType))
+        return;
+    
     dfgBuildPutByIdList(exec, baseValue, *propertyName, slot, stubInfo, NotDirect);
 }
 
@@ -753,13 +793,18 @@ void DFG_OPERATION operationPutByIdDirectStrictBuildListWithReturnAddress(ExecSt
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+    
     JSValue value = JSValue::decode(encodedValue);
     PutPropertySlot slot(true);
     
     ASSERT(base->isObject());
     asObject(base)->putDirect(exec->globalData(), *propertyName, value, slot);
     
-    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    if (accessType != static_cast<AccessType>(stubInfo.accessType))
+        return;
+    
     dfgBuildPutByIdList(exec, base, *propertyName, slot, stubInfo, Direct);
 }
 
@@ -769,13 +814,18 @@ void DFG_OPERATION operationPutByIdDirectNonStrictBuildListWithReturnAddress(Exe
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue value = JSValue::decode(encodedValue);
     PutPropertySlot slot(false);
     
     ASSERT(base->isObject());
     asObject(base)->putDirect(exec->globalData(), *propertyName, value, slot);
     
-    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    if (accessType != static_cast<AccessType>(stubInfo.accessType))
+        return;
+    
     dfgBuildPutByIdList(exec, base, *propertyName, slot, stubInfo, Direct);
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
index 2e4f8094c..94f69abc2 100644
--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
@@ -637,6 +637,7 @@ private:
         }
         
         case PutByVal:
+        case PutByValSafe:
             changed |= m_graph[m_graph.varArgChild(node, 0)].mergeFlags(NodeUsedAsValue);
             changed |= m_graph[m_graph.varArgChild(node, 1)].mergeFlags(NodeUsedAsNumber | NodeUsedAsInt);
             changed |= m_graph[m_graph.varArgChild(node, 2)].mergeFlags(NodeUsedAsValue);
@@ -672,6 +673,7 @@ private:
         case ForceOSRExit:
         case SetArgument:
         case CheckStructure:
+        case ForwardCheckStructure:
         case StructureTransitionWatchpoint:
         case CheckFunction:
         case PutStructure:
@@ -746,42 +748,6 @@ private:
             propagate(m_graph[m_compileIndex]);
     }
     
-    void vote(Edge nodeUse, VariableAccessData::Ballot ballot)
-    {
-        switch (m_graph[nodeUse].op()) {
-        case ValueToInt32:
-        case UInt32ToNumber:
-            nodeUse = m_graph[nodeUse].child1();
-            break;
-        default:
-            break;
-        }
-        
-        if (m_graph[nodeUse].op() == GetLocal)
-            m_graph[nodeUse].variableAccessData()->vote(ballot);
-    }
-    
-    void vote(Node& node, VariableAccessData::Ballot ballot)
-    {
-        if (node.flags() & NodeHasVarArgs) {
-            for (unsigned childIdx = node.firstChild();
-                 childIdx < node.firstChild() + node.numChildren();
-                 childIdx++)
-                vote(m_graph.m_varArgChildren[childIdx], ballot);
-            return;
-        }
-        
-        if (!node.child1())
-            return;
-        vote(node.child1(), ballot);
-        if (!node.child2())
-            return;
-        vote(node.child2(), ballot);
-        if (!node.child3())
-            return;
-        vote(node.child3(), ballot);
-    }
-    
     void doRoundOfDoubleVoting()
     {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
@@ -798,16 +764,16 @@ private:
                 SpeculatedType left = m_graph[node.child1()].prediction();
                 SpeculatedType right = m_graph[node.child2()].prediction();
                 
-                VariableAccessData::Ballot ballot;
+                DoubleBallot ballot;
                 
                 if (isNumberSpeculation(left) && isNumberSpeculation(right)
                     && !m_graph.addShouldSpeculateInteger(node))
-                    ballot = VariableAccessData::VoteDouble;
+                    ballot = VoteDouble;
                 else
-                    ballot = VariableAccessData::VoteValue;
+                    ballot = VoteValue;
                 
-                vote(node.child1(), ballot);
-                vote(node.child2(), ballot);
+                m_graph.vote(node.child1(), ballot);
+                m_graph.vote(node.child2(), ballot);
                 break;
             }
                 
@@ -815,16 +781,16 @@ private:
                 SpeculatedType left = m_graph[node.child1()].prediction();
                 SpeculatedType right = m_graph[node.child2()].prediction();
                 
-                VariableAccessData::Ballot ballot;
+                DoubleBallot ballot;
                 
                 if (isNumberSpeculation(left) && isNumberSpeculation(right)
                     && !m_graph.mulShouldSpeculateInteger(node))
-                    ballot = VariableAccessData::VoteDouble;
+                    ballot = VoteDouble;
                 else
-                    ballot = VariableAccessData::VoteValue;
+                    ballot = VoteValue;
                 
-                vote(node.child1(), ballot);
-                vote(node.child2(), ballot);
+                m_graph.vote(node.child1(), ballot);
+                m_graph.vote(node.child2(), ballot);
                 break;
             }
 
@@ -835,46 +801,46 @@ private:
                 SpeculatedType left = m_graph[node.child1()].prediction();
                 SpeculatedType right = m_graph[node.child2()].prediction();
                 
-                VariableAccessData::Ballot ballot;
+                DoubleBallot ballot;
                 
                 if (isNumberSpeculation(left) && isNumberSpeculation(right)
                     && !(Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child1()])
                          && node.canSpeculateInteger()))
-                    ballot = VariableAccessData::VoteDouble;
+                    ballot = VoteDouble;
                 else
-                    ballot = VariableAccessData::VoteValue;
+                    ballot = VoteValue;
                 
-                vote(node.child1(), ballot);
-                vote(node.child2(), ballot);
+                m_graph.vote(node.child1(), ballot);
+                m_graph.vote(node.child2(), ballot);
                 break;
             }
                 
             case ArithAbs:
-                VariableAccessData::Ballot ballot;
+                DoubleBallot ballot;
                 if (!(m_graph[node.child1()].shouldSpeculateInteger()
                       && node.canSpeculateInteger()))
-                    ballot = VariableAccessData::VoteDouble;
+                    ballot = VoteDouble;
                 else
-                    ballot = VariableAccessData::VoteValue;
+                    ballot = VoteValue;
                 
-                vote(node.child1(), ballot);
+                m_graph.vote(node.child1(), ballot);
                 break;
                 
             case ArithSqrt:
-                vote(node.child1(), VariableAccessData::VoteDouble);
+                m_graph.vote(node.child1(), VoteDouble);
                 break;
                 
             case SetLocal: {
                 SpeculatedType prediction = m_graph[node.child1()].prediction();
                 if (isDoubleSpeculation(prediction))
-                    node.variableAccessData()->vote(VariableAccessData::VoteDouble);
+                    node.variableAccessData()->vote(VoteDouble);
                 else if (!isNumberSpeculation(prediction) || isInt32Speculation(prediction))
-                    node.variableAccessData()->vote(VariableAccessData::VoteValue);
+                    node.variableAccessData()->vote(VoteValue);
                 break;
             }
                 
             default:
-                vote(node, VariableAccessData::VoteValue);
+                m_graph.vote(node, VoteValue);
                 break;
             }
         }
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 179ad45fa..f17e2d7e4 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -56,6 +56,163 @@ SpeculativeJIT::~SpeculativeJIT()
     WTF::deleteAllValues(m_slowPathGenerators);
 }
 
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::Jump jumpToFail)
+{
+    if (!m_compileOkay)
+        return;
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+    m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex), jumpToFail, this, m_stream->size()));
+}
+
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::Jump jumpToFail)
+{
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+    speculationCheck(kind, jsValueSource, nodeUse.index(), jumpToFail);
+}
+
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::JumpList& jumpsToFail)
+{
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+    Vector<MacroAssembler::Jump, 16> jumpVector = jumpsToFail.jumps();
+    for (unsigned i = 0; i < jumpVector.size(); ++i)
+        speculationCheck(kind, jsValueSource, nodeIndex, jumpVector[i]);
+}
+
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::JumpList& jumpsToFail)
+{
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+    speculationCheck(kind, jsValueSource, nodeUse.index(), jumpsToFail);
+}
+
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)
+{
+    if (!m_compileOkay)
+        return;
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+    m_jit.codeBlock()->appendSpeculationRecovery(recovery);
+    m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex), jumpToFail, this, m_stream->size(), m_jit.codeBlock()->numberOfSpeculationRecoveries()));
+}
+
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)
+{
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+    speculationCheck(kind, jsValueSource, nodeUse.index(), jumpToFail, recovery);
+}
+
+JumpReplacementWatchpoint* SpeculativeJIT::speculationWatchpoint(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex)
+{
+    if (!m_compileOkay)
+        return 0;
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+    OSRExit& exit = m_jit.codeBlock()->osrExit(
+        m_jit.codeBlock()->appendOSRExit(
+            OSRExit(kind, jsValueSource,
+                    m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex),
+                    JITCompiler::Jump(), this, m_stream->size())));
+    exit.m_watchpointIndex = m_jit.codeBlock()->appendWatchpoint(
+        JumpReplacementWatchpoint(m_jit.watchpointLabel()));
+    return &m_jit.codeBlock()->watchpoint(exit.m_watchpointIndex);
+}
+
+JumpReplacementWatchpoint* SpeculativeJIT::speculationWatchpoint(ExitKind kind)
+{
+    return speculationWatchpoint(kind, JSValueSource(), NoNode);
+}
+
+void SpeculativeJIT::forwardSpeculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::Jump jumpToFail, const ValueRecovery& valueRecovery)
+{
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+    speculationCheck(kind, jsValueSource, nodeIndex, jumpToFail);
+    
+#if !ASSERT_DISABLED
+    if (!valueRecovery) {
+        // Check that the preceding node was a SetLocal with the same code origin.
+        Node* setLocal = &at(m_jit.graph().m_blocks[m_block]->at(m_indexInBlock - 1));
+        ASSERT(setLocal->op() == SetLocal);
+        ASSERT(setLocal->codeOrigin == at(m_compileIndex).codeOrigin);
+    }
+#endif
+    
+    unsigned setLocalIndexInBlock = m_indexInBlock + 1;
+    
+    Node* setLocal = &at(m_jit.graph().m_blocks[m_block]->at(setLocalIndexInBlock));
+    bool hadInt32ToDouble = false;
+    
+    if (setLocal->op() == Int32ToDouble) {
+        setLocal = &at(m_jit.graph().m_blocks[m_block]->at(++setLocalIndexInBlock));
+        hadInt32ToDouble = true;
+    }
+    if (setLocal->op() == Flush || setLocal->op() == Phantom)
+        setLocal = &at(m_jit.graph().m_blocks[m_block]->at(++setLocalIndexInBlock));
+        
+    if (!!valueRecovery) {
+        if (hadInt32ToDouble)
+            ASSERT(at(setLocal->child1()).child1() == m_compileIndex);
+        else
+            ASSERT(setLocal->child1() == m_compileIndex);
+    }
+    ASSERT(setLocal->op() == SetLocal);
+    ASSERT(setLocal->codeOrigin == at(m_compileIndex).codeOrigin);
+
+    Node* nextNode = &at(m_jit.graph().m_blocks[m_block]->at(setLocalIndexInBlock + 1));
+    ASSERT(nextNode->codeOrigin != at(m_compileIndex).codeOrigin);
+        
+    OSRExit& exit = m_jit.codeBlock()->lastOSRExit();
+    exit.m_codeOrigin = nextNode->codeOrigin;
+        
+    if (!valueRecovery)
+        return;
+    exit.m_lastSetOperand = setLocal->local();
+    exit.m_valueRecoveryOverride = adoptRef(
+        new ValueRecoveryOverride(setLocal->local(), valueRecovery));
+}
+
+void SpeculativeJIT::forwardSpeculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::JumpList& jumpsToFail, const ValueRecovery& valueRecovery)
+{
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+    Vector<MacroAssembler::Jump, 16> jumpVector = jumpsToFail.jumps();
+    for (unsigned i = 0; i < jumpVector.size(); ++i)
+        forwardSpeculationCheck(kind, jsValueSource, nodeIndex, jumpVector[i], valueRecovery);
+}
+
+void SpeculativeJIT::speculationCheckWithConditionalDirection(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::Jump jumpToFail, bool isForward)
+{
+    if (isForward)
+        forwardSpeculationCheck(kind, jsValueSource, nodeIndex, jumpToFail);
+    else
+        speculationCheck(kind, jsValueSource, nodeIndex, jumpToFail);
+}
+
+void SpeculativeJIT::terminateSpeculativeExecution(ExitKind kind, JSValueRegs jsValueRegs, NodeIndex nodeIndex)
+{
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+#if DFG_ENABLE(DEBUG_VERBOSE)
+    dataLog("SpeculativeJIT was terminated.\n");
+#endif
+    if (!m_compileOkay)
+        return;
+    speculationCheck(kind, jsValueRegs, nodeIndex, m_jit.jump());
+    m_compileOkay = false;
+}
+
+void SpeculativeJIT::terminateSpeculativeExecution(ExitKind kind, JSValueRegs jsValueRegs, Edge nodeUse)
+{
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+    terminateSpeculativeExecution(kind, jsValueRegs, nodeUse.index());
+}
+
+void SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection(ExitKind kind, JSValueRegs jsValueRegs, NodeIndex nodeIndex, bool isForward)
+{
+    ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
+#if DFG_ENABLE(DEBUG_VERBOSE)
+    dataLog("SpeculativeJIT was terminated.\n");
+#endif
+    if (!m_compileOkay)
+        return;
+    speculationCheckWithConditionalDirection(kind, jsValueRegs, nodeIndex, m_jit.jump(), isForward);
+    m_compileOkay = false;
+}
+
 void SpeculativeJIT::addSlowPathGenerator(PassOwnPtr<SlowPathGenerator> slowPathGenerator)
 {
     m_slowPathGenerators.append(slowPathGenerator.leakPtr());
@@ -2902,7 +3059,7 @@ void SpeculativeJIT::compileGetIndexedPropertyStorage(Node& node)
         ASSERT_NOT_REACHED();
     } else if (at(node.child1()).prediction() == SpecString) {
         if (!isStringSpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSString::s_info)));
+            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
 
         m_jit.loadPtr(MacroAssembler::Address(baseReg, JSString::offsetOfValue()), storageReg);
         
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index f43323afd..96f2fec0a 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -306,7 +306,7 @@ public:
     GPRReg fillSpeculateInt(NodeIndex, DataFormat& returnFormat);
     GPRReg fillSpeculateIntStrict(NodeIndex);
     FPRReg fillSpeculateDouble(NodeIndex);
-    GPRReg fillSpeculateCell(NodeIndex);
+    GPRReg fillSpeculateCell(NodeIndex, bool isForwardSpeculation = false);
     GPRReg fillSpeculateBoolean(NodeIndex);
     GeneratedOperandType checkGeneratedTypeForToInt32(NodeIndex);
 
@@ -2163,130 +2163,33 @@ public:
 #endif
 
     // Add a speculation check without additional recovery.
-    void speculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::Jump jumpToFail)
-    {
-        if (!m_compileOkay)
-            return;
-        ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-        m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex), jumpToFail, this, m_stream->size()));
-    }
-    void speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::Jump jumpToFail)
-    {
-        ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-        speculationCheck(kind, jsValueSource, nodeUse.index(), jumpToFail);
-    }
+    void speculationCheck(ExitKind, JSValueSource, NodeIndex, MacroAssembler::Jump jumpToFail);
+    void speculationCheck(ExitKind, JSValueSource, Edge, MacroAssembler::Jump jumpToFail);
     // Add a set of speculation checks without additional recovery.
-    void speculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::JumpList& jumpsToFail)
-    {
-        ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-        Vector<MacroAssembler::Jump, 16> jumpVector = jumpsToFail.jumps();
-        for (unsigned i = 0; i < jumpVector.size(); ++i)
-            speculationCheck(kind, jsValueSource, nodeIndex, jumpVector[i]);
-    }
-    void speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::JumpList& jumpsToFail)
-    {
-        ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-        speculationCheck(kind, jsValueSource, nodeUse.index(), jumpsToFail);
-    }
+    void speculationCheck(ExitKind, JSValueSource, NodeIndex, MacroAssembler::JumpList& jumpsToFail);
+    void speculationCheck(ExitKind, JSValueSource, Edge, MacroAssembler::JumpList& jumpsToFail);
     // Add a speculation check with additional recovery.
-    void speculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)
-    {
-        if (!m_compileOkay)
-            return;
-        ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-        m_jit.codeBlock()->appendSpeculationRecovery(recovery);
-        m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex), jumpToFail, this, m_stream->size(), m_jit.codeBlock()->numberOfSpeculationRecoveries()));
-    }
-    void speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)
-    {
-        ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-        speculationCheck(kind, jsValueSource, nodeUse.index(), jumpToFail, recovery);
-    }
+    void speculationCheck(ExitKind, JSValueSource, NodeIndex, MacroAssembler::Jump jumpToFail, const SpeculationRecovery&);
+    void speculationCheck(ExitKind, JSValueSource, Edge, MacroAssembler::Jump jumpToFail, const SpeculationRecovery&);
     // Use this like you would use speculationCheck(), except that you don't pass it a jump
     // (because you don't have to execute a branch; that's kind of the whole point), and you
     // must register the returned Watchpoint with something relevant. In general, this should
     // be used with extreme care. Use speculationCheck() unless you've got an amazing reason
     // not to.
-    JumpReplacementWatchpoint* speculationWatchpoint(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex)
-    {
-        if (!m_compileOkay)
-            return 0;
-        ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-        OSRExit& exit = m_jit.codeBlock()->osrExit(
-            m_jit.codeBlock()->appendOSRExit(
-                OSRExit(kind, jsValueSource,
-                        m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex),
-                        JITCompiler::Jump(), this, m_stream->size())));
-        exit.m_watchpointIndex = m_jit.codeBlock()->appendWatchpoint(
-            JumpReplacementWatchpoint(m_jit.watchpointLabel()));
-        return &m_jit.codeBlock()->watchpoint(exit.m_watchpointIndex);
-    }
+    JumpReplacementWatchpoint* speculationWatchpoint(ExitKind, JSValueSource, NodeIndex);
     // The default for speculation watchpoints is that they're uncounted, because the
     // act of firing a watchpoint invalidates it. So, future recompilations will not
     // attempt to set this watchpoint again.
-    JumpReplacementWatchpoint* speculationWatchpoint()
-    {
-        return speculationWatchpoint(UncountableWatchpoint, JSValueSource(), NoNode);
-    }
-    void forwardSpeculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::Jump jumpToFail, const ValueRecovery& valueRecovery)
-    {
-        ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-        speculationCheck(kind, jsValueSource, nodeIndex, jumpToFail);
-        
-        unsigned setLocalIndexInBlock = m_indexInBlock + 1;
-        
-        Node* setLocal = &at(m_jit.graph().m_blocks[m_block]->at(setLocalIndexInBlock));
-        bool hadInt32ToDouble = false;
-        
-        if (setLocal->op() == Int32ToDouble) {
-            setLocal = &at(m_jit.graph().m_blocks[m_block]->at(++setLocalIndexInBlock));
-            hadInt32ToDouble = true;
-        }
-        if (setLocal->op() == Flush || setLocal->op() == Phantom)
-            setLocal = &at(m_jit.graph().m_blocks[m_block]->at(++setLocalIndexInBlock));
-        
-        if (hadInt32ToDouble)
-            ASSERT(at(setLocal->child1()).child1() == m_compileIndex);
-        else
-            ASSERT(setLocal->child1() == m_compileIndex);
-        ASSERT(setLocal->op() == SetLocal);
-        ASSERT(setLocal->codeOrigin == at(m_compileIndex).codeOrigin);
-
-        Node* nextNode = &at(m_jit.graph().m_blocks[m_block]->at(setLocalIndexInBlock + 1));
-        ASSERT(nextNode->codeOrigin != at(m_compileIndex).codeOrigin);
-        
-        OSRExit& exit = m_jit.codeBlock()->lastOSRExit();
-        exit.m_codeOrigin = nextNode->codeOrigin;
-        exit.m_lastSetOperand = setLocal->local();
-        
-        exit.m_valueRecoveryOverride = adoptRef(
-            new ValueRecoveryOverride(setLocal->local(), valueRecovery));
-    }
-    void forwardSpeculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::JumpList& jumpsToFail, const ValueRecovery& valueRecovery)
-    {
-        ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-        Vector<MacroAssembler::Jump, 16> jumpVector = jumpsToFail.jumps();
-        for (unsigned i = 0; i < jumpVector.size(); ++i)
-            forwardSpeculationCheck(kind, jsValueSource, nodeIndex, jumpVector[i], valueRecovery);
-    }
-
+    JumpReplacementWatchpoint* speculationWatchpoint(ExitKind = UncountableWatchpoint);
+    // Note: not specifying the valueRecovery argument (leaving it as ValueRecovery()) implies
+    // that you've ensured that there exists a MovHint prior to your use of forwardSpeculationCheck().
+    void forwardSpeculationCheck(ExitKind, JSValueSource, NodeIndex, MacroAssembler::Jump jumpToFail, const ValueRecovery& = ValueRecovery());
+    void forwardSpeculationCheck(ExitKind, JSValueSource, NodeIndex, MacroAssembler::JumpList& jumpsToFail, const ValueRecovery& = ValueRecovery());
+    void speculationCheckWithConditionalDirection(ExitKind, JSValueSource, NodeIndex, MacroAssembler::Jump jumpToFail, bool isForward);
     // Called when we statically determine that a speculation will fail.
-    void terminateSpeculativeExecution(ExitKind kind, JSValueRegs jsValueRegs, NodeIndex nodeIndex)
-    {
-        ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-#if DFG_ENABLE(DEBUG_VERBOSE)
-        dataLog("SpeculativeJIT was terminated.\n");
-#endif
-        if (!m_compileOkay)
-            return;
-        speculationCheck(kind, jsValueRegs, nodeIndex, m_jit.jump());
-        m_compileOkay = false;
-    }
-    void terminateSpeculativeExecution(ExitKind kind, JSValueRegs jsValueRegs, Edge nodeUse)
-    {
-        ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-        terminateSpeculativeExecution(kind, jsValueRegs, nodeUse.index());
-    }
+    void terminateSpeculativeExecution(ExitKind, JSValueRegs, NodeIndex);
+    void terminateSpeculativeExecution(ExitKind, JSValueRegs, Edge);
+    void terminateSpeculativeExecutionWithConditionalDirection(ExitKind, JSValueRegs, NodeIndex, bool isForward);
     
     template<bool strict>
     GPRReg fillSpeculateIntInternal(NodeIndex, DataFormat& returnFormat);
@@ -2912,10 +2815,11 @@ private:
 
 class SpeculateCellOperand {
 public:
-    explicit SpeculateCellOperand(SpeculativeJIT* jit, Edge use)
+    explicit SpeculateCellOperand(SpeculativeJIT* jit, Edge use, bool isForwardSpeculation = false)
         : m_jit(jit)
         , m_index(use.index())
         , m_gprOrInvalid(InvalidGPRReg)
+        , m_isForwardSpeculation(isForwardSpeculation)
     {
         ASSERT(m_jit);
         ASSERT(use.useKind() != DoubleUse);
@@ -2937,7 +2841,7 @@ public:
     GPRReg gpr()
     {
         if (m_gprOrInvalid == InvalidGPRReg)
-            m_gprOrInvalid = m_jit->fillSpeculateCell(index());
+            m_gprOrInvalid = m_jit->fillSpeculateCell(index(), m_isForwardSpeculation);
         return m_gprOrInvalid;
     }
     
@@ -2950,6 +2854,7 @@ private:
     SpeculativeJIT* m_jit;
     NodeIndex m_index;
     GPRReg m_gprOrInvalid;
+    bool m_isForwardSpeculation;
 };
 
 class SpeculateBooleanOperand {
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index 6209da485..bf3503d6d 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -1284,13 +1284,13 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
     }
 }
 
-GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
+GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex, bool isForwardSpeculation)
 {
 #if DFG_ENABLE(DEBUG_VERBOSE)
     dataLog("SpecCell@%d   ", nodeIndex);
 #endif
     if (isKnownNotCell(nodeIndex)) {
-        terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
+        terminateSpeculativeExecutionWithConditionalDirection(Uncountable, JSValueRegs(), NoNode, isForwardSpeculation);
         return allocate();
     }
 
@@ -1314,7 +1314,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
 
         ASSERT((info.spillFormat() & DataFormatJS) || info.spillFormat() == DataFormatCell);
         if (!isCellSpeculation(type))
-            speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::CellTag)));
+            speculationCheckWithConditionalDirection(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::CellTag)), isForwardSpeculation);
         GPRReg gpr = allocate();
         m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);
         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
@@ -1335,7 +1335,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
         m_gprs.lock(tagGPR);
         m_gprs.lock(payloadGPR);
         if (!isCellSpeculation(type))
-            speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::CellTag)));
+            speculationCheckWithConditionalDirection(BadType, JSValueRegs(tagGPR, payloadGPR), nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::CellTag)), isForwardSpeculation);
         m_gprs.unlock(tagGPR);
         m_gprs.release(tagGPR);
         m_gprs.release(payloadGPR);
@@ -2483,7 +2483,8 @@ void SpeculativeJIT::compile(Node& node)
         break;
     }
 
-    case PutByVal: {
+    case PutByVal:
+    case PutByValSafe: {
         Edge child1 = m_jit.graph().varArgChild(node, 0);
         Edge child2 = m_jit.graph().varArgChild(node, 1);
         Edge child3 = m_jit.graph().varArgChild(node, 2);
@@ -2599,12 +2600,14 @@ void SpeculativeJIT::compile(Node& node)
         if (!isArraySpeculation(m_state.forNode(child1).m_type))
             speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), child1, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
 
+        MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
+        if (node.op() == PutByVal)
+            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, beyondArrayBounds);
+
         base.use();
         property.use();
         value.use();
         
-        MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
-
         // Get the array storage.
         GPRReg storageReg = scratchReg;
         m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
@@ -2626,12 +2629,14 @@ void SpeculativeJIT::compile(Node& node)
         m_jit.store32(valueTagReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
         m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
         
-        addSlowPathGenerator(
-            slowPathCall(
-                beyondArrayBounds, this,
-                m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
-                NoResult, baseReg, propertyReg, valueTagReg, valuePayloadReg));
-
+        if (node.op() == PutByValSafe) {
+            addSlowPathGenerator(
+                slowPathCall(
+                    beyondArrayBounds, this,
+                    m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
+                    NoResult, baseReg, propertyReg, valueTagReg, valuePayloadReg));
+        }
+            
         noResult(m_compileIndex, UseChildrenCalledExplicitly);
         break;
     }
@@ -2990,7 +2995,7 @@ void SpeculativeJIT::compile(Node& node)
             m_jit.move(op1PayloadGPR, resultPayloadGPR);
         } else {
             MacroAssembler::Jump alreadyPrimitive = m_jit.branch32(MacroAssembler::NotEqual, op1TagGPR, TrustedImm32(JSValue::CellTag));
-            MacroAssembler::Jump notPrimitive = m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1PayloadGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSString::s_info));
+            MacroAssembler::Jump notPrimitive = m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1PayloadGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get()));
             
             alreadyPrimitive.link(&m_jit);
             m_jit.move(op1TagGPR, resultTagGPR);
@@ -3174,7 +3179,7 @@ void SpeculativeJIT::compile(Node& node)
             GPRReg thisValueGPR = thisValue.gpr();
             
             if (!isObjectSpeculation(m_state.forNode(node.child1()).m_type))
-                speculationCheck(BadType, JSValueSource::unboxedCell(thisValueGPR), node.child1(), m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(thisValueGPR, JSCell::classInfoOffset()), JITCompiler::TrustedImmPtr(&JSString::s_info)));
+                speculationCheck(BadType, JSValueSource::unboxedCell(thisValueGPR), node.child1(), m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(thisValueGPR, JSCell::structureOffset()), JITCompiler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
             
             GPRTemporary result(this, thisValue);
             GPRReg resultGPR = result.gpr();
@@ -3418,7 +3423,7 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg resultGPR = result.gpr();
         
         if (!isStringSpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSString::s_info)));
+            speculationCheck(BadType, JSValueSource::unboxedCell(baseGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
         
         m_jit.load32(MacroAssembler::Address(baseGPR, JSString::offsetOfLength()), resultGPR);
 
@@ -3470,7 +3475,8 @@ void SpeculativeJIT::compile(Node& node)
         break;
     }
 
-    case CheckStructure: {
+    case CheckStructure:
+    case ForwardCheckStructure: {
         AbstractValue& value = m_state.forNode(node.child1());
         if (value.m_structure.isSubsetOf(node.structureSet())
             && isCellSpeculation(value.m_type)) {
@@ -3478,13 +3484,19 @@ void SpeculativeJIT::compile(Node& node)
             break;
         }
         
-        SpeculateCellOperand base(this, node.child1());
+        SpeculateCellOperand base(this, node.child1(), node.op() == ForwardCheckStructure);
         
         ASSERT(node.structureSet().size());
         
-        if (node.structureSet().size() == 1)
-            speculationCheck(BadCache, JSValueRegs(), NoNode, m_jit.branchWeakPtr(JITCompiler::NotEqual, JITCompiler::Address(base.gpr(), JSCell::structureOffset()), node.structureSet()[0]));
-        else {
+        if (node.structureSet().size() == 1) {
+            speculationCheckWithConditionalDirection(
+                BadCache, JSValueRegs(), NoNode,
+                m_jit.branchWeakPtr(
+                    JITCompiler::NotEqual,
+                    JITCompiler::Address(base.gpr(), JSCell::structureOffset()),
+                    node.structureSet()[0]),
+                node.op() == ForwardCheckStructure);
+        } else {
             GPRTemporary structure(this);
             
             m_jit.loadPtr(JITCompiler::Address(base.gpr(), JSCell::structureOffset()), structure.gpr());
@@ -3494,7 +3506,11 @@ void SpeculativeJIT::compile(Node& node)
             for (size_t i = 0; i < node.structureSet().size() - 1; ++i)
                 done.append(m_jit.branchWeakPtr(JITCompiler::Equal, structure.gpr(), node.structureSet()[i]));
             
-            speculationCheck(BadCache, JSValueRegs(), NoNode, m_jit.branchWeakPtr(JITCompiler::NotEqual, structure.gpr(), node.structureSet().last()));
+            speculationCheckWithConditionalDirection(
+                BadCache, JSValueRegs(), NoNode,
+                m_jit.branchWeakPtr(
+                    JITCompiler::NotEqual, structure.gpr(), node.structureSet().last()),
+                node.op() == ForwardCheckStructure);
             
             done.link(&m_jit);
         }
@@ -3505,7 +3521,7 @@ void SpeculativeJIT::compile(Node& node)
         
     case StructureTransitionWatchpoint: {
         m_jit.addWeakReference(node.structure());
-        node.structure()->addTransitionWatchpoint(speculationWatchpoint());
+        node.structure()->addTransitionWatchpoint(speculationWatchpoint(BadCache));
         
 #if !ASSERT_DISABLED
         SpeculateCellOperand op1(this, node.child1());
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index 39f4a0740..5541113f2 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -1326,7 +1326,7 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
     }
 }
 
-GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
+GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex, bool isForwardSpeculation)
 {
 #if DFG_ENABLE(DEBUG_VERBOSE)
     dataLog("SpecCell@%d   ", nodeIndex);
@@ -1339,7 +1339,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
     switch (info.registerFormat()) {
     case DataFormatNone: {
         if (info.spillFormat() == DataFormatInteger || info.spillFormat() == DataFormatDouble) {
-            terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
+            terminateSpeculativeExecutionWithConditionalDirection(Uncountable, JSValueRegs(), NoNode, isForwardSpeculation);
             return allocate();
         }
         
@@ -1353,7 +1353,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
                 info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
                 return gpr;
             }
-            terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
+            terminateSpeculativeExecutionWithConditionalDirection(Uncountable, JSValueRegs(), NoNode, isForwardSpeculation);
             return gpr;
         }
         ASSERT(info.spillFormat() & DataFormatJS);
@@ -1362,7 +1362,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
 
         info.fillJSValue(*m_stream, gpr, DataFormatJS);
         if (!isCellSpeculation(type))
-            speculationCheck(BadType, JSValueRegs(gpr), nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister));
+            speculationCheckWithConditionalDirection(BadType, JSValueRegs(gpr), nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister), isForwardSpeculation);
         info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
         return gpr;
     }
@@ -1378,7 +1378,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
         GPRReg gpr = info.gpr();
         m_gprs.lock(gpr);
         if (!isCellSpeculation(type))
-            speculationCheck(BadType, JSValueRegs(gpr), nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister));
+            speculationCheckWithConditionalDirection(BadType, JSValueRegs(gpr), nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister), isForwardSpeculation);
         info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
         return gpr;
     }
@@ -1389,7 +1389,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
     case DataFormatDouble:
     case DataFormatJSBoolean:
     case DataFormatBoolean: {
-        terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
+        terminateSpeculativeExecutionWithConditionalDirection(Uncountable, JSValueRegs(), NoNode, isForwardSpeculation);
         return allocate();
     }
 
@@ -1578,7 +1578,7 @@ void SpeculativeJIT::compileObjectToObjectOrOtherEquality(
     
     // We know that within this branch, rightChild must not be a cell. Check if that is enough to
     // prove that it is either null or undefined.
-    if (!isOtherSpeculation(m_state.forNode(rightChild).m_type & ~SpecCell)) {
+    if (!isOtherOrEmptySpeculation(m_state.forNode(rightChild).m_type & ~SpecCell)) {
         m_jit.move(op2GPR, resultGPR);
         m_jit.andPtr(MacroAssembler::TrustedImm32(~TagBitUndefined), resultGPR);
         
@@ -1649,7 +1649,7 @@ void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(
     
     // We know that within this branch, rightChild must not be a cell. Check if that is enough to
     // prove that it is either null or undefined.
-    if (isOtherSpeculation(m_state.forNode(rightChild).m_type & ~SpecCell))
+    if (isOtherOrEmptySpeculation(m_state.forNode(rightChild).m_type & ~SpecCell))
         rightNotCell.link(&m_jit);
     else {
         jump(notTaken, ForceJump);
@@ -2508,7 +2508,8 @@ void SpeculativeJIT::compile(Node& node)
         break;
     }
 
-    case PutByVal: {
+    case PutByVal:
+    case PutByValSafe: {
         Edge child1 = m_jit.graph().varArgChild(node, 0);
         Edge child2 = m_jit.graph().varArgChild(node, 1);
         Edge child3 = m_jit.graph().varArgChild(node, 2);
@@ -2675,13 +2676,15 @@ void SpeculativeJIT::compile(Node& node)
         // If we have predicted the base to be type array, we can skip the check.
         if (!isArraySpeculation(m_state.forNode(child1).m_type))
             speculationCheck(BadType, JSValueRegs(baseReg), child1, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
+        
+        MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
+        if (node.op() == PutByVal)
+            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, beyondArrayBounds);
 
         base.use();
         property.use();
         value.use();
         
-        MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
-
         // Get the array storage.
         GPRReg storageReg = scratchReg;
         m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
@@ -2702,11 +2705,13 @@ void SpeculativeJIT::compile(Node& node)
         // Store the value to the array.
         m_jit.storePtr(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
 
-        addSlowPathGenerator(
-            slowPathCall(
-                beyondArrayBounds, this,
-                m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
-                NoResult, baseReg, propertyReg, valueReg));
+        if (node.op() == PutByValSafe) {
+            addSlowPathGenerator(
+                slowPathCall(
+                    beyondArrayBounds, this,
+                    m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
+                    NoResult, baseReg, propertyReg, valueReg));
+        }
 
         noResult(m_compileIndex, UseChildrenCalledExplicitly);
         break;
@@ -3043,7 +3048,7 @@ void SpeculativeJIT::compile(Node& node)
             m_jit.move(op1GPR, resultGPR);
         else {
             MacroAssembler::Jump alreadyPrimitive = m_jit.branchTestPtr(MacroAssembler::NonZero, op1GPR, GPRInfo::tagMaskRegister);
-            MacroAssembler::Jump notPrimitive = m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSString::s_info));
+            MacroAssembler::Jump notPrimitive = m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1GPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get()));
             
             alreadyPrimitive.link(&m_jit);
             m_jit.move(op1GPR, resultGPR);
@@ -3208,7 +3213,7 @@ void SpeculativeJIT::compile(Node& node)
             GPRReg resultGPR = result.gpr();
             
             if (!isObjectSpeculation(m_state.forNode(node.child1()).m_type))
-                speculationCheck(BadType, JSValueRegs(thisValueGPR), node.child1(), m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(thisValueGPR, JSCell::classInfoOffset()), JITCompiler::TrustedImmPtr(&JSString::s_info)));
+                speculationCheck(BadType, JSValueRegs(thisValueGPR), node.child1(), m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(thisValueGPR, JSCell::structureOffset()), JITCompiler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
             
             m_jit.move(thisValueGPR, resultGPR);
             
@@ -3435,7 +3440,7 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg resultGPR = result.gpr();
         
         if (!isStringSpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueRegs(baseGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSString::s_info)));
+            speculationCheck(BadType, JSValueRegs(baseGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
         
         m_jit.load32(MacroAssembler::Address(baseGPR, JSString::offsetOfLength()), resultGPR);
 
@@ -3485,7 +3490,8 @@ void SpeculativeJIT::compile(Node& node)
         noResult(m_compileIndex);
         break;
     }
-    case CheckStructure: {
+    case CheckStructure:
+    case ForwardCheckStructure: {
         AbstractValue& value = m_state.forNode(node.child1());
         if (value.m_structure.isSubsetOf(node.structureSet())
             && isCellSpeculation(value.m_type)) {
@@ -3493,13 +3499,19 @@ void SpeculativeJIT::compile(Node& node)
             break;
         }
         
-        SpeculateCellOperand base(this, node.child1());
+        SpeculateCellOperand base(this, node.child1(), node.op() == ForwardCheckStructure);
         
         ASSERT(node.structureSet().size());
         
-        if (node.structureSet().size() == 1)
-            speculationCheck(BadCache, JSValueRegs(), NoNode, m_jit.branchWeakPtr(JITCompiler::NotEqual, JITCompiler::Address(base.gpr(), JSCell::structureOffset()), node.structureSet()[0]));
-        else {
+        if (node.structureSet().size() == 1) {
+            speculationCheckWithConditionalDirection(
+                BadCache, JSValueRegs(), NoNode,
+                m_jit.branchWeakPtr(
+                    JITCompiler::NotEqual,
+                    JITCompiler::Address(base.gpr(), JSCell::structureOffset()),
+                    node.structureSet()[0]),
+                node.op() == ForwardCheckStructure);
+        } else {
             GPRTemporary structure(this);
             
             m_jit.loadPtr(JITCompiler::Address(base.gpr(), JSCell::structureOffset()), structure.gpr());
@@ -3509,7 +3521,11 @@ void SpeculativeJIT::compile(Node& node)
             for (size_t i = 0; i < node.structureSet().size() - 1; ++i)
                 done.append(m_jit.branchWeakPtr(JITCompiler::Equal, structure.gpr(), node.structureSet()[i]));
             
-            speculationCheck(BadCache, JSValueRegs(), NoNode, m_jit.branchWeakPtr(JITCompiler::NotEqual, structure.gpr(), node.structureSet().last()));
+            speculationCheckWithConditionalDirection(
+                BadCache, JSValueRegs(), NoNode,
+                m_jit.branchWeakPtr(
+                    JITCompiler::NotEqual, structure.gpr(), node.structureSet().last()),
+                node.op() == ForwardCheckStructure);
             
             done.link(&m_jit);
         }
@@ -3520,7 +3536,7 @@ void SpeculativeJIT::compile(Node& node)
         
     case StructureTransitionWatchpoint: {
         m_jit.addWeakReference(node.structure());
-        node.structure()->addTransitionWatchpoint(speculationWatchpoint());
+        node.structure()->addTransitionWatchpoint(speculationWatchpoint(BadCache));
 
 #if !ASSERT_DISABLED
         SpeculateCellOperand op1(this, node.child1());
diff --git a/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp b/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp
new file mode 100644
index 000000000..e86c57dff
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp
@@ -0,0 +1,490 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGStructureCheckHoistingPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlock.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include <wtf/HashMap.h>
+
+namespace JSC { namespace DFG {
+
+enum CheckBallot { VoteOther, VoteStructureCheck };
+
+class StructureCheckHoistingPhase : public Phase {
+public:
+    StructureCheckHoistingPhase(Graph& graph)
+        : Phase(graph, "structure check hoisting")
+    {
+    }
+    
+    bool run()
+    {
+        for (unsigned i = m_graph.m_variableAccessData.size(); i--;) {
+            VariableAccessData* variable = &m_graph.m_variableAccessData[i];
+            if (!variable->isRoot())
+                continue;
+            variable->clearVotes();
+        }
+        
+        // Identify the set of variables that are always subject to the same structure
+        // checks. For now, only consider monomorphic structure checks (one structure).
+        
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
+            BasicBlock* block = m_graph.m_blocks[blockIndex].get();
+            if (!block)
+                continue;
+            for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
+                NodeIndex nodeIndex = block->at(indexInBlock);
+                Node& node = m_graph[nodeIndex];
+                if (!node.shouldGenerate())
+                    continue;
+                switch (node.op()) {
+                case CheckStructure: {
+                    Node& child = m_graph[node.child1()];
+                    if (child.op() != GetLocal)
+                        break;
+                    VariableAccessData* variable = child.variableAccessData();
+                    variable->vote(VoteStructureCheck);
+                    if (variable->isCaptured() || variable->structureCheckHoistingFailed())
+                        break;
+                    if (!isCellSpeculation(variable->prediction()))
+                        break;
+                    noticeStructureCheck(variable, node.structureSet());
+                    break;
+                }
+                    
+                case ForwardCheckStructure:
+                    // We currently rely on the fact that we're the only ones who would
+                    // insert this node.
+                    ASSERT_NOT_REACHED();
+                    break;
+                    
+                case GetByOffset:
+                case PutByOffset:
+                case PutStructure:
+                case StructureTransitionWatchpoint:
+                case AllocatePropertyStorage:
+                case ReallocatePropertyStorage:
+                case GetPropertyStorage:
+                    // Don't count these uses.
+                    break;
+                    
+                default:
+                    m_graph.vote(node, VoteOther);
+                    break;
+                }
+            }
+        }
+        
+        // Disable structure hoisting on variables that appear to mostly be used in
+        // contexts where it doesn't make sense.
+        
+        for (unsigned i = m_graph.m_variableAccessData.size(); i--;) {
+            VariableAccessData* variable = &m_graph.m_variableAccessData[i];
+            if (!variable->isRoot())
+                continue;
+            if (variable->voteRatio() >= Options::structureCheckVoteRatioForHoisting())
+                continue;
+            HashMap<VariableAccessData*, CheckData>::iterator iter = m_map.find(variable);
+            if (iter == m_map.end())
+                continue;
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+            dataLog("Zeroing the structure to hoist for %s because the ratio is %lf.\n",
+                    m_graph.nameOfVariableAccessData(variable), variable->voteRatio());
+#endif
+            iter->second.m_structure = 0;
+        }
+
+        // Identify the set of variables that are live across a structure clobber.
+        
+        Operands<VariableAccessData*> live(
+            m_graph.m_blocks[0]->variablesAtTail.numberOfArguments(),
+            m_graph.m_blocks[0]->variablesAtTail.numberOfLocals());
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
+            BasicBlock* block = m_graph.m_blocks[blockIndex].get();
+            if (!block)
+                continue;
+            ASSERT(live.numberOfArguments() == block->variablesAtTail.numberOfArguments());
+            ASSERT(live.numberOfLocals() == block->variablesAtTail.numberOfLocals());
+            for (unsigned i = live.size(); i--;) {
+                NodeIndex indexAtTail = block->variablesAtTail[i];
+                VariableAccessData* variable;
+                if (indexAtTail == NoNode)
+                    variable = 0;
+                else
+                    variable = m_graph[indexAtTail].variableAccessData();
+                live[i] = variable;
+            }
+            for (unsigned indexInBlock = block->size(); indexInBlock--;) {
+                NodeIndex nodeIndex = block->at(indexInBlock);
+                Node& node = m_graph[nodeIndex];
+                if (!node.shouldGenerate())
+                    continue;
+                switch (node.op()) {
+                case GetLocal:
+                case Flush:
+                    // This is a birth.
+                    live.operand(node.local()) = node.variableAccessData();
+                    break;
+                    
+                case SetLocal:
+                case SetArgument:
+                    ASSERT(live.operand(node.local())); // Must be live.
+                    ASSERT(live.operand(node.local()) == node.variableAccessData()); // Must have the variable we expected.
+                    // This is a death.
+                    live.operand(node.local()) = 0;
+                    break;
+                    
+                // Use the CFA's notion of what clobbers the world.
+                case ValueAdd:
+                    if (m_graph.addShouldSpeculateInteger(node))
+                        break;
+                    if (Node::shouldSpeculateNumber(m_graph[node.child1()], m_graph[node.child2()]))
+                        break;
+                    clobber(live);
+                    break;
+                    
+                case CompareLess:
+                case CompareLessEq:
+                case CompareGreater:
+                case CompareGreaterEq:
+                case CompareEq: {
+                    Node& left = m_graph[node.child1()];
+                    Node& right = m_graph[node.child2()];
+                    if (Node::shouldSpeculateInteger(left, right))
+                        break;
+                    if (Node::shouldSpeculateNumber(left, right))
+                        break;
+                    if (node.op() == CompareEq) {
+                        if ((m_graph.isConstant(node.child1().index())
+                             && m_graph.valueOfJSConstant(node.child1().index()).isNull())
+                            || (m_graph.isConstant(node.child2().index())
+                                && m_graph.valueOfJSConstant(node.child2().index()).isNull()))
+                            break;
+                        
+                        if (Node::shouldSpeculateFinalObject(left, right))
+                            break;
+                        if (Node::shouldSpeculateArray(left, right))
+                            break;
+                        if (left.shouldSpeculateFinalObject() && right.shouldSpeculateFinalObjectOrOther())
+                            break;
+                        if (right.shouldSpeculateFinalObject() && left.shouldSpeculateFinalObjectOrOther())
+                            break;
+                        if (left.shouldSpeculateArray() && right.shouldSpeculateArrayOrOther())
+                            break;
+                        if (right.shouldSpeculateArray() && left.shouldSpeculateArrayOrOther())
+                            break;
+                    }
+                    clobber(live);
+                    break;
+                }
+                    
+                case GetByVal:
+                    if (!node.prediction() || !m_graph[node.child1()].prediction() || !m_graph[node.child2()].prediction())
+                        break;
+                    if (!isActionableArraySpeculation(m_graph[node.child1()].prediction()) || !m_graph[node.child2()].shouldSpeculateInteger())
+                        clobber(live);
+                    break;
+                    
+                case PutByVal:
+                case PutByValAlias: {
+                    Edge child1 = m_graph.varArgChild(node, 0);
+                    Edge child2 = m_graph.varArgChild(node, 1);
+                    
+                    if (!m_graph[child1].prediction() || !m_graph[child2].prediction())
+                        break;
+                    if (!m_graph[child2].shouldSpeculateInteger() || !isActionableMutableArraySpeculation(m_graph[child1].prediction())) {
+                        clobber(live);
+                        break;
+                    }
+                    if (node.op() == PutByValAlias)
+                        break;
+                    if (m_graph[child1].shouldSpeculateArguments())
+                        break;
+                    if (m_graph[child1].shouldSpeculateInt8Array())
+                        break;
+                    if (m_graph[child1].shouldSpeculateInt16Array())
+                        break;
+                    if (m_graph[child1].shouldSpeculateInt32Array())
+                        break;
+                    if (m_graph[child1].shouldSpeculateUint8Array())
+                        break;
+                    if (m_graph[child1].shouldSpeculateUint8ClampedArray())
+                        break;
+                    if (m_graph[child1].shouldSpeculateUint16Array())
+                        break;
+                    if (m_graph[child1].shouldSpeculateUint32Array())
+                        break;
+                    if (m_graph[child1].shouldSpeculateFloat32Array())
+                        break;
+                    if (m_graph[child1].shouldSpeculateFloat64Array())
+                        break;
+                    clobber(live);
+                    break;
+                }
+                    
+                case GetMyArgumentsLengthSafe:
+                case GetMyArgumentByValSafe:
+                case GetById:
+                case GetByIdFlush:
+                case PutStructure:
+                case PhantomPutStructure:
+                case PutById:
+                case PutByIdDirect:
+                case Call:
+                case Construct:
+                case Resolve:
+                case ResolveBase:
+                case ResolveBaseStrictPut:
+                case ResolveGlobal:
+                    clobber(live);
+                    break;
+                    
+                default:
+                    ASSERT(node.op() != Phi);
+                    break;
+                }
+            }
+        }
+        
+        bool changed = false;
+
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        for (HashMap<VariableAccessData*, CheckData>::iterator it = m_map.begin();
+             it != m_map.end(); ++it) {
+            if (!it->second.m_structure) {
+                dataLog("Not hoisting checks for %s because of heuristics.\n", m_graph.nameOfVariableAccessData(it->first));
+                continue;
+            }
+            if (it->second.m_isClobbered && !it->second.m_structure->transitionWatchpointSetIsStillValid()) {
+                dataLog("Not hoisting checks for %s because the structure is clobbered and has an invalid watchpoint set.\n", m_graph.nameOfVariableAccessData(it->first));
+                continue;
+            }
+            dataLog("Hoisting checks for %s\n", m_graph.nameOfVariableAccessData(it->first));
+        }
+#endif // DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+
+        // Make changes:
+        // 1) If a variable's live range does not span a clobber, then inject structure
+        //    checks before the SetLocal.
+        // 2) If a variable's live range spans a clobber but is watchpointable, then
+        //    inject structure checks before the SetLocal and replace all other structure
+        //    checks on that variable with structure transition watchpoints.
+        
+        InsertionSet<NodeIndex> insertionSet;
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
+            BasicBlock* block = m_graph.m_blocks[blockIndex].get();
+            if (!block)
+                continue;
+            for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
+                NodeIndex nodeIndex = block->at(indexInBlock);
+                Node& node = m_graph[nodeIndex];
+                // Be careful not to use 'node' after appending to the graph. In those switch
+                // cases where we need to append, we first carefully extract everything we need
+                // from the node, before doing any appending.
+                if (!node.shouldGenerate())
+                    continue;
+                switch (node.op()) {
+                case SetArgument: {
+                    ASSERT(!blockIndex);
+                    // Insert a GetLocal and a CheckStructure immediately following this
+                    // SetArgument, if the variable was a candidate for structure hoisting.
+                    // If the basic block previously only had the SetArgument as its
+                    // variable-at-tail, then replace it with this GetLocal.
+                    VariableAccessData* variable = node.variableAccessData();
+                    HashMap<VariableAccessData*, CheckData>::iterator iter = m_map.find(variable);
+                    if (iter == m_map.end())
+                        break;
+                    if (!iter->second.m_structure)
+                        break;
+                    if (iter->second.m_isClobbered && !iter->second.m_structure->transitionWatchpointSetIsStillValid())
+                        break;
+                    
+                    node.ref();
+
+                    CodeOrigin codeOrigin = node.codeOrigin;
+                    
+                    Node getLocal(GetLocal, codeOrigin, OpInfo(variable), nodeIndex);
+                    getLocal.predict(variable->prediction());
+                    getLocal.ref();
+                    NodeIndex getLocalIndex = m_graph.size();
+                    m_graph.append(getLocal);
+                    insertionSet.append(indexInBlock + 1, getLocalIndex);
+                    
+                    Node checkStructure(CheckStructure, codeOrigin, OpInfo(m_graph.addStructureSet(iter->second.m_structure)), getLocalIndex);
+                    checkStructure.ref();
+                    NodeIndex checkStructureIndex = m_graph.size();
+                    m_graph.append(checkStructure);
+                    insertionSet.append(indexInBlock + 1, checkStructureIndex);
+                    
+                    if (block->variablesAtTail.operand(variable->local()) == nodeIndex)
+                        block->variablesAtTail.operand(variable->local()) = getLocalIndex;
+                    
+                    changed = true;
+                    break;
+                }
+                    
+                case SetLocal: {
+                    VariableAccessData* variable = node.variableAccessData();
+                    HashMap<VariableAccessData*, CheckData>::iterator iter = m_map.find(variable);
+                    if (iter == m_map.end())
+                        break;
+                    if (!iter->second.m_structure)
+                        break;
+                    if (iter->second.m_isClobbered && !iter->second.m_structure->transitionWatchpointSetIsStillValid())
+                        break;
+
+                    // First insert a dead SetLocal to tell OSR that the child's value should
+                    // be dropped into this bytecode variable if the CheckStructure decides
+                    // to exit.
+                    
+                    CodeOrigin codeOrigin = node.codeOrigin;
+                    NodeIndex child1 = node.child1().index();
+                    
+                    Node setLocal(SetLocal, codeOrigin, OpInfo(variable), child1);
+                    NodeIndex setLocalIndex = m_graph.size();
+                    m_graph.append(setLocal);
+                    insertionSet.append(indexInBlock, setLocalIndex);
+                    m_graph[child1].ref();
+                    // Use a ForwardCheckStructure to indicate that we should exit to the
+                    // next bytecode instruction rather than reexecuting the current one.
+                    Node checkStructure(ForwardCheckStructure, codeOrigin, OpInfo(m_graph.addStructureSet(iter->second.m_structure)), child1);
+                    checkStructure.ref();
+                    NodeIndex checkStructureIndex = m_graph.size();
+                    m_graph.append(checkStructure);
+                    insertionSet.append(indexInBlock, checkStructureIndex);
+                    changed = true;
+                    break;
+                }
+                    
+                case CheckStructure: {
+                    Node& child = m_graph[node.child1()];
+                    if (child.op() != GetLocal)
+                        break;
+                    HashMap<VariableAccessData*, CheckData>::iterator iter = m_map.find(child.variableAccessData());
+                    if (iter == m_map.end())
+                        break;
+                    if (!iter->second.m_structure)
+                        break;
+                    if (!iter->second.m_isClobbered) {
+                        node.setOpAndDefaultFlags(Phantom);
+                        ASSERT(node.refCount() == 1);
+                        break;
+                    }
+                    if (!iter->second.m_structure->transitionWatchpointSetIsStillValid())
+                        break;
+                    ASSERT(iter->second.m_structure == node.structureSet().singletonStructure());
+                    node.convertToStructureTransitionWatchpoint();
+                    changed = true;
+                    break;
+                }
+                    
+                default:
+                    break;
+                }
+            }
+            insertionSet.execute(*block);
+        }
+        
+        return changed;
+    }
+
+private:
+    void noticeStructureCheck(VariableAccessData* variable, Structure* structure)
+    {
+        HashMap<VariableAccessData*, CheckData>::AddResult result =
+            m_map.add(variable, CheckData(structure, false));
+        if (result.isNewEntry)
+            return;
+        if (result.iterator->second.m_structure == structure)
+            return;
+        result.iterator->second.m_structure = 0;
+    }
+    
+    void noticeStructureCheck(VariableAccessData* variable, const StructureSet& set)
+    {
+        if (set.size() != 1) {
+            noticeStructureCheck(variable, 0);
+            return;
+        }
+        noticeStructureCheck(variable, set.singletonStructure());
+    }
+    
+    void noticeClobber(VariableAccessData* variable)
+    {
+        HashMap<VariableAccessData*, CheckData>::iterator iter =
+            m_map.find(variable);
+        if (iter == m_map.end())
+            return;
+        iter->second.m_isClobbered = true;
+    }
+    
+    void clobber(const Operands<VariableAccessData*>& live)
+    {
+        for (size_t i = live.size(); i--;) {
+            VariableAccessData* variable = live[i];
+            if (!variable)
+                continue;
+            noticeClobber(variable);
+        }
+    }
+    
+    struct CheckData {
+        Structure* m_structure;
+        bool m_isClobbered;
+        
+        CheckData()
+            : m_structure(0)
+            , m_isClobbered(false)
+        {
+        }
+        
+        CheckData(Structure* structure, bool isClobbered)
+            : m_structure(structure)
+            , m_isClobbered(isClobbered)
+        {
+        }
+    };
+    
+    HashMap<VariableAccessData*, CheckData> m_map;
+};
+
+bool performStructureCheckHoisting(Graph& graph)
+{
+    SamplingRegion samplingRegion("DFG Structure Check Hoisting Phase");
+    return runPhase<StructureCheckHoistingPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
diff --git a/Source/WebCore/bindings/js/ScriptControllerWin.cpp b/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.h
index 9780c93a7..1e6462a92 100644
--- a/Source/WebCore/bindings/js/ScriptControllerWin.cpp
+++ b/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.h
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -11,10 +10,10 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -24,22 +23,28 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "config.h"
-#include "ScriptController.h"
+#ifndef DFGStructureCheckHoistingPhase_h
+#define DFGStructureCheckHoistingPhase_h
 
-#include "BridgeJSC.h"
-#include "PluginView.h"
+#include <wtf/Platform.h>
 
-using namespace JSC::Bindings;
+#if ENABLE(DFG_JIT)
 
-namespace WebCore {
+namespace JSC { namespace DFG {
 
-PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(Widget* widget)
-{
-    if (!widget->isPluginView())
-        return 0;
+class Graph;
 
-    return static_cast<PluginView*>(widget)->bindingInstance();
-}
+// Hoists CheckStructure on variables to assignments to those variables, if either of
+// the following is true:
+// A) The structure's transition watchpoint set is valid.
+// B) The span of code within which the variable is live has no effects that might
+//    clobber the structure.
+
+bool performStructureCheckHoisting(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGStructureCheckHoistingPhase_h
 
-} // namespace WebCore
diff --git a/Source/JavaScriptCore/dfg/DFGVariableAccessData.h b/Source/JavaScriptCore/dfg/DFGVariableAccessData.h
index e734e6387..6d8e89799 100644
--- a/Source/JavaScriptCore/dfg/DFGVariableAccessData.h
+++ b/Source/JavaScriptCore/dfg/DFGVariableAccessData.h
@@ -37,10 +37,10 @@
 
 namespace JSC { namespace DFG {
 
+enum DoubleBallot { VoteValue, VoteDouble };
+
 class VariableAccessData : public UnionFind<VariableAccessData> {
 public:
-    enum Ballot { VoteValue, VoteDouble };
-
     VariableAccessData()
         : m_local(static_cast<VirtualRegister>(std::numeric_limits<int>::min()))
         , m_prediction(SpecNone)
@@ -49,6 +49,7 @@ public:
         , m_doubleFormatState(EmptyDoubleFormatState)
         , m_isCaptured(false)
         , m_isArgumentsAlias(false)
+        , m_structureCheckHoistingFailed(false)
     {
         clearVotes();
     }
@@ -61,6 +62,7 @@ public:
         , m_doubleFormatState(EmptyDoubleFormatState)
         , m_isCaptured(isCaptured)
         , m_isArgumentsAlias(false)
+        , m_structureCheckHoistingFailed(false)
     {
         clearVotes();
     }
@@ -90,6 +92,20 @@ public:
         return m_isCaptured;
     }
     
+    bool mergeStructureCheckHoistingFailed(bool failed)
+    {
+        bool newFailed = m_structureCheckHoistingFailed | failed;
+        if (newFailed == m_structureCheckHoistingFailed)
+            return false;
+        m_structureCheckHoistingFailed = newFailed;
+        return true;
+    }
+    
+    bool structureCheckHoistingFailed()
+    {
+        return m_structureCheckHoistingFailed;
+    }
+    
     bool mergeIsArgumentsAlias(bool isArgumentsAlias)
     {
         bool newIsArgumentsAlias = m_isArgumentsAlias | isArgumentsAlias;
@@ -136,20 +152,20 @@ public:
     void clearVotes()
     {
         ASSERT(find() == this);
-        m_votes[VoteValue] = 0;
-        m_votes[VoteDouble] = 0;
+        m_votes[0] = 0;
+        m_votes[1] = 0;
     }
     
-    void vote(Ballot ballot)
+    void vote(unsigned ballot)
     {
-        ASSERT(static_cast<unsigned>(ballot) < 2);
+        ASSERT(ballot < 2);
         m_votes[ballot]++;
     }
     
-    double doubleVoteRatio()
+    double voteRatio()
     {
         ASSERT(find() == this);
-        return static_cast<double>(m_votes[VoteDouble]) / m_votes[VoteValue];
+        return static_cast<double>(m_votes[1]) / m_votes[0];
     }
     
     bool shouldUseDoubleFormatAccordingToVote()
@@ -176,7 +192,7 @@ public:
         
         // If the variable has been voted to become a double, then make it a
         // double.
-        if (doubleVoteRatio() >= Options::doubleVoteRatioForDoubleFormat())
+        if (voteRatio() >= Options::doubleVoteRatioForDoubleFormat())
             return true;
         
         return false;
@@ -250,11 +266,12 @@ private:
     SpeculatedType m_argumentAwarePrediction;
     NodeFlags m_flags;
     
-    float m_votes[2];
+    float m_votes[2]; // Used primarily for double voting but may be reused for other purposes.
     DoubleFormatState m_doubleFormatState;
     
     bool m_isCaptured;
     bool m_isArgumentsAlias;
+    bool m_structureCheckHoistingFailed;
 };
 
 } } // namespace JSC::DFG
diff --git a/Source/JavaScriptCore/heap/BlockAllocator.cpp b/Source/JavaScriptCore/heap/BlockAllocator.cpp
index fc4f8a4c6..690fd83c4 100644
--- a/Source/JavaScriptCore/heap/BlockAllocator.cpp
+++ b/Source/JavaScriptCore/heap/BlockAllocator.cpp
@@ -55,7 +55,7 @@ BlockAllocator::~BlockAllocator()
 void BlockAllocator::releaseFreeBlocks()
 {
     while (true) {
-        HeapBlock* block;
+        DeadBlock* block;
         {
             SpinLockHolder locker(&m_freeBlockLock);
             if (!m_numberOfFreeBlocks)
@@ -70,7 +70,7 @@ void BlockAllocator::releaseFreeBlocks()
         if (!block)
             break;
 
-        block->m_allocation.deallocate();
+        DeadBlock::destroy(block).deallocate();
     }
 }
 
@@ -121,7 +121,7 @@ void BlockAllocator::blockFreeingThreadMain()
         size_t desiredNumberOfFreeBlocks = currentNumberOfFreeBlocks / 2;
         
         while (!m_blockFreeingThreadShouldQuit) {
-            HeapBlock* block;
+            DeadBlock* block;
             {
                 SpinLockHolder locker(&m_freeBlockLock);
                 if (m_numberOfFreeBlocks <= desiredNumberOfFreeBlocks)
@@ -136,7 +136,7 @@ void BlockAllocator::blockFreeingThreadMain()
             if (!block)
                 break;
             
-            block->m_allocation.deallocate();
+            DeadBlock::destroy(block).deallocate();
         }
     }
 }
diff --git a/Source/JavaScriptCore/heap/BlockAllocator.h b/Source/JavaScriptCore/heap/BlockAllocator.h
index 7a99d2edd..042e65d92 100644
--- a/Source/JavaScriptCore/heap/BlockAllocator.h
+++ b/Source/JavaScriptCore/heap/BlockAllocator.h
@@ -38,6 +38,24 @@ namespace JSC {
 // Simple allocator to reduce VM cost by holding onto blocks of memory for
 // short periods of time and then freeing them on a secondary thread.
 
+class DeadBlock : public HeapBlock<DeadBlock> {
+public:
+    static DeadBlock* create(const PageAllocationAligned&);
+
+private:
+    DeadBlock(const PageAllocationAligned&);
+};
+
+inline DeadBlock::DeadBlock(const PageAllocationAligned& allocation)
+    : HeapBlock<DeadBlock>(allocation)
+{
+}
+
+inline DeadBlock* DeadBlock::create(const PageAllocationAligned& allocation)
+{
+    return new(NotNull, allocation.base()) DeadBlock(allocation);
+}
+
 class BlockAllocator {
 public:
     BlockAllocator();
@@ -55,7 +73,7 @@ private:
 
     void releaseFreeBlocks();
 
-    DoublyLinkedList<HeapBlock> m_freeBlocks;
+    DoublyLinkedList<DeadBlock> m_freeBlocks;
     size_t m_numberOfFreeBlocks;
     bool m_isCurrentlyAllocating;
     bool m_blockFreeingThreadShouldQuit;
@@ -73,12 +91,12 @@ inline PageAllocationAligned BlockAllocator::allocate()
         if (m_numberOfFreeBlocks) {
             ASSERT(!m_freeBlocks.isEmpty());
             m_numberOfFreeBlocks--;
-            return m_freeBlocks.removeHead()->m_allocation;
+            return DeadBlock::destroy(m_freeBlocks.removeHead());
         }
     }
 
     ASSERT(m_freeBlocks.isEmpty());
-    PageAllocationAligned allocation = PageAllocationAligned::allocate(HeapBlock::s_blockSize, HeapBlock::s_blockSize, OSAllocator::JSGCHeapPages);
+    PageAllocationAligned allocation = PageAllocationAligned::allocate(DeadBlock::s_blockSize, DeadBlock::s_blockSize, OSAllocator::JSGCHeapPages);
     if (!static_cast<bool>(allocation))
         CRASH();
     return allocation;
@@ -87,8 +105,7 @@ inline PageAllocationAligned BlockAllocator::allocate()
 inline void BlockAllocator::deallocate(PageAllocationAligned allocation)
 {
     SpinLockHolder locker(&m_freeBlockLock);
-    HeapBlock* heapBlock = new(NotNull, allocation.base()) HeapBlock(allocation);
-    m_freeBlocks.push(heapBlock);
+    m_freeBlocks.push(DeadBlock::create(allocation));
     m_numberOfFreeBlocks++;
 }
 
diff --git a/Source/JavaScriptCore/heap/CopiedBlock.h b/Source/JavaScriptCore/heap/CopiedBlock.h
index 6717a6835..ad5dbb46b 100644
--- a/Source/JavaScriptCore/heap/CopiedBlock.h
+++ b/Source/JavaScriptCore/heap/CopiedBlock.h
@@ -34,13 +34,12 @@ namespace JSC {
 
 class CopiedSpace;
 
-class CopiedBlock : public HeapBlock {
+class CopiedBlock : public HeapBlock<CopiedBlock> {
     friend class CopiedSpace;
     friend class CopiedAllocator;
 public:
     static CopiedBlock* create(const PageAllocationAligned&);
     static CopiedBlock* createNoZeroFill(const PageAllocationAligned&);
-    static PageAllocationAligned destroy(CopiedBlock*);
 
     // The payload is the region of the block that is usable for allocations.
     char* payload();
@@ -93,17 +92,8 @@ inline void CopiedBlock::zeroFillWilderness()
 #endif
 }
 
-inline PageAllocationAligned CopiedBlock::destroy(CopiedBlock* block)
-{
-    PageAllocationAligned allocation;
-    swap(allocation, block->m_allocation);
-
-    block->~CopiedBlock();
-    return allocation;
-}
-
 inline CopiedBlock::CopiedBlock(const PageAllocationAligned& allocation)
-    : HeapBlock(allocation)
+    : HeapBlock<CopiedBlock>(allocation)
     , m_remaining(payloadCapacity())
     , m_isPinned(false)
 {
@@ -117,7 +107,7 @@ inline char* CopiedBlock::payload()
 
 inline char* CopiedBlock::payloadEnd()
 {
-    return reinterpret_cast<char*>(this) + m_allocation.size();
+    return reinterpret_cast<char*>(this) + allocation().size();
 }
 
 inline size_t CopiedBlock::payloadCapacity()
@@ -162,7 +152,7 @@ inline size_t CopiedBlock::size()
 
 inline size_t CopiedBlock::capacity()
 {
-    return m_allocation.size();
+    return allocation().size();
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/CopiedSpace.cpp b/Source/JavaScriptCore/heap/CopiedSpace.cpp
index 147dfa4b3..bf87a305c 100644
--- a/Source/JavaScriptCore/heap/CopiedSpace.cpp
+++ b/Source/JavaScriptCore/heap/CopiedSpace.cpp
@@ -44,13 +44,13 @@ CopiedSpace::CopiedSpace(Heap* heap)
 CopiedSpace::~CopiedSpace()
 {
     while (!m_toSpace->isEmpty())
-        m_heap->blockAllocator().deallocate(CopiedBlock::destroy(static_cast<CopiedBlock*>(m_toSpace->removeHead())));
+        m_heap->blockAllocator().deallocate(CopiedBlock::destroy(m_toSpace->removeHead()));
 
     while (!m_fromSpace->isEmpty())
-        m_heap->blockAllocator().deallocate(CopiedBlock::destroy(static_cast<CopiedBlock*>(m_fromSpace->removeHead())));
+        m_heap->blockAllocator().deallocate(CopiedBlock::destroy(m_fromSpace->removeHead()));
 
     while (!m_oversizeBlocks.isEmpty())
-        CopiedBlock::destroy(static_cast<CopiedBlock*>(m_oversizeBlocks.removeHead())).deallocate();
+        CopiedBlock::destroy(m_oversizeBlocks.removeHead()).deallocate();
 }
 
 void CopiedSpace::init()
@@ -193,7 +193,7 @@ void CopiedSpace::doneCopying()
     ASSERT(m_inCopyingPhase);
     m_inCopyingPhase = false;
     while (!m_fromSpace->isEmpty()) {
-        CopiedBlock* block = static_cast<CopiedBlock*>(m_fromSpace->removeHead());
+        CopiedBlock* block = m_fromSpace->removeHead();
         if (block->m_isPinned) {
             block->m_isPinned = false;
             // We don't add the block to the blockSet because it was never removed.
@@ -207,9 +207,9 @@ void CopiedSpace::doneCopying()
         m_heap->blockAllocator().deallocate(CopiedBlock::destroy(block));
     }
 
-    CopiedBlock* curr = static_cast<CopiedBlock*>(m_oversizeBlocks.head());
+    CopiedBlock* curr = m_oversizeBlocks.head();
     while (curr) {
-        CopiedBlock* next = static_cast<CopiedBlock*>(curr->next());
+        CopiedBlock* next = curr->next();
         if (!curr->m_isPinned) {
             m_oversizeBlocks.remove(curr);
             m_blockSet.remove(curr);
@@ -224,20 +224,20 @@ void CopiedSpace::doneCopying()
     if (!m_toSpace->head())
         allocateBlock();
     else
-        m_allocator.setCurrentBlock(static_cast<CopiedBlock*>(m_toSpace->head()));
+        m_allocator.setCurrentBlock(m_toSpace->head());
 }
 
 size_t CopiedSpace::size()
 {
     size_t calculatedSize = 0;
 
-    for (CopiedBlock* block = static_cast<CopiedBlock*>(m_toSpace->head()); block; block = static_cast<CopiedBlock*>(block->next()))
+    for (CopiedBlock* block = m_toSpace->head(); block; block = block->next())
         calculatedSize += block->size();
 
-    for (CopiedBlock* block = static_cast<CopiedBlock*>(m_fromSpace->head()); block; block = static_cast<CopiedBlock*>(block->next()))
+    for (CopiedBlock* block = m_fromSpace->head(); block; block = block->next())
         calculatedSize += block->size();
 
-    for (CopiedBlock* block = static_cast<CopiedBlock*>(m_oversizeBlocks.head()); block; block = static_cast<CopiedBlock*>(block->next()))
+    for (CopiedBlock* block = m_oversizeBlocks.head(); block; block = block->next())
         calculatedSize += block->size();
 
     return calculatedSize;
@@ -247,22 +247,22 @@ size_t CopiedSpace::capacity()
 {
     size_t calculatedCapacity = 0;
 
-    for (CopiedBlock* block = static_cast<CopiedBlock*>(m_toSpace->head()); block; block = static_cast<CopiedBlock*>(block->next()))
+    for (CopiedBlock* block = m_toSpace->head(); block; block = block->next())
         calculatedCapacity += block->capacity();
 
-    for (CopiedBlock* block = static_cast<CopiedBlock*>(m_fromSpace->head()); block; block = static_cast<CopiedBlock*>(block->next()))
+    for (CopiedBlock* block = m_fromSpace->head(); block; block = block->next())
         calculatedCapacity += block->capacity();
 
-    for (CopiedBlock* block = static_cast<CopiedBlock*>(m_oversizeBlocks.head()); block; block = static_cast<CopiedBlock*>(block->next()))
+    for (CopiedBlock* block = m_oversizeBlocks.head(); block; block = block->next())
         calculatedCapacity += block->capacity();
 
     return calculatedCapacity;
 }
 
-static bool isBlockListPagedOut(double deadline, DoublyLinkedList<HeapBlock>* list)
+static bool isBlockListPagedOut(double deadline, DoublyLinkedList<CopiedBlock>* list)
 {
     unsigned itersSinceLastTimeCheck = 0;
-    HeapBlock* current = list->head();
+    CopiedBlock* current = list->head();
     while (current) {
         current = current->next();
         ++itersSinceLastTimeCheck;
diff --git a/Source/JavaScriptCore/heap/CopiedSpace.h b/Source/JavaScriptCore/heap/CopiedSpace.h
index be3a331e8..ec394ca8f 100644
--- a/Source/JavaScriptCore/heap/CopiedSpace.h
+++ b/Source/JavaScriptCore/heap/CopiedSpace.h
@@ -44,7 +44,6 @@ namespace JSC {
 
 class Heap;
 class CopiedBlock;
-class HeapBlock;
 
 class CopiedSpace {
     friend class SlotVisitor;
@@ -101,12 +100,12 @@ private:
 
     SpinLock m_toSpaceLock;
 
-    DoublyLinkedList<HeapBlock>* m_toSpace;
-    DoublyLinkedList<HeapBlock>* m_fromSpace;
+    DoublyLinkedList<CopiedBlock>* m_toSpace;
+    DoublyLinkedList<CopiedBlock>* m_fromSpace;
     
-    DoublyLinkedList<HeapBlock> m_blocks1;
-    DoublyLinkedList<HeapBlock> m_blocks2;
-    DoublyLinkedList<HeapBlock> m_oversizeBlocks;
+    DoublyLinkedList<CopiedBlock> m_blocks1;
+    DoublyLinkedList<CopiedBlock> m_blocks2;
+    DoublyLinkedList<CopiedBlock> m_oversizeBlocks;
    
     bool m_inCopyingPhase;
 
@@ -116,7 +115,7 @@ private:
 
     static const size_t s_maxAllocationSize = 32 * KB;
     static const size_t s_initialBlockNum = 16;
-    static const size_t s_blockMask = ~(HeapBlock::s_blockSize - 1);
+    static const size_t s_blockMask = ~(CopiedBlock::s_blockSize - 1);
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h b/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h
index e2af41ad8..790a302de 100644
--- a/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h
+++ b/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h
@@ -95,9 +95,7 @@ inline void CopiedSpace::pinIfNecessary(void* opaquePointer)
 
 inline void CopiedSpace::startedCopying()
 {
-    DoublyLinkedList<HeapBlock>* temp = m_fromSpace;
-    m_fromSpace = m_toSpace;
-    m_toSpace = temp;
+    std::swap(m_fromSpace, m_toSpace);
 
     m_blockFilter.reset();
     m_allocator.resetCurrentBlock();
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index 377132765..669178804 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -830,4 +830,18 @@ void Heap::addCompiledCode(ExecutableBase* executable)
     m_compiledCode.append(executable);
 }
 
+bool Heap::isSafeToSweepStructures()
+{
+    return !m_sweeper || m_sweeper->structuresCanBeSwept();
+}
+
+void Heap::didStartVMShutdown()
+{
+    m_activityCallback->didStartVMShutdown();
+    m_activityCallback = 0;
+    m_sweeper->didStartVMShutdown();
+    m_sweeper = 0;
+    lastChanceToFinalize();
+}
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/Heap.h b/Source/JavaScriptCore/heap/Heap.h
index 595e937ce..f3474f2ea 100644
--- a/Source/JavaScriptCore/heap/Heap.h
+++ b/Source/JavaScriptCore/heap/Heap.h
@@ -168,6 +168,8 @@ namespace JSC {
         void didAbandon(size_t);
 
         bool isPagedOut(double deadline);
+        bool isSafeToSweepStructures();
+        void didStartVMShutdown();
 
     private:
         friend class CodeBlock;
diff --git a/Source/JavaScriptCore/heap/HeapBlock.h b/Source/JavaScriptCore/heap/HeapBlock.h
index 3cd3c6322..a63b7ebe1 100644
--- a/Source/JavaScriptCore/heap/HeapBlock.h
+++ b/Source/JavaScriptCore/heap/HeapBlock.h
@@ -34,22 +34,42 @@ namespace JSC {
 
 enum AllocationEffort { AllocationCanFail, AllocationMustSucceed };
 
-class HeapBlock : public DoublyLinkedListNode<HeapBlock> {
+#if COMPILER(GCC)
+#define CLASS_IF_GCC class
+#else
+#define CLASS_IF_GCC
+#endif
+
+template<typename T>
+class HeapBlock : public DoublyLinkedListNode<T> {
+    friend CLASS_IF_GCC DoublyLinkedListNode<T>;
 public:
+    static const size_t s_blockSize = 64 * KB;
+
+    static PageAllocationAligned destroy(HeapBlock* block)
+    {
+        static_cast<T*>(block)->~T();
+
+        PageAllocationAligned allocation;
+        std::swap(allocation, block->m_allocation);
+        return allocation;
+    }
+
     HeapBlock(const PageAllocationAligned& allocation)
-        : DoublyLinkedListNode<HeapBlock>()
+        : DoublyLinkedListNode<T>()
+        , m_allocation(allocation)
         , m_prev(0)
         , m_next(0)
-        , m_allocation(allocation)
     {
         ASSERT(m_allocation);
     }
 
-    HeapBlock* m_prev;
-    HeapBlock* m_next;
+    const PageAllocationAligned allocation() const { return m_allocation; }
+
+private:
     PageAllocationAligned m_allocation;
-    
-    static const size_t s_blockSize = 64 * KB;
+    T* m_prev;
+    T* m_next;
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/IncrementalSweeper.cpp b/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
index 49222c545..f284d8b57 100644
--- a/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
+++ b/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
@@ -51,6 +51,7 @@ void IncrementalSweeper::doWork()
 IncrementalSweeper::IncrementalSweeper(Heap* heap, CFRunLoopRef runLoop)
     : HeapTimer(heap->globalData(), runLoop)
     , m_currentBlockToSweepIndex(0)
+    , m_structuresCanBeSwept(false)
 {
 }
 
@@ -72,12 +73,7 @@ void IncrementalSweeper::cancelTimer()
 void IncrementalSweeper::doSweep(double sweepBeginTime)
 {
     while (m_currentBlockToSweepIndex < m_blocksToSweep.size()) {
-        MarkedBlock* block = m_blocksToSweep[m_currentBlockToSweepIndex++];
-        if (!block->needsSweeping())
-            continue;
-
-        block->sweep();
-        m_globalData->heap.objectSpace().freeOrShrinkBlock(block);
+        sweepNextBlock();
 
         CFTimeInterval elapsedTime = WTF::monotonicallyIncreasingTime() - sweepBeginTime;
         if (elapsedTime < sweepTimeSlice)
@@ -91,17 +87,48 @@ void IncrementalSweeper::doSweep(double sweepBeginTime)
     cancelTimer();
 }
 
+void IncrementalSweeper::sweepNextBlock()
+{
+    while (m_currentBlockToSweepIndex < m_blocksToSweep.size()) {
+        MarkedBlock* block = m_blocksToSweep[m_currentBlockToSweepIndex++];
+        if (block->onlyContainsStructures())
+            m_structuresCanBeSwept = true;
+        else
+            ASSERT(!m_structuresCanBeSwept);
+
+        if (!block->needsSweeping())
+            continue;
+
+        block->sweep();
+        m_globalData->heap.objectSpace().freeOrShrinkBlock(block);
+        return;
+    }
+}
+
 void IncrementalSweeper::startSweeping(const HashSet<MarkedBlock*>& blockSnapshot)
 {
-    WTF::copyToVector(blockSnapshot, m_blocksToSweep);
+    m_blocksToSweep.resize(blockSnapshot.size());
+    CopyFunctor functor(m_blocksToSweep);
+    m_globalData->heap.objectSpace().forEachBlock(functor);
     m_currentBlockToSweepIndex = 0;
+    m_structuresCanBeSwept = false;
     scheduleTimer();
 }
 
+void IncrementalSweeper::willFinishSweeping()
+{
+    m_currentBlockToSweepIndex = 0;
+    m_structuresCanBeSwept = true;
+    m_blocksToSweep.clear();
+    if (m_globalData)
+        cancelTimer();
+}
+
 #else
 
 IncrementalSweeper::IncrementalSweeper(JSGlobalData* globalData)
     : HeapTimer(globalData)
+    , m_structuresCanBeSwept(false)
 {
 }
 
@@ -116,8 +143,23 @@ IncrementalSweeper* IncrementalSweeper::create(Heap* heap)
 
 void IncrementalSweeper::startSweeping(const HashSet<MarkedBlock*>&)
 {
+    m_structuresCanBeSwept = false;
 }
-    
+
+void IncrementalSweeper::willFinishSweeping()
+{
+    m_structuresCanBeSwept = true;
+}
+
+void IncrementalSweeper::sweepNextBlock()
+{
+}
+
 #endif
 
+bool IncrementalSweeper::structuresCanBeSwept()
+{
+    return m_structuresCanBeSwept;
+}
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/IncrementalSweeper.h b/Source/JavaScriptCore/heap/IncrementalSweeper.h
index eedfa7f6f..c8005b071 100644
--- a/Source/JavaScriptCore/heap/IncrementalSweeper.h
+++ b/Source/JavaScriptCore/heap/IncrementalSweeper.h
@@ -36,12 +36,28 @@
 namespace JSC {
 
 class Heap;
-    
+
+struct CopyFunctor : public MarkedBlock::VoidFunctor {
+    CopyFunctor(Vector<MarkedBlock*>& blocks) 
+        : m_index(0) 
+        , m_blocks(blocks)
+    {
+    }
+
+    void operator()(MarkedBlock* block) { m_blocks[m_index++] = block; }
+
+    size_t m_index;
+    Vector<MarkedBlock*>& m_blocks;
+};
+
 class IncrementalSweeper : public HeapTimer {
 public:
     static IncrementalSweeper* create(Heap*);
     void startSweeping(const HashSet<MarkedBlock*>& blockSnapshot);
     virtual void doWork();
+    void sweepNextBlock();
+    bool structuresCanBeSwept();
+    void willFinishSweeping();
 
 private:
 #if USE(CF)
@@ -58,6 +74,7 @@ private:
     IncrementalSweeper(JSGlobalData*);
     
 #endif
+    bool m_structuresCanBeSwept;
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/MachineStackMarker.cpp b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
index 8e0c57b6a..537a34e48 100644
--- a/Source/JavaScriptCore/heap/MachineStackMarker.cpp
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
@@ -142,7 +142,7 @@ MachineThreads::MachineThreads(Heap* heap)
 MachineThreads::~MachineThreads()
 {
     if (m_threadSpecific)
-        ThreadSpecificKeyDelete(m_threadSpecific);
+        threadSpecificKeyDelete(m_threadSpecific);
 
     MutexLocker registeredThreadsLock(m_registeredThreadsMutex);
     for (Thread* t = m_registeredThreads; t;) {
@@ -179,17 +179,17 @@ void MachineThreads::makeUsableFromMultipleThreads()
     if (m_threadSpecific)
         return;
 
-    ThreadSpecificKeyCreate(&m_threadSpecific, removeThread);
+    threadSpecificKeyCreate(&m_threadSpecific, removeThread);
 }
 
 void MachineThreads::addCurrentThread()
 {
     ASSERT(!m_heap->globalData()->exclusiveThread || m_heap->globalData()->exclusiveThread == currentThread());
 
-    if (!m_threadSpecific || ThreadSpecificGet(m_threadSpecific))
+    if (!m_threadSpecific || threadSpecificGet(m_threadSpecific))
         return;
 
-    ThreadSpecificSet(m_threadSpecific, this);
+    threadSpecificSet(m_threadSpecific, this);
     Thread* thread = new Thread(getCurrentPlatformThread(), wtfThreadData().stack().origin());
 
     MutexLocker lock(m_registeredThreadsMutex);
diff --git a/Source/JavaScriptCore/heap/MarkedAllocator.cpp b/Source/JavaScriptCore/heap/MarkedAllocator.cpp
index 465e3a72a..20b556969 100644
--- a/Source/JavaScriptCore/heap/MarkedAllocator.cpp
+++ b/Source/JavaScriptCore/heap/MarkedAllocator.cpp
@@ -3,6 +3,7 @@
 
 #include "GCActivityCallback.h"
 #include "Heap.h"
+#include "IncrementalSweeper.h"
 #include "JSGlobalData.h"
 #include <wtf/CurrentTime.h>
 
@@ -11,7 +12,7 @@ namespace JSC {
 bool MarkedAllocator::isPagedOut(double deadline)
 {
     unsigned itersSinceLastTimeCheck = 0;
-    HeapBlock* block = m_blockList.head();
+    MarkedBlock* block = m_blockList.head();
     while (block) {
         block = block->next();
         ++itersSinceLastTimeCheck;
@@ -29,7 +30,18 @@ bool MarkedAllocator::isPagedOut(double deadline)
 inline void* MarkedAllocator::tryAllocateHelper()
 {
     if (!m_freeList.head) {
-        for (MarkedBlock*& block = m_blocksToSweep; block; block = static_cast<MarkedBlock*>(block->next())) {
+        if (m_onlyContainsStructures && !m_heap->isSafeToSweepStructures()) {
+            if (m_currentBlock) {
+                m_currentBlock->didConsumeFreeList();
+                m_currentBlock = 0;
+            }
+            // We sweep another random block here so that we can make progress
+            // toward being able to sweep Structures.
+            m_heap->sweeper()->sweepNextBlock();
+            return 0;
+        }
+
+        for (MarkedBlock*& block = m_blocksToSweep; block; block = block->next()) {
             m_freeList = block->sweep(MarkedBlock::SweepToFreeList);
             if (m_freeList.head) {
                 m_currentBlock = block;
@@ -104,7 +116,6 @@ MarkedBlock* MarkedAllocator::allocateBlock()
 void MarkedAllocator::addBlock(MarkedBlock* block)
 {
     ASSERT(!m_currentBlock);
-    ASSERT(!m_blocksToSweep);
     ASSERT(!m_freeList.head);
     
     m_blockList.append(block);
@@ -115,11 +126,11 @@ void MarkedAllocator::addBlock(MarkedBlock* block)
 void MarkedAllocator::removeBlock(MarkedBlock* block)
 {
     if (m_currentBlock == block) {
-        m_currentBlock = static_cast<MarkedBlock*>(m_currentBlock->next());
+        m_currentBlock = m_currentBlock->next();
         m_freeList = MarkedBlock::FreeList();
     }
     if (m_blocksToSweep == block)
-        m_blocksToSweep = static_cast<MarkedBlock*>(m_blocksToSweep->next());
+        m_blocksToSweep = m_blocksToSweep->next();
     m_blockList.remove(block);
 }
 
diff --git a/Source/JavaScriptCore/heap/MarkedAllocator.h b/Source/JavaScriptCore/heap/MarkedAllocator.h
index 47bae9451..c1c431194 100644
--- a/Source/JavaScriptCore/heap/MarkedAllocator.h
+++ b/Source/JavaScriptCore/heap/MarkedAllocator.h
@@ -47,7 +47,7 @@ private:
     MarkedBlock::FreeList m_freeList;
     MarkedBlock* m_currentBlock;
     MarkedBlock* m_blocksToSweep;
-    DoublyLinkedList<HeapBlock> m_blockList;
+    DoublyLinkedList<MarkedBlock> m_blockList;
     size_t m_cellSize;
     bool m_cellsNeedDestruction;
     bool m_onlyContainsStructures;
@@ -90,7 +90,7 @@ inline void MarkedAllocator::reset()
 {
     m_currentBlock = 0;
     m_freeList = MarkedBlock::FreeList();
-    m_blocksToSweep = static_cast<MarkedBlock*>(m_blockList.head());
+    m_blocksToSweep = m_blockList.head();
 }
 
 inline void MarkedAllocator::zapFreeList()
@@ -101,15 +101,16 @@ inline void MarkedAllocator::zapFreeList()
     }
     
     m_currentBlock->zapFreeList(m_freeList);
+    m_currentBlock = 0;
     m_freeList = MarkedBlock::FreeList();
 }
 
 template <typename Functor> inline void MarkedAllocator::forEachBlock(Functor& functor)
 {
-    HeapBlock* next;
-    for (HeapBlock* block = m_blockList.head(); block; block = next) {
+    MarkedBlock* next;
+    for (MarkedBlock* block = m_blockList.head(); block; block = next) {
         next = block->next();
-        functor(static_cast<MarkedBlock*>(block));
+        functor(block);
     }
 }
     
diff --git a/Source/JavaScriptCore/heap/MarkedBlock.cpp b/Source/JavaScriptCore/heap/MarkedBlock.cpp
index 8ede87927..95ea2f414 100644
--- a/Source/JavaScriptCore/heap/MarkedBlock.cpp
+++ b/Source/JavaScriptCore/heap/MarkedBlock.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "MarkedBlock.h"
 
+#include "IncrementalSweeper.h"
 #include "JSCell.h"
 #include "JSObject.h"
 #include "ScopeChain.h"
@@ -37,17 +38,8 @@ MarkedBlock* MarkedBlock::create(const PageAllocationAligned& allocation, Heap*
     return new (NotNull, allocation.base()) MarkedBlock(allocation, heap, cellSize, cellsNeedDestruction, onlyContainsStructures);
 }
 
-PageAllocationAligned MarkedBlock::destroy(MarkedBlock* block)
-{
-    PageAllocationAligned allocation;
-    swap(allocation, block->m_allocation);
-
-    block->~MarkedBlock();
-    return allocation;
-}
-
 MarkedBlock::MarkedBlock(const PageAllocationAligned& allocation, Heap* heap, size_t cellSize, bool cellsNeedDestruction, bool onlyContainsStructures)
-    : HeapBlock(allocation)
+    : HeapBlock<MarkedBlock>(allocation)
     , m_atomsPerCell((cellSize + atomSize - 1) / atomSize)
     , m_endAtom(atomsPerBlock - m_atomsPerCell + 1)
     , m_cellsNeedDestruction(cellsNeedDestruction)
@@ -69,10 +61,6 @@ inline void MarkedBlock::callDestructor(JSCell* cell)
     m_heap->m_destroyedTypeCounts.countVPtr(vptr);
 #endif
 
-#if !ASSERT_DISABLED || ENABLE(GC_VALIDATION)
-    cell->clearStructure();
-#endif
-
     cell->methodTable()->destroy(cell);
     cell->zap();
 }
@@ -140,10 +128,12 @@ MarkedBlock::FreeList MarkedBlock::sweepHelper(SweepMode sweepMode)
         ASSERT_NOT_REACHED();
         return FreeList();
     case Marked:
+        ASSERT(!m_onlyContainsStructures || heap()->isSafeToSweepStructures());
         return sweepMode == SweepToFreeList
             ? specializedSweep<Marked, SweepToFreeList, destructorCallNeeded>()
             : specializedSweep<Marked, SweepOnly, destructorCallNeeded>();
     case Zapped:
+        ASSERT(!m_onlyContainsStructures || heap()->isSafeToSweepStructures());
         return sweepMode == SweepToFreeList
             ? specializedSweep<Zapped, SweepToFreeList, destructorCallNeeded>()
             : specializedSweep<Zapped, SweepOnly, destructorCallNeeded>();
diff --git a/Source/JavaScriptCore/heap/MarkedBlock.h b/Source/JavaScriptCore/heap/MarkedBlock.h
index ff7840632..ab2abd753 100644
--- a/Source/JavaScriptCore/heap/MarkedBlock.h
+++ b/Source/JavaScriptCore/heap/MarkedBlock.h
@@ -67,8 +67,7 @@ namespace JSC {
     // size is equal to the difference between the cell size and the object
     // size.
 
-    class MarkedBlock : public HeapBlock {
-        friend class WTF::DoublyLinkedListNode<MarkedBlock>;
+    class MarkedBlock : public HeapBlock<MarkedBlock> {
     public:
         // Ensure natural alignment for native types whilst recognizing that the smallest
         // object the heap will commonly allocate is four words.
@@ -114,7 +113,6 @@ namespace JSC {
         };
 
         static MarkedBlock* create(const PageAllocationAligned&, Heap*, size_t cellSize, bool cellsNeedDestruction, bool onlyContainsStructures);
-        static PageAllocationAligned destroy(MarkedBlock*);
 
         static bool isAtomAligned(const void*);
         static MarkedBlock* blockFor(const void*);
@@ -336,7 +334,7 @@ namespace JSC {
 
     inline size_t MarkedBlock::capacity()
     {
-        return m_allocation.size();
+        return allocation().size();
     }
 
     inline size_t MarkedBlock::atomNumber(const void* p)
diff --git a/Source/JavaScriptCore/heap/MarkedSpace.cpp b/Source/JavaScriptCore/heap/MarkedSpace.cpp
index a9e9ef64d..cd6be001c 100644
--- a/Source/JavaScriptCore/heap/MarkedSpace.cpp
+++ b/Source/JavaScriptCore/heap/MarkedSpace.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "MarkedSpace.h"
 
+#include "IncrementalSweeper.h"
 #include "JSGlobalObject.h"
 #include "JSLock.h"
 #include "JSObject.h"
@@ -108,6 +109,12 @@ void MarkedSpace::lastChanceToFinalize()
     forEachBlock<LastChanceToFinalize>();
 }
 
+void MarkedSpace::sweep()
+{
+    m_heap->sweeper()->willFinishSweeping();
+    forEachBlock<Sweep>();
+}
+
 void MarkedSpace::resetAllocators()
 {
     for (size_t cellSize = preciseStep; cellSize <= preciseCutoff; cellSize += preciseStep) {
diff --git a/Source/JavaScriptCore/heap/MarkedSpace.h b/Source/JavaScriptCore/heap/MarkedSpace.h
index d2a0688f1..d5dae3584 100644
--- a/Source/JavaScriptCore/heap/MarkedSpace.h
+++ b/Source/JavaScriptCore/heap/MarkedSpace.h
@@ -235,11 +235,6 @@ inline void MarkedSpace::clearMarks()
     forEachBlock<ClearMarks>();
 }
 
-inline void MarkedSpace::sweep()
-{
-    forEachBlock<Sweep>();
-}
-
 inline size_t MarkedSpace::objectCount()
 {
     return forEachBlock<MarkCount>();
diff --git a/Source/JavaScriptCore/heap/WeakSetInlines.h b/Source/JavaScriptCore/heap/WeakSetInlines.h
index c1c87b380..76337fda7 100644
--- a/Source/JavaScriptCore/heap/WeakSetInlines.h
+++ b/Source/JavaScriptCore/heap/WeakSetInlines.h
@@ -49,9 +49,6 @@ inline void WeakBlock::finalize(WeakImpl* weakImpl)
     WeakHandleOwner* weakHandleOwner = weakImpl->weakHandleOwner();
     if (!weakHandleOwner)
         return;
-#if !ASSERT_DISABLED || ENABLE(GC_VALIDATION)
-    weakImpl->jsValue().asCell()->clearStructure();
-#endif
     weakHandleOwner->finalize(Handle<Unknown>::wrapSlot(&const_cast<JSValue&>(weakImpl->jsValue())), weakImpl->context());
 }
 
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index 3edb8589e..51f22bedd 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -730,9 +730,9 @@ NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue ex
     if (Debugger* debugger = callFrame->dynamicGlobalObject()->debugger()) {
         DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
         if (callFrame->callee())
-            debugger->returnEvent(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->lastLine());
+            debugger->returnEvent(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->lastLine(), 0);
         else
-            debugger->didExecuteProgram(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->lastLine());
+            debugger->didExecuteProgram(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->lastLine(), 0);
     }
 
     // If this call frame created an activation or an 'arguments' object, tear it off.
@@ -1055,7 +1055,7 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     if (Debugger* debugger = callFrame->dynamicGlobalObject()->debugger()) {
         DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
         bool hasHandler = codeBlock->handlerForBytecodeOffset(bytecodeOffset);
-        debugger->exception(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->lineNumberForBytecodeOffset(bytecodeOffset), hasHandler);
+        debugger->exception(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->lineNumberForBytecodeOffset(bytecodeOffset), 0, hasHandler);
     }
 
     // Calculate an exception handler vPC, unwinding call frames as necessary.
@@ -1643,7 +1643,7 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSValue
     return checkedReturn(result);
 }
 
-NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHookID, int firstLine, int lastLine)
+NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHookID, int firstLine, int lastLine, int column)
 {
     Debugger* debugger = callFrame->dynamicGlobalObject()->debugger();
     if (!debugger)
@@ -1651,22 +1651,22 @@ NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHook
 
     switch (debugHookID) {
         case DidEnterCallFrame:
-            debugger->callEvent(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine);
+            debugger->callEvent(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine, column);
             return;
         case WillLeaveCallFrame:
-            debugger->returnEvent(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine);
+            debugger->returnEvent(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine, column);
             return;
         case WillExecuteStatement:
-            debugger->atStatement(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine);
+            debugger->atStatement(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine, column);
             return;
         case WillExecuteProgram:
-            debugger->willExecuteProgram(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine);
+            debugger->willExecuteProgram(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine, column);
             return;
         case DidExecuteProgram:
-            debugger->didExecuteProgram(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine);
+            debugger->didExecuteProgram(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine, column);
             return;
         case DidReachBreakpoint:
-            debugger->didReachBreakpoint(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine);
+            debugger->didReachBreakpoint(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine, column);
             return;
     }
 }
@@ -5245,7 +5245,7 @@ skip_id_custom_self:
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_debug) {
-        /* debug debugHookID(n) firstLine(n) lastLine(n)
+        /* debug debugHookID(n) firstLine(n) lastLine(n) column(n)
 
          Notifies the debugger of the current state of execution. This opcode
          is only generated while the debugger is attached.
@@ -5253,8 +5253,10 @@ skip_id_custom_self:
         int debugHookID = vPC[1].u.operand;
         int firstLine = vPC[2].u.operand;
         int lastLine = vPC[3].u.operand;
+        int column = vPC[4].u.operand;
 
-        debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
+
+        debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine, column);
 
         vPC += OPCODE_LENGTH(op_debug);
         NEXT_INSTRUCTION();
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.h b/Source/JavaScriptCore/interpreter/Interpreter.h
index 8663bf8ec..f4ccd995c 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.h
+++ b/Source/JavaScriptCore/interpreter/Interpreter.h
@@ -240,7 +240,7 @@ namespace JSC {
         SamplingTool* sampler() { return m_sampler.get(); }
 
         NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValue&, unsigned bytecodeOffset);
-        NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine);
+        NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine, int column);
         static const UString getTraceLine(CallFrame*, StackFrameCodeType, const UString&, int);
         JS_EXPORT_PRIVATE static void getStackTrace(JSGlobalData*, Vector<StackFrame>& results);
         static void addStackTraceIfNecessary(CallFrame*, JSObject* error);
diff --git a/Source/JavaScriptCore/jit/JITInlineMethods.h b/Source/JavaScriptCore/jit/JITInlineMethods.h
index 32bc1837d..e68ecbe78 100644
--- a/Source/JavaScriptCore/jit/JITInlineMethods.h
+++ b/Source/JavaScriptCore/jit/JITInlineMethods.h
@@ -84,7 +84,7 @@ ALWAYS_INLINE void JIT::emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHea
 
 ALWAYS_INLINE void JIT::emitLoadCharacterString(RegisterID src, RegisterID dst, JumpList& failures)
 {
-    failures.append(branchPtr(NotEqual, Address(src, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
+    failures.append(branchPtr(NotEqual, Address(src, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get())));
     failures.append(branch32(NotEqual, MacroAssembler::Address(src, ThunkHelpers::jsStringLengthOffset()), TrustedImm32(1)));
     loadPtr(MacroAssembler::Address(src, ThunkHelpers::jsStringValueOffset()), dst);
     failures.append(branchTest32(Zero, dst));
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index c0af6f9e9..0d24961b8 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -50,7 +50,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
 
     // Check eax is a string
     Jump string_failureCases1 = emitJumpIfNotJSCell(regT0);
-    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info));
+    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(globalData->stringStructure.get()));
 
     // Checks out okay! - get the length from the Ustring.
     load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT0);
@@ -647,7 +647,7 @@ void JIT::emit_op_to_primitive(Instruction* currentInstruction)
     emitGetVirtualRegister(src, regT0);
     
     Jump isImm = emitJumpIfNotJSCell(regT0);
-    addSlowCase(branchPtr(NotEqual, Address(regT0, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get())));
     isImm.link(this);
 
     if (dst != src)
@@ -1158,6 +1158,7 @@ void JIT::emit_op_debug(Instruction* currentInstruction)
     stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
     stubCall.addArgument(TrustedImm32(currentInstruction[2].u.operand));
     stubCall.addArgument(TrustedImm32(currentInstruction[3].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[4].u.operand));
     stubCall.call();
 #endif
 }
@@ -1260,7 +1261,7 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
         loadPtr(Address(regT1, JSCell::structureOffset()), regT0);
         emitValueProfilingSite();
     }
-    addSlowCase(branchPtr(Equal, Address(regT1, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
+    addSlowCase(branchPtr(Equal, Address(regT1, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get())));
 }
 
 void JIT::emit_op_create_this(Instruction* currentInstruction)
diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
index 095ea57d3..eec9df36f 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -48,7 +48,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     // regT0 holds payload, regT1 holds tag
 
     Jump string_failureCases1 = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
-    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info));
+    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(globalData->stringStructure.get()));
 
     // Checks out okay! - get the length from the Ustring.
     load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT2);
@@ -732,7 +732,7 @@ void JIT::emit_op_to_primitive(Instruction* currentInstruction)
     emitLoad(src, regT1, regT0);
 
     Jump isImm = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
-    addSlowCase(branchPtr(NotEqual, Address(regT0, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get())));
     isImm.link(this);
 
     if (dst != src)
@@ -1008,8 +1008,8 @@ void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>:
     genericCase.append(getSlowCase(iter)); // tags not equal
 
     linkSlowCase(iter); // tags equal and JSCell
-    genericCase.append(branchPtr(NotEqual, Address(regT0, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
-    genericCase.append(branchPtr(NotEqual, Address(regT2, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
+    genericCase.append(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get())));
+    genericCase.append(branchPtr(NotEqual, Address(regT2, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get())));
 
     // String case.
     JITStubCall stubCallEqStrings(this, cti_op_eq_strings);
@@ -1056,8 +1056,8 @@ void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>
     genericCase.append(getSlowCase(iter)); // tags not equal
 
     linkSlowCase(iter); // tags equal and JSCell
-    genericCase.append(branchPtr(NotEqual, Address(regT0, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
-    genericCase.append(branchPtr(NotEqual, Address(regT2, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
+    genericCase.append(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get())));
+    genericCase.append(branchPtr(NotEqual, Address(regT2, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get())));
 
     // String case.
     JITStubCall stubCallEqStrings(this, cti_op_eq_strings);
@@ -1093,8 +1093,8 @@ void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqTy
 
     // Jump to a slow case if both are strings.
     Jump notCell = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
-    Jump firstNotString = branchPtr(NotEqual, Address(regT0, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info));
-    addSlowCase(branchPtr(Equal, Address(regT2, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
+    Jump firstNotString = branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get()));
+    addSlowCase(branchPtr(Equal, Address(regT2, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get())));
     notCell.link(this);
     firstNotString.link(this);
 
@@ -1478,6 +1478,7 @@ void JIT::emit_op_debug(Instruction* currentInstruction)
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
     stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[4].u.operand));
     stubCall.call();
 #endif
 }
@@ -1556,7 +1557,7 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
         move(regT3, regT1);
         emitValueProfilingSite();
     }
-    addSlowCase(branchPtr(Equal, Address(regT2, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
+    addSlowCase(branchPtr(Equal, Address(regT2, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get())));
 }
 
 void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
index 86078fbc3..dfb2dc8ec 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -56,7 +56,7 @@ JIT::CodeRef JIT::stringGetByValStubGenerator(JSGlobalData* globalData)
 {
     JSInterfaceJIT jit;
     JumpList failures;
-    failures.append(jit.branchPtr(NotEqual, Address(regT0, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
+    failures.append(jit.branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(globalData->stringStructure.get())));
 
     // Load string length to regT2, and start the process of loading the data pointer into regT0
     jit.load32(Address(regT0, ThunkHelpers::jsStringLengthOffset()), regT2);
@@ -132,7 +132,7 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     linkSlowCaseIfNotJSCell(iter, base); // base cell check
     Jump nonCell = jump();
     linkSlowCase(iter); // base array check
-    Jump notString = branchPtr(NotEqual, Address(regT0, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info));
+    Jump notString = branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get()));
     emitNakedCall(CodeLocationLabel(m_globalData->getCTIStub(stringGetByValStubGenerator).code()));
     Jump failed = branchTestPtr(Zero, regT0);
     emitPutVirtualRegister(dst, regT0);
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index 365ecd20a..b506f4ecb 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -161,7 +161,7 @@ JIT::CodeRef JIT::stringGetByValStubGenerator(JSGlobalData* globalData)
 {
     JSInterfaceJIT jit;
     JumpList failures;
-    failures.append(jit.branchPtr(NotEqual, Address(regT0, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
+    failures.append(jit.branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(globalData->stringStructure.get())));
     
     // Load string length to regT1, and start the process of loading the data pointer into regT0
     jit.load32(Address(regT0, ThunkHelpers::jsStringLengthOffset()), regT1);
@@ -234,7 +234,7 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
 
     Jump nonCell = jump();
     linkSlowCase(iter); // base array check
-    Jump notString = branchPtr(NotEqual, Address(regT0, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info));
+    Jump notString = branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(m_globalData->stringStructure.get()));
     emitNakedCall(m_globalData->getCTIStub(stringGetByValStubGenerator).code());
     Jump failed = branchTestPtr(Zero, regT0);
     emitStore(dst, regT1, regT0);
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index 0f03a0a4a..8b8546994 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -1430,15 +1430,19 @@ DEFINE_STUB_FUNCTION(void, op_put_by_id)
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
     
+    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
+
     PutPropertySlot slot(callFrame->codeBlock()->isStrictMode());
     stackFrame.args[0].jsValue().put(callFrame, ident, stackFrame.args[2].jsValue(), slot);
     
-    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
-    if (!stubInfo->seenOnce())
-        stubInfo->setSeen();
-    else
-        JITThunks::tryCachePutByID(callFrame, codeBlock, STUB_RETURN_ADDRESS, stackFrame.args[0].jsValue(), slot, stubInfo, false);
+    if (accessType == static_cast<AccessType>(stubInfo->accessType)) {
+        if (!stubInfo->seenOnce())
+            stubInfo->setSeen();
+        else
+            JITThunks::tryCachePutByID(callFrame, codeBlock, STUB_RETURN_ADDRESS, stackFrame.args[0].jsValue(), slot, stubInfo, false);
+    }
     
     CHECK_FOR_EXCEPTION_AT_END();
 }
@@ -1449,18 +1453,22 @@ DEFINE_STUB_FUNCTION(void, op_put_by_id_direct)
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
     
+    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
+
     PutPropertySlot slot(callFrame->codeBlock()->isStrictMode());
     JSValue baseValue = stackFrame.args[0].jsValue();
     ASSERT(baseValue.isObject());
     
     asObject(baseValue)->putDirect(callFrame->globalData(), ident, stackFrame.args[2].jsValue(), slot);
     
-    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
-    if (!stubInfo->seenOnce())
-        stubInfo->setSeen();
-    else
-        JITThunks::tryCachePutByID(callFrame, codeBlock, STUB_RETURN_ADDRESS, stackFrame.args[0].jsValue(), slot, stubInfo, true);
+    if (accessType == static_cast<AccessType>(stubInfo->accessType)) {
+        if (!stubInfo->seenOnce())
+            stubInfo->setSeen();
+        else
+            JITThunks::tryCachePutByID(callFrame, codeBlock, STUB_RETURN_ADDRESS, stackFrame.args[0].jsValue(), slot, stubInfo, true);
+    }
     
     CHECK_FOR_EXCEPTION_AT_END();
 }
@@ -1521,14 +1529,18 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
 
+    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
+    MethodCallLinkInfo& methodCallLinkInfo = codeBlock->getMethodCallLinkInfo(STUB_RETURN_ADDRESS);
+    StructureStubInfo& stubInfo = codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
     JSValue result = baseValue.get(callFrame, ident, slot);
     CHECK_FOR_EXCEPTION();
-
-    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
-    MethodCallLinkInfo& methodCallLinkInfo = codeBlock->getMethodCallLinkInfo(STUB_RETURN_ADDRESS);
-    StructureStubInfo& stubInfo = codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+    
+    if (accessType != static_cast<AccessType>(stubInfo.accessType))
+        return JSValue::encode(result);
 
     if (!methodCallLinkInfo.seenOnce()) {
         methodCallLinkInfo.setSeen();
@@ -1595,14 +1607,18 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check_update)
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
 
+    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
+    MethodCallLinkInfo& methodCallLinkInfo = codeBlock->getMethodCallLinkInfo(STUB_RETURN_ADDRESS);
+    StructureStubInfo& stubInfo = codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
+
     JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
     JSValue result = baseValue.get(callFrame, ident, slot);
     CHECK_FOR_EXCEPTION();
-
-    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
-    MethodCallLinkInfo& methodCallLinkInfo = codeBlock->getMethodCallLinkInfo(STUB_RETURN_ADDRESS);
-    StructureStubInfo& stubInfo = codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+    
+    if (accessType != static_cast<AccessType>(stubInfo.accessType))
+        return JSValue::encode(result);
 
     ASSERT(methodCallLinkInfo.seenOnce());
 
@@ -1684,12 +1700,17 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id)
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
 
+    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
+
     JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
     JSValue result = baseValue.get(callFrame, ident, slot);
+    
+    if (accessType != static_cast<AccessType>(stubInfo->accessType))
+        return JSValue::encode(result);
 
-    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
     if (!stubInfo->seenOnce())
         stubInfo->setSeen();
     else
@@ -1706,9 +1727,16 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
 
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
+
     JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
     JSValue result = baseValue.get(callFrame, ident, slot);
+    
+    if (accessType != static_cast<AccessType>(stubInfo->accessType))
+        return JSValue::encode(result);
 
     CHECK_FOR_EXCEPTION();
 
@@ -1717,9 +1745,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
         && !baseValue.asCell()->structure()->isUncacheableDictionary()
         && slot.slotBase() == baseValue) {
 
-        CodeBlock* codeBlock = callFrame->codeBlock();
-        StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
-
         ASSERT(slot.slotBase().isObject());
 
         PolymorphicAccessStructureList* polymorphicStructureList;
@@ -1813,20 +1838,26 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
     CallFrame* callFrame = stackFrame.callFrame;
     const Identifier& propertyName = stackFrame.args[1].identifier();
 
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
+
     JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
     JSValue result = baseValue.get(callFrame, propertyName, slot);
 
     CHECK_FOR_EXCEPTION();
 
-    if (!baseValue.isCell() || !slot.isCacheable() || baseValue.asCell()->structure()->isDictionary() || baseValue.asCell()->structure()->typeInfo().prohibitsPropertyCaching()) {
+    if (accessType != static_cast<AccessType>(stubInfo->accessType)
+        || !baseValue.isCell()
+        || !slot.isCacheable()
+        || baseValue.asCell()->structure()->isDictionary()
+        || baseValue.asCell()->structure()->typeInfo().prohibitsPropertyCaching()) {
         ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
         return JSValue::encode(result);
     }
 
     Structure* structure = baseValue.asCell()->structure();
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
 
     ASSERT(slot.slotBase().isObject());
     JSObject* slotBaseObject = asObject(slot.slotBase());
@@ -3403,8 +3434,9 @@ DEFINE_STUB_FUNCTION(void, op_debug)
     int debugHookID = stackFrame.args[0].int32();
     int firstLine = stackFrame.args[1].int32();
     int lastLine = stackFrame.args[2].int32();
+    int column = stackFrame.args[3].int32();
 
-    stackFrame.globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
+    stackFrame.globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine, column);
 }
 
 DEFINE_STUB_FUNCTION(void*, vm_throw)
diff --git a/Source/JavaScriptCore/jit/SpecializedThunkJIT.h b/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
index e17b45d94..0fe606476 100644
--- a/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
+++ b/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
@@ -55,10 +55,10 @@ namespace JSC {
             m_failures.append(emitLoadJSCell(src, dst));
         }
         
-        void loadJSStringArgument(int argument, RegisterID dst)
+        void loadJSStringArgument(JSGlobalData& globalData, int argument, RegisterID dst)
         {
             loadCellArgument(argument, dst);
-            m_failures.append(branchPtr(NotEqual, Address(dst, JSCell::classInfoOffset()), TrustedImmPtr(&JSString::s_info)));
+            m_failures.append(branchPtr(NotEqual, Address(dst, JSCell::structureOffset()), TrustedImmPtr(globalData.stringStructure.get())));
         }
         
         void loadInt32Argument(int argument, RegisterID dst, Jump& failTarget)
diff --git a/Source/JavaScriptCore/jit/ThunkGenerators.cpp b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
index c6431c22d..cbfc1eb0f 100644
--- a/Source/JavaScriptCore/jit/ThunkGenerators.cpp
+++ b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
@@ -35,10 +35,10 @@
 
 namespace JSC {
 
-static void stringCharLoad(SpecializedThunkJIT& jit)
+static void stringCharLoad(SpecializedThunkJIT& jit, JSGlobalData* globalData)
 {
     // load string
-    jit.loadJSStringArgument(SpecializedThunkJIT::ThisArgument, SpecializedThunkJIT::regT0);
+    jit.loadJSStringArgument(*globalData, SpecializedThunkJIT::ThisArgument, SpecializedThunkJIT::regT0);
 
     // Load string length to regT2, and start the process of loading the data pointer into regT0
     jit.load32(MacroAssembler::Address(SpecializedThunkJIT::regT0, ThunkHelpers::jsStringLengthOffset()), SpecializedThunkJIT::regT2);
@@ -76,7 +76,7 @@ static void charToString(SpecializedThunkJIT& jit, JSGlobalData* globalData, Mac
 MacroAssemblerCodeRef charCodeAtThunkGenerator(JSGlobalData* globalData)
 {
     SpecializedThunkJIT jit(1);
-    stringCharLoad(jit);
+    stringCharLoad(jit, globalData);
     jit.returnInt32(SpecializedThunkJIT::regT0);
     return jit.finalize(*globalData, globalData->jitStubs->ctiNativeCall(), "charCodeAt");
 }
@@ -84,7 +84,7 @@ MacroAssemblerCodeRef charCodeAtThunkGenerator(JSGlobalData* globalData)
 MacroAssemblerCodeRef charAtThunkGenerator(JSGlobalData* globalData)
 {
     SpecializedThunkJIT jit(1);
-    stringCharLoad(jit);
+    stringCharLoad(jit, globalData);
     charToString(jit, globalData, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT1);
     jit.returnJSCell(SpecializedThunkJIT::regT0);
     return jit.finalize(*globalData, globalData->jitStubs->ctiNativeCall(), "charAt");
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index d2d743e0a..58bf1bdeb 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -1601,8 +1601,9 @@ LLINT_SLOW_PATH_DECL(slow_path_debug)
     int debugHookID = pc[1].u.operand;
     int firstLine = pc[2].u.operand;
     int lastLine = pc[3].u.operand;
-    
-    globalData.interpreter->debug(exec, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
+    int column = pc[4].u.operand;
+
+    globalData.interpreter->debug(exec, static_cast<DebugHookID>(debugHookID), firstLine, lastLine, column);
     
     LLINT_END();
 }
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
index 2ae3e0cb2..10a5aaeab 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -760,7 +760,7 @@ _llint_op_profile_did_call:
 _llint_op_debug:
     traceExecution()
     callSlowPath(_llint_slow_path_debug)
-    dispatch(4)
+    dispatch(5)
 
 
 _llint_native_call_trampoline:
diff --git a/Source/JavaScriptCore/parser/ASTBuilder.h b/Source/JavaScriptCore/parser/ASTBuilder.h
index d4c170617..0a71f1294 100644
--- a/Source/JavaScriptCore/parser/ASTBuilder.h
+++ b/Source/JavaScriptCore/parser/ASTBuilder.h
@@ -112,8 +112,8 @@ public:
     static const int  DontBuildKeywords = 0;
     static const int  DontBuildStrings = 0;
 
-    ExpressionNode* makeBinaryNode(int lineNumber, int token, std::pair<ExpressionNode*, BinaryOpInfo>, std::pair<ExpressionNode*, BinaryOpInfo>);
-    ExpressionNode* makeFunctionCallNode(int lineNumber, ExpressionNode* func, ArgumentsNode* args, int start, int divot, int end);
+    ExpressionNode* makeBinaryNode(const JSTokenLocation&, int token, std::pair<ExpressionNode*, BinaryOpInfo>, std::pair<ExpressionNode*, BinaryOpInfo>);
+    ExpressionNode* makeFunctionCallNode(const JSTokenLocation&, ExpressionNode* func, ArgumentsNode* args, int start, int divot, int end);
 
     JSC::SourceElements* createSourceElements() { return new (m_globalData) JSC::SourceElements(); }
 
@@ -124,168 +124,168 @@ public:
 
     void appendToComma(CommaNode* commaNode, ExpressionNode* expr) { commaNode->append(expr); }
 
-    CommaNode* createCommaExpr(int lineNumber, ExpressionNode* lhs, ExpressionNode* rhs) { return new (m_globalData) CommaNode(lineNumber, lhs, rhs); }
-
-    ExpressionNode* makeAssignNode(int lineNumber, ExpressionNode* left, Operator, ExpressionNode* right, bool leftHasAssignments, bool rightHasAssignments, int start, int divot, int end);
-    ExpressionNode* makePrefixNode(int lineNumber, ExpressionNode*, Operator, int start, int divot, int end);
-    ExpressionNode* makePostfixNode(int lineNumber, ExpressionNode*, Operator, int start, int divot, int end);
-    ExpressionNode* makeTypeOfNode(int lineNumber, ExpressionNode*);
-    ExpressionNode* makeDeleteNode(int lineNumber, ExpressionNode*, int start, int divot, int end);
-    ExpressionNode* makeNegateNode(int lineNumber, ExpressionNode*);
-    ExpressionNode* makeBitwiseNotNode(int lineNumber, ExpressionNode*);
-    ExpressionNode* makeMultNode(int lineNumber, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-    ExpressionNode* makeDivNode(int lineNumber, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-    ExpressionNode* makeModNode(int lineNumber, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-    ExpressionNode* makeAddNode(int lineNumber, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-    ExpressionNode* makeSubNode(int lineNumber, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-    ExpressionNode* makeBitXOrNode(int lineNumber, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-    ExpressionNode* makeBitAndNode(int lineNumber, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-    ExpressionNode* makeBitOrNode(int lineNumber, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-    ExpressionNode* makeLeftShiftNode(int lineNumber, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-    ExpressionNode* makeRightShiftNode(int lineNumber, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-    ExpressionNode* makeURightShiftNode(int lineNumber, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-
-    ExpressionNode* createLogicalNot(int lineNumber, ExpressionNode* expr) { return new (m_globalData) LogicalNotNode(lineNumber, expr); }
-    ExpressionNode* createUnaryPlus(int lineNumber, ExpressionNode* expr) { return new (m_globalData) UnaryPlusNode(lineNumber, expr); }
-    ExpressionNode* createVoid(int lineNumber, ExpressionNode* expr)
+    CommaNode* createCommaExpr(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* rhs) { return new (m_globalData) CommaNode(location, lhs, rhs); }
+
+    ExpressionNode* makeAssignNode(const JSTokenLocation&, ExpressionNode* left, Operator, ExpressionNode* right, bool leftHasAssignments, bool rightHasAssignments, int start, int divot, int end);
+    ExpressionNode* makePrefixNode(const JSTokenLocation&, ExpressionNode*, Operator, int start, int divot, int end);
+    ExpressionNode* makePostfixNode(const JSTokenLocation&, ExpressionNode*, Operator, int start, int divot, int end);
+    ExpressionNode* makeTypeOfNode(const JSTokenLocation&, ExpressionNode*);
+    ExpressionNode* makeDeleteNode(const JSTokenLocation&, ExpressionNode*, int start, int divot, int end);
+    ExpressionNode* makeNegateNode(const JSTokenLocation&, ExpressionNode*);
+    ExpressionNode* makeBitwiseNotNode(const JSTokenLocation&, ExpressionNode*);
+    ExpressionNode* makeMultNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeDivNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeModNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeAddNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeSubNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeBitXOrNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeBitAndNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeBitOrNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeLeftShiftNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeRightShiftNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeURightShiftNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+
+    ExpressionNode* createLogicalNot(const JSTokenLocation& location, ExpressionNode* expr) { return new (m_globalData) LogicalNotNode(location, expr); }
+    ExpressionNode* createUnaryPlus(const JSTokenLocation& location, ExpressionNode* expr) { return new (m_globalData) UnaryPlusNode(location, expr); }
+    ExpressionNode* createVoid(const JSTokenLocation& location, ExpressionNode* expr)
     {
         incConstants();
-        return new (m_globalData) VoidNode(lineNumber, expr);
+        return new (m_globalData) VoidNode(location, expr);
     }
-    ExpressionNode* thisExpr(int lineNumber)
+    ExpressionNode* thisExpr(const JSTokenLocation& location)
     {
         usesThis();
-        return new (m_globalData) ThisNode(lineNumber);
+        return new (m_globalData) ThisNode(location);
     }
-    ExpressionNode* createResolve(int lineNumber, const Identifier* ident, int start)
+    ExpressionNode* createResolve(const JSTokenLocation& location, const Identifier* ident, int start)
     {
         if (m_globalData->propertyNames->arguments == *ident)
             usesArguments();
-        return new (m_globalData) ResolveNode(lineNumber, *ident, start);
+        return new (m_globalData) ResolveNode(location, *ident, start);
     }
-    ExpressionNode* createObjectLiteral(int lineNumber) { return new (m_globalData) ObjectLiteralNode(lineNumber); }
-    ExpressionNode* createObjectLiteral(int lineNumber, PropertyListNode* properties) { return new (m_globalData) ObjectLiteralNode(lineNumber, properties); }
+    ExpressionNode* createObjectLiteral(const JSTokenLocation& location) { return new (m_globalData) ObjectLiteralNode(location); }
+    ExpressionNode* createObjectLiteral(const JSTokenLocation& location, PropertyListNode* properties) { return new (m_globalData) ObjectLiteralNode(location, properties); }
 
-    ExpressionNode* createArray(int lineNumber, int elisions)
+    ExpressionNode* createArray(const JSTokenLocation& location, int elisions)
     {
         if (elisions)
             incConstants();
-        return new (m_globalData) ArrayNode(lineNumber, elisions);
+        return new (m_globalData) ArrayNode(location, elisions);
     }
 
-    ExpressionNode* createArray(int lineNumber, ElementNode* elems) { return new (m_globalData) ArrayNode(lineNumber, elems); }
-    ExpressionNode* createArray(int lineNumber, int elisions, ElementNode* elems)
+    ExpressionNode* createArray(const JSTokenLocation& location, ElementNode* elems) { return new (m_globalData) ArrayNode(location, elems); }
+    ExpressionNode* createArray(const JSTokenLocation& location, int elisions, ElementNode* elems)
     {
         if (elisions)
             incConstants();
-        return new (m_globalData) ArrayNode(lineNumber, elisions, elems);
+        return new (m_globalData) ArrayNode(location, elisions, elems);
     }
-    ExpressionNode* createNumberExpr(int lineNumber, double d)
+    ExpressionNode* createNumberExpr(const JSTokenLocation& location, double d)
     {
         incConstants();
-        return new (m_globalData) NumberNode(lineNumber, d);
+        return new (m_globalData) NumberNode(location, d);
     }
 
-    ExpressionNode* createString(int lineNumber, const Identifier* string)
+    ExpressionNode* createString(const JSTokenLocation& location, const Identifier* string)
     {
         incConstants();
-        return new (m_globalData) StringNode(lineNumber, *string);
+        return new (m_globalData) StringNode(location, *string);
     }
 
-    ExpressionNode* createBoolean(int lineNumber, bool b)
+    ExpressionNode* createBoolean(const JSTokenLocation& location, bool b)
     {
         incConstants();
-        return new (m_globalData) BooleanNode(lineNumber, b);
+        return new (m_globalData) BooleanNode(location, b);
     }
 
-    ExpressionNode* createNull(int lineNumber)
+    ExpressionNode* createNull(const JSTokenLocation& location)
     {
         incConstants();
-        return new (m_globalData) NullNode(lineNumber);
+        return new (m_globalData) NullNode(location);
     }
 
-    ExpressionNode* createBracketAccess(int lineNumber, ExpressionNode* base, ExpressionNode* property, bool propertyHasAssignments, int start, int divot, int end)
+    ExpressionNode* createBracketAccess(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* property, bool propertyHasAssignments, int start, int divot, int end)
     {
-        BracketAccessorNode* node = new (m_globalData) BracketAccessorNode(lineNumber, base, property, propertyHasAssignments);
+        BracketAccessorNode* node = new (m_globalData) BracketAccessorNode(location, base, property, propertyHasAssignments);
         setExceptionLocation(node, start, divot, end);
         return node;
     }
 
-    ExpressionNode* createDotAccess(int lineNumber, ExpressionNode* base, const Identifier* property, int start, int divot, int end)
+    ExpressionNode* createDotAccess(const JSTokenLocation& location, ExpressionNode* base, const Identifier* property, int start, int divot, int end)
     {
-        DotAccessorNode* node = new (m_globalData) DotAccessorNode(lineNumber, base, *property);
+        DotAccessorNode* node = new (m_globalData) DotAccessorNode(location, base, *property);
         setExceptionLocation(node, start, divot, end);
         return node;
     }
 
-    ExpressionNode* createRegExp(int lineNumber, const Identifier& pattern, const Identifier& flags, int start)
+    ExpressionNode* createRegExp(const JSTokenLocation& location, const Identifier& pattern, const Identifier& flags, int start)
     {
         if (Yarr::checkSyntax(pattern.ustring()))
             return 0;
-        RegExpNode* node = new (m_globalData) RegExpNode(lineNumber, pattern, flags);
+        RegExpNode* node = new (m_globalData) RegExpNode(location, pattern, flags);
         int size = pattern.length() + 2; // + 2 for the two /'s
         setExceptionLocation(node, start, start + size, start + size);
         return node;
     }
 
-    ExpressionNode* createNewExpr(int lineNumber, ExpressionNode* expr, ArgumentsNode* arguments, int start, int divot, int end)
+    ExpressionNode* createNewExpr(const JSTokenLocation& location, ExpressionNode* expr, ArgumentsNode* arguments, int start, int divot, int end)
     {
-        NewExprNode* node = new (m_globalData) NewExprNode(lineNumber, expr, arguments);
+        NewExprNode* node = new (m_globalData) NewExprNode(location, expr, arguments);
         setExceptionLocation(node, start, divot, end);
         return node;
     }
 
-    ExpressionNode* createNewExpr(int lineNumber, ExpressionNode* expr, int start, int end)
+    ExpressionNode* createNewExpr(const JSTokenLocation& location, ExpressionNode* expr, int start, int end)
     {
-        NewExprNode* node = new (m_globalData) NewExprNode(lineNumber, expr);
+        NewExprNode* node = new (m_globalData) NewExprNode(location, expr);
         setExceptionLocation(node, start, end, end);
         return node;
     }
 
-    ExpressionNode* createConditionalExpr(int lineNumber, ExpressionNode* condition, ExpressionNode* lhs, ExpressionNode* rhs)
+    ExpressionNode* createConditionalExpr(const JSTokenLocation& location, ExpressionNode* condition, ExpressionNode* lhs, ExpressionNode* rhs)
     {
-        return new (m_globalData) ConditionalNode(lineNumber, condition, lhs, rhs);
+        return new (m_globalData) ConditionalNode(location, condition, lhs, rhs);
     }
 
-    ExpressionNode* createAssignResolve(int lineNumber, const Identifier& ident, ExpressionNode* rhs, int start, int divot, int end)
+    ExpressionNode* createAssignResolve(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* rhs, int start, int divot, int end)
     {
         if (rhs->isFuncExprNode())
             static_cast<FuncExprNode*>(rhs)->body()->setInferredName(ident);
-        AssignResolveNode* node = new (m_globalData) AssignResolveNode(lineNumber, ident, rhs);
+        AssignResolveNode* node = new (m_globalData) AssignResolveNode(location, ident, rhs);
         setExceptionLocation(node, start, divot, end);
         return node;
     }
 
-    ExpressionNode* createFunctionExpr(int lineNumber, const Identifier* name, FunctionBodyNode* body, ParameterNode* parameters, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
+    ExpressionNode* createFunctionExpr(const JSTokenLocation& location, const Identifier* name, FunctionBodyNode* body, ParameterNode* parameters, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
     {
-        FuncExprNode* result = new (m_globalData) FuncExprNode(lineNumber, *name, body, m_sourceCode->subExpression(openBracePos, closeBracePos, bodyStartLine), parameters);
-        body->setLoc(bodyStartLine, bodyEndLine);
+        FuncExprNode* result = new (m_globalData) FuncExprNode(location, *name, body, m_sourceCode->subExpression(openBracePos, closeBracePos, bodyStartLine), parameters);
+        body->setLoc(bodyStartLine, bodyEndLine, location.column);
         return result;
     }
 
-    FunctionBodyNode* createFunctionBody(int lineNumber, bool inStrictContext)
+    FunctionBodyNode* createFunctionBody(const JSTokenLocation& location, bool inStrictContext)
     {
-        return FunctionBodyNode::create(m_globalData, lineNumber, inStrictContext);
+        return FunctionBodyNode::create(m_globalData, location, inStrictContext);
     }
     
-    template <bool> PropertyNode* createGetterOrSetterProperty(int lineNumber, PropertyNode::Type type, const Identifier* name, ParameterNode* params, FunctionBodyNode* body, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
+    template <bool> PropertyNode* createGetterOrSetterProperty(const JSTokenLocation& location, PropertyNode::Type type, const Identifier* name, ParameterNode* params, FunctionBodyNode* body, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
     {
         ASSERT(name);
-        body->setLoc(bodyStartLine, bodyEndLine);
+        body->setLoc(bodyStartLine, bodyEndLine, location.column);
         body->setInferredName(*name);
-        return new (m_globalData) PropertyNode(m_globalData, *name, new (m_globalData) FuncExprNode(lineNumber, m_globalData->propertyNames->nullIdentifier, body, m_sourceCode->subExpression(openBracePos, closeBracePos, bodyStartLine), params), type);
+        return new (m_globalData) PropertyNode(m_globalData, *name, new (m_globalData) FuncExprNode(location, m_globalData->propertyNames->nullIdentifier, body, m_sourceCode->subExpression(openBracePos, closeBracePos, bodyStartLine), params), type);
     }
     
-    template <bool> PropertyNode* createGetterOrSetterProperty(JSGlobalData*, int lineNumber, PropertyNode::Type type, double name, ParameterNode* params, FunctionBodyNode* body, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
+    template <bool> PropertyNode* createGetterOrSetterProperty(JSGlobalData*, const JSTokenLocation& location, PropertyNode::Type type, double name, ParameterNode* params, FunctionBodyNode* body, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
     {
-        body->setLoc(bodyStartLine, bodyEndLine);
-        return new (m_globalData) PropertyNode(m_globalData, name, new (m_globalData) FuncExprNode(lineNumber, m_globalData->propertyNames->nullIdentifier, body, m_sourceCode->subExpression(openBracePos, closeBracePos, bodyStartLine), params), type);
+        body->setLoc(bodyStartLine, bodyEndLine, location.column);
+        return new (m_globalData) PropertyNode(m_globalData, name, new (m_globalData) FuncExprNode(location, m_globalData->propertyNames->nullIdentifier, body, m_sourceCode->subExpression(openBracePos, closeBracePos, bodyStartLine), params), type);
     }
 
     ArgumentsNode* createArguments() { return new (m_globalData) ArgumentsNode(); }
     ArgumentsNode* createArguments(ArgumentListNode* args) { return new (m_globalData) ArgumentsNode(args); }
-    ArgumentListNode* createArgumentsList(int lineNumber, ExpressionNode* arg) { return new (m_globalData) ArgumentListNode(lineNumber, arg); }
-    ArgumentListNode* createArgumentsList(int lineNumber, ArgumentListNode* args, ExpressionNode* arg) { return new (m_globalData) ArgumentListNode(lineNumber, args, arg); }
+    ArgumentListNode* createArgumentsList(const JSTokenLocation& location, ExpressionNode* arg) { return new (m_globalData) ArgumentListNode(location, arg); }
+    ArgumentListNode* createArgumentsList(const JSTokenLocation& location, ArgumentListNode* args, ExpressionNode* arg) { return new (m_globalData) ArgumentListNode(location, args, arg); }
 
     template <bool> PropertyNode* createProperty(const Identifier* propertyName, ExpressionNode* node, PropertyNode::Type type)
     {
@@ -294,8 +294,8 @@ public:
         return new (m_globalData) PropertyNode(m_globalData, *propertyName, node, type);
     }
     template <bool> PropertyNode* createProperty(JSGlobalData*, double propertyName, ExpressionNode* node, PropertyNode::Type type) { return new (m_globalData) PropertyNode(m_globalData, propertyName, node, type); }
-    PropertyListNode* createPropertyList(int lineNumber, PropertyNode* property) { return new (m_globalData) PropertyListNode(lineNumber, property); }
-    PropertyListNode* createPropertyList(int lineNumber, PropertyNode* property, PropertyListNode* tail) { return new (m_globalData) PropertyListNode(lineNumber, property, tail); }
+    PropertyListNode* createPropertyList(const JSTokenLocation& location, PropertyNode* property) { return new (m_globalData) PropertyListNode(location, property); }
+    PropertyListNode* createPropertyList(const JSTokenLocation& location, PropertyNode* property, PropertyListNode* tail) { return new (m_globalData) PropertyListNode(location, property, tail); }
 
     ElementNode* createElementList(int elisions, ExpressionNode* expr) { return new (m_globalData) ElementNode(elisions, expr); }
     ElementNode* createElementList(ElementNode* elems, int elisions, ExpressionNode* expr) { return new (m_globalData) ElementNode(elems, elisions, expr); }
@@ -309,191 +309,191 @@ public:
 
     void setUsesArguments(FunctionBodyNode* node) { node->setUsesArguments(); }
 
-    StatementNode* createFuncDeclStatement(int lineNumber, const Identifier* name, FunctionBodyNode* body, ParameterNode* parameters, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
+    StatementNode* createFuncDeclStatement(const JSTokenLocation& location, const Identifier* name, FunctionBodyNode* body, ParameterNode* parameters, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
     {
-        FuncDeclNode* decl = new (m_globalData) FuncDeclNode(lineNumber, *name, body, m_sourceCode->subExpression(openBracePos, closeBracePos, bodyStartLine), parameters);
+        FuncDeclNode* decl = new (m_globalData) FuncDeclNode(location, *name, body, m_sourceCode->subExpression(openBracePos, closeBracePos, bodyStartLine), parameters);
         if (*name == m_globalData->propertyNames->arguments)
             usesArguments();
         m_scope.m_funcDeclarations->data.append(decl->body());
-        body->setLoc(bodyStartLine, bodyEndLine);
+        body->setLoc(bodyStartLine, bodyEndLine, location.column);
         return decl;
     }
 
-    StatementNode* createBlockStatement(int lineNumber, JSC::SourceElements* elements, int startLine, int endLine)
+    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine)
     {
-        BlockNode* block = new (m_globalData) BlockNode(lineNumber, elements);
-        block->setLoc(startLine, endLine);
+        BlockNode* block = new (m_globalData) BlockNode(location, elements);
+        block->setLoc(startLine, endLine, location.column);
         return block;
     }
 
-    StatementNode* createExprStatement(int lineNumber, ExpressionNode* expr, int start, int end)
+    StatementNode* createExprStatement(const JSTokenLocation& location, ExpressionNode* expr, int start, int end)
     {
-        ExprStatementNode* result = new (m_globalData) ExprStatementNode(lineNumber, expr);
-        result->setLoc(start, end);
+        ExprStatementNode* result = new (m_globalData) ExprStatementNode(location, expr);
+        result->setLoc(start, end, location.column);
         return result;
     }
 
-    StatementNode* createIfStatement(int lineNumber, ExpressionNode* condition, StatementNode* trueBlock, int start, int end)
+    StatementNode* createIfStatement(const JSTokenLocation& location, ExpressionNode* condition, StatementNode* trueBlock, int start, int end)
     {
-        IfNode* result = new (m_globalData) IfNode(lineNumber, condition, trueBlock);
-        result->setLoc(start, end);
+        IfNode* result = new (m_globalData) IfNode(location, condition, trueBlock);
+        result->setLoc(start, end, location.column);
         return result;
     }
 
-    StatementNode* createIfStatement(int lineNumber, ExpressionNode* condition, StatementNode* trueBlock, StatementNode* falseBlock, int start, int end)
+    StatementNode* createIfStatement(const JSTokenLocation& location, ExpressionNode* condition, StatementNode* trueBlock, StatementNode* falseBlock, int start, int end)
     {
-        IfNode* result = new (m_globalData) IfElseNode(lineNumber, condition, trueBlock, falseBlock);
-        result->setLoc(start, end);
+        IfNode* result = new (m_globalData) IfElseNode(location, condition, trueBlock, falseBlock);
+        result->setLoc(start, end, location.column);
         return result;
     }
 
-    StatementNode* createForLoop(int lineNumber, ExpressionNode* initializer, ExpressionNode* condition, ExpressionNode* iter, StatementNode* statements, int start, int end)
+    StatementNode* createForLoop(const JSTokenLocation& location, ExpressionNode* initializer, ExpressionNode* condition, ExpressionNode* iter, StatementNode* statements, int start, int end)
     {
-        ForNode* result = new (m_globalData) ForNode(lineNumber, initializer, condition, iter, statements);
+        ForNode* result = new (m_globalData) ForNode(location, initializer, condition, iter, statements);
         result->setLoc(start, end);
         return result;
     }
 
-    StatementNode* createForInLoop(int lineNumber, const Identifier* ident, ExpressionNode* initializer, ExpressionNode* iter, StatementNode* statements, int start, int divot, int end, int initStart, int initEnd, int startLine, int endLine)
+    StatementNode* createForInLoop(const JSTokenLocation& location, const Identifier* ident, ExpressionNode* initializer, ExpressionNode* iter, StatementNode* statements, int start, int divot, int end, int initStart, int initEnd, int startLine, int endLine)
     {
-        ForInNode* result = new (m_globalData) ForInNode(m_globalData, lineNumber, *ident, initializer, iter, statements, initStart, initStart - start, initEnd - initStart);
-        result->setLoc(startLine, endLine);
+        ForInNode* result = new (m_globalData) ForInNode(m_globalData, location, *ident, initializer, iter, statements, initStart, initStart - start, initEnd - initStart);
+        result->setLoc(startLine, endLine, location.column);
         setExceptionLocation(result, start, divot + 1, end);
         return result;
     }
 
-    StatementNode* createForInLoop(int lineNumber, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, int eStart, int eDivot, int eEnd, int start, int end)
+    StatementNode* createForInLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, int eStart, int eDivot, int eEnd, int start, int end)
     {
-        ForInNode* result = new (m_globalData) ForInNode(lineNumber, lhs, iter, statements);
-        result->setLoc(start, end);
+        ForInNode* result = new (m_globalData) ForInNode(location, lhs, iter, statements);
+        result->setLoc(start, end, location.column);
         setExceptionLocation(result, eStart, eDivot, eEnd);
         return result;
     }
 
-    StatementNode* createEmptyStatement(int lineNumber) { return new (m_globalData) EmptyStatementNode(lineNumber); }
+    StatementNode* createEmptyStatement(const JSTokenLocation& location) { return new (m_globalData) EmptyStatementNode(location); }
 
-    StatementNode* createVarStatement(int lineNumber, ExpressionNode* expr, int start, int end)
+    StatementNode* createVarStatement(const JSTokenLocation& location, ExpressionNode* expr, int start, int end)
     {
         StatementNode* result;
         if (!expr)
-            result = new (m_globalData) EmptyStatementNode(lineNumber);
+            result = new (m_globalData) EmptyStatementNode(location);
         else
-            result = new (m_globalData) VarStatementNode(lineNumber, expr);
-        result->setLoc(start, end);
+            result = new (m_globalData) VarStatementNode(location, expr);
+        result->setLoc(start, end, location.column);
         return result;
     }
 
-    StatementNode* createReturnStatement(int lineNumber, ExpressionNode* expression, int eStart, int eEnd, int startLine, int endLine)
+    StatementNode* createReturnStatement(const JSTokenLocation& location, ExpressionNode* expression, int eStart, int eEnd, int startLine, int endLine)
     {
-        ReturnNode* result = new (m_globalData) ReturnNode(lineNumber, expression);
+        ReturnNode* result = new (m_globalData) ReturnNode(location, expression);
         setExceptionLocation(result, eStart, eEnd, eEnd);
-        result->setLoc(startLine, endLine);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }
 
-    StatementNode* createBreakStatement(int lineNumber, int eStart, int eEnd, int startLine, int endLine)
+    StatementNode* createBreakStatement(const JSTokenLocation& location, int eStart, int eEnd, int startLine, int endLine)
     {
-        BreakNode* result = new (m_globalData) BreakNode(m_globalData, lineNumber);
+        BreakNode* result = new (m_globalData) BreakNode(m_globalData, location);
         setExceptionLocation(result, eStart, eEnd, eEnd);
-        result->setLoc(startLine, endLine);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }
 
-    StatementNode* createBreakStatement(int lineNumber, const Identifier* ident, int eStart, int eEnd, int startLine, int endLine)
+    StatementNode* createBreakStatement(const JSTokenLocation& location, const Identifier* ident, int eStart, int eEnd, int startLine, int endLine)
     {
-        BreakNode* result = new (m_globalData) BreakNode(lineNumber, *ident);
+        BreakNode* result = new (m_globalData) BreakNode(location, *ident);
         setExceptionLocation(result, eStart, eEnd, eEnd);
-        result->setLoc(startLine, endLine);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }
 
-    StatementNode* createContinueStatement(int lineNumber, int eStart, int eEnd, int startLine, int endLine)
+    StatementNode* createContinueStatement(const JSTokenLocation& location, int eStart, int eEnd, int startLine, int endLine)
     {
-        ContinueNode* result = new (m_globalData) ContinueNode(m_globalData, lineNumber);
+        ContinueNode* result = new (m_globalData) ContinueNode(m_globalData, location);
         setExceptionLocation(result, eStart, eEnd, eEnd);
-        result->setLoc(startLine, endLine);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }
 
-    StatementNode* createContinueStatement(int lineNumber, const Identifier* ident, int eStart, int eEnd, int startLine, int endLine)
+    StatementNode* createContinueStatement(const JSTokenLocation& location, const Identifier* ident, int eStart, int eEnd, int startLine, int endLine)
     {
-        ContinueNode* result = new (m_globalData) ContinueNode(lineNumber, *ident);
+        ContinueNode* result = new (m_globalData) ContinueNode(location, *ident);
         setExceptionLocation(result, eStart, eEnd, eEnd);
-        result->setLoc(startLine, endLine);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }
 
-    StatementNode* createTryStatement(int lineNumber, StatementNode* tryBlock, const Identifier* ident, StatementNode* catchBlock, StatementNode* finallyBlock, int startLine, int endLine)
+    StatementNode* createTryStatement(const JSTokenLocation& location, StatementNode* tryBlock, const Identifier* ident, StatementNode* catchBlock, StatementNode* finallyBlock, int startLine, int endLine)
     {
-        TryNode* result = new (m_globalData) TryNode(lineNumber, tryBlock, *ident, catchBlock, finallyBlock);
+        TryNode* result = new (m_globalData) TryNode(location, tryBlock, *ident, catchBlock, finallyBlock);
         if (catchBlock)
             usesCatch();
-        result->setLoc(startLine, endLine);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }
 
-    StatementNode* createSwitchStatement(int lineNumber, ExpressionNode* expr, ClauseListNode* firstClauses, CaseClauseNode* defaultClause, ClauseListNode* secondClauses, int startLine, int endLine)
+    StatementNode* createSwitchStatement(const JSTokenLocation& location, ExpressionNode* expr, ClauseListNode* firstClauses, CaseClauseNode* defaultClause, ClauseListNode* secondClauses, int startLine, int endLine)
     {
         CaseBlockNode* cases = new (m_globalData) CaseBlockNode(firstClauses, defaultClause, secondClauses);
-        SwitchNode* result = new (m_globalData) SwitchNode(lineNumber, expr, cases);
-        result->setLoc(startLine, endLine);
+        SwitchNode* result = new (m_globalData) SwitchNode(location, expr, cases);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }
 
-    StatementNode* createWhileStatement(int lineNumber, ExpressionNode* expr, StatementNode* statement, int startLine, int endLine)
+    StatementNode* createWhileStatement(const JSTokenLocation& location, ExpressionNode* expr, StatementNode* statement, int startLine, int endLine)
     {
-        WhileNode* result = new (m_globalData) WhileNode(lineNumber, expr, statement);
-        result->setLoc(startLine, endLine);
+        WhileNode* result = new (m_globalData) WhileNode(location, expr, statement);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }
 
-    StatementNode* createDoWhileStatement(int lineNumber, StatementNode* statement, ExpressionNode* expr, int startLine, int endLine)
+    StatementNode* createDoWhileStatement(const JSTokenLocation& location, StatementNode* statement, ExpressionNode* expr, int startLine, int endLine)
     {
-        DoWhileNode* result = new (m_globalData) DoWhileNode(lineNumber, statement, expr);
-        result->setLoc(startLine, endLine);
+        DoWhileNode* result = new (m_globalData) DoWhileNode(location, statement, expr);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }
 
-    StatementNode* createLabelStatement(int lineNumber, const Identifier* ident, StatementNode* statement, int start, int end)
+    StatementNode* createLabelStatement(const JSTokenLocation& location, const Identifier* ident, StatementNode* statement, int start, int end)
     {
-        LabelNode* result = new (m_globalData) LabelNode(lineNumber, *ident, statement);
+        LabelNode* result = new (m_globalData) LabelNode(location, *ident, statement);
         setExceptionLocation(result, start, end, end);
         return result;
     }
 
-    StatementNode* createWithStatement(int lineNumber, ExpressionNode* expr, StatementNode* statement, int start, int end, int startLine, int endLine)
+    StatementNode* createWithStatement(const JSTokenLocation& location, ExpressionNode* expr, StatementNode* statement, int start, int end, int startLine, int endLine)
     {
         usesWith();
-        WithNode* result = new (m_globalData) WithNode(lineNumber, expr, statement, end, end - start);
-        result->setLoc(startLine, endLine);
+        WithNode* result = new (m_globalData) WithNode(location, expr, statement, end, end - start);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }    
     
-    StatementNode* createThrowStatement(int lineNumber, ExpressionNode* expr, int start, int end, int startLine, int endLine)
+    StatementNode* createThrowStatement(const JSTokenLocation& location, ExpressionNode* expr, int start, int end, int startLine, int endLine)
     {
-        ThrowNode* result = new (m_globalData) ThrowNode(lineNumber, expr);
-        result->setLoc(startLine, endLine);
+        ThrowNode* result = new (m_globalData) ThrowNode(location, expr);
+        result->setLoc(startLine, endLine, location.column);
         setExceptionLocation(result, start, end, end);
         return result;
     }
     
-    StatementNode* createDebugger(int lineNumber, int startLine, int endLine)
+    StatementNode* createDebugger(const JSTokenLocation& location, int startLine, int endLine)
     {
-        DebuggerStatementNode* result = new (m_globalData) DebuggerStatementNode(lineNumber);
-        result->setLoc(startLine, endLine);
+        DebuggerStatementNode* result = new (m_globalData) DebuggerStatementNode(location);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }
     
-    StatementNode* createConstStatement(int lineNumber, ConstDeclNode* decls, int startLine, int endLine)
+    StatementNode* createConstStatement(const JSTokenLocation& location, ConstDeclNode* decls, int startLine, int endLine)
     {
-        ConstStatementNode* result = new (m_globalData) ConstStatementNode(lineNumber, decls);
-        result->setLoc(startLine, endLine);
+        ConstStatementNode* result = new (m_globalData) ConstStatementNode(location, decls);
+        result->setLoc(startLine, endLine, location.column);
         return result;
     }
 
-    ConstDeclNode* appendConstDecl(int lineNumber, ConstDeclNode* tail, const Identifier* name, ExpressionNode* initializer)
+    ConstDeclNode* appendConstDecl(const JSTokenLocation& location, ConstDeclNode* tail, const Identifier* name, ExpressionNode* initializer)
     {
-        ConstDeclNode* result = new (m_globalData) ConstDeclNode(lineNumber, *name, initializer);
+        ConstDeclNode* result = new (m_globalData) ConstDeclNode(location, *name, initializer);
         if (tail)
             tail->m_next = result;
         return result;
@@ -511,7 +511,7 @@ public:
         m_scope.m_varDeclarations->data.append(std::make_pair(ident, attrs));
     }
 
-    ExpressionNode* combineCommaNodes(int lineNumber, ExpressionNode* list, ExpressionNode* init)
+    ExpressionNode* combineCommaNodes(const JSTokenLocation& location, ExpressionNode* list, ExpressionNode* init)
     {
         if (!list)
             return init;
@@ -519,7 +519,7 @@ public:
             static_cast<CommaNode*>(list)->append(init);
             return list;
         }
-        return new (m_globalData) CommaNode(lineNumber, list, init);
+        return new (m_globalData) CommaNode(location, list, init);
     }
 
     int evalCount() const { return m_evalCount; }
@@ -547,10 +547,10 @@ public:
         ASSERT(operandStackDepth >= 0);
         m_binaryOperandStack.resize(m_binaryOperandStack.size() - amount);
     }
-    void appendBinaryOperation(int lineNumber, int& operandStackDepth, int&, const BinaryOperand& lhs, const BinaryOperand& rhs)
+    void appendBinaryOperation(const JSTokenLocation& location, int& operandStackDepth, int&, const BinaryOperand& lhs, const BinaryOperand& rhs)
     {
         operandStackDepth++;
-        m_binaryOperandStack.append(std::make_pair(makeBinaryNode(lineNumber, m_binaryOperatorStack.last().first, lhs, rhs), BinaryOpInfo(lhs.second, rhs.second)));
+        m_binaryOperandStack.append(std::make_pair(makeBinaryNode(location, m_binaryOperatorStack.last().first, lhs, rhs), BinaryOpInfo(lhs.second, rhs.second)));
     }
     void operatorStackAppend(int& operatorStackDepth, int op, int precedence)
     {
@@ -592,9 +592,9 @@ public:
         m_assignmentInfoStack.append(AssignmentInfo(node, start, divot, assignmentCount, op));
     }
 
-    ExpressionNode* createAssignment(int lineNumber, int& assignmentStackDepth, ExpressionNode* rhs, int initialAssignmentCount, int currentAssignmentCount, int lastTokenEnd)
+    ExpressionNode* createAssignment(const JSTokenLocation& location, int& assignmentStackDepth, ExpressionNode* rhs, int initialAssignmentCount, int currentAssignmentCount, int lastTokenEnd)
     {
-        ExpressionNode* result = makeAssignNode(lineNumber, m_assignmentInfoStack.last().m_node, m_assignmentInfoStack.last().m_op, rhs, m_assignmentInfoStack.last().m_initAssignments != initialAssignmentCount, m_assignmentInfoStack.last().m_initAssignments != currentAssignmentCount, m_assignmentInfoStack.last().m_start, m_assignmentInfoStack.last().m_divot + 1, lastTokenEnd);
+        ExpressionNode* result = makeAssignNode(location, m_assignmentInfoStack.last().m_node, m_assignmentInfoStack.last().m_op, rhs, m_assignmentInfoStack.last().m_initAssignments != initialAssignmentCount, m_assignmentInfoStack.last().m_initAssignments != currentAssignmentCount, m_assignmentInfoStack.last().m_start, m_assignmentInfoStack.last().m_divot + 1, lastTokenEnd);
         m_assignmentInfoStack.removeLast();
         assignmentStackDepth--;
         return result;
@@ -635,9 +635,9 @@ private:
         m_evalCount++;
         m_scope.m_features |= EvalFeature;
     }
-    ExpressionNode* createNumber(int lineNumber, double d)
+    ExpressionNode* createNumber(const JSTokenLocation& location, double d)
     {
-        return new (m_globalData) NumberNode(lineNumber, d);
+        return new (m_globalData) NumberNode(location, d);
     }
     
     JSGlobalData* m_globalData;
@@ -650,33 +650,33 @@ private:
     int m_evalCount;
 };
 
-ExpressionNode* ASTBuilder::makeTypeOfNode(int lineNumber, ExpressionNode* expr)
+ExpressionNode* ASTBuilder::makeTypeOfNode(const JSTokenLocation& location, ExpressionNode* expr)
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (m_globalData) TypeOfResolveNode(lineNumber, resolve->identifier());
+        return new (m_globalData) TypeOfResolveNode(location, resolve->identifier());
     }
-    return new (m_globalData) TypeOfValueNode(lineNumber, expr);
+    return new (m_globalData) TypeOfValueNode(location, expr);
 }
 
-ExpressionNode* ASTBuilder::makeDeleteNode(int lineNumber, ExpressionNode* expr, int start, int divot, int end)
+ExpressionNode* ASTBuilder::makeDeleteNode(const JSTokenLocation& location, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (m_globalData) DeleteValueNode(lineNumber, expr);
+        return new (m_globalData) DeleteValueNode(location, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (m_globalData) DeleteResolveNode(lineNumber, resolve->identifier(), divot, divot - start, end - divot);
+        return new (m_globalData) DeleteResolveNode(location, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new (m_globalData) DeleteBracketNode(lineNumber, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (m_globalData) DeleteBracketNode(location, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new (m_globalData) DeleteDotNode(lineNumber, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (m_globalData) DeleteDotNode(location, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
-ExpressionNode* ASTBuilder::makeNegateNode(int lineNumber, ExpressionNode* n)
+ExpressionNode* ASTBuilder::makeNegateNode(const JSTokenLocation& location, ExpressionNode* n)
 {
     if (n->isNumber()) {
         NumberNode* numberNode = static_cast<NumberNode*>(n);
@@ -684,128 +684,128 @@ ExpressionNode* ASTBuilder::makeNegateNode(int lineNumber, ExpressionNode* n)
         return numberNode;
     }
 
-    return new (m_globalData) NegateNode(lineNumber, n);
+    return new (m_globalData) NegateNode(location, n);
 }
 
-ExpressionNode* ASTBuilder::makeBitwiseNotNode(int lineNumber, ExpressionNode* expr)
+ExpressionNode* ASTBuilder::makeBitwiseNotNode(const JSTokenLocation& location, ExpressionNode* expr)
 {
     if (expr->isNumber())
-        return createNumber(lineNumber, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new (m_globalData) BitwiseNotNode(lineNumber, expr);
+        return createNumber(location, ~toInt32(static_cast<NumberNode*>(expr)->value()));
+    return new (m_globalData) BitwiseNotNode(location, expr);
 }
 
-ExpressionNode* ASTBuilder::makeMultNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+ExpressionNode* ASTBuilder::makeMultNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return createNumber(lineNumber, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
+        return createNumber(location, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new (m_globalData) UnaryPlusNode(lineNumber, expr2);
+        return new (m_globalData) UnaryPlusNode(location, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new (m_globalData) UnaryPlusNode(lineNumber, expr1);
+        return new (m_globalData) UnaryPlusNode(location, expr1);
 
-    return new (m_globalData) MultNode(lineNumber, expr1, expr2, rightHasAssignments);
+    return new (m_globalData) MultNode(location, expr1, expr2, rightHasAssignments);
 }
 
-ExpressionNode* ASTBuilder::makeDivNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+ExpressionNode* ASTBuilder::makeDivNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return createNumber(lineNumber, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new (m_globalData) DivNode(lineNumber, expr1, expr2, rightHasAssignments);
+        return createNumber(location, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
+    return new (m_globalData) DivNode(location, expr1, expr2, rightHasAssignments);
 }
 
-ExpressionNode* ASTBuilder::makeModNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+ExpressionNode* ASTBuilder::makeModNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
     
     if (expr1->isNumber() && expr2->isNumber())
-        return createNumber(lineNumber, fmod(static_cast<NumberNode*>(expr1)->value(), static_cast<NumberNode*>(expr2)->value()));
-    return new (m_globalData) ModNode(lineNumber, expr1, expr2, rightHasAssignments);
+        return createNumber(location, fmod(static_cast<NumberNode*>(expr1)->value(), static_cast<NumberNode*>(expr2)->value()));
+    return new (m_globalData) ModNode(location, expr1, expr2, rightHasAssignments);
 }
 
-ExpressionNode* ASTBuilder::makeAddNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+ExpressionNode* ASTBuilder::makeAddNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return createNumber(lineNumber, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new (m_globalData) AddNode(lineNumber, expr1, expr2, rightHasAssignments);
+        return createNumber(location, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
+    return new (m_globalData) AddNode(location, expr1, expr2, rightHasAssignments);
 }
 
-ExpressionNode* ASTBuilder::makeSubNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+ExpressionNode* ASTBuilder::makeSubNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return createNumber(lineNumber, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new (m_globalData) SubNode(lineNumber, expr1, expr2, rightHasAssignments);
+        return createNumber(location, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
+    return new (m_globalData) SubNode(location, expr1, expr2, rightHasAssignments);
 }
 
-ExpressionNode* ASTBuilder::makeLeftShiftNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+ExpressionNode* ASTBuilder::makeLeftShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return createNumber(lineNumber, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (m_globalData) LeftShiftNode(lineNumber, expr1, expr2, rightHasAssignments);
+        return createNumber(location, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+    return new (m_globalData) LeftShiftNode(location, expr1, expr2, rightHasAssignments);
 }
 
-ExpressionNode* ASTBuilder::makeRightShiftNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+ExpressionNode* ASTBuilder::makeRightShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return createNumber(lineNumber, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (m_globalData) RightShiftNode(lineNumber, expr1, expr2, rightHasAssignments);
+        return createNumber(location, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+    return new (m_globalData) RightShiftNode(location, expr1, expr2, rightHasAssignments);
 }
 
-ExpressionNode* ASTBuilder::makeURightShiftNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+ExpressionNode* ASTBuilder::makeURightShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return createNumber(lineNumber, toUInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (m_globalData) UnsignedRightShiftNode(lineNumber, expr1, expr2, rightHasAssignments);
+        return createNumber(location, toUInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+    return new (m_globalData) UnsignedRightShiftNode(location, expr1, expr2, rightHasAssignments);
 }
 
-ExpressionNode* ASTBuilder::makeBitOrNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+ExpressionNode* ASTBuilder::makeBitOrNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return createNumber(lineNumber, toInt32(static_cast<NumberNode*>(expr1)->value()) | toInt32(static_cast<NumberNode*>(expr2)->value()));
-    return new (m_globalData) BitOrNode(lineNumber, expr1, expr2, rightHasAssignments);
+        return createNumber(location, toInt32(static_cast<NumberNode*>(expr1)->value()) | toInt32(static_cast<NumberNode*>(expr2)->value()));
+    return new (m_globalData) BitOrNode(location, expr1, expr2, rightHasAssignments);
 }
 
-ExpressionNode* ASTBuilder::makeBitAndNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+ExpressionNode* ASTBuilder::makeBitAndNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return createNumber(lineNumber, toInt32(static_cast<NumberNode*>(expr1)->value()) & toInt32(static_cast<NumberNode*>(expr2)->value()));
-    return new (m_globalData) BitAndNode(lineNumber, expr1, expr2, rightHasAssignments);
+        return createNumber(location, toInt32(static_cast<NumberNode*>(expr1)->value()) & toInt32(static_cast<NumberNode*>(expr2)->value()));
+    return new (m_globalData) BitAndNode(location, expr1, expr2, rightHasAssignments);
 }
 
-ExpressionNode* ASTBuilder::makeBitXOrNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+ExpressionNode* ASTBuilder::makeBitXOrNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return createNumber(lineNumber, toInt32(static_cast<NumberNode*>(expr1)->value()) ^ toInt32(static_cast<NumberNode*>(expr2)->value()));
-    return new (m_globalData) BitXOrNode(lineNumber, expr1, expr2, rightHasAssignments);
+        return createNumber(location, toInt32(static_cast<NumberNode*>(expr1)->value()) ^ toInt32(static_cast<NumberNode*>(expr2)->value()));
+    return new (m_globalData) BitXOrNode(location, expr1, expr2, rightHasAssignments);
 }
 
-ExpressionNode* ASTBuilder::makeFunctionCallNode(int lineNumber, ExpressionNode* func, ArgumentsNode* args, int start, int divot, int end)
+ExpressionNode* ASTBuilder::makeFunctionCallNode(const JSTokenLocation& location, ExpressionNode* func, ArgumentsNode* args, int start, int divot, int end)
 {
     if (!func->isLocation())
-        return new (m_globalData) FunctionCallValueNode(lineNumber, func, args, divot, divot - start, end - divot);
+        return new (m_globalData) FunctionCallValueNode(location, func, args, divot, divot - start, end - divot);
     if (func->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func);
         const Identifier& identifier = resolve->identifier();
         if (identifier == m_globalData->propertyNames->eval) {
             usesEval();
-            return new (m_globalData) EvalFunctionCallNode(lineNumber, args, divot, divot - start, end - divot);
+            return new (m_globalData) EvalFunctionCallNode(location, args, divot, divot - start, end - divot);
         }
-        return new (m_globalData) FunctionCallResolveNode(lineNumber, identifier, args, divot, divot - start, end - divot);
+        return new (m_globalData) FunctionCallResolveNode(location, identifier, args, divot, divot - start, end - divot);
     }
     if (func->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func);
-        FunctionCallBracketNode* node = new (m_globalData) FunctionCallBracketNode(lineNumber, bracket->base(), bracket->subscript(), args, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (m_globalData) FunctionCallBracketNode(location, bracket->base(), bracket->subscript(), args, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
     }
@@ -813,118 +813,118 @@ ExpressionNode* ASTBuilder::makeFunctionCallNode(int lineNumber, ExpressionNode*
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func);
     FunctionCallDotNode* node;
     if (dot->identifier() == m_globalData->propertyNames->call)
-        node = new (m_globalData) CallFunctionCallDotNode(lineNumber, dot->base(), dot->identifier(), args, divot, divot - start, end - divot);
+        node = new (m_globalData) CallFunctionCallDotNode(location, dot->base(), dot->identifier(), args, divot, divot - start, end - divot);
     else if (dot->identifier() == m_globalData->propertyNames->apply)
-        node = new (m_globalData) ApplyFunctionCallDotNode(lineNumber, dot->base(), dot->identifier(), args, divot, divot - start, end - divot);
+        node = new (m_globalData) ApplyFunctionCallDotNode(location, dot->base(), dot->identifier(), args, divot, divot - start, end - divot);
     else
-        node = new (m_globalData) FunctionCallDotNode(lineNumber, dot->base(), dot->identifier(), args, divot, divot - start, end - divot);
+        node = new (m_globalData) FunctionCallDotNode(location, dot->base(), dot->identifier(), args, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
 
-ExpressionNode* ASTBuilder::makeBinaryNode(int lineNumber, int token, pair<ExpressionNode*, BinaryOpInfo> lhs, pair<ExpressionNode*, BinaryOpInfo> rhs)
+ExpressionNode* ASTBuilder::makeBinaryNode(const JSTokenLocation& location, int token, pair<ExpressionNode*, BinaryOpInfo> lhs, pair<ExpressionNode*, BinaryOpInfo> rhs)
 {
     switch (token) {
     case OR:
-        return new (m_globalData) LogicalOpNode(lineNumber, lhs.first, rhs.first, OpLogicalOr);
+        return new (m_globalData) LogicalOpNode(location, lhs.first, rhs.first, OpLogicalOr);
 
     case AND:
-        return new (m_globalData) LogicalOpNode(lineNumber, lhs.first, rhs.first, OpLogicalAnd);
+        return new (m_globalData) LogicalOpNode(location, lhs.first, rhs.first, OpLogicalAnd);
 
     case BITOR:
-        return makeBitOrNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return makeBitOrNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case BITXOR:
-        return makeBitXOrNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return makeBitXOrNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case BITAND:
-        return makeBitAndNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return makeBitAndNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case EQEQ:
-        return new (m_globalData) EqualNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return new (m_globalData) EqualNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case NE:
-        return new (m_globalData) NotEqualNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return new (m_globalData) NotEqualNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case STREQ:
-        return new (m_globalData) StrictEqualNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return new (m_globalData) StrictEqualNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case STRNEQ:
-        return new (m_globalData) NotStrictEqualNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return new (m_globalData) NotStrictEqualNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case LT:
-        return new (m_globalData) LessNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return new (m_globalData) LessNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case GT:
-        return new (m_globalData) GreaterNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return new (m_globalData) GreaterNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case LE:
-        return new (m_globalData) LessEqNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return new (m_globalData) LessEqNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case GE:
-        return new (m_globalData) GreaterEqNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return new (m_globalData) GreaterEqNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case INSTANCEOF: {
-        InstanceOfNode* node = new (m_globalData) InstanceOfNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        InstanceOfNode* node = new (m_globalData) InstanceOfNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
         setExceptionLocation(node, lhs.second.start, rhs.second.start, rhs.second.end);
         return node;
     }
 
     case INTOKEN: {
-        InNode* node = new (m_globalData) InNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        InNode* node = new (m_globalData) InNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
         setExceptionLocation(node, lhs.second.start, rhs.second.start, rhs.second.end);
         return node;
     }
 
     case LSHIFT:
-        return makeLeftShiftNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return makeLeftShiftNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case RSHIFT:
-        return makeRightShiftNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return makeRightShiftNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case URSHIFT:
-        return makeURightShiftNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return makeURightShiftNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case PLUS:
-        return makeAddNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return makeAddNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case MINUS:
-        return makeSubNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return makeSubNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case TIMES:
-        return makeMultNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return makeMultNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case DIVIDE:
-        return makeDivNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return makeDivNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
 
     case MOD:
-        return makeModNode(lineNumber, lhs.first, rhs.first, rhs.second.hasAssignment);
+        return makeModNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
     }
     CRASH();
     return 0;
 }
 
-ExpressionNode* ASTBuilder::makeAssignNode(int lineNumber, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
+ExpressionNode* ASTBuilder::makeAssignNode(const JSTokenLocation& location, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new (m_globalData) AssignErrorNode(lineNumber, divot, divot - start, end - divot);
+        return new (m_globalData) AssignErrorNode(location, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
             if (expr->isFuncExprNode())
                 static_cast<FuncExprNode*>(expr)->body()->setInferredName(resolve->identifier());
-            AssignResolveNode* node = new (m_globalData) AssignResolveNode(lineNumber, resolve->identifier(), expr);
+            AssignResolveNode* node = new (m_globalData) AssignResolveNode(location, resolve->identifier(), expr);
             setExceptionLocation(node, start, divot, end);
             return node;
         }
-        return new (m_globalData) ReadModifyResolveNode(lineNumber, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+        return new (m_globalData) ReadModifyResolveNode(location, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new (m_globalData) AssignBracketNode(lineNumber, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
-        ReadModifyBracketNode* node = new (m_globalData) ReadModifyBracketNode(lineNumber, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            return new (m_globalData) AssignBracketNode(location, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+        ReadModifyBracketNode* node = new (m_globalData) ReadModifyBracketNode(location, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
     }
@@ -933,55 +933,55 @@ ExpressionNode* ASTBuilder::makeAssignNode(int lineNumber, ExpressionNode* loc,
     if (op == OpEqual) {
         if (expr->isFuncExprNode())
             static_cast<FuncExprNode*>(expr)->body()->setInferredName(dot->identifier());
-        return new (m_globalData) AssignDotNode(lineNumber, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (m_globalData) AssignDotNode(location, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
     }
 
-    ReadModifyDotNode* node = new (m_globalData) ReadModifyDotNode(lineNumber, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (m_globalData) ReadModifyDotNode(location, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
 
-ExpressionNode* ASTBuilder::makePrefixNode(int lineNumber, ExpressionNode* expr, Operator op, int start, int divot, int end)
+ExpressionNode* ASTBuilder::makePrefixNode(const JSTokenLocation& location, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (m_globalData) PrefixErrorNode(lineNumber, op, divot, divot - start, end - divot);
+        return new (m_globalData) PrefixErrorNode(location, op, divot, divot - start, end - divot);
 
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (m_globalData) PrefixResolveNode(lineNumber, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (m_globalData) PrefixResolveNode(location, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new (m_globalData) PrefixBracketNode(lineNumber, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (m_globalData) PrefixBracketNode(location, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new (m_globalData) PrefixDotNode(lineNumber, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (m_globalData) PrefixDotNode(location, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
 
-ExpressionNode* ASTBuilder::makePostfixNode(int lineNumber, ExpressionNode* expr, Operator op, int start, int divot, int end)
+ExpressionNode* ASTBuilder::makePostfixNode(const JSTokenLocation& location, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (m_globalData) PostfixErrorNode(lineNumber, op, divot, divot - start, end - divot);
+        return new (m_globalData) PostfixErrorNode(location, op, divot, divot - start, end - divot);
 
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (m_globalData) PostfixResolveNode(lineNumber, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (m_globalData) PostfixResolveNode(location, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new (m_globalData) PostfixBracketNode(lineNumber, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (m_globalData) PostfixBracketNode(location, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
 
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new (m_globalData) PostfixDotNode(lineNumber, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (m_globalData) PostfixDotNode(location, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
diff --git a/Source/JavaScriptCore/parser/Lexer.cpp b/Source/JavaScriptCore/parser/Lexer.cpp
index 3b020f4f2..2a8a8dc9e 100644
--- a/Source/JavaScriptCore/parser/Lexer.cpp
+++ b/Source/JavaScriptCore/parser/Lexer.cpp
@@ -417,6 +417,7 @@ void Lexer<T>::setCode(const SourceCode& source, ParserArena* arena)
     m_codeEnd = m_codeStart + source.endOffset();
     m_error = false;
     m_atLineStart = true;
+    m_columnNumber = 0;
     m_lexErrorMessage = UString();
     
     m_buffer8.reserveInitialCapacity(initialReadBufferCapacity);
@@ -433,6 +434,7 @@ template <typename T>
 template <int shiftAmount> ALWAYS_INLINE void Lexer<T>::internalShift()
 {
     m_code += shiftAmount;
+    m_columnNumber += shiftAmount;
     m_current = *m_code;
 }
 
@@ -444,6 +446,7 @@ ALWAYS_INLINE void Lexer<T>::shift()
     ++m_code;
     if (LIKELY(m_code < m_codeEnd))
         m_current = *m_code;
+    ++m_columnNumber;
 }
 
 template <typename T>
@@ -1183,7 +1186,7 @@ bool Lexer<T>::nextTokenIsColon()
 }
 
 template <typename T>
-JSTokenType Lexer<T>::lex(JSTokenData* tokenData, JSTokenInfo* tokenInfo, unsigned lexerFlags, bool strictMode)
+JSTokenType Lexer<T>::lex(JSTokenData* tokenData, JSTokenLocation* tokenLocation, unsigned lexerFlags, bool strictMode)
 {
     ASSERT(!m_error);
     ASSERT(m_buffer8.isEmpty());
@@ -1199,7 +1202,8 @@ start:
     if (atEnd())
         return EOFTOK;
     
-    tokenInfo->startOffset = currentOffset();
+    tokenLocation->startOffset = currentOffset();
+    tokenLocation->column = m_columnNumber;
 
     CharacterType type;
     if (LIKELY(isLatin1(m_current)))
@@ -1522,6 +1526,7 @@ inNumberAfterDecimalPoint:
         shiftLineTerminator();
         m_atLineStart = true;
         m_terminator = true;
+        m_columnNumber = 0;
         goto start;
     case CharacterInvalid:
         m_lexErrorMessage = invalidCharacterMessage();
@@ -1544,6 +1549,7 @@ inSingleLineComment:
     shiftLineTerminator();
     m_atLineStart = true;
     m_terminator = true;
+    m_columnNumber = 0;
     if (!lastTokenWasRestrKeyword())
         goto start;
 
@@ -1551,15 +1557,15 @@ inSingleLineComment:
     // Fall through into returnToken.
 
 returnToken:
-    tokenInfo->line = m_lineNumber;
-    tokenInfo->endOffset = currentOffset();
+    tokenLocation->line = m_lineNumber;
+    tokenLocation->endOffset = currentOffset();
     m_lastToken = token;
     return token;
 
 returnError:
     m_error = true;
-    tokenInfo->line = m_lineNumber;
-    tokenInfo->endOffset = currentOffset();
+    tokenLocation->line = m_lineNumber;
+    tokenLocation->endOffset = currentOffset();
     return ERRORTOK;
 }
 
diff --git a/Source/JavaScriptCore/parser/Lexer.h b/Source/JavaScriptCore/parser/Lexer.h
index 41f1f8553..1ac832a2c 100644
--- a/Source/JavaScriptCore/parser/Lexer.h
+++ b/Source/JavaScriptCore/parser/Lexer.h
@@ -87,9 +87,10 @@ public:
     void setIsReparsing() { m_isReparsing = true; }
     bool isReparsing() const { return m_isReparsing; }
 
-    JSTokenType lex(JSTokenData*, JSTokenInfo*, unsigned, bool strictMode);
+    JSTokenType lex(JSTokenData*, JSTokenLocation*, unsigned, bool strictMode);
     bool nextTokenIsColon();
     int lineNumber() const { return m_lineNumber; }
+    int currentColumnNumber() const { return m_columnNumber; }
     void setLastLineNumber(int lastLineNumber) { m_lastLineNumber = lastLineNumber; }
     int lastLineNumber() const { return m_lastLineNumber; }
     bool prevTerminator() const { return m_terminator; }
@@ -120,7 +121,7 @@ public:
 
     SourceProvider* sourceProvider() const { return m_source->provider(); }
 
-    JSTokenType lexExpectIdentifier(JSTokenData*, JSTokenInfo*, unsigned, bool strictMode);
+    JSTokenType lexExpectIdentifier(JSTokenData*, JSTokenLocation*, unsigned, bool strictMode);
 
 private:
     void record8(int);
@@ -166,6 +167,7 @@ private:
 
     int m_lineNumber;
     int m_lastLineNumber;
+    int m_columnNumber;
 
     Vector<LChar> m_buffer8;
     Vector<UChar> m_buffer16;
@@ -257,7 +259,7 @@ ALWAYS_INLINE const Identifier* Lexer<T>::makeIdentifierLCharFromUChar(const UCh
 }
 
 template <typename T>
-ALWAYS_INLINE JSTokenType Lexer<T>::lexExpectIdentifier(JSTokenData* tokenData, JSTokenInfo* tokenInfo, unsigned lexerFlags, bool strictMode)
+ALWAYS_INLINE JSTokenType Lexer<T>::lexExpectIdentifier(JSTokenData* tokenData, JSTokenLocation* tokenLocation, unsigned lexerFlags, bool strictMode)
 {
     ASSERT((lexerFlags & LexerFlagsIgnoreReservedWords));
     const T* start = m_code;
@@ -285,20 +287,22 @@ ALWAYS_INLINE JSTokenType Lexer<T>::lexExpectIdentifier(JSTokenData* tokenData,
         m_current = 0;
 
     m_code = ptr;
+    m_columnNumber = m_columnNumber + (m_code - start);
 
     // Create the identifier if needed
     if (lexerFlags & LexexFlagsDontBuildKeywords)
         tokenData->ident = 0;
     else
         tokenData->ident = makeIdentifier(start, ptr - start);
-    tokenInfo->line = m_lineNumber;
-    tokenInfo->startOffset = start - m_codeStart;
-    tokenInfo->endOffset = currentOffset();
+    tokenLocation->line = m_lineNumber;
+    tokenLocation->startOffset = start - m_codeStart;
+    tokenLocation->endOffset = currentOffset();
+    tokenLocation->column = m_columnNumber;
     m_lastToken = IDENT;
     return IDENT;
     
 slowCase:
-    return lex(tokenData, tokenInfo, lexerFlags, strictMode);
+    return lex(tokenData, tokenLocation, lexerFlags, strictMode);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/parser/NodeConstructors.h b/Source/JavaScriptCore/parser/NodeConstructors.h
index be50eeafe..43d1e17c6 100644
--- a/Source/JavaScriptCore/parser/NodeConstructors.h
+++ b/Source/JavaScriptCore/parser/NodeConstructors.h
@@ -42,60 +42,61 @@ namespace JSC {
         globalData->parserArena->derefWithArena(adoptRef(this));
     }
 
-    inline Node::Node(int lineNumber)
-        : m_lineNumber(lineNumber)
+    inline Node::Node(const JSTokenLocation& location)
+        : m_lineNumber(location.line)
+        , m_columnNumber(location.column)
     {
     }
 
-    inline ExpressionNode::ExpressionNode(int lineNumber, ResultType resultType)
-        : Node(lineNumber)
+    inline ExpressionNode::ExpressionNode(const JSTokenLocation& location, ResultType resultType)
+        : Node(location)
         , m_resultType(resultType)
     {
     }
 
-    inline StatementNode::StatementNode(int lineNumber)
-        : Node(lineNumber)
+    inline StatementNode::StatementNode(const JSTokenLocation& location)
+        : Node(location)
         , m_lastLine(-1)
     {
     }
 
-    inline NullNode::NullNode(int lineNumber)
-        : ExpressionNode(lineNumber, ResultType::nullType())
+    inline NullNode::NullNode(const JSTokenLocation& location)
+        : ExpressionNode(location, ResultType::nullType())
     {
     }
 
-    inline BooleanNode::BooleanNode(int lineNumber, bool value)
-        : ExpressionNode(lineNumber, ResultType::booleanType())
+    inline BooleanNode::BooleanNode(const JSTokenLocation& location, bool value)
+        : ExpressionNode(location, ResultType::booleanType())
         , m_value(value)
     {
     }
 
-    inline NumberNode::NumberNode(int lineNumber, double value)
-        : ExpressionNode(lineNumber, ResultType::numberType())
+    inline NumberNode::NumberNode(const JSTokenLocation& location, double value)
+        : ExpressionNode(location, ResultType::numberType())
         , m_value(value)
     {
     }
 
-    inline StringNode::StringNode(int lineNumber, const Identifier& value)
-        : ExpressionNode(lineNumber, ResultType::stringType())
+    inline StringNode::StringNode(const JSTokenLocation& location, const Identifier& value)
+        : ExpressionNode(location, ResultType::stringType())
         , m_value(value)
     {
     }
 
-    inline RegExpNode::RegExpNode(int lineNumber, const Identifier& pattern, const Identifier& flags)
-        : ExpressionNode(lineNumber)
+    inline RegExpNode::RegExpNode(const JSTokenLocation& location, const Identifier& pattern, const Identifier& flags)
+        : ExpressionNode(location)
         , m_pattern(pattern)
         , m_flags(flags)
     {
     }
 
-    inline ThisNode::ThisNode(int lineNumber)
-        : ExpressionNode(lineNumber)
+    inline ThisNode::ThisNode(const JSTokenLocation& location)
+        : ExpressionNode(location)
     {
     }
 
-    inline ResolveNode::ResolveNode(int lineNumber, const Identifier& ident, int startOffset)
-        : ExpressionNode(lineNumber)
+    inline ResolveNode::ResolveNode(const JSTokenLocation& location, const Identifier& ident, int startOffset)
+        : ExpressionNode(location)
         , m_ident(ident)
         , m_startOffset(startOffset)
     {
@@ -116,24 +117,24 @@ namespace JSC {
         l->m_next = this;
     }
 
-    inline ArrayNode::ArrayNode(int lineNumber, int elision)
-        : ExpressionNode(lineNumber)
+    inline ArrayNode::ArrayNode(const JSTokenLocation& location, int elision)
+        : ExpressionNode(location)
         , m_element(0)
         , m_elision(elision)
         , m_optional(true)
     {
     }
 
-    inline ArrayNode::ArrayNode(int lineNumber, ElementNode* element)
-        : ExpressionNode(lineNumber)
+    inline ArrayNode::ArrayNode(const JSTokenLocation& location, ElementNode* element)
+        : ExpressionNode(location)
         , m_element(element)
         , m_elision(0)
         , m_optional(false)
     {
     }
 
-    inline ArrayNode::ArrayNode(int lineNumber, int elision, ElementNode* element)
-        : ExpressionNode(lineNumber)
+    inline ArrayNode::ArrayNode(const JSTokenLocation& location, int elision, ElementNode* element)
+        : ExpressionNode(location)
         , m_element(element)
         , m_elision(elision)
         , m_optional(true)
@@ -154,57 +155,57 @@ namespace JSC {
     {
     }
 
-    inline PropertyListNode::PropertyListNode(int lineNumber, PropertyNode* node)
-        : Node(lineNumber)
+    inline PropertyListNode::PropertyListNode(const JSTokenLocation& location, PropertyNode* node)
+        : Node(location)
         , m_node(node)
         , m_next(0)
     {
     }
 
-    inline PropertyListNode::PropertyListNode(int lineNumber, PropertyNode* node, PropertyListNode* list)
-        : Node(lineNumber)
+    inline PropertyListNode::PropertyListNode(const JSTokenLocation& location, PropertyNode* node, PropertyListNode* list)
+        : Node(location)
         , m_node(node)
         , m_next(0)
     {
         list->m_next = this;
     }
 
-    inline ObjectLiteralNode::ObjectLiteralNode(int lineNumber)
-        : ExpressionNode(lineNumber)
+    inline ObjectLiteralNode::ObjectLiteralNode(const JSTokenLocation& location)
+        : ExpressionNode(location)
         , m_list(0)
     {
     }
 
-    inline ObjectLiteralNode::ObjectLiteralNode(int lineNumber, PropertyListNode* list)
-        : ExpressionNode(lineNumber)
+    inline ObjectLiteralNode::ObjectLiteralNode(const JSTokenLocation& location, PropertyListNode* list)
+        : ExpressionNode(location)
         , m_list(list)
     {
     }
 
-    inline BracketAccessorNode::BracketAccessorNode(int lineNumber, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments)
-        : ExpressionNode(lineNumber)
+    inline BracketAccessorNode::BracketAccessorNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments)
+        : ExpressionNode(location)
         , m_base(base)
         , m_subscript(subscript)
         , m_subscriptHasAssignments(subscriptHasAssignments)
     {
     }
 
-    inline DotAccessorNode::DotAccessorNode(int lineNumber, ExpressionNode* base, const Identifier& ident)
-        : ExpressionNode(lineNumber)
+    inline DotAccessorNode::DotAccessorNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident)
+        : ExpressionNode(location)
         , m_base(base)
         , m_ident(ident)
     {
     }
 
-    inline ArgumentListNode::ArgumentListNode(int lineNumber, ExpressionNode* expr)
-        : Node(lineNumber)
+    inline ArgumentListNode::ArgumentListNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : Node(location)
         , m_next(0)
         , m_expr(expr)
     {
     }
 
-    inline ArgumentListNode::ArgumentListNode(int lineNumber, ArgumentListNode* listNode, ExpressionNode* expr)
-        : Node(lineNumber)
+    inline ArgumentListNode::ArgumentListNode(const JSTokenLocation& location, ArgumentListNode* listNode, ExpressionNode* expr)
+        : Node(location)
         , m_next(0)
         , m_expr(expr)
     {
@@ -221,45 +222,45 @@ namespace JSC {
     {
     }
 
-    inline NewExprNode::NewExprNode(int lineNumber, ExpressionNode* expr)
-        : ExpressionNode(lineNumber)
+    inline NewExprNode::NewExprNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location)
         , m_expr(expr)
         , m_args(0)
     {
     }
 
-    inline NewExprNode::NewExprNode(int lineNumber, ExpressionNode* expr, ArgumentsNode* args)
-        : ExpressionNode(lineNumber)
+    inline NewExprNode::NewExprNode(const JSTokenLocation& location, ExpressionNode* expr, ArgumentsNode* args)
+        : ExpressionNode(location)
         , m_expr(expr)
         , m_args(args)
     {
     }
 
-    inline EvalFunctionCallNode::EvalFunctionCallNode(int lineNumber, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline EvalFunctionCallNode::EvalFunctionCallNode(const JSTokenLocation& location, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableExpressionData(divot, startOffset, endOffset)
         , m_args(args)
     {
     }
 
-    inline FunctionCallValueNode::FunctionCallValueNode(int lineNumber, ExpressionNode* expr, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline FunctionCallValueNode::FunctionCallValueNode(const JSTokenLocation& location, ExpressionNode* expr, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableExpressionData(divot, startOffset, endOffset)
         , m_expr(expr)
         , m_args(args)
     {
     }
 
-    inline FunctionCallResolveNode::FunctionCallResolveNode(int lineNumber, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline FunctionCallResolveNode::FunctionCallResolveNode(const JSTokenLocation& location, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableExpressionData(divot, startOffset, endOffset)
         , m_ident(ident)
         , m_args(args)
     {
     }
 
-    inline FunctionCallBracketNode::FunctionCallBracketNode(int lineNumber, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline FunctionCallBracketNode::FunctionCallBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableSubExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_subscript(subscript)
@@ -267,8 +268,8 @@ namespace JSC {
     {
     }
 
-    inline FunctionCallDotNode::FunctionCallDotNode(int lineNumber, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline FunctionCallDotNode::FunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableSubExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_ident(ident)
@@ -276,31 +277,31 @@ namespace JSC {
     {
     }
 
-    inline CallFunctionCallDotNode::CallFunctionCallDotNode(int lineNumber, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : FunctionCallDotNode(lineNumber, base, ident, args, divot, startOffset, endOffset)
+    inline CallFunctionCallDotNode::CallFunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : FunctionCallDotNode(location, base, ident, args, divot, startOffset, endOffset)
     {
     }
 
-    inline ApplyFunctionCallDotNode::ApplyFunctionCallDotNode(int lineNumber, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : FunctionCallDotNode(lineNumber, base, ident, args, divot, startOffset, endOffset)
+    inline ApplyFunctionCallDotNode::ApplyFunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : FunctionCallDotNode(location, base, ident, args, divot, startOffset, endOffset)
     {
     }
 
-    inline PrePostResolveNode::PrePostResolveNode(int lineNumber, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber, ResultType::numberType()) // could be reusable for pre?
+    inline PrePostResolveNode::PrePostResolveNode(const JSTokenLocation& location, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location, ResultType::numberType()) // could be reusable for pre?
         , ThrowableExpressionData(divot, startOffset, endOffset)
         , m_ident(ident)
     {
     }
 
-    inline PostfixResolveNode::PostfixResolveNode(int lineNumber, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : PrePostResolveNode(lineNumber, ident, divot, startOffset, endOffset)
+    inline PostfixResolveNode::PostfixResolveNode(const JSTokenLocation& location, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : PrePostResolveNode(location, ident, divot, startOffset, endOffset)
         , m_operator(oper)
     {
     }
 
-    inline PostfixBracketNode::PostfixBracketNode(int lineNumber, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline PostfixBracketNode::PostfixBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableSubExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_subscript(subscript)
@@ -308,8 +309,8 @@ namespace JSC {
     {
     }
 
-    inline PostfixDotNode::PostfixDotNode(int lineNumber, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline PostfixDotNode::PostfixDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableSubExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_ident(ident)
@@ -317,68 +318,68 @@ namespace JSC {
     {
     }
 
-    inline PostfixErrorNode::PostfixErrorNode(int lineNumber, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline PostfixErrorNode::PostfixErrorNode(const JSTokenLocation& location, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableSubExpressionData(divot, startOffset, endOffset)
         , m_operator(oper)
     {
     }
 
-    inline DeleteResolveNode::DeleteResolveNode(int lineNumber, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline DeleteResolveNode::DeleteResolveNode(const JSTokenLocation& location, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableExpressionData(divot, startOffset, endOffset)
         , m_ident(ident)
     {
     }
 
-    inline DeleteBracketNode::DeleteBracketNode(int lineNumber, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline DeleteBracketNode::DeleteBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_subscript(subscript)
     {
     }
 
-    inline DeleteDotNode::DeleteDotNode(int lineNumber, ExpressionNode* base, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline DeleteDotNode::DeleteDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_ident(ident)
     {
     }
 
-    inline DeleteValueNode::DeleteValueNode(int lineNumber, ExpressionNode* expr)
-        : ExpressionNode(lineNumber)
+    inline DeleteValueNode::DeleteValueNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location)
         , m_expr(expr)
     {
     }
 
-    inline VoidNode::VoidNode(int lineNumber, ExpressionNode* expr)
-        : ExpressionNode(lineNumber)
+    inline VoidNode::VoidNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location)
         , m_expr(expr)
     {
     }
 
-    inline TypeOfResolveNode::TypeOfResolveNode(int lineNumber, const Identifier& ident)
-        : ExpressionNode(lineNumber, ResultType::stringType())
+    inline TypeOfResolveNode::TypeOfResolveNode(const JSTokenLocation& location, const Identifier& ident)
+        : ExpressionNode(location, ResultType::stringType())
         , m_ident(ident)
     {
     }
 
-    inline TypeOfValueNode::TypeOfValueNode(int lineNumber, ExpressionNode* expr)
-        : ExpressionNode(lineNumber, ResultType::stringType())
+    inline TypeOfValueNode::TypeOfValueNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location, ResultType::stringType())
         , m_expr(expr)
     {
     }
 
-    inline PrefixResolveNode::PrefixResolveNode(int lineNumber, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : PrePostResolveNode(lineNumber, ident, divot, startOffset, endOffset)
+    inline PrefixResolveNode::PrefixResolveNode(const JSTokenLocation& location, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : PrePostResolveNode(location, ident, divot, startOffset, endOffset)
         , m_operator(oper)
     {
     }
 
-    inline PrefixBracketNode::PrefixBracketNode(int lineNumber, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline PrefixBracketNode::PrefixBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_subscript(subscript)
@@ -386,8 +387,8 @@ namespace JSC {
     {
     }
 
-    inline PrefixDotNode::PrefixDotNode(int lineNumber, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline PrefixDotNode::PrefixDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_ident(ident)
@@ -395,43 +396,43 @@ namespace JSC {
     {
     }
 
-    inline PrefixErrorNode::PrefixErrorNode(int lineNumber, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline PrefixErrorNode::PrefixErrorNode(const JSTokenLocation& location, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableExpressionData(divot, startOffset, endOffset)
         , m_operator(oper)
     {
     }
 
-    inline UnaryOpNode::UnaryOpNode(int lineNumber, ResultType type, ExpressionNode* expr, OpcodeID opcodeID)
-        : ExpressionNode(lineNumber, type)
+    inline UnaryOpNode::UnaryOpNode(const JSTokenLocation& location, ResultType type, ExpressionNode* expr, OpcodeID opcodeID)
+        : ExpressionNode(location, type)
         , m_expr(expr)
         , m_opcodeID(opcodeID)
     {
     }
 
-    inline UnaryPlusNode::UnaryPlusNode(int lineNumber, ExpressionNode* expr)
-        : UnaryOpNode(lineNumber, ResultType::numberType(), expr, op_to_jsnumber)
+    inline UnaryPlusNode::UnaryPlusNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : UnaryOpNode(location, ResultType::numberType(), expr, op_to_jsnumber)
     {
     }
 
-    inline NegateNode::NegateNode(int lineNumber, ExpressionNode* expr)
-        : UnaryOpNode(lineNumber, ResultType::numberType(), expr, op_negate)
+    inline NegateNode::NegateNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : UnaryOpNode(location, ResultType::numberType(), expr, op_negate)
     {
     }
 
-    inline BitwiseNotNode::BitwiseNotNode(int lineNumber, ExpressionNode* expr)
-        : ExpressionNode(lineNumber, ResultType::forBitOp())
+    inline BitwiseNotNode::BitwiseNotNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location, ResultType::forBitOp())
         , m_expr(expr)
     {
     }
 
-    inline LogicalNotNode::LogicalNotNode(int lineNumber, ExpressionNode* expr)
-        : UnaryOpNode(lineNumber, ResultType::booleanType(), expr, op_not)
+    inline LogicalNotNode::LogicalNotNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : UnaryOpNode(location, ResultType::booleanType(), expr, op_not)
     {
     }
 
-    inline BinaryOpNode::BinaryOpNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
-        : ExpressionNode(lineNumber)
+    inline BinaryOpNode::BinaryOpNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : ExpressionNode(location)
         , m_expr1(expr1)
         , m_expr2(expr2)
         , m_opcodeID(opcodeID)
@@ -439,8 +440,8 @@ namespace JSC {
     {
     }
 
-    inline BinaryOpNode::BinaryOpNode(int lineNumber, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
-        : ExpressionNode(lineNumber, type)
+    inline BinaryOpNode::BinaryOpNode(const JSTokenLocation& location, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : ExpressionNode(location, type)
         , m_expr1(expr1)
         , m_expr2(expr2)
         , m_opcodeID(opcodeID)
@@ -448,140 +449,140 @@ namespace JSC {
     {
     }
 
-    inline MultNode::MultNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::numberType(), expr1, expr2, op_mul, rightHasAssignments)
+    inline MultNode::MultNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::numberType(), expr1, expr2, op_mul, rightHasAssignments)
     {
     }
 
-    inline DivNode::DivNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::numberType(), expr1, expr2, op_div, rightHasAssignments)
+    inline DivNode::DivNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::numberType(), expr1, expr2, op_div, rightHasAssignments)
     {
     }
 
 
-    inline ModNode::ModNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::numberType(), expr1, expr2, op_mod, rightHasAssignments)
+    inline ModNode::ModNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::numberType(), expr1, expr2, op_mod, rightHasAssignments)
     {
     }
 
-    inline AddNode::AddNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::forAdd(expr1->resultDescriptor(), expr2->resultDescriptor()), expr1, expr2, op_add, rightHasAssignments)
+    inline AddNode::AddNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forAdd(expr1->resultDescriptor(), expr2->resultDescriptor()), expr1, expr2, op_add, rightHasAssignments)
     {
     }
 
-    inline SubNode::SubNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::numberType(), expr1, expr2, op_sub, rightHasAssignments)
+    inline SubNode::SubNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::numberType(), expr1, expr2, op_sub, rightHasAssignments)
     {
     }
 
-    inline LeftShiftNode::LeftShiftNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::forBitOp(), expr1, expr2, op_lshift, rightHasAssignments)
+    inline LeftShiftNode::LeftShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forBitOp(), expr1, expr2, op_lshift, rightHasAssignments)
     {
     }
 
-    inline RightShiftNode::RightShiftNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::forBitOp(), expr1, expr2, op_rshift, rightHasAssignments)
+    inline RightShiftNode::RightShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forBitOp(), expr1, expr2, op_rshift, rightHasAssignments)
     {
     }
 
-    inline UnsignedRightShiftNode::UnsignedRightShiftNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::numberType(), expr1, expr2, op_urshift, rightHasAssignments)
+    inline UnsignedRightShiftNode::UnsignedRightShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::numberType(), expr1, expr2, op_urshift, rightHasAssignments)
     {
     }
 
-    inline LessNode::LessNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::booleanType(), expr1, expr2, op_less, rightHasAssignments)
+    inline LessNode::LessNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_less, rightHasAssignments)
     {
     }
 
-    inline GreaterNode::GreaterNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::booleanType(), expr1, expr2, op_greater, rightHasAssignments)
+    inline GreaterNode::GreaterNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_greater, rightHasAssignments)
     {
     }
 
-    inline LessEqNode::LessEqNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::booleanType(), expr1, expr2, op_lesseq, rightHasAssignments)
+    inline LessEqNode::LessEqNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_lesseq, rightHasAssignments)
     {
     }
 
-    inline GreaterEqNode::GreaterEqNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::booleanType(), expr1, expr2, op_greatereq, rightHasAssignments)
+    inline GreaterEqNode::GreaterEqNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_greatereq, rightHasAssignments)
     {
     }
 
-    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(int lineNumber, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, type, expr1, expr2, opcodeID, rightHasAssignments)
+    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(const JSTokenLocation& location, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(location, type, expr1, expr2, opcodeID, rightHasAssignments)
     {
     }
 
-    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, expr1, expr2, opcodeID, rightHasAssignments)
+    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(location, expr1, expr2, opcodeID, rightHasAssignments)
     {
     }
 
-    inline InstanceOfNode::InstanceOfNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : ThrowableBinaryOpNode(lineNumber, ResultType::booleanType(), expr1, expr2, op_instanceof, rightHasAssignments)
+    inline InstanceOfNode::InstanceOfNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ThrowableBinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_instanceof, rightHasAssignments)
     {
     }
 
-    inline InNode::InNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : ThrowableBinaryOpNode(lineNumber, expr1, expr2, op_in, rightHasAssignments)
+    inline InNode::InNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ThrowableBinaryOpNode(location, expr1, expr2, op_in, rightHasAssignments)
     {
     }
 
-    inline EqualNode::EqualNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::booleanType(), expr1, expr2, op_eq, rightHasAssignments)
+    inline EqualNode::EqualNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_eq, rightHasAssignments)
     {
     }
 
-    inline NotEqualNode::NotEqualNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::booleanType(), expr1, expr2, op_neq, rightHasAssignments)
+    inline NotEqualNode::NotEqualNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_neq, rightHasAssignments)
     {
     }
 
-    inline StrictEqualNode::StrictEqualNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::booleanType(), expr1, expr2, op_stricteq, rightHasAssignments)
+    inline StrictEqualNode::StrictEqualNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_stricteq, rightHasAssignments)
     {
     }
 
-    inline NotStrictEqualNode::NotStrictEqualNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::booleanType(), expr1, expr2, op_nstricteq, rightHasAssignments)
+    inline NotStrictEqualNode::NotStrictEqualNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_nstricteq, rightHasAssignments)
     {
     }
 
-    inline BitAndNode::BitAndNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::forBitOp(), expr1, expr2, op_bitand, rightHasAssignments)
+    inline BitAndNode::BitAndNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forBitOp(), expr1, expr2, op_bitand, rightHasAssignments)
     {
     }
 
-    inline BitOrNode::BitOrNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::forBitOp(), expr1, expr2, op_bitor, rightHasAssignments)
+    inline BitOrNode::BitOrNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forBitOp(), expr1, expr2, op_bitor, rightHasAssignments)
     {
     }
 
-    inline BitXOrNode::BitXOrNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::forBitOp(), expr1, expr2, op_bitxor, rightHasAssignments)
+    inline BitXOrNode::BitXOrNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forBitOp(), expr1, expr2, op_bitxor, rightHasAssignments)
     {
     }
 
-    inline LogicalOpNode::LogicalOpNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper)
-        : ExpressionNode(lineNumber, ResultType::booleanType())
+    inline LogicalOpNode::LogicalOpNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper)
+        : ExpressionNode(location, ResultType::booleanType())
         , m_expr1(expr1)
         , m_expr2(expr2)
         , m_operator(oper)
     {
     }
 
-    inline ConditionalNode::ConditionalNode(int lineNumber, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2)
-        : ExpressionNode(lineNumber)
+    inline ConditionalNode::ConditionalNode(const JSTokenLocation& location, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2)
+        : ExpressionNode(location)
         , m_logical(logical)
         , m_expr1(expr1)
         , m_expr2(expr2)
     {
     }
 
-    inline ReadModifyResolveNode::ReadModifyResolveNode(int lineNumber, const Identifier& ident, Operator oper, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline ReadModifyResolveNode::ReadModifyResolveNode(const JSTokenLocation& location, const Identifier& ident, Operator oper, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableExpressionData(divot, startOffset, endOffset)
         , m_ident(ident)
         , m_right(right)
@@ -590,15 +591,15 @@ namespace JSC {
     {
     }
 
-    inline AssignResolveNode::AssignResolveNode(int lineNumber, const Identifier& ident, ExpressionNode* right)
-        : ExpressionNode(lineNumber)
+    inline AssignResolveNode::AssignResolveNode(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* right)
+        : ExpressionNode(location)
         , m_ident(ident)
         , m_right(right)
     {
     }
 
-    inline ReadModifyBracketNode::ReadModifyBracketNode(int lineNumber, ExpressionNode* base, ExpressionNode* subscript, Operator oper, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline ReadModifyBracketNode::ReadModifyBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, Operator oper, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableSubExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_subscript(subscript)
@@ -609,8 +610,8 @@ namespace JSC {
     {
     }
 
-    inline AssignBracketNode::AssignBracketNode(int lineNumber, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline AssignBracketNode::AssignBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_subscript(subscript)
@@ -620,8 +621,8 @@ namespace JSC {
     {
     }
 
-    inline AssignDotNode::AssignDotNode(int lineNumber, ExpressionNode* base, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline AssignDotNode::AssignDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_ident(ident)
@@ -630,8 +631,8 @@ namespace JSC {
     {
     }
 
-    inline ReadModifyDotNode::ReadModifyDotNode(int lineNumber, ExpressionNode* base, const Identifier& ident, Operator oper, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline ReadModifyDotNode::ReadModifyDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, Operator oper, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableSubExpressionData(divot, startOffset, endOffset)
         , m_base(base)
         , m_ident(ident)
@@ -641,21 +642,21 @@ namespace JSC {
     {
     }
 
-    inline AssignErrorNode::AssignErrorNode(int lineNumber, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(lineNumber)
+    inline AssignErrorNode::AssignErrorNode(const JSTokenLocation& location, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(location)
         , ThrowableExpressionData(divot, startOffset, endOffset)
     {
     }
 
-    inline CommaNode::CommaNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2)
-        : ExpressionNode(lineNumber)
+    inline CommaNode::CommaNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2)
+        : ExpressionNode(location)
     {
         m_expressions.append(expr1);
         m_expressions.append(expr2);
     }
 
-    inline ConstStatementNode::ConstStatementNode(int lineNumber, ConstDeclNode* next)
-        : StatementNode(lineNumber)
+    inline ConstStatementNode::ConstStatementNode(const JSTokenLocation& location, ConstDeclNode* next)
+        : StatementNode(location)
         , m_next(next)
     {
     }
@@ -664,57 +665,57 @@ namespace JSC {
     {
     }
 
-    inline EmptyStatementNode::EmptyStatementNode(int lineNumber)
-        : StatementNode(lineNumber)
+    inline EmptyStatementNode::EmptyStatementNode(const JSTokenLocation& location)
+        : StatementNode(location)
     {
     }
 
-    inline DebuggerStatementNode::DebuggerStatementNode(int lineNumber)
-        : StatementNode(lineNumber)
+    inline DebuggerStatementNode::DebuggerStatementNode(const JSTokenLocation& location)
+        : StatementNode(location)
     {
     }
     
-    inline ExprStatementNode::ExprStatementNode(int lineNumber, ExpressionNode* expr)
-        : StatementNode(lineNumber)
+    inline ExprStatementNode::ExprStatementNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : StatementNode(location)
         , m_expr(expr)
     {
     }
 
-    inline VarStatementNode::VarStatementNode(int lineNumber, ExpressionNode* expr)
-        : StatementNode(lineNumber)
+    inline VarStatementNode::VarStatementNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : StatementNode(location)
         , m_expr(expr)
     {
     }
     
-    inline IfNode::IfNode(int lineNumber, ExpressionNode* condition, StatementNode* ifBlock)
-        : StatementNode(lineNumber)
+    inline IfNode::IfNode(const JSTokenLocation& location, ExpressionNode* condition, StatementNode* ifBlock)
+        : StatementNode(location)
         , m_condition(condition)
         , m_ifBlock(ifBlock)
     {
     }
 
-    inline IfElseNode::IfElseNode(int lineNumber, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock)
-        : IfNode(lineNumber, condition, ifBlock)
+    inline IfElseNode::IfElseNode(const JSTokenLocation& location, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock)
+        : IfNode(location, condition, ifBlock)
         , m_elseBlock(elseBlock)
     {
     }
 
-    inline DoWhileNode::DoWhileNode(int lineNumber, StatementNode* statement, ExpressionNode* expr)
-        : StatementNode(lineNumber)
+    inline DoWhileNode::DoWhileNode(const JSTokenLocation& location, StatementNode* statement, ExpressionNode* expr)
+        : StatementNode(location)
         , m_statement(statement)
         , m_expr(expr)
     {
     }
 
-    inline WhileNode::WhileNode(int lineNumber, ExpressionNode* expr, StatementNode* statement)
-        : StatementNode(lineNumber)
+    inline WhileNode::WhileNode(const JSTokenLocation& location, ExpressionNode* expr, StatementNode* statement)
+        : StatementNode(location)
         , m_expr(expr)
         , m_statement(statement)
     {
     }
 
-    inline ForNode::ForNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement)
-        : StatementNode(lineNumber)
+    inline ForNode::ForNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement)
+        : StatementNode(location)
         , m_expr1(expr1)
         , m_expr2(expr2)
         , m_expr3(expr3)
@@ -723,38 +724,38 @@ namespace JSC {
         ASSERT(statement);
     }
 
-    inline ContinueNode::ContinueNode(JSGlobalData* globalData, int lineNumber)
-        : StatementNode(lineNumber)
+    inline ContinueNode::ContinueNode(JSGlobalData* globalData, const JSTokenLocation& location)
+        : StatementNode(location)
         , m_ident(globalData->propertyNames->nullIdentifier)
     {
     }
 
-    inline ContinueNode::ContinueNode(int lineNumber, const Identifier& ident)
-        : StatementNode(lineNumber)
+    inline ContinueNode::ContinueNode(const JSTokenLocation& location, const Identifier& ident)
+        : StatementNode(location)
         , m_ident(ident)
     {
     }
     
-    inline BreakNode::BreakNode(JSGlobalData* globalData, int lineNumber)
-        : StatementNode(lineNumber)
+    inline BreakNode::BreakNode(JSGlobalData* globalData, const JSTokenLocation& location)
+        : StatementNode(location)
         , m_ident(globalData->propertyNames->nullIdentifier)
     {
     }
 
-    inline BreakNode::BreakNode(int lineNumber, const Identifier& ident)
-        : StatementNode(lineNumber)
+    inline BreakNode::BreakNode(const JSTokenLocation& location, const Identifier& ident)
+        : StatementNode(location)
         , m_ident(ident)
     {
     }
     
-    inline ReturnNode::ReturnNode(int lineNumber, ExpressionNode* value)
-        : StatementNode(lineNumber)
+    inline ReturnNode::ReturnNode(const JSTokenLocation& location, ExpressionNode* value)
+        : StatementNode(location)
         , m_value(value)
     {
     }
 
-    inline WithNode::WithNode(int lineNumber, ExpressionNode* expr, StatementNode* statement, uint32_t divot, uint32_t expressionLength)
-        : StatementNode(lineNumber)
+    inline WithNode::WithNode(const JSTokenLocation& location, ExpressionNode* expr, StatementNode* statement, uint32_t divot, uint32_t expressionLength)
+        : StatementNode(location)
         , m_expr(expr)
         , m_statement(statement)
         , m_divot(divot)
@@ -762,21 +763,21 @@ namespace JSC {
     {
     }
 
-    inline LabelNode::LabelNode(int lineNumber, const Identifier& name, StatementNode* statement)
-        : StatementNode(lineNumber)
+    inline LabelNode::LabelNode(const JSTokenLocation& location, const Identifier& name, StatementNode* statement)
+        : StatementNode(location)
         , m_name(name)
         , m_statement(statement)
     {
     }
 
-    inline ThrowNode::ThrowNode(int lineNumber, ExpressionNode* expr)
-        : StatementNode(lineNumber)
+    inline ThrowNode::ThrowNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : StatementNode(location)
         , m_expr(expr)
     {
     }
 
-    inline TryNode::TryNode(int lineNumber, StatementNode* tryBlock, const Identifier& exceptionIdent, StatementNode* catchBlock, StatementNode* finallyBlock)
-        : StatementNode(lineNumber)
+    inline TryNode::TryNode(const JSTokenLocation& location, StatementNode* tryBlock, const Identifier& exceptionIdent, StatementNode* catchBlock, StatementNode* finallyBlock)
+        : StatementNode(location)
         , m_tryBlock(tryBlock)
         , m_exceptionIdent(exceptionIdent)
         , m_catchBlock(catchBlock)
@@ -797,15 +798,15 @@ namespace JSC {
         l->m_next = this;
     }
 
-    inline FuncExprNode::FuncExprNode(int lineNumber, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
-        : ExpressionNode(lineNumber)
+    inline FuncExprNode::FuncExprNode(const JSTokenLocation& location, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
+        : ExpressionNode(location)
         , m_body(body)
     {
         m_body->finishParsing(source, parameter, ident);
     }
 
-    inline FuncDeclNode::FuncDeclNode(int lineNumber, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
-        : StatementNode(lineNumber)
+    inline FuncDeclNode::FuncDeclNode(const JSTokenLocation& location, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
+        : StatementNode(location)
         , m_body(body)
     {
         m_body->finishParsing(source, parameter, ident);
@@ -837,29 +838,29 @@ namespace JSC {
     {
     }
 
-    inline SwitchNode::SwitchNode(int lineNumber, ExpressionNode* expr, CaseBlockNode* block)
-        : StatementNode(lineNumber)
+    inline SwitchNode::SwitchNode(const JSTokenLocation& location, ExpressionNode* expr, CaseBlockNode* block)
+        : StatementNode(location)
         , m_expr(expr)
         , m_block(block)
     {
     }
 
-    inline ConstDeclNode::ConstDeclNode(int lineNumber, const Identifier& ident, ExpressionNode* init)
-        : ExpressionNode(lineNumber)
+    inline ConstDeclNode::ConstDeclNode(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* init)
+        : ExpressionNode(location)
         , m_ident(ident)
         , m_next(0)
         , m_init(init)
     {
     }
 
-    inline BlockNode::BlockNode(int lineNumber, SourceElements* statements)
-        : StatementNode(lineNumber)
+    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements)
+        : StatementNode(location)
         , m_statements(statements)
     {
     }
 
-    inline ForInNode::ForInNode(int lineNumber, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
-        : StatementNode(lineNumber)
+    inline ForInNode::ForInNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
+        : StatementNode(location)
         , m_init(0)
         , m_lexpr(l)
         , m_expr(expr)
@@ -868,16 +869,16 @@ namespace JSC {
     {
     }
 
-    inline ForInNode::ForInNode(JSGlobalData* globalData, int lineNumber, const Identifier& ident, ExpressionNode* in, ExpressionNode* expr, StatementNode* statement, int divot, int startOffset, int endOffset)
-        : StatementNode(lineNumber)
+    inline ForInNode::ForInNode(JSGlobalData* globalData, const JSTokenLocation& location, const Identifier& ident, ExpressionNode* in, ExpressionNode* expr, StatementNode* statement, int divot, int startOffset, int endOffset)
+        : StatementNode(location)
         , m_init(0)
-        , m_lexpr(new (globalData) ResolveNode(lineNumber, ident, divot - startOffset))
+        , m_lexpr(new (globalData) ResolveNode(location, ident, divot - startOffset))
         , m_expr(expr)
         , m_statement(statement)
         , m_identIsVarDecl(true)
     {
         if (in) {
-            AssignResolveNode* node = new (globalData) AssignResolveNode(lineNumber, ident, in);
+            AssignResolveNode* node = new (globalData) AssignResolveNode(location, ident, in);
             node->setExceptionSourceCode(divot, divot - startOffset, endOffset - divot);
             m_init = node;
         }
diff --git a/Source/JavaScriptCore/parser/Nodes.cpp b/Source/JavaScriptCore/parser/Nodes.cpp
index c32e4c73a..0172359c7 100644
--- a/Source/JavaScriptCore/parser/Nodes.cpp
+++ b/Source/JavaScriptCore/parser/Nodes.cpp
@@ -52,10 +52,18 @@ namespace JSC {
 
 // ------------------------------ StatementNode --------------------------------
 
+void StatementNode::setLoc(int firstLine, int lastLine, int column)
+{
+    m_lineNumber = firstLine;
+    m_lastLine = lastLine;
+    m_columnNumber = column;
+}
+
 void StatementNode::setLoc(int firstLine, int lastLine)
 {
     m_lineNumber = firstLine;
     m_lastLine = lastLine;
+    m_columnNumber = 0;
 }
 
 // ------------------------------ SourceElements --------------------------------
@@ -75,8 +83,8 @@ StatementNode* SourceElements::singleStatement() const
 
 // ------------------------------ ScopeNode -----------------------------
 
-ScopeNode::ScopeNode(JSGlobalData* globalData, int lineNumber, bool inStrictContext)
-    : StatementNode(lineNumber)
+ScopeNode::ScopeNode(JSGlobalData* globalData, const JSTokenLocation& location, bool inStrictContext)
+    : StatementNode(location)
     , ParserArenaRefCounted(globalData)
     , m_features(inStrictContext ? StrictModeFeature : NoFeatures)
     , m_numConstants(0)
@@ -84,8 +92,8 @@ ScopeNode::ScopeNode(JSGlobalData* globalData, int lineNumber, bool inStrictCont
 {
 }
 
-ScopeNode::ScopeNode(JSGlobalData* globalData, int lineNumber, const SourceCode& source, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, CodeFeatures features, int numConstants)
-    : StatementNode(lineNumber)
+ScopeNode::ScopeNode(JSGlobalData* globalData, const JSTokenLocation& location, const SourceCode& source, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, CodeFeatures features, int numConstants)
+    : StatementNode(location)
     , ParserArenaRefCounted(globalData)
     , m_features(features)
     , m_source(source)
@@ -107,14 +115,14 @@ StatementNode* ScopeNode::singleStatement() const
 
 // ------------------------------ ProgramNode -----------------------------
 
-inline ProgramNode::ProgramNode(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
-    : ScopeNode(globalData, lineNumber, source, children, varStack, funcStack, capturedVariables, features, numConstants)
+inline ProgramNode::ProgramNode(JSGlobalData* globalData, const JSTokenLocation& location, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
+    : ScopeNode(globalData, location, source, children, varStack, funcStack, capturedVariables, features, numConstants)
 {
 }
 
-PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
+PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, const JSTokenLocation& location, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
 {
-    RefPtr<ProgramNode> node = new ProgramNode(globalData, lineNumber, children, varStack, funcStack,  capturedVariables, source, features, numConstants);
+    RefPtr<ProgramNode> node = new ProgramNode(globalData, location, children, varStack, funcStack,  capturedVariables, source, features, numConstants);
 
     ASSERT(node->m_arena.last() == node);
     node->m_arena.removeLast();
@@ -125,14 +133,14 @@ PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, int lineNu
 
 // ------------------------------ EvalNode -----------------------------
 
-inline EvalNode::EvalNode(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
-    : ScopeNode(globalData, lineNumber, source, children, varStack, funcStack, capturedVariables, features, numConstants)
+inline EvalNode::EvalNode(JSGlobalData* globalData, const JSTokenLocation& location, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
+    : ScopeNode(globalData, location, source, children, varStack, funcStack, capturedVariables, features, numConstants)
 {
 }
 
-PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
+PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, const JSTokenLocation& location, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
 {
-    RefPtr<EvalNode> node = new EvalNode(globalData, lineNumber, children, varStack, funcStack, capturedVariables, source, features, numConstants);
+    RefPtr<EvalNode> node = new EvalNode(globalData, location, children, varStack, funcStack, capturedVariables, source, features, numConstants);
 
     ASSERT(node->m_arena.last() == node);
     node->m_arena.removeLast();
@@ -149,13 +157,13 @@ FunctionParameters::FunctionParameters(ParameterNode* firstParameter)
         append(parameter->ident());
 }
 
-inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, int lineNumber, bool inStrictContext)
-    : ScopeNode(globalData, lineNumber, inStrictContext)
+inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, const JSTokenLocation& location, bool inStrictContext)
+    : ScopeNode(globalData, location, inStrictContext)
 {
 }
 
-inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
-    : ScopeNode(globalData, lineNumber, sourceCode, children, varStack, funcStack, capturedVariables, features, numConstants)
+inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, const JSTokenLocation& location, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
+    : ScopeNode(globalData, location, sourceCode, children, varStack, funcStack, capturedVariables, features, numConstants)
 {
 }
 
@@ -172,14 +180,14 @@ void FunctionBodyNode::finishParsing(PassRefPtr<FunctionParameters> parameters,
     m_ident = ident;
 }
 
-FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData, int lineNumber, bool inStrictContext)
+FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData, const JSTokenLocation& location, bool inStrictContext)
 {
-    return new FunctionBodyNode(globalData, lineNumber, inStrictContext);
+    return new FunctionBodyNode(globalData, location, inStrictContext);
 }
 
-PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
+PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData, const JSTokenLocation& location, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
 {
-    RefPtr<FunctionBodyNode> node = new FunctionBodyNode(globalData, lineNumber, children, varStack, funcStack, capturedVariables, sourceCode, features, numConstants);
+    RefPtr<FunctionBodyNode> node = new FunctionBodyNode(globalData, location, children, varStack, funcStack, capturedVariables, sourceCode, features, numConstants);
 
     ASSERT(node->m_arena.last() == node);
     node->m_arena.removeLast();
diff --git a/Source/JavaScriptCore/parser/Nodes.h b/Source/JavaScriptCore/parser/Nodes.h
index 5b15be44c..ed1a85aaf 100644
--- a/Source/JavaScriptCore/parser/Nodes.h
+++ b/Source/JavaScriptCore/parser/Nodes.h
@@ -130,7 +130,7 @@ namespace JSC {
 
     class Node : public ParserArenaFreeable {
     protected:
-        Node(int);
+        Node(const JSTokenLocation&);
 
     public:
         virtual ~Node() { }
@@ -139,13 +139,16 @@ namespace JSC {
 
         int lineNo() const { return m_lineNumber; }
 
+        int columnNo() const { return m_columnNumber; }
+
     protected:
         int m_lineNumber;
+        int m_columnNumber;
     };
 
     class ExpressionNode : public Node {
     protected:
-        ExpressionNode(int, ResultType = ResultType::unknownType());
+        ExpressionNode(const JSTokenLocation&, ResultType = ResultType::unknownType());
 
     public:
         virtual bool isNumber() const { return false; }
@@ -175,12 +178,14 @@ namespace JSC {
 
     class StatementNode : public Node {
     protected:
-        StatementNode(int);
+        StatementNode(const JSTokenLocation&);
 
     public:
         JS_EXPORT_PRIVATE void setLoc(int firstLine, int lastLine);
+        void setLoc(int firstLine, int lastLine, int column);
         int firstLine() const { return lineNo(); }
         int lastLine() const { return m_lastLine; }
+        int column() const { return columnNo();}
 
         virtual bool isEmptyStatement() const { return false; }
         virtual bool isReturnNode() const { return false; }
@@ -194,7 +199,7 @@ namespace JSC {
 
     class NullNode : public ExpressionNode {
     public:
-        NullNode(int);
+        NullNode(const JSTokenLocation&);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -204,7 +209,7 @@ namespace JSC {
 
     class BooleanNode : public ExpressionNode {
     public:
-        BooleanNode(int, bool value);
+        BooleanNode(const JSTokenLocation&, bool value);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -216,7 +221,7 @@ namespace JSC {
 
     class NumberNode : public ExpressionNode {
     public:
-        NumberNode(int, double value);
+        NumberNode(const JSTokenLocation&, double value);
 
         double value() const { return m_value; }
         void setValue(double value) { m_value = value; }
@@ -232,7 +237,7 @@ namespace JSC {
 
     class StringNode : public ExpressionNode {
     public:
-        StringNode(int, const Identifier&);
+        StringNode(const JSTokenLocation&, const Identifier&);
 
         const Identifier& value() { return m_value; }
 
@@ -342,7 +347,7 @@ namespace JSC {
 
     class RegExpNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        RegExpNode(int, const Identifier& pattern, const Identifier& flags);
+        RegExpNode(const JSTokenLocation&, const Identifier& pattern, const Identifier& flags);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -353,7 +358,7 @@ namespace JSC {
 
     class ThisNode : public ExpressionNode {
     public:
-        ThisNode(int);
+        ThisNode(const JSTokenLocation&);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -361,7 +366,7 @@ namespace JSC {
 
     class ResolveNode : public ExpressionNode {
     public:
-        ResolveNode(int, const Identifier&, int startOffset);
+        ResolveNode(const JSTokenLocation&, const Identifier&, int startOffset);
 
         const Identifier& identifier() const { return m_ident; }
 
@@ -393,11 +398,11 @@ namespace JSC {
 
     class ArrayNode : public ExpressionNode {
     public:
-        ArrayNode(int, int elision);
-        ArrayNode(int, ElementNode*);
-        ArrayNode(int, int elision, ElementNode*);
+        ArrayNode(const JSTokenLocation&, int elision);
+        ArrayNode(const JSTokenLocation&, ElementNode*);
+        ArrayNode(const JSTokenLocation&, int elision, ElementNode*);
 
-        ArgumentListNode* toArgumentList(JSGlobalData*, int) const;
+        ArgumentListNode* toArgumentList(JSGlobalData*, int, int) const;
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -428,8 +433,8 @@ namespace JSC {
 
     class PropertyListNode : public Node {
     public:
-        PropertyListNode(int, PropertyNode*);
-        PropertyListNode(int, PropertyNode*, PropertyListNode*);
+        PropertyListNode(const JSTokenLocation&, PropertyNode*);
+        PropertyListNode(const JSTokenLocation&, PropertyNode*, PropertyListNode*);
 
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
@@ -440,8 +445,8 @@ namespace JSC {
 
     class ObjectLiteralNode : public ExpressionNode {
     public:
-        ObjectLiteralNode(int);
-        ObjectLiteralNode(int, PropertyListNode*);
+        ObjectLiteralNode(const JSTokenLocation&);
+        ObjectLiteralNode(const JSTokenLocation&, PropertyListNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -451,7 +456,7 @@ namespace JSC {
     
     class BracketAccessorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        BracketAccessorNode(int, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments);
+        BracketAccessorNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments);
 
         ExpressionNode* base() const { return m_base; }
         ExpressionNode* subscript() const { return m_subscript; }
@@ -469,7 +474,7 @@ namespace JSC {
 
     class DotAccessorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DotAccessorNode(int, ExpressionNode* base, const Identifier&);
+        DotAccessorNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&);
 
         ExpressionNode* base() const { return m_base; }
         const Identifier& identifier() const { return m_ident; }
@@ -486,8 +491,8 @@ namespace JSC {
 
     class ArgumentListNode : public Node {
     public:
-        ArgumentListNode(int, ExpressionNode*);
-        ArgumentListNode(int, ArgumentListNode*, ExpressionNode*);
+        ArgumentListNode(const JSTokenLocation&, ExpressionNode*);
+        ArgumentListNode(const JSTokenLocation&, ArgumentListNode*, ExpressionNode*);
 
         ArgumentListNode* m_next;
         ExpressionNode* m_expr;
@@ -506,8 +511,8 @@ namespace JSC {
 
     class NewExprNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        NewExprNode(int, ExpressionNode*);
-        NewExprNode(int, ExpressionNode*, ArgumentsNode*);
+        NewExprNode(const JSTokenLocation&, ExpressionNode*);
+        NewExprNode(const JSTokenLocation&, ExpressionNode*, ArgumentsNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -518,7 +523,7 @@ namespace JSC {
 
     class EvalFunctionCallNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        EvalFunctionCallNode(int, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        EvalFunctionCallNode(const JSTokenLocation&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -528,7 +533,7 @@ namespace JSC {
 
     class FunctionCallValueNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        FunctionCallValueNode(int, ExpressionNode*, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        FunctionCallValueNode(const JSTokenLocation&, ExpressionNode*, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -539,7 +544,7 @@ namespace JSC {
 
     class FunctionCallResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        FunctionCallResolveNode(int, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        FunctionCallResolveNode(const JSTokenLocation&, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -550,7 +555,7 @@ namespace JSC {
     
     class FunctionCallBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        FunctionCallBracketNode(int, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        FunctionCallBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -562,7 +567,7 @@ namespace JSC {
 
     class FunctionCallDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        FunctionCallDotNode(int, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        FunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -575,7 +580,7 @@ namespace JSC {
 
     class CallFunctionCallDotNode : public FunctionCallDotNode {
     public:
-        CallFunctionCallDotNode(int, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        CallFunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -583,7 +588,7 @@ namespace JSC {
     
     class ApplyFunctionCallDotNode : public FunctionCallDotNode {
     public:
-        ApplyFunctionCallDotNode(int, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        ApplyFunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -591,7 +596,7 @@ namespace JSC {
 
     class PrePostResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        PrePostResolveNode(int, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PrePostResolveNode(const JSTokenLocation&, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     protected:
         const Identifier& m_ident;
@@ -599,7 +604,7 @@ namespace JSC {
 
     class PostfixResolveNode : public PrePostResolveNode {
     public:
-        PostfixResolveNode(int, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PostfixResolveNode(const JSTokenLocation&, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -609,7 +614,7 @@ namespace JSC {
 
     class PostfixBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixBracketNode(int, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PostfixBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -621,7 +626,7 @@ namespace JSC {
 
     class PostfixDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixDotNode(int, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PostfixDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -633,7 +638,7 @@ namespace JSC {
 
     class PostfixErrorNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixErrorNode(int, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PostfixErrorNode(const JSTokenLocation&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -643,7 +648,7 @@ namespace JSC {
 
     class DeleteResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteResolveNode(int, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
+        DeleteResolveNode(const JSTokenLocation&, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -653,7 +658,7 @@ namespace JSC {
 
     class DeleteBracketNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteBracketNode(int, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset);
+        DeleteBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -664,7 +669,7 @@ namespace JSC {
 
     class DeleteDotNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteDotNode(int, ExpressionNode* base, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
+        DeleteDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -675,7 +680,7 @@ namespace JSC {
 
     class DeleteValueNode : public ExpressionNode {
     public:
-        DeleteValueNode(int, ExpressionNode*);
+        DeleteValueNode(const JSTokenLocation&, ExpressionNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -685,7 +690,7 @@ namespace JSC {
 
     class VoidNode : public ExpressionNode {
     public:
-        VoidNode(int, ExpressionNode*);
+        VoidNode(const JSTokenLocation&, ExpressionNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -695,7 +700,7 @@ namespace JSC {
 
     class TypeOfResolveNode : public ExpressionNode {
     public:
-        TypeOfResolveNode(int, const Identifier&);
+        TypeOfResolveNode(const JSTokenLocation&, const Identifier&);
 
         const Identifier& identifier() const { return m_ident; }
 
@@ -707,7 +712,7 @@ namespace JSC {
 
     class TypeOfValueNode : public ExpressionNode {
     public:
-        TypeOfValueNode(int, ExpressionNode*);
+        TypeOfValueNode(const JSTokenLocation&, ExpressionNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -717,7 +722,7 @@ namespace JSC {
 
     class PrefixResolveNode : public PrePostResolveNode {
     public:
-        PrefixResolveNode(int, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PrefixResolveNode(const JSTokenLocation&, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -727,7 +732,7 @@ namespace JSC {
 
     class PrefixBracketNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
     public:
-        PrefixBracketNode(int, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PrefixBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -739,7 +744,7 @@ namespace JSC {
 
     class PrefixDotNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
     public:
-        PrefixDotNode(int, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PrefixDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -751,7 +756,7 @@ namespace JSC {
 
     class PrefixErrorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        PrefixErrorNode(int, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PrefixErrorNode(const JSTokenLocation&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -761,7 +766,7 @@ namespace JSC {
 
     class UnaryOpNode : public ExpressionNode {
     public:
-        UnaryOpNode(int, ResultType, ExpressionNode*, OpcodeID);
+        UnaryOpNode(const JSTokenLocation&, ResultType, ExpressionNode*, OpcodeID);
 
     protected:
         ExpressionNode* expr() { return m_expr; }
@@ -778,7 +783,7 @@ namespace JSC {
 
     class UnaryPlusNode : public UnaryOpNode {
     public:
-        UnaryPlusNode(int, ExpressionNode*);
+        UnaryPlusNode(const JSTokenLocation&, ExpressionNode*);
 
     private:
         virtual ExpressionNode* stripUnaryPlus() { return expr(); }
@@ -786,12 +791,12 @@ namespace JSC {
 
     class NegateNode : public UnaryOpNode {
     public:
-        NegateNode(int, ExpressionNode*);
+        NegateNode(const JSTokenLocation&, ExpressionNode*);
     };
 
     class BitwiseNotNode : public ExpressionNode {
     public:
-        BitwiseNotNode(int, ExpressionNode*);
+        BitwiseNotNode(const JSTokenLocation&, ExpressionNode*);
 
     protected:
         ExpressionNode* expr() { return m_expr; }
@@ -805,7 +810,7 @@ namespace JSC {
  
     class LogicalNotNode : public UnaryOpNode {
     public:
-        LogicalNotNode(int, ExpressionNode*);
+        LogicalNotNode(const JSTokenLocation&, ExpressionNode*);
     private:
         void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue);
         virtual bool hasConditionContextCodegen() const { return expr()->hasConditionContextCodegen(); }
@@ -813,8 +818,8 @@ namespace JSC {
 
     class BinaryOpNode : public ExpressionNode {
     public:
-        BinaryOpNode(int, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
-        BinaryOpNode(int, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        BinaryOpNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        BinaryOpNode(const JSTokenLocation&, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
 
         RegisterID* emitStrcat(BytecodeGenerator& generator, RegisterID* destination, RegisterID* lhs = 0, ReadModifyResolveNode* emitExpressionInfoForMe = 0);
 
@@ -838,72 +843,72 @@ namespace JSC {
 
     class MultNode : public BinaryOpNode {
     public:
-        MultNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        MultNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class DivNode : public BinaryOpNode {
     public:
-        DivNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        DivNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class ModNode : public BinaryOpNode {
     public:
-        ModNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        ModNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class AddNode : public BinaryOpNode {
     public:
-        AddNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        AddNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
         virtual bool isAdd() const { return true; }
     };
 
     class SubNode : public BinaryOpNode {
     public:
-        SubNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        SubNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
         virtual bool isSubtract() const { return true; }
     };
 
     class LeftShiftNode : public BinaryOpNode {
     public:
-        LeftShiftNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        LeftShiftNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class RightShiftNode : public BinaryOpNode {
     public:
-        RightShiftNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        RightShiftNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class UnsignedRightShiftNode : public BinaryOpNode {
     public:
-        UnsignedRightShiftNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        UnsignedRightShiftNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class LessNode : public BinaryOpNode {
     public:
-        LessNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        LessNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class GreaterNode : public BinaryOpNode {
     public:
-        GreaterNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        GreaterNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class LessEqNode : public BinaryOpNode {
     public:
-        LessEqNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        LessEqNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class GreaterEqNode : public BinaryOpNode {
     public:
-        GreaterEqNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        GreaterEqNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class ThrowableBinaryOpNode : public BinaryOpNode, public ThrowableExpressionData {
     public:
-        ThrowableBinaryOpNode(int, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
-        ThrowableBinaryOpNode(int, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        ThrowableBinaryOpNode(const JSTokenLocation&, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        ThrowableBinaryOpNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -911,7 +916,7 @@ namespace JSC {
     
     class InstanceOfNode : public ThrowableBinaryOpNode {
     public:
-        InstanceOfNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        InstanceOfNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -919,12 +924,12 @@ namespace JSC {
 
     class InNode : public ThrowableBinaryOpNode {
     public:
-        InNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        InNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class EqualNode : public BinaryOpNode {
     public:
-        EqualNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        EqualNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -932,12 +937,12 @@ namespace JSC {
 
     class NotEqualNode : public BinaryOpNode {
     public:
-        NotEqualNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        NotEqualNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class StrictEqualNode : public BinaryOpNode {
     public:
-        StrictEqualNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        StrictEqualNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -945,28 +950,28 @@ namespace JSC {
 
     class NotStrictEqualNode : public BinaryOpNode {
     public:
-        NotStrictEqualNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        NotStrictEqualNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitAndNode : public BinaryOpNode {
     public:
-        BitAndNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        BitAndNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitOrNode : public BinaryOpNode {
     public:
-        BitOrNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        BitOrNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitXOrNode : public BinaryOpNode {
     public:
-        BitXOrNode(int, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+        BitXOrNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     // m_expr1 && m_expr2, m_expr1 || m_expr2
     class LogicalOpNode : public ExpressionNode {
     public:
-        LogicalOpNode(int, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator);
+        LogicalOpNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -981,7 +986,7 @@ namespace JSC {
     // The ternary operator, "m_logical ? m_expr1 : m_expr2"
     class ConditionalNode : public ExpressionNode {
     public:
-        ConditionalNode(int, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2);
+        ConditionalNode(const JSTokenLocation&, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -993,7 +998,7 @@ namespace JSC {
 
     class ReadModifyResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        ReadModifyResolveNode(int, const Identifier&, Operator, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
+        ReadModifyResolveNode(const JSTokenLocation&, const Identifier&, Operator, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1006,7 +1011,7 @@ namespace JSC {
 
     class AssignResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignResolveNode(int, const Identifier&, ExpressionNode* right);
+        AssignResolveNode(const JSTokenLocation&, const Identifier&, ExpressionNode* right);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1017,7 +1022,7 @@ namespace JSC {
 
     class ReadModifyBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        ReadModifyBracketNode(int, ExpressionNode* base, ExpressionNode* subscript, Operator, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
+        ReadModifyBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, Operator, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1032,7 +1037,7 @@ namespace JSC {
 
     class AssignBracketNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignBracketNode(int, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
+        AssignBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1046,7 +1051,7 @@ namespace JSC {
 
     class AssignDotNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignDotNode(int, ExpressionNode* base, const Identifier&, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
+        AssignDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1059,7 +1064,7 @@ namespace JSC {
 
     class ReadModifyDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        ReadModifyDotNode(int, ExpressionNode* base, const Identifier&, Operator, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
+        ReadModifyDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, Operator, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1073,7 +1078,7 @@ namespace JSC {
 
     class AssignErrorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignErrorNode(int, unsigned divot, unsigned startOffset, unsigned endOffset);
+        AssignErrorNode(const JSTokenLocation&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1083,7 +1088,7 @@ namespace JSC {
 
     class CommaNode : public ExpressionNode, public ParserArenaDeletable {
     public:
-        CommaNode(int, ExpressionNode* expr1, ExpressionNode* expr2);
+        CommaNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2);
 
         using ParserArenaDeletable::operator new;
 
@@ -1098,7 +1103,7 @@ namespace JSC {
     
     class ConstDeclNode : public ExpressionNode {
     public:
-        ConstDeclNode(int, const Identifier&, ExpressionNode*);
+        ConstDeclNode(const JSTokenLocation&, const Identifier&, ExpressionNode*);
 
         bool hasInitializer() const { return m_init; }
         const Identifier& ident() { return m_ident; }
@@ -1118,7 +1123,7 @@ namespace JSC {
 
     class ConstStatementNode : public StatementNode {
     public:
-        ConstStatementNode(int, ConstDeclNode* next);
+        ConstStatementNode(const JSTokenLocation&, ConstDeclNode* next);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1143,7 +1148,7 @@ namespace JSC {
 
     class BlockNode : public StatementNode {
     public:
-        BlockNode(int, SourceElements* = 0);
+        BlockNode(const JSTokenLocation&, SourceElements* = 0);
 
         StatementNode* singleStatement() const;
         StatementNode* lastStatement() const;
@@ -1158,7 +1163,7 @@ namespace JSC {
 
     class EmptyStatementNode : public StatementNode {
     public:
-        EmptyStatementNode(int);
+        EmptyStatementNode(const JSTokenLocation&);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1168,7 +1173,7 @@ namespace JSC {
     
     class DebuggerStatementNode : public StatementNode {
     public:
-        DebuggerStatementNode(int);
+        DebuggerStatementNode(const JSTokenLocation&);
         
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1176,7 +1181,7 @@ namespace JSC {
 
     class ExprStatementNode : public StatementNode {
     public:
-        ExprStatementNode(int, ExpressionNode*);
+        ExprStatementNode(const JSTokenLocation&, ExpressionNode*);
 
         ExpressionNode* expr() const { return m_expr; }
 
@@ -1190,8 +1195,7 @@ namespace JSC {
 
     class VarStatementNode : public StatementNode {
     public:
-        VarStatementNode(int, ExpressionNode*);        
-
+        VarStatementNode(const JSTokenLocation&, ExpressionNode*);
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
@@ -1200,7 +1204,7 @@ namespace JSC {
 
     class IfNode : public StatementNode {
     public:
-        IfNode(int, ExpressionNode* condition, StatementNode* ifBlock);
+        IfNode(const JSTokenLocation&, ExpressionNode* condition, StatementNode* ifBlock);
 
     protected:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1211,7 +1215,7 @@ namespace JSC {
 
     class IfElseNode : public IfNode {
     public:
-        IfElseNode(int, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock);
+        IfElseNode(const JSTokenLocation&, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1221,7 +1225,7 @@ namespace JSC {
 
     class DoWhileNode : public StatementNode {
     public:
-        DoWhileNode(int, StatementNode*, ExpressionNode*);
+        DoWhileNode(const JSTokenLocation&, StatementNode*, ExpressionNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1232,7 +1236,7 @@ namespace JSC {
 
     class WhileNode : public StatementNode {
     public:
-        WhileNode(int, ExpressionNode*, StatementNode*);
+        WhileNode(const JSTokenLocation&, ExpressionNode*, StatementNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1243,7 +1247,7 @@ namespace JSC {
 
     class ForNode : public StatementNode {
     public:
-        ForNode(int, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode*);
+        ForNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1256,8 +1260,8 @@ namespace JSC {
 
     class ForInNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ForInNode(int, ExpressionNode*, ExpressionNode*, StatementNode*);
-        ForInNode(JSGlobalData*, int, const Identifier&, ExpressionNode*, ExpressionNode*, StatementNode*, int divot, int startOffset, int endOffset);
+        ForInNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*);
+        ForInNode(JSGlobalData*, const JSTokenLocation&, const Identifier&, ExpressionNode*, ExpressionNode*, StatementNode*, int divot, int startOffset, int endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1271,8 +1275,8 @@ namespace JSC {
 
     class ContinueNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ContinueNode(JSGlobalData*, int);
-        ContinueNode(int, const Identifier&);
+        ContinueNode(JSGlobalData*, const JSTokenLocation&);
+        ContinueNode(const JSTokenLocation&, const Identifier&);
         
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1282,8 +1286,8 @@ namespace JSC {
 
     class BreakNode : public StatementNode, public ThrowableExpressionData {
     public:
-        BreakNode(JSGlobalData*, int);
-        BreakNode(int, const Identifier&);
+        BreakNode(JSGlobalData*, const JSTokenLocation&);
+        BreakNode(const JSTokenLocation&, const Identifier&);
         
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1293,7 +1297,7 @@ namespace JSC {
 
     class ReturnNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ReturnNode(int, ExpressionNode* value);
+        ReturnNode(const JSTokenLocation&, ExpressionNode* value);
 
         ExpressionNode* value() { return m_value; }
 
@@ -1307,7 +1311,7 @@ namespace JSC {
 
     class WithNode : public StatementNode {
     public:
-        WithNode(int, ExpressionNode*, StatementNode*, uint32_t divot, uint32_t expressionLength);
+        WithNode(const JSTokenLocation&, ExpressionNode*, StatementNode*, uint32_t divot, uint32_t expressionLength);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1320,7 +1324,7 @@ namespace JSC {
 
     class LabelNode : public StatementNode, public ThrowableExpressionData {
     public:
-        LabelNode(int, const Identifier& name, StatementNode*);
+        LabelNode(const JSTokenLocation&, const Identifier& name, StatementNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1331,7 +1335,7 @@ namespace JSC {
 
     class ThrowNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ThrowNode(int, ExpressionNode*);
+        ThrowNode(const JSTokenLocation&, ExpressionNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1341,7 +1345,7 @@ namespace JSC {
 
     class TryNode : public StatementNode {
     public:
-        TryNode(int, StatementNode* tryBlock, const Identifier& exceptionIdent, StatementNode* catchBlock, StatementNode* finallyBlock);
+        TryNode(const JSTokenLocation&, StatementNode* tryBlock, const Identifier& exceptionIdent, StatementNode* catchBlock, StatementNode* finallyBlock);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1370,8 +1374,8 @@ namespace JSC {
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
 
-        ScopeNode(JSGlobalData*, int, bool inStrictContext);
-        ScopeNode(JSGlobalData*, int, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, CodeFeatures, int numConstants);
+        ScopeNode(JSGlobalData*, const JSTokenLocation&, bool inStrictContext);
+        ScopeNode(JSGlobalData*, const JSTokenLocation&, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, CodeFeatures, int numConstants);
 
         using ParserArenaRefCounted::operator new;
 
@@ -1433,12 +1437,12 @@ namespace JSC {
     class ProgramNode : public ScopeNode {
     public:
         static const bool isFunctionNode = false;
-        static PassRefPtr<ProgramNode> create(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        static PassRefPtr<ProgramNode> create(JSGlobalData*, const JSTokenLocation&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
 
         static const bool scopeIsFunction = false;
 
     private:
-        ProgramNode(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        ProgramNode(JSGlobalData*, const JSTokenLocation&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
 
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
@@ -1446,12 +1450,12 @@ namespace JSC {
     class EvalNode : public ScopeNode {
     public:
         static const bool isFunctionNode = false;
-        static PassRefPtr<EvalNode> create(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        static PassRefPtr<EvalNode> create(JSGlobalData*, const JSTokenLocation&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
 
         static const bool scopeIsFunction = false;
 
     private:
-        EvalNode(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        EvalNode(JSGlobalData*, const JSTokenLocation&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
 
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
@@ -1468,8 +1472,8 @@ namespace JSC {
     class FunctionBodyNode : public ScopeNode {
     public:
         static const bool isFunctionNode = true;
-        static FunctionBodyNode* create(JSGlobalData*, int, bool isStrictMode);
-        static PassRefPtr<FunctionBodyNode> create(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        static FunctionBodyNode* create(JSGlobalData*, const JSTokenLocation&, bool isStrictMode);
+        static PassRefPtr<FunctionBodyNode> create(JSGlobalData*, const JSTokenLocation&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
 
         FunctionParameters* parameters() const { return m_parameters.get(); }
         size_t parameterCount() const { return m_parameters->size(); }
@@ -1486,8 +1490,8 @@ namespace JSC {
         static const bool scopeIsFunction = true;
 
     private:
-        FunctionBodyNode(JSGlobalData*, int, bool inStrictContext);
-        FunctionBodyNode(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        FunctionBodyNode(JSGlobalData*, const JSTokenLocation&, bool inStrictContext);
+        FunctionBodyNode(JSGlobalData*, const JSTokenLocation&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
 
         Identifier m_ident;
         Identifier m_inferredName;
@@ -1496,7 +1500,7 @@ namespace JSC {
 
     class FuncExprNode : public ExpressionNode {
     public:
-        FuncExprNode(int, const Identifier&, FunctionBodyNode*, const SourceCode&, ParameterNode* = 0);
+        FuncExprNode(const JSTokenLocation&, const Identifier&, FunctionBodyNode*, const SourceCode&, ParameterNode* = 0);
 
         FunctionBodyNode* body() { return m_body; }
 
@@ -1510,7 +1514,7 @@ namespace JSC {
 
     class FuncDeclNode : public StatementNode {
     public:
-        FuncDeclNode(int, const Identifier&, FunctionBodyNode*, const SourceCode&, ParameterNode* = 0);
+        FuncDeclNode(const JSTokenLocation&, const Identifier&, FunctionBodyNode*, const SourceCode&, ParameterNode* = 0);
 
         FunctionBodyNode* body() { return m_body; }
 
@@ -1561,7 +1565,7 @@ namespace JSC {
 
     class SwitchNode : public StatementNode {
     public:
-        SwitchNode(int, ExpressionNode*, CaseBlockNode*);
+        SwitchNode(const JSTokenLocation&, ExpressionNode*, CaseBlockNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
diff --git a/Source/JavaScriptCore/parser/Parser.cpp b/Source/JavaScriptCore/parser/Parser.cpp
index 558f50e5f..4fd671fb7 100644
--- a/Source/JavaScriptCore/parser/Parser.cpp
+++ b/Source/JavaScriptCore/parser/Parser.cpp
@@ -138,7 +138,7 @@ template <SourceElementsMode mode, class TreeBuilder> TreeSourceElements Parser<
     bool seenNonDirective = false;
     const Identifier* directive = 0;
     unsigned directiveLiteralLength = 0;
-    unsigned startOffset = m_token.m_info.startOffset;
+    unsigned startOffset = m_token.m_location.startOffset;
     unsigned oldLastLineNumber = m_lexer->lastLineNumber();
     unsigned oldLineNumber = m_lexer->lineNumber();
     bool hasSetStrict = false;
@@ -172,6 +172,7 @@ template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVarDeclaration(TreeBuilder& context)
 {
     ASSERT(match(VAR));
+    JSTokenLocation location(tokenLocation());
     int start = tokenLine();
     int end = 0;
     int scratch;
@@ -182,20 +183,21 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVarDeclaratio
     failIfTrue(m_error);
     failIfFalse(autoSemiColon());
     
-    return context.createVarStatement(m_lexer->lastLineNumber(), varDecls, start, end);
+    return context.createVarStatement(location, varDecls, start, end);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseConstDeclaration(TreeBuilder& context)
 {
     ASSERT(match(CONSTTOKEN));
+    JSTokenLocation location(tokenLocation());
     int start = tokenLine();
     int end = 0;
     TreeConstDeclList constDecls = parseConstDeclarationList(context);
     failIfTrue(m_error);
     failIfFalse(autoSemiColon());
     
-    return context.createConstStatement(m_lexer->lastLineNumber(), constDecls, start, end);
+    return context.createConstStatement(location, constDecls, start, end);
 }
 
 template <typename LexerType>
@@ -210,6 +212,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseDoWhileStatem
     endLoop();
     failIfFalse(statement);
     int endLine = tokenLine();
+    JSTokenLocation location(tokenLocation());
     consumeOrFail(WHILE);
     consumeOrFail(OPENPAREN);
     TreeExpression expr = parseExpression(context);
@@ -217,13 +220,14 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseDoWhileStatem
     consumeOrFail(CLOSEPAREN);
     if (match(SEMICOLON))
         next(); // Always performs automatic semicolon insertion.
-    return context.createDoWhileStatement(m_lexer->lastLineNumber(), statement, expr, startLine, endLine);
+    return context.createDoWhileStatement(location, statement, expr, startLine, endLine);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseWhileStatement(TreeBuilder& context)
 {
     ASSERT(match(WHILE));
+    JSTokenLocation location(tokenLocation());
     int startLine = tokenLine();
     next();
     consumeOrFail(OPENPAREN);
@@ -236,7 +240,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseWhileStatemen
     TreeStatement statement = parseStatement(context, unused);
     endLoop();
     failIfFalse(statement);
-    return context.createWhileStatement(m_lexer->lastLineNumber(), expr, statement, startLine, endLine);
+    return context.createWhileStatement(location, expr, statement, startLine, endLine);
 }
 
 template <typename LexerType>
@@ -245,6 +249,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarati
     TreeExpression varDecls = 0;
     do {
         declarations++;
+        JSTokenLocation location(tokenLocation());
         next();
         matchOrFail(IDENT);
         
@@ -265,11 +270,11 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarati
             lastInitializer = initializer;
             failIfFalse(initializer);
             
-            TreeExpression node = context.createAssignResolve(m_lexer->lastLineNumber(), *name, initializer, varStart, varDivot, lastTokenEnd());
+            TreeExpression node = context.createAssignResolve(location, *name, initializer, varStart, varDivot, lastTokenEnd());
             if (!varDecls)
                 varDecls = node;
             else
-                varDecls = context.combineCommaNodes(m_lexer->lastLineNumber(), varDecls, node);
+                varDecls = context.combineCommaNodes(location, varDecls, node);
         }
     } while (match(COMMA));
     return varDecls;
@@ -282,6 +287,7 @@ template <class TreeBuilder> TreeConstDeclList Parser<LexerType>::parseConstDecl
     TreeConstDeclList constDecls = 0;
     TreeConstDeclList tail = 0;
     do {
+        JSTokenLocation location(tokenLocation());
         next();
         matchOrFail(IDENT);
         const Identifier* name = m_token.m_data.ident;
@@ -294,7 +300,7 @@ template <class TreeBuilder> TreeConstDeclList Parser<LexerType>::parseConstDecl
             next(TreeBuilder::DontBuildStrings); // consume '='
             initializer = parseAssignmentExpression(context);
         }
-        tail = context.appendConstDecl(m_lexer->lastLineNumber(), tail, name, initializer);
+        tail = context.appendConstDecl(location, tail, name, initializer);
         if (!constDecls)
             constDecls = tail;
     } while (match(COMMA));
@@ -305,6 +311,7 @@ template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseForStatement(TreeBuilder& context)
 {
     ASSERT(match(FOR));
+    JSTokenLocation location(tokenLocation());
     int startLine = tokenLine();
     next();
     consumeOrFail(OPENPAREN);
@@ -352,7 +359,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseForStatement(
         endLoop();
         failIfFalse(statement);
         
-        return context.createForInLoop(m_lexer->lastLineNumber(), forInTarget, forInInitializer, expr, statement, declsStart, inLocation, exprEnd, initStart, initEnd, startLine, endLine);
+        return context.createForInLoop(location, forInTarget, forInInitializer, expr, statement, declsStart, inLocation, exprEnd, initStart, initEnd, startLine, endLine);
     }
     
     if (!match(SEMICOLON)) {
@@ -388,7 +395,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseForStatement(
         TreeStatement statement = parseStatement(context, unused);
         endLoop();
         failIfFalse(statement);
-        return context.createForLoop(m_lexer->lastLineNumber(), decls, condition, increment, statement, startLine, endLine);
+        return context.createForLoop(location, decls, condition, increment, statement, startLine, endLine);
     }
     
     // For-in loop
@@ -405,13 +412,14 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseForStatement(
     endLoop();
     failIfFalse(statement);
     
-    return context.createForInLoop(m_lexer->lastLineNumber(), decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
+    return context.createForInLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBreakStatement(TreeBuilder& context)
 {
     ASSERT(match(BREAK));
+    JSTokenLocation location(tokenLocation());
     int startCol = tokenStart();
     int endCol = tokenEnd();
     int startLine = tokenLine();
@@ -420,7 +428,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBreakStatemen
     
     if (autoSemiColon()) {
         failIfFalseWithMessage(breakIsValid(), "'break' is only valid inside a switch or loop statement");
-        return context.createBreakStatement(m_lexer->lastLineNumber(), startCol, endCol, startLine, endLine);
+        return context.createBreakStatement(location, startCol, endCol, startLine, endLine);
     }
     matchOrFail(IDENT);
     const Identifier* ident = m_token.m_data.ident;
@@ -429,13 +437,14 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBreakStatemen
     endLine = tokenLine();
     next();
     failIfFalse(autoSemiColon());
-    return context.createBreakStatement(m_lexer->lastLineNumber(), ident, startCol, endCol, startLine, endLine);
+    return context.createBreakStatement(location, ident, startCol, endCol, startLine, endLine);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseContinueStatement(TreeBuilder& context)
 {
     ASSERT(match(CONTINUE));
+    JSTokenLocation location(tokenLocation());
     int startCol = tokenStart();
     int endCol = tokenEnd();
     int startLine = tokenLine();
@@ -444,7 +453,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseContinueState
     
     if (autoSemiColon()) {
         failIfFalseWithMessage(continueIsValid(), "'continue' is only valid inside a loop statement");
-        return context.createContinueStatement(m_lexer->lastLineNumber(), startCol, endCol, startLine, endLine);
+        return context.createContinueStatement(location, startCol, endCol, startLine, endLine);
     }
     matchOrFail(IDENT);
     const Identifier* ident = m_token.m_data.ident;
@@ -455,13 +464,14 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseContinueState
     endLine = tokenLine();
     next();
     failIfFalse(autoSemiColon());
-    return context.createContinueStatement(m_lexer->lastLineNumber(), ident, startCol, endCol, startLine, endLine);
+    return context.createContinueStatement(location, ident, startCol, endCol, startLine, endLine);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseReturnStatement(TreeBuilder& context)
 {
     ASSERT(match(RETURN));
+    JSTokenLocation location(tokenLocation());
     failIfFalse(currentScope()->isFunction());
     int startLine = tokenLine();
     int endLine = startLine;
@@ -474,20 +484,21 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseReturnStateme
     if (match(SEMICOLON))
         endLine  = tokenLine();
     if (autoSemiColon())
-        return context.createReturnStatement(m_lexer->lastLineNumber(), 0, start, end, startLine, endLine);
+        return context.createReturnStatement(location, 0, start, end, startLine, endLine);
     TreeExpression expr = parseExpression(context);
     failIfFalse(expr);
     end = lastTokenEnd();
     if (match(SEMICOLON))
         endLine  = tokenLine();
     failIfFalse(autoSemiColon());
-    return context.createReturnStatement(m_lexer->lastLineNumber(), expr, start, end, startLine, endLine);
+    return context.createReturnStatement(location, expr, start, end, startLine, endLine);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseThrowStatement(TreeBuilder& context)
 {
     ASSERT(match(THROW));
+    JSTokenLocation location(tokenLocation());
     int eStart = tokenStart();
     int startLine = tokenLine();
     next();
@@ -500,13 +511,14 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseThrowStatemen
     int endLine = tokenLine();
     failIfFalse(autoSemiColon());
     
-    return context.createThrowStatement(m_lexer->lastLineNumber(), expr, eStart, eEnd, startLine, endLine);
+    return context.createThrowStatement(location, expr, eStart, eEnd, startLine, endLine);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseWithStatement(TreeBuilder& context)
 {
     ASSERT(match(WITH));
+    JSTokenLocation location(tokenLocation());
     failIfTrueWithMessage(strictMode(), "'with' statements are not valid in strict mode");
     currentScope()->setNeedsFullActivation();
     int startLine = tokenLine();
@@ -523,13 +535,14 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseWithStatement
     TreeStatement statement = parseStatement(context, unused);
     failIfFalse(statement);
     
-    return context.createWithStatement(m_lexer->lastLineNumber(), expr, statement, start, end, startLine, endLine);
+    return context.createWithStatement(location, expr, statement, start, end, startLine, endLine);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseSwitchStatement(TreeBuilder& context)
 {
     ASSERT(match(SWITCH));
+    JSTokenLocation location(tokenLocation());
     int startLine = tokenLine();
     next();
     consumeOrFail(OPENPAREN);
@@ -550,7 +563,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseSwitchStateme
     endSwitch();
     consumeOrFail(CLOSEBRACE);
     
-    return context.createSwitchStatement(m_lexer->lastLineNumber(), expr, firstClauses, defaultClause, secondClauses, startLine, endLine);
+    return context.createSwitchStatement(location, expr, firstClauses, defaultClause, secondClauses, startLine, endLine);
     
 }
 
@@ -598,6 +611,7 @@ template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseTryStatement(TreeBuilder& context)
 {
     ASSERT(match(TRY));
+    JSTokenLocation location(tokenLocation());
     TreeStatement tryBlock = 0;
     const Identifier* ident = &m_globalData->propertyNames->nullIdentifier;
     TreeStatement catchBlock = 0;
@@ -634,37 +648,39 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseTryStatement(
         failIfFalse(finallyBlock);
     }
     failIfFalse(catchBlock || finallyBlock);
-    return context.createTryStatement(m_lexer->lastLineNumber(), tryBlock, ident, catchBlock, finallyBlock, firstLine, lastLine);
+    return context.createTryStatement(location, tryBlock, ident, catchBlock, finallyBlock, firstLine, lastLine);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseDebuggerStatement(TreeBuilder& context)
 {
     ASSERT(match(DEBUGGER));
+    JSTokenLocation location(tokenLocation());
     int startLine = tokenLine();
     int endLine = startLine;
     next();
     if (match(SEMICOLON))
         startLine = tokenLine();
     failIfFalse(autoSemiColon());
-    return context.createDebugger(m_lexer->lastLineNumber(), startLine, endLine);
+    return context.createDebugger(location, startLine, endLine);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBlockStatement(TreeBuilder& context)
 {
     ASSERT(match(OPENBRACE));
+    JSTokenLocation location(tokenLocation());
     int start = tokenLine();
     next();
     if (match(CLOSEBRACE)) {
         next();
-        return context.createBlockStatement(m_lexer->lastLineNumber(), 0, start, m_lastLine);
+        return context.createBlockStatement(location, 0, start, m_lastLine);
     }
     TreeSourceElements subtree = parseSourceElements<DontCheckForStrictMode>(context);
     failIfFalse(subtree);
     matchOrFail(CLOSEBRACE);
     next();
-    return context.createBlockStatement(m_lexer->lastLineNumber(), subtree, start, m_lastLine);
+    return context.createBlockStatement(location, subtree, start, m_lastLine);
 }
 
 template <typename LexerType>
@@ -685,9 +701,11 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseStatement(Tre
     case FUNCTION:
         failIfFalseIfStrictWithMessage(m_statementDepth == 1, "Functions cannot be declared in a nested block in strict mode");
         return parseFunctionDeclaration(context);
-    case SEMICOLON:
+    case SEMICOLON: {
+        JSTokenLocation location(tokenLocation());
         next();
-        return context.createEmptyStatement(m_lexer->lastLineNumber());
+        return context.createEmptyStatement(location);
+    }
     case IF:
         return parseIfStatement(context);
     case DO:
@@ -723,7 +741,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseStatement(Tre
     case STRING:
         directive = m_token.m_data.ident;
         if (directiveLiteralLength)
-            *directiveLiteralLength = m_token.m_info.endOffset - m_token.m_info.startOffset;
+            *directiveLiteralLength = m_token.m_location.endOffset - m_token.m_location.startOffset;
         nonTrivialExpressionCount = m_nonTrivialExpressionCount;
     default:
         TreeStatement exprStatement = parseExpressionStatement(context);
@@ -756,12 +774,12 @@ template <typename LexerType>
 template <class TreeBuilder> TreeFunctionBody Parser<LexerType>::parseFunctionBody(TreeBuilder& context)
 {
     if (match(CLOSEBRACE))
-        return context.createFunctionBody(m_lexer->lastLineNumber(), strictMode());
+        return context.createFunctionBody(tokenLocation(), strictMode());
     DepthManager statementDepth(&m_statementDepth);
     m_statementDepth = 0;
     typename TreeBuilder::FunctionBodyBuilder bodyBuilder(const_cast<JSGlobalData*>(m_globalData), m_lexer.get());
     failIfFalse(parseSourceElements<CheckForStrictMode>(bodyBuilder));
-    return context.createFunctionBody(m_lexer->lastLineNumber(), strictMode());
+    return context.createFunctionBody(tokenLocation(), strictMode());
 }
 
 template <typename LexerType>
@@ -786,20 +804,21 @@ template <FunctionRequirements requirements, bool nameIsInContainingScope, class
     
     openBracePos = m_token.m_data.intValue;
     bodyStartLine = tokenLine();
+    JSTokenLocation location(tokenLocation());
     
     // If we know about this function already, we can use the cached info and skip the parser to the end of the function.
     if (const SourceProviderCacheItem* cachedInfo = TreeBuilder::CanUseFunctionCache ? findCachedFunctionInfo(openBracePos) : 0) {
         // If we're in a strict context, the cached function info must say it was strict too.
         ASSERT(!strictMode() || cachedInfo->strictMode);
-        body = context.createFunctionBody(m_lexer->lastLineNumber(), cachedInfo->strictMode);
+        body = context.createFunctionBody(location, cachedInfo->strictMode);
         
         functionScope->restoreFunctionInfo(cachedInfo);
         failIfFalse(popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo));
         
         closeBracePos = cachedInfo->closeBracePos;
         m_token = cachedInfo->closeBraceToken();
-        m_lexer->setOffset(m_token.m_info.endOffset);
-        m_lexer->setLineNumber(m_token.m_info.line);
+        m_lexer->setOffset(m_token.m_location.endOffset);
+        m_lexer->setLineNumber(m_token.m_location.line);
         
         next();
         return true;
@@ -821,7 +840,7 @@ template <FunctionRequirements requirements, bool nameIsInContainingScope, class
     OwnPtr<SourceProviderCacheItem> newInfo;
     int functionLength = closeBracePos - openBracePos;
     if (TreeBuilder::CanUseFunctionCache && m_functionCache && functionLength > minimumFunctionLengthToCache) {
-        newInfo = adoptPtr(new SourceProviderCacheItem(m_token.m_info.line, closeBracePos));
+        newInfo = adoptPtr(new SourceProviderCacheItem(m_token.m_location.line, closeBracePos));
         functionScope->saveFunctionInfo(newInfo.get());
     }
     
@@ -841,6 +860,7 @@ template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseFunctionDeclaration(TreeBuilder& context)
 {
     ASSERT(match(FUNCTION));
+    JSTokenLocation location(tokenLocation());
     next();
     const Identifier* name = 0;
     TreeFormalParameterList parameters = 0;
@@ -851,7 +871,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseFunctionDecla
     failIfFalse((parseFunctionInfo<FunctionNeedsName, true>(context, name, parameters, body, openBracePos, closeBracePos, bodyStartLine)));
     failIfFalse(name);
     failIfFalseIfStrict(declareVariable(name));
-    return context.createFuncDeclStatement(m_lexer->lastLineNumber(), name, body, parameters, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
+    return context.createFuncDeclStatement(location, name, body, parameters, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
 }
 
 struct LabelInfo {
@@ -875,10 +895,11 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseExpressionOrL
      * special case that looks for a colon as the next character in the input.
      */
     Vector<LabelInfo> labels;
-    
+    JSTokenLocation location;
     do {
         int start = tokenStart();
         int startLine = tokenLine();
+        location = tokenLocation();
         if (!nextTokenIsColon()) {
             // If we hit this path we're making a expression statement, which
             // by definition can't make use of continue/break so we can just
@@ -886,7 +907,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseExpressionOrL
             TreeExpression expression = parseExpression(context);
             failIfFalse(expression);
             failIfFalse(autoSemiColon());
-            return context.createExprStatement(m_lexer->lastLineNumber(), expression, startLine, m_lastLine);
+            return context.createExprStatement(location, expression, startLine, m_lastLine);
         }
         const Identifier* ident = m_token.m_data.ident;
         int end = tokenEnd();
@@ -925,7 +946,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseExpressionOrL
     failIfFalse(statement);
     for (size_t i = 0; i < labels.size(); i++) {
         const LabelInfo& info = labels[labels.size() - i - 1];
-        statement = context.createLabelStatement(m_lexer->lastLineNumber(), info.m_ident, statement, info.m_start, info.m_end);
+        statement = context.createLabelStatement(location, info.m_ident, statement, info.m_start, info.m_end);
     }
     return statement;
 }
@@ -934,39 +955,42 @@ template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseExpressionStatement(TreeBuilder& context)
 {
     int startLine = tokenLine();
+    JSTokenLocation location(tokenLocation());
     TreeExpression expression = parseExpression(context);
     failIfFalse(expression);
     failIfFalse(autoSemiColon());
-    return context.createExprStatement(m_lexer->lastLineNumber(), expression, startLine, m_lastLine);
+    return context.createExprStatement(location, expression, startLine, m_lastLine);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeStatement Parser<LexerType>::parseIfStatement(TreeBuilder& context)
 {
     ASSERT(match(IF));
-    
+    JSTokenLocation ifLocation(tokenLocation());
     int start = tokenLine();
     next();
-    
+
     consumeOrFail(OPENPAREN);
-    
+
     TreeExpression condition = parseExpression(context);
     failIfFalse(condition);
     int end = tokenLine();
     consumeOrFail(CLOSEPAREN);
-    
+
     const Identifier* unused = 0;
     TreeStatement trueBlock = parseStatement(context, unused);
     failIfFalse(trueBlock);
-    
+
     if (!match(ELSE))
-        return context.createIfStatement(m_lexer->lastLineNumber(), condition, trueBlock, start, end);
-    
+        return context.createIfStatement(ifLocation, condition, trueBlock, start, end);
+
     Vector<TreeExpression> exprStack;
     Vector<pair<int, int> > posStack;
+    Vector<JSTokenLocation> tokenLocationStack;
     Vector<TreeStatement> statementStack;
     bool trailingElse = false;
     do {
+        JSTokenLocation tempLocation = tokenLocation();
         next();
         if (!match(IF)) {
             const Identifier* unused = 0;
@@ -978,21 +1002,22 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseIfStatement(T
         }
         int innerStart = tokenLine();
         next();
-        
+
         consumeOrFail(OPENPAREN);
-        
+
         TreeExpression innerCondition = parseExpression(context);
         failIfFalse(innerCondition);
         int innerEnd = tokenLine();
         consumeOrFail(CLOSEPAREN);
         const Identifier* unused = 0;
         TreeStatement innerTrueBlock = parseStatement(context, unused);
-        failIfFalse(innerTrueBlock);     
+        failIfFalse(innerTrueBlock);
+        tokenLocationStack.append(tempLocation);
         exprStack.append(innerCondition);
         posStack.append(make_pair(innerStart, innerEnd));
         statementStack.append(innerTrueBlock);
     } while (match(ELSE));
-    
+
     if (!trailingElse) {
         TreeExpression condition = exprStack.last();
         exprStack.removeLast();
@@ -1000,9 +1025,11 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseIfStatement(T
         statementStack.removeLast();
         pair<int, int> pos = posStack.last();
         posStack.removeLast();
-        statementStack.append(context.createIfStatement(m_lexer->lastLineNumber(), condition, trueBlock, pos.first, pos.second));
+        JSTokenLocation elseLocation = tokenLocationStack.last();
+        tokenLocationStack.removeLast();
+        statementStack.append(context.createIfStatement(elseLocation, condition, trueBlock, pos.first, pos.second));
     }
-    
+
     while (!exprStack.isEmpty()) {
         TreeExpression condition = exprStack.last();
         exprStack.removeLast();
@@ -1012,16 +1039,19 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseIfStatement(T
         statementStack.removeLast();
         pair<int, int> pos = posStack.last();
         posStack.removeLast();
-        statementStack.append(context.createIfStatement(m_lexer->lastLineNumber(), condition, trueBlock, falseBlock, pos.first, pos.second));
+        JSTokenLocation elseLocation = tokenLocationStack.last();
+        tokenLocationStack.removeLast();
+        statementStack.append(context.createIfStatement(elseLocation, condition, trueBlock, falseBlock, pos.first, pos.second));
     }
-    
-    return context.createIfStatement(m_lexer->lastLineNumber(), condition, trueBlock, statementStack.last(), start, end);
+
+    return context.createIfStatement(ifLocation, condition, trueBlock, statementStack.last(), start, end);
 }
 
 template <typename LexerType>
 template <class TreeBuilder> TreeExpression Parser<LexerType>::parseExpression(TreeBuilder& context)
 {
     failIfStackOverflow();
+    JSTokenLocation location(tokenLocation());
     TreeExpression node = parseAssignmentExpression(context);
     failIfFalse(node);
     if (!match(COMMA))
@@ -1031,7 +1061,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseExpression(T
     m_nonLHSCount++;
     TreeExpression right = parseAssignmentExpression(context);
     failIfFalse(right);
-    typename TreeBuilder::Comma commaNode = context.createCommaExpr(m_lexer->lastLineNumber(), node, right);
+    typename TreeBuilder::Comma commaNode = context.createCommaExpr(location, node, right);
     while (match(COMMA)) {
         next(TreeBuilder::DontBuildStrings);
         right = parseAssignmentExpression(context);
@@ -1046,6 +1076,7 @@ template <typename TreeBuilder> TreeExpression Parser<LexerType>::parseAssignmen
 {
     failIfStackOverflow();
     int start = tokenStart();
+    JSTokenLocation location(tokenLocation());
     int initialAssignmentCount = m_assignmentCount;
     int initialNonLHSCount = m_nonLHSCount;
     TreeExpression lhs = parseConditionalExpression(context);
@@ -1098,7 +1129,7 @@ end:
         return lhs;
     
     while (assignmentStack)
-        lhs = context.createAssignment(m_lexer->lastLineNumber(), assignmentStack, lhs, initialAssignmentCount, m_assignmentCount, lastTokenEnd());
+        lhs = context.createAssignment(location, assignmentStack, lhs, initialAssignmentCount, m_assignmentCount, lastTokenEnd());
     
     return lhs;
 }
@@ -1106,6 +1137,7 @@ end:
 template <typename LexerType>
 template <class TreeBuilder> TreeExpression Parser<LexerType>::parseConditionalExpression(TreeBuilder& context)
 {
+    JSTokenLocation location(tokenLocation());
     TreeExpression cond = parseBinaryExpression(context);
     failIfFalse(cond);
     if (!match(QUESTION))
@@ -1118,7 +1150,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseConditionalE
     
     TreeExpression rhs = parseAssignmentExpression(context);
     failIfFalse(rhs);
-    return context.createConditionalExpr(m_lexer->lastLineNumber(), cond, lhs, rhs);
+    return context.createConditionalExpr(location, cond, lhs, rhs);
 }
 
 ALWAYS_INLINE static bool isUnaryOp(JSTokenType token)
@@ -1141,6 +1173,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseBinaryExpres
     int operandStackDepth = 0;
     int operatorStackDepth = 0;
     typename TreeBuilder::BinaryExprContext binaryExprContext(context);
+    JSTokenLocation location(tokenLocation());
     while (true) {
         int exprStart = tokenStart();
         int initialAssignments = m_assignmentCount;
@@ -1162,7 +1195,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseBinaryExpres
             typename TreeBuilder::BinaryOperand rhs = context.getFromOperandStack(-1);
             typename TreeBuilder::BinaryOperand lhs = context.getFromOperandStack(-2);
             context.shrinkOperandStackBy(operandStackDepth, 2);
-            context.appendBinaryOperation(m_lexer->lastLineNumber(), operandStackDepth, operatorStackDepth, lhs, rhs);
+            context.appendBinaryOperation(location, operandStackDepth, operatorStackDepth, lhs, rhs);
             context.operatorStackPop(operatorStackDepth);
         }
         context.operatorStackAppend(operatorStackDepth, operatorToken, precedence);
@@ -1173,7 +1206,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseBinaryExpres
         typename TreeBuilder::BinaryOperand rhs = context.getFromOperandStack(-1);
         typename TreeBuilder::BinaryOperand lhs = context.getFromOperandStack(-2);
         context.shrinkOperandStackBy(operandStackDepth, 2);
-        context.appendBinaryOperation(m_lexer->lastLineNumber(), operandStackDepth, operatorStackDepth, lhs, rhs);
+        context.appendBinaryOperation(location, operandStackDepth, operatorStackDepth, lhs, rhs);
         context.operatorStackPop(operatorStackDepth);
     }
     return context.popOperandStack(operandStackDepth);
@@ -1222,11 +1255,12 @@ template <bool complete, class TreeBuilder> TreeProperty Parser<LexerType>::pars
             numericPropertyName = m_token.m_data.doubleValue;
         else
             fail();
+        JSTokenLocation location(tokenLocation());
         next();
         failIfFalse((parseFunctionInfo<FunctionNoRequirements, false>(context, accessorName, parameters, body, openBracePos, closeBracePos, bodyStartLine)));
         if (stringPropertyName)
-            return context.template createGetterOrSetterProperty<complete>(m_lexer->lastLineNumber(), type, stringPropertyName, parameters, body, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
-        return context.template createGetterOrSetterProperty<complete>(const_cast<JSGlobalData*>(m_globalData), m_lexer->lastLineNumber(), type, numericPropertyName, parameters, body, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
+            return context.template createGetterOrSetterProperty<complete>(location, type, stringPropertyName, parameters, body, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
+        return context.template createGetterOrSetterProperty<complete>(const_cast<JSGlobalData*>(m_globalData), location, type, numericPropertyName, parameters, body, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
     }
     case NUMBER: {
         double propertyName = m_token.m_data.doubleValue;
@@ -1249,12 +1283,13 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseObjectLitera
     unsigned oldLastLineNumber = m_lexer->lastLineNumber();
     unsigned oldLineNumber = m_lexer->lineNumber();
     consumeOrFailWithFlags(OPENBRACE, TreeBuilder::DontBuildStrings);
-    
+    JSTokenLocation location(tokenLocation());
+
     int oldNonLHSCount = m_nonLHSCount;
     
     if (match(CLOSEBRACE)) {
         next();
-        return context.createObjectLiteral(m_lexer->lastLineNumber());
+        return context.createObjectLiteral(location);
     }
     
     TreeProperty property = parseProperty<false>(context);
@@ -1266,13 +1301,14 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseObjectLitera
         m_lexer->setLineNumber(oldLineNumber);
         return parseStrictObjectLiteral(context);
     }
-    TreePropertyList propertyList = context.createPropertyList(m_lexer->lastLineNumber(), property);
+    TreePropertyList propertyList = context.createPropertyList(location, property);
     TreePropertyList tail = propertyList;
     while (match(COMMA)) {
         next(TreeBuilder::DontBuildStrings);
         // allow extra comma, see http://bugs.webkit.org/show_bug.cgi?id=5939
         if (match(CLOSEBRACE))
             break;
+        JSTokenLocation propertyLocation(tokenLocation());
         property = parseProperty<false>(context);
         failIfFalse(property);
         if (!m_syntaxAlreadyValidated && context.getType(property) != PropertyNode::Constant) {
@@ -1282,14 +1318,15 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseObjectLitera
             m_lexer->setLineNumber(oldLineNumber);
             return parseStrictObjectLiteral(context);
         }
-        tail = context.createPropertyList(m_lexer->lastLineNumber(), property, tail);
+        tail = context.createPropertyList(propertyLocation, property, tail);
     }
-    
+
+    location = tokenLocation();
     consumeOrFail(CLOSEBRACE);
     
     m_nonLHSCount = oldNonLHSCount;
     
-    return context.createObjectLiteral(m_lexer->lastLineNumber(), propertyList);
+    return context.createObjectLiteral(location, propertyList);
 }
 
 template <typename LexerType>
@@ -1299,9 +1336,10 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseStrictObject
     
     int oldNonLHSCount = m_nonLHSCount;
 
+    JSTokenLocation location(tokenLocation());
     if (match(CLOSEBRACE)) {
         next();
-        return context.createObjectLiteral(m_lexer->lastLineNumber());
+        return context.createObjectLiteral(location);
     }
     
     TreeProperty property = parseProperty<true>(context);
@@ -1313,13 +1351,14 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseStrictObject
     if (!m_syntaxAlreadyValidated)
         objectValidator.add(context.getName(property).impl(), context.getType(property));
     
-    TreePropertyList propertyList = context.createPropertyList(m_lexer->lastLineNumber(), property);
+    TreePropertyList propertyList = context.createPropertyList(location, property);
     TreePropertyList tail = propertyList;
     while (match(COMMA)) {
         next();
         // allow extra comma, see http://bugs.webkit.org/show_bug.cgi?id=5939
         if (match(CLOSEBRACE))
             break;
+        JSTokenLocation propertyLocation(tokenLocation());
         property = parseProperty<true>(context);
         failIfFalse(property);
         if (!m_syntaxAlreadyValidated) {
@@ -1331,14 +1370,15 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseStrictObject
                 propertyEntry.iterator->second |= context.getType(property);
             }
         }
-        tail = context.createPropertyList(m_lexer->lastLineNumber(), property, tail);
+        tail = context.createPropertyList(propertyLocation, property, tail);
     }
-    
+
+    location = tokenLocation();
     consumeOrFail(CLOSEBRACE);
 
     m_nonLHSCount = oldNonLHSCount;
 
-    return context.createObjectLiteral(m_lexer->lastLineNumber(), propertyList);
+    return context.createObjectLiteral(location, propertyList);
 }
 
 template <typename LexerType>
@@ -1354,8 +1394,9 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseArrayLiteral
         elisions++;
     }
     if (match(CLOSEBRACKET)) {
+        JSTokenLocation location(tokenLocation());
         next(TreeBuilder::DontBuildStrings);
-        return context.createArray(m_lexer->lastLineNumber(), elisions);
+        return context.createArray(location, elisions);
     }
     
     TreeExpression elem = parseAssignmentExpression(context);
@@ -1373,19 +1414,21 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseArrayLiteral
         }
         
         if (match(CLOSEBRACKET)) {
+            JSTokenLocation location(tokenLocation());
             next(TreeBuilder::DontBuildStrings);
-            return context.createArray(m_lexer->lastLineNumber(), elisions, elementList);
+            return context.createArray(location, elisions, elementList);
         }
         TreeExpression elem = parseAssignmentExpression(context);
         failIfFalse(elem);
         tail = context.createElementList(tail, elisions, elem);
     }
-    
+
+    JSTokenLocation location(tokenLocation());
     consumeOrFail(CLOSEBRACKET);
     
     m_nonLHSCount = oldNonLHSCount;
     
-    return context.createArray(m_lexer->lastLineNumber(), elementList);
+    return context.createArray(location, elementList);
 }
 
 template <typename LexerType>
@@ -1409,38 +1452,45 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parsePrimaryExpre
         return result;
     }
     case THISTOKEN: {
+        JSTokenLocation location(tokenLocation());
         next();
-        return context.thisExpr(m_lexer->lastLineNumber());
+        return context.thisExpr(location);
     }
     case IDENT: {
         int start = tokenStart();
         const Identifier* ident = m_token.m_data.ident;
+        JSTokenLocation location(tokenLocation());
         next();
         currentScope()->useVariable(ident, m_globalData->propertyNames->eval == *ident);
         m_lastIdentifier = ident;
-        return context.createResolve(m_lexer->lastLineNumber(), ident, start);
+        return context.createResolve(location, ident, start);
     }
     case STRING: {
         const Identifier* ident = m_token.m_data.ident;
+        JSTokenLocation location(tokenLocation());
         next();
-        return context.createString(m_lexer->lastLineNumber(), ident);
+        return context.createString(location, ident);
     }
     case NUMBER: {
         double d = m_token.m_data.doubleValue;
+        JSTokenLocation location(tokenLocation());
         next();
-        return context.createNumberExpr(m_lexer->lastLineNumber(), d);
+        return context.createNumberExpr(location, d);
     }
     case NULLTOKEN: {
+        JSTokenLocation location(tokenLocation());
         next();
-        return context.createNull(m_lexer->lastLineNumber());
+        return context.createNull(location);
     }
     case TRUETOKEN: {
+        JSTokenLocation location(tokenLocation());
         next();
-        return context.createBoolean(m_lexer->lastLineNumber(), true);
+        return context.createBoolean(location, true);
     }
     case FALSETOKEN: {
+        JSTokenLocation location(tokenLocation());
         next();
-        return context.createBoolean(m_lexer->lastLineNumber(), false);
+        return context.createBoolean(location, false);
     }
     case DIVEQUAL:
     case DIVIDE: {
@@ -1453,8 +1503,9 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parsePrimaryExpre
             failIfFalse(m_lexer->scanRegExp(pattern, flags));
         
         int start = tokenStart();
+        JSTokenLocation location(tokenLocation());
         next();
-        TreeExpression re = context.createRegExp(m_lexer->lastLineNumber(), *pattern, *flags, start);
+        TreeExpression re = context.createRegExp(location, *pattern, *flags, start);
         if (!re) {
             const char* yarrErrorMsg = Yarr::checkSyntax(pattern->ustring());
             ASSERT(!m_errorMessage.isNull());
@@ -1471,6 +1522,7 @@ template <typename LexerType>
 template <class TreeBuilder> TreeArguments Parser<LexerType>::parseArguments(TreeBuilder& context)
 {
     consumeOrFailWithFlags(OPENPAREN, TreeBuilder::DontBuildStrings);
+    JSTokenLocation location(tokenLocation());
     if (match(CLOSEPAREN)) {
         next(TreeBuilder::DontBuildStrings);
         return context.createArguments();
@@ -1478,13 +1530,14 @@ template <class TreeBuilder> TreeArguments Parser<LexerType>::parseArguments(Tre
     TreeExpression firstArg = parseAssignmentExpression(context);
     failIfFalse(firstArg);
     
-    TreeArgumentsList argList = context.createArgumentsList(m_lexer->lastLineNumber(), firstArg);
+    TreeArgumentsList argList = context.createArgumentsList(location, firstArg);
     TreeArgumentsList tail = argList;
     while (match(COMMA)) {
+        JSTokenLocation argumentLocation(tokenLocation());
         next(TreeBuilder::DontBuildStrings);
         TreeExpression arg = parseAssignmentExpression(context);
         failIfFalse(arg);
-        tail = context.createArgumentsList(m_lexer->lastLineNumber(), tail, arg);
+        tail = context.createArgumentsList(argumentLocation, tail, arg);
     }
     consumeOrFail(CLOSEPAREN);
     return context.createArguments(argList);
@@ -1497,6 +1550,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseMemberExpres
     int start = tokenStart();
     int expressionStart = start;
     int newCount = 0;
+    JSTokenLocation location;
     while (match(NEW)) {
         next();
         newCount++;
@@ -1509,14 +1563,16 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseMemberExpres
         int openBracePos = 0;
         int closeBracePos = 0;
         int bodyStartLine = 0;
+        location = tokenLocation();
         next();
         failIfFalse((parseFunctionInfo<FunctionNoRequirements, false>(context, name, parameters, body, openBracePos, closeBracePos, bodyStartLine)));
-        base = context.createFunctionExpr(m_lexer->lastLineNumber(), name, body, parameters, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
+        base = context.createFunctionExpr(location, name, body, parameters, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
     } else
         base = parsePrimaryExpression(context);
     
     failIfFalse(base);
     while (true) {
+        location = tokenLocation();
         switch (m_token.m_type) {
         case OPENBRACKET: {
             m_nonTrivialExpressionCount++;
@@ -1526,7 +1582,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseMemberExpres
             int initialAssignments = m_assignmentCount;
             TreeExpression property = parseExpression(context);
             failIfFalse(property);
-            base = context.createBracketAccess(m_lexer->lastLineNumber(), base, property, initialAssignments != m_assignmentCount, expressionStart, expressionEnd, tokenEnd());
+            base = context.createBracketAccess(location, base, property, initialAssignments != m_assignmentCount, expressionStart, expressionEnd, tokenEnd());
             consumeOrFail(CLOSEBRACKET);
             m_nonLHSCount = nonLHSCount;
             break;
@@ -1539,12 +1595,12 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseMemberExpres
                 int exprEnd = lastTokenEnd();
                 TreeArguments arguments = parseArguments(context);
                 failIfFalse(arguments);
-                base = context.createNewExpr(m_lexer->lastLineNumber(), base, arguments, start, exprEnd, lastTokenEnd());           
+                base = context.createNewExpr(location, base, arguments, start, exprEnd, lastTokenEnd());
             } else {
                 int expressionEnd = lastTokenEnd();
                 TreeArguments arguments = parseArguments(context);
                 failIfFalse(arguments);
-                base = context.makeFunctionCallNode(m_lexer->lastLineNumber(), base, arguments, expressionStart, expressionEnd, lastTokenEnd());
+                base = context.makeFunctionCallNode(location, base, arguments, expressionStart, expressionEnd, lastTokenEnd());
             }
             m_nonLHSCount = nonLHSCount;
             break;
@@ -1554,7 +1610,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseMemberExpres
             int expressionEnd = lastTokenEnd();
             nextExpectIdentifier(LexerFlagsIgnoreReservedWords | TreeBuilder::DontBuildKeywords);
             matchOrFail(IDENT);
-            base = context.createDotAccess(m_lexer->lastLineNumber(), base, m_token.m_data.ident, expressionStart, expressionEnd, tokenEnd());
+            base = context.createDotAccess(location, base, m_token.m_data.ident, expressionStart, expressionEnd, tokenEnd());
             next();
             break;
         }
@@ -1564,7 +1620,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseMemberExpres
     }
 endMemberExpression:
     while (newCount--)
-        base = context.createNewExpr(m_lexer->lastLineNumber(), base, start, lastTokenEnd());
+        base = context.createNewExpr(location, base, start, lastTokenEnd());
     return base;
 }
 
@@ -1602,6 +1658,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseUnaryExpress
         m_nonTrivialExpressionCount++;
     }
     int subExprStart = tokenStart();
+    JSTokenLocation location(tokenLocation());
     TreeExpression expr = parseMemberExpression(context);
     failIfFalse(expr);
     bool isEvalOrArguments = false;
@@ -1614,7 +1671,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseUnaryExpress
     case PLUSPLUS:
         m_nonTrivialExpressionCount++;
         m_nonLHSCount++;
-        expr = context.makePostfixNode(m_lexer->lastLineNumber(), expr, OpPlusPlus, subExprStart, lastTokenEnd(), tokenEnd());
+        expr = context.makePostfixNode(location, expr, OpPlusPlus, subExprStart, lastTokenEnd(), tokenEnd());
         m_assignmentCount++;
         failIfTrueIfStrictWithNameAndMessage(isEvalOrArguments, "'", m_lastIdentifier->impl(), "' cannot be modified in strict mode");
         failIfTrueIfStrict(requiresLExpr);
@@ -1623,7 +1680,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseUnaryExpress
     case MINUSMINUS:
         m_nonTrivialExpressionCount++;
         m_nonLHSCount++;
-        expr = context.makePostfixNode(m_lexer->lastLineNumber(), expr, OpMinusMinus, subExprStart, lastTokenEnd(), tokenEnd());
+        expr = context.makePostfixNode(location, expr, OpMinusMinus, subExprStart, lastTokenEnd(), tokenEnd());
         m_assignmentCount++;
         failIfTrueIfStrictWithNameAndMessage(isEvalOrArguments, "'", m_lastIdentifier->impl(), "' cannot be modified in strict mode");
         failIfTrueIfStrict(requiresLExpr);
@@ -1637,40 +1694,42 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseUnaryExpress
     
     if (!TreeBuilder::CreatesAST && (m_syntaxAlreadyValidated || !strictMode()))
         return expr;
-    
+
+    location = tokenLocation();
+    location.line = m_lexer->lastLineNumber();
     while (tokenStackDepth) {
         switch (context.unaryTokenStackLastType(tokenStackDepth)) {
         case EXCLAMATION:
-            expr = context.createLogicalNot(m_lexer->lastLineNumber(), expr);
+            expr = context.createLogicalNot(location, expr);
             break;
         case TILDE:
-            expr = context.makeBitwiseNotNode(m_lexer->lastLineNumber(), expr);
+            expr = context.makeBitwiseNotNode(location, expr);
             break;
         case MINUS:
-            expr = context.makeNegateNode(m_lexer->lastLineNumber(), expr);
+            expr = context.makeNegateNode(location, expr);
             break;
         case PLUS:
-            expr = context.createUnaryPlus(m_lexer->lastLineNumber(), expr);
+            expr = context.createUnaryPlus(location, expr);
             break;
         case PLUSPLUS:
         case AUTOPLUSPLUS:
-            expr = context.makePrefixNode(m_lexer->lastLineNumber(), expr, OpPlusPlus, context.unaryTokenStackLastStart(tokenStackDepth), subExprStart + 1, end);
+            expr = context.makePrefixNode(location, expr, OpPlusPlus, context.unaryTokenStackLastStart(tokenStackDepth), subExprStart + 1, end);
             m_assignmentCount++;
             break;
         case MINUSMINUS:
         case AUTOMINUSMINUS:
-            expr = context.makePrefixNode(m_lexer->lastLineNumber(), expr, OpMinusMinus, context.unaryTokenStackLastStart(tokenStackDepth), subExprStart + 1, end);
+            expr = context.makePrefixNode(location, expr, OpMinusMinus, context.unaryTokenStackLastStart(tokenStackDepth), subExprStart + 1, end);
             m_assignmentCount++;
             break;
         case TYPEOF:
-            expr = context.makeTypeOfNode(m_lexer->lastLineNumber(), expr);
+            expr = context.makeTypeOfNode(location, expr);
             break;
         case VOIDTOKEN:
-            expr = context.createVoid(m_lexer->lastLineNumber(), expr);
+            expr = context.createVoid(location, expr);
             break;
         case DELETETOKEN:
             failIfTrueIfStrictWithNameAndMessage(context.isResolve(expr), "Cannot delete unqualified property", m_lastIdentifier->impl(), "in strict mode");
-            expr = context.makeDeleteNode(m_lexer->lastLineNumber(), expr, context.unaryTokenStackLastStart(tokenStackDepth), end, end);
+            expr = context.makeDeleteNode(location, expr, context.unaryTokenStackLastStart(tokenStackDepth), end, end);
             break;
         default:
             // If we get here something has gone horribly horribly wrong
diff --git a/Source/JavaScriptCore/parser/Parser.h b/Source/JavaScriptCore/parser/Parser.h
index c2a11d665..79a95b696 100644
--- a/Source/JavaScriptCore/parser/Parser.h
+++ b/Source/JavaScriptCore/parser/Parser.h
@@ -502,18 +502,18 @@ private:
 
     ALWAYS_INLINE void next(unsigned lexerFlags = 0)
     {
-        m_lastLine = m_token.m_info.line;
-        m_lastTokenEnd = m_token.m_info.endOffset;
+        m_lastLine = m_token.m_location.line;
+        m_lastTokenEnd = m_token.m_location.endOffset;
         m_lexer->setLastLineNumber(m_lastLine);
-        m_token.m_type = m_lexer->lex(&m_token.m_data, &m_token.m_info, lexerFlags, strictMode());
+        m_token.m_type = m_lexer->lex(&m_token.m_data, &m_token.m_location, lexerFlags, strictMode());
     }
 
     ALWAYS_INLINE void nextExpectIdentifier(unsigned lexerFlags = 0)
     {
-        m_lastLine = m_token.m_info.line;
-        m_lastTokenEnd = m_token.m_info.endOffset;
+        m_lastLine = m_token.m_location.line;
+        m_lastTokenEnd = m_token.m_location.endOffset;
         m_lexer->setLastLineNumber(m_lastLine);
-        m_token.m_type = m_lexer->lexExpectIdentifier(&m_token.m_data, &m_token.m_info, lexerFlags, strictMode());
+        m_token.m_type = m_lexer->lexExpectIdentifier(&m_token.m_data, &m_token.m_location, lexerFlags, strictMode());
     }
 
     ALWAYS_INLINE bool nextTokenIsColon()
@@ -541,20 +541,25 @@ private:
     
     ALWAYS_INLINE int tokenStart()
     {
-        return m_token.m_info.startOffset;
+        return m_token.m_location.startOffset;
     }
     
     ALWAYS_INLINE int tokenLine()
     {
-        return m_token.m_info.line;
+        return m_token.m_location.line;
     }
     
     ALWAYS_INLINE int tokenEnd()
     {
-        return m_token.m_info.endOffset;
+        return m_token.m_location.endOffset;
     }
     
-    const char* getTokenName(JSTokenType tok) 
+    ALWAYS_INLINE const JSTokenLocation& tokenLocation()
+    {
+        return m_token.m_location;
+    }
+
+    const char* getTokenName(JSTokenType tok)
     {
         switch (tok) {
         case NULLTOKEN: 
@@ -1003,8 +1008,11 @@ PassRefPtr<ParsedNode> Parser<LexerType>::parse(JSGlobalObject* lexicalGlobalObj
 
     RefPtr<ParsedNode> result;
     if (m_sourceElements) {
+        JSTokenLocation location;
+        location.line = m_lexer->lastLineNumber();
+        location.column = m_lexer->currentColumnNumber();
         result = ParsedNode::create(&lexicalGlobalObject->globalData(),
-                                    m_lexer->lastLineNumber(),
+                                    location,
                                     m_sourceElements,
                                     m_varDeclarations ? &m_varDeclarations->data : 0,
                                     m_funcDeclarations ? &m_funcDeclarations->data : 0,
@@ -1012,7 +1020,7 @@ PassRefPtr<ParsedNode> Parser<LexerType>::parse(JSGlobalObject* lexicalGlobalObj
                                     *m_source,
                                     m_features,
                                     m_numConstants);
-        result->setLoc(m_source->firstLine(), m_lastLine);
+        result->setLoc(m_source->firstLine(), m_lastLine, m_lexer->currentColumnNumber());
     } else if (lexicalGlobalObject) {
         // We can never see a syntax error when reparsing a function, since we should have
         // reported the error when parsing the containing program or eval code. So if we're
diff --git a/Source/JavaScriptCore/parser/ParserTokens.h b/Source/JavaScriptCore/parser/ParserTokens.h
index a1ea751ac..6e6cec114 100644
--- a/Source/JavaScriptCore/parser/ParserTokens.h
+++ b/Source/JavaScriptCore/parser/ParserTokens.h
@@ -140,17 +140,25 @@ union JSTokenData {
     const Identifier* ident;
 };
 
-struct JSTokenInfo {
-    JSTokenInfo() : line(0) { }
+struct JSTokenLocation {
+    JSTokenLocation() : line(0), column(0) { }
+    JSTokenLocation(const JSTokenLocation& location)
+    {
+        line = location.line;
+        startOffset = location.startOffset;
+        endOffset = location.endOffset;
+        column = location.column;
+    }
     int line;
     int startOffset;
     int endOffset;
+    int column;
 };
 
 struct JSToken {
     JSTokenType m_type;
     JSTokenData m_data;
-    JSTokenInfo m_info;
+    JSTokenLocation m_location;
 };
 
 enum JSParserStrictness { JSParseNormal, JSParseStrict };
diff --git a/Source/JavaScriptCore/parser/SourceProviderCacheItem.h b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
index 3662367a0..bfd35648e 100644
--- a/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
+++ b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
@@ -53,9 +53,9 @@ public:
         JSToken token;
         token.m_type = CLOSEBRACE;
         token.m_data.intValue = closeBracePos;
-        token.m_info.startOffset = closeBracePos;
-        token.m_info.endOffset = closeBracePos + 1;
-        token.m_info.line = closeBraceLine; 
+        token.m_location.startOffset = closeBracePos;
+        token.m_location.endOffset = closeBracePos + 1;
+        token.m_location.line = closeBraceLine;
         return token;
     }
     
diff --git a/Source/JavaScriptCore/parser/SyntaxChecker.h b/Source/JavaScriptCore/parser/SyntaxChecker.h
index fe3ce714f..7d44ef3c6 100644
--- a/Source/JavaScriptCore/parser/SyntaxChecker.h
+++ b/Source/JavaScriptCore/parser/SyntaxChecker.h
@@ -119,42 +119,42 @@ public:
     static const unsigned DontBuildStrings = LexerFlagsDontBuildStrings;
 
     int createSourceElements() { return 1; }
-    ExpressionType makeFunctionCallNode(int, int, int, int, int, int) { return CallExpr; }
+    ExpressionType makeFunctionCallNode(const JSTokenLocation&, int, int, int, int, int) { return CallExpr; }
     void appendToComma(ExpressionType& base, ExpressionType right) { base = right; }
-    ExpressionType createCommaExpr(int, ExpressionType, ExpressionType right) { return right; }
-    ExpressionType makeAssignNode(int, ExpressionType, Operator, ExpressionType, bool, bool, int, int, int) { return AssignmentExpr; }
-    ExpressionType makePrefixNode(int, ExpressionType, Operator, int, int, int) { return PreExpr; }
-    ExpressionType makePostfixNode(int, ExpressionType, Operator, int, int, int) { return PostExpr; }
-    ExpressionType makeTypeOfNode(int, ExpressionType) { return TypeofExpr; }
-    ExpressionType makeDeleteNode(int, ExpressionType, int, int, int) { return DeleteExpr; }
-    ExpressionType makeNegateNode(int, ExpressionType) { return UnaryExpr; }
-    ExpressionType makeBitwiseNotNode(int, ExpressionType) { return UnaryExpr; }
-    ExpressionType createLogicalNot(int, ExpressionType) { return UnaryExpr; }
-    ExpressionType createUnaryPlus(int, ExpressionType) { return UnaryExpr; }
-    ExpressionType createVoid(int, ExpressionType) { return UnaryExpr; }
-    ExpressionType thisExpr(int) { return ThisExpr; }
-    ExpressionType createResolve(int, const Identifier*, int) { return ResolveExpr; }
-    ExpressionType createObjectLiteral(int) { return ObjectLiteralExpr; }
-    ExpressionType createObjectLiteral(int, int) { return ObjectLiteralExpr; }
-    ExpressionType createArray(int, int) { return ArrayLiteralExpr; }
-    ExpressionType createArray(int, int, int) { return ArrayLiteralExpr; }
-    ExpressionType createNumberExpr(int, double) { return NumberExpr; }
-    ExpressionType createString(int, const Identifier*) { return StringExpr; }
-    ExpressionType createBoolean(int, bool) { return BoolExpr; }
-    ExpressionType createNull(int) { return NullExpr; }
-    ExpressionType createBracketAccess(int, ExpressionType, ExpressionType, bool, int, int, int) { return BracketExpr; }
-    ExpressionType createDotAccess(int, ExpressionType, const Identifier*, int, int, int) { return DotExpr; }
-    ExpressionType createRegExp(int, const Identifier& pattern, const Identifier&, int) { return Yarr::checkSyntax(pattern.ustring()) ? 0 : RegExpExpr; }
-    ExpressionType createNewExpr(int, ExpressionType, int, int, int, int) { return NewExpr; }
-    ExpressionType createNewExpr(int, ExpressionType, int, int) { return NewExpr; }
-    ExpressionType createConditionalExpr(int, ExpressionType, ExpressionType, ExpressionType) { return ConditionalExpr; }
-    ExpressionType createAssignResolve(int, const Identifier&, ExpressionType, int, int, int) { return AssignmentExpr; }
-    ExpressionType createFunctionExpr(int, const Identifier*, int, int, int, int, int, int) { return FunctionExpr; }
-    int createFunctionBody(int, bool) { return 1; }
+    ExpressionType createCommaExpr(const JSTokenLocation&, ExpressionType, ExpressionType right) { return right; }
+    ExpressionType makeAssignNode(const JSTokenLocation&, ExpressionType, Operator, ExpressionType, bool, bool, int, int, int) { return AssignmentExpr; }
+    ExpressionType makePrefixNode(const JSTokenLocation&, ExpressionType, Operator, int, int, int) { return PreExpr; }
+    ExpressionType makePostfixNode(const JSTokenLocation&, ExpressionType, Operator, int, int, int) { return PostExpr; }
+    ExpressionType makeTypeOfNode(const JSTokenLocation&, ExpressionType) { return TypeofExpr; }
+    ExpressionType makeDeleteNode(const JSTokenLocation&, ExpressionType, int, int, int) { return DeleteExpr; }
+    ExpressionType makeNegateNode(const JSTokenLocation&, ExpressionType) { return UnaryExpr; }
+    ExpressionType makeBitwiseNotNode(const JSTokenLocation&, ExpressionType) { return UnaryExpr; }
+    ExpressionType createLogicalNot(const JSTokenLocation&, ExpressionType) { return UnaryExpr; }
+    ExpressionType createUnaryPlus(const JSTokenLocation&, ExpressionType) { return UnaryExpr; }
+    ExpressionType createVoid(const JSTokenLocation&, ExpressionType) { return UnaryExpr; }
+    ExpressionType thisExpr(const JSTokenLocation&) { return ThisExpr; }
+    ExpressionType createResolve(const JSTokenLocation&, const Identifier*, int) { return ResolveExpr; }
+    ExpressionType createObjectLiteral(const JSTokenLocation&) { return ObjectLiteralExpr; }
+    ExpressionType createObjectLiteral(const JSTokenLocation&, int) { return ObjectLiteralExpr; }
+    ExpressionType createArray(const JSTokenLocation&, int) { return ArrayLiteralExpr; }
+    ExpressionType createArray(const JSTokenLocation&, int, int) { return ArrayLiteralExpr; }
+    ExpressionType createNumberExpr(const JSTokenLocation&, double) { return NumberExpr; }
+    ExpressionType createString(const JSTokenLocation&, const Identifier*) { return StringExpr; }
+    ExpressionType createBoolean(const JSTokenLocation&, bool) { return BoolExpr; }
+    ExpressionType createNull(const JSTokenLocation&) { return NullExpr; }
+    ExpressionType createBracketAccess(const JSTokenLocation&, ExpressionType, ExpressionType, bool, int, int, int) { return BracketExpr; }
+    ExpressionType createDotAccess(const JSTokenLocation&, ExpressionType, const Identifier*, int, int, int) { return DotExpr; }
+    ExpressionType createRegExp(const JSTokenLocation&, const Identifier& pattern, const Identifier&, int) { return Yarr::checkSyntax(pattern.ustring()) ? 0 : RegExpExpr; }
+    ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int, int, int) { return NewExpr; }
+    ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int) { return NewExpr; }
+    ExpressionType createConditionalExpr(const JSTokenLocation&, ExpressionType, ExpressionType, ExpressionType) { return ConditionalExpr; }
+    ExpressionType createAssignResolve(const JSTokenLocation&, const Identifier&, ExpressionType, int, int, int) { return AssignmentExpr; }
+    ExpressionType createFunctionExpr(const JSTokenLocation&, const Identifier*, int, int, int, int, int, int) { return FunctionExpr; }
+    int createFunctionBody(const JSTokenLocation&, bool) { return 1; }
     int createArguments() { return 1; }
     int createArguments(int) { return 1; }
-    int createArgumentsList(int, int) { return 1; }
-    int createArgumentsList(int, int, int) { return 1; }
+    int createArgumentsList(const JSTokenLocation&, int) { return 1; }
+    int createArgumentsList(const JSTokenLocation&, int, int) { return 1; }
     template <bool complete> Property createProperty(const Identifier* name, int, PropertyNode::Type type)
     {
         if (!complete)
@@ -168,8 +168,8 @@ public:
             return Property(type);
         return Property(&globalData->parserArena->identifierArena().makeNumericIdentifier(globalData, name), type);
     }
-    int createPropertyList(int, Property) { return 1; }
-    int createPropertyList(int, Property, int) { return 1; }
+    int createPropertyList(const JSTokenLocation&, Property) { return 1; }
+    int createPropertyList(const JSTokenLocation&, Property, int) { return 1; }
     int createElementList(int, int) { return 1; }
     int createElementList(int, int, int) { return 1; }
     int createFormalParameterList(const Identifier&) { return 1; }
@@ -178,39 +178,39 @@ public:
     int createClauseList(int) { return 1; }
     int createClauseList(int, int) { return 1; }
     void setUsesArguments(int) { }
-    int createFuncDeclStatement(int, const Identifier*, int, int, int, int, int, int) { return 1; }
-    int createBlockStatement(int, int, int, int) { return 1; }
-    int createExprStatement(int, int, int, int) { return 1; }
-    int createIfStatement(int, int, int, int, int) { return 1; }
-    int createIfStatement(int, int, int, int, int, int) { return 1; }
-    int createForLoop(int, int, int, int, int, int, int) { return 1; }
-    int createForInLoop(int, const Identifier*, int, int, int, int, int, int, int, int, int, int) { return 1; }
-    int createForInLoop(int, int, int, int, int, int, int, int, int) { return 1; }
-    int createEmptyStatement(int) { return 1; }
-    int createVarStatement(int, int, int, int) { return 1; }
-    int createReturnStatement(int, int, int, int, int, int) { return 1; }
-    int createBreakStatement(int, int, int, int, int) { return 1; }
-    int createBreakStatement(int, const Identifier*, int, int, int, int) { return 1; }
-    int createContinueStatement(int, int, int, int, int) { return 1; }
-    int createContinueStatement(int, const Identifier*, int, int, int, int) { return 1; }
-    int createTryStatement(int, int, const Identifier*, int, int, int, int) { return 1; }
-    int createSwitchStatement(int, int, int, int, int, int, int) { return 1; }
-    int createWhileStatement(int, int, int, int, int) { return 1; }
-    int createWithStatement(int, int, int, int, int, int, int) { return 1; }
-    int createDoWhileStatement(int, int, int, int, int) { return 1; }
-    int createLabelStatement(int, const Identifier*, int, int, int) { return 1; }
-    int createThrowStatement(int, int, int, int, int, int) { return 1; }
-    int createDebugger(int, int, int) { return 1; }
-    int createConstStatement(int, int, int, int) { return 1; }
-    int appendConstDecl(int, int, const Identifier*, int) { return 1; }
-    template <bool strict> Property createGetterOrSetterProperty(int, PropertyNode::Type type, const Identifier* name, int, int, int, int, int, int)
+    int createFuncDeclStatement(const JSTokenLocation&, const Identifier*, int, int, int, int, int, int) { return 1; }
+    int createBlockStatement(const JSTokenLocation&, int, int, int) { return 1; }
+    int createExprStatement(const JSTokenLocation&, int, int, int) { return 1; }
+    int createIfStatement(const JSTokenLocation&, int, int, int, int) { return 1; }
+    int createIfStatement(const JSTokenLocation&, int, int, int, int, int) { return 1; }
+    int createForLoop(const JSTokenLocation&, int, int, int, int, int, int) { return 1; }
+    int createForInLoop(const JSTokenLocation&, const Identifier*, int, int, int, int, int, int, int, int, int, int) { return 1; }
+    int createForInLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int) { return 1; }
+    int createEmptyStatement(const JSTokenLocation&) { return 1; }
+    int createVarStatement(const JSTokenLocation&, int, int, int) { return 1; }
+    int createReturnStatement(const JSTokenLocation&, int, int, int, int, int) { return 1; }
+    int createBreakStatement(const JSTokenLocation&, int, int, int, int) { return 1; }
+    int createBreakStatement(const JSTokenLocation&, const Identifier*, int, int, int, int) { return 1; }
+    int createContinueStatement(const JSTokenLocation&, int, int, int, int) { return 1; }
+    int createContinueStatement(const JSTokenLocation&, const Identifier*, int, int, int, int) { return 1; }
+    int createTryStatement(const JSTokenLocation&, int, const Identifier*, int, int, int, int) { return 1; }
+    int createSwitchStatement(const JSTokenLocation&, int, int, int, int, int, int) { return 1; }
+    int createWhileStatement(const JSTokenLocation&, int, int, int, int) { return 1; }
+    int createWithStatement(const JSTokenLocation&, int, int, int, int, int, int) { return 1; }
+    int createDoWhileStatement(const JSTokenLocation&, int, int, int, int) { return 1; }
+    int createLabelStatement(const JSTokenLocation&, const Identifier*, int, int, int) { return 1; }
+    int createThrowStatement(const JSTokenLocation&, int, int, int, int, int) { return 1; }
+    int createDebugger(const JSTokenLocation&, int, int) { return 1; }
+    int createConstStatement(const JSTokenLocation&, int, int, int) { return 1; }
+    int appendConstDecl(const JSTokenLocation&, int, const Identifier*, int) { return 1; }
+    template <bool strict> Property createGetterOrSetterProperty(const JSTokenLocation&, PropertyNode::Type type, const Identifier* name, int, int, int, int, int, int)
     {
         ASSERT(name);
         if (!strict)
             return Property(type);
         return Property(name, type);
     }
-    template <bool strict> Property createGetterOrSetterProperty(JSGlobalData* globalData, int, PropertyNode::Type type, double name, int, int, int, int, int, int)
+    template <bool strict> Property createGetterOrSetterProperty(JSGlobalData* globalData, const JSTokenLocation&, PropertyNode::Type type, double name, int, int, int, int, int, int)
     {
         if (!strict)
             return Property(type);
@@ -219,7 +219,7 @@ public:
 
     void appendStatement(int, int) { }
     void addVar(const Identifier*, bool) { }
-    int combineCommaNodes(int, int, int) { return 1; }
+    int combineCommaNodes(const JSTokenLocation&, int, int) { return 1; }
     int evalCount() const { return 0; }
     void appendBinaryExpressionInfo(int& operandStackDepth, int expr, int, int, int, bool)
     {
@@ -235,7 +235,7 @@ public:
     bool operatorStackHasHigherPrecedence(int&, int) { return true; }
     BinaryOperand getFromOperandStack(int) { return m_topBinaryExpr; }
     void shrinkOperandStackBy(int& operandStackDepth, int amount) { operandStackDepth -= amount; }
-    void appendBinaryOperation(int, int& operandStackDepth, int&, BinaryOperand, BinaryOperand) { operandStackDepth++; }
+    void appendBinaryOperation(const JSTokenLocation&, int& operandStackDepth, int&, BinaryOperand, BinaryOperand) { operandStackDepth++; }
     void operatorStackAppend(int& operatorStackDepth, int, int) { operatorStackDepth++; }
     int popOperandStack(int&) { int res = m_topBinaryExpr; m_topBinaryExpr = 0; return res; }
     
@@ -245,7 +245,7 @@ public:
     void unaryTokenStackRemoveLast(int& stackDepth) { stackDepth = 0; }
     
     void assignmentStackAppend(int, int, int, int, int, Operator) { }
-    int createAssignment(int, int, int, int, int, int) { ASSERT_NOT_REACHED(); return 1; }
+    int createAssignment(const JSTokenLocation&, int, int, int, int, int) { ASSERT_NOT_REACHED(); return 1; }
     const Identifier& getName(const Property& property) const { ASSERT(property.name); return *property.name; }
     PropertyNode::Type getType(const Property& property) const { return property.type; }
     bool isResolve(ExpressionType expr) const { return expr == ResolveExpr || expr == ResolveEvalExpr; }
diff --git a/Source/JavaScriptCore/runtime/CommonIdentifiers.cpp b/Source/JavaScriptCore/runtime/CommonIdentifiers.cpp
index 82beda336..e929d7a49 100644
--- a/Source/JavaScriptCore/runtime/CommonIdentifiers.cpp
+++ b/Source/JavaScriptCore/runtime/CommonIdentifiers.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2003, 2007, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2007, 2009, 2012 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -23,14 +23,12 @@
 
 namespace JSC {
 
-static const char* const nullCString = 0;
-
 #define INITIALIZE_PROPERTY_NAME(name) , name(globalData, #name)
 #define INITIALIZE_KEYWORD(name) , name##Keyword(globalData, #name)
 
 CommonIdentifiers::CommonIdentifiers(JSGlobalData* globalData)
-    : nullIdentifier(globalData, nullCString)
-    , emptyIdentifier(globalData, "")
+    : nullIdentifier()
+    , emptyIdentifier(Identifier::EmptyIdentifier)
     , underscoreProto(globalData, "__proto__")
     , thisIdentifier(globalData, "this")
     , useStrictIdentifier(globalData, "use strict")
diff --git a/Source/JavaScriptCore/runtime/DateConstructor.cpp b/Source/JavaScriptCore/runtime/DateConstructor.cpp
index 5984bbf97..e4f89dd37 100644
--- a/Source/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/DateConstructor.cpp
@@ -168,11 +168,7 @@ static EncodedJSValue JSC_HOST_CALL callDate(ExecState* exec)
 {
     GregorianDateTime ts;
     msToGregorianDateTime(exec, currentTimeMS(), false, ts);
-    DateConversionBuffer date;
-    DateConversionBuffer time;
-    formatDate(ts, date);
-    formatTime(ts, time);
-    return JSValue::encode(jsMakeNontrivialString(exec, date, " ", time));
+    return JSValue::encode(jsNontrivialString(exec, formatDateTime(ts, DateTimeFormatDateAndTime, false)));
 }
 
 CallType DateConstructor::getCallData(JSCell*, CallData& callData)
diff --git a/Source/JavaScriptCore/runtime/DateConversion.cpp b/Source/JavaScriptCore/runtime/DateConversion.cpp
index 706ffe9a2..47839817f 100644
--- a/Source/JavaScriptCore/runtime/DateConversion.cpp
+++ b/Source/JavaScriptCore/runtime/DateConversion.cpp
@@ -1,95 +1,127 @@
 /*
- * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
  *
- * The Original Code is Mozilla Communicator client code, released
- * March 31, 1998.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- * Alternatively, the contents of this file may be used under the terms
- * of either the Mozilla Public License Version 1.1, found at
- * http://www.mozilla.org/MPL/ (the "MPL") or the GNU General Public
- * License Version 2.0, found at http://www.fsf.org/copyleft/gpl.html
- * (the "GPL"), in which case the provisions of the MPL or the GPL are
- * applicable instead of those above.  If you wish to allow use of your
- * version of this file only under the terms of one of those two
- * licenses (the MPL or the GPL) and not to allow others to use your
- * version of this file under the LGPL, indicate your decision by
- * deletingthe provisions above and replace them with the notice and
- * other provisions required by the MPL or the GPL, as the case may be.
- * If you do not delete the provisions above, a recipient may use your
- * version of this file under any of the LGPL, the MPL or the GPL.
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "DateConversion.h"
 
-#include "CallFrame.h"
-#include "JSDateMath.h"
-#include "JSObject.h"
-#include "ScopeChain.h"
 #include "UString.h"
-#include <wtf/StringExtras.h>
-#include <wtf/text/CString.h>
+#include <wtf/Assertions.h>
+#include <wtf/DateMath.h>
+#include <wtf/text/StringBuilder.h>
+
+#if OS(WINDOWS)
+#include <windows.h>
+#endif
 
 using namespace WTF;
 
 namespace JSC {
 
-void formatDate(const GregorianDateTime &t, DateConversionBuffer& buffer)
+template<int width>
+static inline void appendNumber(StringBuilder& builder, int value)
 {
-    snprintf(buffer, DateConversionBufferSize, "%s %s %02d %04d",
-        weekdayName[(t.weekDay() + 6) % 7],
-        monthName[t.month()], t.monthDay(), t.year());
+    int fillingZerosCount = width;
+    if (value < 0) {
+        builder.append('-');
+        value = -value;
+        --fillingZerosCount;
+    }
+    String valueString = String::number(value);
+    fillingZerosCount -= valueString.length();
+    for (int i = 0; i < fillingZerosCount; ++i)
+        builder.append('0');
+    builder.append(valueString);
 }
 
-void formatDateUTCVariant(const GregorianDateTime &t, DateConversionBuffer& buffer)
+template<>
+void appendNumber<2>(StringBuilder& builder, int value)
 {
-    snprintf(buffer, DateConversionBufferSize, "%s, %02d %s %04d",
-        weekdayName[(t.weekDay() + 6) % 7],
-        t.monthDay(), monthName[t.month()], t.year());
+    ASSERT(0 <= value && value <= 99);
+    builder.append(static_cast<char>('0' + value / 10));
+    builder.append(static_cast<char>('0' + value % 10));
 }
 
-void formatTime(const GregorianDateTime &t, DateConversionBuffer& buffer)
+UString formatDateTime(const GregorianDateTime& t, DateTimeFormat format, bool asUTCVariant)
 {
-    int offset = abs(t.utcOffset());
-    char timeZoneName[70];
-    struct tm gtm = t;
-    strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
-
-    if (timeZoneName[0]) {
-        snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT%c%02d%02d (%s)",
-            t.hour(), t.minute(), t.second(),
-            t.utcOffset() < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
-    } else {
-        snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT%c%02d%02d",
-            t.hour(), t.minute(), t.second(),
-            t.utcOffset() < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
+    bool appendDate = format & DateTimeFormatDate;
+    bool appendTime = format & DateTimeFormatTime;
+
+    StringBuilder builder;
+
+    if (appendDate) {
+        builder.append(weekdayName[(t.weekDay() + 6) % 7]);
+
+        if (asUTCVariant) {
+            builder.append(", ");
+            appendNumber<2>(builder, t.monthDay());
+            builder.append(' ');
+            builder.append(monthName[t.month()]);
+        } else {
+            builder.append(' ');
+            builder.append(monthName[t.month()]);
+            builder.append(' ');
+            appendNumber<2>(builder, t.monthDay());
+        }
+        builder.append(' ');
+        appendNumber<4>(builder, t.year());
     }
-}
 
-void formatTimeUTC(const GregorianDateTime &t, DateConversionBuffer& buffer)
-{
-    snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT", t.hour(), t.minute(), t.second());
+    if (appendDate && appendTime)
+        builder.append(' ');
+
+    if (appendTime) {
+        appendNumber<2>(builder, t.hour());
+        builder.append(':');
+        appendNumber<2>(builder, t.minute());
+        builder.append(':');
+        appendNumber<2>(builder, t.second());
+        builder.append(" GMT");
+
+        if (!asUTCVariant) {
+            int offset = abs(t.utcOffset()) / 60;
+            builder.append(t.utcOffset() < 0 ? '-' : '+');
+            appendNumber<2>(builder, offset / 60);
+            appendNumber<2>(builder, offset % 60);
+
+#if OS(WINDOWS)
+            TIME_ZONE_INFORMATION timeZoneInformation;
+            GetTimeZoneInformation(&timeZoneInformation);
+            const WCHAR* timeZoneName = t.isDST() ? timeZoneInformation.DaylightName : timeZoneInformation.StandardName;
+#else
+            struct tm gtm = t;
+            char timeZoneName[70];
+            strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
+#endif
+            if (timeZoneName[0]) {
+                builder.append(" (");
+                builder.append(timeZoneName);
+                builder.append(')');
+            }
+        }
+    }
+
+    return builder.toString().impl();
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/DateConversion.h b/Source/JavaScriptCore/runtime/DateConversion.h
index 0b078cd34..fd1a7eb35 100644
--- a/Source/JavaScriptCore/runtime/DateConversion.h
+++ b/Source/JavaScriptCore/runtime/DateConversion.h
@@ -1,42 +1,25 @@
 /*
- * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Communicator client code, released
- * March 31, 1998.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
+ * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef DateConversion_h
@@ -46,15 +29,15 @@
 
 namespace JSC {
 
-class ExecState;
+class UString;
 
-static const unsigned DateConversionBufferSize = 100;
-typedef char DateConversionBuffer[DateConversionBufferSize];
+enum DateTimeFormat {
+    DateTimeFormatDate = 1,
+    DateTimeFormatTime = 2,
+    DateTimeFormatDateAndTime = DateTimeFormatDate | DateTimeFormatTime
+};
 
-void formatDate(const GregorianDateTime&, DateConversionBuffer&);
-void formatDateUTCVariant(const GregorianDateTime&, DateConversionBuffer&);
-void formatTime(const GregorianDateTime&, DateConversionBuffer&);
-void formatTimeUTC(const GregorianDateTime&, DateConversionBuffer&);
+UString formatDateTime(const GregorianDateTime&, DateTimeFormat, bool asUTCVariant);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.cpp b/Source/JavaScriptCore/runtime/DatePrototype.cpp
index 7cbab0497..363eec03a 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/Source/JavaScriptCore/runtime/DatePrototype.cpp
@@ -340,6 +340,23 @@ static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, doubl
 
 #endif // !PLATFORM(MAC) && !PLATFORM(IOS)
 
+static EncodedJSValue formateDateInstance(ExecState* exec, DateTimeFormat format, bool asUTCVariant)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&DateInstance::s_info))
+        return throwVMTypeError(exec);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue);
+
+    const GregorianDateTime* gregorianDateTime = asUTCVariant
+        ? thisDateObj->gregorianDateTimeUTC(exec)
+        : thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNontrivialString(exec, "Invalid Date"));
+
+    return JSValue::encode(jsNontrivialString(exec, formatDateTime(*gregorianDateTime, format, asUTCVariant)));
+}
+
 // Converts a list of arguments sent to a Date member function into milliseconds, updating
 // ms (representing milliseconds) and t (representing the rest of the date structure) appropriately.
 //
@@ -513,38 +530,14 @@ bool DatePrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec,
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::s_info))
-        return throwVMTypeError(exec);
-
-    DateInstance* thisDateObj = asDateInstance(thisValue); 
-
-    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
-    if (!gregorianDateTime)
-        return JSValue::encode(jsNontrivialString(exec, "Invalid Date"));
-    DateConversionBuffer date;
-    DateConversionBuffer time;
-    formatDate(*gregorianDateTime, date);
-    formatTime(*gregorianDateTime, time);
-    return JSValue::encode(jsMakeNontrivialString(exec, date, " ", time));
+    const bool asUTCVariant = false;
+    return formateDateInstance(exec, DateTimeFormatDateAndTime, asUTCVariant);
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::s_info))
-        return throwVMTypeError(exec);
-
-    DateInstance* thisDateObj = asDateInstance(thisValue); 
-
-    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
-    if (!gregorianDateTime)
-        return JSValue::encode(jsNontrivialString(exec, "Invalid Date"));
-    DateConversionBuffer date;
-    DateConversionBuffer time;
-    formatDateUTCVariant(*gregorianDateTime, date);
-    formatTimeUTC(*gregorianDateTime, time);
-    return JSValue::encode(jsMakeNontrivialString(exec, date, " ", time));
+    const bool asUTCVariant = true;
+    return formateDateInstance(exec, DateTimeFormatDateAndTime, asUTCVariant);
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec)
@@ -577,34 +570,14 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::s_info))
-        return throwVMTypeError(exec);
-
-    DateInstance* thisDateObj = asDateInstance(thisValue); 
-
-    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
-    if (!gregorianDateTime)
-        return JSValue::encode(jsNontrivialString(exec, "Invalid Date"));
-    DateConversionBuffer date;
-    formatDate(*gregorianDateTime, date);
-    return JSValue::encode(jsNontrivialString(exec, date));
+    const bool asUTCVariant = false;
+    return formateDateInstance(exec, DateTimeFormatDate, asUTCVariant);
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::s_info))
-        return throwVMTypeError(exec);
-
-    DateInstance* thisDateObj = asDateInstance(thisValue); 
-
-    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
-    if (!gregorianDateTime)
-        return JSValue::encode(jsNontrivialString(exec, "Invalid Date"));
-    DateConversionBuffer time;
-    formatTime(*gregorianDateTime, time);
-    return JSValue::encode(jsNontrivialString(exec, time));
+    const bool asUTCVariant = false;
+    return formateDateInstance(exec, DateTimeFormatTime, asUTCVariant);
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec)
@@ -676,20 +649,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::s_info))
-        return throwVMTypeError(exec);
-
-    DateInstance* thisDateObj = asDateInstance(thisValue); 
-
-    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
-    if (!gregorianDateTime)
-        return JSValue::encode(jsNontrivialString(exec, "Invalid Date"));
-    DateConversionBuffer date;
-    DateConversionBuffer time;
-    formatDateUTCVariant(*gregorianDateTime, date);
-    formatTimeUTC(*gregorianDateTime, time);
-    return JSValue::encode(jsMakeNontrivialString(exec, date, " ", time));
+    const bool asUTCVariant = true;
+    return formateDateInstance(exec, DateTimeFormatDateAndTime, asUTCVariant);
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallbackBlackBerry.cpp b/Source/JavaScriptCore/runtime/GCActivityCallbackBlackBerry.cpp
index c052c61ba..35b992567 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallbackBlackBerry.cpp
+++ b/Source/JavaScriptCore/runtime/GCActivityCallbackBlackBerry.cpp
@@ -25,8 +25,6 @@
 
 namespace JSC {
 
-static const size_t bytesWorthGC = 4 * 1024 * 1024;
-
 DefaultGCActivityCallback::DefaultGCActivityCallback(Heap* heap)
     : GCActivityCallback(heap->globalData())
 {
@@ -40,7 +38,7 @@ void DefaultGCActivityCallback::doWork()
 
 void DefaultGCActivityCallback::didAllocate(size_t bytesAllocated)
 {
-    if (bytesAllocated < bytesWorthGC || m_timer.started())
+    if (m_timer.started())
         return;
 
     // Try using ~5% CPU time.
diff --git a/Source/JavaScriptCore/runtime/Identifier.cpp b/Source/JavaScriptCore/runtime/Identifier.cpp
index 20770928c..0fc54f3c6 100644
--- a/Source/JavaScriptCore/runtime/Identifier.cpp
+++ b/Source/JavaScriptCore/runtime/Identifier.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2012 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -46,10 +46,10 @@ void deleteIdentifierTable(IdentifierTable* table)
     delete table;
 }
 
-struct IdentifierCStringTranslator {
+struct IdentifierASCIIStringTranslator {
     static unsigned hash(const LChar* c)
     {
-        return StringHasher::computeHash<LChar>(c);
+        return StringHasher::computeHashAndMaskTop8Bits<LChar>(c);
     }
 
     static bool equal(StringImpl* r, const LChar* s)
@@ -60,19 +60,15 @@ struct IdentifierCStringTranslator {
     static void translate(StringImpl*& location, const LChar* c, unsigned hash)
     {
         size_t length = strlen(reinterpret_cast<const char*>(c));
-        LChar* d;
-        StringImpl* r = StringImpl::createUninitialized(length, d).leakRef();
-        for (size_t i = 0; i != length; i++)
-            d[i] = c[i];
-        r->setHash(hash);
-        location = r;
+        location = StringImpl::createFromLiteral(reinterpret_cast<const char*>(c), length).leakRef();
+        location->setHash(hash);
     }
 };
 
 struct IdentifierLCharFromUCharTranslator {
     static unsigned hash(const CharBuffer<UChar>& buf)
     {
-        return StringHasher::computeHash<UChar>(buf.s, buf.length);
+        return StringHasher::computeHashAndMaskTop8Bits<UChar>(buf.s, buf.length);
     }
     
     static bool equal(StringImpl* str, const CharBuffer<UChar>& buf)
@@ -96,10 +92,8 @@ struct IdentifierLCharFromUCharTranslator {
 
 PassRefPtr<StringImpl> Identifier::add(JSGlobalData* globalData, const char* c)
 {
-    if (!c)
-        return 0;
-    if (!c[0])
-        return StringImpl::empty();
+    ASSERT(c);
+    ASSERT(c[0]);
     if (!c[1])
         return add(globalData, globalData->smallStrings.singleCharacterStringRep(c[0]));
 
@@ -110,7 +104,7 @@ PassRefPtr<StringImpl> Identifier::add(JSGlobalData* globalData, const char* c)
     if (iter != literalIdentifierTable.end())
         return iter->second;
 
-    HashSet<StringImpl*>::AddResult addResult = identifierTable.add<const LChar*, IdentifierCStringTranslator>(reinterpret_cast<const LChar*>(c));
+    HashSet<StringImpl*>::AddResult addResult = identifierTable.add<const LChar*, IdentifierASCIIStringTranslator>(reinterpret_cast<const LChar*>(c));
 
     // If the string is newly-translated, then we need to adopt it.
     // The boolean in the pair tells us if that is so.
diff --git a/Source/JavaScriptCore/runtime/Identifier.h b/Source/JavaScriptCore/runtime/Identifier.h
index 7b7907983..196fdca23 100644
--- a/Source/JavaScriptCore/runtime/Identifier.h
+++ b/Source/JavaScriptCore/runtime/Identifier.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2006, 2007, 2008, 2009, 2012 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -35,12 +35,18 @@ namespace JSC {
         friend class Structure;
     public:
         Identifier() { }
+        enum EmptyIdentifierFlag { EmptyIdentifier };
+        Identifier(EmptyIdentifierFlag) : m_string(StringImpl::empty()) { }
 
-        Identifier(ExecState* exec, const char* s) : m_string(add(exec, s)) { } // Only to be used with string literals.
-        Identifier(ExecState* exec, StringImpl* rep) : m_string(add(exec, rep)) { } 
+        // Only to be used with string literals.
+        template<unsigned charactersCount>
+        Identifier(ExecState* exec, const char (&characters)[charactersCount]) : m_string(add(exec, characters)) { }
+        template<unsigned charactersCount>
+        Identifier(JSGlobalData* globalData, const char (&characters)[charactersCount]) : m_string(add(globalData, characters)) { }
+
+        Identifier(ExecState* exec, StringImpl* rep) : m_string(add(exec, rep)) { }
         Identifier(ExecState* exec, const UString& s) : m_string(add(exec, s.impl())) { }
 
-        Identifier(JSGlobalData* globalData, const char* s) : m_string(add(globalData, s)) { } // Only to be used with string literals.
         Identifier(JSGlobalData* globalData, const LChar* s, int length) : m_string(add(globalData, s, length)) { }
         Identifier(JSGlobalData* globalData, const UChar* s, int length) : m_string(add(globalData, s, length)) { }
         Identifier(JSGlobalData* globalData, StringImpl* rep) : m_string(add(globalData, rep)) { } 
@@ -80,8 +86,9 @@ namespace JSC {
         static bool equal(const StringImpl*, const UChar*, unsigned length);
         static bool equal(const StringImpl* a, const StringImpl* b) { return ::equal(a, b); }
 
-        JS_EXPORT_PRIVATE static PassRefPtr<StringImpl> add(ExecState*, const char*); // Only to be used with string literals.
-        static PassRefPtr<StringImpl> add(JSGlobalData*, const char*); // Only to be used with string literals.
+        // Only to be used with string literals.
+        static PassRefPtr<StringImpl> add(JSGlobalData*, const char*);
+        JS_EXPORT_PRIVATE static PassRefPtr<StringImpl> add(ExecState*, const char*);
 
     private:
         UString m_string;
@@ -143,7 +150,7 @@ namespace JSC {
     struct IdentifierCharBufferTranslator {
         static unsigned hash(const CharBuffer<T>& buf)
         {
-            return StringHasher::computeHash<T>(buf.s, buf.length);
+            return StringHasher::computeHashAndMaskTop8Bits<T>(buf.s, buf.length);
         }
         
         static bool equal(StringImpl* str, const CharBuffer<T>& buf)
diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index cdd409706..90e531cec 100644
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -192,11 +192,6 @@ namespace JSC {
         return m_structure.get();
     }
 
-    inline const ClassInfo* JSCell::classInfo() const
-    {
-        return m_classInfo;
-    }
-
     inline void JSCell::visitChildren(JSCell* cell, SlotVisitor& visitor)
     {
         MARK_LOG_PARENT(visitor, cell);
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.cpp b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
index dd05005c7..2d6d1e54f 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -223,9 +223,7 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
 JSGlobalData::~JSGlobalData()
 {
     ASSERT(!m_apiLock.currentThreadIsHoldingLock());
-    heap.activityCallback()->didStartVMShutdown();
-    heap.sweeper()->didStartVMShutdown();
-    heap.lastChanceToFinalize();
+    heap.didStartVMShutdown();
 
     delete interpreter;
 #ifndef NDEBUG
diff --git a/Source/JavaScriptCore/runtime/Options.h b/Source/JavaScriptCore/runtime/Options.h
index 0a55bda6b..ab3f34bb6 100644
--- a/Source/JavaScriptCore/runtime/Options.h
+++ b/Source/JavaScriptCore/runtime/Options.h
@@ -109,6 +109,7 @@ namespace JSC {
     v(double, desiredProfileFullnessRate, 0.35) \
     \
     v(double, doubleVoteRatioForDoubleFormat, 2) \
+    v(double, structureCheckVoteRatioForHoisting, 1) \
     \
     v(unsigned, minimumNumberOfScansBetweenRebalance, 100) \
     v(unsigned, gcMarkStackSegmentSize, pageSize()) \
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index 8e41781e2..ee0b573d9 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -602,6 +602,15 @@ namespace JSC {
         ASSERT(m_structure || !globalData.structureStructure);
     }
 
+    inline const ClassInfo* JSCell::classInfo() const
+    {
+#if ENABLE(GC_VALIDATION)
+        return m_structure.unvalidatedGet()->classInfo();
+#else
+        return m_structure->classInfo();
+#endif
+    }
+
 } // namespace JSC
 
 #endif // Structure_h
diff --git a/Source/JavaScriptCore/runtime/TimeoutChecker.cpp b/Source/JavaScriptCore/runtime/TimeoutChecker.cpp
index 8f3d1a578..56d6d4b71 100644
--- a/Source/JavaScriptCore/runtime/TimeoutChecker.cpp
+++ b/Source/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -80,6 +80,11 @@ static inline unsigned getCPUTime()
     GetThreadTimes(GetCurrentThread(), &creationTime, &exitTime, &kernelTime.fileTime, &userTime.fileTime);
     
     return userTime.fileTimeAsLong / 10000 + kernelTime.fileTimeAsLong / 10000;
+#elif OS(QNX)
+    struct timespec time;
+    if (clock_gettime(CLOCK_THREAD_CPUTIME_ID, &time))
+        CRASH();
+    return time.tv_sec * 1000.0 + time.tv_nsec / 1.0e6;
 #else
     // FIXME: We should return the time the current thread has spent executing.
 
diff --git a/Source/Platform/ChangeLog b/Source/Platform/ChangeLog
index 442098c96..583666eec 100644
--- a/Source/Platform/ChangeLog
+++ b/Source/Platform/ChangeLog
@@ -1,3 +1,716 @@
+2012-08-09  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove forwarding headers for compositor-related WebKit API and update includes
+        https://bugs.webkit.org/show_bug.cgi?id=93669
+
+        Reviewed by Adam Barth.
+
+        Removes a no-longer-necessary transitional define.
+
+        * chromium/public/WebCompositor.h:
+
+2012-08-06  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Expose CCGraphicsContext as WebCompositorOutputSurface
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Reviewed by James Robinson.
+
+        The CCGraphicsContext was introduced as a wrapper around the 2D
+        and 3D output for the compositor. However, it is a CC only
+        concept. We want to be able to make 2D and ubercomp-mode IPCs on
+        behalf of the compositor. This patch allows this by pushing this
+        abstraction out to the Chrome-visible layer of the compositor,
+        changing the name to OutputSurface based on discussions on
+        wkb.ug/90736. A future patch will rename the CCGraphicsContext to
+        CCOutputSurface.
+
+        * Platform.gypi:
+        * chromium/public/WebCompositorOutputSurface.h: Added.
+        (WebKit):
+        (WebCompositorOutputSurface):
+        (WebKit::WebCompositorOutputSurface::~WebCompositorOutputSurface):
+        (WebKit::WebCompositorOutputSurface::Capabilities::Capabilities):
+        (Capabilities):
+        * chromium/public/WebCompositorOutputSurfaceClient.h: Added.
+        (WebKit):
+        (WebCompositorOutputSurfaceClient):
+        (WebKit::WebCompositorOutputSurfaceClient::~WebCompositorOutputSurfaceClient):
+        * chromium/public/WebLayerTreeView.h:
+        (WebKit::WebLayerTreeView::Settings::Settings):
+        (Settings):
+        * chromium/public/WebLayerTreeViewClient.h:
+        (WebKit):
+        (WebLayerTreeViewClient):
+        (WebKit::WebLayerTreeViewClient::createContext3D):
+        (WebKit::WebLayerTreeViewClient::createOutputSurface):
+
+2012-08-09  Nat Duca  <nduca@chromium.org>
+
+        Unreviewed, rolling out r125212.
+        http://trac.webkit.org/changeset/125212
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Compile failure on mac dbg builder
+
+        * Platform.gypi:
+        * chromium/public/WebCompositorOutputSurface.h: Removed.
+        * chromium/public/WebCompositorOutputSurfaceClient.h: Removed.
+        * chromium/public/WebLayerTreeView.h:
+        (WebKit::WebLayerTreeView::Settings::Settings):
+        (Settings):
+        * chromium/public/WebLayerTreeViewClient.h:
+        (WebKit):
+        (WebLayerTreeViewClient):
+
+2012-08-06  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Expose CCGraphicsContext as WebCompositorOutputSurface
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Reviewed by James Robinson.
+
+        The CCGraphicsContext was introduced as a wrapper around the 2D
+        and 3D output for the compositor. However, it is a CC only
+        concept. We want to be able to make 2D and ubercomp-mode IPCs on
+        behalf of the compositor. This patch allows this by pushing this
+        abstraction out to the Chrome-visible layer of the compositor,
+        changing the name to OutputSurface based on discussions on
+        wkb.ug/90736. A future patch will rename the CCGraphicsContext to
+        CCOutputSurface.
+
+        * Platform.gypi:
+        * chromium/public/WebCompositorOutputSurface.h: Added.
+        (WebKit):
+        (WebCompositorOutputSurface):
+        (WebKit::WebCompositorOutputSurface::~WebCompositorOutputSurface):
+        (WebKit::WebCompositorOutputSurface::Capabilities::Capabilities):
+        (Capabilities):
+        * chromium/public/WebCompositorOutputSurfaceClient.h: Added.
+        (WebKit):
+        (WebCompositorOutputSurfaceClient):
+        (WebKit::WebCompositorOutputSurfaceClient::~WebCompositorOutputSurfaceClient):
+        * chromium/public/WebLayerTreeView.h:
+        (WebKit::WebLayerTreeView::Settings::Settings):
+        (Settings):
+        * chromium/public/WebLayerTreeViewClient.h:
+        (WebKit):
+        (WebLayerTreeViewClient):
+        (WebKit::WebLayerTreeViewClient::createContext3D):
+        (WebKit::WebLayerTreeViewClient::createOutputSurface):
+
+2012-08-08  Adrienne Walker  <enne@google.com>
+
+        [chromium] Move scrollbar pointer into WebScrollbarThemePainter
+        https://bugs.webkit.org/show_bug.cgi?id=93541
+
+        Reviewed by James Robinson.
+
+        Update WebScrollbarThemePainter to encapsulate a pointer to the
+        scrollbar as well. Lion scrollbars and RenderScrollbars are both
+        incompatible with wrapping a scrollbar in a WebScrollbar.
+
+        ScrollbarTheme(Chromium)Mac attaches extra data to a scrollbar based
+        on the pointer value (via a static map keyed on the pointer) so
+        passing an object that returns all the same values for the
+        ScrollbarThemeClient interface but has a different pointer will fail
+        to paint.
+
+        RenderScrollbar does static casts on the ScrollbarThemeClient pointer
+        that it is passed, assuming that it is the same. Therefore, it also
+        cannot use a WebScrollbar.
+
+        To fix this, push the real scrollbar pointer into the painter.
+
+        * chromium/public/WebScrollbarThemePainter.h:
+        (WebCore):
+        (WebKit::WebScrollbarThemePainter::WebScrollbarThemePainter):
+        (WebScrollbarThemePainter):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Only use public Platform API in NonCompositedContentHost
+        https://bugs.webkit.org/show_bug.cgi?id=93423
+
+        Reviewed by Adrienne Walker.
+
+        Adds setters to control text antialiasing and checkerboarding behavior for content layers.
+
+        * chromium/public/WebContentLayer.h:
+        (WebContentLayer):
+
+2012-08-08  Nate Chapin  <japhet@chromium.org>
+
+        [chromium] Upstream android's FlingAnimator
+        https://bugs.webkit.org/show_bug.cgi?id=92900
+
+        Reviewed by James Robinson.
+
+        No new tests yet, will be added once this code is called.
+
+        * Platform.gypi:
+        * chromium/public/Platform.h:
+        (WebKit):
+        (WebKit::Platform::createFlingAnimator):
+        * chromium/public/WebFlingAnimator.h: Added.
+        (WebKit):
+        (WebFlingAnimator):
+        (WebKit::WebFlingAnimator::~WebFlingAnimator):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Switch PlatformLayer typedef to Platform API type for PLATFORM(CHROMIUM)
+        https://bugs.webkit.org/show_bug.cgi?id=93335
+
+        Reviewed by Adrienne Walker.
+
+        Add APIs to control scrolling behavior on WebScrollableLayer.
+
+        * chromium/public/WebScrollableLayer.h:
+        (WebScrollableLayer):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use WebCompositor interface in Platform API instead of CCProxy to query threaded compositor status
+        https://bugs.webkit.org/show_bug.cgi?id=93398
+
+        Reviewed by Adam Barth.
+
+        Adds thread status query interfaces to WebCompositor for WebKit code that wants to know if we are in threaded
+        mode.
+
+        * chromium/public/WebCompositor.h:
+        (WebCompositor):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move WebCompositor interface into Platform API
+        https://bugs.webkit.org/show_bug.cgi?id=93391
+
+        Reviewed by Adam Barth.
+
+        WebCompositor is logically part of the Platform API, along with WebLayerTreeView and the WebLayer types.
+
+        * chromium/public/WebCompositor.h: Renamed from Source/WebKit/chromium/public/WebCompositorClient.h.
+        (WebKit):
+        (WebCompositor):
+        (WebKit::WebCompositor::~WebCompositor):
+
+2012-08-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove lingering unwrap<>() calls in GraphicsLayerChromium.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=93319
+
+        Reviewed by Adrienne Walker.
+
+        Adds a few more entry points to WebLayer that are being used by GraphicsLayerChromium.
+
+        * chromium/public/WebLayer.h:
+        (WebLayer):
+
+2012-08-06  Antoine Labour  <piman@chromium.org>
+
+        [chromium] add sync points and GL_CHROMIUM_texture_mailbox entrypoints to WebGraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=93313
+
+        Reviewed by James Robinson.
+
+        Sync points already landed chromium-side, mailbos at https://chromiumcodereview.appspot.com/10829209/
+
+        * chromium/public/WebGraphicsContext3D.h:
+        (WebKit::WebGraphicsContext3D::insertSyncPoint):
+        (WebKit::WebGraphicsContext3D::waitSyncPoint):
+        (WebGraphicsContext3D):
+        (WebKit::WebGraphicsContext3D::genMailboxCHROMIUM):
+        (WebKit::WebGraphicsContext3D::produceTextureCHROMIUM):
+        (WebKit::WebGraphicsContext3D::consumeTextureCHROMIUM):
+
+2012-08-06  Adrienne Walker  <enne@google.com>
+
+        [chromium] Convert WebScrollbarThemeGeometry from a concrete class to an interface
+        https://bugs.webkit.org/show_bug.cgi?id=93308
+
+        Reviewed by James Robinson.
+
+        Convert WebScrollbarThemeGeometry to be an interface. Update
+        WebScrollbarLayer to take a pointer to this interface.
+
+        * chromium/public/WebScrollbarLayer.h:
+        (WebScrollbarLayer):
+        * chromium/public/WebScrollbarThemeGeometry.h:
+        (WebScrollbarThemeGeometry):
+
+2012-08-06  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] WebTouchCandidatesInfo should be part of the Client API
+        https://bugs.webkit.org/show_bug.cgi?id=93088
+
+        Reviewed by Eric Seidel.
+
+        All the input related interfaces are part of the client (rather than
+        the platform) part of the API. This patch moves WebTouchCandidatesInfo
+        to the client part of the API.
+
+        * Platform.gypi:
+        * chromium/public/WebTouchCandidatesInfo.h: Removed.
+
+2012-08-03  Nico Weber  <thakis@chromium.org>
+
+        [chromium] Add API to make it possible to request all variants of a WebImage
+        https://bugs.webkit.org/show_bug.cgi?id=92933
+
+        Reviewed by Adam Barth.
+
+        Part of http://crbug.com/138550
+
+        * chromium/public/WebImage.h:
+        (WebImage):
+
+2012-08-03  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Move ubercomp quads back into CC
+        https://bugs.webkit.org/show_bug.cgi?id=93062
+
+        Reviewed by James Robinson.
+
+        Because GTFO is almost done, we can move back the quad types
+        to CC and pickle them there.  This patch moves everything back
+        to where it was before and changes types like WebRect to IntRect.
+
+        As a bonus, I also added CCRenderPassDrawQuad and CCYUVVideoDrawQuad
+        (which had been left in the CC files) to CCDrawQuad::size(), so now
+        every quad type is ready for serialization.
+
+        * Platform.gypi:
+        * chromium/public/WebCompositorCheckerboardQuad.h: Removed.
+        * chromium/public/WebCompositorDebugBorderQuad.h: Removed.
+        * chromium/public/WebCompositorIOSurfaceQuad.h: Removed.
+        * chromium/public/WebCompositorQuad.h: Removed.
+        * chromium/public/WebCompositorSharedQuadState.h: Removed.
+        * chromium/public/WebCompositorSolidColorQuad.h: Removed.
+        * chromium/public/WebCompositorStreamVideoQuad.h: Removed.
+        * chromium/public/WebCompositorTextureQuad.h: Removed.
+        * chromium/public/WebCompositorTileQuad.h: Removed.
+
+2012-08-02  Alexandre Elias  <aelias@google.com>
+
+        [chromium] deviceViewportSize cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=92794
+
+        Reviewed by Adrienne Walker.
+
+        In the future, CSS layout size will become increasingly disassociated
+        from physical device size, and it will become impossible to infer one
+        from the other inside the compositor.  Therefore, this patch allows
+        deviceViewportSize to be explicitly passed in by the outside client.
+
+        I also renamed the existing viewportSize field to "layoutViewportSize"
+        for clarity, and converted its uses to deviceViewportSize since
+        that is more appropriate.
+
+        I had to add some default-value scaffolding to WebLayerTreeView in
+        order to avoid breaking ui/compositor.  We can delete it once that's
+        updated.
+
+        * chromium/public/WebLayerTreeView.h:
+        (WebLayerTreeView):
+
+2012-08-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Wrap shared context getters in WebKit API and avoid WebCore::GraphicsContext3D use in compositor internals
+        https://bugs.webkit.org/show_bug.cgi?id=92917
+
+        Reviewed by Adrienne Walker.
+
+        This adds Platform API for creating and accessing shared GraphicsContext3D and Ganesh contexts from the main or
+        compositor threads. These can be used for evaluating filters or doing accelerated painting. These contexts are
+        generally leaked until lost or process exit, the details are documented in WebSharedGraphicsContext3D.h
+
+        * Platform.gypi:
+        * chromium/public/WebSharedGraphicsContext3D.h: Added.
+        (WebKit):
+        (WebSharedGraphicsContext3D):
+
+2012-08-02  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Add a stub for WebView::getTouchHighlightQuads()
+        https://bugs.webkit.org/show_bug.cgi?id=92997
+
+        Reviewed by Adam Barth.
+
+        Chrome on Android will be using this method for the link preview
+        implementation, discussion about which is available in Bug 79150. Since
+        that system is fairly big, will require refactoring, and the unavailable
+        APIs are blocking API compatibility, add a stub for now.
+
+        Together with the WebView API, also add the "WebTouchCandidatesInfo"
+        structure which is being used by it.
+
+        * Platform.gypi: List WebTouchCandidatesInfo.h
+        * chromium/public/WebTouchCandidatesInfo.h: Added.
+        (WebKit):
+        (WebTouchCandidatesInfo):
+        (WebKit::WebTouchCandidatesInfo::WebTouchCandidatesInfo):
+
+2012-08-02  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Add RTCPeerConnectionHandler infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=92866
+
+        Reviewed by Adam Barth.
+
+        Introducing RTCPeerConnectionHandler & RTCPeerConnectionHandlerClient,
+        together with the Chromium WebKit interface, following the pattern of
+        the previous PeerConnection00Handler but with the optimizations from MediaStreamCenter.
+
+        * Platform.gypi:
+        * chromium/public/Platform.h:
+        (WebKit):
+        (Platform):
+        (WebKit::Platform::createRTCPeerConnectionHandler):
+        * chromium/public/WebRTCPeerConnectionHandler.h: Added.
+        (WebKit):
+        (WebRTCPeerConnectionHandler):
+        (WebKit::WebRTCPeerConnectionHandler::~WebRTCPeerConnectionHandler):
+        * chromium/public/WebRTCPeerConnectionHandlerClient.h: Added.
+        (WebKit):
+        (WebRTCPeerConnectionHandlerClient):
+        (WebKit::WebRTCPeerConnectionHandlerClient::~WebRTCPeerConnectionHandlerClient):
+
+2012-08-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124439.
+        http://trac.webkit.org/changeset/124439
+        https://bugs.webkit.org/show_bug.cgi?id=92980
+
+        Broke Chromium Mac Release compile (Requested by apavlov on
+        #webkit).
+
+        * Platform.gypi:
+        * chromium/public/Platform.h:
+        (WebKit):
+        (Platform):
+        (WebKit::Platform::createPeerConnectionHandler):
+        * chromium/public/WebRTCPeerConnectionHandler.h: Removed.
+        * chromium/public/WebRTCPeerConnectionHandlerClient.h: Removed.
+
+2012-08-02  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Add RTCPeerConnectionHandler infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=92866
+
+        Reviewed by Kentaro Hara.
+
+        Introducing RTCPeerConnectionHandler & RTCPeerConnectionHandlerClient,
+        together with the Chromium WebKit interface, following the pattern of
+        the previous PeerConnection00Handler but with the optimizations from MediaStreamCenter.
+
+        * Platform.gypi:
+        * chromium/public/Platform.h:
+        (WebKit):
+        (Platform):
+        (WebKit::Platform::createRTCPeerConnectionHandler):
+        * chromium/public/WebRTCPeerConnectionHandler.h: Added.
+        (WebKit):
+        (WebRTCPeerConnectionHandler):
+        (WebKit::WebRTCPeerConnectionHandler::~WebRTCPeerConnectionHandler):
+        * chromium/public/WebRTCPeerConnectionHandlerClient.h: Added.
+        (WebKit):
+        (WebRTCPeerConnectionHandlerClient):
+        (WebKit::WebRTCPeerConnectionHandlerClient::~WebRTCPeerConnectionHandlerClient):
+
+2012-08-02  Hironori Bono  <hbono@chromium.org>
+
+        [Chromium] Implement hyphenation for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=48610
+
+        Reviewed by Eric Seidel.
+
+        This change adds a couple of methods canHyphenate and computeLastHyphenLocation
+        to Platform so Chromium can implement them. Also, this change uses these methods
+        to implement the hyphenation methods of WebCore. (This change does not change
+        any behaviors until Chromium implements these methods.)
+
+        * chromium/public/Platform.h:
+        (Platform):
+        (WebKit::Platform::canHyphenate): Added a stub method so Chromium can implement it.
+        (WebKit::Platform::computeLastHyphenLocation): ditto.
+
+2012-08-02  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Move RTCConfiguration to its proper place
+        https://bugs.webkit.org/show_bug.cgi?id=92867
+
+        Reviewed by Adam Barth.
+
+        This patch moves RTCConfiguration to Source/WebCore/platform/mediastream,
+        and adds its WebKit interface for chromium.
+
+        * Platform.gypi:
+        * chromium/public/WebRTCConfiguration.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebRTCICEServer):
+        (WebKit::WebRTCICEServer::WebRTCICEServer):
+        (WebKit::WebRTCICEServer::~WebRTCICEServer):
+        (WebKit::WebRTCICEServer::operator=):
+        (WebKit::WebRTCICEServer::isNull):
+        (WebRTCConfiguration):
+        (WebKit::WebRTCConfiguration::WebRTCConfiguration):
+        (WebKit::WebRTCConfiguration::~WebRTCConfiguration):
+        (WebKit::WebRTCConfiguration::operator=):
+        (WebKit::WebRTCConfiguration::isNull):
+
+2012-08-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move compositor HUD font atlas initialization code out of compositor core
+        https://bugs.webkit.org/show_bug.cgi?id=92924
+
+        Reviewed by Adrienne Walker.
+
+        The chromium compositor does not have any text rendering capabilities. It generally does not need them, but it
+        is helpful for some debugging aids to be able to render at least ASCII text to the screen. This provides an API
+        on WebLayerTreeView by which an embedder can provide an ASCII glyph atlas to use for displaying debug
+        information.
+
+        * chromium/public/WebLayerTreeView.h:
+        (WebLayerTreeView):
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        Unreviewed. Fix build break for chromium.
+
+        * Platform.gypi:
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        [chromium] Make WebKit API support draggable region change update
+        https://bugs.webkit.org/show_bug.cgi?id=92813
+
+        Reviewed by Adam Barth.
+
+        Add WebDraggableRegion for chromium's usage.
+
+        * Platform.gypi:
+
+2012-08-01  Antoine Labour  <piman@chromium.org>
+
+        [chromium] factor out the optimization pass in CCRenderSurfaceFilters::apply
+        https://bugs.webkit.org/show_bug.cgi?id=92453
+
+        Reviewed by James Robinson.
+
+        This separates the "optimization" pass in CCRenderSurfaceFilters::apply
+        to resolve a succession of color matrix filters into a single operation.
+        This allows testing of that code.
+        This introduces a new generic color matrix WebFilterOperation, which can
+        also be used on its own.
+
+        * Platform.gypi:
+        * chromium/public/WebFilterOperation.h:
+        (WebKit::WebFilterOperation::matrix):
+        (WebKit::WebFilterOperation::createColorMatrixFilter):
+        (WebFilterOperation):
+        (WebKit::WebFilterOperation::WebFilterOperation):
+        * chromium/src/WebFilterOperation.cpp: Copied from Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.h.
+        (WebKit):
+        (WebKit::WebFilterOperation::equals):
+        (WebKit::WebFilterOperation::WebFilterOperation):
+        * chromium/src/WebFilterOperations.cpp:
+        (WebKit::WebFilterOperations::hasFilterThatAffectsOpacity):
+
+2012-08-01  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Add ExtraData capability to MediaStreamSource
+        https://bugs.webkit.org/show_bug.cgi?id=92860
+
+        Reviewed by Adam Barth.
+
+        The Chromium port needs to store some related data in MediaStreamSource objects.
+
+        * chromium/public/WebMediaStreamSource.h:
+        (ExtraData):
+        (WebKit::WebMediaStreamSource::ExtraData::~ExtraData):
+        (WebMediaStreamSource):
+
+2012-08-01  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: count DOM storage cache memory for native snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=91617
+
+        Reviewed by Yury Semikhatsky.
+
+        Add memory size used for DOM storage cache reporting interface.
+
+        * chromium/public/WebStorageArea.h:
+        (WebStorageArea):
+        (WebKit::WebStorageArea::memoryBytesUsedByCache):
+
+2012-07-31  Chris Rogers  <crogers@google.com>
+
+        Allow AudioDestination to support local/live audio input
+        https://bugs.webkit.org/show_bug.cgi?id=90318
+
+        Reviewed by Kenneth Russell.
+
+        * chromium/public/WebAudioDevice.h:
+        (WebKit::WebAudioDevice::RenderCallback::render):
+        (RenderCallback):
+
+2012-07-31  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Use WebAnimation and related classes in GraphicsLayerChromium and AnimTranslationUtil
+        https://bugs.webkit.org/show_bug.cgi?id=90468
+
+        Reviewed by James Robinson.
+
+        * Platform.gypi:
+        * chromium/public/WebAnimation.h:
+        (WebAnimation):
+        (WebKit::WebAnimation::WebAnimation):
+        * chromium/public/WebAnimationDelegate.h: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationDelegate.h.
+        (WebKit):
+        (WebAnimationDelegate):
+        * chromium/public/WebLayer.h:
+        (WebKit):
+        (WebLayer):
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        * chromium/public/WebLocalizedString.h: Added OtherColorLabel.
+
+2012-07-30  Adrienne Walker  <enne@google.com>
+
+        [chromium] Wrap ScrollbarLayerChromium in WebScrollbarLayer
+        https://bugs.webkit.org/show_bug.cgi?id=91032
+
+        Reviewed by James Robinson.
+
+        Add WebScrollbarLayer class to the Platform API.
+
+        * Platform.gypi:
+        * chromium/public/WebScrollbarLayer.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebScrollbarLayer):
+        (WebKit::WebScrollbarLayer::WebScrollbarLayer):
+        (WebKit::WebScrollbarLayer::~WebScrollbarLayer):
+        (WebKit::WebScrollbarLayer::operator=):
+
+2012-06-29  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove WebTransformationMatrix::mapPoint overrides
+        https://bugs.webkit.org/show_bug.cgi?id=90329
+
+        Reviewed by Adrienne Walker.
+
+        Remove clipping-unaware mapPoint functions from the WebTransformationMatrix interface.
+
+        * chromium/public/WebTransformationMatrix.h:
+        (WebTransformationMatrix):
+
+2012-07-30  John Bates  <jbates@google.com>
+
+        Plumb vsync-enabled flag up to compositor thread and support disable-vsync
+        https://bugs.webkit.org/show_bug.cgi?id=92323
+
+        Reviewed by James Robinson.
+
+        * chromium/public/WebLayerTreeView.h:
+        (WebKit::WebLayerTreeView::Settings::Settings):
+        (Settings):
+
+2012-07-30  Adrienne Walker  <enne@google.com>
+
+        [chromium] Remove dependency on ScrollbarTheme from the compositor
+        https://bugs.webkit.org/show_bug.cgi?id=90528
+
+        Reviewed by James Robinson.
+
+        Flesh out WebScrollbar functions enough to be able to implement
+        the parts of ScrollbarThemeClient that Chromium uses.
+
+        Wrap ScrollbarThemeComposite in the Platform API via two different
+        classes: WebScrollbarThemePainter is the non-threadsafe version that
+        is used to paint parts of a scrollbar into a context. This is intended
+        to only be used on the main thread. WebScrollbarThemeGeometry is the
+        threadsafe version, used to get the location and sizes of scrollbar
+        parts on both threads, so they can be painted on the main thread and
+        composited on the compositor thread.
+
+        Unfortunately, there is no way to enforce these thread safety issues,
+        as other ports use the ScrollbarTheme hierarchy differently than
+        Chromium does. On the bright side, other than painting, the
+        ScrollbarTheme code is largely functional and we can enforce this
+        internally for the Chromium port.
+
+        * Platform.gypi:
+        * chromium/public/WebScrollbar.h:
+        (WebCore):
+        (WebKit):
+        (WebScrollbar):
+        * chromium/public/WebScrollbarThemeGeometry.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebScrollbarThemeGeometry):
+        (WebKit::WebScrollbarThemeGeometry::WebScrollbarThemeGeometry):
+        (WebKit::WebScrollbarThemeGeometry::~WebScrollbarThemeGeometry):
+        (WebKit::WebScrollbarThemeGeometry::operator=):
+        (WebKit::WebScrollbarThemeGeometry::isNull):
+        * chromium/public/WebScrollbarThemePainter.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebScrollbarThemePainter):
+        (WebKit::WebScrollbarThemePainter::WebScrollbarThemePainter):
+        (WebKit::WebScrollbarThemePainter::~WebScrollbarThemePainter):
+        (WebKit::WebScrollbarThemePainter::operator=):
+        (WebKit::WebScrollbarThemePainter::isNull):
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124025.
+        http://trac.webkit.org/changeset/124025
+        https://bugs.webkit.org/show_bug.cgi?id=92658
+
+        Causes color-suggestion-picker-appearance layout test to time
+        out on all Chromium platforms (Requested by tomhudson_ on
+        #webkit).
+
+        * chromium/public/WebLocalizedString.h:
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        * chromium/public/WebLocalizedString.h: Added OtherColorLabel.
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124004.
+        http://trac.webkit.org/changeset/124004
+        https://bugs.webkit.org/show_bug.cgi?id=92622
+
+        Broke Android build (Requested by keishi on #webkit).
+
+        * chromium/public/WebLocalizedString.h:
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        * chromium/public/WebLocalizedString.h: Added OtherColorLabel.
+
 2012-07-25  Min Qin  <qinmin@chromium.org>
 
         Upstream declaration of WebGraphicsContext3D::createStreamTextureCHROMIUM() for android
diff --git a/Source/Platform/Platform.gyp/Platform.gyp b/Source/Platform/Platform.gyp/Platform.gyp
index 911116a9f..c8f1f1fb5 100644
--- a/Source/Platform/Platform.gyp/Platform.gyp
+++ b/Source/Platform/Platform.gyp/Platform.gyp
@@ -39,6 +39,7 @@
             'type': 'static_library',
             'dependencies': [
                 '../../WTF/WTF.gyp/WTF.gyp:wtf',
+                '<(DEPTH)/skia/skia.gyp:skia',
             ],
             'include_dirs': [
                 '../chromium',
diff --git a/Source/Platform/Platform.gypi b/Source/Platform/Platform.gypi
index 465dc312c..7ab08262a 100644
--- a/Source/Platform/Platform.gypi
+++ b/Source/Platform/Platform.gypi
@@ -34,6 +34,7 @@
             'chromium/public/Platform.h',
             'chromium/public/WebAnimation.h',
             'chromium/public/WebAnimationCurve.h',
+            'chromium/public/WebAnimationDelegate.h',
             'chromium/public/WebAudioBus.h',
             'chromium/public/WebAudioDevice.h',
             'chromium/public/WebBlobData.h',
@@ -43,15 +44,8 @@
             'chromium/public/WebClipboard.h',
             'chromium/public/WebColor.h',
             'chromium/public/WebCommon.h',
-            'chromium/public/WebCompositorCheckerboardQuad.h',
-            'chromium/public/WebCompositorDebugBorderQuad.h',
-            'chromium/public/WebCompositorIOSurfaceQuad.h',
-            'chromium/public/WebCompositorQuad.h',
-            'chromium/public/WebCompositorSharedQuadState.h',
-            'chromium/public/WebCompositorSolidColorQuad.h',
-            'chromium/public/WebCompositorStreamVideoQuad.h',
-            'chromium/public/WebCompositorTextureQuad.h',
-            'chromium/public/WebCompositorTileQuad.h',
+            'chromium/public/WebCompositorOutputSurface.h',
+            'chromium/public/WebCompositorOutputSurfaceClient.h',
             'chromium/public/WebContentLayer.h',
             'chromium/public/WebContentLayerClient.h',
             'chromium/public/WebCookie.h',
@@ -65,6 +59,7 @@
             'chromium/public/WebFileUtilities.h',
             'chromium/public/WebFilterOperation.h',
             'chromium/public/WebFilterOperations.h',
+            'chromium/public/WebFlingAnimator.h',
             'chromium/public/WebFloatAnimationCurve.h',
             'chromium/public/WebFloatKeyframe.h',
             'chromium/public/WebFloatPoint.h',
@@ -105,11 +100,18 @@
             'chromium/public/WebPrerenderingSupport.h',
             'chromium/public/WebPrivateOwnPtr.h',
             'chromium/public/WebPrivatePtr.h',
+            'chromium/public/WebRTCConfiguration.h',
+            'chromium/public/WebRTCPeerConnectionHandler.h',
+            'chromium/public/WebRTCPeerConnectionHandlerClient.h',
             'chromium/public/WebRect.h',
             'chromium/public/WebReferrerPolicy.h',
             'chromium/public/WebRenderingStats.h',
             'chromium/public/WebScrollbar.h',
+            'chromium/public/WebScrollbarLayer.h',
+            'chromium/public/WebScrollbarThemeGeometry.h',
+            'chromium/public/WebScrollbarThemePainter.h',
             'chromium/public/WebSessionDescriptionDescriptor.h',
+            'chromium/public/WebSharedGraphicsContext3D.h',
             'chromium/public/WebSize.h',
             'chromium/public/WebSocketStreamError.h',
             'chromium/public/WebSocketStreamHandle.h',
@@ -147,6 +149,7 @@
             'chromium/public/win/WebThemeEngine.h',
             'chromium/src/Platform.cpp',
             'chromium/src/WebCString.cpp',
+            'chromium/src/WebFilterOperation.cpp',
             'chromium/src/WebFilterOperations.cpp',
             'chromium/src/WebFloatQuad.cpp',
             'chromium/src/WebPrerenderingSupport.cpp',
diff --git a/Source/Platform/chromium/public/Platform.h b/Source/Platform/chromium/public/Platform.h
index 64df3ba89..d6ba86fe7 100644
--- a/Source/Platform/chromium/public/Platform.h
+++ b/Source/Platform/chromium/public/Platform.h
@@ -52,21 +52,22 @@ class WebClipboard;
 class WebCookieJar;
 class WebFileSystem;
 class WebFileUtilities;
+class WebFlingAnimator;
 class WebMediaStreamCenter;
 class WebMediaStreamCenterClient;
 class WebMessagePortChannel;
 class WebMimeRegistry;
 class WebPeerConnection00Handler;
 class WebPeerConnection00HandlerClient;
-class WebPeerConnectionHandler;
-class WebPeerConnectionHandlerClient;
-class WebURL;
-class WebURLLoader;
+class WebRTCPeerConnectionHandler;
+class WebRTCPeerConnectionHandlerClient;
 class WebSandboxSupport;
 class WebSocketStreamHandle;
 class WebStorageNamespace;
 class WebThemeEngine;
 class WebThread;
+class WebURL;
+class WebURLLoader;
 class WebWorkerRunLoop;
 struct WebLocalizedString;
 
@@ -164,6 +165,15 @@ public:
     virtual bool isLinkVisited(unsigned long long linkHash) { return false; }
 
 
+    // Hyphenation ---------------------------------------------------------
+
+    // Returns whether we can support hyphenation for the given locale.
+    virtual bool canHyphenate(const WebString& locale) { return false; }
+
+    // Returns the last position where we can add a hyphen before the given position.
+    virtual size_t computeLastHyphenLocation(const WebUChar* characters, size_t length, size_t beforeIndex, const WebString& locale) { return 0; }
+
+
     // Keygen --------------------------------------------------------------
 
     // Handle the <keygen> tag for generating client certificates
@@ -401,19 +411,20 @@ public:
     // This value must be checked again after a context loss event as the platform's capabilities may have changed.
     virtual bool canAccelerate2dCanvas() { return false; }
 
+    virtual WebFlingAnimator* createFlingAnimator() { return 0; }
 
     // WebRTC ----------------------------------------------------------
 
     // DEPRECATED
-    // Creates an WebPeerConnectionHandler for DeprecatedPeerConnection.
-    // May return null if WebRTC functionality is not avaliable or out of resources.
-    virtual WebPeerConnectionHandler* createPeerConnectionHandler(WebPeerConnectionHandlerClient*) { return 0; }
-
     // Creates an WebPeerConnection00Handler for PeerConnection00.
     // This is an highly experimental feature not yet in the WebRTC standard.
     // May return null if WebRTC functionality is not avaliable or out of resources.
     virtual WebPeerConnection00Handler* createPeerConnection00Handler(WebPeerConnection00HandlerClient*) { return 0; }
 
+    // Creates an WebRTCPeerConnectionHandler for RTCPeerConnection.
+    // May return null if WebRTC functionality is not avaliable or out of resources.
+    virtual WebRTCPeerConnectionHandler* createRTCPeerConnectionHandler(WebRTCPeerConnectionHandlerClient*) { return 0; }
+
     // May return null if WebRTC functionality is not avaliable or out of resources.
     virtual WebMediaStreamCenter* createMediaStreamCenter(WebMediaStreamCenterClient*) { return 0; }
 
diff --git a/Source/Platform/chromium/public/WebAnimation.h b/Source/Platform/chromium/public/WebAnimation.h
index b715e050f..0db98ad35 100644
--- a/Source/Platform/chromium/public/WebAnimation.h
+++ b/Source/Platform/chromium/public/WebAnimation.h
@@ -45,8 +45,8 @@ class WebAnimationCurve;
 class WebAnimation : public WebNonCopyable {
 public:
     enum TargetProperty {
-        WebAnimationTransform = 1,
-        WebAnimationOpacity
+        TargetPropertyTransform = 0,
+        TargetPropertyOpacity
     };
 
     WebAnimation(const WebAnimationCurve& curve, TargetProperty targetProperty)
@@ -54,11 +54,21 @@ public:
         initialize(curve, targetProperty);
     }
 
+    // An animationId is effectively the animation's name, and it is not unique.
+    // Animations with the same groupId are run at the same time. An animation
+    // may be uniquely identified by a combination of groupId and target property.
+    WebAnimation(const WebAnimationCurve& curve, int animationId, int groupId, TargetProperty targetProperty)
+    {
+        initialize(curve, animationId, groupId, targetProperty);
+    }
+
     ~WebAnimation()
     {
         destroy();
     }
 
+    WEBKIT_EXPORT TargetProperty targetProperty() const;
+
     // This is the number of times that the animation will play. If this
     // value is zero the animation will not play. If it is negative, then
     // the animation will loop indefinitely.
@@ -82,7 +92,7 @@ public:
 
 private:
     WEBKIT_EXPORT void initialize(const WebAnimationCurve&, TargetProperty);
-    WEBKIT_EXPORT void initialize(const WebAnimation&);
+    WEBKIT_EXPORT void initialize(const WebAnimationCurve&, int animationId, int groupId, TargetProperty);
     WEBKIT_EXPORT void destroy();
 
     WebPrivateOwnPtr<WebCore::CCActiveAnimation> m_private;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationDelegate.h b/Source/Platform/chromium/public/WebAnimationDelegate.h
index 06b21d3d1..f77c1ccc8 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationDelegate.h
+++ b/Source/Platform/chromium/public/WebAnimationDelegate.h
@@ -22,18 +22,17 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef CCLayerAnimationDelegate_h
-#define CCLayerAnimationDelegate_h
+#ifndef WebAnimationDelegate_h
+#define WebAnimationDelegate_h
 
-namespace WebCore {
+namespace WebKit {
 
-// This class is used to send notifications when layer animations begin or end.
-class CCLayerAnimationDelegate {
+class WebAnimationDelegate {
 public:
     virtual void notifyAnimationStarted(double time) = 0;
     virtual void notifyAnimationFinished(double time) = 0;
 };
 
-} // namespace WebCore
+} // namespace WebKit
 
-#endif // CCLayerAnimationDelegate_h
+#endif // WebAnimationDelegate_h
diff --git a/Source/Platform/chromium/public/WebAudioDevice.h b/Source/Platform/chromium/public/WebAudioDevice.h
index 00aea975f..ab3e5875b 100644
--- a/Source/Platform/chromium/public/WebAudioDevice.h
+++ b/Source/Platform/chromium/public/WebAudioDevice.h
@@ -39,7 +39,11 @@ class WebAudioDevice {
 public:
     class RenderCallback {
     public:
+        virtual void render(const WebVector<float*>& sourceData, const WebVector<float*>& destinationData, size_t numberOfFrames) { };
+
+        // FIXME: to be removed once we switch over to newer render() method handling both audio output and (optional) input.
         virtual void render(const WebVector<float*>& audioData, size_t numberOfFrames) = 0;
+
     protected:
         virtual ~RenderCallback() { }
     };
diff --git a/Source/WebKit/chromium/public/WebCompositor.h b/Source/Platform/chromium/public/WebCompositor.h
index 6e0da2b22..6bdd8ff34 100644
--- a/Source/WebKit/chromium/public/WebCompositor.h
+++ b/Source/Platform/chromium/public/WebCompositor.h
@@ -26,13 +26,10 @@
 #ifndef WebCompositor_h
 #define WebCompositor_h
 
-#define WEBCOMPOSITOR_OWNS_SETTINGS 1
-
-#include "platform/WebCommon.h"
+#include "WebCommon.h"
 
 namespace WebKit {
 
-class WebInputEvent;
 class WebThread;
 
 // This class contains global routines for interacting with the
@@ -46,6 +43,9 @@ public:
     // prior to calling initialize.
     WEBKIT_EXPORT static void initialize(WebThread*);
 
+    // Returns whether the compositor was initialized with threading enabled.
+    WEBKIT_EXPORT static bool threadingEnabled();
+
     // Shuts down the compositor. This must be called when all compositor data
     // types have been deleted. No compositor classes or methods should be used
     // after shutdown.
diff --git a/Source/Platform/chromium/public/WebCompositorIOSurfaceQuad.h b/Source/Platform/chromium/public/WebCompositorIOSurfaceQuad.h
deleted file mode 100644
index e850e0628..000000000
--- a/Source/Platform/chromium/public/WebCompositorIOSurfaceQuad.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebCompositorIOSurfaceQuad_h
-#define WebCompositorIOSurfaceQuad_h
-
-#include "WebCompositorQuad.h"
-#include "WebSize.h"
-#include <wtf/PassOwnPtr.h>
-
-namespace WebKit {
-
-#pragma pack(push, 4)
-
-class WebCompositorIOSurfaceQuad : public WebCompositorQuad {
-public:
-#if WEBKIT_IMPLEMENTATION
-    enum Orientation {
-      Flipped,
-      Unflipped
-    };
-
-    static PassOwnPtr<WebCompositorIOSurfaceQuad> create(const WebCompositorSharedQuadState*, const WebCore::IntRect&, const WebCore::IntSize& ioSurfaceSize, unsigned ioSurfaceTextureId, Orientation);
-
-    WebCore::IntSize ioSurfaceSize() const { return m_ioSurfaceSize; }
-    unsigned ioSurfaceTextureId() const { return m_ioSurfaceTextureId; }
-    Orientation orientation() const { return m_orientation; }
-#endif
-
-    static const WebCompositorIOSurfaceQuad* materialCast(const WebCompositorQuad*);
-private:
-#if WEBKIT_IMPLEMENTATION
-    WebCompositorIOSurfaceQuad(const WebCompositorSharedQuadState*, const WebCore::IntRect&, const WebCore::IntSize& ioSurfaceSize, unsigned ioSurfaceTextureId, Orientation);
-#endif
-
-    WebSize m_ioSurfaceSize;
-    unsigned m_ioSurfaceTextureId;
-    Orientation m_orientation;
-};
-
-#pragma pack(pop)
-
-}
-
-#endif
diff --git a/Source/Platform/chromium/public/WebCompositorOutputSurface.h b/Source/Platform/chromium/public/WebCompositorOutputSurface.h
new file mode 100644
index 000000000..e93d8b4f0
--- /dev/null
+++ b/Source/Platform/chromium/public/WebCompositorOutputSurface.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCompositorOutputSurface_h
+#define WebCompositorOutputSurface_h
+
+namespace WebKit {
+
+class WebCompositorFrame;
+class WebGraphicsContext3D;
+class WebCompositorOutputSurfaceClient;
+
+// Represents the output surface for a compositor. The compositor owns
+// and manages its destruction. Its lifetime is:
+//   1. Created on the main thread via WebLayerTreeViewClient::createOutputSurface.
+//   2. Passed to the compositor thread and bound to a client via bindToClient.
+//      From here on, it will only be used on the compositor thread.
+//   3. If the 3D context is lost, then the compositor will delete the output surface
+//      (on the compositor thread) and go back to step 1.
+class WebCompositorOutputSurface {
+public:
+    virtual ~WebCompositorOutputSurface() { }
+
+    // Called by the compositor on the compositor thread. This is a place where thread-specific
+    // data for the output surface can be initialized, since from this point on the output surface
+    // will only be used on the compositor thread.
+    virtual bool bindToClient(WebCompositorOutputSurfaceClient*) = 0;
+
+    struct Capabilities {
+        Capabilities()
+            : hasParentCompositor(false)
+        {
+        }
+
+        bool hasParentCompositor;
+    };
+
+    virtual const Capabilities& capabilities() const = 0;
+
+    // Obtains the context associated with this output surface. In the event of a lost context, the
+    // entire output surface should be recreated.
+    virtual WebGraphicsContext3D* context3D() const = 0;
+
+    // Sends frame data to the parent compositor. This should only be called
+    // when capabilities().hasParentCompositor.
+    virtual void sendFrameToParentCompositor(const WebCompositorFrame&) = 0;
+
+};
+
+}
+
+#endif
diff --git a/Source/WebKit/chromium/public/platform/WebExternalTextureLayer.h b/Source/Platform/chromium/public/WebCompositorOutputSurfaceClient.h
index 000826df7..8e38fcfe7 100644
--- a/Source/WebKit/chromium/public/platform/WebExternalTextureLayer.h
+++ b/Source/Platform/chromium/public/WebCompositorOutputSurfaceClient.h
@@ -23,4 +23,19 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "../../../../Platform/chromium/public/WebExternalTextureLayer.h"
+#ifndef WebCompositorOutputSurfaceClient_h
+#define WebCompositorOutputSurfaceClient_h
+
+namespace WebKit {
+
+class WebCompositorOutputSurfaceClient {
+public:
+    virtual void onVSyncParametersChanged(double monotonicTimebase, double intervalInSeconds) = 0;
+
+protected:
+    ~WebCompositorOutputSurfaceClient() { }
+};
+
+}
+
+#endif
diff --git a/Source/Platform/chromium/public/WebCompositorQuad.h b/Source/Platform/chromium/public/WebCompositorQuad.h
deleted file mode 100644
index 68027fc55..000000000
--- a/Source/Platform/chromium/public/WebCompositorQuad.h
+++ /dev/null
@@ -1,121 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebCompositorQuad_h
-#define WebCompositorQuad_h
-
-#include "WebCommon.h"
-#include "WebCompositorSharedQuadState.h"
-
-namespace WebKit {
-
-// WARNING! All WebCompositorXYZQuad classes must remain PODs (plain old data).
-// They are intended to be "serializable" by copying their raw bytes, so they
-// must not contain any non-bit-copyable member variables!
-//
-// Furthermore, the class members need to be packed so they are aligned
-// properly and don't have paddings/gaps, otherwise memory check tools
-// like Valgrind will complain about uninitialized memory usage when
-// transferring these classes over the wire.
-#pragma pack(push, 4)
-
-// WebCompositorQuad is a bag of data used for drawing a quad. Because different
-// materials need different bits of per-quad data to render, classes that derive
-// from WebCompositorQuad store additional data in their derived instance. The Material
-// enum is used to "safely" downcast to the derived class.
-class WebCompositorQuad {
-public:
-    enum Material {
-        Invalid,
-        Checkerboard,
-        DebugBorder,
-        IOSurfaceContent,
-        RenderPass,
-        TextureContent,
-        SolidColor,
-        TiledContent,
-        YUVVideoContent,
-        StreamVideoContent,
-    };
-
-#if WEBKIT_IMPLEMENTATION
-    WebCore::IntRect quadRect() const { return m_quadRect; }
-    const WebTransformationMatrix& quadTransform() const { return m_sharedQuadState->quadTransform; }
-    WebCore::IntRect visibleContentRect() const { return m_sharedQuadState->visibleContentRect; }
-    WebCore::IntRect scissorRect() const { return m_sharedQuadState->scissorRect; }
-    float opacity() const { return m_sharedQuadState->opacity; }
-    // For the purposes of blending, what part of the contents of this quad are opaque?
-    WebCore::IntRect opaqueRect() const;
-    bool needsBlending() const { return m_needsBlending || !opaqueRect().contains(m_quadVisibleRect); }
-    bool isLayerAxisAlignedIntRect() const { return m_sharedQuadState->isLayerAxisAlignedIntRect(); }
-
-    // Allows changing the rect that gets drawn to make it smaller. Parameter passed
-    // in will be clipped to quadRect().
-    void setQuadVisibleRect(const WebCore::IntRect&);
-    WebCore::IntRect quadVisibleRect() const { return m_quadVisibleRect; }
-    bool isDebugQuad() const { return m_material == DebugBorder; }
-#endif
-
-    Material material() const { return m_material; }
-
-    // Returns transfer size of this object based on the derived class (by
-    // looking at the material type).
-    unsigned size() const;
-
-    const WebCompositorSharedQuadState* sharedQuadState() const { return m_sharedQuadState; }
-    int sharedQuadStateId() const { return m_sharedQuadStateId; }
-    void setSharedQuadState(const WebCompositorSharedQuadState*);
-
-protected:
-#if WEBKIT_IMPLEMENTATION
-    WebCompositorQuad(const WebCompositorSharedQuadState*, Material, const WebCore::IntRect&);
-#endif
-
-    // Stores state common to a large bundle of quads; kept separate for memory
-    // efficiency. There is special treatment to reconstruct these pointers
-    // during serialization.
-    const WebCompositorSharedQuadState* m_sharedQuadState;
-    int m_sharedQuadStateId;
-
-    Material m_material;
-    WebRect m_quadRect;
-    WebRect m_quadVisibleRect;
-
-    // By default, the shared quad state determines whether or not this quad is
-    // opaque or needs blending. Derived classes can override with these
-    // variables.
-    bool m_quadOpaque;
-    bool m_needsBlending;
-
-    // Be default, this rect is empty. It is used when the shared quad state and above
-    // variables determine that the quad is not fully opaque but may be partially opaque.
-    WebRect m_opaqueRect;
-};
-
-#pragma pack(pop)
-
-}
-
-#endif
diff --git a/Source/Platform/chromium/public/WebCompositorTileQuad.h b/Source/Platform/chromium/public/WebCompositorTileQuad.h
deleted file mode 100644
index e20de7233..000000000
--- a/Source/Platform/chromium/public/WebCompositorTileQuad.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebCompositorTileQuad_h
-#define WebCompositorTileQuad_h
-
-#include "GraphicsTypes3D.h"
-#include "WebCompositorQuad.h"
-#include "WebPoint.h"
-#include "WebSize.h"
-#include <wtf/PassOwnPtr.h>
-
-namespace WebKit {
-
-#pragma pack(push, 4)
-
-class WebCompositorTileQuad : public WebCompositorQuad {
-public:
-#if WEBKIT_IMPLEMENTATION
-    static PassOwnPtr<WebCompositorTileQuad> create(const WebCompositorSharedQuadState*, const WebCore::IntRect& quadRect, const WebCore::IntRect& opaqueRect, unsigned resourceId, const WebCore::IntPoint& textureOffset, const WebCore::IntSize& textureSize, GC3Dint textureFilter, bool swizzleContents, bool leftEdgeAA, bool topEdgeAA, bool rightEdgeAA, bool bottomEdgeAA);
-
-    unsigned resourceId() const { return m_resourceId; }
-    WebCore::IntPoint textureOffset() const { return m_textureOffset; }
-    WebCore::IntSize textureSize() const { return m_textureSize; }
-    GC3Dint textureFilter() const { return m_textureFilter; }
-    bool swizzleContents() const { return m_swizzleContents; }
-
-    bool leftEdgeAA() const { return m_leftEdgeAA; }
-    bool topEdgeAA() const { return m_topEdgeAA; }
-    bool rightEdgeAA() const { return m_rightEdgeAA; }
-    bool bottomEdgeAA() const { return m_bottomEdgeAA; }
-
-    bool isAntialiased() const { return leftEdgeAA() || topEdgeAA() || rightEdgeAA() || bottomEdgeAA(); }
-#endif
-
-    static const WebCompositorTileQuad* materialCast(const WebCompositorQuad*);
-private:
-#if WEBKIT_IMPLEMENTATION
-     WebCompositorTileQuad(const WebCompositorSharedQuadState*, const WebCore::IntRect& quadRect, const WebCore::IntRect& opaqueRect, unsigned resourceId, const WebCore::IntPoint& textureOffset, const WebCore::IntSize& textureSize, GC3Dint textureFilter, bool swizzleContents, bool leftEdgeAA, bool topEdgeAA, bool rightEdgeAA, bool bottomEdgeAA);
-#endif
-
-    unsigned m_resourceId;
-    WebPoint m_textureOffset;
-    WebSize m_textureSize;
-    GC3Dint m_textureFilter;
-    bool m_swizzleContents;
-    bool m_leftEdgeAA;
-    bool m_topEdgeAA;
-    bool m_rightEdgeAA;
-    bool m_bottomEdgeAA;
-};
-
-#pragma pack(pop)
-
-}
-
-#endif
diff --git a/Source/Platform/chromium/public/WebContentLayer.h b/Source/Platform/chromium/public/WebContentLayer.h
index 3e097f96b..7336bfabc 100644
--- a/Source/Platform/chromium/public/WebContentLayer.h
+++ b/Source/Platform/chromium/public/WebContentLayer.h
@@ -60,6 +60,17 @@ public:
     // Set to apply a scale factor used when painting and drawing this layer's content. Defaults to 1.0.
     WEBKIT_EXPORT void setContentsScale(float);
 
+    // Set to render text in this layer with LCD antialiasing. Only set if you know that this layer will be
+    // drawn in a way where this makes sense - i.e. opaque background, not rotated or scaled, etc.
+    // Defaults to false;
+    WEBKIT_EXPORT void setUseLCDText(bool);
+
+    // Set to draw a system-defined checkerboard if the compositor would otherwise draw a tile in this layer
+    // and the actual contents are unavailable. If false, the compositor will draw the layer's background color
+    // for these tiles.
+    // Defaults to false.
+    WEBKIT_EXPORT void setDrawCheckerboardForMissingTiles(bool);
+
 #if WEBKIT_IMPLEMENTATION
     WebContentLayer(const WTF::PassRefPtr<WebCore::ContentLayerChromium>&);
     WebContentLayer& operator=(const WTF::PassRefPtr<WebCore::ContentLayerChromium>&);
diff --git a/Source/Platform/chromium/public/WebFilterOperation.h b/Source/Platform/chromium/public/WebFilterOperation.h
index 039f72968..851a7b9d4 100644
--- a/Source/Platform/chromium/public/WebFilterOperation.h
+++ b/Source/Platform/chromium/public/WebFilterOperation.h
@@ -26,8 +26,8 @@
 #ifndef WebFilterOperation_h
 #define WebFilterOperation_h
 
+#include "SkScalar.h"
 #include "WebCommon.h"
-
 #include "WebColor.h"
 #include "WebPoint.h"
 
@@ -46,6 +46,7 @@ public:
         FilterTypeOpacity,
         FilterTypeBlur,
         FilterTypeDropShadow,
+        FilterTypeColorMatrix,
     };
 
     FilterType type() const { return m_type; }
@@ -64,6 +65,10 @@ public:
         WEBKIT_ASSERT(m_type == FilterTypeDropShadow);
         return m_dropShadowColor;
     }
+    const SkScalar* matrix() const
+    {
+        return m_matrix;
+    }
 
 #define WEBKIT_HAS_NEW_WEBFILTEROPERATION_API 1
     static WebFilterOperation createGrayscaleFilter(float amount) { return WebFilterOperation(FilterTypeGrayscale, amount); }
@@ -76,13 +81,9 @@ public:
     static WebFilterOperation createOpacityFilter(float amount) { return WebFilterOperation(FilterTypeOpacity, amount); }
     static WebFilterOperation createBlurFilter(float amount) { return WebFilterOperation(FilterTypeBlur, amount); }
     static WebFilterOperation createDropShadowFilter(WebPoint offset, float stdDeviation, WebColor color) { return WebFilterOperation(FilterTypeDropShadow, offset, stdDeviation, color); }
+    static WebFilterOperation createColorMatrixFilter(SkScalar matrix[20]) { return WebFilterOperation(FilterTypeColorMatrix, matrix); }
 
-    bool equals(const WebFilterOperation& other) const
-    {
-        return m_amount == other.m_amount
-            && m_dropShadowOffset == other.m_dropShadowOffset
-            && m_dropShadowColor == other.m_dropShadowColor;
-    }
+    bool equals(const WebFilterOperation& other) const;
 
 private:
     FilterType m_type;
@@ -90,10 +91,11 @@ private:
     float m_amount;
     WebPoint m_dropShadowOffset;
     WebColor m_dropShadowColor;
+    SkScalar m_matrix[20];
 
     WebFilterOperation(FilterType type, float amount)
     {
-        WEBKIT_ASSERT(type != FilterTypeDropShadow);
+        WEBKIT_ASSERT(type != FilterTypeDropShadow && type != FilterTypeColorMatrix);
         m_type = type;
         m_amount = amount;
         m_dropShadowColor = 0;
@@ -107,6 +109,8 @@ private:
         m_dropShadowOffset = offset;
         m_dropShadowColor = color;
     }
+
+    WebFilterOperation(FilterType, SkScalar matrix[20]);
 };
 
 inline bool operator==(const WebFilterOperation& a, const WebFilterOperation& b)
diff --git a/Source/WebKit/chromium/public/WebCompositorClient.h b/Source/Platform/chromium/public/WebFlingAnimator.h
index c275f7055..b249a6b95 100644
--- a/Source/WebKit/chromium/public/WebCompositorClient.h
+++ b/Source/Platform/chromium/public/WebFlingAnimator.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,21 +23,26 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCompositorClient_h
-#define WebCompositorClient_h
+#ifndef WebFlingAnimator_h
+#define WebFlingAnimator_h
 
-#include "WebCompositorInputHandlerClient.h"
+#include "WebFloatPoint.h"
+#include "WebPoint.h"
+#include "WebRect.h"
 
 namespace WebKit {
 
-// This class will go away once downstream code has transitioned
-// to WebCompositorInputHandlerClient.
-class WebCompositorClient : public WebCompositorInputHandlerClient {
+class WebFlingAnimator {
 public:
-protected:
-    virtual ~WebCompositorClient() { }
+    virtual ~WebFlingAnimator() { }
+
+    virtual void startFling(const WebFloatPoint& velocity, const WebRect& range) = 0;
+    // Returns true if the animation is not yet finished.
+    virtual bool updatePosition() = 0;
+    virtual WebPoint getCurrentPosition() = 0;
+    virtual void cancelFling() = 0;
 };
 
 } // namespace WebKit
 
-#endif
+#endif // WebFlingAnimator_h
diff --git a/Source/Platform/chromium/public/WebGraphicsContext3D.h b/Source/Platform/chromium/public/WebGraphicsContext3D.h
index ae71c9a65..c0f790b8a 100644
--- a/Source/Platform/chromium/public/WebGraphicsContext3D.h
+++ b/Source/Platform/chromium/public/WebGraphicsContext3D.h
@@ -171,6 +171,9 @@ public:
 
     virtual bool setParentContext(WebGraphicsContext3D* parentContext) { return false; }
 
+    virtual unsigned insertSyncPoint() { return 0; }
+    virtual void waitSyncPoint(unsigned) { }
+
     // Helper for software compositing path. Reads back the frame buffer into
     // the memory region pointed to by "pixels" with size "bufferSize". It is
     // expected that the storage for "pixels" covers (4 * width * height) bytes.
@@ -430,6 +433,11 @@ public:
     // GL_CHROMIUM_shallow_flush
     virtual void shallowFlushCHROMIUM() { }
 
+    // GL_CHROMIUM_texture_mailbox
+    virtual void genMailboxCHROMIUM(WGC3Dbyte* mailbox) { }
+    virtual void produceTextureCHROMIUM(WGC3Denum target, const WGC3Dbyte* mailbox) { }
+    virtual void consumeTextureCHROMIUM(WGC3Denum target, const WGC3Dbyte* mailbox) { }
+
     GrGLInterface* createGrGLInterface();
 
 protected:
diff --git a/Source/Platform/chromium/public/WebImage.h b/Source/Platform/chromium/public/WebImage.h
index 29bef1c34..da65ac954 100644
--- a/Source/Platform/chromium/public/WebImage.h
+++ b/Source/Platform/chromium/public/WebImage.h
@@ -32,6 +32,7 @@
 #define WebImage_h
 
 #include "WebCommon.h"
+#include "WebVector.h"
 
 #include <SkBitmap.h>
 
@@ -68,6 +69,10 @@ public:
     // the first frame is returned.
     WEBKIT_EXPORT static WebImage fromData(const WebData&, const WebSize& desiredSize);
 
+    // Returns a list of all frames in the image. Only the first frame at each pixel
+    // size will be returned.
+    WEBKIT_EXPORT static WebVector<WebImage> framesFromData(const WebData&);
+
     WEBKIT_EXPORT void reset();
     WEBKIT_EXPORT void assign(const WebImage&);
 
diff --git a/Source/Platform/chromium/public/WebLayer.h b/Source/Platform/chromium/public/WebLayer.h
index 507955432..ec602411b 100644
--- a/Source/Platform/chromium/public/WebLayer.h
+++ b/Source/Platform/chromium/public/WebLayer.h
@@ -26,14 +26,18 @@
 #ifndef WebLayer_h
 #define WebLayer_h
 
+#include "WebAnimation.h"
 #include "WebColor.h"
 #include "WebCommon.h"
 #include "WebPrivatePtr.h"
+#include "WebString.h"
+#include "WebVector.h"
 
 class SkMatrix44;
 namespace WebCore { class LayerChromium; }
 
 namespace WebKit {
+class WebAnimationDelegate;
 class WebFilterOperations;
 class WebTransformationMatrix;
 struct WebFloatPoint;
@@ -71,6 +75,7 @@ public:
     WEBKIT_EXPORT void addChild(const WebLayer&);
     WEBKIT_EXPORT void insertChild(const WebLayer&, size_t index);
     WEBKIT_EXPORT void replaceChild(const WebLayer& reference, const WebLayer& newLayer);
+    WEBKIT_EXPORT void setChildren(const WebVector<WebLayer>&);
     WEBKIT_EXPORT void removeFromParent();
     WEBKIT_EXPORT void removeAllChildren();
 
@@ -89,6 +94,8 @@ public:
     WEBKIT_EXPORT void setMaskLayer(const WebLayer&);
     WEBKIT_EXPORT WebLayer maskLayer() const;
 
+    WEBKIT_EXPORT void setReplicaLayer(const WebLayer&);
+
     WEBKIT_EXPORT void setOpacity(float);
     WEBKIT_EXPORT float opacity() const;
 
@@ -136,6 +143,33 @@ public:
 
     WEBKIT_EXPORT void setDebugBorderColor(const WebColor&);
     WEBKIT_EXPORT void setDebugBorderWidth(float);
+    WEBKIT_EXPORT void setDebugName(WebString);
+
+    // An animation delegate is notified when animations are started and
+    // stopped. The WebLayer does not take ownership of the delegate, and it is
+    // the responsibility of the client to reset the layer's delegate before
+    // deleting the delegate.
+    WEBKIT_EXPORT void setAnimationDelegate(WebAnimationDelegate*);
+
+    // Returns false if the animation cannot be added.
+    WEBKIT_EXPORT bool addAnimation(const WebAnimation&);
+
+    // Removes all animations with the given id.
+    WEBKIT_EXPORT void removeAnimation(int animationId);
+
+    // Removes all animations with the given id targeting the given property.
+    WEBKIT_EXPORT void removeAnimation(int animationId, WebAnimation::TargetProperty);
+
+    // Pauses all animations with the given id.
+    WEBKIT_EXPORT void pauseAnimation(int animationId, double timeOffset);
+
+    // The following functions suspend and resume all animations. The given time
+    // is assumed to use the same time base as monotonicallyIncreasingTime().
+    WEBKIT_EXPORT void suspendAnimations(double monotonicTime);
+    WEBKIT_EXPORT void resumeAnimations(double monotonicTime);
+
+    // Transfers all animations running on the current layer.
+    WEBKIT_EXPORT void transferAnimationsTo(WebLayer*);
 
     // DEPRECATED.
     // This requests that this layer's compositor-managed textures always be reserved
@@ -146,6 +180,10 @@ public:
     // so, but this is to facilitate benchmarks and tests.
     WEBKIT_EXPORT void setForceRenderSurface(bool);
 
+    // Drops this layer's render surface, if it has one. Used to break cycles in some
+    // cases - if you aren't sure, you don't need to call this.
+    WEBKIT_EXPORT void clearRenderSurface();
+
     template<typename T> T to()
     {
         T res;
diff --git a/Source/Platform/chromium/public/WebLayerTreeView.h b/Source/Platform/chromium/public/WebLayerTreeView.h
index f52511043..1ad967da1 100644
--- a/Source/Platform/chromium/public/WebLayerTreeView.h
+++ b/Source/Platform/chromium/public/WebLayerTreeView.h
@@ -26,6 +26,7 @@
 #ifndef WebLayerTreeView_h
 #define WebLayerTreeView_h
 
+#include "SkBitmap.h"
 #include "WebColor.h"
 #include "WebCommon.h"
 #include "WebNonCopyable.h"
@@ -51,10 +52,10 @@ public:
     struct Settings {
         Settings()
             : acceleratePainting(false)
-            , forceSoftwareCompositing(false)
             , showFPSCounter(false)
             , showPlatformLayerTree(false)
             , showPaintRects(false)
+            , renderVSyncEnabled(true)
             , refreshRate(0)
             , defaultTileSize(WebSize(256, 256))
             , maxUntiledLayerSize(WebSize(512, 512))
@@ -62,13 +63,14 @@ public:
         }
 
         bool acceleratePainting;
-        bool forceSoftwareCompositing;
         bool showFPSCounter;
         bool showPlatformLayerTree;
         bool showPaintRects;
+        bool renderVSyncEnabled;
         double refreshRate;
         WebSize defaultTileSize;
         WebSize maxUntiledLayerSize;
+
 #if WEBKIT_IMPLEMENTATION
         operator WebCore::CCLayerTreeSettings() const;
 #endif
@@ -105,8 +107,13 @@ public:
 
     // View properties ---------------------------------------------------
 
-    WEBKIT_EXPORT void setViewportSize(const WebSize&);
-    WEBKIT_EXPORT WebSize viewportSize() const;
+    WEBKIT_EXPORT void setViewportSize(const WebSize& layoutViewportSize, const WebSize& deviceViewportSize = WebSize());
+    // Gives the viewport size in layer space.
+    WEBKIT_EXPORT WebSize layoutViewportSize() const;
+    // Gives the viewport size in physical device pixels (may be different
+    // from the above if there exists page scale, device scale or fixed layout
+    // mode).
+    WEBKIT_EXPORT WebSize deviceViewportSize() const;
 
     WEBKIT_EXPORT void setDeviceScaleFactor(float);
     WEBKIT_EXPORT float deviceScaleFactor() const;
@@ -173,6 +180,10 @@ public:
     // This call is relatively expensive in threaded mode as it blocks on the compositor thread.
     WEBKIT_EXPORT void renderingStats(WebRenderingStats&) const;
 
+    // Provides a font atlas to use for debug visualizations. The atlas must be a bitmap containing glyph data, a table of
+    // ASCII character values to a subrectangle of the atlas representing the corresponding glyph, and the glyph height.
+    WEBKIT_EXPORT void setFontAtlas(SkBitmap, WebRect asciiToRectTable[128], int fontHeight);
+
     // Simulates a lost context. For testing only.
     WEBKIT_EXPORT void loseCompositorContext(int numTimes);
 
diff --git a/Source/Platform/chromium/public/WebLayerTreeViewClient.h b/Source/Platform/chromium/public/WebLayerTreeViewClient.h
index fa737e6f6..dfb4e8161 100644
--- a/Source/Platform/chromium/public/WebLayerTreeViewClient.h
+++ b/Source/Platform/chromium/public/WebLayerTreeViewClient.h
@@ -27,7 +27,7 @@
 #define WebLayerTreeViewClient_h
 
 namespace WebKit {
-class WebGraphicsContext3D;
+class WebCompositorOutputSurface;
 struct WebSize;
 class WebThread;
 
@@ -55,13 +55,22 @@ public:
     // compositor thread through the WebCompositor interface.
     virtual void applyScrollAndScale(const WebSize& scrollDelta, float scaleFactor) = 0;
 
-    // Creates a 3D context suitable for the compositing. This may be called
-    // more than once if the context gets lost.
-    virtual WebGraphicsContext3D* createContext3D() = 0;
+    // DEPRECATED: Creates a 3D context suitable for the compositing. This may be called
+    // more than once if the context gets lost. This will be removed once
+    // downstream dependencies have been removed.
+    virtual WebGraphicsContext3D* createContext3D() { return 0; }
 
-    // Signals a successful rebinding of the 3D context (e.g. after a lost
+    // DEPRECATED: Signals a successful rebinding of the 3D context (e.g. after a lost
     // context event).
-    virtual void didRebindGraphicsContext(bool success) = 0;
+    virtual void didRebindGraphicsContext(bool) { return; }
+
+    // Creates the output surface. This may be called more than once
+    // if the context gets lost.
+    virtual WebCompositorOutputSurface* createOutputSurface() { return 0; }
+
+    // Signals a successful recreation of the output surface (e.g. after a lost
+    // 3D context event).
+    virtual void didRecreateOutputSurface(bool success) { }
 
     // Indicates that a frame will be committed to the impl side of the compositor
     // for rendering.
diff --git a/Source/Platform/chromium/public/WebLocalizedString.h b/Source/Platform/chromium/public/WebLocalizedString.h
index 5e7748ec6..419dfb242 100644
--- a/Source/Platform/chromium/public/WebLocalizedString.h
+++ b/Source/Platform/chromium/public/WebLocalizedString.h
@@ -60,6 +60,7 @@ struct WebLocalizedString {
         KeygenMenuMediumGradeKeySize,
         MissingPluginText,
         MultipleFileUploadText,
+        OtherColorLabel,
         ResetButtonDefaultLabel,
         SearchableIndexIntroduction,
         SearchMenuClearRecentSearchesText,
diff --git a/Source/Platform/chromium/public/WebMediaStreamSource.h b/Source/Platform/chromium/public/WebMediaStreamSource.h
index 01aa8cf7f..3a972f1d8 100644
--- a/Source/Platform/chromium/public/WebMediaStreamSource.h
+++ b/Source/Platform/chromium/public/WebMediaStreamSource.h
@@ -45,6 +45,11 @@ class WebString;
 
 class WebMediaStreamSource {
 public:
+    class ExtraData {
+    public:
+        virtual ~ExtraData() { }
+    };
+
     enum Type {
         TypeAudio,
         TypeVideo
@@ -79,6 +84,13 @@ public:
     WEBKIT_EXPORT void setReadyState(ReadyState);
     WEBKIT_EXPORT ReadyState readyState() const;
 
+    // Extra data associated with this object.
+    // If non-null, the extra data pointer will be deleted when the object is destroyed.
+    // Setting the extra data pointer will cause any existing non-null
+    // extra data pointer to be deleted.
+    WEBKIT_EXPORT ExtraData* extraData() const;
+    WEBKIT_EXPORT void setExtraData(ExtraData*);
+
 #if WEBKIT_IMPLEMENTATION
     WebMediaStreamSource(const WTF::PassRefPtr<WebCore::MediaStreamSource>&);
     WebMediaStreamSource& operator=(WebCore::MediaStreamSource*);
diff --git a/Source/Platform/chromium/public/WebRTCConfiguration.h b/Source/Platform/chromium/public/WebRTCConfiguration.h
new file mode 100644
index 000000000..e99c14de9
--- /dev/null
+++ b/Source/Platform/chromium/public/WebRTCConfiguration.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebRTCConfiguration_h
+#define WebRTCConfiguration_h
+
+#include "WebCommon.h"
+#include "WebNonCopyable.h"
+#include "WebPrivatePtr.h"
+#include "WebVector.h"
+
+namespace WebCore {
+class RTCIceServer;
+class RTCConfiguration;
+}
+
+namespace WebKit {
+class WebString;
+class WebURL;
+
+class WebRTCICEServer {
+public:
+    WebRTCICEServer() { }
+    WebRTCICEServer(const WebRTCICEServer& other) { assign(other); }
+    ~WebRTCICEServer() { reset(); }
+
+    WebRTCICEServer& operator=(const WebRTCICEServer& other)
+    {
+        assign(other);
+        return *this;
+    }
+
+    WEBKIT_EXPORT void assign(const WebRTCICEServer&);
+
+    WEBKIT_EXPORT void reset();
+    bool isNull() const { return m_private.isNull(); }
+
+    WEBKIT_EXPORT WebURL uri() const;
+    WEBKIT_EXPORT WebString credential() const;
+
+#if WEBKIT_IMPLEMENTATION
+    WebRTCICEServer(const WTF::PassRefPtr<WebCore::RTCIceServer>&);
+#endif
+
+private:
+    WebPrivatePtr<WebCore::RTCIceServer> m_private;
+};
+
+class WebRTCConfiguration {
+public:
+    WebRTCConfiguration() { }
+    WebRTCConfiguration(const WebRTCConfiguration& other) { assign(other); }
+    ~WebRTCConfiguration() { reset(); }
+
+    WebRTCConfiguration& operator=(const WebRTCConfiguration& other)
+    {
+        assign(other);
+        return *this;
+    }
+
+    WEBKIT_EXPORT void assign(const WebRTCConfiguration&);
+
+    WEBKIT_EXPORT void reset();
+    bool isNull() const { return m_private.isNull(); }
+
+    WEBKIT_EXPORT size_t numberOfServers() const;
+    WEBKIT_EXPORT WebRTCICEServer server(size_t index) const;
+
+#if WEBKIT_IMPLEMENTATION
+    WebRTCConfiguration(const WTF::PassRefPtr<WebCore::RTCConfiguration>&);
+#endif
+
+private:
+    WebPrivatePtr<WebCore::RTCConfiguration> m_private;
+};
+
+} // namespace WebKit
+
+#endif // WebRTCConfiguration_h
diff --git a/Source/Platform/chromium/public/WebRTCPeerConnectionHandler.h b/Source/Platform/chromium/public/WebRTCPeerConnectionHandler.h
new file mode 100644
index 000000000..a2641bf9c
--- /dev/null
+++ b/Source/Platform/chromium/public/WebRTCPeerConnectionHandler.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebRTCPeerConnectionHandler_h
+#define WebRTCPeerConnectionHandler_h
+
+namespace WebKit {
+class WebRTCPeerConnectionHandlerClient;
+
+class WebRTCPeerConnectionHandler {
+public:
+    virtual ~WebRTCPeerConnectionHandler() { }
+
+    virtual bool initialize() = 0;
+};
+
+} // namespace WebKit
+
+#endif // WebRTCPeerConnectionHandler_h
diff --git a/Source/Platform/chromium/public/WebRTCPeerConnectionHandlerClient.h b/Source/Platform/chromium/public/WebRTCPeerConnectionHandlerClient.h
new file mode 100644
index 000000000..1443def4f
--- /dev/null
+++ b/Source/Platform/chromium/public/WebRTCPeerConnectionHandlerClient.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebRTCPeerConnectionHandlerClient_h
+#define WebRTCPeerConnectionHandlerClient_h
+
+namespace WebKit {
+
+class WebRTCPeerConnectionHandlerClient {
+public:
+    virtual ~WebRTCPeerConnectionHandlerClient() { }
+};
+
+} // namespace WebKit
+
+#endif // WebRTCPeerConnectionHandlerClient_h
diff --git a/Source/Platform/chromium/public/WebScrollableLayer.h b/Source/Platform/chromium/public/WebScrollableLayer.h
index 3dc733681..ea02f8c73 100644
--- a/Source/Platform/chromium/public/WebScrollableLayer.h
+++ b/Source/Platform/chromium/public/WebScrollableLayer.h
@@ -29,6 +29,8 @@
 #include "WebCommon.h"
 #include "WebLayer.h"
 #include "WebPoint.h"
+#include "WebRect.h"
+#include "WebVector.h"
 
 namespace WebKit {
 
@@ -47,6 +49,10 @@ public:
     WEBKIT_EXPORT void setScrollable(bool);
     WEBKIT_EXPORT void setHaveWheelEventHandlers(bool);
     WEBKIT_EXPORT void setShouldScrollOnMainThread(bool);
+    WEBKIT_EXPORT void setNonFastScrollableRegion(const WebVector<WebRect>&);
+    WEBKIT_EXPORT void setIsContainerForFixedPositionLayers(bool);
+    WEBKIT_EXPORT void setFixedToContainerLayer(bool);
+
 
 #if WEBKIT_IMPLEMENTATION
     WebScrollableLayer(const WTF::PassRefPtr<WebCore::LayerChromium>& layer) : WebLayer(layer) { }
diff --git a/Source/Platform/chromium/public/WebScrollbar.h b/Source/Platform/chromium/public/WebScrollbar.h
index 879556552..8baf34b76 100644
--- a/Source/Platform/chromium/public/WebScrollbar.h
+++ b/Source/Platform/chromium/public/WebScrollbar.h
@@ -25,8 +25,21 @@
 #ifndef WebScrollbar_h
 #define WebScrollbar_h
 
+#include "WebPoint.h"
+#include "WebRect.h"
+#include "WebSize.h"
+#include "WebVector.h"
+#if WEBKIT_IMPLEMENTATION
+#include <wtf/PassOwnPtr.h>
+#endif
+
+namespace WebCore {
+class Scrollbar;
+}
+
 namespace WebKit {
 
+// A const accessor interface for a WebKit scrollbar
 class WebScrollbar {
 public:
     enum Orientation {
@@ -46,6 +59,31 @@ public:
         ScrollByPixel
     };
 
+    enum ScrollbarControlSize {
+        RegularScrollbar,
+        SmallScrollbar
+    };
+
+    enum ScrollbarPart {
+        NoPart = 0,
+        BackButtonStartPart = 1,
+        ForwardButtonStartPart = 1 << 1,
+        BackTrackPart = 1 << 2,
+        ThumbPart = 1 << 3,
+        ForwardTrackPart = 1 << 4,
+        BackButtonEndPart = 1 << 5,
+        ForwardButtonEndPart = 1 << 6,
+        ScrollbarBGPart = 1 << 7,
+        TrackBGPart = 1 << 8,
+        AllParts = 0xffffffff
+    };
+
+    enum ScrollbarOverlayStyle {
+        ScrollbarOverlayStyleDefault,
+        ScrollbarOverlayStyleDark,
+        ScrollbarOverlayStyleLight
+    };
+
     virtual ~WebScrollbar() { }
 
     // Return true if this is an overlay scrollbar.
@@ -53,6 +91,25 @@ public:
 
     // Gets the current value (i.e. position inside the region).
     virtual int value() const = 0;
+
+    virtual WebPoint location() const = 0;
+    virtual WebSize size() const = 0;
+    virtual bool enabled() const = 0;
+    virtual int maximum() const = 0;
+    virtual int totalSize() const = 0;
+    virtual bool isScrollViewScrollbar() const = 0;
+    virtual bool isScrollableAreaActive() const = 0;
+    virtual void getTickmarks(WebVector<WebRect>& tickmarks) const = 0;
+    virtual ScrollbarControlSize controlSize() const = 0;
+    virtual ScrollbarPart pressedPart() const = 0;
+    virtual ScrollbarPart hoveredPart() const = 0;
+    virtual ScrollbarOverlayStyle scrollbarOverlayStyle() const = 0;
+    virtual bool isCustomScrollbar() const = 0;
+    virtual Orientation orientation() const = 0;
+
+#if WEBKIT_IMPLEMENTATION
+    WEBKIT_EXPORT static PassOwnPtr<WebScrollbar> create(WebCore::Scrollbar*);
+#endif
 };
 
 } // namespace WebKit
diff --git a/Source/Platform/chromium/public/WebCompositorDebugBorderQuad.h b/Source/Platform/chromium/public/WebScrollbarLayer.h
index 1fcfd4b65..1bfe7d6ab 100644
--- a/Source/Platform/chromium/public/WebCompositorDebugBorderQuad.h
+++ b/Source/Platform/chromium/public/WebScrollbarLayer.h
@@ -23,40 +23,41 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCompositorDebugBorderQuad_h
-#define WebCompositorDebugBorderQuad_h
+#ifndef WebScrollbarLayer_h
+#define WebScrollbarLayer_h
 
-#include "SkColor.h"
-#include "WebCompositorQuad.h"
-#if WEBKIT_IMPLEMENTATION
-#include <wtf/PassOwnPtr.h>
-#endif
+#include "WebLayer.h"
+#include "WebScrollbarThemeGeometry.h"
+#include "WebScrollbarThemePainter.h"
 
-namespace WebKit {
+namespace WebCore {
+class Scrollbar;
+class ScrollbarLayerChromium;
+}
 
-#pragma pack(push, 4)
+namespace WebKit {
 
-class WebCompositorDebugBorderQuad : public WebCompositorQuad {
+class WebScrollbarLayer : public WebLayer {
 public:
-#if WEBKIT_IMPLEMENTATION
-    static PassOwnPtr<WebCompositorDebugBorderQuad> create(const WebCompositorSharedQuadState*, const WebCore::IntRect&, SkColor, int width);
-#endif
+    WebScrollbarLayer() { }
+    WebScrollbarLayer(const WebScrollbarLayer& layer) : WebLayer(layer) { }
+    virtual ~WebScrollbarLayer() { }
+    WebScrollbarLayer& operator=(const WebScrollbarLayer& layer)
+    {
+        WebLayer::assign(layer);
+        return *this;
+    }
 
-    SkColor color() const { return m_color; };
-    int width() const { return m_width; }
+    WEBKIT_EXPORT void setScrollLayer(const WebLayer);
 
-    static const WebCompositorDebugBorderQuad* materialCast(const WebCompositorQuad*);
-private:
 #if WEBKIT_IMPLEMENTATION
-    WebCompositorDebugBorderQuad(const WebCompositorSharedQuadState*, const WebCore::IntRect&, SkColor, int width);
+    static WebScrollbarLayer create(WebCore::Scrollbar*, WebScrollbarThemePainter, PassOwnPtr<WebScrollbarThemeGeometry>);
+    explicit WebScrollbarLayer(const WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>&);
+    WebScrollbarLayer& operator=(const WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>&);
+    operator WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>() const;
 #endif
-
-    SkColor m_color;
-    int m_width;
 };
 
-#pragma pack(pop)
+} // namespace WebKit
 
-}
-
-#endif
+#endif // WebScrollbarLayer_h
diff --git a/Source/Platform/chromium/public/WebCompositorSharedQuadState.h b/Source/Platform/chromium/public/WebScrollbarThemeGeometry.h
index 063d4073e..0a8562e78 100644
--- a/Source/Platform/chromium/public/WebCompositorSharedQuadState.h
+++ b/Source/Platform/chromium/public/WebScrollbarThemeGeometry.h
@@ -23,42 +23,38 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCompositorSharedQuadState_h
-#define WebCompositorSharedQuadState_h
+#ifndef WebScrollbarThemeGeometry_h
+#define WebScrollbarThemeGeometry_h
 
-#include "WebCommon.h"
-
-#if WEBKIT_IMPLEMENTATION
-#include "IntRect.h"
-#include <wtf/PassOwnPtr.h>
-#endif
 #include "WebRect.h"
-#include "WebTransformationMatrix.h"
 
 namespace WebKit {
 
-class WebCompositorSharedQuadState {
-public:
-    int id;
-
-    // Transforms from quad's original content space to its target content space.
-    WebTransformationMatrix quadTransform;
-    // This rect lives in the content space for the quad's originating layer.
-    WebRect visibleContentRect;
-    // This rect lives in the quad's target content space.
-    WebRect scissorRect;
-    float opacity;
-    bool opaque;
+class WebScrollbar;
 
-    WebCompositorSharedQuadState();
-
-#if WEBKIT_IMPLEMENTATION
-    static PassOwnPtr<WebCompositorSharedQuadState> create(int id, const WebTransformationMatrix& quadTransform, const WebCore::IntRect& visibleContentRect, const WebCore::IntRect& scissorRect, float opacity, bool opaque);
-    WebCompositorSharedQuadState(int id, const WebTransformationMatrix& quadTransform, const WebCore::IntRect& visibleContentRect, const WebCore::IntRect& scissorRect, float opacity, bool opaque);
-    bool isLayerAxisAlignedIntRect() const;
-#endif
+class WebScrollbarThemeGeometry {
+public:
+    virtual ~WebScrollbarThemeGeometry() { }
+
+    virtual WebScrollbarThemeGeometry* clone() const = 0;
+    virtual int thumbPosition(WebScrollbar*) = 0;
+    virtual int thumbLength(WebScrollbar*) = 0;
+    virtual int trackPosition(WebScrollbar*) = 0;
+    virtual int trackLength(WebScrollbar*) = 0;
+    virtual bool hasButtons(WebScrollbar*) = 0;
+    virtual bool hasThumb(WebScrollbar*) = 0;
+    virtual WebRect trackRect(WebScrollbar*) = 0;
+    virtual WebRect thumbRect(WebScrollbar*) = 0;
+    virtual int minimumThumbLength(WebScrollbar*) = 0;
+    virtual int scrollbarThickness(WebScrollbar*) = 0;
+    virtual WebRect backButtonStartRect(WebScrollbar*) = 0;
+    virtual WebRect backButtonEndRect(WebScrollbar*) = 0;
+    virtual WebRect forwardButtonStartRect(WebScrollbar*) = 0;
+    virtual WebRect forwardButtonEndRect(WebScrollbar*) = 0;
+    virtual WebRect constrainTrackRectToTrackPieces(WebScrollbar*, const WebRect&) = 0;
+    virtual void splitTrack(WebScrollbar*, const WebRect& track, WebRect& startTrack, WebRect& thumb, WebRect& endTrack) = 0;
 };
 
-}
+} // namespace WebKit
 
 #endif
diff --git a/Source/Platform/chromium/public/WebScrollbarThemePainter.h b/Source/Platform/chromium/public/WebScrollbarThemePainter.h
new file mode 100644
index 000000000..e6cbeb80d
--- /dev/null
+++ b/Source/Platform/chromium/public/WebScrollbarThemePainter.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScrollbarThemePainter_h
+#define WebScrollbarThemePainter_h
+
+#include "WebCanvas.h"
+
+namespace WebCore {
+class ScrollbarThemeComposite;
+class Scrollbar;
+};
+
+namespace WebKit {
+
+class WebScrollbar;
+struct WebRect;
+
+class WebScrollbarThemePainter {
+public:
+    WebScrollbarThemePainter() : m_theme(0) { }
+    WebScrollbarThemePainter(const WebScrollbarThemePainter& painter) { assign(painter); }
+    virtual ~WebScrollbarThemePainter() { }
+    WebScrollbarThemePainter& operator=(const WebScrollbarThemePainter& painter)
+    {
+        assign(painter);
+        return *this;
+    }
+
+    bool isNull() const { return m_theme; }
+    WEBKIT_EXPORT void assign(const WebScrollbarThemePainter&);
+
+    WEBKIT_EXPORT void paintScrollbarBackground(WebCanvas*, const WebRect&);
+    WEBKIT_EXPORT void paintTrackBackground(WebCanvas*, const WebRect&);
+    WEBKIT_EXPORT void paintBackTrackPart(WebCanvas*, const WebRect&);
+    WEBKIT_EXPORT void paintForwardTrackPart(WebCanvas*, const WebRect&);
+    WEBKIT_EXPORT void paintBackButtonStart(WebCanvas*, const WebRect&);
+    WEBKIT_EXPORT void paintBackButtonEnd(WebCanvas*, const WebRect&);
+    WEBKIT_EXPORT void paintForwardButtonStart(WebCanvas*, const WebRect&);
+    WEBKIT_EXPORT void paintForwardButtonEnd(WebCanvas*, const WebRect&);
+    WEBKIT_EXPORT void paintTickmarks(WebCanvas*, const WebRect&);
+    WEBKIT_EXPORT void paintThumb(WebCanvas*, const WebRect&);
+
+#if WEBKIT_IMPLEMENTATION
+    WebScrollbarThemePainter(WebCore::ScrollbarThemeComposite*, WebCore::Scrollbar*);
+#endif
+
+private:
+    // The theme is not owned by this class. It is assumed that the theme is a
+    // static pointer and its lifetime is essentially infinite. The functions
+    // called from the painter may not be thread-safe, so all calls must be made
+    // from the same thread that it is created on.
+    WebCore::ScrollbarThemeComposite* m_theme;
+
+    // It is assumed that the constructor of this paint object is responsible
+    // for the lifetime of this scrollbar. The painter has to use the real
+    // scrollbar (and not a WebScrollbar wrapper) due to static_casts for
+    // RenderScrollbar and pointer-based HashMap lookups for Lion scrollbars.
+    WebCore::Scrollbar* m_scrollbar;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/Platform/chromium/public/WebSharedGraphicsContext3D.h b/Source/Platform/chromium/public/WebSharedGraphicsContext3D.h
new file mode 100644
index 000000000..948e6ed3a
--- /dev/null
+++ b/Source/Platform/chromium/public/WebSharedGraphicsContext3D.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSharedGraphicsContext3D_h
+#define WebSharedGraphicsContext3D_h
+
+#include "WebCommon.h"
+
+class GrContext;
+
+namespace WebKit {
+
+class WebGraphicsContext3D;
+
+class WebSharedGraphicsContext3D {
+public:
+    // Returns a context usable from the main thread. If the context is lost or has never been created, this will attempt to create a new context.
+    // The returned pointer is only valid until the next call to mainThreadContext().
+    WEBKIT_EXPORT static WebGraphicsContext3D* mainThreadContext();
+
+    // Returns a ganesh context associated with the main thread shared context. The ganesh context has the same lifetime as the main thread shared
+    // WebGraphicsContext3D.
+    WEBKIT_EXPORT static GrContext* mainThreadGrContext();
+
+    // Attempts to create a context usable from the compositor thread. Must be called from the main (WebKit) thread. Returns false
+    // if a context could not be created.
+    WEBKIT_EXPORT static bool createCompositorThreadContext();
+
+    // Can be called from any thread.
+    WEBKIT_EXPORT static bool haveCompositorThreadContext();
+
+    // Returns a context usable from the compositor thread, if there is one. The context must be used only from the compositor thread.
+    // The returned context is valid until the next call to createCompositorThreadContext().
+    // If this context becomes lost or unusable, the caller should call createCompositorThreadContext() on the main thread and
+    // then use the newly created context from the compositor thread.
+    WEBKIT_EXPORT static WebGraphicsContext3D* compositorThreadContext();
+
+    // Returns a ganesh context associated with the compositor thread shared context. The ganesh context has the same lifetime as the compositor thread
+    // shared WebGraphicsContext3D.
+    WEBKIT_EXPORT static GrContext* compositorThreadGrContext();
+};
+
+}
+
+#endif // WebSharedGraphicsContext3D_h
diff --git a/Source/Platform/chromium/public/WebStorageArea.h b/Source/Platform/chromium/public/WebStorageArea.h
index f75e56d4a..3b1f967ad 100644
--- a/Source/Platform/chromium/public/WebStorageArea.h
+++ b/Source/Platform/chromium/public/WebStorageArea.h
@@ -84,6 +84,9 @@ public:
         clear(pageUrl, unused);
     }
 
+    // Returns amount of bytes occupied by the storage cache in physical memory.
+    virtual size_t memoryBytesUsedByCache() const { return 0; }
+
     // DEPRECATED - being replaced by the async variants above which do not return oldValues or block until completion.
     virtual void setItem(const WebString& key, const WebString& newValue, const WebURL&, Result&, WebString& oldValue) { }
     virtual void removeItem(const WebString& key, const WebURL& pageUrl, WebString& oldValue)  { }
diff --git a/Source/Platform/chromium/public/WebTransformationMatrix.h b/Source/Platform/chromium/public/WebTransformationMatrix.h
index 0ffe0c405..9de9e2c4c 100644
--- a/Source/Platform/chromium/public/WebTransformationMatrix.h
+++ b/Source/Platform/chromium/public/WebTransformationMatrix.h
@@ -137,13 +137,6 @@ public:
     // Conversions between WebKit::WebTransformationMatrix and WebCore::TransformationMatrix
     explicit WebTransformationMatrix(const WebCore::TransformationMatrix&);
     WebCore::TransformationMatrix toWebCoreTransform() const;
-
-    // FIXME: these map functions should not exist, should be using CCMathUtil
-    // instead. Eventually CCMathUtil functions could be merged here, but its
-    // not yet the right time for that.
-    WebCore::FloatPoint3D mapPoint(const WebCore::FloatPoint3D&) const;
-    WebCore::FloatPoint mapPoint(const WebCore::FloatPoint&) const;
-    WebCore::IntPoint mapPoint(const WebCore::IntPoint&) const;
 #endif
 
 protected:
diff --git a/Source/WebCore/platform/chromium/support/WebCompositorCheckerboardQuad.cpp b/Source/Platform/chromium/src/WebFilterOperation.cpp
index 970db2b84..dbaf1377c 100644
--- a/Source/WebCore/platform/chromium/support/WebCompositorCheckerboardQuad.cpp
+++ b/Source/Platform/chromium/src/WebFilterOperation.cpp
@@ -24,28 +24,31 @@
  */
 
 #include "config.h"
+#include <public/WebFilterOperation.h>
 
-#include <public/WebCompositorCheckerboardQuad.h>
-
-using namespace WebCore;
+#include <string.h>
 
 namespace WebKit {
 
-PassOwnPtr<WebCompositorCheckerboardQuad> WebCompositorCheckerboardQuad::create(const WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect)
-{
-    return adoptPtr(new WebCompositorCheckerboardQuad(sharedQuadState, quadRect));
-}
-
-WebCompositorCheckerboardQuad::WebCompositorCheckerboardQuad(const WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect)
-    : WebCompositorQuad(sharedQuadState, WebCompositorQuad::Checkerboard, quadRect)
+bool WebFilterOperation::equals(const WebFilterOperation& other) const
 {
+    if (m_type != other.m_type)
+        return false;
+    if (m_type == FilterTypeColorMatrix)
+        return !memcmp(m_matrix, other.m_matrix, sizeof(m_matrix));
+    if (m_type == FilterTypeDropShadow) {
+        return m_amount == other.m_amount
+            && m_dropShadowOffset == other.m_dropShadowOffset
+            && m_dropShadowColor == other.m_dropShadowColor;
+    } else
+        return m_amount == other.m_amount;
 }
 
-const WebCompositorCheckerboardQuad* WebCompositorCheckerboardQuad::materialCast(const WebCompositorQuad* quad)
+WebFilterOperation::WebFilterOperation(FilterType type, SkScalar matrix[20])
 {
-    ASSERT(quad->material() == WebCompositorQuad::Checkerboard);
-    return static_cast<const WebCompositorCheckerboardQuad*>(quad);
+    WEBKIT_ASSERT(type == FilterTypeColorMatrix);
+    m_type = type;
+    memcpy(m_matrix, matrix, sizeof(m_matrix));
 }
 
-
-}
+} // namespace WebKit
diff --git a/Source/Platform/chromium/src/WebFilterOperations.cpp b/Source/Platform/chromium/src/WebFilterOperations.cpp
index e1cfcfa9d..882d5a1e8 100644
--- a/Source/Platform/chromium/src/WebFilterOperations.cpp
+++ b/Source/Platform/chromium/src/WebFilterOperations.cpp
@@ -133,6 +133,14 @@ bool WebFilterOperations::hasFilterThatAffectsOpacity() const
         case WebFilterOperation::FilterTypeBlur:
         case WebFilterOperation::FilterTypeDropShadow:
             return true;
+        case WebFilterOperation::FilterTypeColorMatrix: {
+            const SkScalar* matrix = op.matrix();
+            return matrix[15]
+                || matrix[16]
+                || matrix[17]
+                || matrix[18] != 1
+                || matrix[19];
+        }
         default:
             break;
         }
diff --git a/Source/QtWebKit.pro b/Source/QtWebKit.pro
index 1cc44a8ba..e0fcb7163 100644
--- a/Source/QtWebKit.pro
+++ b/Source/QtWebKit.pro
@@ -23,7 +23,7 @@ include(WebKit/qt/docs/docs.pri)
 
 declarative.file = WebKit/qt/declarative/declarative.pro
 declarative.makefile = Makefile.declarative
-SUBDIRS += declarative
+contains(DEFINES, HAVE_QTQUICK=1): SUBDIRS += declarative
 
 !no_webkit1 {
     tests.file = tests.pri
diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
index 0c6d5d430..bc761aabd 100644
--- a/Source/WTF/ChangeLog
+++ b/Source/WTF/ChangeLog
@@ -1,3 +1,570 @@
+2012-08-11  Sam Weinig  <sam@webkit.org>
+
+        Enable XPC Service based WebProcess with runtime flag
+        https://bugs.webkit.org/show_bug.cgi?id=93773
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/Platform.h:
+        Define HAVE_XPC on 10.7 and later.
+
+2012-08-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do the DecimalNumber to String conversion on 8 bits
+        https://bugs.webkit.org/show_bug.cgi?id=93683
+
+        Reviewed by Andreas Kling.
+
+        Modify DecimalNumber to do the conversion to string on LChar instead of UChar.
+
+        * wtf/DecimalNumber.cpp:
+        (WTF::DecimalNumber::toStringDecimal):
+        (WTF::DecimalNumber::toStringExponential):
+        * wtf/DecimalNumber.h:
+        (DecimalNumber):
+        * wtf/dtoa.h:
+        * wtf/text/StringBuffer.h:
+        (WTF::StringBuffer::operator[]): StringBuffer::operator[] was incorrectly typed to UChar, making
+        the method impossible to instanciate with LChar.
+        * wtf/text/WTFString.h:
+        (String):
+        (WTF::String::adopt): String::adopt() is modified to work with both LChar and UChar. StringImpl
+        already support that.
+        (WTF::appendNumber): Add support for any type that can instanciate the template.
+
+2012-08-11  Benjamin Poulain  <benjamin@webkit.org>
+
+        WebCore::findAtomicString(PropertyName) always convert the name to 16bits
+        https://bugs.webkit.org/show_bug.cgi?id=93685
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, WebCore::findAtomicString() was causing a conversion for the 8bit property name
+        to a 16bits due to the call to StringImpl::character16().
+
+        This patch fixes the issue by adding support for both 8bits and 16bits string in AtomicString::find().
+
+        * wtf/text/AtomicString.cpp:
+        (HashAndCharacters):
+        (WTF::HashAndCharactersTranslator::hash):
+        (WTF::HashAndCharactersTranslator::equal):
+        (WTF::HashAndCharactersTranslator::translate):
+        Use a template to make the struct and the translator independant of the CharacterType.
+
+        (WTF::AtomicString::add):
+        (WTF::findString):
+        (WTF::AtomicString::find): Change the API to take a StringImpl*. AtomicString can use
+        it efficiently to find the right string.
+        * wtf/text/AtomicString.h:
+        (AtomicString):
+        * wtf/text/StringImpl.h:
+        (StringImpl): Adapt the friends translator to support the template.
+
+2012-08-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        Add support for String initialization from literal to WTFString
+        https://bugs.webkit.org/show_bug.cgi?id=93426
+
+        Reviewed by Anders Carlsson.
+
+        This patch adds two constructor to WTF::String in order to support fast initialization from literal:
+        -String(ASCIILiteral): Constructor similar to String(const char*) while being faster. This constructor
+         does not incur any overhead over String(const char*).
+        -String(char[], ConstructFromLiteralTag): Template constructor that encode explicitely the size of the
+         string.
+
+        String(ASCIILiteral) is expected to be used in most cases to avoid regressions. This constructor was
+        added because of what we have learned from r124922: inlining the string length in the code causes a code bloat
+        that is not always welcome.
+
+        Regarding performance of string initialization, the constructors performance are (6 characters string):
+        -String(ASCIILiteral): 16% faster.
+        -String(char[], ConstructFromLiteralTag): 33% faster (the delta increases with the string length).
+
+        In addition, no memory is allocated for the characters.
+
+        * wtf/text/StringImpl.cpp:
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::createFromLiteral): Extend StringImpl::createFromLiteral to have a version
+        with strlen() which avoids loading one extra argument.
+        * wtf/text/WTFString.cpp:
+        (WTF::String::String):
+        * wtf/text/WTFString.h:
+        (WTF::String::String):
+        (ASCIILiteral): This class is aimed at making the construction of WTFString from a literal very easy.
+        By using the explicit constructor ASCIILiteral(char *), one can expect the implicit conversion to String
+        when needed.
+        (WTF::ASCIILiteral::ASCIILiteral):
+        (WTF::ASCIILiteral::operator const char*):
+
+2012-08-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Use char* instead of LChar* for the public interface of String construction from literals
+        https://bugs.webkit.org/show_bug.cgi?id=93402
+
+        Reviewed by Michael Saboff.
+
+        When the initialization from literal was added, some constructor/initialization function were
+        using LChar for convenience.
+
+        Since those function should only take ASCII characters, using LChar* could cause confusion. This
+        patch intents to clarify this by using char* for all those APIs.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::CharBufferFromLiteralDataTranslator::hash):
+        (WTF::CharBufferFromLiteralDataTranslator::equal):
+        (WTF::CharBufferFromLiteralDataTranslator::translate):
+        (WTF::AtomicString::addFromLiteralData):
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::AtomicString):
+        (AtomicString):
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::createFromLiteral):
+        * wtf/text/StringImpl.h:
+        (StringImpl):
+        (WTF::StringImpl::StringImpl):
+        (WTF::StringImpl::createFromLiteral):
+
+2012-08-08  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove ce_time.(cpp|h) from list of source files
+        https://bugs.webkit.org/show_bug.cgi?id=93446
+
+        Reviewed by Simon Hausmann.
+
+        r125004 removed the last dependency on functions defined in ce_time.cpp.
+
+        * wtf/PlatformWinCE.cmake:
+
+2012-08-08  Alvaro Lopez Ortega  <alvaro@alobbs.com>
+
+        Atomics.h has incorrect GCC test for ext/atomicity.h when using LSB compilers
+        https://bugs.webkit.org/show_bug.cgi?id=51974
+
+        Reviewed by Simon Hausmann.
+
+        * wtf/Atomics.h: Inhibits the inclusion of the atomicity.h GNU C++
+        extension when compiling with a LSB compliant compiler. Thanks to
+        Craig Scott for the new precompiler check code.
+
+2012-08-07  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [WTF] Add using WTF::msPerHour into DateMath.h
+        https://bugs.webkit.org/show_bug.cgi?id=93428
+
+        Reviewed by Kent Tamura.
+
+        This patch adds "using WTF::msPerHour" into DateMath.h for some codes
+        which will use it, e.g. bug 92960. Note: DateMath.h already has had
+        using statements for msPerDay, msPerMinute and msPerSecond.
+
+        * wtf/DateMath.h: Added "using WTF::msPerHour".
+
+2012-08-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        Use the initialization from literal for JSC's Identifiers
+        https://bugs.webkit.org/show_bug.cgi?id=93193
+
+        Reviewed by Geoffrey Garen.
+
+        * wtf/text/StringImpl.h: Update the names for the HashTranslator used by Identifier.
+
+2012-07-19  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove Qt 4 specific code paths
+        https://bugs.webkit.org/show_bug.cgi?id=88161
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * WTF.pri:
+        * WTF.pro:
+        * wtf/qt/StringQt.cpp:
+        (WTF::String::String):
+        (WTF::String::operator QString):
+        * wtf/qt/UtilsQt.h: Removed.
+        * wtf/qt/compat/QGuiApplication: Removed.
+        * wtf/qt/compat/qguiapplication.h: Removed.
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::~StringImpl):
+        (WTF):
+        * wtf/text/StringImpl.h:
+        (StringImpl):
+
+2012-08-06  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Remove dependency on pthread from MachineStackMarker
+        https://bugs.webkit.org/show_bug.cgi?id=68429
+
+        Reviewed by Geoffrey Garen.
+
+        Windows has no support for calling a destructor for thread specific data.
+        Since we need more control over creating and deleting thread specific keys
+        we can not simply extend WTF::ThreadSpecific with this functionality.
+
+        All thread specific keys created via the new API get stored in a list.
+        After a thread function finished we iterate over this list and call
+        the registered destructor for every item if needed.
+
+        * wtf/ThreadSpecific.h:
+        (WTF):
+        (WTF::threadSpecificKeyCreate): Added wrapper around pthread_key_create.
+        (WTF::threadSpecificKeyDelete): Added wrapper around pthread_key_delete.
+        (WTF::threadSpecificSet): Added wrapper around pthread_setspecific.
+        (WTF::threadSpecificGet): Added wrapper around pthread_getspecific.
+        * wtf/ThreadSpecificWin.cpp:
+
+2012-08-04  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] UI_SIDE_COMPOSITING code has confusing names
+        https://bugs.webkit.org/show_bug.cgi?id=93164
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Renamed UI_SIDE_COMPOSITING to COORDINATED_GRAPHICS.
+
+        * wtf/Platform.h:
+
+2012-08-03  Michael Saboff  <msaboff@apple.com>
+
+        Convert HTML parser to handle 8-bit resources without converting to UChar*
+        https://bugs.webkit.org/show_bug.cgi?id=90321
+
+        Reviewed by Adam Barth.
+
+        * wtf/text/WTFString.h:
+        (WTF::String::dataSize): New method to return the number of bytes 
+        the string requires.  This replaces a harcoded calculation based on
+        length and sizeof(UChar).
+
+2012-08-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        StringImpl created from literal should be BufferInternal
+        https://bugs.webkit.org/show_bug.cgi?id=92940
+
+        Reviewed by Anders Carlsson.
+
+        The ownership of string created from literal should be BufferInternal so that
+        StringImpl never tries to delete the characters.
+
+        The ownership was accidentaly set to BufferOwned in r123689.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::createFromLiteral): Update to use the new constructor.
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::StringImpl):
+        Add a new constructor making the construction from literal explicit.
+        Add the flag s_hashFlagHasTerminatingNullCharacter since the data has the terminating
+        null character.
+
+2012-08-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Move getLocalTime() as static inline function to DateMath
+        https://bugs.webkit.org/show_bug.cgi?id=92955
+
+        Reviewed by Ryosuke Niwa.
+
+        getCurrentLocalTime() and getLocalTime() has been superseded with the
+        GregorianDateTime class. So we can move it into DateMath.cpp as an static inline
+        function. This allows us to remove the dependecy on time() and localtime()
+        for Windows CE, where this functions require the ce_time library to work.
+
+        * wtf/CurrentTime.cpp:
+        (WTF):
+        * wtf/CurrentTime.h:
+        * wtf/DateMath.cpp:
+        (WTF):
+        (WTF::getLocalTime):
+
+2012-08-02  Patrick Gansterer  <paroga@webkit.org>
+
+        [WINCE] Return 0 at calculateDSTOffset(double, double)
+        https://bugs.webkit.org/show_bug.cgi?id=92953
+
+        Reviewed by Ryosuke Niwa.
+
+        localtime() is implemented as a call to gmtime() in ce_time.c.
+        Since this will never return correct values, returning 0 instead
+        does not remove any existing functionality, but decreases the
+        dependency on the (external) ce_time implementation.
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateDSTOffsetSimple):
+
+2012-08-02  Arnaud Renevier  <a.renevier@sisa.samsung.com>
+
+        TypedArray set method is slow when called with another typed array
+        https://bugs.webkit.org/show_bug.cgi?id=92556
+
+        Reviewed by Kenneth Russell.
+
+        Add an checkInboundData function to TypedArrayBase to check if a
+        position will be not be out of bound or overflow from the typed array.
+
+        * wtf/TypedArrayBase.h:
+        (WTF::TypedArrayBase::checkInboundData):
+        (TypedArrayBase):
+
+2012-08-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Replace WTF::getCurrentLocalTime() with GregorianDateTime::setToCurrentLocalTime()
+        https://bugs.webkit.org/show_bug.cgi?id=92286
+
+        Reviewed by Geoffrey Garen.
+
+        Add a method to GregorianDateTime to set its values to the current locale time.
+        Replacing all occurrences of getCurrentLocalTime with the new function allows
+        us to remove getCurrentLocalTime in a next step.
+
+        * GNUmakefile.list.am:
+        * WTF.gypi:
+        * WTF.pro:
+        * WTF.vcproj/WTF.vcproj:
+        * WTF.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/DateMath.cpp:
+        (WTF::dayInYear):
+        * wtf/DateMath.h:
+        (WTF):
+        * wtf/GregorianDateTime.cpp: Added.
+        (WTF):
+        (WTF::GregorianDateTime::setToCurrentLocalTime):
+        * wtf/GregorianDateTime.h:
+        (GregorianDateTime):
+
+2012-08-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Fix FastMalloc build with assertions enabled.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::isScavengerSuspended):
+        (WTF::TCMalloc_PageHeap::scheduleScavenger):
+        (WTF::TCMalloc_PageHeap::suspendScavenger):
+
+2012-08-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Export StringImpl::sizeInBytes() with WTF_EXPORT_STRING_API
+        https://bugs.webkit.org/show_bug.cgi?id=92851
+
+        Reviewed by Hajime Morita.
+
+        r124069 missed to change one export macro, which is needed
+        to make the windows port with USE(EXPORT_MACROS).
+
+        * wtf/text/StringImpl.h:
+        (StringImpl):
+
+2012-08-01  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Add missing WTF export macros to functions
+        https://bugs.webkit.org/show_bug.cgi?id=92842
+
+        Reviewed by Hajime Morita.
+
+        When we switch the windows port to USE(EXPORT_MACROS) we
+        need to export all functions referenced by WebKit.dll.
+
+        * wtf/ThreadingPrimitives.h:
+        (WTF):
+        * wtf/dtoa.h:
+        (WTF):
+        * wtf/dtoa/double-conversion.h:
+        (StringToDoubleConverter):
+        * wtf/unicode/UTF8.h:
+
+2012-07-31  Sam Weinig  <sam@webkit.org>
+
+        Stop masking 8 bits off of the visited link hash. We need all the bits!
+        https://bugs.webkit.org/show_bug.cgi?id=92799
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/StringHasher.h:
+        (WTF::StringHasher::hashWithTop8BitsMasked):
+        (WTF::StringHasher::hash):
+        (StringHasher):
+        (WTF::StringHasher::computeHashAndMaskTop8Bits):
+        (WTF::StringHasher::hashMemory):
+        (WTF::StringHasher::avalancheBits):
+        Rename existing computeHash and hash functions to computeHashAndMaskTop8Bits
+        and hashWithTop8BitsMasked respectively. Add new computeHash and hash functions
+        that do the StringHash without the masking.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::CStringTranslator::hash):
+        (WTF::UCharBufferTranslator::hash):
+        (WTF::HashAndCharactersTranslator::hash):
+        (WTF::SubstringTranslator::hash):
+        (WTF::LCharBufferFromLiteralDataTranslator::hash):
+        (WTF::AtomicString::fromUTF8Internal):
+        * wtf/text/StringHash.h:
+        (WTF::CaseFoldingHash::hash):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::setHash):
+        * wtf/text/StringStatics.cpp:
+        (WTF::StringImpl::hashSlowCase):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8MaskingTop8Bits):
+        * wtf/unicode/UTF8.h:
+        Update for new function names.
+
+2012-07-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Add a mechanism to dump the stack trace in case of a crash
+        https://bugs.webkit.org/show_bug.cgi?id=92666
+
+        Reviewed by Csaba Osztrogonác.
+
+        Unix based ports can make use of signal handlers to dump the stack
+        trace in case of a crash. This is specially handy when a test crashes on
+        the bot without hitting an assertion, we might have a chance to see
+        some insightful information at the reports.
+
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+
+2012-07-31  Stephen Chenney  <schenney@chromium.org>
+
+        xmlserializer strips xlink from xlink:html svg image tag
+        https://bugs.webkit.org/show_bug.cgi?id=79586
+
+        Reviewed by Nikolas Zimmermann.
+
+        Add WTF::xlinkAtom as a global AtomicString constant.
+
+        * wtf/text/AtomicString.h:
+        (WTF): Add xlinkAtom.
+        * wtf/text/StringStatics.cpp:
+        (WTF): Add xlinkAtom.
+        (WTF::AtomicString::init): Add xlinkAtom.
+
+2012-07-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Add WTF_EXPORT_PRIVATE to deleteOwnedPtr()
+        https://bugs.webkit.org/show_bug.cgi?id=92668
+
+        Reviewed by Hajime Morita.
+
+        When using export macros all non-inlined deleteOwnedPtr()
+        functions need to be declared with WTF_EXPORT_PRIVATE.
+
+        * wtf/OwnPtrCommon.h:
+        (WTF):
+
+2012-07-30  Wei James  <james.wei@intel.com>
+
+        atomicDecrement() never reach 0 on Android so no deref() will be called
+        https://bugs.webkit.org/show_bug.cgi?id=92635
+
+        Reviewed by Adam Barth.
+
+        With Android NDK 7b and later, __atomic_dec()  is implemented by
+        __sync_fetch_and_sub(), which will result in that atomicDecrement()
+        returns the old value instead of new one.
+
+        * wtf/Atomics.h:
+        (WTF):
+        (WTF::atomicIncrement):
+        (WTF::atomicDecrement):
+
+2012-07-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Add function to calculate the day in year from a date
+        https://bugs.webkit.org/show_bug.cgi?id=92671
+
+        Reviewed by Ryosuke Niwa.
+
+        Replace monthToDayInYear() with dayInYear() which takes a whole
+        date for calculation and will be used for bug 92286 later.
+
+        * wtf/DateMath.cpp:
+        (WTF::dayInYear):
+        (WTF::dateToDaysFrom1970):
+
+2012-07-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Add special export macro for string related functions
+        https://bugs.webkit.org/show_bug.cgi?id=92624
+
+        Reviewed by Hajime Morita.
+
+        The windows port compiles string related code into every binary for performance reasons (see r59187).
+        Add the WTF_EXPORT_STRING_API define to allow this behaviour with export macros too.
+
+        * wtf/ExportMacros.h:
+        * wtf/text/AtomicString.h:
+        (AtomicString):
+        * wtf/text/StringImpl.h:
+        (StringImpl):
+        (WTF):
+        * wtf/text/WTFString.h:
+        (WTF):
+        (String):
+
+2012-07-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Replace UnicodeWinCE with UnicodeWchar
+        https://bugs.webkit.org/show_bug.cgi?id=92539
+
+        Reviewed by Ryosuke Niwa.
+
+        UnicodeWinCE never contained WinCE specific code. UnicodeWchar
+        is a replacement for it, which is mainly based on the functions
+        from <wchar.h>. It is ment as a minimal Unicode backend, which
+        can be used very easy and has no external dependencies.
+
+        * WTF.gyp/WTF.gyp:
+        * WTF.gypi:
+        * wtf/Platform.h:
+        * wtf/PlatformWinCE.cmake:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/wchar/UnicodeWchar.cpp: Added.
+        (Unicode):
+        (WTF::Unicode::category):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::decompositionType):
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::convertWithFunction):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        * wtf/unicode/wchar/UnicodeWchar.h: Added.
+        (Unicode):
+        (WTF::Unicode::isAlphanumeric):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isLetter):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::isArabicChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::umemcasecmp):
+        * wtf/unicode/wince/UnicodeWinCE.cpp: Removed.
+        * wtf/unicode/wince/UnicodeWinCE.h: Removed.
+
+2012-07-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: move StringImpl size calculation to StringImpl
+        https://bugs.webkit.org/show_bug.cgi?id=92359
+
+        Reviewed by Pavel Feldman.
+
+        Moved stringSize(StringImpl*) implementation from InspectorMemoryAgent to
+        StringImpl::sizeInBytes();
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::sizeInBytes):
+        (WTF):
+        * wtf/text/StringImpl.h:
+        (StringImpl):
+
 2012-07-28  Patrick Gansterer  <paroga@webkit.org>
 
         [WIN] Add missing export macro to friend decleration.
diff --git a/Source/WTF/GNUmakefile.list.am b/Source/WTF/GNUmakefile.list.am
index 2b844af25..7d34ee1b1 100644
--- a/Source/WTF/GNUmakefile.list.am
+++ b/Source/WTF/GNUmakefile.list.am
@@ -52,6 +52,7 @@ wtf_sources += \
     Source/WTF/wtf/Forward.h \
     Source/WTF/wtf/Functional.h \
     Source/WTF/wtf/GetPtr.h \
+    Source/WTF/wtf/GregorianDateTime.cpp \
     Source/WTF/wtf/GregorianDateTime.h \
     Source/WTF/wtf/HashCountedSet.h \
     Source/WTF/wtf/HashFunctions.h \
diff --git a/Source/WTF/WTF.gyp/WTF.gyp b/Source/WTF/WTF.gyp/WTF.gyp
index db82dd25a..50b132702 100644
--- a/Source/WTF/WTF.gyp/WTF.gyp
+++ b/Source/WTF/WTF.gyp/WTF.gyp
@@ -122,9 +122,9 @@
         ['exclude', '../wtf/url'],
         ['exclude', '../wtf/wince'],
         ['exclude', '../wtf/wx'],
-        ['exclude', '../wtf/unicode/wince'],
         ['exclude', '../wtf/unicode/glib'],
         ['exclude', '../wtf/unicode/qt4'],
+        ['exclude', '../wtf/unicode/wchar'],
         # GLib/GTK, even though its name doesn't really indicate.
         ['exclude', '/(gtk|glib|gobject)/.*\\.(cpp|h)$'],
         ['exclude', '(Default|Gtk|Mac|None|Qt|Win|Wx|Efl|Symbian)\\.(cpp|mm)$'],
diff --git a/Source/WTF/WTF.gypi b/Source/WTF/WTF.gypi
index 59c74b311..5d27970cc 100644
--- a/Source/WTF/WTF.gypi
+++ b/Source/WTF/WTF.gypi
@@ -144,6 +144,7 @@
             'wtf/FastMalloc.cpp',
             'wtf/Float32Array.h',
             'wtf/Float64Array.h',
+            'wtf/GregorianDateTime.cpp',
             'wtf/HashTable.cpp',
             'wtf/Int16Array.h',
             'wtf/Int32Array.h',
@@ -234,8 +235,8 @@
             'wtf/unicode/glib/UnicodeGLib.h',
             'wtf/unicode/icu/CollatorICU.cpp',
             'wtf/unicode/qt4/UnicodeQt4.h',
-            'wtf/unicode/wince/UnicodeWinCE.cpp',
-            'wtf/unicode/wince/UnicodeWinCE.h',
+            'wtf/unicode/wchar/UnicodeWchar.cpp',
+            'wtf/unicode/wchar/UnicodeWchar.h',
             'wtf/win/MainThreadWin.cpp',
             'wtf/win/OwnPtrWin.cpp',
             'wtf/wince/FastMallocWinCE.h',
diff --git a/Source/WTF/WTF.pri b/Source/WTF/WTF.pri
index 024c7f69f..2cfb6f82b 100644
--- a/Source/WTF/WTF.pri
+++ b/Source/WTF/WTF.pri
@@ -8,19 +8,17 @@
 # All external modules should include WTF headers by prefixing with "wtf" (#include <wtf/some/thing.h>).
 INCLUDEPATH += $$PWD
 
-haveQt(5) {
-    mac {
-        # Mac OS does ship libicu but not the associated header files.
-        # Therefore WebKit provides adequate header files.
-        INCLUDEPATH += $${ROOT_WEBKIT_DIR}/Source/WTF/icu
-        LIBS += -licucore
+mac {
+    # Mac OS does ship libicu but not the associated header files.
+    # Therefore WebKit provides adequate header files.
+    INCLUDEPATH += $${ROOT_WEBKIT_DIR}/Source/WTF/icu
+    LIBS += -licucore
+} else {
+    contains(QT_CONFIG,icu) {
+        win32: LIBS += -licuin -licuuc -licudt
+        else: LIBS += -licui18n -licuuc -licudata
     } else {
-        contains(QT_CONFIG,icu) {
-            win32: LIBS += -licuin -licuuc -licudt
-            else: LIBS += -licui18n -licuuc -licudata
-        } else {
-            error("To build QtWebKit with Qt 5 you need ICU")
-        }
+        error("To build QtWebKit with Qt 5 you need ICU")
     }
 }
 
diff --git a/Source/WTF/WTF.pro b/Source/WTF/WTF.pro
index 72d1d712a..d66e29560 100644
--- a/Source/WTF/WTF.pro
+++ b/Source/WTF/WTF.pro
@@ -110,7 +110,6 @@ HEADERS += \
     PassTraits.h \
     Platform.h \
     PossiblyNull.h \
-    qt/UtilsQt.h \
     RandomNumber.h \
     RandomNumberSeed.h \
     RedBlackTree.h \
@@ -190,6 +189,7 @@ SOURCES += \
     dtoa/fixed-dtoa.cc \
     dtoa/strtod.cc \
     FastMalloc.cpp \
+    GregorianDateTime.cpp \
     gobject/GOwnPtr.cpp \
     gobject/GRefPtr.cpp \
     HashTable.cpp \
diff --git a/Source/WTF/WTF.vcproj/WTF.vcproj b/Source/WTF/WTF.vcproj/WTF.vcproj
index 94e8326f3..332a18419 100644
--- a/Source/WTF/WTF.vcproj/WTF.vcproj
+++ b/Source/WTF/WTF.vcproj/WTF.vcproj
@@ -797,6 +797,10 @@
 			>
 		</File>
 		<File
+			RelativePath="..\wtf\GregorianDateTime.cpp"
+			>
+		</File>
+		<File
 			RelativePath="..\wtf\GregorianDateTime.h"
 			>
 		</File>
diff --git a/Source/WTF/WTF.xcodeproj/project.pbxproj b/Source/WTF/WTF.xcodeproj/project.pbxproj
index f5347b24d..97e2250b3 100644
--- a/Source/WTF/WTF.xcodeproj/project.pbxproj
+++ b/Source/WTF/WTF.xcodeproj/project.pbxproj
@@ -11,6 +11,7 @@
 		143F611F1565F0F900DB514A /* RAMSize.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 143F611D1565F0F900DB514A /* RAMSize.cpp */; };
 		143F61201565F0F900DB514A /* RAMSize.h in Headers */ = {isa = PBXBuildFile; fileRef = 143F611E1565F0F900DB514A /* RAMSize.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		2C05385415BC819000F21B96 /* GregorianDateTime.h in Headers */ = {isa = PBXBuildFile; fileRef = 2C05385315BC819000F21B96 /* GregorianDateTime.h */; };
+		2CCD892A15C0390200285083 /* GregorianDateTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2CCD892915C0390200285083 /* GregorianDateTime.cpp */; };
 		4330F38F15745B0500AAFA8F /* URLString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4330F38E15745B0500AAFA8F /* URLString.cpp */; };
 		4F0321BC156AA8D1006EBAF6 /* BitArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F0321BB156AA8D1006EBAF6 /* BitArray.h */; };
 		8134013815B092FD001FF0B8 /* Base64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8134013615B092FD001FF0B8 /* Base64.cpp */; };
@@ -254,6 +255,7 @@
 		143F611D1565F0F900DB514A /* RAMSize.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RAMSize.cpp; sourceTree = "<group>"; };
 		143F611E1565F0F900DB514A /* RAMSize.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RAMSize.h; sourceTree = "<group>"; };
 		2C05385315BC819000F21B96 /* GregorianDateTime.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GregorianDateTime.h; sourceTree = "<group>"; };
+		2CCD892915C0390200285083 /* GregorianDateTime.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GregorianDateTime.cpp; sourceTree = "<group>"; };
 		4330F38E15745B0500AAFA8F /* URLString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = URLString.cpp; sourceTree = "<group>"; };
 		4F0321BB156AA8D1006EBAF6 /* BitArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BitArray.h; sourceTree = "<group>"; };
 		5D247B6214689B8600E78B76 /* libWTF.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = libWTF.a; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -614,6 +616,7 @@
 				A8A472A6151A825A004123FF /* Forward.h */,
 				A8A472A7151A825A004123FF /* Functional.h */,
 				A8A472A8151A825A004123FF /* GetPtr.h */,
+				2CCD892915C0390200285083 /* GregorianDateTime.cpp */,
 				2C05385315BC819000F21B96 /* GregorianDateTime.h */,
 				A8A472B3151A825A004123FF /* HashCountedSet.h */,
 				A8A472B4151A825A004123FF /* HashFunctions.h */,
@@ -1172,6 +1175,7 @@
 				A8A473B3151A825B004123FF /* fast-dtoa.cc in Sources */,
 				A8A473C3151A825B004123FF /* FastMalloc.cpp in Sources */,
 				A8A473B5151A825B004123FF /* fixed-dtoa.cc in Sources */,
+				2CCD892A15C0390200285083 /* GregorianDateTime.cpp in Sources */,
 				A8A473D8151A825B004123FF /* HashTable.cpp in Sources */,
 				A8A473E5151A825B004123FF /* MainThread.cpp in Sources */,
 				A8A473E4151A825B004123FF /* MainThreadMac.mm in Sources */,
diff --git a/Source/WTF/wtf/Assertions.cpp b/Source/WTF/wtf/Assertions.cpp
index 4c44d8b99..aa7f364d9 100644
--- a/Source/WTF/wtf/Assertions.cpp
+++ b/Source/WTF/wtf/Assertions.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2003, 2006, 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ * Copyright (C) 2011 University of Szeged. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,12 +34,17 @@
 #include "config.h"
 #include "Assertions.h"
 
+#include "Compiler.h"
 #include "OwnArrayPtr.h"
 
 #include <stdio.h>
 #include <stdarg.h>
 #include <string.h>
 
+#if HAVE(SIGNAL_H)
+#include <signal.h>
+#endif
+
 #if PLATFORM(MAC)
 #include <CoreFoundation/CFString.h>
 #include <asl.h>
@@ -355,6 +361,42 @@ void WTFInvokeCrashHook()
         globalHook();
 }
 
+#if HAVE(SIGNAL_H)
+static NO_RETURN void dumpBacktraceSignalHandler(int sig)
+{
+    WTFReportBacktrace();
+    exit(128 + sig);
+}
+
+static void installSignalHandlersForFatalErrors(void (*handler)(int))
+{
+    signal(SIGILL, handler); //    4: illegal instruction (not reset when caught).
+    signal(SIGTRAP, handler); //   5: trace trap (not reset when caught).
+    signal(SIGFPE, handler); //    8: floating point exception.
+    signal(SIGBUS, handler); //   10: bus error.
+    signal(SIGSEGV, handler); //  11: segmentation violation.
+    signal(SIGSYS, handler); //   12: bad argument to system call.
+    signal(SIGPIPE, handler); //  13: write on a pipe with no reader.
+    signal(SIGXCPU, handler); //  24: exceeded CPU time limit.
+    signal(SIGXFSZ, handler); //  25: exceeded file size limit.
+}
+
+static void resetSignalHandlersForFatalErrors()
+{
+    installSignalHandlersForFatalErrors(SIG_DFL);
+}
+#endif
+
+void WTFInstallReportBacktraceOnCrashHook()
+{
+#if HAVE(SIGNAL_H)
+    // Needed otherwise we are going to dump the stack trace twice
+    // in case we hit an assertion.
+    WTFSetCrashHook(&resetSignalHandlersForFatalErrors);
+    installSignalHandlersForFatalErrors(&dumpBacktraceSignalHandler);
+#endif
+}
+
 void WTFReportFatalError(const char* file, int line, const char* function, const char* format, ...)
 {
 #if PLATFORM(BLACKBERRY)
diff --git a/Source/WTF/wtf/Assertions.h b/Source/WTF/wtf/Assertions.h
index 9807cedbc..80d51d605 100644
--- a/Source/WTF/wtf/Assertions.h
+++ b/Source/WTF/wtf/Assertions.h
@@ -152,6 +152,7 @@ WTF_EXPORT_PRIVATE void WTFPrintBacktrace(void** stack, int size);
 typedef void (*WTFCrashHookFunction)();
 WTF_EXPORT_PRIVATE void WTFSetCrashHook(WTFCrashHookFunction);
 WTF_EXPORT_PRIVATE void WTFInvokeCrashHook();
+WTF_EXPORT_PRIVATE void WTFInstallReportBacktraceOnCrashHook();
 
 #ifdef __cplusplus
 }
diff --git a/Source/WTF/wtf/Atomics.h b/Source/WTF/wtf/Atomics.h
index a2efd948c..b16f455d2 100644
--- a/Source/WTF/wtf/Atomics.h
+++ b/Source/WTF/wtf/Atomics.h
@@ -72,7 +72,7 @@
 #elif OS(ANDROID)
 #include <sys/atomics.h>
 #elif COMPILER(GCC)
-#if (__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 2))
+#if ((__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 2))) && !defined(__LSB_VERSION__)
 #include <ext/atomicity.h>
 #else
 #include <bits/atomicity.h>
@@ -108,8 +108,9 @@ inline int atomicDecrement(int volatile* addend) { return static_cast<int>(atomi
 #elif OS(ANDROID)
 #define WTF_USE_LOCKFREE_THREADSAFEREFCOUNTED 1
 
-inline int atomicIncrement(int volatile* addend) { return __atomic_inc(addend); }
-inline int atomicDecrement(int volatile* addend) { return __atomic_dec(addend); }
+// Note, __atomic_{inc, dec}() return the previous value of addend's content.
+inline int atomicIncrement(int volatile* addend) { return __atomic_inc(addend) + 1; }
+inline int atomicDecrement(int volatile* addend) { return __atomic_dec(addend) - 1; }
 
 #elif COMPILER(GCC) && !CPU(SPARC64) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
 #define WTF_USE_LOCKFREE_THREADSAFEREFCOUNTED 1
diff --git a/Source/WTF/wtf/CMakeLists.txt b/Source/WTF/wtf/CMakeLists.txt
index 4636b5e52..1f12fb851 100644
--- a/Source/WTF/wtf/CMakeLists.txt
+++ b/Source/WTF/wtf/CMakeLists.txt
@@ -147,6 +147,7 @@ SET(WTF_SOURCES
     DecimalNumber.cpp
     DynamicAnnotations.cpp
     FastMalloc.cpp
+    GregorianDateTime.cpp
     HashTable.cpp
     MD5.cpp
     MainThread.cpp
diff --git a/Source/WTF/wtf/CurrentTime.cpp b/Source/WTF/wtf/CurrentTime.cpp
index 155051ac7..8d16a4e3f 100644
--- a/Source/WTF/wtf/CurrentTime.cpp
+++ b/Source/WTF/wtf/CurrentTime.cpp
@@ -335,21 +335,4 @@ double monotonicallyIncreasingTime()
 
 #endif // !PLATFORM(CHROMIUM)
 
-void getLocalTime(const time_t* localTime, struct tm* localTM)
-{
-#if COMPILER(MSVC7_OR_LOWER) || COMPILER(MINGW) || OS(WINCE)
-    *localTM = *localtime(localTime);
-#elif COMPILER(MSVC)
-    localtime_s(localTM, localTime);
-#else
-    localtime_r(localTime, localTM);
-#endif
-}
-
-void getCurrentLocalTime(struct tm* localTM)
-{
-    time_t localTime = time(0);
-    getLocalTime(&localTime, localTM);
-}
-
 } // namespace WTF
diff --git a/Source/WTF/wtf/CurrentTime.h b/Source/WTF/wtf/CurrentTime.h
index f2ebd89c8..e93873117 100644
--- a/Source/WTF/wtf/CurrentTime.h
+++ b/Source/WTF/wtf/CurrentTime.h
@@ -47,9 +47,6 @@ inline double currentTimeMS()
     return currentTime() * 1000.0;
 }
 
-WTF_EXPORT_PRIVATE void getLocalTime(const time_t* localTime, struct tm* localTM);
-WTF_EXPORT_PRIVATE void getCurrentLocalTime(struct tm* localTM);
-
 // Provides a monotonically increasing time in seconds since an arbitrary point in the past.
 // On unsupported platforms, this function only guarantees the result will be non-decreasing.
 WTF_EXPORT_PRIVATE double monotonicallyIncreasingTime();
@@ -58,8 +55,6 @@ WTF_EXPORT_PRIVATE double monotonicallyIncreasingTime();
 
 using WTF::currentTime;
 using WTF::currentTimeMS;
-using WTF::getCurrentLocalTime;
-using WTF::getLocalTime;
 using WTF::monotonicallyIncreasingTime;
 
 #endif // CurrentTime_h
diff --git a/Source/WTF/wtf/DateMath.cpp b/Source/WTF/wtf/DateMath.cpp
index 3b0bbd309..710bae2bf 100644
--- a/Source/WTF/wtf/DateMath.cpp
+++ b/Source/WTF/wtf/DateMath.cpp
@@ -127,6 +127,19 @@ static const int firstDayOfMonth[2][12] = {
     {0, 31, 60, 91, 121, 152, 182, 213, 244, 274, 305, 335}
 };
 
+#if !OS(WINCE)
+static inline void getLocalTime(const time_t* localTime, struct tm* localTM)
+{
+#if COMPILER(MSVC7_OR_LOWER) || COMPILER(MINGW)
+    *localTM = *localtime(localTime);
+#elif COMPILER(MSVC)
+    localtime_s(localTM, localTime);
+#else
+    localtime_r(localTime, localTM);
+#endif
+}
+#endif
+
 bool isLeapYear(int year)
 {
     if (year % 4 != 0)
@@ -286,9 +299,9 @@ int dayInMonthFromDayInYear(int dayInYear, bool leapYear)
     return d - step;
 }
 
-static inline int monthToDayInYear(int month, bool isLeapYear)
+int dayInYear(int year, int month, int day)
 {
-    return firstDayOfMonth[isLeapYear][month];
+    return firstDayOfMonth[isLeapYear(year)][month] + day - 1;
 }
 
 double dateToDaysFrom1970(int year, int month, int day)
@@ -303,9 +316,7 @@ double dateToDaysFrom1970(int year, int month, int day)
 
     double yearday = floor(daysFrom1970ToYear(year));
     ASSERT((year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0));
-    int monthday = monthToDayInYear(month, isLeapYear(year));
-
-    return yearday + monthday + day - 1;
+    return yearday + dayInYear(year, month, day);
 }
 
 // There is a hard limit at 2038 that we currently do not have a workaround
@@ -404,6 +415,11 @@ int32_t calculateUTCOffset()
  */
 static double calculateDSTOffsetSimple(double localTimeSeconds, double utcOffset)
 {
+#if OS(WINCE)
+    UNUSED_PARAM(localTimeSeconds);
+    UNUSED_PARAM(utcOffset);
+    return 0;
+#else
     if (localTimeSeconds > maxUnixTime)
         localTimeSeconds = maxUnixTime;
     else if (localTimeSeconds < 0) // Go ahead a day to make localtime work (does not work with 0)
@@ -428,6 +444,7 @@ static double calculateDSTOffsetSimple(double localTimeSeconds, double utcOffset
         diff += secondsPerDay;
 
     return (diff * msPerSecond);
+#endif
 }
 
 // Get the DST offset, given a time in UTC
diff --git a/Source/WTF/wtf/DateMath.h b/Source/WTF/wtf/DateMath.h
index 62add5eee..8b8e282c1 100644
--- a/Source/WTF/wtf/DateMath.h
+++ b/Source/WTF/wtf/DateMath.h
@@ -95,6 +95,7 @@ WTF_EXPORT_PRIVATE int msToYear(double ms);
 double msToDays(double ms);
 int msToMinutes(double ms);
 int msToHours(double ms);
+int dayInYear(int year, int month, int day);
 WTF_EXPORT_PRIVATE int dayInYear(double ms, int year);
 WTF_EXPORT_PRIVATE int monthFromDayInYear(int dayInYear, bool leapYear);
 WTF_EXPORT_PRIVATE int dayInMonthFromDayInYear(int dayInYear, bool leapYear);
@@ -112,6 +113,7 @@ using WTF::dayInYear;
 using WTF::minutesPerHour;
 using WTF::monthFromDayInYear;
 using WTF::msPerDay;
+using WTF::msPerHour;
 using WTF::msPerMinute;
 using WTF::msPerSecond;
 using WTF::msToYear;
diff --git a/Source/WTF/wtf/DecimalNumber.cpp b/Source/WTF/wtf/DecimalNumber.cpp
index 70304e2e5..d33a5ae4c 100644
--- a/Source/WTF/wtf/DecimalNumber.cpp
+++ b/Source/WTF/wtf/DecimalNumber.cpp
@@ -99,13 +99,13 @@ unsigned DecimalNumber::bufferLengthForStringExponential() const
     return length;
 }
 
-unsigned DecimalNumber::toStringDecimal(UChar* buffer, unsigned bufferLength) const
+unsigned DecimalNumber::toStringDecimal(LChar* buffer, unsigned bufferLength) const
 {
     ASSERT_UNUSED(bufferLength, bufferLength >= bufferLengthForStringDecimal());
 
     // Should always be at least one digit to add to the string!
     ASSERT(m_precision);
-    UChar* next = buffer;
+    LChar* next = buffer;
 
     // if the exponent is negative the number decimal representation is of the form:
     // [<sign>]0.[<zeros>]<significand>
@@ -155,13 +155,13 @@ unsigned DecimalNumber::toStringDecimal(UChar* buffer, unsigned bufferLength) co
     return next - buffer;
 }
 
-unsigned DecimalNumber::toStringExponential(UChar* buffer, unsigned bufferLength) const
+unsigned DecimalNumber::toStringExponential(LChar* buffer, unsigned bufferLength) const
 {
     ASSERT_UNUSED(bufferLength, bufferLength >= bufferLengthForStringExponential());
 
     // Should always be at least one digit to add to the string!
     ASSERT(m_precision);
-    UChar* next = buffer;
+    LChar* next = buffer;
 
     // Add the sign
     if (m_sign)
diff --git a/Source/WTF/wtf/DecimalNumber.h b/Source/WTF/wtf/DecimalNumber.h
index 61effcdd3..8278dfe4f 100644
--- a/Source/WTF/wtf/DecimalNumber.h
+++ b/Source/WTF/wtf/DecimalNumber.h
@@ -84,8 +84,8 @@ public:
     WTF_EXPORT_PRIVATE unsigned bufferLengthForStringDecimal() const;
     WTF_EXPORT_PRIVATE unsigned bufferLengthForStringExponential() const;
 
-    WTF_EXPORT_PRIVATE unsigned toStringDecimal(UChar* buffer, unsigned bufferLength) const;
-    WTF_EXPORT_PRIVATE unsigned toStringExponential(UChar* buffer, unsigned bufferLength) const;
+    WTF_EXPORT_PRIVATE unsigned toStringDecimal(LChar* buffer, unsigned bufferLength) const;
+    WTF_EXPORT_PRIVATE unsigned toStringExponential(LChar* buffer, unsigned bufferLength) const;
 
     bool sign() const { return m_sign; }
     int exponent() const { return m_exponent; }
diff --git a/Source/WTF/wtf/ExportMacros.h b/Source/WTF/wtf/ExportMacros.h
index e784247c4..ef9bd23f7 100644
--- a/Source/WTF/wtf/ExportMacros.h
+++ b/Source/WTF/wtf/ExportMacros.h
@@ -141,6 +141,12 @@
 #define WTF_EXPORT_PRIVATE_NO_RTTI WTF_EXPORT_PRIVATE
 #endif
 
+#if PLATFORM(WIN)
+#define WTF_EXPORT_STRING_API
+#else
+#define WTF_EXPORT_STRING_API WTF_EXPORT_PRIVATE
+#endif
+
 #define WTF_EXPORT_HIDDEN WTF_HIDDEN
 
 #define HIDDEN_INLINE WTF_EXPORT_HIDDEN inline
diff --git a/Source/WTF/wtf/FastMalloc.cpp b/Source/WTF/wtf/FastMalloc.cpp
index dddfcc699..dba8f9d30 100644
--- a/Source/WTF/wtf/FastMalloc.cpp
+++ b/Source/WTF/wtf/FastMalloc.cpp
@@ -1564,7 +1564,7 @@ void TCMalloc_PageHeap::initializeScavenger()
 
 ALWAYS_INLINE bool TCMalloc_PageHeap::isScavengerSuspended()
 {
-    ASSERT(IsHeld(pageheap_lock));
+    ASSERT(pageheap_lock.IsHeld());
     return !m_scavengeQueueTimer;
 }
 
@@ -1572,7 +1572,7 @@ ALWAYS_INLINE void TCMalloc_PageHeap::scheduleScavenger()
 {
     // We need to use WT_EXECUTEONLYONCE here and reschedule the timer, because
     // Windows will fire the timer event even when the function is already running.
-    ASSERT(IsHeld(pageheap_lock));
+    ASSERT(pageheap_lock.IsHeld());
     CreateTimerQueueTimer(&m_scavengeQueueTimer, 0, scavengerTimerFired, this, kScavengeDelayInSeconds * 1000, 0, WT_EXECUTEONLYONCE);
 }
 
@@ -1585,7 +1585,7 @@ ALWAYS_INLINE void TCMalloc_PageHeap::rescheduleScavenger()
 
 ALWAYS_INLINE void TCMalloc_PageHeap::suspendScavenger()
 {
-    ASSERT(IsHeld(pageheap_lock));
+    ASSERT(pageheap_lock.IsHeld());
     HANDLE scavengeQueueTimer = m_scavengeQueueTimer;
     m_scavengeQueueTimer = 0;
     DeleteTimerQueueTimer(0, scavengeQueueTimer, 0);
diff --git a/Source/WTF/wtf/GregorianDateTime.cpp b/Source/WTF/wtf/GregorianDateTime.cpp
new file mode 100644
index 000000000..61f73bf50
--- /dev/null
+++ b/Source/WTF/wtf/GregorianDateTime.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GregorianDateTime.h"
+
+#include "DateMath.h"
+
+#if OS(WINDOWS)
+#include <windows.h>
+#else
+#include <time.h>
+#endif
+
+namespace WTF {
+
+void GregorianDateTime::setToCurrentLocalTime()
+{
+#if OS(WINDOWS)
+    SYSTEMTIME systemTime;
+    GetLocalTime(&systemTime);
+    TIME_ZONE_INFORMATION timeZoneInformation;
+    DWORD timeZoneId = GetTimeZoneInformation(&timeZoneInformation);
+
+    LONG bias = timeZoneInformation.Bias;
+    if (timeZoneId == TIME_ZONE_ID_DAYLIGHT)
+        bias += timeZoneInformation.DaylightBias;
+    else if (timeZoneId == TIME_ZONE_ID_STANDARD)
+        bias += timeZoneInformation.StandardBias;
+    else
+        ASSERT(timeZoneId == TIME_ZONE_ID_UNKNOWN);
+
+    m_year = systemTime.wYear;
+    m_month = systemTime.wMonth - 1;
+    m_monthDay = systemTime.wDay;
+    m_yearDay = dayInYear(m_year, m_month, m_monthDay);
+    m_weekDay = systemTime.wDayOfWeek;
+    m_hour = systemTime.wHour;
+    m_minute = systemTime.wMinute;
+    m_second = systemTime.wSecond;
+    m_utcOffset = -bias * secondsPerMinute;
+    m_isDST = timeZoneId == TIME_ZONE_ID_DAYLIGHT ? 1 : 0;
+#else
+    tm localTM;
+    time_t localTime = time(0);
+    localtime_r(&localTime, &localTM);
+
+    m_year = localTM.tm_year + 1900;
+    m_month = localTM.tm_mon;
+    m_monthDay = localTM.tm_mday;
+    m_yearDay = localTM.tm_yday;
+    m_weekDay = localTM.tm_wday;
+    m_hour = localTM.tm_hour;
+    m_minute = localTM.tm_min;
+    m_second = localTM.tm_sec;
+    m_isDST = localTM.tm_isdst;
+#if HAVE(TM_GMTOFF)
+    m_utcOffset = localTM.tm_gmtoff;
+#else
+    int utcOffset = calculateUTCOffset();
+    utcOffset += calculateDSTOffset(localTime * msPerSecond, utcOffset);
+    m_utcOffset = utcOffset / msPerSecond;
+#endif
+#endif
+}
+
+} // namespace WTF
diff --git a/Source/WTF/wtf/GregorianDateTime.h b/Source/WTF/wtf/GregorianDateTime.h
index 37300f089..49fadf27b 100644
--- a/Source/WTF/wtf/GregorianDateTime.h
+++ b/Source/WTF/wtf/GregorianDateTime.h
@@ -70,6 +70,8 @@ public:
     inline void setUtcOffset(int utcOffset) { m_utcOffset = utcOffset; }
     inline void setIsDST(int isDST) { m_isDST = isDST; }
 
+    WTF_EXPORT_PRIVATE void setToCurrentLocalTime();
+
     operator tm() const
     {
         tm ret;
diff --git a/Source/WTF/wtf/OwnPtrCommon.h b/Source/WTF/wtf/OwnPtrCommon.h
index 86670e9c3..43a3cb7de 100644
--- a/Source/WTF/wtf/OwnPtrCommon.h
+++ b/Source/WTF/wtf/OwnPtrCommon.h
@@ -57,22 +57,22 @@ namespace WTF {
     }
 
 #if OS(WINDOWS)
-    void deleteOwnedPtr(HBITMAP);
-    void deleteOwnedPtr(HBRUSH);
-    void deleteOwnedPtr(HDC);
-    void deleteOwnedPtr(HFONT);
-    void deleteOwnedPtr(HPALETTE);
-    void deleteOwnedPtr(HPEN);
-    void deleteOwnedPtr(HRGN);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(HBITMAP);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(HBRUSH);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(HDC);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(HFONT);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(HPALETTE);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(HPEN);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(HRGN);
 #endif
 
 #if PLATFORM(EFL)
-    void deleteOwnedPtr(Ecore_Evas*);
-    void deleteOwnedPtr(Ecore_Pipe*);
-    void deleteOwnedPtr(Ecore_Timer*);
-    void deleteOwnedPtr(Eina_Hash*);
-    void deleteOwnedPtr(Eina_Module*);
-    void deleteOwnedPtr(Evas_Object*);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(Ecore_Evas*);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(Ecore_Pipe*);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(Ecore_Timer*);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(Eina_Hash*);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(Eina_Module*);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(Evas_Object*);
 #endif
 
 } // namespace WTF
diff --git a/Source/WTF/wtf/Platform.h b/Source/WTF/wtf/Platform.h
index f99c4c8ab..506537734 100644
--- a/Source/WTF/wtf/Platform.h
+++ b/Source/WTF/wtf/Platform.h
@@ -517,7 +517,7 @@
 #define WTF_USE_QT4_UNICODE 1
 #endif
 #elif OS(WINCE)
-#define WTF_USE_WINCE_UNICODE 1
+#define WTF_USE_WCHAR_UNICODE 1
 #elif PLATFORM(GTK)
 /* The GTK+ Unicode backend is configurable */
 #else
@@ -532,6 +532,7 @@
 #define ENABLE_GESTURE_EVENTS 1
 #define ENABLE_RUBBER_BANDING 1
 #define WTF_USE_SCROLLBAR_PAINTER 1
+#define HAVE_XPC 1
 #endif
 #if !defined(ENABLE_JAVA_BRIDGE)
 #define ENABLE_JAVA_BRIDGE 1
@@ -1017,7 +1018,7 @@
 
 /* Compositing on the UI-process in WebKit2 */
 #if PLATFORM(QT)
-#define WTF_USE_UI_SIDE_COMPOSITING 1
+#define WTF_USE_COORDINATED_GRAPHICS 1
 #endif
 
 #if PLATFORM(MAC) || PLATFORM(IOS)
diff --git a/Source/WTF/wtf/PlatformWinCE.cmake b/Source/WTF/wtf/PlatformWinCE.cmake
index d30282f36..d558ee579 100644
--- a/Source/WTF/wtf/PlatformWinCE.cmake
+++ b/Source/WTF/wtf/PlatformWinCE.cmake
@@ -1,8 +1,5 @@
 LIST(APPEND WTF_HEADERS
-    unicode/wince/UnicodeWinCE.h
-
-    ${3RDPARTY_DIR}/ce-compat/ce_time.h
-    ${3RDPARTY_DIR}/ce-compat/ce_unicode.h
+    unicode/wchar/UnicodeWchar.h
 )
 
 LIST(APPEND WTF_SOURCES
@@ -14,13 +11,10 @@ LIST(APPEND WTF_SOURCES
     threads/win/BinarySemaphoreWin.cpp
 
     unicode/CollatorDefault.cpp
-    unicode/wince/UnicodeWinCE.cpp
+    unicode/wchar/UnicodeWchar.cpp
 
     win/MainThreadWin.cpp
     win/OwnPtrWin.cpp
-
-    ${3RDPARTY_DIR}/ce-compat/ce_time.c
-    ${3RDPARTY_DIR}/ce-compat/ce_unicode.cpp
 )
 
 LIST(APPEND WTF_LIBRARIES
diff --git a/Source/WTF/wtf/StringHasher.h b/Source/WTF/wtf/StringHasher.h
index 714525188..53b1b5443 100644
--- a/Source/WTF/wtf/StringHasher.h
+++ b/Source/WTF/wtf/StringHasher.h
@@ -63,23 +63,9 @@ public:
         m_hasPendingCharacter = true;
     }
 
-    inline unsigned hash() const
+    inline unsigned hashWithTop8BitsMasked() const
     {
-        unsigned result = m_hash;
-
-        // Handle end case.
-        if (m_hasPendingCharacter) {
-            result += m_pendingCharacter;
-            result ^= result << 11;
-            result += result >> 17;
-        }
-
-        // Force "avalanching" of final 31 bits.
-        result ^= result << 3;
-        result += result >> 5;
-        result ^= result << 2;
-        result += result >> 15;
-        result ^= result << 10;
+        unsigned result = avalancheBits();
 
         // Reserving space from the high bits for flags preserves most of the hash's
         // value, since hash lookup typically masks out the high bits anyway.
@@ -95,6 +81,67 @@ public:
         return result;
     }
 
+    inline unsigned hash() const
+    {
+        unsigned result = avalancheBits();
+
+        // This avoids ever returning a hash code of 0, since that is used to
+        // signal "hash not computed yet". Setting the high bit maintains
+        // reasonable fidelity to a hash code of 0 because it is likely to yield
+        // exactly 0 when hash lookup masks out the high bits.
+        if (!result)
+            result = 0x80000000;
+
+        return result;
+    }
+
+    template<typename T, UChar Converter(T)> static inline unsigned computeHashAndMaskTop8Bits(const T* data, unsigned length)
+    {
+        StringHasher hasher;
+        bool rem = length & 1;
+        length >>= 1;
+
+        while (length--) {
+            hasher.addCharacters(Converter(data[0]), Converter(data[1]));
+            data += 2;
+        }
+
+        if (rem)
+            hasher.addCharacter(Converter(*data));
+
+        return hasher.hashWithTop8BitsMasked();
+    }
+
+    template<typename T, UChar Converter(T)> static inline unsigned computeHashAndMaskTop8Bits(const T* data)
+    {
+        StringHasher hasher;
+
+        while (true) {
+            UChar b0 = Converter(*data++);
+            if (!b0)
+                break;
+            UChar b1 = Converter(*data++);
+            if (!b1) {
+                hasher.addCharacter(b0);
+                break;
+            }
+
+            hasher.addCharacters(b0, b1);
+        }
+
+        return hasher.hashWithTop8BitsMasked();
+    }
+
+    template<typename T> static inline unsigned computeHashAndMaskTop8Bits(const T* data, unsigned length)
+    {
+        return computeHashAndMaskTop8Bits<T, defaultConverter>(data, length);
+    }
+
+    template<typename T> static inline unsigned computeHashAndMaskTop8Bits(const T* data)
+    {
+        return computeHashAndMaskTop8Bits<T, defaultConverter>(data);
+    }
+
     template<typename T, UChar Converter(T)> static inline unsigned computeHash(const T* data, unsigned length)
     {
         StringHasher hasher;
@@ -145,13 +192,13 @@ public:
     template<size_t length> static inline unsigned hashMemory(const void* data)
     {
         COMPILE_ASSERT(!(length % 4), length_must_be_a_multible_of_four);
-        return computeHash<UChar>(static_cast<const UChar*>(data), length / sizeof(UChar));
+        return computeHashAndMaskTop8Bits<UChar>(static_cast<const UChar*>(data), length / sizeof(UChar));
     }
 
     static inline unsigned hashMemory(const void* data, unsigned size)
     {
         ASSERT(!(size % 2));
-        return computeHash<UChar>(static_cast<const UChar*>(data), size / sizeof(UChar));
+        return computeHashAndMaskTop8Bits<UChar>(static_cast<const UChar*>(data), size / sizeof(UChar));
     }
 
 private:
@@ -173,6 +220,27 @@ private:
         m_hash += m_hash >> 11;
     }
 
+    inline unsigned avalancheBits() const
+    {
+        unsigned result = m_hash;
+
+        // Handle end case.
+        if (m_hasPendingCharacter) {
+            result += m_pendingCharacter;
+            result ^= result << 11;
+            result += result >> 17;
+        }
+
+        // Force "avalanching" of final 31 bits.
+        result ^= result << 3;
+        result += result >> 5;
+        result ^= result << 2;
+        result += result >> 15;
+        result ^= result << 10;
+
+        return result;
+    }
+
     unsigned m_hash;
     bool m_hasPendingCharacter;
     UChar m_pendingCharacter;
diff --git a/Source/WTF/wtf/ThreadSpecific.h b/Source/WTF/wtf/ThreadSpecific.h
index 60c9907bd..4ebece055 100644
--- a/Source/WTF/wtf/ThreadSpecific.h
+++ b/Source/WTF/wtf/ThreadSpecific.h
@@ -106,26 +106,26 @@ private:
 
 typedef pthread_key_t ThreadSpecificKey;
 
-inline void ThreadSpecificKeyCreate(ThreadSpecificKey* key, void (*destructor)(void *))
+inline void threadSpecificKeyCreate(ThreadSpecificKey* key, void (*destructor)(void *))
 {
     int error = pthread_key_create(key, destructor);
     if (error)
         CRASH();
 }
 
-inline void ThreadSpecificKeyDelete(ThreadSpecificKey key)
+inline void threadSpecificKeyDelete(ThreadSpecificKey key)
 {
     int error = pthread_key_delete(key);
     if (error)
         CRASH();
 }
 
-inline void ThreadSpecificSet(ThreadSpecificKey key, void* value)
+inline void threadSpecificSet(ThreadSpecificKey key, void* value)
 {
     pthread_setspecific(key, value);
 }
 
-inline void* ThreadSpecificGet(ThreadSpecificKey key)
+inline void* threadSpecificGet(ThreadSpecificKey key)
 {
     return pthread_getspecific(key);
 }
@@ -167,13 +167,13 @@ const int kMaxTlsKeySize = 256;
 WTF_EXPORT_PRIVATE long& tlsKeyCount();
 WTF_EXPORT_PRIVATE DWORD* tlsKeys();
 
-class ThreadSpecificKeyValue;
-typedef ThreadSpecificKeyValue* ThreadSpecificKey;
+class PlatformThreadSpecificKey;
+typedef PlatformThreadSpecificKey* ThreadSpecificKey;
 
-void ThreadSpecificKeyCreate(ThreadSpecificKey*, void (*)(void *));
-void ThreadSpecificKeyDelete(ThreadSpecificKey);
-void ThreadSpecificSet(ThreadSpecificKey, void*);
-void* ThreadSpecificGet(ThreadSpecificKey);
+void threadSpecificKeyCreate(ThreadSpecificKey*, void (*)(void *));
+void threadSpecificKeyDelete(ThreadSpecificKey);
+void threadSpecificSet(ThreadSpecificKey, void*);
+void* threadSpecificGet(ThreadSpecificKey);
 
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
diff --git a/Source/WTF/wtf/ThreadSpecificWin.cpp b/Source/WTF/wtf/ThreadSpecificWin.cpp
index 61a594251..d0f60ace1 100644
--- a/Source/WTF/wtf/ThreadSpecificWin.cpp
+++ b/Source/WTF/wtf/ThreadSpecificWin.cpp
@@ -24,68 +24,57 @@
 
 #include "StdLibExtras.h"
 #include "ThreadingPrimitives.h"
+#include <wtf/DoublyLinkedList.h>
 
 #if !USE(PTHREADS)
 
 namespace WTF {
 
+static DoublyLinkedList<PlatformThreadSpecificKey>& destructorsList()
+{
+    DEFINE_STATIC_LOCAL(DoublyLinkedList<PlatformThreadSpecificKey>, staticList, ());
+    return staticList;
+}
+
 static Mutex& destructorsMutex()
 {
     DEFINE_STATIC_LOCAL(Mutex, staticMutex, ());
     return staticMutex;
 }
 
-class ThreadSpecificKeyValue {
+class PlatformThreadSpecificKey : public DoublyLinkedListNode<PlatformThreadSpecificKey> {
 public:
-    ThreadSpecificKeyValue(void (*destructor)(void *))
+    friend class DoublyLinkedListNode<PlatformThreadSpecificKey>;
+
+    PlatformThreadSpecificKey(void (*destructor)(void *))
         : m_destructor(destructor)
     {
         m_tlsKey = TlsAlloc();
         if (m_tlsKey == TLS_OUT_OF_INDEXES)
             CRASH();
-
-        MutexLocker locker(destructorsMutex());
-        m_next = m_first;
-        m_first = this;
     }
 
-    ~ThreadSpecificKeyValue()
+    ~PlatformThreadSpecificKey()
     {
-        MutexLocker locker(destructorsMutex());
-        ThreadSpecificKeyValue** next = &m_first;
-        while (*next != this) {
-            ASSERT(*next);
-            next = &(*next)->m_next;
-        }
-        *next = (*next)->m_next;
-
         TlsFree(m_tlsKey);
     }
 
     void setValue(void* data) { TlsSetValue(m_tlsKey, data); }
     void* value() { return TlsGetValue(m_tlsKey); }
 
-    static void callDestructors()
+    void callDestructor()
     {
-        MutexLocker locker(destructorsMutex());
-        ThreadSpecificKeyValue* next = m_first;
-        while (next) {
-            if (void* data = next->value())
-                next->m_destructor(data);
-            next = next->m_next;
-        }
+       if (void* data = value())
+            m_destructor(data);
     }
 
 private:
     void (*m_destructor)(void *);
     DWORD m_tlsKey;
-    ThreadSpecificKeyValue* m_next;
-
-    static ThreadSpecificKeyValue* m_first;
+    PlatformThreadSpecificKey* m_prev;
+    PlatformThreadSpecificKey* m_next;
 };
 
-ThreadSpecificKeyValue* ThreadSpecificKeyValue::m_first = 0;
-
 long& tlsKeyCount()
 {
     static long count;
@@ -98,22 +87,27 @@ DWORD* tlsKeys()
     return keys;
 }
 
-void ThreadSpecificKeyCreate(ThreadSpecificKey* key, void (*destructor)(void *))
+void threadSpecificKeyCreate(ThreadSpecificKey* key, void (*destructor)(void *))
 {
-    *key = new ThreadSpecificKeyValue(destructor);
+    *key = new PlatformThreadSpecificKey(destructor);
+
+    MutexLocker locker(destructorsMutex());
+    destructorsList().push(*key);
 }
 
-void ThreadSpecificKeyDelete(ThreadSpecificKey key)
+void threadSpecificKeyDelete(ThreadSpecificKey key)
 {
+    MutexLocker locker(destructorsMutex());
+    destructorsList().remove(key);
     delete key;
 }
 
-void ThreadSpecificSet(ThreadSpecificKey key, void* data)
+void threadSpecificSet(ThreadSpecificKey key, void* data)
 {
     key->setValue(data);
 }
 
-void* ThreadSpecificGet(ThreadSpecificKey key)
+void* threadSpecificGet(ThreadSpecificKey key)
 {
     return key->value();
 }
@@ -127,7 +121,13 @@ void ThreadSpecificThreadExit()
             data->destructor(data);
     }
 
-    ThreadSpecificKeyValue::callDestructors();
+    MutexLocker locker(destructorsMutex());
+    PlatformThreadSpecificKey* key = destructorsList().head();
+    while (key) {
+        PlatformThreadSpecificKey* nextKey = key->next();
+        key->callDestructor();
+        key = nextKey;
+    }
 }
 
 } // namespace WTF
diff --git a/Source/WTF/wtf/ThreadingPrimitives.h b/Source/WTF/wtf/ThreadingPrimitives.h
index ee8bc789a..ab7dc36ff 100644
--- a/Source/WTF/wtf/ThreadingPrimitives.h
+++ b/Source/WTF/wtf/ThreadingPrimitives.h
@@ -152,7 +152,7 @@ private:
 #if OS(WINDOWS)
 // The absoluteTime is in seconds, starting on January 1, 1970. The time is assumed to use the same time zone as WTF::currentTime().
 // Returns an interval in milliseconds suitable for passing to one of the Win32 wait functions (e.g., ::WaitForSingleObject).
-DWORD absoluteTimeToWaitTimeoutInterval(double absoluteTime);
+WTF_EXPORT_PRIVATE DWORD absoluteTimeToWaitTimeoutInterval(double absoluteTime);
 #endif
 
 } // namespace WTF
diff --git a/Source/WTF/wtf/TypedArrayBase.h b/Source/WTF/wtf/TypedArrayBase.h
index 185cf7762..6d2a0f2b8 100644
--- a/Source/WTF/wtf/TypedArrayBase.h
+++ b/Source/WTF/wtf/TypedArrayBase.h
@@ -73,6 +73,14 @@ class TypedArrayBase : public ArrayBufferView {
         return TypedArrayBase<T>::data()[index];
     }
 
+    bool checkInboundData(unsigned offset, unsigned pos) const
+    {
+        return (offset <= m_length
+            && offset + pos <= m_length
+            // check overflow
+            && offset + pos >= offset);
+    }
+
 protected:
     TypedArrayBase(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length)
         : ArrayBufferView(buffer, byteOffset)
diff --git a/Source/WTF/wtf/dtoa.h b/Source/WTF/wtf/dtoa.h
index eca6a34ea..39b8f481a 100644
--- a/Source/WTF/wtf/dtoa.h
+++ b/Source/WTF/wtf/dtoa.h
@@ -40,11 +40,11 @@ WTF_EXPORT_PRIVATE void dtoaRoundDP(DtoaBuffer result, double dd, int ndigits, b
 // Size = 80 for sizeof(DtoaBuffer) + some sign bits, decimal point, 'e', exponent digits.
 const unsigned NumberToStringBufferLength = 96;
 typedef char NumberToStringBuffer[NumberToStringBufferLength];
-typedef UChar NumberToUStringBuffer[NumberToStringBufferLength];
+typedef LChar NumberToLStringBuffer[NumberToStringBufferLength];
 
 WTF_EXPORT_PRIVATE const char* numberToString(double, NumberToStringBuffer);
-const char* numberToFixedPrecisionString(double, unsigned significantFigures, NumberToStringBuffer, bool truncateTrailingZeros = false);
-const char* numberToFixedWidthString(double, unsigned decimalPlaces, NumberToStringBuffer);
+WTF_EXPORT_PRIVATE const char* numberToFixedPrecisionString(double, unsigned significantFigures, NumberToStringBuffer, bool truncateTrailingZeros = false);
+WTF_EXPORT_PRIVATE const char* numberToFixedWidthString(double, unsigned decimalPlaces, NumberToStringBuffer);
 
 double parseDouble(const LChar* string, size_t length, size_t& parsedLength);
 double parseDouble(const UChar* string, size_t length, size_t& parsedLength);
@@ -72,7 +72,7 @@ inline double parseDouble(const UChar* string, size_t length, size_t& parsedLeng
 } // namespace WTF
 
 using WTF::NumberToStringBuffer;
-using WTF::NumberToUStringBuffer;
+using WTF::NumberToLStringBuffer;
 using WTF::numberToString;
 using WTF::numberToFixedPrecisionString;
 using WTF::numberToFixedWidthString;
diff --git a/Source/WTF/wtf/dtoa/double-conversion.h b/Source/WTF/wtf/dtoa/double-conversion.h
index 9e2cb76d0..eb26e87b3 100644
--- a/Source/WTF/wtf/dtoa/double-conversion.h
+++ b/Source/WTF/wtf/dtoa/double-conversion.h
@@ -364,7 +364,7 @@ namespace double_conversion {
         // Performs the conversion.
         // The output parameter 'processed_characters_count' is set to the number
         // of characters that have been processed to read the number.
-        static double StringToDouble(const char* buffer, size_t length, size_t* processed_characters_count);
+        WTF_EXPORT_PRIVATE static double StringToDouble(const char* buffer, size_t length, size_t* processed_characters_count);
         
     private:
         DISALLOW_IMPLICIT_CONSTRUCTORS(StringToDoubleConverter);
diff --git a/Source/WTF/wtf/qt/StringQt.cpp b/Source/WTF/wtf/qt/StringQt.cpp
index 43c4f81f0..ad88c03f7 100644
--- a/Source/WTF/wtf/qt/StringQt.cpp
+++ b/Source/WTF/wtf/qt/StringQt.cpp
@@ -37,11 +37,7 @@ String::String(const QString& qstr)
 {
     if (qstr.isNull())
         return;
-#if HAVE(QT5)
     m_impl = StringImpl::adopt(const_cast<QString&>(qstr).data_ptr());
-#else
-    m_impl = StringImpl::create(reinterpret_cast_ptr<const UChar*>(qstr.constData()), qstr.length());
-#endif
 }
 
 String::String(const QStringRef& ref)
@@ -56,7 +52,6 @@ String::operator QString() const
     if (!m_impl)
         return QString();
 
-#if HAVE(QT5)
     if (QStringData* qStringData = m_impl->qStringData()) {
         // The WTF string was adopted from a QString at some point, so we
         // can just adopt the QStringData like a regular QString copy.
@@ -64,7 +59,7 @@ String::operator QString() const
         QStringDataPtr qStringDataPointer = { qStringData };
         return QString(qStringDataPointer);
     }
-#endif
+
     if (is8Bit() && !m_impl->has16BitShadow()) {
         // Asking for characters() of an 8-bit string will make a 16-bit copy internally
         // in WTF::String. Since we're going to copy the data to QStringData anyways, we
diff --git a/Source/WTF/wtf/qt/UtilsQt.h b/Source/WTF/wtf/qt/UtilsQt.h
deleted file mode 100644
index 61c9e32c1..000000000
--- a/Source/WTF/wtf/qt/UtilsQt.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
-    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef WTF_UtilsQt_h
-#define WTF_UtilsQt_h
-
-#include <QString>
-#if !HAVE(QT5)
-#include <QTextDocument>
-#endif
-
-inline QString escapeHtml(const QString& string)
-{
-#if HAVE(QT5)
-    return string.toHtmlEscaped();
-#else
-    return Qt::escape(string);
-#endif
-}
-
-#endif // WTF_UtilsQt_h
diff --git a/Source/WTF/wtf/qt/compat/QGuiApplication b/Source/WTF/wtf/qt/compat/QGuiApplication
deleted file mode 100644
index 0337e2526..000000000
--- a/Source/WTF/wtf/qt/compat/QGuiApplication
+++ /dev/null
@@ -1 +0,0 @@
-#include "qguiapplication.h"
diff --git a/Source/WTF/wtf/qt/compat/qguiapplication.h b/Source/WTF/wtf/qt/compat/qguiapplication.h
deleted file mode 100644
index 2a2fc23cb..000000000
--- a/Source/WTF/wtf/qt/compat/qguiapplication.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
-    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef qguiapplication_h
-#define qguiapplication_h
-
-#include <QApplication>
-
-struct QGuiApplication : public QApplication
-{
-    // Style hints in Qt 5 contain stuff that just used to be in QApplication in Qt 4, hence
-    // this hack.
-    static QApplication* styleHints()
-    {
-        return qApp;
-    }
-};
-
-#endif
diff --git a/Source/WTF/wtf/text/AtomicString.cpp b/Source/WTF/wtf/text/AtomicString.cpp
index 6477c45b8..a588117e7 100644
--- a/Source/WTF/wtf/text/AtomicString.cpp
+++ b/Source/WTF/wtf/text/AtomicString.cpp
@@ -88,7 +88,7 @@ static inline PassRefPtr<StringImpl> addToStringTable(const T& value)
 struct CStringTranslator {
     static unsigned hash(const LChar* c)
     {
-        return StringHasher::computeHash(c);
+        return StringHasher::computeHashAndMaskTop8Bits(c);
     }
 
     static inline bool equal(StringImpl* r, const LChar* s)
@@ -124,7 +124,7 @@ typedef HashTranslatorCharBuffer<UChar> UCharBuffer;
 struct UCharBufferTranslator {
     static unsigned hash(const UCharBuffer& buf)
     {
-        return StringHasher::computeHash(buf.s, buf.length);
+        return StringHasher::computeHashAndMaskTop8Bits(buf.s, buf.length);
     }
 
     static bool equal(StringImpl* const& str, const UCharBuffer& buf)
@@ -140,25 +140,27 @@ struct UCharBufferTranslator {
     }
 };
 
+template<typename CharacterType>
 struct HashAndCharacters {
     unsigned hash;
-    const UChar* characters;
+    const CharacterType* characters;
     unsigned length;
 };
 
+template<typename CharacterType>
 struct HashAndCharactersTranslator {
-    static unsigned hash(const HashAndCharacters& buffer)
+    static unsigned hash(const HashAndCharacters<CharacterType>& buffer)
     {
-        ASSERT(buffer.hash == StringHasher::computeHash(buffer.characters, buffer.length));
+        ASSERT(buffer.hash == StringHasher::computeHashAndMaskTop8Bits(buffer.characters, buffer.length));
         return buffer.hash;
     }
 
-    static bool equal(StringImpl* const& string, const HashAndCharacters& buffer)
+    static bool equal(StringImpl* const& string, const HashAndCharacters<CharacterType>& buffer)
     {
         return WTF::equal(string, buffer.characters, buffer.length);
     }
 
-    static void translate(StringImpl*& location, const HashAndCharacters& buffer, unsigned hash)
+    static void translate(StringImpl*& location, const HashAndCharacters<CharacterType>& buffer, unsigned hash)
     {
         location = StringImpl::create(buffer.characters, buffer.length).leakRef();
         location->setHash(hash);
@@ -233,8 +235,8 @@ PassRefPtr<StringImpl> AtomicString::add(const UChar* s, unsigned length, unsign
     if (!length)
         return StringImpl::empty();
 
-    HashAndCharacters buffer = { existingHash, s, length };
-    return addToStringTable<HashAndCharacters, HashAndCharactersTranslator>(buffer);
+    HashAndCharacters<UChar> buffer = { existingHash, s, length };
+    return addToStringTable<HashAndCharacters<UChar>, HashAndCharactersTranslator<UChar> >(buffer);
 }
 
 PassRefPtr<StringImpl> AtomicString::add(const UChar* s)
@@ -262,7 +264,7 @@ struct SubstringLocation {
 struct SubstringTranslator {
     static unsigned hash(const SubstringLocation& buffer)
     {
-        return StringHasher::computeHash(buffer.baseString->characters() + buffer.start, buffer.length);
+        return StringHasher::computeHashAndMaskTop8Bits(buffer.baseString->characters() + buffer.start, buffer.length);
     }
 
     static bool equal(StringImpl* const& string, const SubstringLocation& buffer)
@@ -297,19 +299,19 @@ PassRefPtr<StringImpl> AtomicString::add(StringImpl* baseString, unsigned start,
     return addToStringTable<SubstringLocation, SubstringTranslator>(buffer);
 }
 
-typedef HashTranslatorCharBuffer<LChar> LCharBuffer;
-struct LCharBufferFromLiteralDataTranslator {
-    static unsigned hash(const LCharBuffer& buf)
+typedef HashTranslatorCharBuffer<char> CharBuffer;
+struct CharBufferFromLiteralDataTranslator {
+    static unsigned hash(const CharBuffer& buf)
     {
-        return StringHasher::computeHash(buf.s, buf.length);
+        return StringHasher::computeHashAndMaskTop8Bits(reinterpret_cast<const LChar*>(buf.s), buf.length);
     }
 
-    static bool equal(StringImpl* const& str, const LCharBuffer& buf)
+    static bool equal(StringImpl* const& str, const CharBuffer& buf)
     {
         return WTF::equal(str, buf.s, buf.length);
     }
 
-    static void translate(StringImpl*& location, const LCharBuffer& buf, unsigned hash)
+    static void translate(StringImpl*& location, const CharBuffer& buf, unsigned hash)
     {
         location = StringImpl::createFromLiteral(buf.s, buf.length).leakRef();
         location->setHash(hash);
@@ -317,13 +319,13 @@ struct LCharBufferFromLiteralDataTranslator {
     }
 };
 
-PassRefPtr<StringImpl> AtomicString::addFromLiteralData(const LChar *characters, unsigned length)
+PassRefPtr<StringImpl> AtomicString::addFromLiteralData(const char* characters, unsigned length)
 {
     ASSERT(characters);
     ASSERT(length);
 
-    LCharBuffer buffer = { characters, length };
-    return addToStringTable<LCharBuffer, LCharBufferFromLiteralDataTranslator>(buffer);
+    CharBuffer buffer = { characters, length };
+    return addToStringTable<CharBuffer, CharBufferFromLiteralDataTranslator>(buffer);
 }
 
 PassRefPtr<StringImpl> AtomicString::addSlowCase(StringImpl* r)
@@ -337,16 +339,26 @@ PassRefPtr<StringImpl> AtomicString::addSlowCase(StringImpl* r)
     return result;
 }
 
-AtomicStringImpl* AtomicString::find(const UChar* s, unsigned length, unsigned existingHash)
+template<typename CharacterType>
+static inline HashSet<StringImpl*>::iterator findString(const StringImpl* stringImpl)
 {
-    ASSERT(s);
-    ASSERT(existingHash);
+    HashAndCharacters<CharacterType> buffer = { stringImpl->existingHash(), stringImpl->getCharacters<CharacterType>(), stringImpl->length() };
+    return stringTable().find<HashAndCharacters<CharacterType>, HashAndCharactersTranslator<CharacterType> >(buffer);
+}
 
-    if (!length)
+AtomicStringImpl* AtomicString::find(const StringImpl* stringImpl)
+{
+    ASSERT(stringImpl);
+    ASSERT(stringImpl->existingHash());
+
+    if (!stringImpl->length())
         return static_cast<AtomicStringImpl*>(StringImpl::empty());
 
-    HashAndCharacters buffer = { existingHash, s, length }; 
-    HashSet<StringImpl*>::iterator iterator = stringTable().find<HashAndCharacters, HashAndCharactersTranslator>(buffer);
+    HashSet<StringImpl*>::iterator iterator;
+    if (stringImpl->is8Bit())
+        iterator = findString<LChar>(stringImpl);
+    else
+        iterator = findString<UChar>(stringImpl);
     if (iterator == stringTable().end())
         return 0;
     return static_cast<AtomicStringImpl*>(*iterator);
@@ -373,7 +385,7 @@ AtomicString AtomicString::fromUTF8Internal(const char* charactersStart, const c
 {
     HashAndUTF8Characters buffer;
     buffer.characters = charactersStart;
-    buffer.hash = calculateStringHashAndLengthFromUTF8(charactersStart, charactersEnd, buffer.length, buffer.utf16Length);
+    buffer.hash = calculateStringHashAndLengthFromUTF8MaskingTop8Bits(charactersStart, charactersEnd, buffer.length, buffer.utf16Length);
 
     if (!buffer.hash)
         return nullAtom;
diff --git a/Source/WTF/wtf/text/AtomicString.h b/Source/WTF/wtf/text/AtomicString.h
index e75830ee5..194d30ac4 100644
--- a/Source/WTF/wtf/text/AtomicString.h
+++ b/Source/WTF/wtf/text/AtomicString.h
@@ -53,12 +53,12 @@ public:
 
     enum ConstructFromLiteralTag { ConstructFromLiteral };
     AtomicString(const char* characters, unsigned length, ConstructFromLiteralTag)
-        : m_string(addFromLiteralData(reinterpret_cast<const LChar*>(characters), length))
+        : m_string(addFromLiteralData(characters, length))
     {
     }
     template<unsigned charactersCount>
     ALWAYS_INLINE AtomicString(const char (&characters)[charactersCount], ConstructFromLiteralTag)
-        : m_string(addFromLiteralData(reinterpret_cast<const LChar*>(characters), charactersCount - 1))
+        : m_string(addFromLiteralData(characters, charactersCount - 1))
     {
         COMPILE_ASSERT(charactersCount > 1, AtomicStringFromLiteralNotEmpty);
         COMPILE_ASSERT((charactersCount - 1 <= ((unsigned(~0) - sizeof(StringImpl)) / sizeof(LChar))), AtomicStringFromLiteralCannotOverflow);
@@ -79,7 +79,7 @@ public:
     AtomicString(WTF::HashTableDeletedValueType) : m_string(WTF::HashTableDeletedValue) { }
     bool isHashTableDeletedValue() const { return m_string.isHashTableDeletedValue(); }
 
-    WTF_EXPORT_PRIVATE static AtomicStringImpl* find(const UChar* s, unsigned length, unsigned existingHash);
+    WTF_EXPORT_STRING_API static AtomicStringImpl* find(const StringImpl*);
 
     operator const String&() const { return m_string; }
     const String& string() const { return m_string; };
@@ -119,7 +119,7 @@ public:
     bool endsWith(const char (&prefix)[matchLength], bool caseSensitive = true) const
         { return m_string.endsWith<matchLength>(prefix, caseSensitive); }
     
-    WTF_EXPORT_PRIVATE AtomicString lower() const;
+    WTF_EXPORT_STRING_API AtomicString lower() const;
     AtomicString upper() const { return AtomicString(impl()->upper()); }
     
     int toInt(bool* ok = 0) const { return m_string.toInt(ok); }
@@ -156,22 +156,22 @@ public:
 private:
     String m_string;
     
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> add(const LChar*);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(const LChar*);
     ALWAYS_INLINE static PassRefPtr<StringImpl> add(const char* s) { return add(reinterpret_cast<const LChar*>(s)); };
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> add(const UChar*, unsigned length);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(const UChar*, unsigned length);
     ALWAYS_INLINE static PassRefPtr<StringImpl> add(const char* s, unsigned length) { return add(reinterpret_cast<const char*>(s), length); };
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> add(const UChar*, unsigned length, unsigned existingHash);
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> add(const UChar*);
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> add(StringImpl*, unsigned offset, unsigned length);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(const UChar*, unsigned length, unsigned existingHash);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(const UChar*);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(StringImpl*, unsigned offset, unsigned length);
     ALWAYS_INLINE static PassRefPtr<StringImpl> add(StringImpl* r)
     {
         if (!r || r->isAtomic())
             return r;
         return addSlowCase(r);
     }
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> addFromLiteralData(const LChar *characters, unsigned length);
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> addSlowCase(StringImpl*);
-    WTF_EXPORT_PRIVATE static AtomicString fromUTF8Internal(const char*, const char*);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> addFromLiteralData(const char* characters, unsigned length);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> addSlowCase(StringImpl*);
+    WTF_EXPORT_STRING_API static AtomicString fromUTF8Internal(const char*, const char*);
 };
 
 inline bool operator==(const AtomicString& a, const AtomicString& b) { return a.impl() == b.impl(); }
@@ -210,6 +210,7 @@ extern const WTF_EXPORTDATA AtomicString commentAtom;
 extern const WTF_EXPORTDATA AtomicString starAtom;
 extern const WTF_EXPORTDATA AtomicString xmlAtom;
 extern const WTF_EXPORTDATA AtomicString xmlnsAtom;
+extern const WTF_EXPORTDATA AtomicString xlinkAtom;
 
 inline AtomicString AtomicString::fromUTF8(const char* characters, size_t length)
 {
@@ -247,6 +248,7 @@ using WTF::commentAtom;
 using WTF::starAtom;
 using WTF::xmlAtom;
 using WTF::xmlnsAtom;
+using WTF::xlinkAtom;
 #endif
 
 #include <wtf/text/StringConcatenate.h>
diff --git a/Source/WTF/wtf/text/StringBuffer.h b/Source/WTF/wtf/text/StringBuffer.h
index 739260d27..0f66113e5 100644
--- a/Source/WTF/wtf/text/StringBuffer.h
+++ b/Source/WTF/wtf/text/StringBuffer.h
@@ -71,7 +71,7 @@ public:
     unsigned length() const { return m_length; }
     CharType* characters() { return m_data; }
 
-    UChar& operator[](unsigned i) { ASSERT(i < m_length); return m_data[i]; }
+    CharType& operator[](unsigned i) { ASSERT(i < m_length); return m_data[i]; }
 
     CharType* release() { CharType* data = m_data; m_data = 0; return data; }
 
diff --git a/Source/WTF/wtf/text/StringHash.h b/Source/WTF/wtf/text/StringHash.h
index 2d34d2c91..d030befaf 100644
--- a/Source/WTF/wtf/text/StringHash.h
+++ b/Source/WTF/wtf/text/StringHash.h
@@ -97,7 +97,7 @@ namespace WTF {
 
         static unsigned hash(const UChar* data, unsigned length)
         {
-            return StringHasher::computeHash<UChar, foldCase<UChar> >(data, length);
+            return StringHasher::computeHashAndMaskTop8Bits<UChar, foldCase<UChar> >(data, length);
         }
 
         static unsigned hash(StringImpl* str)
@@ -109,7 +109,7 @@ namespace WTF {
 
         static unsigned hash(const LChar* data, unsigned length)
         {
-            return StringHasher::computeHash<LChar, foldCase<LChar> >(data, length);
+            return StringHasher::computeHashAndMaskTop8Bits<LChar, foldCase<LChar> >(data, length);
         }
 
         static inline unsigned hash(const char* data, unsigned length)
diff --git a/Source/WTF/wtf/text/StringImpl.cpp b/Source/WTF/wtf/text/StringImpl.cpp
index 88369a850..6f9b1dcab 100644
--- a/Source/WTF/wtf/text/StringImpl.cpp
+++ b/Source/WTF/wtf/text/StringImpl.cpp
@@ -69,7 +69,7 @@ StringImpl::~StringImpl()
         fastFree(const_cast<LChar*>(m_data8));
         return;
     }
-#if PLATFORM(QT) && HAVE(QT5)
+#if PLATFORM(QT)
     if (ownership == BufferAdoptedQString) {
         if (!m_qStringData->ref.deref())
             QStringData::deallocate(m_qStringData);
@@ -82,10 +82,17 @@ StringImpl::~StringImpl()
     m_substringBuffer->deref();
 }
 
-PassRefPtr<StringImpl> StringImpl::createFromLiteral(const LChar* characters, unsigned length)
+PassRefPtr<StringImpl> StringImpl::createFromLiteral(const char* characters, unsigned length)
 {
-    ASSERT(charactersAreAllASCII<LChar>(characters, length));
-    return adoptRef(new StringImpl(characters, length));
+    ASSERT(charactersAreAllASCII<LChar>(reinterpret_cast<const LChar*>(characters), length));
+    return adoptRef(new StringImpl(characters, length, ConstructFromLiteral));
+}
+
+PassRefPtr<StringImpl> StringImpl::createFromLiteral(const char* characters)
+{
+    size_t length = strlen(characters);
+    ASSERT(charactersAreAllASCII<LChar>(reinterpret_cast<const LChar*>(characters), length));
+    return adoptRef(new StringImpl(characters, length, ConstructFromLiteral));
 }
 
 PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, LChar*& data)
@@ -1657,7 +1664,7 @@ PassRefPtr<StringImpl> StringImpl::adopt(StringBuffer<UChar>& buffer)
     return adoptRef(new StringImpl(buffer.release(), length));
 }
 
-#if PLATFORM(QT) && HAVE(QT5)
+#if PLATFORM(QT)
 PassRefPtr<StringImpl> StringImpl::adopt(QStringData* qStringData)
 {
     ASSERT(qStringData);
@@ -1693,4 +1700,19 @@ PassRefPtr<StringImpl> StringImpl::createWithTerminatingNullCharacter(const Stri
     return terminatedString.release();
 }
 
+size_t StringImpl::sizeInBytes() const
+{
+    // FIXME: support substrings
+    size_t size = length();
+    if (is8Bit()) {
+        if (has16BitShadow()) {
+            size += 2 * size;
+            if (hasTerminatingNullCharacter())
+                size += 2;
+        }
+    } else
+        size *= 2;
+    return size + sizeof(*this);
+}
+
 } // namespace WTF
diff --git a/Source/WTF/wtf/text/StringImpl.h b/Source/WTF/wtf/text/StringImpl.h
index 2afa4e20b..2a3ae2bd0 100644
--- a/Source/WTF/wtf/text/StringImpl.h
+++ b/Source/WTF/wtf/text/StringImpl.h
@@ -31,7 +31,7 @@
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
 
-#if PLATFORM(QT) && HAVE(QT5)
+#if PLATFORM(QT)
 #include <QString>
 #endif
 
@@ -46,7 +46,7 @@ typedef const struct __CFString * CFStringRef;
 // FIXME: This is a temporary layering violation while we move string code to WTF.
 // Landing the file moves in one patch, will follow on with patches to change the namespaces.
 namespace JSC {
-struct IdentifierCStringTranslator;
+struct IdentifierASCIIStringTranslator;
 namespace LLInt { class Data; }
 class LLIntOffsetsExtractor;
 template <typename T> struct IdentifierCharBufferTranslator;
@@ -56,9 +56,9 @@ struct IdentifierLCharFromUCharTranslator;
 namespace WTF {
 
 struct CStringTranslator;
-struct HashAndCharactersTranslator;
+template<typename CharacterType> struct HashAndCharactersTranslator;
 struct HashAndUTF8CharactersTranslator;
-struct LCharBufferFromLiteralDataTranslator;
+struct CharBufferFromLiteralDataTranslator;
 struct SubstringTranslator;
 struct UCharBufferTranslator;
 
@@ -69,14 +69,14 @@ typedef bool (*IsWhiteSpaceFunctionPtr)(UChar);
 
 class StringImpl {
     WTF_MAKE_NONCOPYABLE(StringImpl); WTF_MAKE_FAST_ALLOCATED;
-    friend struct JSC::IdentifierCStringTranslator;
+    friend struct JSC::IdentifierASCIIStringTranslator;
     friend struct JSC::IdentifierCharBufferTranslator<LChar>;
     friend struct JSC::IdentifierCharBufferTranslator<UChar>;
     friend struct JSC::IdentifierLCharFromUCharTranslator;
     friend struct WTF::CStringTranslator;
-    friend struct WTF::HashAndCharactersTranslator;
+    template<typename CharacterType> friend struct WTF::HashAndCharactersTranslator;
     friend struct WTF::HashAndUTF8CharactersTranslator;
-    friend struct WTF::LCharBufferFromLiteralDataTranslator;
+    friend struct WTF::CharBufferFromLiteralDataTranslator;
     friend struct WTF::SubstringTranslator;
     friend struct WTF::UCharBufferTranslator;
     friend class AtomicStringImpl;
@@ -88,7 +88,7 @@ private:
         BufferInternal,
         BufferOwned,
         BufferSubstring,
-#if PLATFORM(QT) && HAVE(QT5)
+#if PLATFORM(QT)
         BufferAdoptedQString
 #endif
         // NOTE: Adding more ownership types needs to extend m_hashAndFlags as we're at capacity
@@ -165,6 +165,19 @@ private:
         ASSERT(m_length);
     }
 
+    enum ConstructFromLiteralTag { ConstructFromLiteral };
+    StringImpl(const char* characters, unsigned length, ConstructFromLiteralTag)
+        : m_refCount(s_refCountIncrement)
+        , m_length(length)
+        , m_data8(reinterpret_cast<const LChar*>(characters))
+        , m_buffer(0)
+        , m_hashAndFlags(s_hashFlag8BitBuffer | BufferInternal | s_hashFlagHasTerminatingNullCharacter)
+    {
+        ASSERT(m_data8);
+        ASSERT(m_length);
+        ASSERT(!characters[length]);
+    }
+
     // Create a StringImpl adopting ownership of the provided buffer (BufferOwned)
     StringImpl(const UChar* characters, unsigned length)
         : m_refCount(s_refCountIncrement)
@@ -225,7 +238,7 @@ private:
         m_hashAndFlags = hash | BufferInternal;
     }
 
-#if PLATFORM(QT) && HAVE(QT5)
+#if PLATFORM(QT)
     // Used to create new strings that adopt an existing QString's data
     enum ConstructAdoptedQStringTag { ConstructAdoptedQString };
     StringImpl(QStringData* qStringData, ConstructAdoptedQStringTag)
@@ -249,12 +262,12 @@ private:
 #endif
 
 public:
-    WTF_EXPORT_PRIVATE ~StringImpl();
+    WTF_EXPORT_STRING_API ~StringImpl();
 
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> create(const UChar*, unsigned length);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> create(const UChar*, unsigned length);
     static PassRefPtr<StringImpl> create(const LChar*, unsigned length);
     ALWAYS_INLINE static PassRefPtr<StringImpl> create(const char* s, unsigned length) { return create(reinterpret_cast<const LChar*>(s), length); }
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> create(const LChar*);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> create(const LChar*);
     ALWAYS_INLINE static PassRefPtr<StringImpl> create(const char* s) { return create(reinterpret_cast<const LChar*>(s)); }
 
     static ALWAYS_INLINE PassRefPtr<StringImpl> create8(PassRefPtr<StringImpl> rep, unsigned offset, unsigned length)
@@ -284,18 +297,19 @@ public:
         return adoptRef(new StringImpl(rep->m_data16 + offset, length, ownerRep));
     }
 
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> createFromLiteral(const LChar* characters, unsigned length);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> createFromLiteral(const char* characters, unsigned length);
     template<unsigned charactersCount>
     ALWAYS_INLINE static PassRefPtr<StringImpl> createFromLiteral(const char (&characters)[charactersCount])
     {
         COMPILE_ASSERT(charactersCount > 1, StringImplFromLiteralNotEmpty);
         COMPILE_ASSERT((charactersCount - 1 <= ((unsigned(~0) - sizeof(StringImpl)) / sizeof(LChar))), StringImplFromLiteralCannotOverflow);
 
-        return createFromLiteral(reinterpret_cast<const LChar*>(characters), charactersCount - 1);
+        return createFromLiteral(characters, charactersCount - 1);
     }
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> createFromLiteral(const char* characters);
 
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> createUninitialized(unsigned length, LChar*& data);
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> createUninitialized(unsigned length, UChar*& data);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> createUninitialized(unsigned length, LChar*& data);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> createUninitialized(unsigned length, UChar*& data);
     template <typename T> static ALWAYS_INLINE PassRefPtr<StringImpl> tryCreateUninitialized(unsigned length, T*& output)
     {
         if (!length) {
@@ -348,10 +362,10 @@ public:
         return empty();
     }
 
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> adopt(StringBuffer<UChar>&);
-    WTF_EXPORT_PRIVATE static PassRefPtr<StringImpl> adopt(StringBuffer<LChar>&);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> adopt(StringBuffer<UChar>&);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> adopt(StringBuffer<LChar>&);
 
-#if PLATFORM(QT) && HAVE(QT5)
+#if PLATFORM(QT)
     static PassRefPtr<StringImpl> adopt(QStringData*);
 #endif
 
@@ -385,8 +399,10 @@ public:
         return m_length;
     }
 
+    WTF_EXPORT_STRING_API size_t sizeInBytes() const;
+
     bool has16BitShadow() const { return m_hashAndFlags & s_hashFlagHas16BitShadow; }
-    WTF_EXPORT_PRIVATE void upconvertCharacters(unsigned, unsigned) const;
+    WTF_EXPORT_STRING_API void upconvertCharacters(unsigned, unsigned) const;
     bool isIdentifier() const { return m_hashAndFlags & s_hashFlagIsIdentifier; }
     void setIsIdentifier(bool isIdentifier)
     {
@@ -414,7 +430,7 @@ public:
             m_hashAndFlags &= ~s_hashFlagIsAtomic;
     }
 
-#if PLATFORM(QT) && HAVE(QT5)
+#if PLATFORM(QT)
     QStringData* qStringData() { return bufferOwnership() == BufferAdoptedQString ? m_qStringData : 0; }
 #endif
 
@@ -426,7 +442,7 @@ private:
     {
         ASSERT(!hasHash());
         // Multiple clients assume that StringHasher is the canonical string hash function.
-        ASSERT(hash == (is8Bit() ? StringHasher::computeHash(m_data8, m_length) : StringHasher::computeHash(m_data16, m_length)));
+        ASSERT(hash == (is8Bit() ? StringHasher::computeHashAndMaskTop8Bits(m_data8, m_length) : StringHasher::computeHashAndMaskTop8Bits(m_data16, m_length)));
         ASSERT(!(hash & (s_flagMask << (8 * sizeof(hash) - s_flagCount)))); // Verify that enough high bits are empty.
         
         hash <<= s_flagCount;
@@ -515,7 +531,7 @@ public:
     // its own copy of the string.
     PassRefPtr<StringImpl> isolatedCopy() const;
 
-    WTF_EXPORT_PRIVATE PassRefPtr<StringImpl> substring(unsigned pos, unsigned len = UINT_MAX);
+    WTF_EXPORT_STRING_API PassRefPtr<StringImpl> substring(unsigned pos, unsigned len = UINT_MAX);
 
     UChar operator[](unsigned i) const
     {
@@ -524,9 +540,9 @@ public:
             return m_data8[i];
         return m_data16[i];
     }
-    WTF_EXPORT_PRIVATE UChar32 characterStartingAt(unsigned);
+    WTF_EXPORT_STRING_API UChar32 characterStartingAt(unsigned);
 
-    WTF_EXPORT_PRIVATE bool containsOnlyWhitespace();
+    WTF_EXPORT_STRING_API bool containsOnlyWhitespace();
 
     int toIntStrict(bool* ok = 0, int base = 10);
     unsigned toUIntStrict(bool* ok = 0, int base = 10);
@@ -534,7 +550,7 @@ public:
     uint64_t toUInt64Strict(bool* ok = 0, int base = 10);
     intptr_t toIntPtrStrict(bool* ok = 0, int base = 10);
 
-    WTF_EXPORT_PRIVATE int toInt(bool* ok = 0); // ignores trailing garbage
+    WTF_EXPORT_STRING_API int toInt(bool* ok = 0); // ignores trailing garbage
     unsigned toUInt(bool* ok = 0); // ignores trailing garbage
     int64_t toInt64(bool* ok = 0); // ignores trailing garbage
     uint64_t toUInt64(bool* ok = 0); // ignores trailing garbage
@@ -546,16 +562,16 @@ public:
     double toDouble(bool* ok = 0);
     float toFloat(bool* ok = 0);
 
-    WTF_EXPORT_PRIVATE PassRefPtr<StringImpl> lower();
-    WTF_EXPORT_PRIVATE PassRefPtr<StringImpl> upper();
+    WTF_EXPORT_STRING_API PassRefPtr<StringImpl> lower();
+    WTF_EXPORT_STRING_API PassRefPtr<StringImpl> upper();
 
-    WTF_EXPORT_PRIVATE PassRefPtr<StringImpl> fill(UChar);
+    WTF_EXPORT_STRING_API PassRefPtr<StringImpl> fill(UChar);
     // FIXME: Do we need fill(char) or can we just do the right thing if UChar is ASCII?
     PassRefPtr<StringImpl> foldCase();
 
     PassRefPtr<StringImpl> stripWhiteSpace();
     PassRefPtr<StringImpl> stripWhiteSpace(IsWhiteSpaceFunctionPtr);
-    WTF_EXPORT_PRIVATE PassRefPtr<StringImpl> simplifyWhiteSpace();
+    WTF_EXPORT_STRING_API PassRefPtr<StringImpl> simplifyWhiteSpace();
     PassRefPtr<StringImpl> simplifyWhiteSpace(IsWhiteSpaceFunctionPtr);
 
     PassRefPtr<StringImpl> removeCharacters(CharacterMatchFunctionPtr);
@@ -565,37 +581,37 @@ public:
     size_t find(LChar character, unsigned start = 0);
     size_t find(char character, unsigned start = 0);
     size_t find(UChar character, unsigned start = 0);
-    WTF_EXPORT_PRIVATE size_t find(CharacterMatchFunctionPtr, unsigned index = 0);
+    WTF_EXPORT_STRING_API size_t find(CharacterMatchFunctionPtr, unsigned index = 0);
     size_t find(const LChar*, unsigned index = 0);
     ALWAYS_INLINE size_t find(const char* s, unsigned index = 0) { return find(reinterpret_cast<const LChar*>(s), index); };
-    WTF_EXPORT_PRIVATE size_t find(StringImpl*);
-    WTF_EXPORT_PRIVATE size_t find(StringImpl*, unsigned index);
+    WTF_EXPORT_STRING_API size_t find(StringImpl*);
+    WTF_EXPORT_STRING_API size_t find(StringImpl*, unsigned index);
     size_t findIgnoringCase(const LChar*, unsigned index = 0);
     ALWAYS_INLINE size_t findIgnoringCase(const char* s, unsigned index = 0) { return findIgnoringCase(reinterpret_cast<const LChar*>(s), index); };
-    WTF_EXPORT_PRIVATE size_t findIgnoringCase(StringImpl*, unsigned index = 0);
+    WTF_EXPORT_STRING_API size_t findIgnoringCase(StringImpl*, unsigned index = 0);
 
-    WTF_EXPORT_PRIVATE size_t reverseFind(UChar, unsigned index = UINT_MAX);
-    WTF_EXPORT_PRIVATE size_t reverseFind(StringImpl*, unsigned index = UINT_MAX);
-    WTF_EXPORT_PRIVATE size_t reverseFindIgnoringCase(StringImpl*, unsigned index = UINT_MAX);
+    WTF_EXPORT_STRING_API size_t reverseFind(UChar, unsigned index = UINT_MAX);
+    WTF_EXPORT_STRING_API size_t reverseFind(StringImpl*, unsigned index = UINT_MAX);
+    WTF_EXPORT_STRING_API size_t reverseFindIgnoringCase(StringImpl*, unsigned index = UINT_MAX);
 
     bool startsWith(StringImpl* str, bool caseSensitive = true) { return (caseSensitive ? reverseFind(str, 0) : reverseFindIgnoringCase(str, 0)) == 0; }
-    WTF_EXPORT_PRIVATE bool startsWith(UChar) const;
-    WTF_EXPORT_PRIVATE bool startsWith(const char*, unsigned matchLength, bool caseSensitive) const;
+    WTF_EXPORT_STRING_API bool startsWith(UChar) const;
+    WTF_EXPORT_STRING_API bool startsWith(const char*, unsigned matchLength, bool caseSensitive) const;
     template<unsigned matchLength>
     bool startsWith(const char (&prefix)[matchLength], bool caseSensitive = true) const { return startsWith(prefix, matchLength - 1, caseSensitive); };
 
-    WTF_EXPORT_PRIVATE bool endsWith(StringImpl*, bool caseSensitive = true);
-    WTF_EXPORT_PRIVATE bool endsWith(UChar) const;
-    WTF_EXPORT_PRIVATE bool endsWith(const char*, unsigned matchLength, bool caseSensitive) const;
+    WTF_EXPORT_STRING_API bool endsWith(StringImpl*, bool caseSensitive = true);
+    WTF_EXPORT_STRING_API bool endsWith(UChar) const;
+    WTF_EXPORT_STRING_API bool endsWith(const char*, unsigned matchLength, bool caseSensitive) const;
     template<unsigned matchLength>
     bool endsWith(const char (&prefix)[matchLength], bool caseSensitive = true) const { return endsWith(prefix, matchLength - 1, caseSensitive); }
 
-    WTF_EXPORT_PRIVATE PassRefPtr<StringImpl> replace(UChar, UChar);
-    WTF_EXPORT_PRIVATE PassRefPtr<StringImpl> replace(UChar, StringImpl*);
-    WTF_EXPORT_PRIVATE PassRefPtr<StringImpl> replace(StringImpl*, StringImpl*);
-    WTF_EXPORT_PRIVATE PassRefPtr<StringImpl> replace(unsigned index, unsigned len, StringImpl*);
+    WTF_EXPORT_STRING_API PassRefPtr<StringImpl> replace(UChar, UChar);
+    WTF_EXPORT_STRING_API PassRefPtr<StringImpl> replace(UChar, StringImpl*);
+    WTF_EXPORT_STRING_API PassRefPtr<StringImpl> replace(StringImpl*, StringImpl*);
+    WTF_EXPORT_STRING_API PassRefPtr<StringImpl> replace(unsigned index, unsigned len, StringImpl*);
 
-    WTF_EXPORT_PRIVATE WTF::Unicode::Direction defaultWritingDirection(bool* hasStrongDirectionality = 0);
+    WTF_EXPORT_STRING_API WTF::Unicode::Direction defaultWritingDirection(bool* hasStrongDirectionality = 0);
 
 #if USE(CF)
     CFStringRef createCFString();
@@ -612,7 +628,7 @@ private:
     bool isStatic() const { return m_refCount & s_refCountFlagIsStaticString; }
     template <class UCharPredicate> PassRefPtr<StringImpl> stripMatchedCharacters(UCharPredicate);
     template <typename CharType, class UCharPredicate> PassRefPtr<StringImpl> simplifyMatchedCharactersToSpace(UCharPredicate);
-    WTF_EXPORT_PRIVATE NEVER_INLINE const UChar* getData16SlowCase() const;
+    WTF_EXPORT_STRING_API NEVER_INLINE const UChar* getData16SlowCase() const;
     WTF_EXPORT_PRIVATE NEVER_INLINE unsigned hashSlowCase() const;
 
     // The bottom bit in the ref count indicates a static (immortal) string.
@@ -642,7 +658,7 @@ private:
         void* m_buffer;
         StringImpl* m_substringBuffer;
         mutable UChar* m_copyData16;
-#if PLATFORM(QT) && HAVE(QT5)
+#if PLATFORM(QT)
         QStringData* m_qStringData;
 #endif
     };
@@ -655,14 +671,14 @@ ALWAYS_INLINE const LChar* StringImpl::getCharacters<LChar>() const { return cha
 template <>
 ALWAYS_INLINE const UChar* StringImpl::getCharacters<UChar>() const { return characters(); }
 
-WTF_EXPORT_PRIVATE bool equal(const StringImpl*, const StringImpl*);
-WTF_EXPORT_PRIVATE bool equal(const StringImpl*, const LChar*);
+WTF_EXPORT_STRING_API bool equal(const StringImpl*, const StringImpl*);
+WTF_EXPORT_STRING_API bool equal(const StringImpl*, const LChar*);
 inline bool equal(const StringImpl* a, const char* b) { return equal(a, reinterpret_cast<const LChar*>(b)); }
-WTF_EXPORT_PRIVATE bool equal(const StringImpl*, const LChar*, unsigned);
+WTF_EXPORT_STRING_API bool equal(const StringImpl*, const LChar*, unsigned);
 inline bool equal(const StringImpl* a, const char* b, unsigned length) { return equal(a, reinterpret_cast<const LChar*>(b), length); }
 inline bool equal(const LChar* a, StringImpl* b) { return equal(b, a); }
 inline bool equal(const char* a, StringImpl* b) { return equal(b, reinterpret_cast<const LChar*>(a)); }
-WTF_EXPORT_PRIVATE bool equal(const StringImpl*, const UChar*, unsigned);
+WTF_EXPORT_STRING_API bool equal(const StringImpl*, const UChar*, unsigned);
 
 // Do comparisons 8 or 4 bytes-at-a-time on architectures where it's safe.
 #if CPU(X86_64)
@@ -820,16 +836,16 @@ ALWAYS_INLINE bool equal(const UChar* a, const LChar* b, unsigned length)
     return true;
 }
 
-WTF_EXPORT_PRIVATE bool equalIgnoringCase(StringImpl*, StringImpl*);
-WTF_EXPORT_PRIVATE bool equalIgnoringCase(StringImpl*, const LChar*);
+WTF_EXPORT_STRING_API bool equalIgnoringCase(StringImpl*, StringImpl*);
+WTF_EXPORT_STRING_API bool equalIgnoringCase(StringImpl*, const LChar*);
 inline bool equalIgnoringCase(const LChar* a, StringImpl* b) { return equalIgnoringCase(b, a); }
-WTF_EXPORT_PRIVATE bool equalIgnoringCase(const LChar*, const LChar*, unsigned);
-WTF_EXPORT_PRIVATE bool equalIgnoringCase(const UChar*, const LChar*, unsigned);
+WTF_EXPORT_STRING_API bool equalIgnoringCase(const LChar*, const LChar*, unsigned);
+WTF_EXPORT_STRING_API bool equalIgnoringCase(const UChar*, const LChar*, unsigned);
 inline bool equalIgnoringCase(const UChar* a, const char* b, unsigned length) { return equalIgnoringCase(a, reinterpret_cast<const LChar*>(b), length); }
 inline bool equalIgnoringCase(const LChar* a, const UChar* b, unsigned length) { return equalIgnoringCase(b, a, length); }
 inline bool equalIgnoringCase(const char* a, const UChar* b, unsigned length) { return equalIgnoringCase(b, reinterpret_cast<const LChar*>(a), length); }
 
-WTF_EXPORT_PRIVATE bool equalIgnoringNullity(StringImpl*, StringImpl*);
+WTF_EXPORT_STRING_API bool equalIgnoringNullity(StringImpl*, StringImpl*);
 
 template<typename CharacterType>
 inline size_t find(const CharacterType* characters, unsigned length, CharacterType matchCharacter, unsigned index = 0)
diff --git a/Source/WTF/wtf/text/StringStatics.cpp b/Source/WTF/wtf/text/StringStatics.cpp
index 1a80f6d48..e749728fc 100644
--- a/Source/WTF/wtf/text/StringStatics.cpp
+++ b/Source/WTF/wtf/text/StringStatics.cpp
@@ -59,13 +59,14 @@ WTF_EXPORTDATA DEFINE_GLOBAL(AtomicString, commentAtom, "#comment")
 WTF_EXPORTDATA DEFINE_GLOBAL(AtomicString, starAtom, "*")
 WTF_EXPORTDATA DEFINE_GLOBAL(AtomicString, xmlAtom, "xml")
 WTF_EXPORTDATA DEFINE_GLOBAL(AtomicString, xmlnsAtom, "xmlns")
+WTF_EXPORTDATA DEFINE_GLOBAL(AtomicString, xlinkAtom, "xlink")
 
 NEVER_INLINE unsigned StringImpl::hashSlowCase() const
 {
     if (is8Bit())
-        setHash(StringHasher::computeHash(m_data8, m_length));
+        setHash(StringHasher::computeHashAndMaskTop8Bits(m_data8, m_length));
     else
-        setHash(StringHasher::computeHash(m_data16, m_length));
+        setHash(StringHasher::computeHashAndMaskTop8Bits(m_data16, m_length));
     return existingHash();
 }
 
@@ -84,6 +85,7 @@ void AtomicString::init()
         new (NotNull, (void*)&starAtom) AtomicString("*");
         new (NotNull, (void*)&xmlAtom) AtomicString("xml");
         new (NotNull, (void*)&xmlnsAtom) AtomicString("xmlns");
+        new (NotNull, (void*)&xlinkAtom) AtomicString("xlink");
 
         initialized = true;
     }
diff --git a/Source/WTF/wtf/text/WTFString.cpp b/Source/WTF/wtf/text/WTFString.cpp
index 05fc21e15..8977444bb 100644
--- a/Source/WTF/wtf/text/WTFString.cpp
+++ b/Source/WTF/wtf/text/WTFString.cpp
@@ -84,6 +84,11 @@ String::String(const char* characters)
 {
 }
 
+String::String(ASCIILiteral characters)
+    : m_impl(StringImpl::createFromLiteral(characters))
+{
+}
+
 void String::append(const String& str)
 {
     if (str.isEmpty())
diff --git a/Source/WTF/wtf/text/WTFString.h b/Source/WTF/wtf/text/WTFString.h
index 9f492a7a1..2ef384251 100644
--- a/Source/WTF/wtf/text/WTFString.h
+++ b/Source/WTF/wtf/text/WTFString.h
@@ -63,9 +63,9 @@ struct StringHash;
 // Declarations of string operations
 
 int charactersToIntStrict(const LChar*, size_t, bool* ok = 0, int base = 10);
-WTF_EXPORT_PRIVATE int charactersToIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
+WTF_EXPORT_STRING_API int charactersToIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
 unsigned charactersToUIntStrict(const LChar*, size_t, bool* ok = 0, int base = 10);
-WTF_EXPORT_PRIVATE unsigned charactersToUIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
+WTF_EXPORT_STRING_API unsigned charactersToUIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
 int64_t charactersToInt64Strict(const LChar*, size_t, bool* ok = 0, int base = 10);
 int64_t charactersToInt64Strict(const UChar*, size_t, bool* ok = 0, int base = 10);
 uint64_t charactersToUInt64Strict(const LChar*, size_t, bool* ok = 0, int base = 10);
@@ -74,7 +74,7 @@ intptr_t charactersToIntPtrStrict(const LChar*, size_t, bool* ok = 0, int base =
 intptr_t charactersToIntPtrStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
 
 int charactersToInt(const LChar*, size_t, bool* ok = 0); // ignores trailing garbage
-WTF_EXPORT_PRIVATE int charactersToInt(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
+WTF_EXPORT_STRING_API int charactersToInt(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
 unsigned charactersToUInt(const LChar*, size_t, bool* ok = 0); // ignores trailing garbage
 unsigned charactersToUInt(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
 int64_t charactersToInt64(const LChar*, size_t, bool* ok = 0); // ignores trailing garbage
@@ -87,12 +87,14 @@ intptr_t charactersToIntPtr(const UChar*, size_t, bool* ok = 0); // ignores trai
 // FIXME: Like the strict functions above, these give false for "ok" when there is trailing garbage.
 // Like the non-strict functions above, these return the value when there is trailing garbage.
 // It would be better if these were more consistent with the above functions instead.
-WTF_EXPORT_PRIVATE double charactersToDouble(const LChar*, size_t, bool* ok = 0);
-WTF_EXPORT_PRIVATE double charactersToDouble(const UChar*, size_t, bool* ok = 0);
+WTF_EXPORT_STRING_API double charactersToDouble(const LChar*, size_t, bool* ok = 0);
+WTF_EXPORT_STRING_API double charactersToDouble(const UChar*, size_t, bool* ok = 0);
 float charactersToFloat(const LChar*, size_t, bool* ok = 0);
-WTF_EXPORT_PRIVATE float charactersToFloat(const UChar*, size_t, bool* ok = 0);
-WTF_EXPORT_PRIVATE float charactersToFloat(const LChar*, size_t, size_t& parsedLength);
-WTF_EXPORT_PRIVATE float charactersToFloat(const UChar*, size_t, size_t& parsedLength);
+WTF_EXPORT_STRING_API float charactersToFloat(const UChar*, size_t, bool* ok = 0);
+WTF_EXPORT_STRING_API float charactersToFloat(const LChar*, size_t, size_t& parsedLength);
+WTF_EXPORT_STRING_API float charactersToFloat(const UChar*, size_t, size_t& parsedLength);
+
+class ASCIILiteral;
 
 enum FloatConversionFlags {
     ShouldRoundSignificantFigures = 1 << 0,
@@ -108,7 +110,7 @@ public:
     String() { }
 
     // Construct a string with UTF-16 data.
-    WTF_EXPORT_PRIVATE String(const UChar* characters, unsigned length);
+    WTF_EXPORT_STRING_API String(const UChar* characters, unsigned length);
 
     // Construct a string by copying the contents of a vector.  To avoid
     // copying, consider using String::adopt instead.
@@ -116,21 +118,30 @@ public:
     explicit String(const Vector<UChar, inlineCapacity>&);
 
     // Construct a string with UTF-16 data, from a null-terminated source.
-    WTF_EXPORT_PRIVATE String(const UChar*);
+    WTF_EXPORT_STRING_API String(const UChar*);
 
     // Construct a string with latin1 data.
-    WTF_EXPORT_PRIVATE String(const LChar* characters, unsigned length);
-    WTF_EXPORT_PRIVATE String(const char* characters, unsigned length);
+    WTF_EXPORT_STRING_API String(const LChar* characters, unsigned length);
+    WTF_EXPORT_STRING_API String(const char* characters, unsigned length);
 
     // Construct a string with latin1 data, from a null-terminated source.
-    WTF_EXPORT_PRIVATE String(const LChar* characters);
-    WTF_EXPORT_PRIVATE String(const char* characters);
+    WTF_EXPORT_STRING_API String(const LChar* characters);
+    WTF_EXPORT_STRING_API String(const char* characters);
 
     // Construct a string referencing an existing StringImpl.
     String(StringImpl* impl) : m_impl(impl) { }
     String(PassRefPtr<StringImpl> impl) : m_impl(impl) { }
     String(RefPtr<StringImpl> impl) : m_impl(impl) { }
 
+    // Construct a string from a constant string literal.
+    WTF_EXPORT_STRING_API String(ASCIILiteral characters);
+
+    // Construct a string from a constant string literal.
+    // This constructor is the "big" version, as it put the length in the function call and generate bigger code.
+    enum ConstructFromLiteralTag { ConstructFromLiteral };
+    template<unsigned charactersCount>
+    String(const char (&characters)[charactersCount], ConstructFromLiteralTag) : m_impl(StringImpl::createFromLiteral<charactersCount>(characters)) { }
+
 #if COMPILER_SUPPORTS(CXX_RVALUE_REFERENCES)
     // We have to declare the copy constructor and copy assignment operator as well, otherwise
     // they'll be implicitly deleted by adding the move constructor and move assignment operator.
@@ -147,8 +158,8 @@ public:
 
     static String adopt(StringBuffer<LChar>& buffer) { return StringImpl::adopt(buffer); }
     static String adopt(StringBuffer<UChar>& buffer) { return StringImpl::adopt(buffer); }
-    template<size_t inlineCapacity>
-    static String adopt(Vector<UChar, inlineCapacity>& vector) { return StringImpl::adopt(vector); }
+    template<typename CharacterType, size_t inlineCapacity>
+    static String adopt(Vector<CharacterType, inlineCapacity>& vector) { return StringImpl::adopt(vector); }
 
     bool isNull() const { return !m_impl; }
     bool isEmpty() const { return !m_impl || !m_impl->length(); }
@@ -190,9 +201,16 @@ public:
 
     bool is8Bit() const { return m_impl->is8Bit(); }
 
-    WTF_EXPORT_PRIVATE CString ascii() const;
-    WTF_EXPORT_PRIVATE CString latin1() const;
-    WTF_EXPORT_PRIVATE CString utf8(bool strict = false) const;
+    unsigned sizeInBytes() const
+    {
+        if (!m_impl)
+            return 0;
+        return m_impl->length() * (is8Bit() ? sizeof(LChar) : sizeof(UChar));
+    }
+
+    WTF_EXPORT_STRING_API CString ascii() const;
+    WTF_EXPORT_STRING_API CString latin1() const;
+    WTF_EXPORT_STRING_API CString utf8(bool strict = false) const;
 
     UChar operator[](unsigned index) const
     {
@@ -202,14 +220,14 @@ public:
     }
 
     static String number(short);
-    WTF_EXPORT_PRIVATE static String number(unsigned short);
-    WTF_EXPORT_PRIVATE static String number(int);
-    WTF_EXPORT_PRIVATE static String number(unsigned);
-    WTF_EXPORT_PRIVATE static String number(long);
-    WTF_EXPORT_PRIVATE static String number(unsigned long);
-    WTF_EXPORT_PRIVATE static String number(long long);
-    WTF_EXPORT_PRIVATE static String number(unsigned long long);
-    WTF_EXPORT_PRIVATE static String number(double, unsigned = ShouldRoundSignificantFigures | ShouldTruncateTrailingZeros, unsigned precision = 6);
+    WTF_EXPORT_STRING_API static String number(unsigned short);
+    WTF_EXPORT_STRING_API static String number(int);
+    WTF_EXPORT_STRING_API static String number(unsigned);
+    WTF_EXPORT_STRING_API static String number(long);
+    WTF_EXPORT_STRING_API static String number(unsigned long);
+    WTF_EXPORT_STRING_API static String number(long long);
+    WTF_EXPORT_STRING_API static String number(unsigned long long);
+    WTF_EXPORT_STRING_API static String number(double, unsigned = ShouldRoundSignificantFigures | ShouldTruncateTrailingZeros, unsigned precision = 6);
 
     // Find a single character or string, also with match function & latin1 forms.
     size_t find(UChar c, unsigned start = 0) const
@@ -247,9 +265,9 @@ public:
     size_t reverseFind(const String& str, unsigned start, bool caseSensitive) const
         { return caseSensitive ? reverseFind(str, start) : reverseFindIgnoringCase(str, start); }
 
-    WTF_EXPORT_PRIVATE const UChar* charactersWithNullTermination();
+    WTF_EXPORT_STRING_API const UChar* charactersWithNullTermination();
     
-    WTF_EXPORT_PRIVATE UChar32 characterStartingAt(unsigned) const; // Ditto.
+    WTF_EXPORT_STRING_API UChar32 characterStartingAt(unsigned) const; // Ditto.
     
     bool contains(UChar c) const { return find(c) != notFound; }
     bool contains(const LChar* str, bool caseSensitive = true) const { return find(str, 0, caseSensitive) != notFound; }
@@ -271,12 +289,12 @@ public:
     bool endsWith(const char (&prefix)[matchLength], bool caseSensitive = true) const
         { return m_impl ? m_impl->endsWith<matchLength>(prefix, caseSensitive) : !matchLength; }
 
-    WTF_EXPORT_PRIVATE void append(const String&);
-    WTF_EXPORT_PRIVATE void append(LChar);
+    WTF_EXPORT_STRING_API void append(const String&);
+    WTF_EXPORT_STRING_API void append(LChar);
     void append(char c) { append(static_cast<LChar>(c)); };
-    WTF_EXPORT_PRIVATE void append(UChar);
-    WTF_EXPORT_PRIVATE void append(const UChar*, unsigned length);
-    WTF_EXPORT_PRIVATE void insert(const String&, unsigned pos);
+    WTF_EXPORT_STRING_API void append(UChar);
+    WTF_EXPORT_STRING_API void append(const UChar*, unsigned length);
+    WTF_EXPORT_STRING_API void insert(const String&, unsigned pos);
     void insert(const UChar*, unsigned length, unsigned pos);
 
     String& replace(UChar a, UChar b) { if (m_impl) m_impl = m_impl->replace(a, b); return *this; }
@@ -288,33 +306,33 @@ public:
     void makeUpper() { if (m_impl) m_impl = m_impl->upper(); }
     void fill(UChar c) { if (m_impl) m_impl = m_impl->fill(c); }
 
-    WTF_EXPORT_PRIVATE void truncate(unsigned len);
-    WTF_EXPORT_PRIVATE void remove(unsigned pos, int len = 1);
+    WTF_EXPORT_STRING_API void truncate(unsigned len);
+    WTF_EXPORT_STRING_API void remove(unsigned pos, int len = 1);
 
-    WTF_EXPORT_PRIVATE String substring(unsigned pos, unsigned len = UINT_MAX) const;
+    WTF_EXPORT_STRING_API String substring(unsigned pos, unsigned len = UINT_MAX) const;
     String substringSharingImpl(unsigned pos, unsigned len = UINT_MAX) const;
     String left(unsigned len) const { return substring(0, len); }
     String right(unsigned len) const { return substring(length() - len, len); }
 
     // Returns a lowercase/uppercase version of the string
-    WTF_EXPORT_PRIVATE String lower() const;
-    WTF_EXPORT_PRIVATE String upper() const;
+    WTF_EXPORT_STRING_API String lower() const;
+    WTF_EXPORT_STRING_API String upper() const;
 
-    WTF_EXPORT_PRIVATE String stripWhiteSpace() const;
-    WTF_EXPORT_PRIVATE String stripWhiteSpace(IsWhiteSpaceFunctionPtr) const;
-    WTF_EXPORT_PRIVATE String simplifyWhiteSpace() const;
-    WTF_EXPORT_PRIVATE String simplifyWhiteSpace(IsWhiteSpaceFunctionPtr) const;
+    WTF_EXPORT_STRING_API String stripWhiteSpace() const;
+    WTF_EXPORT_STRING_API String stripWhiteSpace(IsWhiteSpaceFunctionPtr) const;
+    WTF_EXPORT_STRING_API String simplifyWhiteSpace() const;
+    WTF_EXPORT_STRING_API String simplifyWhiteSpace(IsWhiteSpaceFunctionPtr) const;
 
-    WTF_EXPORT_PRIVATE String removeCharacters(CharacterMatchFunctionPtr) const;
+    WTF_EXPORT_STRING_API String removeCharacters(CharacterMatchFunctionPtr) const;
     template<bool isSpecialCharacter(UChar)> bool isAllSpecialCharacters() const;
 
     // Return the string with case folded for case insensitive comparison.
-    WTF_EXPORT_PRIVATE String foldCase() const;
+    WTF_EXPORT_STRING_API String foldCase() const;
 
 #if !PLATFORM(QT)
-    WTF_EXPORT_PRIVATE static String format(const char *, ...) WTF_ATTRIBUTE_PRINTF(1, 2);
+    WTF_EXPORT_STRING_API static String format(const char *, ...) WTF_ATTRIBUTE_PRINTF(1, 2);
 #else
-    WTF_EXPORT_PRIVATE static String format(const char *, ...);
+    WTF_EXPORT_STRING_API static String format(const char *, ...);
 #endif
 
     // Returns an uninitialized string. The characters needs to be written
@@ -323,32 +341,32 @@ public:
     static String createUninitialized(unsigned length, UChar*& data) { return StringImpl::createUninitialized(length, data); }
     static String createUninitialized(unsigned length, LChar*& data) { return StringImpl::createUninitialized(length, data); }
 
-    WTF_EXPORT_PRIVATE void split(const String& separator, Vector<String>& result) const;
-    WTF_EXPORT_PRIVATE void split(const String& separator, bool allowEmptyEntries, Vector<String>& result) const;
-    WTF_EXPORT_PRIVATE void split(UChar separator, Vector<String>& result) const;
-    WTF_EXPORT_PRIVATE void split(UChar separator, bool allowEmptyEntries, Vector<String>& result) const;
+    WTF_EXPORT_STRING_API void split(const String& separator, Vector<String>& result) const;
+    WTF_EXPORT_STRING_API void split(const String& separator, bool allowEmptyEntries, Vector<String>& result) const;
+    WTF_EXPORT_STRING_API void split(UChar separator, Vector<String>& result) const;
+    WTF_EXPORT_STRING_API void split(UChar separator, bool allowEmptyEntries, Vector<String>& result) const;
 
-    WTF_EXPORT_PRIVATE int toIntStrict(bool* ok = 0, int base = 10) const;
-    WTF_EXPORT_PRIVATE unsigned toUIntStrict(bool* ok = 0, int base = 10) const;
-    WTF_EXPORT_PRIVATE int64_t toInt64Strict(bool* ok = 0, int base = 10) const;
+    WTF_EXPORT_STRING_API int toIntStrict(bool* ok = 0, int base = 10) const;
+    WTF_EXPORT_STRING_API unsigned toUIntStrict(bool* ok = 0, int base = 10) const;
+    WTF_EXPORT_STRING_API int64_t toInt64Strict(bool* ok = 0, int base = 10) const;
     uint64_t toUInt64Strict(bool* ok = 0, int base = 10) const;
     intptr_t toIntPtrStrict(bool* ok = 0, int base = 10) const;
 
-    WTF_EXPORT_PRIVATE int toInt(bool* ok = 0) const;
-    WTF_EXPORT_PRIVATE unsigned toUInt(bool* ok = 0) const;
+    WTF_EXPORT_STRING_API int toInt(bool* ok = 0) const;
+    WTF_EXPORT_STRING_API unsigned toUInt(bool* ok = 0) const;
     int64_t toInt64(bool* ok = 0) const;
-    WTF_EXPORT_PRIVATE uint64_t toUInt64(bool* ok = 0) const;
-    WTF_EXPORT_PRIVATE intptr_t toIntPtr(bool* ok = 0) const;
+    WTF_EXPORT_STRING_API uint64_t toUInt64(bool* ok = 0) const;
+    WTF_EXPORT_STRING_API intptr_t toIntPtr(bool* ok = 0) const;
 
     // FIXME: Like the strict functions above, these give false for "ok" when there is trailing garbage.
     // Like the non-strict functions above, these return the value when there is trailing garbage.
     // It would be better if these were more consistent with the above functions instead.
-    WTF_EXPORT_PRIVATE double toDouble(bool* ok = 0) const;
-    WTF_EXPORT_PRIVATE float toFloat(bool* ok = 0) const;
+    WTF_EXPORT_STRING_API double toDouble(bool* ok = 0) const;
+    WTF_EXPORT_STRING_API float toFloat(bool* ok = 0) const;
 
     bool percentage(int& percentage) const;
 
-    WTF_EXPORT_PRIVATE String isolatedCopy() const;
+    WTF_EXPORT_STRING_API String isolatedCopy() const;
 
     // Prevent Strings from being implicitly convertable to bool as it will be ambiguous on any platform that
     // allows implicit conversion to another pointer type (e.g., Mac allows implicit conversion to NSString*).
@@ -388,13 +406,13 @@ public:
 
     // String::fromUTF8 will return a null string if
     // the input data contains invalid UTF-8 sequences.
-    WTF_EXPORT_PRIVATE static String fromUTF8(const LChar*, size_t);
-    WTF_EXPORT_PRIVATE static String fromUTF8(const LChar*);
+    WTF_EXPORT_STRING_API static String fromUTF8(const LChar*, size_t);
+    WTF_EXPORT_STRING_API static String fromUTF8(const LChar*);
     static String fromUTF8(const char* s, size_t length) { return fromUTF8(reinterpret_cast<const LChar*>(s), length); };
     static String fromUTF8(const char* s) { return fromUTF8(reinterpret_cast<const LChar*>(s)); };
 
     // Tries to convert the passed in string to UTF-8, but will fall back to Latin-1 if the string is not valid UTF-8.
-    WTF_EXPORT_PRIVATE static String fromUTF8WithLatin1Fallback(const LChar*, size_t);
+    WTF_EXPORT_STRING_API static String fromUTF8WithLatin1Fallback(const LChar*, size_t);
     static String fromUTF8WithLatin1Fallback(const char* s, size_t length) { return fromUTF8WithLatin1Fallback(reinterpret_cast<const LChar*>(s), length); };
     
     // Determines the writing direction using the Unicode Bidi Algorithm rules P2 and P3.
@@ -416,7 +434,7 @@ public:
     bool isHashTableDeletedValue() const { return m_impl.isHashTableDeletedValue(); }
 
 #ifndef NDEBUG
-    WTF_EXPORT_PRIVATE void show() const;
+    WTF_EXPORT_STRING_API void show() const;
 #endif
 
 private:
@@ -527,7 +545,7 @@ inline bool String::containsOnlyASCII() const
     return charactersAreAllASCII(characters16(), m_impl->length());
 }
 
-WTF_EXPORT_PRIVATE int codePointCompare(const String&, const String&);
+WTF_EXPORT_STRING_API int codePointCompare(const String&, const String&);
 
 inline bool codePointCompareLessThan(const String& a, const String& b)
 {
@@ -539,7 +557,8 @@ inline void append(Vector<UChar>& vector, const String& string)
     vector.append(string.characters(), string.length());
 }
 
-inline void appendNumber(Vector<UChar>& vector, unsigned char number)
+template<typename CharacterType>
+inline void appendNumber(Vector<CharacterType>& vector, unsigned char number)
 {
     int numberLength = number > 99 ? 3 : (number > 9 ? 2 : 1);
     size_t vectorSize = vector.size();
@@ -581,8 +600,17 @@ template<> struct DefaultHash<String> {
 
 template <> struct VectorTraits<String> : SimpleClassVectorTraits { };
 
+class ASCIILiteral {
+public:
+    explicit ASCIILiteral(const char* characters) : m_characters(characters) { }
+    operator const char*() { return m_characters; }
+
+private:
+    const char* m_characters;
+};
+
 // Shared global empty string.
-WTF_EXPORT_PRIVATE const String& emptyString();
+WTF_EXPORT_STRING_API const String& emptyString();
 
 }
 
@@ -611,6 +639,7 @@ using WTF::isAllSpecialCharacters;
 using WTF::isSpaceOrNewline;
 using WTF::reverseFind;
 using WTF::ShouldRoundDecimalPlaces;
+using WTF::ASCIILiteral;
 
 #include <wtf/text/AtomicString.h>
 #endif
diff --git a/Source/WTF/wtf/unicode/UTF8.cpp b/Source/WTF/wtf/unicode/UTF8.cpp
index 8ea5c6992..6bec4051b 100644
--- a/Source/WTF/wtf/unicode/UTF8.cpp
+++ b/Source/WTF/wtf/unicode/UTF8.cpp
@@ -356,7 +356,7 @@ ConversionResult convertUTF8ToUTF16(
     return result;
 }
 
-unsigned calculateStringHashAndLengthFromUTF8(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length)
+unsigned calculateStringHashAndLengthFromUTF8MaskingTop8Bits(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length)
 {
     if (!data)
         return 0;
@@ -404,7 +404,7 @@ unsigned calculateStringHashAndLengthFromUTF8(const char* data, const char* data
             return 0;
     }
 
-    return stringHasher.hash();
+    return stringHasher.hashWithTop8BitsMasked();
 }
 
 bool equalUTF16WithUTF8(const UChar* a, const UChar* aEnd, const char* b, const char* bEnd)
diff --git a/Source/WTF/wtf/unicode/UTF8.h b/Source/WTF/wtf/unicode/UTF8.h
index 59f6994be..33497daf6 100644
--- a/Source/WTF/wtf/unicode/UTF8.h
+++ b/Source/WTF/wtf/unicode/UTF8.h
@@ -66,7 +66,7 @@ namespace Unicode {
                     const char** sourceStart, const char* sourceEnd, 
                     UChar** targetStart, UChar* targetEnd, bool strict = true);
 
-    ConversionResult convertLatin1ToUTF8(
+    WTF_EXPORT_PRIVATE ConversionResult convertLatin1ToUTF8(
                     const LChar** sourceStart, const LChar* sourceEnd, 
                     char** targetStart, char* targetEnd);
 
@@ -74,9 +74,9 @@ namespace Unicode {
                     const UChar** sourceStart, const UChar* sourceEnd, 
                     char** targetStart, char* targetEnd, bool strict = true);
 
-    unsigned calculateStringHashAndLengthFromUTF8(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length);
+    WTF_EXPORT_PRIVATE unsigned calculateStringHashAndLengthFromUTF8MaskingTop8Bits(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length);
 
-    bool equalUTF16WithUTF8(const UChar* a, const UChar* aEnd, const char* b, const char* bEnd);
+    WTF_EXPORT_PRIVATE bool equalUTF16WithUTF8(const UChar* a, const UChar* aEnd, const char* b, const char* bEnd);
 
 } // namespace Unicode
 } // namespace WTF
diff --git a/Source/WTF/wtf/unicode/Unicode.h b/Source/WTF/wtf/unicode/Unicode.h
index cc44476a6..926021191 100644
--- a/Source/WTF/wtf/unicode/Unicode.h
+++ b/Source/WTF/wtf/unicode/Unicode.h
@@ -34,8 +34,8 @@ typedef unsigned char LChar;
 #include <wtf/unicode/icu/UnicodeIcu.h>
 #elif USE(GLIB_UNICODE)
 #include <wtf/unicode/glib/UnicodeGLib.h>
-#elif USE(WINCE_UNICODE)
-#include <wtf/unicode/wince/UnicodeWinCE.h>
+#elif USE(WCHAR_UNICODE)
+#include <wtf/unicode/wchar/UnicodeWchar.h>
 #else
 #error "Unknown Unicode implementation"
 #endif
diff --git a/Source/WTF/wtf/unicode/wchar/UnicodeWchar.cpp b/Source/WTF/wtf/unicode/wchar/UnicodeWchar.cpp
new file mode 100644
index 000000000..e975c3b61
--- /dev/null
+++ b/Source/WTF/wtf/unicode/wchar/UnicodeWchar.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "UnicodeWchar.h"
+
+#include <algorithm>
+
+namespace WTF {
+namespace Unicode {
+
+CharCategory category(UChar32)
+{
+    return NoCategory; // FIXME: implement!
+}
+
+unsigned char combiningClass(UChar32)
+{
+    return 0; // FIXME: implement!
+}
+
+Direction direction(UChar32)
+{
+    return LeftToRight; // FIXME: implement!
+}
+
+DecompositionType decompositionType(UChar32)
+{
+    return DecompositionNone; // FIXME: implement!
+}
+
+bool hasLineBreakingPropertyComplexContext(UChar32)
+{
+    return false; // FIXME: implement!
+}
+
+UChar32 mirroredChar(UChar32 c)
+{
+    return c; // FIXME: implement!
+}
+
+template<UChar Function(UChar)>
+static inline int convertWithFunction(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
+{
+    UChar* resultIterator = result;
+    UChar* resultEnd = result + std::min(resultLength, sourceLength);
+    while (resultIterator < resultEnd)
+        *resultIterator++ = Function(*source++);
+
+    if (sourceLength < resultLength)
+        *resultIterator = '\0';
+
+    *isError = sourceLength > resultLength;
+    return sourceLength;
+}
+
+int foldCase(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
+{
+    return convertWithFunction<foldCase>(result, resultLength, source, sourceLength, isError);
+}
+
+int toLower(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
+{
+    return convertWithFunction<toLower>(result, resultLength, source, sourceLength, isError);
+}
+
+int toUpper(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
+{
+    return convertWithFunction<toUpper>(result, resultLength, source, sourceLength, isError);
+}
+
+} // namespace Unicode
+} // namespace WTF
diff --git a/Source/WTF/wtf/unicode/wchar/UnicodeWchar.h b/Source/WTF/wtf/unicode/wchar/UnicodeWchar.h
new file mode 100644
index 000000000..10c2026c5
--- /dev/null
+++ b/Source/WTF/wtf/unicode/wchar/UnicodeWchar.h
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WTF_UnicodeWchar_h
+#define WTF_UnicodeWchar_h
+
+#include <stdint.h>
+#include <wchar.h>
+#include <wtf/unicode/ScriptCodesFromICU.h>
+#include <wtf/unicode/UnicodeMacrosFromICU.h>
+
+typedef wchar_t UChar;
+typedef uint32_t UChar32;
+
+namespace WTF {
+namespace Unicode {
+
+enum Direction {
+    LeftToRight,
+    RightToLeft,
+    EuropeanNumber,
+    EuropeanNumberSeparator,
+    EuropeanNumberTerminator,
+    ArabicNumber,
+    CommonNumberSeparator,
+    BlockSeparator,
+    SegmentSeparator,
+    WhiteSpaceNeutral,
+    OtherNeutral,
+    LeftToRightEmbedding,
+    LeftToRightOverride,
+    RightToLeftArabic,
+    RightToLeftEmbedding,
+    RightToLeftOverride,
+    PopDirectionalFormat,
+    NonSpacingMark,
+    BoundaryNeutral
+};
+
+enum DecompositionType {
+    DecompositionNone,
+    DecompositionCanonical,
+    DecompositionCompat,
+    DecompositionCircle,
+    DecompositionFinal,
+    DecompositionFont,
+    DecompositionFraction,
+    DecompositionInitial,
+    DecompositionIsolated,
+    DecompositionMedial,
+    DecompositionNarrow,
+    DecompositionNoBreak,
+    DecompositionSmall,
+    DecompositionSquare,
+    DecompositionSub,
+    DecompositionSuper,
+    DecompositionVertical,
+    DecompositionWide
+};
+
+enum CharCategory {
+    NoCategory = 0,
+    Other_NotAssigned = U_MASK(0),
+    Letter_Uppercase = U_MASK(1),
+    Letter_Lowercase = U_MASK(2),
+    Letter_Titlecase = U_MASK(3),
+    Letter_Modifier = U_MASK(4),
+    Letter_Other = U_MASK(5),
+
+    Mark_NonSpacing = U_MASK(6),
+    Mark_Enclosing = U_MASK(7),
+    Mark_SpacingCombining = U_MASK(8),
+
+    Number_DecimalDigit = U_MASK(9),
+    Number_Letter = U_MASK(10),
+    Number_Other = U_MASK(11),
+
+    Separator_Space = U_MASK(12),
+    Separator_Line = U_MASK(13),
+    Separator_Paragraph = U_MASK(14),
+
+    Other_Control = U_MASK(15),
+    Other_Format = U_MASK(16),
+    Other_PrivateUse = U_MASK(17),
+    Other_Surrogate = U_MASK(18),
+
+    Punctuation_Dash = U_MASK(19),
+    Punctuation_Open = U_MASK(20),
+    Punctuation_Close = U_MASK(21),
+    Punctuation_Connector = U_MASK(22),
+    Punctuation_Other = U_MASK(23),
+
+    Symbol_Math = U_MASK(24),
+    Symbol_Currency = U_MASK(25),
+    Symbol_Modifier = U_MASK(26),
+    Symbol_Other = U_MASK(27),
+
+    Punctuation_InitialQuote = U_MASK(28),
+    Punctuation_FinalQuote = U_MASK(29)
+};
+
+
+WTF_EXPORT_PRIVATE CharCategory category(UChar32);
+WTF_EXPORT_PRIVATE unsigned char combiningClass(UChar32);
+WTF_EXPORT_PRIVATE Direction direction(UChar32);
+WTF_EXPORT_PRIVATE DecompositionType decompositionType(UChar32);
+WTF_EXPORT_PRIVATE bool hasLineBreakingPropertyComplexContext(UChar32);
+WTF_EXPORT_PRIVATE UChar32 mirroredChar(UChar32);
+
+inline bool isAlphanumeric(UChar c) { return !!iswalnum(c); }
+inline bool isDigit(UChar c) { return !!iswdigit(c); }
+inline bool isLetter(UChar c) { return !!iswalpha(c); }
+inline bool isLower(UChar c) { return !!iswlower(c); }
+inline bool isPrintableChar(UChar c) { return !!iswprint(c); }
+inline bool isPunct(UChar c) { return !!iswpunct(c); }
+inline bool isSpace(UChar c) { return !!iswspace(c); }
+inline bool isUpper(UChar c) { return !!iswupper(c); }
+
+inline bool isArabicChar(UChar32 c) { return c >= 0x0600 && c <= 0x06ff; }
+inline bool isSeparatorSpace(UChar32 c) { return category(c) == Separator_Space; }
+
+inline UChar foldCase(UChar c) { return towlower(c); }
+inline UChar toLower(UChar c) { return towlower(c); }
+inline UChar toUpper(UChar c) { return towupper(c); }
+inline UChar toTitleCase(UChar c) { return towupper(c); }
+
+WTF_EXPORT_PRIVATE int foldCase(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
+WTF_EXPORT_PRIVATE int toLower(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
+WTF_EXPORT_PRIVATE int toUpper(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
+
+inline int umemcasecmp(const UChar* a, const UChar* b, int len)
+{
+    for (int i = 0; i < len; ++i) {
+        UChar c1 = foldCase(a[i]);
+        UChar c2 = foldCase(b[i]);
+        if (c1 != c2)
+            return c1 - c2;
+    }
+
+    return 0;
+}
+
+} // namespace Unicode
+} // namespace WTF
+
+#endif // WTF_UnicodeWchar_h
diff --git a/Source/WTF/wtf/unicode/wince/UnicodeWinCE.cpp b/Source/WTF/wtf/unicode/wince/UnicodeWinCE.cpp
deleted file mode 100644
index 96dac7d40..000000000
--- a/Source/WTF/wtf/unicode/wince/UnicodeWinCE.cpp
+++ /dev/null
@@ -1,181 +0,0 @@
-/*
- *  Copyright (C) 2006 George Staikos <staikos@kde.org>
- *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
- *  Copyright (C) 2007-2009 Torch Mobile, Inc.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "UnicodeWinCE.h"
-
-#include <wchar.h>
-
-namespace WTF {
-namespace Unicode {
-
-UChar toLower(UChar c)
-{
-    return towlower(c);
-}
-
-UChar toUpper(UChar c)
-{
-    return towupper(c);
-}
-
-UChar foldCase(UChar c)
-{
-    return towlower(c);
-}
-
-bool isPrintableChar(UChar c)
-{
-    return !!iswprint(c);
-}
-
-bool isSpace(UChar c)
-{
-    return !!iswspace(c);
-}
-
-bool isLetter(UChar c)
-{
-    return !!iswalpha(c);
-}
-
-bool isUpper(UChar c)
-{
-    return !!iswupper(c);
-}
-
-bool isLower(UChar c)
-{
-    return !!iswlower(c);
-}
-
-bool isDigit(UChar c)
-{
-    return !!iswdigit(c);
-}
-
-bool isPunct(UChar c)
-{
-    return !!iswpunct(c);
-}
-
-bool isAlphanumeric(UChar c)
-{
-    return !!iswalnum(c);
-}
-
-int toLower(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
-{
-    const UChar* sourceIterator = source;
-    const UChar* sourceEnd = source + sourceLength;
-    UChar* resultIterator = result;
-    UChar* resultEnd = result + resultLength;
-
-    int remainingCharacters = 0;
-    if (sourceLength <= resultLength)
-        while (sourceIterator < sourceEnd)
-            *resultIterator++ = towlower(*sourceIterator++);
-    else
-        while (resultIterator < resultEnd)
-            *resultIterator++ = towlower(*sourceIterator++);
-
-    if (sourceIterator < sourceEnd)
-        remainingCharacters += sourceEnd - sourceIterator;
-    *isError = !!remainingCharacters;
-    if (resultIterator < resultEnd)
-        *resultIterator = 0;
-
-    return (resultIterator - result) + remainingCharacters;
-}
-
-int toUpper(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
-{
-    const UChar* sourceIterator = source;
-    const UChar* sourceEnd = source + sourceLength;
-    UChar* resultIterator = result;
-    UChar* resultEnd = result + resultLength;
-
-    int remainingCharacters = 0;
-    if (sourceLength <= resultLength)
-        while (sourceIterator < sourceEnd)
-            *resultIterator++ = towupper(*sourceIterator++);
-    else
-        while (resultIterator < resultEnd)
-            *resultIterator++ = towupper(*sourceIterator++);
-
-    if (sourceIterator < sourceEnd)
-        remainingCharacters += sourceEnd - sourceIterator;
-    *isError = !!remainingCharacters;
-    if (resultIterator < resultEnd)
-        *resultIterator = 0;
-
-    return (resultIterator - result) + remainingCharacters;
-}
-
-int foldCase(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
-{
-    *isError = false;
-    if (resultLength < sourceLength) {
-        *isError = true;
-        return sourceLength;
-    }
-    for (int i = 0; i < sourceLength; ++i)
-        result[i] = foldCase(source[i]);
-    return sourceLength;
-}
-
-UChar toTitleCase(UChar c)
-{
-    return towupper(c);
-}
-
-Direction direction(UChar32 c)
-{
-    return static_cast<Direction>(UnicodeCE::direction(c));
-}
-
-CharCategory category(unsigned int c)
-{
-    return static_cast<CharCategory>(TO_MASK((__int8) UnicodeCE::category(c)));
-}
-
-DecompositionType decompositionType(UChar32 c)
-{
-    return static_cast<DecompositionType>(UnicodeCE::decompositionType(c));
-}
-
-unsigned char combiningClass(UChar32 c)
-{
-    return UnicodeCE::combiningClass(c);
-}
-
-UChar mirroredChar(UChar32 c)
-{
-    return UnicodeCE::mirroredChar(c);
-}
-
-int digitValue(UChar c)
-{
-    return UnicodeCE::digitValue(c);
-}
-
-} // namespace Unicode
-} // namespace WTF
diff --git a/Source/WTF/wtf/unicode/wince/UnicodeWinCE.h b/Source/WTF/wtf/unicode/wince/UnicodeWinCE.h
deleted file mode 100644
index d61bb469d..000000000
--- a/Source/WTF/wtf/unicode/wince/UnicodeWinCE.h
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
- *  Copyright (C) 2006 George Staikos <staikos@kde.org>
- *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
- *  Copyright (C) 2007 Apple Computer, Inc. All rights reserved.
- *  Copyright (C) 2007-2009 Torch Mobile, Inc.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef WTF_UnicodeWinCE_h
-#define WTF_UnicodeWinCE_h
-
-#include <wtf/unicode/ScriptCodesFromICU.h>
-#include <wtf/unicode/UnicodeMacrosFromICU.h>
-
-#include "ce_unicode.h"
-
-#define TO_MASK(x) (1 << (x))
-
-namespace WTF {
-namespace Unicode {
-
-enum Direction {
-    LeftToRight = UnicodeCE::U_LEFT_TO_RIGHT,
-    RightToLeft = UnicodeCE::U_RIGHT_TO_LEFT,
-    EuropeanNumber = UnicodeCE::U_EUROPEAN_NUMBER,
-    EuropeanNumberSeparator = UnicodeCE::U_EUROPEAN_NUMBER_SEPARATOR,
-    EuropeanNumberTerminator = UnicodeCE::U_EUROPEAN_NUMBER_TERMINATOR,
-    ArabicNumber = UnicodeCE::U_ARABIC_NUMBER,
-    CommonNumberSeparator = UnicodeCE::U_COMMON_NUMBER_SEPARATOR,
-    BlockSeparator = UnicodeCE::U_BLOCK_SEPARATOR,
-    SegmentSeparator = UnicodeCE::U_SEGMENT_SEPARATOR,
-    WhiteSpaceNeutral = UnicodeCE::U_WHITE_SPACE_NEUTRAL,
-    OtherNeutral = UnicodeCE::U_OTHER_NEUTRAL,
-    LeftToRightEmbedding = UnicodeCE::U_LEFT_TO_RIGHT_EMBEDDING,
-    LeftToRightOverride = UnicodeCE::U_LEFT_TO_RIGHT_OVERRIDE,
-    RightToLeftArabic = UnicodeCE::U_RIGHT_TO_LEFT_ARABIC,
-    RightToLeftEmbedding = UnicodeCE::U_RIGHT_TO_LEFT_EMBEDDING,
-    RightToLeftOverride = UnicodeCE::U_RIGHT_TO_LEFT_OVERRIDE,
-    PopDirectionalFormat = UnicodeCE::U_POP_DIRECTIONAL_FORMAT,
-    NonSpacingMark = UnicodeCE::U_DIR_NON_SPACING_MARK,
-    BoundaryNeutral = UnicodeCE::U_BOUNDARY_NEUTRAL
-};
-
-enum DecompositionType {
-    DecompositionNone = UnicodeCE::U_DT_NONE,
-    DecompositionCanonical = UnicodeCE::U_DT_CANONICAL,
-    DecompositionCompat = UnicodeCE::U_DT_COMPAT,
-    DecompositionCircle = UnicodeCE::U_DT_CIRCLE,
-    DecompositionFinal = UnicodeCE::U_DT_FINAL,
-    DecompositionFont = UnicodeCE::U_DT_FONT,
-    DecompositionFraction = UnicodeCE::U_DT_FRACTION,
-    DecompositionInitial = UnicodeCE::U_DT_INITIAL,
-    DecompositionIsolated = UnicodeCE::U_DT_ISOLATED,
-    DecompositionMedial = UnicodeCE::U_DT_MEDIAL,
-    DecompositionNarrow = UnicodeCE::U_DT_NARROW,
-    DecompositionNoBreak = UnicodeCE::U_DT_NOBREAK,
-    DecompositionSmall = UnicodeCE::U_DT_SMALL,
-    DecompositionSquare = UnicodeCE::U_DT_SQUARE,
-    DecompositionSub = UnicodeCE::U_DT_SUB,
-    DecompositionSuper = UnicodeCE::U_DT_SUPER,
-    DecompositionVertical = UnicodeCE::U_DT_VERTICAL,
-    DecompositionWide = UnicodeCE::U_DT_WIDE
-};
-
-enum CharCategory {
-    NoCategory =  0,
-    Other_NotAssigned = TO_MASK(UnicodeCE::U_GENERAL_OTHER_TYPES),
-    Letter_Uppercase = TO_MASK(UnicodeCE::U_UPPERCASE_LETTER),
-    Letter_Lowercase = TO_MASK(UnicodeCE::U_LOWERCASE_LETTER),
-    Letter_Titlecase = TO_MASK(UnicodeCE::U_TITLECASE_LETTER),
-    Letter_Modifier = TO_MASK(UnicodeCE::U_MODIFIER_LETTER),
-    Letter_Other = TO_MASK(UnicodeCE::U_OTHER_LETTER),
-
-    Mark_NonSpacing = TO_MASK(UnicodeCE::U_NON_SPACING_MARK),
-    Mark_Enclosing = TO_MASK(UnicodeCE::U_ENCLOSING_MARK),
-    Mark_SpacingCombining = TO_MASK(UnicodeCE::U_COMBINING_SPACING_MARK),
-
-    Number_DecimalDigit = TO_MASK(UnicodeCE::U_DECIMAL_DIGIT_NUMBER),
-    Number_Letter = TO_MASK(UnicodeCE::U_LETTER_NUMBER),
-    Number_Other = TO_MASK(UnicodeCE::U_OTHER_NUMBER),
-
-    Separator_Space = TO_MASK(UnicodeCE::U_SPACE_SEPARATOR),
-    Separator_Line = TO_MASK(UnicodeCE::U_LINE_SEPARATOR),
-    Separator_Paragraph = TO_MASK(UnicodeCE::U_PARAGRAPH_SEPARATOR),
-
-    Other_Control = TO_MASK(UnicodeCE::U_CONTROL_CHAR),
-    Other_Format = TO_MASK(UnicodeCE::U_FORMAT_CHAR),
-    Other_PrivateUse = TO_MASK(UnicodeCE::U_PRIVATE_USE_CHAR),
-    Other_Surrogate = TO_MASK(UnicodeCE::U_SURROGATE),
-
-    Punctuation_Dash = TO_MASK(UnicodeCE::U_DASH_PUNCTUATION),
-    Punctuation_Open = TO_MASK(UnicodeCE::U_START_PUNCTUATION),
-    Punctuation_Close = TO_MASK(UnicodeCE::U_END_PUNCTUATION),
-    Punctuation_Connector = TO_MASK(UnicodeCE::U_CONNECTOR_PUNCTUATION),
-    Punctuation_Other = TO_MASK(UnicodeCE::U_OTHER_PUNCTUATION),
-
-    Symbol_Math = TO_MASK(UnicodeCE::U_MATH_SYMBOL),
-    Symbol_Currency = TO_MASK(UnicodeCE::U_CURRENCY_SYMBOL),
-    Symbol_Modifier = TO_MASK(UnicodeCE::U_MODIFIER_SYMBOL),
-    Symbol_Other = TO_MASK(UnicodeCE::U_OTHER_SYMBOL),
-
-    Punctuation_InitialQuote = TO_MASK(UnicodeCE::U_INITIAL_PUNCTUATION),
-    Punctuation_FinalQuote = TO_MASK(UnicodeCE::U_FINAL_PUNCTUATION)
-};
-
-CharCategory category(unsigned int);
-
-bool isSpace(UChar);
-bool isLetter(UChar);
-bool isPrintableChar(UChar);
-bool isUpper(UChar);
-bool isLower(UChar);
-bool isPunct(UChar);
-bool isDigit(UChar);
-bool isAlphanumeric(UChar);
-inline bool isSeparatorSpace(UChar c) { return category(c) == Separator_Space; }
-
-UChar toLower(UChar);
-UChar toUpper(UChar);
-UChar foldCase(UChar);
-UChar toTitleCase(UChar);
-int toLower(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
-int toUpper(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
-int foldCase(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
-
-int digitValue(UChar);
-
-UChar mirroredChar(UChar32);
-unsigned char combiningClass(UChar32);
-DecompositionType decompositionType(UChar32);
-Direction direction(UChar32);
-inline bool isArabicChar(UChar32 c)
-{
-    return c >= 0x0600 && c <= 0x06FF;
-}
-
-inline bool hasLineBreakingPropertyComplexContext(UChar32)
-{
-    return false; // FIXME: implement!
-}
-
-inline int umemcasecmp(const UChar* a, const UChar* b, int len)
-{
-    for (int i = 0; i < len; ++i) {
-        UChar c1 = foldCase(a[i]);
-        UChar c2 = foldCase(b[i]);
-        if (c1 != c2)
-            return c1 - c2;
-    }
-    return 0;
-}
-
-} // namespace Unicode
-} // namespace WTF
-
-#endif // WTF_UnicodeWinCE_h
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index 6f8ff65e2..9b9c0a6fb 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -6,10 +6,12 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/Modules/geolocation"
     "${WEBCORE_DIR}/Modules/indexeddb"
     "${WEBCORE_DIR}/Modules/intents"
+    "${WEBCORE_DIR}/Modules/mediasource"
     "${WEBCORE_DIR}/Modules/mediastream"
     "${WEBCORE_DIR}/Modules/networkinfo"
     "${WEBCORE_DIR}/Modules/notifications"
     "${WEBCORE_DIR}/Modules/protocolhandler"
+    "${WEBCORE_DIR}/Modules/proximity"
     "${WEBCORE_DIR}/Modules/quota"
     "${WEBCORE_DIR}/Modules/vibration"
     "${WEBCORE_DIR}/Modules/webaudio"
@@ -50,6 +52,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/graphics/filters/arm"
     "${WEBCORE_DIR}/platform/graphics/harfbuzz"
     "${WEBCORE_DIR}/platform/graphics/harfbuzz/ng"
+    "${WEBCORE_DIR}/platform/graphics/opentype"
     "${WEBCORE_DIR}/platform/graphics/transforms"
     "${WEBCORE_DIR}/platform/image-decoders"
     "${WEBCORE_DIR}/platform/image-decoders/bmp"
@@ -104,11 +107,18 @@ SET(WebCore_INCLUDE_DIRECTORIES
 )
 
 SET(WebCore_IDL_INCLUDES
+    Modules/battery
     Modules/filesystem
     Modules/gamepad
     Modules/geolocation
     Modules/indexeddb
+    Modules/intents
+    Modules/mediastream
+    Modules/networkinfo
+    Modules/notifications
     Modules/quota
+    Modules/speech
+    Modules/vibration
     Modules/webaudio
     Modules/webdatabase
     Modules/websockets
@@ -118,6 +128,8 @@ SET(WebCore_IDL_INCLUDES
     fileapi
     html
     html/canvas
+    html/shadow
+    html/track
     inspector
     loader/appcache
     page
@@ -191,6 +203,10 @@ SET(WebCore_IDL_FILES
     Modules/intents/IntentResultCallback.idl
     Modules/intents/NavigatorIntents.idl
 
+    Modules/mediasource/MediaSource.idl
+    Modules/mediasource/SourceBuffer.idl
+    Modules/mediasource/SourceBufferList.idl
+
     Modules/mediastream/DOMWindowMediaStream.idl
     Modules/mediastream/IceCallback.idl
     Modules/mediastream/IceCandidate.idl
@@ -206,6 +222,7 @@ SET(WebCore_IDL_FILES
     Modules/mediastream/NavigatorUserMediaErrorCallback.idl
     Modules/mediastream/NavigatorUserMediaSuccessCallback.idl
     Modules/mediastream/PeerConnection00.idl
+    Modules/mediastream/RTCPeerConnection.idl
     Modules/mediastream/SessionDescription.idl
 
     Modules/networkinfo/NavigatorNetworkInfoConnection.idl
@@ -218,7 +235,9 @@ SET(WebCore_IDL_FILES
     Modules/notifications/WorkerContextNotifications.idl
 
     Modules/protocolhandler/NavigatorRegisterProtocolHandler.idl
-    
+
+    Modules/proximity/DeviceProximityEvent.idl
+
     Modules/quota/DOMWindowQuota.idl
     Modules/quota/StorageInfo.idl
     Modules/quota/StorageInfoErrorCallback.idl
@@ -249,6 +268,7 @@ SET(WebCore_IDL_FILES
     Modules/webaudio/DynamicsCompressorNode.idl
     Modules/webaudio/JavaScriptAudioNode.idl
     Modules/webaudio/MediaElementAudioSourceNode.idl
+    Modules/webaudio/MediaStreamAudioSourceNode.idl
     Modules/webaudio/OfflineAudioCompletionEvent.idl
     Modules/webaudio/Oscillator.idl
     Modules/webaudio/RealtimeAnalyserNode.idl
@@ -814,6 +834,10 @@ SET(WebCore_SOURCES
     Modules/intents/IntentRequest.cpp
     Modules/intents/NavigatorIntents.cpp
 
+    Modules/mediasource/MediaSource.cpp
+    Modules/mediasource/SourceBuffer.cpp
+    Modules/mediasource/SourceBufferList.cpp
+
     Modules/mediastream/IceCandidate.cpp
     Modules/mediastream/LocalMediaStream.cpp
     Modules/mediastream/MediaStream.cpp
@@ -825,6 +849,7 @@ SET(WebCore_SOURCES
     Modules/mediastream/MediaStreamTrackList.cpp
     Modules/mediastream/NavigatorMediaStream.cpp
     Modules/mediastream/PeerConnection00.cpp
+    Modules/mediastream/RTCPeerConnection.cpp
     Modules/mediastream/SessionDescription.cpp
     Modules/mediastream/UserMediaController.cpp
     Modules/mediastream/UserMediaRequest.cpp
@@ -842,6 +867,8 @@ SET(WebCore_SOURCES
 
     Modules/protocolhandler/NavigatorRegisterProtocolHandler.cpp
 
+    Modules/proximity/DeviceProximityEvent.cpp
+
     Modules/quota/DOMWindowQuota.cpp
     Modules/quota/StorageInfo.cpp
 
@@ -879,6 +906,7 @@ SET(WebCore_SOURCES
     Modules/webaudio/DynamicsCompressorNode.cpp
     Modules/webaudio/JavaScriptAudioNode.cpp
     Modules/webaudio/MediaElementAudioSourceNode.cpp
+    Modules/webaudio/MediaStreamAudioSourceNode.cpp
     Modules/webaudio/OfflineAudioCompletionEvent.cpp
     Modules/webaudio/OfflineAudioDestinationNode.cpp
     Modules/webaudio/Oscillator.cpp
@@ -954,6 +982,7 @@ SET(WebCore_SOURCES
     bindings/ScriptControllerBase.cpp
 
     bindings/generic/ActiveDOMCallback.cpp
+    bindings/generic/BindingSecurity.cpp
     bindings/generic/RuntimeEnabledFeatures.cpp
 
     css/CSSAspectRatioValue.cpp
@@ -1036,6 +1065,7 @@ SET(WebCore_SOURCES
     css/WebKitCSSMatrix.cpp
     css/WebKitCSSRegionRule.cpp
     css/WebKitCSSSVGDocumentValue.cpp
+    css/WebKitCSSShaderValue.cpp
     css/WebKitCSSTransformValue.cpp
     css/WrapShapeFunctions.cpp
 
@@ -1101,10 +1131,12 @@ SET(WebCore_SOURCES
     dom/ExceptionBase.cpp
     dom/ExceptionCodePlaceholder.cpp
     dom/GenericEventQueue.cpp
+    dom/GestureEvent.cpp
     dom/IconURL.cpp
     dom/IdTargetObserver.cpp
     dom/IdTargetObserverRegistry.cpp
     dom/KeyboardEvent.cpp
+    dom/MemoryInstrumentation.cpp
     dom/MessageChannel.cpp
     dom/MessageEvent.cpp
     dom/MessagePortChannel.cpp
@@ -1486,7 +1518,6 @@ SET(WebCore_SOURCES
     inspector/ConsoleMessage.cpp
     inspector/ContentSearchUtils.cpp
     inspector/DOMEditor.cpp
-    inspector/DOMNodeHighlighter.cpp
     inspector/DOMPatchSupport.cpp
     inspector/IdentifiersFactory.cpp
     inspector/InjectedScript.cpp
@@ -1518,6 +1549,7 @@ SET(WebCore_SOURCES
     inspector/InspectorIndexedDBAgent.cpp
     inspector/InspectorInstrumentation.cpp
     inspector/InspectorMemoryAgent.cpp
+    inspector/InspectorOverlay.cpp
     inspector/InspectorProfilerAgent.cpp
     inspector/InspectorResourceAgent.cpp
     inspector/InspectorRuntimeAgent.cpp
@@ -1529,6 +1561,7 @@ SET(WebCore_SOURCES
     inspector/InspectorWebGLAgent.cpp
     inspector/InspectorWorkerAgent.cpp
     inspector/InstrumentingAgents.cpp
+    inspector/MemoryInstrumentationImpl.cpp
     inspector/NetworkResourcesData.cpp
     inspector/PageConsoleAgent.cpp
     inspector/PageDebuggerAgent.cpp
@@ -1572,6 +1605,7 @@ SET(WebCore_SOURCES
     loader/SinkDocument.cpp
     loader/SubframeLoader.cpp
     loader/SubresourceLoader.cpp
+    loader/SubstituteData.cpp
     loader/TextResourceDecoder.cpp
     loader/TextTrackLoader.cpp
     loader/ThreadableLoader.cpp
@@ -1601,6 +1635,7 @@ SET(WebCore_SOURCES
     loader/cache/CachedResourceHandle.cpp
     loader/cache/CachedResourceLoader.cpp
     loader/cache/CachedScript.cpp
+    loader/cache/CachedShader.cpp
     loader/cache/CachedSVGDocument.cpp
     loader/cache/CachedTextTrack.cpp
     loader/cache/CachedXSLStyleSheet.cpp
@@ -1817,10 +1852,12 @@ SET(WebCore_SOURCES
     platform/graphics/TiledBackingStore.cpp
     platform/graphics/WidthIterator.cpp
 
+    platform/graphics/filters/CustomFilterCompiledProgram.cpp
     platform/graphics/filters/CustomFilterGlobalContext.cpp
     platform/graphics/filters/CustomFilterMesh.cpp
+    platform/graphics/filters/CustomFilterOperation.cpp
     platform/graphics/filters/CustomFilterProgram.cpp
-    platform/graphics/filters/CustomFilterCompiledProgram.cpp
+    platform/graphics/filters/CustomFilterProgramInfo.cpp
     platform/graphics/filters/DistantLightSource.cpp
     platform/graphics/filters/FEBlend.cpp
     platform/graphics/filters/FEColorMatrix.cpp
@@ -1845,16 +1882,15 @@ SET(WebCore_SOURCES
     platform/graphics/filters/FilterOperations.cpp
     platform/graphics/filters/LightSource.cpp
     platform/graphics/filters/PointLightSource.cpp
-    platform/graphics/filters/SpotLightSource.cpp
     platform/graphics/filters/SourceAlpha.cpp
     platform/graphics/filters/SourceGraphic.cpp
+    platform/graphics/filters/SpotLightSource.cpp
 
     platform/graphics/filters/arm/NEONHelpers.h
     platform/graphics/filters/arm/FEBlendNEON.h
     platform/graphics/filters/arm/FECompositeArithmeticNEON.h
     platform/graphics/filters/arm/FEGaussianBlurNEON.h
     platform/graphics/filters/arm/FELightingNEON.cpp
-    platform/graphics/filters/arm/FELightingNEON.h
 
     platform/graphics/texmap/TextureMapper.cpp
     platform/graphics/texmap/TextureMapperBackingStore.cpp
@@ -1882,6 +1918,7 @@ SET(WebCore_SOURCES
     platform/mediastream/MediaHints.cpp
     platform/mediastream/MediaStreamCenter.cpp
     platform/mediastream/PeerConnection00Handler.cpp
+    platform/mediastream/RTCPeerConnectionHandler.cpp
     platform/mediastream/SessionDescriptionDescriptor.cpp
 
     platform/mock/DeviceMotionClientMock.cpp
@@ -2648,20 +2685,6 @@ SET(WebCoreTestSupport_SOURCES
     testing/InternalSettings.cpp
 )
 
-IF (ENABLE_MEDIA_SOURCE)
-    LIST(APPEND WebCore_INCLUDE_DIRECTORIES
-        ${WEBCORE_DIR}/Modules/mediasource
-    )
-    LIST(APPEND WebCore_IDL_FILES
-        Modules/mediasource/SourceBuffer.idl
-        Modules/mediasource/SourceBufferList.idl
-    )
-    LIST(APPEND WebCore_SOURCES
-        Modules/mediasource/SourceBuffer.cpp
-        Modules/mediasource/SourceBufferList.cpp
-    )
-ENDIF()
-
 # Modules that the bindings generator scripts may use
 SET(SCRIPTS_RESOLVE_SUPPLEMENTAL
     ${WEBCORE_DIR}/bindings/scripts/IDLParser.pm
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 883cb25e9..092930390 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,17527 @@
+2012-08-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do the DecimalNumber to String conversion on 8 bits
+        https://bugs.webkit.org/show_bug.cgi?id=93683
+
+        Reviewed by Andreas Kling.
+
+        Numbers converted to string for CSS are unlikely to ever be concatenated with a 16bits string.
+        This patch change the conversion to be done to 8bits string in order to reduce memory allocations.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::formatNumber):
+        * inspector/InspectorValues.cpp:
+        (WebCore::InspectorBasicValue::writeJSON):
+        * platform/graphics/Color.cpp:
+        (WebCore::Color::serialized): Instead of allocating a static WTF::String, we can simply append the
+        string literal to the output vector.
+
+2012-08-11  Benjamin Poulain  <benjamin@webkit.org>
+
+        WebCore::findAtomicString(PropertyName) always convert the name to 16bits
+        https://bugs.webkit.org/show_bug.cgi?id=93685
+
+        Reviewed by Geoffrey Garen.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::findAtomicString):
+        Use the new AtomicString::find() to avoid calling StringImpl::characters().
+
+2012-08-11  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] Remove QtSenderStack now we do not support __qt_sender__ anymore in Qt bridge
+        https://bugs.webkit.org/show_bug.cgi?id=93767
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Dead code after patch of bug 93649.
+
+        * bridge/qt/qt_instance.h:
+        (QtInstance):
+
+2012-08-11  Abhishek Arya  <inferno@chromium.org>
+
+        Unreviewed. 
+
+        Removing newly added assert in r125351 since it is exposing
+        legitimate layout bugs in few tests. We will re-add the assert
+        after fixing those bugs. Failures are tracked in webkit bug 93766. 
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeFromTrackedRendererMaps):
+
+2012-08-11  Levi Weintraub  <leviw@chromium.org>
+
+        Track block's positioned objects like percent-height descendants
+        https://bugs.webkit.org/show_bug.cgi?id=89848
+
+        Reviewed by Abhishek Arya.
+
+        The previous method for tracking a RenderBlock's out-of-flow positioned descendants was error prone,
+        subject to becoming inconsistent, and in the case of removePositionedObjects, inefficient. This patch 
+        extracts the algorithm used for percent height descendants and re-uses it for positioned objects. This same
+        method could further be re-used for floats.
+
+        This change removes the m_positionedObjects pointer, which brings RenderBlock's size down (yay!).
+
+        Test: fast/block/positioning/relayout-nested-positioned-elements-crash-2.html
+
+        * rendering/RenderBlock.cpp:
+        (SameSizeAsRenderBlock):
+        (WebCore):
+        (WebCore::removeBlockFromDescendantAndContainerMaps):
+        (WebCore::RenderBlock::~RenderBlock):
+        (WebCore::RenderBlock::addOverflowFromPositionedObjects):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutPositionedObjects):
+        (WebCore::RenderBlock::markPositionedObjectsForLayout):
+        (WebCore::clipOutPositionedObjects):
+        (WebCore::RenderBlock::selectionGaps):
+        (WebCore::RenderBlock::insertIntoTrackedRendererMaps):
+        (WebCore::RenderBlock::removeFromTrackedRendererMaps):
+        (WebCore::RenderBlock::positionedObjects):
+        (WebCore::RenderBlock::insertPositionedObject):
+        (WebCore::RenderBlock::removePositionedObject):
+        (WebCore::RenderBlock::removePositionedObjects):
+        (WebCore::RenderBlock::addPercentHeightDescendant):
+        (WebCore::RenderBlock::removePercentHeightDescendant):
+        (WebCore::RenderBlock::percentHeightDescendants):
+        (WebCore::RenderBlock::checkPositionedObjectsNeedLayout):
+        * rendering/RenderBlock.h:
+        (WebCore):
+        (RenderBlock):
+        (WebCore::RenderBlock::hasPositionedObjects):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::moveChildTo): Changing the fixme to reflect the assumption that the caller
+        has taken care of updating the positioned renderer maps is a decision not a bug. The ASSERT should help
+        assure this.
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setFixedPositionedObjectsNeedLayout):
+
+2012-08-10  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [WebGL] Add support for EXT_robustness
+        https://bugs.webkit.org/show_bug.cgi?id=93379
+
+        Reviewed by George Staikos.
+
+        Take advantage of EXT robustness in WebKit.
+
+        This commit makes WebKit use readnPixelsEXT, getnUniformfvEXT and
+        getnUniformivEXT instead of readPixels, getUniformfv and getUniformiv
+        when possible, and sets up the reset notification behaviour for
+        GLES platforms.
+
+        The reset behaviour has not yet been implemented in the BlackBerry
+        compositing thread, so for now on BlackBerry we just abort when
+        the context has been reset. This prevents undefined behaviour, but
+        can be improved in the future.
+
+        No new tests are needed because no new functionality is introduced.
+        Support for ARB robustness reset notification behaviour is already
+        in WebKit, and EXT robustness' reset notifcation behaviour is the
+        same. readnPixelsEXT replaces WebKit's existing mechanisms of
+        preventing buffer overflows.
+
+        RIM PR# 147510
+        Internally reviewed by Arvid Nilsson.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::setupFlags):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::readPixels):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebGLRenderingContext):
+        * platform/chromium/support/Extensions3DChromium.cpp:
+        (WebCore::Extensions3DChromium::readnPixelsEXT):
+        (WebCore):
+        (WebCore::Extensions3DChromium::getnUniformfvEXT):
+        (WebCore::Extensions3DChromium::getnUniformivEXT):
+        * platform/graphics/Extensions3D.h:
+        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
+        (WebCore::GraphicsContext3D::setContextLostCallback):
+        * platform/graphics/blackberry/LayerRenderer.cpp:
+        (WebCore::LayerRenderer::LayerRenderer):
+        (WebCore::LayerRenderer::makeContextCurrent):
+        * platform/graphics/blackberry/LayerRenderer.h:
+        (LayerRenderer):
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
+        (WebCore::Extensions3DOpenGLCommon::readnPixelsEXT):
+        (WebCore):
+        (WebCore::Extensions3DOpenGLCommon::getnUniformfvEXT):
+        (WebCore::Extensions3DOpenGLCommon::getnUniformivEXT):
+        * platform/graphics/opengl/Extensions3DOpenGLCommon.h:
+        (Extensions3DOpenGLCommon):
+        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
+        (WebCore::Extensions3DOpenGLES::Extensions3DOpenGLES):
+        (WebCore::Extensions3DOpenGLES::getGraphicsResetStatusARB):
+        (WebCore):
+        (WebCore::Extensions3DOpenGLES::setEXTContextLostCallback):
+        (WebCore::Extensions3DOpenGLES::readnPixelsEXT):
+        (WebCore::Extensions3DOpenGLES::getnUniformfvEXT):
+        (WebCore::Extensions3DOpenGLES::getnUniformivEXT):
+        (WebCore::Extensions3DOpenGLES::supportsExtension):
+        * platform/graphics/opengl/Extensions3DOpenGLES.h:
+        (Extensions3DOpenGLES):
+
+2012-08-10  Arko Saha  <arko@motorola.com>
+
+        Microdata: item with itemprop attribute should not include the item itself in the HTMLPropertiesCollection.
+        https://bugs.webkit.org/show_bug.cgi?id=93717
+
+        Reviewed by Ryosuke Niwa.
+
+        Tests: fast/dom/MicroData/item-with-itemprop-attr.html
+               fast/dom/MicroData/item-with-itemref-pointing-to-itself.html
+
+        * dom/PropertyNodeList.cpp:
+        (WebCore::PropertyNodeList::nodeMatches): Do not process the testElement if it is the owner node.
+        * html/HTMLPropertiesCollection.cpp:
+        (WebCore::nextNodeWithProperty): Traverse the next node only if previous node is microdata item
+        i.e, ownerNode or previous element does not have itemscope attribute specified.
+        (WebCore::HTMLPropertiesCollection::virtualItemAfter): Try to find the next property if current
+        is ownerNode.
+
+2012-08-10  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [BlackBerry][EFL][GTK][WIN][WX] Remove ScriptControllerXXX.cpp to reduce duplication
+        https://bugs.webkit.org/show_bug.cgi?id=61424
+
+        Reviewed by Rob Buis.
+
+        ScriptControllerBlackBerry, ScriptControllerEfl, ScriptControllerGtk,
+        ScriptControllerWin and ScriptControllerWx are almost same.
+        In order to reduce duplication, this patch moves codes to ScriptController
+        and removes them.
+
+        No behavior change. Just a refactoring.
+
+        * GNUmakefile.list.am:
+        * PlatformBlackBerry.cmake:
+        * PlatformEfl.cmake:
+        * PlatformWinCE.cmake:
+        * WebCore.gypi:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore):
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        Moved from ScriptControllerXXX.cpp
+        * bindings/js/ScriptControllerBlackBerry.cpp: Removed.
+        * bindings/js/ScriptControllerEfl.cpp: Removed.
+        * bindings/js/ScriptControllerGtk.cpp: Removed.
+        * bindings/js/ScriptControllerWin.cpp: Removed.
+        * bindings/js/ScriptControllerWx.cpp: Removed.
+
+2012-08-10  Elliott Sprehn  <esprehn@gmail.com>
+
+        RenderQuote corrupts doubly linked list on insertion before head of list
+        https://bugs.webkit.org/show_bug.cgi?id=93750
+
+        Reviewed by Abhishek Arya.
+
+        Fix bug where moving a RenderQuote instance before the first one in
+        the document would not update the m_previous pointer of the original
+        first RenderQuote to point back at the new one.
+
+        Test: fast/css-generated-content/quote-crash-93750.html
+
+        * rendering/RenderQuote.cpp:
+        (WebCore::RenderQuote::attachQuote):
+
+2012-08-09  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove forwarding headers for compositor-related WebKit API and update includes
+        https://bugs.webkit.org/show_bug.cgi?id=93669
+
+        Reviewed by Adam Barth.
+
+        Updates all includes for compositor-related headers to refer consistently to the Platform API location.
+
+        * platform/chromium/support/WebCompositorImpl.h:
+
+2012-08-10  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed build fix.
+
+        r125337 added a call to WTF::currentTime() in MediaController.cpp, but that file didn't #include
+        <wtf/CurrentTime.h>. This file is indirectly picked up on the include paths for some ports, but not all.
+
+        * html/MediaController.cpp:
+
+2012-08-10  Jer Noble  <jer.noble@apple.com>
+
+        no timeupdate events emitted for media controller
+        https://bugs.webkit.org/show_bug.cgi?id=93745
+
+        Reviewed by Eric Carlson.
+
+        Generate timeupdate events while the current position is changing.
+
+        Test: media/media-controller-timeupdate.html
+
+        Enforce the spec requirement that the timeupdate event is fired no more often
+        than every 250ms.
+        * html/MediaController.cpp:
+        (MediaController::scheduleTimeupdateEvent):
+
+        Add a periodic firing timer to generate timeupdate events during playback.
+        * html/MediaController.cpp:
+        (MediaController::startTimeupdateTimer):
+        (MediaController::timeupdateTimerFired):
+
+        * html/MediaController.cpp:
+        (MediaController::MediaController): Initialize m_previousTimeupdateTime.
+        (MediaController::setCurrentTime): Call scheduleTimeUpdateEvent.
+        (MediaController::updatePlaybackState): Start and stop the timeupdate timer.
+        * html/MediaController.h:
+        
+2012-08-09  Jeffrey Pfau  <jpfau@apple.com>
+
+        Allow blocking of third-party localStorage and sessionStorage
+        https://bugs.webkit.org/show_bug.cgi?id=93390
+
+        Reviewed by Adam Barth.
+
+        Add checks for if a page is third-party and third-party storage blocking is enabled while accessing storage.
+
+        Tests: http/tests/security/cross-origin-local-storage-allowed.html
+               http/tests/security/cross-origin-local-storage.html
+               http/tests/security/cross-origin-session-storage-allowed.html
+               http/tests/security/cross-origin-session-storage.html
+               http/tests/security/same-origin-document-domain-storage-allowed.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext): Initialize securityOrigin with knowledge of if we should block third-party storage.
+        * page/DOMWindow.cpp: Check if the origin trying to access storage is third-party relative to the top document.
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        * page/SecurityOrigin.cpp: Add a call in Security origin to see if another origin counts as a third-party.
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canAccessLocalStorage):
+        (WebCore):
+        (WebCore::SecurityOrigin::isThirdParty):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::blockThirdPartyStorage):
+        (SecurityOrigin):
+        * testing/InternalSettings.cpp: Add an internals.settings hook for setting third-party storage blocking enabled.
+        (WebCore::InternalSettings::setThirdPartyStorageBlockingEnabled):
+        (WebCore):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-08-10  Arko Saha  <arko@motorola.com>
+
+        REGRESSION(r125159): ASSERTION FAILED: m_listsInvalidatedAtDocument.contains(list) in Document::unregisterNodeListCache.
+        https://bugs.webkit.org/show_bug.cgi?id=93729
+
+        Reviewed by Ryosuke Niwa.
+
+        In Document::registerNodeListCache() it was not adding PropertyNodeList
+        cache to m_listsInvalidatedAtDocument the as node list currently not rooted
+        at the document. Where in Document::unregisterNodeListCache() it was trying
+        to remove PropertyNodeList cache from m_listsInvalidatedAtDocument. Hence it
+        caused the assertion failure.
+
+        We need to check if m_rootType is NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr,
+        not that it's currently rooted at the document.
+
+        Test: fast/dom/MicroData/propertynodelist-crash.html
+
+        * dom/DynamicNodeList.h:
+        (WebCore::DynamicNodeListCacheBase::isRootedAtDocument):
+
+2012-08-10  Florin Malita  <fmalita@chromium.org>
+
+        Improved RuleData packing on some 32-bit platforms
+        https://bugs.webkit.org/show_bug.cgi?id=93737
+
+        Reviewed by Andreas Kling.
+
+        Certain 32-bit plarforms use an 8-byte alignment for uint64_t. We can save 4 bytes per
+        object on these platforms by using two naturally-aligning unsigned ints instead.
+
+        * css/StyleResolver.cpp:
+        (RuleData):
+        (SameSizeAsRuleData):
+
+2012-08-10  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Shaders] Add blend mode and composite op to compiled program cache key
+        https://bugs.webkit.org/show_bug.cgi?id=93623
+
+        Reviewed by Dirk Schulze.
+
+        Right now, only the vertex shader string and the fragment shader string are hashed
+        to create a key for the compiled program. However, in a future patch, WebKit will
+        rewrite the fragment shader based on the blend mode and composite op specified by
+        the author. This means that the unique key for a compiled program is (original
+        vertex shader string, original fragment shader string, blend mode, composite
+        operator). This patch adds blend mode and composite operator in the hash for the
+        key.
+
+        No new tests. The state of the compiled program cache is not exposed to a web
+        page. Existing tests should ensure this change doesn't break current
+        functionality. Additional tests will be added in a future patch that implements
+        shader rewriting based on blend mode and composite op.
+
+        * platform/graphics/filters/CustomFilterProgram.cpp:
+        (WebCore::CustomFilterProgram::programInfo):
+        * platform/graphics/filters/CustomFilterProgram.h:
+        (WebCore):
+        * platform/graphics/filters/CustomFilterProgramInfo.cpp:
+        (WebCore::CustomFilterProgramInfo::CustomFilterProgramInfo):
+        (WebCore::CustomFilterProgramInfo::hash):
+        (WebCore::CustomFilterProgramInfo::operator==):
+        * platform/graphics/filters/CustomFilterProgramInfo.h:
+        (WebCore::CustomFilterProgramMixSettings::CustomFilterProgramMixSettings):
+        (CustomFilterProgramMixSettings):
+        (WebCore::CustomFilterProgramMixSettings::operator==):
+        (WebCore):
+        (CustomFilterProgramInfo):
+
+2012-08-10  Alice Cheng  <alice_cheng@apple.com>
+
+        Part 1 of: Extend -webkit-user-select with a new value "all"
+        <rdar://problem/10161404>
+        https://bugs.webkit.org/show_bug.cgi?id=93562
+
+        Reviewed by Dan Bernstein.
+
+        Parse the new "all" value for -webkit-user-select
+
+        Test: editing/selection/user-select-all-parsing.html
+
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue): Add new value all
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Add new value all
+        (WebCore::CSSPrimitiveValue::operator EUserSelect): Add one more bit to store the new property value
+        * rendering/style/RenderStyleConstants.h: Add new value all
+        * rendering/style/StyleRareInheritedData.h: Add new value all
+        (StyleRareInheritedData):
+
+2012-08-10  Iain Merrick  <husky@google.com>
+
+        [chromium] Upstream Android changes to WebFrameImpl::selectRange
+        https://bugs.webkit.org/show_bug.cgi?id=92513
+
+        Reviewed by Ryosuke Niwa.
+
+        Make this function public we so can call it from the WebKit layer.
+
+        * page/EventHandler.h:
+        (EventHandler):
+
+2012-08-10  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Broken implementation of AtkText and AtkEditableText for password fields
+        https://bugs.webkit.org/show_bug.cgi?id=93621
+
+        Rubber-stamped by Ryosuke Niwa.
+
+        Fix Apple Win build, by avoiding to generate unreachable sections
+        of code in AccessibilityRenderObject::passwordFieldValue().
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::passwordFieldValue):
+
+2012-08-10  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Remove targetSurface pointer from CCRenderPass
+        https://bugs.webkit.org/show_bug.cgi?id=93734
+
+        Reviewed by Adrienne Walker.
+
+        This removes the CCRenderSurface pointer from the CCRenderPass
+        structure, allowing it to be serialized and used across processes
+        freely.
+
+        No new tests; no intended change in behaviour.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::CCRenderPass):
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (CCRenderPass):
+
+2012-08-10  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Broken implementation of AtkText and AtkEditableText for password fields
+        https://bugs.webkit.org/show_bug.cgi?id=93621
+
+        Reviewed by Chris Fleizach.
+
+        Fix broken implementation of AtkText and AtkEditableText
+        interfaces in the GTK port for password input fields.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue): Call the new
+        function passwordFieldValue() for password input fields.
+        (WebCore::AccessibilityRenderObject::text): Ditto.
+        (WebCore::AccessibilityRenderObject::textLength): Return the
+        actual length of the password in the field for GTK, return -1
+        otherwise (not to break current behavior in other platforms).
+        (WebCore::AccessibilityRenderObject::doAXStringForRange): Don't
+        early return for password fields in GTK (will rely on text()).
+        (WebCore::AccessibilityRenderObject::passwordFieldValue): New, it
+        returns the text being actually rendered for a password input
+        field (normally a masked string) in GTK. It returns String() in
+        the rest of platforms, to ensure we don't break anything there.
+        (WebCore):
+        * accessibility/AccessibilityRenderObject.h:
+        (AccessibilityRenderObject):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::passwordFieldValue): Default
+        implementation of this new method, returning an empty string.
+        (AccessibilityObject):
+
+        Ensure the 'text-insert' and 'text-remove' signals for the AtkText
+        interface are properly emitted for password input fields.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::nodeTextChangePlatformNotification): Make
+        sure we never emit the password value for an input field in plain
+        text when inserting or removing text. Emit the masked text instead.
+
+2012-08-09  Jer Noble  <jer.noble@apple.com>
+
+        Use the new AVPlayerItemVideoOutput API in MediaPlayerPrivateAVFoundation.
+        https://bugs.webkit.org/show_bug.cgi?id=93591
+
+        Reviewed by Eric Carlson.
+
+        Support the new AVPlayerItemVideoOutput API from Mountain Lion, which has much increased performance over
+        AVAssetImageGenerator.
+
+        No new tests; Performance change only, no net change in functionality.
+
+        AVPlayerItemVideoOutput requires an attached CALayer for rendering to occur.  Make the rendering modes non-exclusive, 
+        so layer-rendering and context-rendering can exist simultaneously:
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h: Make the MediaRenderingMode enum
+            a bitfield.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::currentRenderingModes): Renamed from currentRenderingMode().
+        (WebCore::MediaPlayerPrivateAVFoundation::setUpVideoRendering): Check for the presence of the MediaRenderingToLayer bit.
+        (WebCore::MediaPlayerPrivateAVFoundation::prepareForRendering): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundation::updateStates): Ditto.
+
+        Pull out existing the AVAssetImageGenerator into its own functions:
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createImageGenerator):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyImageGenerator):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithImageGenerator):
+
+        Add new AVPlayerItemVideoOutput equivalent functions:
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoOutput):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoOutput):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithVideoOutput):
+
+        Switch between the AVAssetImageGenerator and AVPlayerItemVideoOutput functions from
+        within the original functions:
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::hasContextRenderer):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::paint):
+
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createImageForTimeInRect): Call the 
+            AVAssetImageGenerator creation function directly.
+
+2012-08-10  Abhishek Arya  <inferno@chromium.org>
+
+        Crash on accessing a removed layout root in FrameView::scheduleRelayout.
+        https://bugs.webkit.org/show_bug.cgi?id=91368
+
+        Reviewed by Levi Weintraub.
+
+        We were calling setNeedsLayoutAndPrefWidthsRecalc() in RenderBlock::collapseAnonymousBoxChild
+        even when documentBeingDestroyed() was true. This ends up accessing stale layout root and bypasses
+        mitigation added in r109406. There is no need to waste time merging up anonymous blocks in
+        RenderBlock::removeChild when documentBeingDestroyed() is true.
+
+        No new tests. The test is time sensitive, requires a bunch of reloads, and only reproduces on chromium linux.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseAnonymousBoxChild):
+        (WebCore::RenderBlock::removeChild):
+
+2012-08-10  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11855229> When in paginated mode, the layout timer fires continually
+        https://bugs.webkit.org/show_bug.cgi?id=91038
+
+        Reviewed by Simon Fraser.
+
+        * page/Page.cpp:
+        (WebCore::Page::pageCount): Changed to only trigger layout if needed.
+
+2012-08-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [CMAKE] Fix wrong idl include path in CMakeList.txt
+        https://bugs.webkit.org/show_bug.cgi?id=93715
+
+        Reviewed by Rob Buis.
+
+        No new tests. No change in behavior.
+
+        * CMakeLists.txt: Fix notifications path.
+
+2012-08-10  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Transforms] Hit test issue with large scale() transform
+        https://bugs.webkit.org/show_bug.cgi?id=23170
+
+        Reviewed by Simon Fraser.
+
+        By using normal rounding to determine the top-left corner of the
+        hit-tested rectangle, we end up offsetting the hit test by up to
+        half a pixel, once scaled to x60, this creates a 30px error.
+
+        Normal rounding is replaced with floored rounding which means the
+        hit-tested pixel will now always be the pixel containing the
+        point.
+
+        Test: fast/transforms/hit-test-large-scale.html
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestPoint::HitTestPoint):
+        (WebCore::HitTestPoint::intersectsRect):
+        (WebCore::HitTestPoint::rectForPoint):
+
+2012-08-10  Florin Malita  <fmalita@chromium.org>
+
+        Unreviewed gardening: build fix for 32bit platforms after 125294.
+
+        * css/StyleResolver.cpp:
+        (RuleData):
+
+2012-08-10  Takashi Sakamoto  <tasak@google.com>
+
+        box-shadow creates incorrect shadow when border-radius is too large
+        https://bugs.webkit.org/show_bug.cgi?id=72103
+
+        Reviewed by Simon Fraser.
+
+        Added a code for adjusting a rounded rect before paintBoxShadow in
+        a similar way to getRoundedRectFor.
+
+        Test: fast/borders/border-shadow-large-radius.html
+
+        * platform/graphics/RoundedRect.cpp:
+        (WebCore::RoundedRect::adjustRadii):
+        Added a new method to set radii's scale to fit into rect.
+        * platform/graphics/RoundedRect.h:
+        (RoundedRect):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        A rounded rect for box-shadow is not checked whether the raii matches
+        the rect or not. Added the code to adjust radii's scale if the rounded
+        rect is not renderable, the case: RoundedRect::isRenderable is false.
+
+2012-08-10  Ojan Vafai  <ojan@chromium.org>
+
+        Wrap INLINE_FLEX in a #if ENABLE(CSS3_FLEXBOX).
+        Unreviewed build fix.
+
+        * rendering/style/RenderStyle.h:
+
+2012-08-10  Dan Bernstein  <mitz@apple.com>
+
+        Renamed the “Modules/webaudio” group in the Xcode project to “webaudio” and moved it into
+        the Modules group.
+
+        Rubber-stamped by Simon Fraser.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-08-10  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Enable es5_readonly
+        https://bugs.webkit.org/show_bug.cgi?id=91031
+
+        Reviewed by Adam Barth.
+
+        This turns on the es5_readonly flag for V8. This makes V8 match the ES5 spec regarding
+        non writable properties on the prototype chain. JSC already behaves the right so this
+        just makes V8 behave the same.
+
+        Updated test expectations.
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initIsolate):
+
+2012-08-10  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Introduce V8DOMConfiguration class and make batchConfigureXXX() methods static
+        https://bugs.webkit.org/show_bug.cgi?id=93615
+
+        Reviewed by Adam Barth.
+
+        Per the discussion in bug 93239,
+
+        (1) Rename V8ConfigureDOMAttributesAndMethods to V8DOMConfiguration.
+        (2) Introduce V8DOMConfiguration class and make batchConfigureXXX() methods static.
+
+        No tests. No change in behavior.
+
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore):
+        (WebCore::ConfigureV8Float64ArrayTemplate):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore):
+        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore):
+        (WebCore::ConfigureV8TestCustomNamedGetterTemplate):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore):
+        (WebCore::ConfigureV8TestEventConstructorTemplate):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore):
+        (WebCore::ConfigureV8TestEventTargetTemplate):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore):
+        (WebCore::ConfigureV8TestExceptionTemplate):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore):
+        (WebCore::ConfigureV8TestInterfaceTemplate):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore):
+        (WebCore::ConfigureV8TestMediaQueryListListenerTemplate):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::ConfigureV8TestNamedConstructorTemplate):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::ConfigureV8TestNodeTemplate):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+        (WebCore::ConfigureV8TestObjTemplate):
+        (WebCore::V8TestObj::installPerContextProperties):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore):
+        (WebCore::ConfigureV8TestSerializedScriptValueInterfaceTemplate):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8ConfigureDOMAttributesAndMethods.h: Removed.
+        * bindings/v8/V8DOMConfiguration.cpp: Renamed from Source/WebCore/bindings/v8/V8ConfigureDOMAttributesAndMethods.cpp.
+        (WebCore):
+        (WebCore::V8DOMConfiguration::batchConfigureAttributes):
+        (WebCore::V8DOMConfiguration::batchConfigureConstants):
+        (WebCore::V8DOMConfiguration::batchConfigureCallbacks):
+        (WebCore::V8DOMConfiguration::configureTemplate):
+        * bindings/v8/V8DOMConfiguration.h: Added.
+        (WebCore):
+        (V8DOMConfiguration):
+        (BatchedAttribute):
+        (WebCore::V8DOMConfiguration::configureAttribute):
+        (BatchedConstant):
+        (BatchedCallback):
+
+2012-08-10  Andreas Kling  <kling@webkit.org>
+
+        CSS: Shrink RuleData by storing selector as index rather than pointer.
+        <http://webkit.org/b/93712>
+
+        Reviewed by Antti Koivisto.
+
+        Pack the selector's index in the rule in the RuleData bitfield, effectively
+        shrinking each RuleData by 8 bytes.
+
+        * css/CSSSelectorList.h:
+        (WebCore::CSSSelectorList::selectorAt):
+        (WebCore::CSSSelectorList::indexOfNextSelectorAfter):
+
+            Add helpers to CSSSelectorList to iterate by index.
+
+        * css/StyleResolver.cpp:
+        (RuleData):
+        (WebCore::RuleData::selector):
+        (WebCore::RuleData::selectorIndex):
+        (SameSizeAsRuleData):
+        (RuleSet):
+        (WebCore::makeRuleSet):
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/StyleResolver.h:
+        (WebCore::StyleResolver::RuleFeature::RuleFeature):
+        (RuleFeature):
+
+            Store selector indices instead of CSSSelector* pointers.
+
+2012-08-10  Vineet Chaudhary  <rgf748@motorola.com>
+
+        Remove custom bindings from WaveShaperNode.
+        https://bugs.webkit.org/show_bug.cgi?id=93613
+
+        Reviewed by Kentaro Hara.
+
+        We should remove custom bindings as CodeGenerator uses UNUSED_PARAM macro.
+
+        TestObj.idl
+        No behavioural changes.
+        All tests under webaudio/* should behave same.
+
+        * GNUmakefile.list.am: Removed JSWaveShaperNodeCustom.cpp from builds.
+        * Modules/webaudio/WaveShaperNode.idl: Removed [JSCustomSetter].
+        * UseJSC.cmake: Removed JSWaveShaperNodeCustom.cpp from builds.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSWaveShaperNodeCustom.cpp: Removed.
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (SkipAttribute): Skip TypedArray attribute.
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (SkipAttribute): Skip TypedArray attribute.
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (SkipAttribute): Skip TypedArray attribute.
+        * bindings/scripts/test/JS/JSTestObj.cpp: Bindings tests.
+        (WebCore::jsTestObjTypedArrayAttr):
+        (WebCore::setJSTestObjReflectedCustomURLAttr):
+        (WebCore::setJSTestObjTypedArrayAttr):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        * bindings/scripts/test/TestObj.idl: Test.
+        * bindings/scripts/test/V8/V8TestObj.cpp: Bindings tests.
+        (WebCore::TestObjV8Internal::typedArrayAttrAttrGetter):
+        (TestObjV8Internal):
+        (WebCore::TestObjV8Internal::typedArrayAttrAttrSetter):
+
+2012-08-10  Huang Dongsung  <luxtella@company100.net>
+
+        REGRESSION (r123848): Heap-use-after-free in WebCore::CachedResource::didAddClient.
+        https://bugs.webkit.org/show_bug.cgi?id=93632
+        -and corresponding-
+        <http://crbug.com/140656>
+
+        Reviewed by Antti Koivisto.
+
+        CachedCSSStyleSheet::didAddClient() calls CachedStyleSheetClient::setCSSStyleSheet
+        and HTMLLnkElement can be CachedStyleSheetClient.
+        HTMLLinkElement::setCSSStyleSheet may cause scripts to be executed, which could
+        destroy the HTMLLinkElement instance. After calliing
+        CachedStyleSheetClient::setCSSStyleSheet, using the CachedStyleSheetClient
+        instance can cause Heap-use-after-free.
+
+        r115625 prevents HTMLLinkElement from being destroyed during
+        HTMLLinkElement::setCSSStyleSheet, but r115625 doesn't prevent HTMLLinkElement
+        from being destroyed after HTMLLinkElement::setCSSStyleSheet.
+
+        So this patch calls CachedResource::didAddClient() before calling
+        setCSSStyleSheet() to make sure its client is not destroyed.
+
+        No new tests. it's covered by fast/css/cached-sheet-restore-crash.html.
+
+        * loader/cache/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::didAddClient):
+
+2012-08-10  Kevin Ellis  <kevers@chromium.org>
+
+        Horizontal scrollbar appears in the month-year selector of input[type=date]
+        https://bugs.webkit.org/show_bug.cgi?id=93517
+
+        Reviewed by Kent Tamura.
+
+        Update size of the month-year selector popup to account for the
+        width of the vertical scrollbar being platform dependent.
+
+        * Resources/calendarPicker.css:
+        (.month-selector-popup): Suppress horizontal scrolling.
+        * Resources/calendarPicker.js:
+        (YearMonthController.prototype.attachTo): Add a sizer element to facilitate determining the scrollbar width.
+        (YearMonthController.prototype._showPopup): Use computed scrollbar width for popup resizing.
+
+2012-08-10  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Unreviewed, fix frontend compilability after r125268.
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.NamedFlow):
+        (WebInspector.NamedFlow.parsePayloadArray):
+
+2012-08-10  Martin Leutelt  <martin.leutelt@basyskom.com>
+
+        [Qt] Dotted borders not drawn with rounded dots
+        https://bugs.webkit.org/show_bug.cgi?id=92383
+
+        Reviewed by Noam Rosenthal.
+
+        The dots in borders with dotted style were previously drawn with
+        rectangular dots. The CSS spec specifies that the dots should be
+        rounded dots. This patch fixes this behavior for the Qt port.
+
+        No new tests, existing ones have been updated with new expected
+        results.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::adjustPointsForDottedLine):
+        (WebCore):
+        (WebCore::drawLineEndpointsForStyle):
+        (WebCore::GraphicsContext::drawLine):
+
+2012-08-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: render arrays as dir in case they were logged into console prior to the front-end opening.
+        https://bugs.webkit.org/show_bug.cgi?id=93713
+
+        Reviewed by Vsevolod Vlasov.
+
+        Dumping potentially outdated arrays using the "dir" representation.
+
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArray):
+        (WebInspector.ConsoleMessageImpl.prototype.clone):
+        * inspector/front-end/ConsoleModel.js:
+        (WebInspector.ConsoleModel.prototype.enableAgent.callback):
+        (WebInspector.ConsoleModel.prototype.enablingConsole):
+        (WebInspector.ConsoleMessage.create):
+        (WebInspector.ConsoleDispatcher.prototype.messageAdded):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.create):
+
+2012-08-10  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Fix the colors in the debugging HUD
+        https://bugs.webkit.org/show_bug.cgi?id=93656
+
+        Reviewed by Adrienne Walker.
+
+        The R and B channels became swapped in our compositor debug HUD when
+        wkb.ug/92182 happened. This corrects the problem by swizzling the
+        color channels when we draw to the SkCanvas, so that it matches the
+        expectations of the shader.
+
+        Chromium bug: crbug.com/139908
+
+        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
+        (WebCore::CCFontAtlas::drawText):
+        (WebCore::CCFontAtlas::drawOneLineOfTextInternal):
+        * platform/graphics/chromium/cc/CCFontAtlas.h:
+        (CCFontAtlas):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
+        (WebCore::createPaint):
+        (WebCore):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawHudContents):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounter):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounterText):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawDebugRects):
+
+2012-08-10  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Remove scissor from the namings in CCOcclusionTracker
+        https://bugs.webkit.org/show_bug.cgi?id=93630
+
+        Reviewed by Adrienne Walker.
+
+        As a followup to wkb.ug/91800 which stops using partial-swap scissor
+        in the occlusion tracker, this does a large rename to the occlusion
+        tracker and affected tests to remove "scissor" from the names of its
+        variables and methods, instead reflecting their new behaviour.
+
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::CCOcclusionTrackerBase):
+        (WebCore::addOcclusionBehindLayer):
+        (WebCore::::markOccludedBehindLayer):
+        (WebCore::testContentRectOccluded):
+        (WebCore::::occluded):
+        (WebCore::computeUnoccludedContentRect):
+        (WebCore::::unoccludedContentRect):
+        (WebCore::::unoccludedContributingSurfaceContentRect):
+        (WebCore::::layerClipRectInTarget):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
+        (CCOcclusionTrackerBase):
+        (WebCore::CCOcclusionTrackerBase::computeVisibleRegionInScreen):
+
+2012-08-10  Jon Lee  <jonlee@apple.com>
+
+        Change Notification.permissionLevel() to Notification.permission
+        https://bugs.webkit.org/show_bug.cgi?id=88919
+        <rdar://problem/11650319>
+
+        Reviewed by Kentaro Hara.
+
+        Retrieving the permission level has changed to Notification.permission, per this discussion:
+        http://lists.w3.org/Archives/Public/public-web-notification/2012Jun/0000.html
+
+        Test: fast/notifications/notifications-permission.html
+
+        * Modules/notifications/Notification.cpp: Rename to match attribute name.
+        (WebCore::Notification::permission):
+        * Modules/notifications/Notification.h: Rename to match attribute name.
+        (Notification):
+        * Modules/notifications/Notification.idl: Change to static readonly attribute.
+
+2012-08-10  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove collectIsolatedContexts() from V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=93682
+
+        Reviewed by Adam Barth.
+
+        We want to remove V8Proxy. This patch removes V8Proxy::collectIsolatedContexts().
+
+        No tests. No change in behavior.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::collectIsolatedContexts):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::collectIsolatedContexts):
+
+2012-08-10  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Unreviewed trivial build fix: Avoid passing a non-existance WebCore/websockets directory
+        to the generators, which produces unnecessary warnings. The module lives now in WebCore/Modules/websockets.
+
+        * DerivedSources.pri:
+
+2012-08-10  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: add frame ids to TimeStamp, Time and TimeEnd records in Timeline
+        https://bugs.webkit.org/show_bug.cgi?id=93699
+
+        Reviewed by Pavel Feldman.
+
+        - plumb Frame from Console to TimelineAgent and use it to add frameId to 3 timeline records;
+
+        * inspector/InspectorConsoleInstrumentation.h:
+        (WebCore::InspectorInstrumentation::startConsoleTiming):
+        (WebCore::InspectorInstrumentation::stopConsoleTiming):
+        (WebCore::InspectorInstrumentation::consoleTimeStamp):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::startConsoleTimingImpl):
+        (WebCore::InspectorInstrumentation::stopConsoleTimingImpl):
+        (WebCore::InspectorInstrumentation::consoleTimeStampImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didTimeStamp):
+        (WebCore::InspectorTimelineAgent::time):
+        (WebCore::InspectorTimelineAgent::timeEnd):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * page/Console.cpp:
+        (WebCore::Console::markTimeline):
+        (WebCore::Console::time):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::timeStamp):
+
+2012-08-10  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix failing assertions when using JSC C API in QObject bridge
+        https://bugs.webkit.org/show_bug.cgi?id=93720
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Avoid calling JSValueProtect and JSValueIsEqual with null JSValueRefs, as in debug
+        builds they trigger failing assertions about the arguments being non-null.
+
+        In these signal & slot connections the receiver can be null, when the signal is connected
+        just to a function, for example using obj.mySignal.connect(function() { .... }).
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtConnectionObject::QtConnectionObject):
+        (JSC::Bindings::QtConnectionObject::~QtConnectionObject):
+        (JSC::Bindings::QtConnectionObject::match):
+
+2012-08-10  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove QRegExp <> JS RegExp conversion
+        https://bugs.webkit.org/show_bug.cgi?id=93716
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Removed automatic conversion between QRegExp and JS regular expressions. The semantics
+        between the expressions are totally different, which can cause data loss and unexpected
+        behaviour. QJSEngine/Value doesn't have this conversion anymore neither.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::operator<<):
+        (JSC::Bindings::valueRealType):
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+
+2012-08-10  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: console.timeStamp() marked are not shown in Timeline overview
+        https://bugs.webkit.org/show_bug.cgi?id=93697
+
+        Reviewed by Pavel Feldman.
+
+        - ignore frameId on TimeStamp records, consider it's always an event divider.
+
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.isEventDivider):
+
+2012-08-10  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSS Regions] region-overflow: break still renders the content that does not fit in the last region.
+        https://bugs.webkit.org/show_bug.cgi?id=92996
+
+        Reviewed by Julien Chaffraix.
+
+        Flow content that follows the last break in the last region, if any, should not be rendered
+        for the regions with region-overflow: break.
+        http://www.w3.org/TR/css3-regions/#the-region-overflow-property
+
+        Modified the expected result for existing test fast/regions/region-overflow-break.html
+        to reflect the correct behavior.
+
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::regionOversetRect):
+
+2012-08-10  Andrei Poenaru  <poenaru@adobe.com>
+
+        Web Inspector: Protocol Extension: Refactor protocol extension for CSS Regions
+        https://bugs.webkit.org/show_bug.cgi?id=92089
+
+        Reviewed by Pavel Feldman.
+
+        Replaced "WebKitNamedFlowCollection::namedFlowsNames" with "WebKitNamedFlowCollection::namedFlows" to return a Vector of "WebKitNamedFlow"s,
+        instead of a Vector of Strings.
+
+        Added the "Region" type to Inspector.json.
+        Changed the "NamedFlow" type and the "getNamedFlowCollection" function in Inspector.json.
+
+        Modified existing test: inspector/styles/protocol-css-regions-commands.html
+
+        * dom/WebKitNamedFlowCollection.cpp:
+        (WebCore::WebKitNamedFlowCollection::namedFlows):
+        * dom/WebKitNamedFlowCollection.h:
+        (WebKitNamedFlowCollection):
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getNamedFlowCollection):
+        (WebCore::InspectorCSSAgent::getFlowByName):
+        (WebCore::InspectorCSSAgent::buildArrayForRegions):
+        (WebCore):
+        (WebCore::InspectorCSSAgent::buildObjectForNamedFlow):
+        * inspector/InspectorCSSAgent.h:
+        (InspectorCSSAgent):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
+        (WebCore):
+        * inspector/InspectorDOMAgent.h:
+        (InspectorDOMAgent):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getNamedFlowCollectionAsync):
+        (WebInspector.NamedFlow):
+        (WebInspector.NamedFlow.parsePayloadArray):
+
+2012-08-10  Keishi Hattori  <keishi@webkit.org>
+
+        Resize calandar and color suggestion popups to show error message
+        https://bugs.webkit.org/show_bug.cgi?id=93695
+
+        Reviewed by Kent Tamura.
+
+        r125169 made PagePopupClient::contentSize() return zero size and so to
+        see the error message, we need to resize the page popup.
+
+        No new tests. Not user facing.
+
+        * Resources/calendarPicker.js:
+        (resizeWindow): Resizes popup window to given size.
+        (showMain): Initiates transition to show the main element.
+        (initialize):
+        (fixWindowSize):
+        * Resources/colorSuggestionPicker.js:
+        (resizeWindow):
+        (initialize):
+        (ColorPicker.prototype._layout):
+
+2012-08-10  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: further ResourceLoader memory instrumentation
+        https://bugs.webkit.org/show_bug.cgi?id=93692
+
+        Reviewed by Vsevolod Vlasov.
+
+        Added missing parts to ResourceLoader and its descendants memory instrumentation.
+        Added special logic for KURL and report the urls where we have them in instrumented classes.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/StyleSheetContents.cpp:
+        (WebCore::StyleSheetContents::reportMemoryUsage):
+        * dom/Document.cpp:
+        (WebCore::Document::reportMemoryUsage):
+        * dom/MemoryInstrumentation.cpp:
+        (WebCore::MemoryInstrumentation::addObject):
+        (WebCore):
+        * dom/MemoryInstrumentation.h:
+        (WebCore):
+        (MemoryInstrumentation):
+        (WebCore::MemoryClassInfo::addMember):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::reportMemoryUsage):
+        (WebCore):
+        * loader/MainResourceLoader.h:
+        (MainResourceLoader):
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::reportMemoryUsage):
+        (WebCore):
+        * loader/SubresourceLoader.h:
+        (SubresourceLoader):
+        * loader/SubstituteData.cpp: Copied from Source/WebCore/dom/MemoryInstrumentation.cpp.
+        (WebCore):
+        (WebCore::SubstituteData::reportMemoryUsage):
+        * loader/SubstituteData.h:
+        (WebCore):
+        (SubstituteData):
+
+2012-08-10  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Introduce shadow elements for multiple fields time input UI
+        https://bugs.webkit.org/show_bug.cgi?id=92960
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces shadow elements for multiple fields time input UI:
+            - DateTimeAMPMFieldElement - field UI for AM/PM
+            - DateTimeEditElement - container of multiple DateTimeFieldElement
+            - DateTimeFieldElement - base class of field UI
+            - DateTimeHourFieldElement - field UI for hour
+            - DateTimeMillisecondFieldElement - field UI for millisecond
+            - DateTimeMinuteFieldElement - field UI for minute
+            - DateTimeNumericFieldElement - base class of numeric field UI.
+            - DateTimeSecondFieldElement - field UI for second
+            - DateTimeSymbolicFieldElement - base class for symbolic field UI
+        inside of ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS build flag.
+
+        No new tests. This patch doesn't change behavior.
+
+        * WebCore.gypi: Changed to include html/shadow/DateTimeEditElement.cpp,
+        html/shadow/DateTimeEdditElement.h, html/shadow/DateTimeFieldElement.cpp,
+        html/shadow/DateTimeFieldElement.h, html/shadow/DateTimeFieldElements.cpp,
+        html/shadow/DateTimeFieldElements.h, html/shadow/DateTimeNumericFieldElement.cpp,
+        html/shadow/DateTimeNumericFieldElement.h, html/shadow/DateTimeSymbolicFieldElement.cpp,
+        and html/shadow/DateTimeSymbolicFieldElement.h.
+        * html/shadow/DateTimeEditElement.cpp: Added.
+        (DateTimeEditBuilder):
+        (WebCore::DateTimeEditBuilder::DateTimeEditBuilder):
+        (WebCore::DateTimeEditBuilder::build):
+        (WebCore::DateTimeEditBuilder::needMillisecondField):
+        (WebCore::DateTimeEditBuilder::needMinuteField):
+        (WebCore::DateTimeEditBuilder::needSecondField):
+        (WebCore::DateTimeEditBuilder::shouldMillisecondFieldReadOnly):
+        (WebCore::DateTimeEditBuilder::shouldMinuteFieldReadOnly):
+        (WebCore::DateTimeEditBuilder::shouldSecondFieldReadOnly):
+        (WebCore::DateTimeEditBuilder::visitField):
+        (WebCore::DateTimeEditBuilder::visitLiteral):
+        (WebCore::DateTimeEditElement::EditControlOwner::~EditControlOwner):
+        (WebCore::DateTimeEditElement::DateTimeEditElement):
+        (WebCore::DateTimeEditElement::~DateTimeEditElement):
+        (WebCore::DateTimeEditElement::addField):
+        (WebCore::DateTimeEditElement::create):
+        (WebCore::DateTimeEditElement::disabledStateChanged): Called when owner's disabled state is changed.
+        (WebCore::DateTimeEditElement::fieldAt):
+        (WebCore::DateTimeEditElement::focusFieldAt):
+        (WebCore::DateTimeEditElement::handleKeyboardEvent):
+        (WebCore::DateTimeEditElement::fieldValueChanged):
+        (WebCore::DateTimeEditElement::focusOnNextField):
+        (WebCore::DateTimeEditElement::handleMouseEvent):
+        (WebCore::DateTimeEditElement::isDisabled):
+        (WebCore::DateTimeEditElement::isReadOnly):
+        (WebCore::DateTimeEditElement::layout):
+        (WebCore::DateTimeEditElement::nextFieldIndex):
+        (WebCore::DateTimeEditElement::previousFieldIndex):
+        (WebCore::DateTimeEditElement::readOnlyStateChanged): Called when owner's readOnly state is changed.
+        (WebCore::DateTimeEditElement::resetLayout):
+        (WebCore::DateTimeEditElement::defaultEventHandler):
+        (WebCore::DateTimeEditElement::setValueAsDate):
+        (WebCore::DateTimeEditElement::setEmptyValue):
+        (WebCore::DateTimeEditElement::spinButtonStepDown):
+        (WebCore::DateTimeEditElement::spinButtonStepUp):
+        (WebCore::DateTimeEditElement::updateUIState):
+        (WebCore::DateTimeEditElement::valueAsDouble):
+        * html/shadow/DateTimeEditElement.h: Added.
+        (DateTimeEditElement):
+        (EditControlOwner):
+        (WebCore::DateTimeEditElement::removeEditControlOwner):
+        * html/shadow/DateTimeFieldElement.cpp: Added.
+        (WebCore::DateTimeFieldElement::FieldEventHandler::~FieldEventHandler):
+        (WebCore::DateTimeFieldElement::DateTimeFieldElement):
+        (WebCore::DateTimeFieldElement::defaultEventHandler):
+        (WebCore::DateTimeFieldElement::defaultKeyboardEventHandler):
+        (WebCore::DateTimeFieldElement::focusOnNextField):
+        (WebCore::DateTimeFieldElement::initialize):
+        (WebCore::DateTimeFieldElement::isReadOnly):
+        (WebCore::DateTimeFieldElement::setReadOnly):
+        (WebCore::DateTimeFieldElement::updateVisibleValue):
+        (WebCore::DateTimeFieldElement::valueAsDouble):
+        * html/shadow/DateTimeFieldElement.h: Added.
+        (DateTimeFieldElement):
+        (FieldEventHandler):
+        (WebCore::DateTimeFieldElement::removeEventHandler):
+        * html/shadow/DateTimeFieldElements.cpp: Added.
+        (WebCore::DateTimeAMPMFieldElement::DateTimeAMPMFieldElement):
+        (WebCore::DateTimeAMPMFieldElement::create):
+        (WebCore::DateTimeAMPMFieldElement::setValueAsDate):
+        (WebCore::DateTimeAMPMFieldElement::unitInMillisecond):
+        (WebCore::DateTimeHourFieldElement::DateTimeHourFieldElement):
+        (WebCore::DateTimeHourFieldElement::create):
+        (WebCore::DateTimeHourFieldElement::setValueAsDate):
+        (WebCore::DateTimeHourFieldElement::setValueAsInteger):
+        (WebCore::DateTimeHourFieldElement::unitInMillisecond):
+        (WebCore::DateTimeHourFieldElement::valueAsInteger):
+        (WebCore::DateTimeMillisecondFieldElement::DateTimeMillisecondFieldElement):
+        (WebCore::DateTimeMillisecondFieldElement::create):
+        (WebCore::DateTimeMillisecondFieldElement::setValueAsDate):
+        (WebCore::DateTimeMillisecondFieldElement::unitInMillisecond):
+        (WebCore::DateTimeMinuteFieldElement::DateTimeMinuteFieldElement):
+        (WebCore::DateTimeMinuteFieldElement::create):
+        (WebCore::DateTimeMinuteFieldElement::setValueAsDate):
+        (WebCore::DateTimeMinuteFieldElement::unitInMillisecond):
+        (WebCore::DateTimeSecondFieldElement::DateTimeSecondFieldElement):
+        (WebCore::DateTimeSecondFieldElement::create):
+        (WebCore::DateTimeSecondFieldElement::setValueAsDate):
+        (WebCore::DateTimeSecondFieldElement::unitInMillisecond):
+        * html/shadow/DateTimeFieldElements.h: Added.
+        (DateTimeAMPMFieldElement):
+        (DateTimeHourFieldElement):
+        (DateTimeMillisecondFieldElement):
+        (DateTimeMinuteFieldElement):
+        (DateTimeSecondFieldElement):
+        * html/shadow/DateTimeNumericFieldElement.cpp: Added.
+        (WebCore::displaySizeOfNumber):
+        (WebCore::DateTimeNumericFieldElement::Range::Range):
+        (WebCore::DateTimeNumericFieldElement::Range::clumpValue):
+        (WebCore::DateTimeNumericFieldElement::DateTimeNumericFieldElement):
+        (WebCore::DateTimeNumericFieldElement::handleKeyboardEvent):
+        (WebCore::DateTimeNumericFieldElement::hasValue):
+        (WebCore::DateTimeNumericFieldElement::setEmptyValue):
+        (WebCore::DateTimeNumericFieldElement::setValueAsInteger):
+        (WebCore::DateTimeNumericFieldElement::stepDown):
+        (WebCore::DateTimeNumericFieldElement::stepUp):
+        (WebCore::DateTimeNumericFieldElement::value):
+        (WebCore::DateTimeNumericFieldElement::valueAsInteger):
+        (WebCore::DateTimeNumericFieldElement::visibleValue):
+        * html/shadow/DateTimeNumericFieldElement.h: Added.
+        (DateTimeNumericFieldElement):
+        (WebCore::DateTimeNumericFieldElement::clumpValue):
+        (WebCore::DateTimeNumericFieldElement::range):
+        * html/shadow/DateTimeSymbolicFieldElement.cpp: Added.
+        (WebCore::DateTimeSymbolicFieldElement::DateTimeSymbolicFieldElement):
+        (WebCore::DateTimeSymbolicFieldElement::handleKeyboardEvent):
+        (WebCore::DateTimeSymbolicFieldElement::hasValue):
+        (WebCore::DateTimeSymbolicFieldElement::setEmptyValue):
+        (WebCore::DateTimeSymbolicFieldElement::setValueAsInteger):
+        (WebCore::DateTimeSymbolicFieldElement::stepDown):
+        (WebCore::DateTimeSymbolicFieldElement::stepUp):
+        (WebCore::DateTimeSymbolicFieldElement::value):
+        (WebCore::DateTimeSymbolicFieldElement::valueAsInteger):
+        (WebCore::DateTimeSymbolicFieldElement::visibleValue):
+        * html/shadow/DateTimeSymbolicFieldElement.h: Added.
+        (DateTimeSymbolicFieldElement):
+
+2012-08-10  Tony Chang  <tony@chromium.org>
+
+        implement display: -webkit-inline-flex
+        https://bugs.webkit.org/show_bug.cgi?id=77772
+
+        Reviewed by Ojan Vafai.
+
+        The crashes last time were because we were marking too much of the tree for relayout. During some editing
+        operations, this causes a layout when we're in an inconsistent state.
+
+        Tests: css3/flexbox/inline-flex-crash.html
+               css3/flexbox/inline-flex-crash2.html
+               css3/flexbox/inline-flex.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Only layout the child.
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): Only layout the child.
+        (WebCore::RenderFlexibleBox::applyStretchAlignmentToChild): Only layout the child.
+        * rendering/style/RenderStyle.h: Include INLINE_FLEX as an inline and replaced display type.
+
+2012-08-10  Vineet Chaudhary  <rgf748@motorola.com>
+
+        Moving the common code from CodegeneratorJS/V8.pm to Codegenerator.pm
+        https://bugs.webkit.org/show_bug.cgi?id=93616
+
+        Reviewed by Adam Barth.
+
+        IsArrayType() IsConstructorTemplate() IsTypedArrayType() these methods
+        has the common implementaion for both V8 and JS and can be moved to
+        common place Codegenerator.pm
+
+        No new tests. There should be no behavioural changes.
+
+        * bindings/scripts/CodeGenerator.pm: Moved common code here.
+        (IsArrayType):
+        (IsConstructorTemplate):
+        (IsSVGTypeWithWritablePropertiesNeedingTearOff):
+        (IsTypedArrayType):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (AddIncludesForType):
+        (AddClassForwardIfNeeded):
+        (GenerateHeader):
+        (GenerateParametersCheckExpression):
+        (GenerateImplementation):
+        (NativeToJSValue):
+        (GenerateConstructorDeclaration):
+        (GenerateConstructorDefinition):
+        (IsConstructable):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (AddIncludesForType):
+        (GenerateHeader):
+        (GetHeaderClassInclude):
+        (GenerateParametersCheckExpression):
+        (GenerateImplementation):
+        (GetTypeNameOfExternalTypedArray):
+
+2012-08-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r125230 and r125238.
+        http://trac.webkit.org/changeset/125230
+        http://trac.webkit.org/changeset/125238
+        https://bugs.webkit.org/show_bug.cgi?id=93698
+
+        Broke ChromiumOS browser tests. (Requested by yutak on
+        #webkit).
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
+        (WebCore::TiledLayerChromium::updateContentRect):
+        (WebCore::TiledLayerChromium::needsIdlePaint):
+        (WebCore::TiledLayerChromium::idlePaintRect):
+        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
+        (WebCore::CCLayerTilingData::contentRectToTileIndices):
+        (WebCore::CCLayerTilingData::setBounds):
+        * platform/graphics/chromium/cc/CCPriorityCalculator.h:
+
+2012-08-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Handle SSL errors for SOUP
+        https://bugs.webkit.org/show_bug.cgi?id=90267
+
+        Reviewed by Martin Robinson.
+
+        No new tests, this is covered by existing tests.
+
+        * platform/LocalizedStrings.h:
+        (WebCore): Add unacceptableTLSCertificate() for SOUP.
+        * platform/efl/LocalizedStringsEfl.cpp:
+        (WebCore::unacceptableTLSCertificate):
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::unacceptableTLSCertificate):
+        * platform/network/ResourceHandle.h:
+        * platform/network/soup/ResourceError.h:
+        (WebCore::ResourceError::ResourceError): Add new constructor for
+        SSL errors that receives a certificate and TLS errors.
+        (WebCore::ResourceError::tlsErrors): Return TLS errors.
+        (WebCore::ResourceError::certificate): Return the certificate.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (HostTLSCertificates): Helper class to store certificates for a
+        host.
+        (WebCore::HostTLSCertificateSet::add): Add a new certificate.
+        (WebCore::HostTLSCertificateSet::contains): Check whether
+        certificate is stored.
+        (WebCore::HostTLSCertificateSet::computeCertificateHash): Compute
+        the SHA1 of the certificate data.
+        (WebCore::allowsAnyHTTPSCertificateHosts): Global set to store
+        hostnames for which SSL errors should be ignored.
+        (WebCore::clientCertificates): Global map to store client
+        certificates.
+        (WebCore::hasUnignoredTLSErrors): Helper function to check whether
+        current message contains TLS errors that shouldn't be ignored and
+        certificate hasn't been approved already.
+        (WebCore::sendRequestCallback): Finish the load with an error in
+        case of SSL errors not handled by the SoupSession.
+        (WebCore::ResourceHandle::setHostAllowsAnyHTTPSCertificate): Add
+        the given hostname to the list of hosts for which SSL errors are
+        ignored.
+        (WebCore::ResourceHandle::setClientCertificate): Store the client
+        certificate for the given host.
+        (WebCore::ResourceHandle::setIgnoreSSLErrors): Set whether all SSL
+        errors should be ignored.
+
+2012-08-10  Arko Saha  <arko@motorola.com>
+
+        itemType.add should treat \t as a space.
+        https://bugs.webkit.org/show_bug.cgi?id=92991
+
+        Reviewed by Ryosuke Niwa.
+
+        Earlier we used to append a space character i.e, ' ' to the string builder
+        if the last character of input string is not a space character in addToken()
+        method. We should add an space character if the last character of input is
+        not a HTML Space character like, '\n', '\r', '\t', '\f' or ' '.
+
+        We can observe the same behavior in FireFox, Opera and IE. They also treat
+        HTML space character as a space.
+
+        Test: fast/dom/MicroData/domsettabletokenlist-attributes-add-token.html
+
+        * html/DOMTokenList.cpp:
+        (WebCore::DOMTokenList::addToken):
+
+2012-08-10  Tony Chang  <tony@chromium.org>
+
+        Remove unused isFlexingChildren and make m_flexingChildren a local variable
+        https://bugs.webkit.org/show_bug.cgi?id=93689
+
+        Reviewed by Ojan Vafai.
+
+        isFlexingChildren() is never called, so we can remove it.
+
+        m_flexingChildren is now only used locally, so remove the member variable and use a local variable.
+
+        No new tests, this is just a refactoring.
+
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::RenderDeprecatedFlexibleBox):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox): Make flexingChildren a local.
+        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox): Make flexingChildren a local.
+        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp): No need to set m_flexingChildren since it's not used
+        outside of RenderDeprecatedFlexibleBox.
+        * rendering/RenderDeprecatedFlexibleBox.h:
+        (RenderDeprecatedFlexibleBox): Remove m_flexingChildren and don't bit pack the remaining bool since it doesn't
+        do anything for 1 bool.
+        * rendering/RenderObject.h:
+
+2012-08-10  Sam D  <dsam2912@gmail.com>
+
+        Web Inspector: Search matches count view is flaky.
+        https://bugs.webkit.org/show_bug.cgi?id=93451
+
+        Reviewed by Pavel Feldman.
+
+        Modified css properties for aligning search panel.
+
+        No new tests.UI change.
+
+        * inspector/front-end/inspector.css:
+        (.search-results-matches):
+
+2012-08-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove support for __qt_sender__ in QObject bridge
+        https://bugs.webkit.org/show_bug.cgi?id=93649
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Support for __qt_sender__ has also been removed from QtScript/QJSEngine. The right
+        JavaScript solution to the problem is Function.prototype.bind.
+
+        * bridge/qt/qt_instance.cpp:
+        (Bindings):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (Bindings):
+        (JSC::Bindings::QtConnectionObject::execute):
+
+2012-08-09  Shane Stephens  <shanestephens@google.com>
+
+        Convert CSSParser's m_reusableSelectorVector to OwnPtr and rename to m_selectorVector.
+        https://bugs.webkit.org/show_bug.cgi?id=93574
+
+        Reviewed by Ojan Vafai.
+
+        This is preparatory work for CSS Hierarchies (see wkb.ug/79939).
+        CSS Hierarchies works by pushing selectorVectors onto a stack while nested selectorVectors are parsed.
+        For this reason, the selectorVector in CSSParser can't be re-used between selector parses within a set of
+        nested selectors. This patch wraps the selectorVector in an OwnPtr but does not otherwise modify its use.
+
+        Similarly, CSSParser::m_parsedProperties is converted from a direct ParsedPropertyVector included
+        as a member of CSSParser to an OwnPtr.
+
+        Once Hierarchies are introduced, when a selectorVector is stacked a new one will be created 
+        and stored in m_selectorVector (see wkb.ug/79939 for context). However, an accompanying unstacking
+        mechanism ensures that selectorVectors will be reused in all circumstances where they currently are.
+
+        This patch also introduces a CSSSelectorVector typedef to simplify and improve readability of 
+        type signatures in and around CSSParser.
+
+        No new tests as this patch doesn't introduce new functionality.
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseColor):
+        (WebCore::CSSParser::parseDeclaration):
+        (WebCore):
+        (WebCore::filterProperties):
+        (WebCore::CSSParser::createStylePropertySet):
+        (WebCore::CSSParser::addProperty):
+        (WebCore::CSSParser::rollbackLastProperties):
+        (WebCore::CSSParser::clearProperties):
+        (WebCore::CSSParser::parse4Values):
+        (WebCore::CSSParser::parseFlowThread):
+        (WebCore::CSSParser::createFloatingSelectorVector):
+        (WebCore::CSSParser::sinkFloatingSelectorVector):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::createPageRule):
+        (WebCore::CSSParser::setReusableRegionSelectorVector):
+        (WebCore::CSSParser::startDeclarationsForMarginBox):
+        (WebCore::CSSParser::endDeclarationsForMarginBox):
+        (WebCore::CSSParser::deleteFontFaceOnlyValues):
+
+        m_reusableSelectorVector renamed to m_selectorVector and wrapped in OwnPtr.
+        m_parsedProperties wrapped in OwnPtr.
+        * css/CSSParser.h:
+        (WebCore::CSSParser::hasProperties):
+        (WebCore::CSSParser::selectorVector): function renamed from reusableSelectorVector
+        (CSSParser): 
+        (WebCore::CSSParser::reusableRegionSelectorVector):
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserSelector::adoptSelectorVector):
+        * css/CSSParserValues.h: CSSSelectorVector typedef added
+        (WebCore):
+        (CSSParserSelector):
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::adoptSelectorVector):
+        * css/CSSSelectorList.h:
+        (CSSSelectorList):
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/StyleRule.cpp:
+        (WebCore::StyleRuleRegion::StyleRuleRegion):
+        * css/StyleRule.h:
+        (WebCore::StyleRule::parserAdoptSelectorVector):
+        (WebCore::StyleRulePage::parserAdoptSelectorVector):
+        (WebCore::StyleRuleRegion::create):
+        (StyleRuleRegion):
+
+2012-08-02  Dominic Cooney  <dominicc@chromium.org>
+
+        SVGElementInstance should have EventTarget on the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=88232
+
+        Reviewed by Adam Barth.
+
+        SVG 1.1 specifies that SVGElementInstance has EventTarget as its
+        parent interface:
+        <http://www.w3.org/TR/SVG/struct.html#InterfaceSVGElementInstance>
+        Match the spec by putting EventTarget on the prototype chain of
+        SVGElementInstance instead of redundantly declaring
+        addEventListener, removeEventListener and dispatchEvent on the
+        SVGElementInstance interface. This is an incremental step to make
+        all EventTargets do it this way, being tracked in bug 67312.
+
+        Covered by existing tests, eg
+        svg/custom/use-instanceRoot-as-event-target.xhtml
+
+        * CMakeLists.txt: Finding base interface types requires
+        searching directories with the IDLs of base interfaces.
+        * DerivedSources.cpp: Add generated JSEventTarget.cpp.
+        * DerivedSources.make: (Search paths again -- see CMakeLists.txt)
+        * DerivedSources.pri: "
+        * bindings/js/JSEventTargetCustom.cpp:
+        (WebCore::toEventTarget): Try to unwrap EventTargets simply as
+        EventTargets. When all EventTargets do this consistently this
+        function will be simplified.
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::visitChildren): SVGElementInstance
+        skips walking its event listener list because it forwards
+        listeners to its corresponding element.
+        * bindings/scripts/CodeGenerator.pm:
+        (IsStrictSubtype): For finding what is an EventTarget based on
+        parent interface.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader): Extend the heuristic for what is an
+        EventTarget. When all EventTargets are handled consistently this
+        will be simplified.
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm: Extend the heuristic for
+        what is an EventTarget, and remove some of the special-casing for
+        EventTarget.
+        (GenerateHeader):
+        (GetInternalFields):
+        (GenerateImplementation):
+        (BaseInterfaceName):
+        (GenerateToV8Converters):
+        (GetNativeType):
+        (JSValueToNative):
+        (GetV8HeaderName):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore::V8Float64Array::wrapSlow): Add assertions.
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::wrapSlow):
+        * svg/SVGElementInstance.h: Must extend EventTarget first so that
+        static_cast<EventTarget*>(elementInstance) is the same pointer as
+        elementInstance, similar to how static_cast<Node*>(element) is the
+        same pointer as element.
+        * svg/SVGElementInstance.idl: Extend EventTarget; no longer need
+        to declare add/removeEventListener and dispatchEvent.
+
+2012-08-09  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Web Inspector: Remove unused method InspectorResourceAgent::clearCache from Resource Agent.
+        https://bugs.webkit.org/show_bug.cgi?id=93675
+
+        Reviewed by Pavel Feldman.
+
+        Removing unused method declaration for clearCache in InspectorResourceAgent. It's marked as FIXME.
+        Hence cleaning up.
+
+        No new tests as cleanup.
+
+        * inspector/InspectorResourceAgent.h:
+        (InspectorResourceAgent):
+
+2012-08-09  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: CodeGeneratorInspector.py: add complete support for TypeBuilder::Array
+        https://bugs.webkit.org/show_bug.cgi?id=93559
+
+        Reviewed by Pavel Feldman.
+
+        Missing binding methods are added to templates. Core assert methods are declared in a helper class now.
+
+        * inspector/CodeGeneratorInspector.py:
+        (RawTypes.BaseType.generate_validate_method):
+        (RawTypes.BaseType.get_raw_validator_call_text):
+        (RawTypes.generate_validate_methods):
+        (RawTypes.Int.generate_validate_method):
+        (RawTypes.Int.get_raw_validator_call_text):
+        (RawTypes.Number.get_validate_method_params.ValidateMethodParams):
+        (RawTypes.Any.generate_validate_method):
+        (RawTypes.Any.get_raw_validator_call_text):
+        (RawTypes.Array.get_validate_method_params.ValidateMethodParams):
+        (RawTypes.Array.get_validate_method_params):
+        (PlainObjectBinding.get_validator_call_text):
+        (RuntimeCastHelper):
+        (Generator):
+        (Generator.go):
+
+2012-08-09  Sukolsak Sakshuwong  <sukolsak@google.com>
+
+        Mouse-select then Cut, results in preceding character being lost
+        https://bugs.webkit.org/show_bug.cgi?id=60830
+
+        Reviewed by Ryosuke Niwa.
+
+        This bug happened only in text fields and text areas, not in other
+        content-editable elements. That's because when we cut or copied text
+        in a text control, we called Pasteboard::writePlainText instead of
+        Pasteboard::writeSelection. writePlainText did not record the smart replace
+        information. Make writePlainText record the smart replace information.
+
+        Test: editing/pasteboard/smart-paste-in-text-control.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::cut):
+        (WebCore::Editor::copy):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::copyText):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::copyText):
+        * platform/Pasteboard.h:
+        * platform/blackberry/PasteboardBlackBerry.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/efl/PasteboardEfl.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::writePlainText):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wince/PasteboardWinCE.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::writePlainText):
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::writePlainText):
+
+2012-08-09  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Updated run-binding-tests results.
+
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::TestActiveDOMObjectV8Internal::TestActiveDOMObjectDomainSafeFunctionSetter):
+
+2012-08-09  Luke Macpherson   <macpherson@chromium.org>
+
+        Fix null pointer deref in RenderFileUploadControl::computePreferredLogicalWidth().
+        https://bugs.webkit.org/show_bug.cgi?id=93579
+
+        Reviewed by Kent Tamura.
+
+        Checks the upload control has a non-null button renderer before dereferencing.
+
+        Test: fast/forms/file/file-crash-by-display-none-button.html
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::computePreferredLogicalWidths):
+
+2012-08-09  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Rename V8BindingPerContextData to V8PerContextData
+        https://bugs.webkit.org/show_bug.cgi?id=93595
+
+        Reviewed by Adam Barth.
+
+        For a better name. See discussion in bug 93333.
+
+        No tests. No change in behavior.
+
+        * UseV8.cmake: Added V8PerContextData.cpp. The fact that missing V8BindingPerContextData.cpp
+        has not caused any problem indicates that UseV8.cmake is not used at all?
+        * WebCore.gypi:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/V8DOMWindowShell.h:
+        (WebCore::V8DOMWindowShell::perContextData):
+        (V8DOMWindowShell):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::constructorForType):
+        (WebCore::V8DOMWrapper::perContextData):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore):
+        (V8DOMWrapper):
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        * bindings/v8/V8IsolatedContext.h:
+        (WebCore):
+        (WebCore::V8IsolatedContext::perContextData):
+        (V8IsolatedContext):
+        * bindings/v8/V8PerContextData.cpp: Renamed from Source/WebCore/bindings/v8/V8BindingPerContextData.cpp.
+        (WebCore):
+        (WebCore::V8PerContextData::dispose):
+        (WebCore::V8PerContextData::init):
+        (WebCore::V8PerContextData::createWrapperFromCacheSlowCase):
+        (WebCore::V8PerContextData::constructorForTypeSlowCase):
+        * bindings/v8/V8PerContextData.h: Renamed from Source/WebCore/bindings/v8/V8BindingPerContextData.h.
+        (WebCore):
+        (V8PerContextData):
+        (WebCore::V8PerContextData::create):
+        (WebCore::V8PerContextData::~V8PerContextData):
+        (WebCore::V8PerContextData::createWrapperFromCache):
+        (WebCore::V8PerContextData::constructorForType):
+        (WebCore::V8PerContextData::V8PerContextData):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrievePerContextData):
+        * bindings/v8/V8Proxy.h:
+        (WebCore):
+        (V8Proxy):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WebCore):
+        (WebCore::WorkerContextExecutionProxy::perContextData):
+        (WorkerContextExecutionProxy):
+
+2012-08-09  Erik Arvidsson  <arv@chromium.org>
+
+        HTMLElement.classList cannot remove classnames with uppercase characters
+        https://bugs.webkit.org/show_bug.cgi?id=93628
+
+        Reviewed by Alexey Proskuryakov.
+
+        Before this patch we were trying to be smart and determine whether we needed the update m_classNamesForQuirksMode
+        based on whether m_classNamesForQuirksMode.isNull(), however, m_classNamesForQuirksMode.isNull() is true when the
+        class name is the empty string.
+
+        We also did not update m_classNamesForQuirksMode when the class attribute was cleared.
+
+        Updated tests.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::classAttributeChanged):
+        * html/ClassList.cpp:
+        (WebCore::ClassList::reset):
+        (WebCore::ClassList::classNames):
+
+2012-08-09  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed, Chromium-mac (clang) build fix for r125230.
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore):
+
+2012-08-09  MORITA Hajime  <morrita@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=93587
+        Node::replaceChild() can create bad DOM topology with MutationEvent, Part 2
+
+        Reviewed by Kent Tamura.
+
+        This is a followup of r124156. replaceChild() has yet another hidden
+        MutationEvent trigger. This change added a guard for it.
+
+        Test: fast/events/mutation-during-replace-child-2.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::replaceChild):
+
+2012-08-09  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] V8Utilities::throwTypeMismatchException() should use setDOMException()
+        https://bugs.webkit.org/show_bug.cgi?id=93610
+
+        Reviewed by Adam Barth.
+
+        Given that V8Utilities::throwTypeMismatchException() throws a DOM exception,
+        we should use setDOMException() instead of throwError().
+
+        This patch also renames throwTypeMismatchException() to setTypeMismatchException().
+
+        No tests. I couldn't figure out how to trigger the call path.
+        Either way this is just a minor change of error message.
+
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::setTypeMismatchException):
+        * bindings/v8/V8Utilities.h:
+        (WebCore::createFunctionOnlyCallback):
+
+2012-08-09  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Crash in WebCore::RenderTable::cellBefore
+        https://bugs.webkit.org/show_bug.cgi?id=91160
+
+        Reviewed by Abhishek Arya.
+
+        The issue was that we wouldn't properly set the row index on row in a newly split table. When inserting
+        the cell into the new row, we would try to repaint the cell which would access the row index and crash.
+        This came from splitAnonymousBoxesAroundChild calling RenderObjectChildList::insertChildNode directly
+        which doesn't invoke the row setting logic (RenderTableSection::addChild for example but we cannot call
+        addChild due to concern over splitting flows in the general case).
+
+        Test: fast/table/split-anonymous-boxes-around-table-repaint-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::splitAnonymousBoxesAroundChild):
+        Dirty our parent box, which forces a cell recomputation which will set the row index. This needs to
+        be done *before* we insert the child to avoid crashing when repainting the new child.
+
+2012-08-09  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Fix issues with [DoNotCheckSecurity] which depended on non ES5 compliant behavior
+        https://bugs.webkit.org/show_bug.cgi?id=93555
+
+        Reviewed by Kentaro Hara.
+
+        Before this change we were relying on a V8 bug where instance properties could be shadow
+        read only properties on the prototype. With this change we no longer depend on this incorrect
+        V8 behavior and instead use a hidden v8 property that is only returned if the code can access
+        the frame.
+
+        No new tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateDomainSafeFunctionGetter):
+        (GenerateDomainSafeFunctionSetter):
+        (GenerateNonStandardFunction):
+        (GenerateImplementation):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::TestActiveDOMObjectV8Internal::postMessageAttrGetter):
+        (WebCore::TestActiveDOMObjectV8Internal::TestActiveDOMObjectDomainSafeFunctionSetter):
+        (TestActiveDOMObjectV8Internal):
+        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):
+
+2012-08-09  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: intversion-long-queue.html fails an assert
+        https://bugs.webkit.org/show_bug.cgi?id=92783
+
+        Reviewed by Tony Chang.
+
+        onBlocked needs the same shouldEnqueueEvent check that the other
+        event generators have.
+
+        Tests: intversion-long-queue is no longer skipped.
+
+        * Modules/indexeddb/IDBRequest.h:
+        (IDBRequest):
+        * Modules/indexeddb/IDBVersionChangeRequest.cpp:
+        (WebCore::IDBVersionChangeRequest::onBlocked):
+
+2012-08-09  Eric Penner  <epenner@google.com>
+
+        [chromium] Paint animated layers immediately to avoid animation hiccups.
+        https://bugs.webkit.org/show_bug.cgi?id=93028
+
+        Reviewed by Adrienne Walker.
+
+        This is a technique used on Android, which is very prone
+        to hiccups in animations. Paint the entire layer if it is
+        of reasonable size such that there is no hiccups when the
+        animation reaches unpainted content. The reasonable size
+        is choosen for page-transitions specifically, as this was
+        the problem case (animations would just jump to the end).
+
+        Since we already have a special case this just modifies it
+        and replaces the unit test with a new one. This can be
+        improved/simplified further when distances/directions are
+        available for the animated layers.
+
+        Replaced one test.
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (UpdatableTile):
+        (WebCore::UpdatableTile::resetUpdateState):
+        (WebCore::UpdatableTile::markForUpdate):
+        (WebCore::UpdatableTile::UpdatableTile):
+        (WebCore::TiledLayerChromium::TiledLayerChromium):
+        (WebCore::TiledLayerChromium::pushPropertiesTo):
+        (WebCore):
+        (WebCore::TiledLayerChromium::updateTiles):
+        (WebCore::TiledLayerChromium::markOcclusionsAndRequestTextures):
+        (WebCore::TiledLayerChromium::haveTexturesForTiles):
+        (WebCore::TiledLayerChromium::markTilesForUpdate):
+        (WebCore::TiledLayerChromium::updateTileTextures):
+        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
+        (WebCore::TiledLayerChromium::resetUpdateState):
+        (WebCore::TiledLayerChromium::updateContentRect):
+        (WebCore::TiledLayerChromium::needsIdlePaint):
+        (WebCore::TiledLayerChromium::idlePaintRect):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
+        (WebCore::CCLayerTilingData::contentRectToTileIndices):
+        * platform/graphics/chromium/cc/CCPriorityCalculator.h:
+        (WebCore::CCPriorityCalculator::maxPriority):
+
+2012-08-09  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        REGRESSION(r117339): cell in block-level table in inline-block are aligned with their last line box
+        https://bugs.webkit.org/show_bug.cgi?id=91137
+
+        Reviewed by Tony Chang.
+
+        Fixed the code to properly ignore any inline-table's baseline for the purpose of 'inline-block' baseline computation.
+        See http://lists.w3.org/Archives/Public/www-style/2012Jul/0721.html about the discussion.
+
+        While touching the code, properly fixed the table baseline logic that was wrong because it wrongly piggy-backed
+        on the inline-block baseline logic.
+
+        Tests: fast/table/anonymous-table-no-baseline-align.html
+               fast/table/inline-table-in-inline-block-last-baseline-align.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::baselinePosition):
+        Overrode this function: this is needed as RenderBlock assumes that isReplaced() == true
+        means it is handling an inline-block, not a table.
+
+        (WebCore::RenderTable::lastLineBoxBaseline):
+        Table are ignored for the purpose of inline-block baseline determination.
+
+        (WebCore::RenderTable::firstLineBoxBaseline):
+        Inlined the code from getLineBoxBaseline. Added some comments to explain
+        why this code works as expected in the 'table' case.
+
+        * rendering/RenderTable.h:
+        Added baselinePosition.
+
+2012-08-09  Adam Barth  <abarth@webkit.org>
+
+        Sandboxing view source documents is ineffective
+        https://bugs.webkit.org/show_bug.cgi?id=93660
+
+        Reviewed by Eric Seidel.
+
+        Prior to this patch, Document::setIsViewSource changed the
+        SecurityOrigin object on Document but didn't update the copy on
+        DOMWindow. As a consequence, the security checks that use the copy on
+        DOMWindow didn't notice the change and acted as if the document wasn't
+        sandboxed.
+
+        This bug wasn't present for most view source documents because
+        HTMLViewSourceDocument sets the flag in its constructor. However, for
+        view source documents created by the XMLTreeViewer, the bit was set at
+        the end of parsing rather than during construction.
+
+        This mechansim is really more of a mitigation than an important
+        security check, and I was tempted to remove the sandboxing entirely
+        given that sandboxing a document at the end of parsing isn't overly
+        effective anyway. However, we can worry about that issue in a future
+        patch.
+
+        For the time being, this patch just synchronizes DOMWindow and
+        Document's copy of the SecurityOrigin. The long-term solution here, of
+        course, is to keep working on fixing
+        https://bugs.webkit.org/show_bug.cgi?id=75793, which this patch gets us
+        one (small) step closer to fixing.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setIsViewSource):
+
+2012-08-09  Benjamin Poulain  <bpoulain@apple.com>
+
+        Append the unit in place when generating the text value of a CSSPrimitiveValue
+        https://bugs.webkit.org/show_bug.cgi?id=93572
+
+        Reviewed by Andreas Kling.
+
+        Previously, the units were added to the formatted number by the operator+. This would create
+        a new WTF::String for the unit, then use String::append() to add it to the number.
+
+        This was ineffective because it required one malloc for the unit, followed by a realloc + copying
+        the bytes.
+
+        This patch adds handling for the unit directly in formatNumber() so that we only do one malloc
+        and append the units in place.
+
+        Avoiding the intermediate string is both more efficient (9% faster as seen from JavaScript)
+        and generate more compact code (~8kb less code on x86_64).
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::formatNumber):
+        (WebCore::CSSPrimitiveValue::customCssText):
+
+2012-08-09  Elliott Sprehn  <esprehn@gmail.com>
+
+        Reimplement RenderQuote placement algorithm
+        https://bugs.webkit.org/show_bug.cgi?id=93056
+
+        Reviewed by Eric Seidel.
+
+        Greatly simplify the code that maintains the linked list of RenderQuotes. Now RenderQuote
+        is placed into the linked list in computePreferredLogicalWidths on first access and is
+        detached when destroyed (or explicitly removed).
+
+        The new algorithm doesn't require walking up the tree of renderers when there are no
+        RenderQuotes in the tree yet, and also removes the need to walk over every subtree
+        when inserting in rendererSubtreeAttached.
+
+        No new tests because this patch doesn't change any behavior.
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::removeChildNode): Call detachQuote when removing from a child list.
+        (WebCore::RenderObjectChildList::appendChildNode):
+        (WebCore::RenderObjectChildList::insertChildNode):
+        * rendering/RenderQuote.cpp:
+        (WebCore::RenderQuote::RenderQuote):
+        (WebCore::RenderQuote::~RenderQuote):
+        (WebCore::RenderQuote::willBeDestroyed): Call detachQuote to ensure all destroyed quotes are detached.
+        (WebCore::RenderQuote::originalText):
+        (WebCore::RenderQuote::computePreferredLogicalWidths): Attach quote before computing the width.
+        (WebCore):
+        (WebCore::RenderQuote::attachQuote): Puts the RenderQuote in the linked list of quotes and computes the depth.
+        (WebCore::RenderQuote::detachQuote): Removes the quote from the linked list.
+        (WebCore::RenderQuote::updateDepth):
+        * rendering/RenderQuote.h:
+        (RenderQuote):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff): Return StyleDifferenceLayout if quotes change and remove check in styleDidChange in RenderQuote.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::RenderView):
+        * rendering/RenderView.h:
+        (WebCore):
+        (WebCore::RenderView::setRenderQuoteHead):
+        (WebCore::RenderView::renderQuoteHead): Stores the first quote in the document.
+        (RenderView):
+
+2012-08-06  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Expose CCGraphicsContext as WebCompositorOutputSurface
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCGraphicsContext.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::recreateContext):
+        (WebCore::CCLayerTreeHost::createContext):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        (CCLayerTreeHostClient):
+        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
+        (CCLayerTreeSettings):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::onVSyncParametersChanged):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (WebKit):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRendererClient):
+        (WebCore::CCRendererClient::~CCRendererClient):
+        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
+        * platform/graphics/chromium/cc/CCResourceProvider.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::recreateContext):
+        (WebCore::CCThreadProxy::onVSyncParametersChanged):
+        (WebCore):
+        (WebCore::CCThreadProxy::beginFrame):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2012-08-09  Nat Duca  <nduca@chromium.org>
+
+        Unreviewed, rolling out r125212.
+        http://trac.webkit.org/changeset/125212
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Compile failure on mac dbg builder
+
+        * platform/graphics/chromium/cc/CCGraphicsContext.h:
+        (WebCore):
+        (CCGraphicsContext):
+        (WebCore::CCGraphicsContext::create2D):
+        (WebCore::CCGraphicsContext::create3D):
+        (WebCore::CCGraphicsContext::context3D):
+        (WebCore::CCGraphicsContext::CCGraphicsContext):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::recreateContext):
+        (WebCore::CCLayerTreeHost::createContext):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        (CCLayerTreeHostClient):
+        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
+        (CCLayerTreeSettings):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRendererClient):
+        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
+        * platform/graphics/chromium/cc/CCResourceProvider.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::recreateContext):
+        (WebCore::CCThreadProxy::beginFrame):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2012-08-09  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove V8Proxy::throwError(ExceptionCode&)
+        https://bugs.webkit.org/show_bug.cgi?id=93605
+
+        Reviewed by Adam Barth.
+
+        (1) Pass Isolate around to V8Utilities::extractTransferables().
+        (2) Replace throwError(ExceptionCode&) in V8Utilities::extractTransferables()
+        with setDOMException(ExceptionCode&, Isolate*), which completely removes
+        V8Proxy::throwError(ExceptionCode&) from the code base.
+        (3) Remove V8Proxy::throwError(ExceptionCode&).
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateParametersCheck):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::acceptTransferListCallback):
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::multiTransferListCallback):
+        (WebCore::V8TestSerializedScriptValueInterface::constructorCallback):
+        * bindings/v8/Dictionary.cpp:
+        (WebCore::Dictionary::get):
+        * bindings/v8/V8Proxy.h:
+        (WebCore):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::extractTransferables):
+        (WebCore::getMessagePortArray):
+        * bindings/v8/V8Utilities.h:
+        (WebCore):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::handlePostMessageCallback):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::handlePostMessageCallback):
+        * bindings/v8/custom/V8IntentConstructor.cpp:
+        (WebCore::V8Intent::constructorCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::handlePostMessageCallback):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::handlePostMessageCallback):
+
+2012-08-09  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Rename V8BindingPerIsolateData to V8PerIsolateData
+        https://bugs.webkit.org/show_bug.cgi?id=93592
+
+        Reviewed by Adam Barth.
+
+        For a better name. See discussion in bug 93333.
+
+        No tests. No change in behavior.
+
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore::V8Float64Array::GetRawTemplate):
+        (WebCore::V8Float64Array::GetTemplate):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::V8TestActiveDOMObject::GetRawTemplate):
+        (WebCore::V8TestActiveDOMObject::GetTemplate):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore::V8TestCustomNamedGetter::GetRawTemplate):
+        (WebCore::V8TestCustomNamedGetter::GetTemplate):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore::V8TestEventConstructor::GetRawTemplate):
+        (WebCore::V8TestEventConstructor::GetTemplate):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore::V8TestEventTarget::GetRawTemplate):
+        (WebCore::V8TestEventTarget::GetTemplate):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore::V8TestException::GetRawTemplate):
+        (WebCore::V8TestException::GetTemplate):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::GetRawTemplate):
+        (WebCore::V8TestInterface::GetTemplate):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore::V8TestMediaQueryListListener::GetRawTemplate):
+        (WebCore::V8TestMediaQueryListListener::GetTemplate):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructor::GetRawTemplate):
+        (WebCore::V8TestNamedConstructor::GetTemplate):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::GetRawTemplate):
+        (WebCore::V8TestNode::GetTemplate):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::V8TestObj::GetRawTemplate):
+        (WebCore::V8TestObj::GetTemplate):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::V8TestSerializedScriptValueInterface::GetRawTemplate):
+        (WebCore::V8TestSerializedScriptValueInterface::GetTemplate):
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::getCurrentStore):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::allStores):
+        * bindings/v8/ScriptGCEvent.cpp:
+        (WebCore::isolateGCEventData):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::visitExternalStrings):
+        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
+        * bindings/v8/StaticDOMDataStore.cpp:
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        (WebCore::StaticDOMDataStore::~StaticDOMDataStore):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::V8PerIsolateData::visitExternalStrings):
+        (WebCore::getToStringName):
+        (WebCore::getToStringTemplate):
+        * bindings/v8/V8Binding.h:
+        (WebCore::ConstructorMode::ConstructorMode):
+        (WebCore::ConstructorMode::~ConstructorMode):
+        (WebCore::ConstructorMode::current):
+        (WebCore::v8ExternalString):
+        (WebCore::v8Integer):
+        (WebCore::v8UnsignedInteger):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
+        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::currentGlobalHandleMap):
+        (WebCore::V8GCController::gcPrologue):
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8PerIsolateData.cpp: Renamed from Source/WebCore/bindings/v8/V8BindingPerIsolateData.cpp.
+        (WebCore):
+        (WebCore::V8PerIsolateData::V8PerIsolateData):
+        (WebCore::V8PerIsolateData::~V8PerIsolateData):
+        (WebCore::V8PerIsolateData::create):
+        (WebCore::V8PerIsolateData::ensureInitialized):
+        (WebCore::V8PerIsolateData::dispose):
+        (WebCore::V8PerIsolateData::reportMemoryUsage):
+        * bindings/v8/V8PerIsolateData.h: Renamed from Source/WebCore/bindings/v8/V8BindingPerIsolateData.h.
+        (WebCore):
+        (V8PerIsolateData):
+        (WebCore::V8PerIsolateData::current):
+        (WebCore::V8PerIsolateData::rawTemplateMap):
+        (WebCore::V8PerIsolateData::templateMap):
+        (WebCore::V8PerIsolateData::toStringName):
+        (WebCore::V8PerIsolateData::toStringTemplate):
+        (WebCore::V8PerIsolateData::lazyEventListenerToStringTemplate):
+        (WebCore::V8PerIsolateData::stringCache):
+        (WebCore::V8PerIsolateData::integerCache):
+        (WebCore::V8PerIsolateData::allStores):
+        (WebCore::V8PerIsolateData::hiddenPropertyName):
+        (WebCore::V8PerIsolateData::auxiliaryContext):
+        (WebCore::V8PerIsolateData::registerDOMDataStore):
+        (WebCore::V8PerIsolateData::unregisterDOMDataStore):
+        (WebCore::V8PerIsolateData::domDataStore):
+        (WebCore::V8PerIsolateData::setDOMDataStore):
+        (WebCore::V8PerIsolateData::recursionLevel):
+        (WebCore::V8PerIsolateData::incrementRecursionLevel):
+        (WebCore::V8PerIsolateData::decrementRecursionLevel):
+        (WebCore::V8PerIsolateData::globalHandleMap):
+        (WebCore::V8PerIsolateData::internalScriptRecursionLevel):
+        (WebCore::V8PerIsolateData::incrementInternalScriptRecursionLevel):
+        (WebCore::V8PerIsolateData::decrementInternalScriptRecursionLevel):
+        (WebCore::V8PerIsolateData::gcEventData):
+        (WebCore::V8PerIsolateData::setShouldCollectGarbageSoon):
+        (WebCore::V8PerIsolateData::clearShouldCollectGarbageSoon):
+        (WebCore::V8PerIsolateData::shouldCollectGarbageSoon):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::hintForGCIfNecessary):
+        * bindings/v8/V8RecursionScope.h:
+        (WebCore::V8RecursionScope::V8RecursionScope):
+        (WebCore::V8RecursionScope::~V8RecursionScope):
+        (WebCore::V8RecursionScope::recursionLevel):
+        (WebCore::V8RecursionScope::properlyUsed):
+        (WebCore::V8RecursionScope::MicrotaskSuppression::MicrotaskSuppression):
+        (WebCore::V8RecursionScope::MicrotaskSuppression::~MicrotaskSuppression):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::V8AuxiliaryContext::auxiliaryContext):
+        * bindings/v8/V8ValueCache.cpp:
+        (WebCore::cachedStringCallback):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initIsolate):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::WorkerScriptController):
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+
+2012-08-09  Mike West  <mkwst@chromium.org>
+
+        Invalid Content Security Policy sources should generate console warnings.
+        https://bugs.webkit.org/show_bug.cgi?id=93599
+
+        Reviewed by Adam Barth.
+
+        Given a Content Security Policy directive, we're currently correctly
+        ignoring sources that we can't parse: "'slef'", "http:///", etc. have
+        no effect on the protected resource's active policy. We're not, however
+        telling the developer what we're doing, which can lead to confusion.
+        This patch adds a console warning whenever an invalid source expression
+        is encountered while parsing a directive in order to make WebKit's
+        behavior more transparent to the developer.
+
+        There should be no functional change as a result of this patch: the
+        policy should be parsed exactly as before, it should simply be more
+        verbose.
+
+        Test: http/tests/security/contentSecurityPolicy/source-list-parsing-07.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPSourceList::parse):
+            Two changes: First, if 'parseSource' returns false, then log a
+            warning to the developer's console. Second, if both the source and
+            host are empty, but parsing succeeded, then we know we're dealing
+            with either a wildcard- or keyword-source that was properly handled
+            inside 'parseSource', so jump to the next source.
+        (WebCore::CSPSourceList::parseSource):
+            Wildcard- and keyword-sources now return 'true'. They parsed
+            correctly, after all.
+        (WebCore::ContentSecurityPolicy::reportInvalidSourceExpression):
+            Log a console warning if an invalid source expression is present in
+            a CSP directive's value.
+        (WebCore):
+        * page/ContentSecurityPolicy.h:
+
+2012-08-06  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Expose CCGraphicsContext as WebCompositorOutputSurface
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCGraphicsContext.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::recreateContext):
+        (WebCore::CCLayerTreeHost::createContext):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        (CCLayerTreeHostClient):
+        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
+        (CCLayerTreeSettings):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::onVSyncParametersChanged):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (WebKit):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRendererClient):
+        (WebCore::CCRendererClient::~CCRendererClient):
+        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
+        * platform/graphics/chromium/cc/CCResourceProvider.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::recreateContext):
+        (WebCore::CCThreadProxy::onVSyncParametersChanged):
+        (WebCore):
+        (WebCore::CCThreadProxy::beginFrame):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2012-08-09  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>
+
+        [css3-text] Add suport for -webkit-text-decoration-line
+        https://bugs.webkit.org/show_bug.cgi?id=90959
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        This patch implements the "text-decoration-line" property specified in CSS3
+        working draft, with "-webkit-" prefix. The specification can be found below:
+        http://dev.w3.org/csswg/css3-text/#text-decoration-line
+
+        Additionally, Mozilla implementation details can be found here:
+        https://developer-dev.allizom.org/en-US/docs/CSS/text-decoration-line
+
+        It is important to notice that "-webkit-text-decoration-line" and
+        "text-decoration" properties shares the same property handlers, however, the
+        former resets the latter if value from latter doesn't have "important" value
+        set (same behavior as Firefox). In a rare case where both properties have
+        "important" value set, the text decoration gets value from the last parsed
+        property.
+
+        Test: fast/css/text-decoration-line.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::renderTextDecorationFlagsToCSSValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::addTextDecorationProperty):
+        (WebCore::CSSParser::parseTextDecoration):
+        * css/CSSParser.h:
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/StyleBuilder.cpp:
+        (WebCore::StyleBuilder::StyleBuilder):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-08-09  Huang Dongsung  <luxtella@company100.net>
+
+        Extract the definition of NativeImagePtr from ImageSource.h into NativeImagePtr.h.
+        https://bugs.webkit.org/show_bug.cgi?id=93466
+
+        Reviewed by Adam Barth.
+
+        Image.h includes ImageSource.h in order to know the definition of NativeImagePtr.
+        But Image does not need to know the definition of ImageSource. So, this patch
+        extracts the definition of NativeImagePtr from ImageSource.h into NativeImagePtr.h.
+
+        This is a preparation for asynchronous image decoding. Async decoding
+        will need a callback function, which sends a NativeImagePtr to clients, and the
+        callback must know the definition of NativeImagePtr, not ImageSource.
+
+        No new tests, behavior is unchanged.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/Image.h:
+        * platform/graphics/ImageSource.h:
+        (WebCore):
+        * platform/graphics/NativeImagePtr.h: Added.
+        (WebCore):
+
+2012-08-09  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: 'Text-indent' only affects a line if it is the first formatted line of an element
+        https://bugs.webkit.org/show_bug.cgi?id=63185
+
+        Reviewed by Eric Seidel.
+
+        Per CSS 2.1 (http://www.w3.org/TR/CSS21/text.html) : "'Text-indent' only affects a line if it is the 
+        first formatted line of an element. For example, the first line of an anonymous block box is only 
+        affected if it is the first child of its parent element."
+
+        Tests: fast/css/text-indent-first-line-001.html
+               fast/css/text-indent-first-line-002.html
+               fast/css/text-indent-first-line-003.html
+               fast/css/text-indent-first-line-004.html
+               fast/css/text-indent-first-line-005.html
+               fast/css/text-indent-first-line-006.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): As well as being the first line under a parent block,
+          check that this is also the first *formatted* line of an element by ensuring that we are at the start of a 
+          formatting context and not just a continuation of a previous anonymous block in an existing formatting context.
+
+2012-08-09  Jan Keromnes  <janx@linux.com>
+
+        Web Inspector: replace the Web Inspector editor with CodeMirror
+        https://bugs.webkit.org/show_bug.cgi?id=92769
+
+        Reviewed by Pavel Feldman.
+
+        Integrating CodeMirror as a devtools experiment. Currently supporting
+        basic editing, search/replacing, and saving. Missing proper breakpoints
+        wiring, debugging, message bubbles, popovers and context menus. WIP.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/CodeMirrorTextEditor.js: Added.
+        (WebInspector.CodeMirrorTextEditor.this._codeMirror.CodeMirror):
+        (WebInspector.CodeMirrorTextEditor):
+        (WebInspector.CodeMirrorTextEditor.prototype.set mimeType):
+        (WebInspector.CodeMirrorTextEditor.prototype.setReadOnly):
+        (WebInspector.CodeMirrorTextEditor.prototype.readOnly):
+        (WebInspector.CodeMirrorTextEditor.prototype.defaultFocusedElement):
+        (WebInspector.CodeMirrorTextEditor.prototype.focus):
+        (WebInspector.CodeMirrorTextEditor.prototype.revealLine):
+        (WebInspector.CodeMirrorTextEditor.prototype.addDecoration):
+        (WebInspector.CodeMirrorTextEditor.prototype.removeDecoration):
+        (WebInspector.CodeMirrorTextEditor.prototype.markAndRevealRange):
+        (WebInspector.CodeMirrorTextEditor.prototype.highlightLine):
+        (WebInspector.CodeMirrorTextEditor.prototype.clearLineHighlight):
+        (WebInspector.CodeMirrorTextEditor.prototype.freeCachedElements):
+        (WebInspector.CodeMirrorTextEditor.prototype.elementsToRestoreScrollPositionsFor):
+        (WebInspector.CodeMirrorTextEditor.prototype.inheritScrollPositions):
+        (WebInspector.CodeMirrorTextEditor.prototype.beginUpdates):
+        (WebInspector.CodeMirrorTextEditor.prototype.endUpdates):
+        (WebInspector.CodeMirrorTextEditor.prototype.onResize):
+        (WebInspector.CodeMirrorTextEditor.prototype.editRange):
+        (WebInspector.CodeMirrorTextEditor.prototype._onChange):
+        (WebInspector.CodeMirrorTextEditor.prototype._commitEditing):
+        (WebInspector.CodeMirrorTextEditor.prototype.scrollToLine):
+        (WebInspector.CodeMirrorTextEditor.prototype.selection):
+        (WebInspector.CodeMirrorTextEditor.prototype.lastSelection):
+        (WebInspector.CodeMirrorTextEditor.prototype.setSelection):
+        (WebInspector.CodeMirrorTextEditor.prototype.setText):
+        (WebInspector.CodeMirrorTextEditor.prototype.text):
+        (WebInspector.CodeMirrorTextEditor.prototype.range):
+        (WebInspector.CodeMirrorTextEditor.prototype.line):
+        (WebInspector.CodeMirrorTextEditor.prototype.get linesCount):
+        (WebInspector.CodeMirrorTextEditor.prototype.setAttribute):
+        (WebInspector.CodeMirrorTextEditor.prototype.getAttribute):
+        (WebInspector.CodeMirrorTextEditor.prototype.removeAttribute):
+        (WebInspector.CodeMirrorTextEditor.prototype.wasShown):
+        (WebInspector.CodeMirrorTextEditor.prototype.willHide):
+        (WebInspector.CodeMirrorTextEditor.prototype._textChanged):
+        (WebInspector.CodeMirrorTextEditor.prototype._toPos):
+        (WebInspector.CodeMirrorTextEditor.prototype._toRange):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/cmdevtools.css: Added.
+        * inspector/front-end/inspector.html:
+
+2012-08-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Do partial-swap scissoring on quads during draw instead of on layers
+        https://bugs.webkit.org/show_bug.cgi?id=91800
+
+        Reviewed by Adrienne Walker.
+
+        Computing the scissor rect for each render pass is now done in
+        LayerRendererChromium::drawRenderPass() instead of being done for each
+        layer and then copied into the quads. This allows us to always push a
+        full frame of quads (and include damage rects) from a child compositor,
+        and do partial-swap scissoring in the host compositor.
+
+        This also make partial-swap functionality completely contained within
+        LayerRendererChromium!
+
+        The scissorRect is removed from all layers, and the concept of
+        scissorRect is now misplaced in CCOcclusionTracker, so the variables
+        and methods in the tracker should be renamed to more appropriate
+        things.
+
+        Covered by existing tests, as well as: CCLayerTreeHostImplTest.textureCachingWithScissor
+
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::clearFramebuffer):
+        (WebCore::LayerRendererChromium::renderPassTextureSize):
+        (WebCore::LayerRendererChromium::drawFrame):
+        (WebCore::LayerRendererChromium::drawRenderPass):
+        (WebCore::LayerRendererChromium::drawQuad):
+        (WebCore::LayerRendererChromium::drawDebugBorderQuad):
+        (WebCore::LayerRendererChromium::drawBackgroundFilters):
+        (WebCore::LayerRendererChromium::drawTileQuad):
+        (WebCore::LayerRendererChromium::swapBuffers):
+        (WebCore::LayerRendererChromium::useRenderPass):
+        (WebCore::LayerRendererChromium::setScissorToRect):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        (DrawingFrame):
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (RenderSurfaceChromium):
+        * platform/graphics/chromium/cc/CCDrawQuad.h:
+        (WebCore::CCDrawQuad::clippedRectInTarget):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::createSharedQuadState):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::updateLayers):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateVisibleRectsInternal):
+        (WebCore::CCLayerTreeHostCommon::calculateVisibleRects):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
+        (CCLayerTreeHostCommon):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
+        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        (WebCore::CCLayerTreeHostImpl::swapBuffers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::layerScissorRectInTargetSurface):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::CCRenderPass):
+        (WebCore::CCRenderPass::appendQuadsToFillScreen):
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (CCRenderPass):
+        (WebCore::CCRenderPass::transformToRootTarget):
+        (WebCore::CCRenderPass::outputRect):
+        (WebCore::CCRenderPass::damageRect):
+        (WebCore::CCRenderPass::setDamageRect):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::computeClippedRectInTarget):
+        (WebCore):
+        (WebCore::CCRenderSurface::createSharedQuadState):
+        (WebCore::CCRenderSurface::createReplicaSharedQuadState):
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (CCRenderSurface):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRenderer):
+        * platform/graphics/chromium/cc/CCSharedQuadState.cpp:
+        (WebCore::CCSharedQuadState::create):
+        (WebCore::CCSharedQuadState::CCSharedQuadState):
+        * platform/graphics/chromium/cc/CCSharedQuadState.h:
+        (CCSharedQuadState):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        (WebCore::CCTiledLayerImpl::appendQuads):
+
+2012-08-09  Mike West  <mkwst@chromium.org>
+
+        Content Security Policy directives that begin with an invalid character should log a console warning.
+        https://bugs.webkit.org/show_bug.cgi?id=93622
+
+        Reviewed by Adam Barth.
+
+        CSP directives containing unrecognized characters somewhere in the
+        middle were caught and logged by the current algorithm. We additionally
+        caught the case in which the directive begins with an invalid character,
+        but we silently ignored it. Now we're slightly more vocal.
+
+        This change also exits 'parseDirective' early in the case where the
+        directive text is empty, or filled only with whitespace. There doesn't
+        seem to be any value in flagging that case, as it has no impact on the
+        way the policy would have been interpreted (that is, 'img-src *;;...'
+        doesn't change in meaning by ignoring the empty directive between the
+        semicolons).
+
+        Test: http/tests/security/contentSecurityPolicy/directive-parsing-05.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPDirectiveList::parseDirective):
+            Two changes: first, we now exit early if the entire directive text
+            is empty (e.g. ';;;' or ';      ;'); second, if the directive begins
+            with a character that doesn't match 'isDirectiveNameCharacter', then
+            we advance either to the next space, or the end of the value, and
+            report an unrecognized directive to the policy.
+
+2012-08-09  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Pass mask scale and offset to shaders for correct masking
+        https://bugs.webkit.org/show_bug.cgi?id=93558
+
+        Reviewed by Adrienne Walker.
+
+        In chromium compositor code, the mask was accidentally mapped 1:1
+        to the layer's renderSurface, rather than the layer itself. This
+        patch adds a layout test that reproduces the error and fixes the
+        problem. The solution we opted for in this patch is to pass a
+        scale and offset to the fragment shader, so that the correct
+        texture coordinate lookup is computed by the fragment shader.
+
+        Test: compositing/masks/mask-of-clipped-layer.html
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawRenderPassQuad):
+        * platform/graphics/chromium/ShaderChromium.cpp:
+        (WebCore::FragmentShaderRGBATexAlphaMask::FragmentShaderRGBATexAlphaMask):
+        (WebCore::FragmentShaderRGBATexAlphaMask::init):
+        (WebCore::FragmentShaderRGBATexAlphaMask::getShaderString):
+        (WebCore::FragmentShaderRGBATexAlphaMaskAA::FragmentShaderRGBATexAlphaMaskAA):
+        (WebCore::FragmentShaderRGBATexAlphaMaskAA::init):
+        (WebCore::FragmentShaderRGBATexAlphaMaskAA::getShaderString):
+        * platform/graphics/chromium/ShaderChromium.h:
+        (WebCore::FragmentShaderRGBATexAlphaMask::maskTexCoordScaleLocation):
+        (WebCore::FragmentShaderRGBATexAlphaMask::maskTexCoordOffsetLocation):
+        (FragmentShaderRGBATexAlphaMask):
+        (WebCore::FragmentShaderRGBATexAlphaMaskAA::maskTexCoordScaleLocation):
+        (WebCore::FragmentShaderRGBATexAlphaMaskAA::maskTexCoordOffsetLocation):
+        (FragmentShaderRGBATexAlphaMaskAA):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
+        (WebCore::CCRenderPassDrawQuad::create):
+        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
+        (CCRenderPassDrawQuad):
+        (WebCore::CCRenderPassDrawQuad::maskTexCoordScaleX):
+        (WebCore::CCRenderPassDrawQuad::maskTexCoordScaleY):
+        (WebCore::CCRenderPassDrawQuad::maskTexCoordOffsetX):
+        (WebCore::CCRenderPassDrawQuad::maskTexCoordOffsetY):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::appendQuads):
+
+2012-08-09  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        CSSRegions: Crash when attaching a region to the removed named flow
+        https://bugs.webkit.org/show_bug.cgi?id=93204
+
+        Reviewed by Abhishek Arya.
+
+        The crash happens because the flow thread reference is passed to the RenderRegion object
+        when the RenderRegion object is created. However, it is only in RenderRegion::attachRegion method
+        when the region is taken into account and stored in flow thread regions list. Under these circumstances,
+        it is possible that the flow thread passed to the region at the moment of region creation be destroyed
+        before the region gets the chance to be attached to the flow thread and a crash will occur.
+
+        This patch moves the moment when the RenderRegion object stores its 'weak' reference to the flow thread
+        from RenderRegion constructor to attachRegion method, preventing the situation in which the region is attached
+        to a wrong flow thread object.
+
+        Test: fast/regions/region-attached-wrong-flow-crash.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject): Pass 0 instead of a reference to the flow thread.
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::checkRegionStyle): Added this function to check whether the region has region style rules attached.
+        (WebCore):
+        (WebCore::RenderRegion::styleDidChange): Use checkRegionStyle.
+        (WebCore::RenderRegion::attachRegion): Store the reference to the flow thread. If the flow thread does not exist, it will be created.
+        Also, check whether the region has region style rules attached, since at this moment the region has a flow thread. Checking whether
+        the region has region style rules is not enough in styleDidChange, because styleDidChange is sometimes triggered before attachRegion.
+        * rendering/RenderRegion.h:
+        (RenderRegion):
+
+2012-08-09  Iain Merrick  <husky@chromium.org>
+
+        [chromium] Enable kerning on Android
+        https://bugs.webkit.org/show_bug.cgi?id=92737
+
+        Reviewed by Adam Barth.
+
+        This #ifdef was incorrectly copied from our forked WebKit repository
+        while unforking our Android-specific changes. Kerning works without
+        any known problems.
+
+        Covered by existing tests (layout and instrumentation tests).
+
+        * platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp:
+        (WebCore::ComplexTextController::ComplexTextController):
+
+2012-08-09  'Pavel Feldman'  <pfeldman@chromium.org>
+
+        Web Inspector: follow up to r125174 - fix subtype use.
+
+        Not reviewed, trivial fix.
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+
+2012-08-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: DocumentEventQueue memory instrumentation
+        https://bugs.webkit.org/show_bug.cgi?id=93604
+
+        Reviewed by Pavel Feldman.
+
+        Provided DocumentEventQueue:: reportMemoryUsage implementation.
+
+        * dom/Document.cpp:
+        (WebCore::Document::reportMemoryUsage):
+        * dom/DocumentEventQueue.cpp:
+        (WebCore::DocumentEventQueue::reportMemoryUsage):
+        (WebCore):
+        * dom/DocumentEventQueue.h:
+        (WebCore):
+        * dom/Event.cpp:
+        (WebCore::Event::reportMemoryUsage):
+        (WebCore):
+        * dom/Event.h:
+        (WebCore):
+        (Event):
+
+2012-08-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: add codemirror library as an experiment
+        https://bugs.webkit.org/show_bug.cgi?id=93620
+
+        Reviewed by Vsevolod Vlasov.
+
+        This change adds codemirror, deploys it, but does not include it into the inspector.html. Clients need to fetch it
+        using XHR and eval into the inspector's context to use as a part of their experiments.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/cm/LICENSE: Added.
+        * inspector/front-end/cm/codemirror.css: Added.
+        (.CodeMirror):
+        * inspector/front-end/cm/xml.js: Added.
+        (CodeMirror.defineMode.):
+        (CodeMirror.defineMode):
+
+2012-08-09  Xan Lopez  <xlopez@igalia.com>
+
+        1.9.6 drops symbols, breaking compatibility
+        https://bugs.webkit.org/show_bug.cgi?id=93477
+
+        Reviewed by Carlos Garcia Campos.
+
+        Expose documentURI as writable again for the GObject DOM
+        bindings. DOM4 makes it read-only, but we need to revert to the
+        old state for compatibility reasons, just like Objective C.
+
+        * dom/Document.idl: ditto.
+
+2012-08-09  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        REGRESSION (r124997): Flaky crashes in two tests
+        https://bugs.webkit.org/show_bug.cgi?id=93501
+
+        Reviewed by Martin Robinson.
+
+        Add missing null check to make sure we early return if the
+        accessibility object does not have a valid parent exposed in the
+        accessibility hierarchy.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::emitTextChanged): Add missing null check.
+
+2012-08-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: generate preview for the objects dumped into the console upon logging.
+        https://bugs.webkit.org/show_bug.cgi?id=35801
+
+        Reviewed by Vsevolod Vlasov.
+
+        As of today, dumping an object (array) into console will result in objects' properties being
+        read upon console object expansion (i.e. lazily). This means that dumping the same object while
+        mutating it will be hard to debug using the console.
+
+        This change starts generating abbreviated previews for objects / arrays at the moment of their
+        logging and passes this information along into the front-end. This only happens when the front-end
+        is already opened, it only works for console.log(), not live console interaction.
+
+        Covered by the existing console tests + collections test has been expanded to capture both: pre and post-
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        (ConsoleMessage):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::wrapObject):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::enable):
+        (WebCore::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._format):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameter):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsObject):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArrayOrObject):
+        (WebInspector.ConsoleMessageImpl.prototype._appendObjectPreview):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsNode):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArray):
+        (WebInspector.ConsoleMessageImpl.prototype._printArray):
+        (WebInspector.ConsoleMessageImpl.prototype._formatAsArrayEntry):
+        (WebInspector.ConsoleMessageImpl.prototype._formatWithSubstitutionString):
+        * inspector/front-end/DOMExtension.js:
+        (Element.prototype.createTextChild):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection):
+        * inspector/front-end/PropertiesSection.js:
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject):
+        (WebInspector.RemoteObject.fromPayload):
+        (WebInspector.RemoteObject.prototype.get preview):
+        * inspector/front-end/Section.js:
+        * inspector/front-end/inspector.css:
+        (.console-group-messages .section .header .title):
+        (.section .console-formatted-node):
+        (.console-object-preview):
+        (.section .properties .name, .event-properties .name, .console-formatted-object .name):
+
+2012-08-09  Keishi Hattori  <keishi@webkit.org>
+
+        Page popups can show up at wrong locations
+        https://bugs.webkit.org/show_bug.cgi?id=93556
+
+        Reviewed by Kent Tamura.
+
+        No new tests. Cannot test popup position.
+
+        * html/shadow/CalendarPickerElement.cpp:
+        (WebCore::CalendarPickerElement::contentSize):
+
+2012-08-08  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: display progress bar while loading timeline data
+        https://bugs.webkit.org/show_bug.cgi?id=92762
+
+        Reviewed by Pavel Feldman.
+
+        - display progress while loading timeline data;
+        - disable status bar buttons while operation is in progress;
+        - ignore save/load/record while operation is in progress;
+        - disable context menu items while operation is in progress;
+        - misc. compilation warning fixes;
+
+        * inspector/front-end/ProgressBar.js:
+        (WebInspector.CompositeProgress.prototype.createSubProgress):
+        * inspector/front-end/TimelineModel.js:
+        (WebInspector.TimelineModel.prototype._loadNextChunk):
+        (WebInspector.TimelineModel.prototype.loadFromFile.parseAndImportData):
+        (WebInspector.TimelineModel.prototype.loadFromFile.onLoad):
+        (WebInspector.TimelineModel.prototype.loadFromFile.onError):
+        (WebInspector.TimelineModel.prototype.loadFromFile.onProgress):
+        (WebInspector.TimelineModel.prototype.loadFromFile):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype._createStatusBarItems):
+        (WebInspector.TimelinePanel.prototype._setOperationInProgress):
+        (WebInspector.TimelinePanel.prototype._contextMenu):
+        (WebInspector.TimelinePanel.prototype._saveToFile):
+        (WebInspector.TimelinePanel.prototype._loadFromFile):
+        (WebInspector.TimelinePanel.prototype.get _toggleTimelineButtonClicked):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        * inspector/front-end/utilities.js: added Array.prototype.select(field) to map array of objects to array containing particular field of each object.
+
+2012-08-09  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Floored and truncated rounded confused.
+        https://bugs.webkit.org/show_bug.cgi?id=93475
+
+        Reviewed by Levi Weintraub.
+
+        Fix the common mistake of confusing truncating (round towards zero) and
+        flooring (round down). They are only identical for positive numbers,
+        not for negative numbers.
+
+        This patch fixes instances of misimplemented or misused floor in the
+        layout and geometric code. And also uses the new correct implementations
+        to clean up the code for enclosingRect.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::fromFloatFloor):
+        (FractionalLayoutUnit):
+        (WebCore::FractionalLayoutUnit::ceil):
+        (WebCore::FractionalLayoutUnit::floor):
+        * platform/graphics/FloatPoint.h:
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore::roundedIntPoint):
+        (WebCore::flooredIntPoint):
+        (WebCore::ceiledIntPoint):
+        (WebCore::flooredIntSize):
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::enclosingIntRect):
+        (WebCore::enclosedIntRect):
+        * platform/graphics/FloatSize.h:
+        (WebCore::roundedIntSize):
+        (WebCore::flooredIntSize):
+        (WebCore::flooredIntPoint):
+        * platform/graphics/FractionalLayoutPoint.h:
+        (WebCore::flooredIntPoint):
+        (WebCore::flooredFractionalLayoutPoint):
+        (WebCore::ceiledFractionalLayoutPoint):
+        * platform/graphics/FractionalLayoutRect.cpp:
+        (WebCore::enclosingIntRect):
+        (WebCore::enclosingFractionalLayoutRect):
+        * platform/graphics/FractionalLayoutSize.h:
+        (WebCore::flooredIntSize):
+        * platform/graphics/IntRect.cpp:
+        (WebCore::IntRect::IntRect):
+        * rendering/LayoutTypes.h:
+        (WebCore::flooredLayoutPoint):
+        (WebCore::floorToInt):
+        (WebCore::isIntegerValue):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::convertToLayerCoords):
+
+2012-08-07  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: use WebInspector.ProgressIndicator in AdvancedSearchController
+        https://bugs.webkit.org/show_bug.cgi?id=93362
+
+        Reviewed by Vsevolod Vlasov.
+
+        - drop custom status bar used in AdvancedSearchController, use WebInspector.ProgressIndicator;
+        - perform additional cancelation check after invoking searchResultCallback to account for stopSearch called from within callback;
+        - fix compilation warnings in ProgressBar;
+
+        * inspector/front-end/AdvancedSearchController.js:
+        (WebInspector.SearchView):
+        (WebInspector.SearchView.prototype.searchStarted):
+        (WebInspector.SearchView.prototype.addSearchResult):
+        (WebInspector.SearchView.prototype.searchFinished):
+        (WebInspector.SearchView.prototype._onCancel):
+        * inspector/front-end/ProgressBar.js:
+        (WebInspector.CompositeProgress.prototype.createSubProgress):
+        * inspector/front-end/ScriptsSearchScope.js:
+        (WebInspector.ScriptsSearchScope.prototype.performSearch.searchCallbackWrapper):
+        * inspector/front-end/inspector.css:
+        (.progress-bar-container progress):
+        (body.platform-mac .progress-bar-container progress):
+
+2012-08-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: improve large array logging experience
+        https://bugs.webkit.org/show_bug.cgi?id=93499
+
+        Reviewed by Vsevolod Vlasov.
+
+        Group elements in chunks of 100, not smaller. 
+
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.FunctionScopeMainTreeElement):
+        (WebInspector.FunctionScopeMainTreeElement.prototype.onpopulate):
+        (WebInspector.ArrayGroupingTreeElement._populateRanges):
+
+2012-08-09  MORITA Hajime  <morrita@google.com>
+
+        DOMCharacterDataModified should not be fired inside shadows
+        https://bugs.webkit.org/show_bug.cgi?id=93427
+
+        Reviewed by Ryosuke Niwa.
+
+        CharacterData::dispatchModifiedEvent() fires DOMCharacterDataModified event even if
+        the node is in shadow. But it shouldn't. Check dispatchChildInsertionEvents() and
+        dispatchChildRemovalEvents() to see how other MutationEvents are suppressed behind shadows.
+        This change follows the same path to suppress DOMCharacterDataModified.
+
+        Tests: fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html
+               fast/forms/textarea-and-mutation-events-appending-text.html
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+
+2012-08-09  Eric Seidel  <eric@webkit.org>
+
+        Use m_everHadLayout in RenderObject::checkForRepaintDuringLayout()
+        https://bugs.webkit.org/show_bug.cgi?id=20885
+
+        Reviewed by Dan Bernstein.
+
+        Fix FIXME in checkForRepaintDuringLayout, making RenderObjects
+        no longer paint on first layout, but instead require their
+        parent containers to paint them.
+        This appears to have fixed one minor SVG overpainting issue
+        in svg/use-detach-expected.png.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::checkForRepaintDuringLayout):
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::layoutChildren):
+
+2012-08-08  Arko Saha  <arko@motorola.com>
+
+        Microdata: PropertyNodeList cache should be invalidated on id attribute change.
+        https://bugs.webkit.org/show_bug.cgi?id=93485
+
+        Reviewed by Ryosuke Niwa.
+
+        Invalidate PropertyNodeList cache when id attribute of an element changed/modified.
+
+        Test: fast/dom/MicroData/propertiescollection-on-changing-id-attr.html
+
+        * dom/DynamicNodeList.cpp: Moved ownerNodeHasItemRefAttribute() method to DynamicNodeList.h
+        (WebCore):
+        * dom/DynamicNodeList.h:
+        (WebCore):
+        (WebCore::DynamicNodeListCacheBase::isRootedAtDocument): Return true if owner has itemref
+        attribute specified with root type NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr.
+        (WebCore::DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChange): Return true if
+        attrName is id attribute in case of InvalidateOnItemAttrChange.
+        (WebCore::DynamicNodeListCacheBase::ownerNodeHasItemRefAttribute):
+
+2012-08-09  Arko Saha  <arko@motorola.com>
+
+        Microdata: HTMLPropertiesCollection does not contain all properties when item is not attached to the DOM tree.
+        https://bugs.webkit.org/show_bug.cgi?id=93456
+
+        Reviewed by Ryosuke Niwa.
+
+        HTMLPropertiesCollection does not contain the item properties added through
+        itemref attribute when item is not attached to the DOM tree. We need to
+        find the root node of the item if its not attached in the document.
+
+        It is also possible that itemref attribute of item refers to the root node.
+        Made changes in getItemRefElements() method so that the traversal should
+        start from the root node.
+
+        Tests: fast/dom/MicroData/add-remove-property-to-item-which-is-not-attached-to-domtree.html
+               fast/dom/MicroData/item-not-attached-to-domtree.html
+               fast/dom/MicroData/itemref-pointing-to-root-node.html
+
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeListCacheBase::rootNode):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::getItemRefElements):
+
+2012-08-09  Tim Horton  <timothy_horton@apple.com>
+
+        Add optional debug logging for tiled scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=93305
+
+        Reviewed by Simon Fraser.
+
+        Add scrolling performance logging to ScrollingTreeNodeMac and WebTileLayer, which will log
+        the amount of unpainted area exposed during scrolling and painting, respectively.
+
+        The logging output looks like this:
+
+            SCROLLING: Exposed tileless area. Time: 1344464850.154839 Unfilled Pixels: 1122008
+            SCROLLING: Filled visible fresh tile. Time: 1344464850.575303 Unfilled Pixels: 1078272
+            SCROLLING: Filled visible fresh tile. Time: 1344464850.676569 Unfilled Pixels: 823808
+            SCROLLING: Filled visible fresh tile. Time: 1344464850.795877 Unfilled Pixels: 569344
+            SCROLLING: Filled visible fresh tile. Time: 1344464850.846940 Unfilled Pixels: 524288
+            SCROLLING: Filled visible fresh tile. Time: 1344464850.984113 Unfilled Pixels: 262144
+            SCROLLING: Filled visible fresh tile. Time: 1344464851.027985 Unfilled Pixels: 0
+
+        No new tests, as this is just debugging logging.
+
+        * WebCore.exp.in:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setScrollingPerformanceLoggingEnabled):
+        Added setScrollingPerformanceLoggingEnabled, passes flag into TiledBacking.
+
+        * page/FrameView.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setScrollingPerformanceLoggingEnabled):
+        Added setScrollingPerformanceLoggingEnabled, passes flag into FrameView.
+
+        * page/Settings.h:
+        (WebCore::Settings::scrollingPerformanceLoggingEnabled):
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::ScrollingTree):
+        (WebCore::ScrollingTree::setScrollingPerformanceLoggingEnabled):
+        (WebCore::ScrollingTree::scrollingPeformanceLoggingEnabled):
+        Added ScrollingPerformanceLoggingEnabled setter/getter; this is where it's accessed from ScrollingTreeNodeMac.
+
+        * page/scrolling/ScrollingTree.h:
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        (ScrollingTreeNodeMac):
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
+        When updating scroll position, conditionally log the amount of unpainted area that was just exposed.
+
+        (WebCore::ScrollingTreeNodeMac::logExposedTilelessArea):
+        * platform/graphics/TiledBacking.h:
+        (WebCore::TiledBacking::TiledBacking):
+        (WebCore::TiledBacking::setScrollingPerformanceLoggingEnabled):
+        (WebCore::TiledBacking::scrollingPerformanceLoggingEnabled):
+        Added ScrollingPerformanceLoggingEnabled setter/getter; this is where it's accessed from WebTileLayer.
+
+        * platform/graphics/ca/mac/TileCache.h:
+        (WebCore::TileCache::visibleRect):
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::blankPixelCount):
+        (WebCore::TileCache::blankPixelCountForTiles):
+        Compute the exposed, unpainted area of the tile cache by iterating over the layers,
+        checking if they've been painted, and subtracting painted layers from the total visible area.
+
+        * platform/graphics/ca/mac/WebTileLayer.h:
+        * platform/graphics/ca/mac/WebTileLayer.mm:
+        (-[WebTileLayer drawInContext:]):
+        (-[WebTileLayer repaintCount]):
+        (-[WebTileLayer logFilledFreshTile]):
+        When painting a WebTileLayer, conditionally log the amount of unpainted area remaining after painting said tile.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        Plumb ScrollingPerformanceLoggingEnabled through to TiledBacking.
+
+2012-08-08  Alpha Lam  <hclam@chromium.org>
+
+        Remove image decoding in some BitmapImage metadata functions
+        https://bugs.webkit.org/show_bug.cgi?id=93171
+
+        Reviewed by Simon Fraser.
+
+        These two metadata functions were decoding an entire frame:
+        - frameOrientationAtIndex
+        - frameHasAlphaAtIndex
+
+        This change removes image decoding from these two methods. This is for
+        preparation of having asynchronous image decoding, intending to reduce
+        code location that trigger image decoding.
+
+        frameOrientationAtIndex() doesn't require decoding a frame. This method
+        is only implemented in CG port in ImageSourceCG.cpp which doesn't do
+        image decoding.
+
+        frameHasAlphaAtIndex() is used to optimize certain drawing operations
+        and accelerated compositing. This change uses a heuristic for non-CG
+        port to determine if an image has alpha. If an image is not yet
+        decoded the function answers having alpha. Only if a frame is decoded
+        and cached that the alpha state of the frame is returned. This is an
+        admissible heuristic that postpone answering the question until a frame
+        is decoded.
+
+        Tested this change with a fully loaded image and partially loaded image
+        with background color.
+
+        Test: http/tests/images/jpg-img-partial-load.html
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::frameHasAlphaAtIndex):
+        (WebCore::BitmapImage::frameOrientationAtIndex):
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::frameHasAlphaAtIndex):
+        (WebCore):
+        * platform/image-decoders/ImageDecoder.h:
+        (ImageDecoder):
+
+2012-08-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r125146.
+        http://trac.webkit.org/changeset/125146
+        https://bugs.webkit.org/show_bug.cgi?id=93578
+
+        Would like to study fast/dom/Window/timer-null-script-
+        execution-context.html behavior change (Requested by abarth on
+        #webkit).
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore):
+        (WebCore::JSDOMWindowBase::crossDomainAccessErrorMessage):
+        (WebCore::JSDOMWindowBase::allowsAccessFrom):
+        * bindings/js/JSDOMWindowBase.h:
+        (JSDOMWindowBase):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::namedItemGetter):
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        (WebCore::JSDOMWindow::put):
+        (WebCore::JSDOMWindow::deleteProperty):
+        (WebCore::JSDOMWindow::getPropertyNames):
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        (WebCore::JSDOMWindow::defineOwnProperty):
+        (WebCore::JSDOMWindow::setLocation):
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindowBase::allowsAccessFrom):
+        (WebCore):
+        (WebCore::JSDOMWindowBase::allowsAccessFromNoErrorMessage):
+        (WebCore::JSDOMWindowBase::allowsAccessFromPrivate):
+        * bindings/js/JSInjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject _isSafeScript]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertyDescriptorBody):
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore::jsTestActiveDOMObjectExcitingAttr):
+        (WebCore::jsTestActiveDOMObjectConstructor):
+        (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):
+
+2012-08-05  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Unprefix window.webkitURL
+        https://bugs.webkit.org/show_bug.cgi?id=93034
+
+        Reviewed by Jian Li.
+
+        Adding unprefixed window.URL as other browsers like FireFox and Opera 12 seem to have the API unprefixed.
+        (This patch doesn't remove webkitURL yet as Safari and Chrome has exposed the URL for a while now.)
+
+        Test: fast/dom/DOMURL/check-instanceof-domurl-functions.html
+
+        * page/DOMWindow.cpp:
+        * page/DOMWindow.h:
+        (DOMWindow):
+        * page/DOMWindow.idl:
+        * workers/WorkerContext.idl:
+
+2012-08-08  MORITA Hajime  <morrita@google.com>
+
+        [SVG] load events shouldn't be fired during Node::insrtedInto()
+        https://bugs.webkit.org/show_bug.cgi?id=92969
+
+        Reviewed by Ryosuke Niwa.
+
+        Event dispatches during insertedInto() allow event handlers to
+        break DOM tree cosistency. This chagne makes them async for load
+        events which are dispatched during insertedInto() call. This
+        prevents event handlers from breaking tree consistency while the
+        notification traversal.
+
+        Test: svg/custom/loadevents-async.html
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::sendSVGLoadEventIfPossibleAsynchronously): Added.
+        (WebCore):
+        (WebCore::SVGElement::svgLoadEventTimerFired): Added.
+        (WebCore::SVGElement::svgLoadEventTimer):
+        - Added a stub. Implemented in SVGScriptElement, SVGStopElement, SVGUseElement
+          where the load event happens.
+        * svg/SVGElement.h:
+        (SVGElement):
+        * svg/SVGExternalResourcesRequired.cpp:
+        (WebCore::SVGExternalResourcesRequired::insertedIntoDocument):
+        - Replaces event dispatch call with async version.
+        * svg/SVGScriptElement.h:
+        * svg/SVGStyleElement.h:
+        * svg/SVGUseElement.h:
+
+2012-08-08  Adam Barth  <abarth@webkit.org>
+
+        Implement JSDOMWindow*::allowsAccessFrom* in terms of BindingSecurity
+        https://bugs.webkit.org/show_bug.cgi?id=93407
+
+        Reviewed by Eric Seidel.
+
+        This patch removes allowsAccessFrom and implements the security checks
+        in terms of shouldAllowAccessToFrame directly. There shouldn't be any
+        change in behavior.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore):
+        (WebCore::shouldAllowAccessFrom):
+        * bindings/js/JSDOMWindowBase.h:
+        (JSDOMWindowBase):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::namedItemGetter):
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        (WebCore::JSDOMWindow::put):
+        (WebCore::JSDOMWindow::deleteProperty):
+        (WebCore::JSDOMWindow::getPropertyNames):
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        (WebCore::JSDOMWindow::defineOwnProperty):
+        (WebCore::JSDOMWindow::setLocation):
+        * bindings/js/JSDOMWindowCustom.h:
+        * bindings/js/JSInjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject _isSafeScript]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertyDescriptorBody):
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore::jsTestActiveDOMObjectExcitingAttr):
+        (WebCore::jsTestActiveDOMObjectConstructor):
+        (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):
+
+2012-08-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r125143.
+        http://trac.webkit.org/changeset/125143
+        https://bugs.webkit.org/show_bug.cgi?id=93573
+
+        Doesn't compile on Mac (Requested by tony^work on #webkit).
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/Image.h:
+        * platform/graphics/ImageSource.h:
+        (WebCore):
+        * platform/graphics/NativeImagePtr.h: Removed.
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
+
+2012-08-08  Huang Dongsung  <luxtella@company100.net>
+
+        Extract the definition of NativeImagePtr from ImageSource.h into NativeImagePtr.h.
+        https://bugs.webkit.org/show_bug.cgi?id=93466
+
+        Reviewed by Adam Barth.
+
+        Image.h includes ImageSource.h in order to know the definition of NativeImagePtr.
+        But Image does not need to know the definition of ImageSource. So, this patch
+        extracts the definition of NativeImagePtr from ImageSource.h into NativeImagePtr.h.
+
+        This is a preparation for asynchronous image decoding. Async decoding
+        will need a callback function, which sends a NativeImagePtr to clients, and the
+        callback must know the definition of NativeImagePtr, not ImageSource.
+
+        No new tests, behavior is unchanged.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/Image.h:
+        * platform/graphics/ImageSource.h:
+        (WebCore):
+        * platform/graphics/NativeImagePtr.h: Added.
+        (WebCore):
+
+2012-08-08  Shane Stephens  <shanestephens@google.com>
+
+        Compile flag for CSS Hierarchies
+        https://bugs.webkit.org/show_bug.cgi?id=92433
+
+        Reviewed by Tony Chang.
+
+        Note that this flag is disabled on all platforms for now.
+
+        No new tests since there's no functional change.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-08-08  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-mac] Switch to LocalizedNumberMac from LocalizedNumberICU
+        https://bugs.webkit.org/show_bug.cgi?id=93432
+
+        Reviewed by Hajime Morita.
+
+        No new tests. Covered by fast/forms/number/number-lossless-localization.html,
+        and WebKit/chromium/tests/LocaleMacTest.cpp.
+
+        * WebCore.gyp/WebCore.gyp:
+        Exclude locale-relatef files for ICU, and include files for Mac.
+
+2012-08-08  Hayato Ito  <hayato@chromium.org>
+
+        EventDispatcher::dispatchSimulatedClick should not reuse the same EventDispatcher instance.
+        https://bugs.webkit.org/show_bug.cgi?id=93452
+
+        Reviewed by Dimitri Glazkov.
+
+        This is a follow up patch after r124975.  There is yet another
+        place where the same EventDispatcher instance is reused across
+        event dispatching.
+
+        In addition to that, in order to simulate a real click, we must
+        different dispatchers because we must recalculate event ancestors
+        each time.  Current implementation wrongly freezes event ancestors
+        at the first event dispatching.
+
+        No new tests, no change in functionality.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchSimulatedClick):
+        (WebCore::EventDispatcher::EventDispatcher):
+        (WebCore::EventDispatcher::dispatchEvent):
+        * dom/EventDispatcher.h:
+        (EventDispatcher):
+
+2012-08-08  Jae Hyun Park  <jae.park@company100.net>
+
+        writeHelperGetString in V8HTMLDocument uses += to concatenate strings
+        https://bugs.webkit.org/show_bug.cgi?id=93035
+
+        Reviewed by Adam Barth.
+
+        Use a StringBuilder instead of String concatenation because StringBuilder is generally faster.
+
+        No new functionality, so no new tests.
+
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::writeHelperGetString):
+
+2012-08-08  Adrienne Walker  <enne@google.com>
+
+        [chromium] Move scrollbar pointer into WebScrollbarThemePainter
+        https://bugs.webkit.org/show_bug.cgi?id=93541
+
+        Reviewed by James Robinson.
+
+        Update clients of WebScrollbarThemePainter.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::createScrollbarLayer):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+
+2012-08-08  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Invalid shaders should act as pass-through filters
+        https://bugs.webkit.org/show_bug.cgi?id=93405
+
+        Reviewed by Dean Jackson.
+
+        If the shader fails to apply then clearShaderResult will just copy the result of the previous filter
+        to the output of the current filter.
+
+        Test: css3/filters/custom/invalid-custom-filter-shader.html
+
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::platformApplySoftware):
+        (WebCore):
+        (WebCore::FECustomFilter::clearShaderResult):
+        (WebCore::FECustomFilter::applyShader):
+        * platform/graphics/filters/FECustomFilter.h:
+        (FECustomFilter):
+        * rendering/style/StyleCustomFilterProgram.h: The test was exposing the fact that if the shaders were referencing the same
+        file then StyleCustomFilterProgram will never complete the load. Having the same file for both the vertex and the fragment shader
+        cannot really work, because the shaders would not compile anyway, thus triggering an invalid shader. 
+        I'm fixing it part of this change because the current test actually exposes that on Safari Mac builds. See the note in the LayoutTest/ChangeLog.
+        (WebCore::StyleCustomFilterProgram::notifyFinished):
+
+2012-08-08  Adam Barth  <abarth@webkit.org>
+
+        Rewire the same-origin checks for the JavaScriptCore bindings through BindingSecurity
+        https://bugs.webkit.org/show_bug.cgi?id=93382
+
+        Reviewed by Eric Seidel.
+
+        This patch rewires the same-origin policy checks in the JavaScriptCore
+        bindings to use the implementation in BindingSecurity.cpp, which is now
+        shared by JavaScriptCore and V8. There are still a few places were we
+        use the JSDOMWindowCustom-based code path, but I plan to change those
+        in a follow up patch in the interest of keeping this patch as small as
+        possible.
+
+        This patch as two main benefits:
+
+        1) We no longer need to maintain duplicate code in the JSC and the V8
+           bindings for as delicate an area as the same-origin check.
+           Previously, the two implementations accomplished the same task using
+           a slightly different mechansim. After this patch, they use the same
+           mechanism, which means we only need to convince ourselves that one
+           implementation is correct.
+
+        2) This patch will make it easier to remove DOMWindow::m_securityOrigin
+           because there will be only one piece of code that needs to change.
+           Prior to this patch, we would have had to change both
+           implementations of the same-origin policy not to rely upon
+           DOMWindow::m_securityOrigin.
+
+        * bindings/js/BindingState.cpp:
+        (WebCore::immediatelyReportUnsafeAccessTo):
+        (WebCore):
+        * bindings/js/BindingState.h:
+        (WebCore):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::shouldAllowAccessToNode):
+        (WebCore::shouldAllowAccessToFrame):
+
+2012-08-08  Brady Eidson  <beidson@apple.com>
+
+        Google search query text reverts to original search query after multiple searches
+        <rdar://problem/10800686> and https://bugs.webkit.org/show_bug.cgi?id=93544
+
+        Reviewed by Darin Adler.
+
+        For security sensitive fields we normally clear "autocomplete=off" form elements when
+        restoring a page from the page cache.
+        
+        If the element is textual and has a defaultValue then "clearing" it actually restores 
+        the default value.
+        
+        There's no scenario we can imagine where that makes sense so we should not reset the 
+        value in such fields.
+
+        Test: fast/forms/autocomplete-off-with-default-value-does-not-clear.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseAttribute): Update suspension callback registration as needed.
+        (WebCore::HTMLInputElement::needsSuspensionCallback): Don't reset text fields with a non-empty default value.
+
+2012-08-08  Raymond Toy  <rtoy@google.com>
+
+        Creating "basic waveform" Oscillator nodes is not efficient
+        https://bugs.webkit.org/show_bug.cgi?id=93194
+
+        Reviewed by Chris Rogers.
+
+        Cache the wavetables for the basic types so they don't have to be
+        recomputed every time.
+
+        Also fix a bug where oscillator type was always set to CUSTOM
+        instead of the specified oscillator type.  Test added for this.
+
+        Test: webaudio/oscillator-basic.html
+
+        * Modules/webaudio/Oscillator.cpp:
+        (WebCore):
+        (WebCore::Oscillator::setType): Use cached wavetables; fix bug in
+        setting the oscillator type.
+        * Modules/webaudio/Oscillator.h: 
+        (Oscillator): Define static variables to hold cached wavetables.
+
+2012-08-08  Tom Sepez  <tsepez@chromium.org>
+
+        Avoid ASSERT(m_workerContext->isSharedWorkerContext()) in WorkerScriptController::initScript()
+        https://bugs.webkit.org/show_bug.cgi?id=93521
+
+        Reviewed by Adam Barth.
+
+        Changes WorkerContext and its subclasses so that we do not call functions that rely upon subclass
+        virtual methods from the superclass constructor.
+
+        Test: http/tests/security/contentSecurityPolicy/worker-set-timeout-blocked.html
+
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore):
+        (WebCore::DedicatedWorkerContext::create):
+        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
+        * workers/DedicatedWorkerContext.h:
+        (DedicatedWorkerContext):
+        * workers/SharedWorkerContext.cpp:
+        (WebCore):
+        (WebCore::SharedWorkerContext::create):
+        (WebCore::SharedWorkerContext::SharedWorkerContext):
+        * workers/SharedWorkerContext.h:
+        (SharedWorkerContext):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        (WebCore::WorkerContext::applyContentSecurityPolicyFromString):
+        (WebCore):
+        * workers/WorkerContext.h:
+        (WorkerContext):
+
+2012-08-08  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        CanvasRenderContext2D::setFont() should ignore inherited properties and default keyword value
+        https://bugs.webkit.org/show_bug.cgi?id=93491
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Treat "inherit" as an invalid value. Also ignore the "default"
+        keyword that was previously treated as a font family. This second
+        change was done in the property validation and will also affect the
+        CSS font parsing, but it is probably harmless since font doesn't
+        recognize the default keyword anyway.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFamily):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFont):
+
+2012-08-08  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Add missing OVERRIDE and virtual annotations in compositor
+        https://bugs.webkit.org/show_bug.cgi?id=93438
+
+        Reviewed by Adrienne Walker.
+
+        As the title suggests.
+
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
+        (BitmapCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/ScrollbarLayerChromium.h:
+        (ScrollbarLayerChromium):
+        * platform/graphics/chromium/SolidColorLayerChromium.h:
+        (SolidColorLayerChromium):
+        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.h:
+        * platform/graphics/chromium/cc/CCFrameRateController.h:
+        (CCFrameRateController):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+        (CCScrollbarLayerImpl):
+
+2012-08-08  Eric Penner  <epenner@google.com>
+
+        [chromium] Refactor tile flags.
+        https://bugs.webkit.org/show_bug.cgi?id=93059
+
+        Reviewed by Adrienne Walker.
+
+        This has become a general refactoring patch to make updateTiles easier
+        to work with. The 'updated' flag had become convoluted and incorrect
+        and the function had lots of special cases piled into it which
+        makes for tangled depedancies that are hard to reason with.
+ 
+        This refactors the updated flag into two flags ('validForFrame',
+        and 'occluded') for the two purposes it is actually used for,
+        simplifies the use of those flags.
+
+        'validForFrame' is improved to work for all tiles that are not dirty
+        before painting begins, rather than just the tiles that get touched via
+        updateTiles().
+
+        This refactors updateTiles() into several functions that more clearly
+        illustrate all the depedancies that have accumulated in there. After
+        doing that I managed to separate the occlusion pass from the painting
+        passes, ecapsulating the difficult dependancies in one documented
+        function 'markOcclusionsAndRequestTextures'.
+
+        Now update tiles doesn't need the 'idle' flag, and returns didPaint
+        as an out-param. The last remaining wierd output is m_failedPaint
+        which is needed in place of m_skipsIdlePaint to prevent infinite 
+        paints from being requested.
+
+        As a last step I was going to merge LayerChromium::update() and
+        LayerChromium::needsMoreUpdates() by having update() just return
+        a boolean, but this proved to be a big change so I'm holding off
+        on that. That would let us remove the m_failedPaint and get rid
+        of needsIdlePaint() altogether.
+
+        Tested by many existing tests.
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (UpdatableTile):
+        (WebCore::UpdatableTile::resetUpdateState):
+        (WebCore::UpdatableTile::markForUpdate):
+        (WebCore::UpdatableTile::UpdatableTile):
+        (WebCore::TiledLayerChromium::TiledLayerChromium):
+        (WebCore::TiledLayerChromium::pushPropertiesTo):
+        (WebCore):
+        (WebCore::TiledLayerChromium::updateTiles):
+        (WebCore::TiledLayerChromium::markOcclusionsAndRequestTextures):
+        (WebCore::TiledLayerChromium::haveTexturesForTiles):
+        (WebCore::TiledLayerChromium::markTilesForUpdate):
+        (WebCore::TiledLayerChromium::updateTileTextures):
+        (WebCore::TiledLayerChromium::resetUpdateState):
+        (WebCore::TiledLayerChromium::updateContentRect):
+        (WebCore::TiledLayerChromium::needsIdlePaint):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+
+2012-08-08  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=93393
+        Overflow regions sometimes repaint incorrectly after going into or 
+        coming out of compositing mode
+        -and corresponding-
+        <rdar://problem/12006463>
+
+        Reviewed by Simon Fraser.
+
+        My first patch to fix this bug removed an if (parent()) check that is 
+        needed to prevent a table crash seen in 
+        fast/table/table-row-compositing-repaint-crash.html  
+        The parent() check was actually added originally to prevent this same 
+        crash. See http://trac.webkit.org/changeset/110456  
+        This patch adds that check back, but really we should delay the 
+        computation of repaint rects if layout has not happened yet.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+
+2012-08-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Avoid backing store on layers created for CoreAnimation plugins
+        https://bugs.webkit.org/show_bug.cgi?id=93526
+        <rdar://problem/12052828>
+
+        Reviewed by Dean Jackson.
+
+        We create a compositing layer for <embed> objects whose plug-in supports
+        the CoreAnimation rendering model. When the embed's renderer is not styled,
+        we can avoid allocating backing store for it.
+
+        Test: compositing/plugins/no-backing-store.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::isCompositedPlugin):
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+
+2012-08-08  Erik Arvidsson  <arv@chromium.org>
+
+        DOM4: classList should be defined on Element and not on HTMLElement
+        https://bugs.webkit.org/show_bug.cgi?id=93015
+
+        Reviewed by Adam Barth.
+
+        DOM4 specs that Element should have the classList WebIDL attribute. This moves the
+        attribute to the correct IDL file.
+
+        Test: fast/dom/Element/class-list.html
+
+        * dom/Element.idl:
+        * html/HTMLElement.idl:
+
+2012-08-08  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=92275
+        Need a way to get a snapshot image that does not show the selection
+        -and corresponding-
+        <rdar://problem/11956802>
+
+        Reviewed by Anders Carlsson.
+
+        New function FrameView::paintContentsForSnapshot() has the option to 
+        exclude selection from the snapshot.
+
+        Export new function
+        * WebCore.exp.in:
+
+        Clear the selection from the RenderView when selection is to be excluded. Restore 
+        all of this information via FrameSelection::updateAppearance() after calling 
+        paintContents().
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContentsForSnapshot):
+        (WebCore):
+        * page/FrameView.h:
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Only use public Platform API in NonCompositedContentHost
+        https://bugs.webkit.org/show_bug.cgi?id=93423
+
+        Reviewed by Adrienne Walker.
+
+        This renames the "NonCompositedContentHost" flag to "useLCDText", which is the primary purpose of the flag. We
+        also use this flag to control whether we have border texels or not on the "root" layer, but I can't think of a
+        clean name that encapsulates both behaviors.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::setUseLCDText):
+        (WebCore::LayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        (WebCore::LayerChromium::useLCDText):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::setUseLCDText):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::setUseLCDText):
+        (WebCore::CCLayerImpl::useLCDText):
+        (CCLayerImpl):
+
+2012-08-08  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=93393
+        Overflow regions sometimes repaint incorrectly after going into or 
+        coming out of compositing mode
+        -and corresponding-
+        <rdar://problem/12006463>
+
+        Reviewed by Simon Fraser.
+
+        New RenderLayer function computeRepaintRectsIncludingDescendants()
+        * rendering/RenderLayer.cpp:
+        (WebCore):
+        (WebCore::RenderLayer::computeRepaintRectsIncludingDescendants):
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+
+        It is not sufficient to compute repaint rects just for the current 
+        layer when compositing changes. They must be recomputed for all 
+        descendant layers as well.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+
+2012-08-08  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: new enums and openCursor stub
+        https://bugs.webkit.org/show_bug.cgi?id=93410
+
+        Reviewed by Adam Barth.
+
+        Introduce a new TaskType enum that will be used to prioritize
+        internal tasks. This is preliminary staging for
+        https://bugs.webkit.org/show_bug.cgi?id=91125.
+
+        No new tests, coming in bug 91125.
+
+        * Modules/indexeddb/IDBTransactionBackendInterface.h:
+
+2012-08-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        REGRESSION(r125046): Breaks debug build (assertion in protocol type checks) (Requested by pfeldman on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=93505
+
+        Not reviewed: roll out.
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        (ConsoleMessage):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::wrapObject):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::enable):
+        (WebCore::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._format):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameter):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsObject):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsNode):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArray):
+        (WebInspector.ConsoleMessageImpl.prototype._printArray):
+        (WebInspector.ConsoleMessageImpl.prototype._formatAsArrayEntry):
+        (WebInspector.ConsoleMessageImpl.prototype._formatWithSubstitutionString):
+        * inspector/front-end/DOMExtension.js:
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection):
+        * inspector/front-end/PropertiesSection.js:
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject):
+        (WebInspector.RemoteObject.fromPayload):
+        * inspector/front-end/Section.js:
+        * inspector/front-end/inspector.css:
+        (.console-group-messages .section .header .title):
+        (.section .properties .name, .event-properties .name):
+
+2012-08-08  Adam Barth  <abarth@webkit.org>
+
+        Crash when reloading a Chromium "platform" app
+        https://bugs.webkit.org/show_bug.cgi?id=93497
+
+        Reviewed by Eric Seidel.
+
+        The framework for Chromium "platform" apps executes a big blob of
+        script during the didCreateScriptContext callback. This blob of scripts
+        interacts with a bunch of JavaScript objects and triggers a number of
+        security checks.
+
+        When reloading a frame, the didCreateScriptContext is called during
+        Frame::setDocument (as a consequence of calling
+        ScriptController::updateDocument). At that time, the SecurityOrigin
+        object hasn't yet been copied over to the DOMWindow, and we crash
+        trying to grab it.
+
+        The long-term fix for this bug is to fix
+        https://bugs.webkit.org/show_bug.cgi?id=75793, at which point there
+        will no longer be a SecurityOrigin object on DOMWindow. In the
+        meantime, however, we can fix this crash by null checking the
+        DOMWindow's SecurityOrigin object.
+
+        * bindings/generic/BindingSecurity.cpp:
+        (WebCore::canAccessDocument):
+
+2012-08-08  Dean Jackson  <dino@apple.com>
+
+        Unreviewed build fix for Mac port after http://trac.webkit.org/changeset/125051
+
+        Add CachedImageClient.h to project.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-08-08  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Add boundsOrigin accessors to LayerOverride
+        https://bugs.webkit.org/show_bug.cgi?id=93479
+        PR #188677
+
+        Reviewed by Yong Li.
+
+        This is needed in order to allow us to directly set the boundsOrigin value
+        to the LayerCompositingThread and avoid it to get overridden by the respective
+        LayerWebKitThread's boundsOrigin value in the next commit.
+
+        No new tests, since this is another preparation PR.
+
+        * platform/graphics/blackberry/LayerCompositingThread.cpp:
+        (WebCore::LayerCompositingThread::updateAnimations):
+        * platform/graphics/blackberry/LayerCompositingThread.h:
+        (WebCore::LayerOverride::isBoundsOriginSet):
+        (WebCore::LayerOverride::boundsOrigin):
+        (WebCore::LayerOverride::setBoundsOrigin):
+        (LayerOverride):
+        (WebCore::LayerOverride::LayerOverride):
+
+2012-08-08  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Propagate GraphicsLayer::boundsOrigin down to the platform layers
+        https://bugs.webkit.org/show_bug.cgi?id=93478
+        PR #188657
+
+        Reviewed by Yong Li.
+
+        This property will be set from both WebKit and Compositing/UI
+        threads in order to fast scroll block elements.
+
+        No new tests, as it is a mid-step patch.
+
+        * platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp:
+        (WebCore::GraphicsLayerBlackBerry::setBoundsOrigin):
+        (WebCore):
+        (WebCore::GraphicsLayerBlackBerry::updateBoundsOrigin):
+        * platform/graphics/blackberry/GraphicsLayerBlackBerry.h:
+        (GraphicsLayerBlackBerry):
+        * platform/graphics/blackberry/LayerCompositingThread.h:
+        (WebCore::LayerCompositingThread::setBoundsOrigin):
+        * platform/graphics/blackberry/LayerData.h:
+        (WebCore::LayerData::boundsOrigin):
+        (LayerData):
+        * platform/graphics/blackberry/LayerRenderer.cpp:
+        (WebCore::LayerRenderer::updateLayersRecursive):
+        * platform/graphics/blackberry/LayerWebKitThread.h:
+        (WebCore::LayerWebKitThread::setBoundsOrigin):
+        (LayerWebKitThread):
+
+2012-08-08  Nate Chapin  <japhet@chromium.org>
+
+        [chromium] Upstream android's FlingAnimator
+        https://bugs.webkit.org/show_bug.cgi?id=92900
+
+        Reviewed by James Robinson.
+
+        No new tests yet, will be added once this code is called.
+
+        * WebCore.gypi:
+        * platform/chromium/support/PlatformGestureCurveFactory.cpp: Added.
+        (WebKit):
+        (WebKit::PlatformGestureCurveFactory::get):
+        (WebKit::PlatformGestureCurveFactory::createCurve):
+        (WebKit::PlatformGestureCurveFactory::setWebFlingAnimatorForTest):
+        * platform/chromium/support/PlatformGestureCurveFactory.h: Added.
+        (WebKit):
+        (PlatformGestureCurveFactory):
+        * platform/chromium/support/WebFlingAnimatorToGestureCurveAdapter.h: Added.
+        (WebKit):
+        (WebFlingAnimatorToGestureCurveAdapter):
+        (WebKit::WebFlingAnimatorToGestureCurveAdapter::create):
+        (WebKit::WebFlingAnimatorToGestureCurveAdapter::WebFlingAnimatorToGestureCurveAdapter):
+
+2012-08-08  Anna Cavender  <annacc@chromium.org>
+
+        Update HTMLMediaElement to the new OO MediaSource API.
+        https://bugs.webkit.org/show_bug.cgi?id=91775
+
+        Reviewed by Eric Carlson.
+
+        This patch rips out the old-style MediaSource API and allows a
+        MediaSource object to be attached to HTMLMediaElement.
+        http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html
+
+        Tests: updates to http/tests/media/media-source/*
+               http/tests/media/media-source/video-media-source-add-and-remove-buffers.html
+               http/tests/media/media-source/video-media-source-objects.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore):
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Remove old style API resources.
+        (WebCore::HTMLMediaElement::parseAttribute): Remove old style event attribute.
+        (WebCore::HTMLMediaElement::prepareForLoad): Set source state to "closed".
+        (WebCore::HTMLMediaElement::loadResource): Get MediaSource object from blob registry
+            look up and, if found, set it's MediaPlayer pointer to the current MediaPlayer.
+        (WebCore::HTMLMediaElement::noneSupported): Set source state to "closed".
+        (WebCore::HTMLMediaElement::mediaEngineError): Set source state to "closed".
+        (WebCore::HTMLMediaElement::mediaPlayerSourceOpened): Set source state to "open".
+        (WebCore::HTMLMediaElement::mediaPlayerSourceURL): Change to new blob URL.
+        (WebCore::HTMLMediaElement::seek): Check if source state is "closed".
+        (WebCore::HTMLMediaElement::setSourceState): Helper function so that we don't have to
+            keep checking for m_mediaSource.
+        (WebCore::HTMLMediaElement::userCancelledLoad): Set source state to "closed".
+        (WebCore::HTMLMediaElement::createMediaPlayer): If the current MediaPlayer is re-
+             created, notify the MediaSource and reset its MediaPlayer.
+
+        * html/HTMLMediaElement.h: Remove old style API code and add a MediaSource object.
+        (HTMLMediaElement):
+        * html/HTMLMediaElement.idl: Remove old style API.
+
+2012-08-08  Dean Jackson  <dino@apple.com>
+
+        Unreviewed build fix for Mac port after http://trac.webkit.org/changeset/125051
+
+        * platform/mac/ClipboardMac.mm:
+
+2012-08-08  Xan Lopez  <xlopez@igalia.com>
+
+        Evolution, empathy no longer build with webkint 1.9.6:  webkit_dom_html_element_set_class_name is gone
+        https://bugs.webkit.org/show_bug.cgi?id=93384
+
+        Reviewed by Adam Barth.
+
+        Provide custom backwards compatibility wrappers for HTMLElement
+        className accessors, since the attribute was moved to Element. The
+        previous fix attempted to define the attribute twice (once in each
+        class), but this is wrong, just provide again the old accessors
+        making them forward to the new methods.
+
+        * bindings/gobject/WebKitDOMCustom.cpp:
+        (webkit_dom_html_element_get_class_name): provide again
+        get_class_name for backwards compatibility.
+        (webkit_dom_html_element_set_class_name): provide again
+        set_class_name for backwards compatibility.
+        * bindings/gobject/WebKitDOMCustom.h: ditto.
+        * html/HTMLElement.idl: remove the className attribute
+        definition. Since it's already present in Element this will break
+        our bindings.
+
+2012-08-07  Ojan Vafai  <ojan@chromium.org>
+
+        percentage height/width values in quirks mode are incorrectly resolved in flexbox children
+        https://bugs.webkit.org/show_bug.cgi?id=81809
+
+        Reviewed by Tony Chang.
+
+        When computing percentage logical heights we need to use the RenderBox helper methods
+        to make sure we handle all the edge cases correctly (e.g. walk up the containing block
+        ancestor chain in quirks mode until we find a definite size).
+
+        For widths, the containing block always has a definite size, so all we need to do
+        is call computeContentBoxLogicalWidth(valueForLength(...)), although I'm not sure
+        this does the right thing for the intrinsic sizing keywords.
+
+        Tests: css3/flexbox/box-sizing-min-max-sizes.html
+               css3/flexbox/percentage-sizes-quirks.html
+               css3/flexbox/percentage-sizes.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeLogicalClientHeight):
+        (WebCore):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::computeMainAxisSizeForChild):
+        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild):
+        (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):
+        * rendering/RenderFlexibleBox.h:
+
+2012-08-08  Andrew Scherkus  <scherkus@chromium.org>
+
+        Fire suspend event whenever network state is set to NETWORK_IDLE.
+        https://bugs.webkit.org/show_bug.cgi?id=93052
+
+        Reviewed by Eric Carlson.
+
+        There was a regression in the Chromium port (http://crbug.com/139511) that revealed we didn't
+        have a layout test for suspend events. Upon further investigation it appeared we also had a bug
+        where we didn't fire the suspend event when a media engine reported they had completely loaded
+        the media.
+
+        Covered by new test http/tests/media/video-load-suspend.html.
+
+        * html/HTMLMediaElement.cpp: Move firing of suspend event to changeNetworkStateFromLoadingToIdle
+        (WebCore::HTMLMediaElement::setNetworkState):
+        (WebCore::HTMLMediaElement::changeNetworkStateFromLoadingToIdle):
+
+2012-08-08  Tom Sepez  <tsepez@chromium.org>
+
+        Video element image loader must persist after element detach.  
+        https://bugs.webkit.org/show_bug.cgi?id=90801
+
+        Reviewed by Eric Carlson.
+
+        We rely on the OwnPtr in the element to cleanup the loader.     
+
+        Test: fast/dom/beforeload/remove-video-poster-in-beforeload-listener.html
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore):
+        * html/HTMLVideoElement.h:
+        (HTMLVideoElement):
+
+2012-08-08  Nikhil Bhargava  <nbhargava@google.com>
+
+        Improve RenderObject.h compile time - split CachedImage and CachedImageClient
+        https://bugs.webkit.org/show_bug.cgi?id=93400
+
+        Reviewed by Eric Seidel.
+
+        Splits loader/cache/CachedImage.h into two files. The remaining changes are to repair existing #includes
+
+        No new tests. No changes to existing functions/functionality.
+
+        * css/CSSCrossfadeValue.h:
+        * loader/ImageLoader.h:
+        * loader/cache/CachedImage.cpp:
+        * loader/cache/CachedImage.h:
+        (WebCore):
+        * loader/cache/CachedImageClient.h: Added.
+        (WebCore):
+        (CachedImageClient):
+        (WebCore::CachedImageClient::~CachedImageClient):
+        (WebCore::CachedImageClient::expectedType):
+        (WebCore::CachedImageClient::resourceClientType):
+        (WebCore::CachedImageClient::imageChanged):
+        (WebCore::CachedImageClient::willRenderImage):
+        * platform/chromium/ClipboardChromium.h:
+        * rendering/RenderObject.h:
+        (WebCore):
+        * rendering/style/StyleCachedImage.cpp:
+        * rendering/style/StyleCachedImage.h:
+        (WebCore):
+        * rendering/style/StyleCachedImageSet.h:
+        * svg/graphics/SVGImage.cpp:
+
+2012-08-08  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r123171): <svg> element with intrinsic size and max-width gets sized incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=93388
+
+        Reviewed by Beth Dakin.
+
+        Test: svg/css/max-width-3.html
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox): Added code to set
+        m_intrinsicSize in the no-contentRenderer branch of this function so that the calls to
+        RenderBox::computeReplacedLogical{Height,Width} in the end use the right intrinsic size.
+        This is similar to what the contentRenderer branch of this function already does.
+
+2012-08-08  Keishi Hattori  <keishi@webkit.org>
+
+        Make slider tick mark snapping threshold configurable for each platform
+        https://bugs.webkit.org/show_bug.cgi?id=93429
+
+        Reviewed by Kent Tamura.
+
+        This makes the slider tick mark snapping threshold configurable for each platform.
+        And we increase the threshold for the Chromium port.
+
+        No new tests. Covered by range-snap-to-datalist.html.
+
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::setPositionFromPoint):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::sliderTickSnappingThreshold):
+        (WebCore):
+        * rendering/RenderTheme.h:
+        (RenderTheme):
+        (WebCore::RenderTheme::sliderTickSnappingThreshold): Returns the threshold distance to the tick mark for snapping to occur.
+        * rendering/RenderThemeChromiumCommon.cpp:
+        (WebCore::RenderThemeChromiumCommon::sliderTickSnappingThreshold):
+        (WebCore):
+        * rendering/RenderThemeChromiumCommon.h:
+        (RenderThemeChromiumCommon):
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore):
+        (WebCore::RenderThemeChromiumMac::sliderTickSnappingThreshold):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore):
+        (WebCore::RenderThemeChromiumSkia::sliderTickSnappingThreshold):
+        * rendering/RenderThemeChromiumSkia.h:
+
+2012-08-08  Mike West  <mkwst@chromium.org>
+
+        Until CSP fully supports paths, we should log a warning if we encounter a source with a path.
+        https://bugs.webkit.org/show_bug.cgi?id=93468
+
+        Reviewed by Adam Barth.
+
+        CSP 1.0 ignores path components of sources in directives' source lists.
+        'script-src http://example.com/path/to/directory' is treated exactly the
+        same as 'script-src http://example.com'. It's likely that this behavior
+        will change in CSP 1.1, which could break with developers' expectations.
+        This patch adds a warning when a path is encountered, alerting
+        developers to the fact that their current source is interpreted
+        differently than they might expect.
+
+        See http://crbug.com/128493 for additional context and discussion.
+
+        Tests for this change are covered by updating the existing Content
+        Security Policy tests to include the new console warnings.
+
+        * page/ContentSecurityPolicy.cpp:
+        (CSPSourceList):
+        (WebCore::CSPSourceList::CSPSourceList):
+            Passing the directive name down into CSPSourceList so that we can
+            generate informative error messages.
+        (WebCore::CSPSourceList::parse):
+            Create a 'path' string, pass it into 'parseSource', and use it after
+            parsing each source to determine whether a warning should be sent.
+        (WebCore::CSPSourceList::parseSource):
+            Adding a 'path' argument so that we can see whether or not a
+            specific source should generate a warning.
+        (WebCore::CSPDirective::CSPDirective):
+            Passing the directive name down into CSPSourceList so that we can
+            generate informative error messages.
+        (WebCore::ContentSecurityPolicy::reportIgnoredPathComponent):
+            Generate the new warning message.
+        (WebCore):
+        * page/ContentSecurityPolicy.h:
+
+2012-08-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: generate preview for the objects dumped into the console upon logging.
+        https://bugs.webkit.org/show_bug.cgi?id=35801
+
+        Reviewed by Vsevolod Vlasov.
+
+        As of today, dumping an object (array) into console will result in objects' properties being
+        read upon console object expansion (i.e. lazily). This means that dumping the same object while
+        mutating it will be hard to debug using the console.
+
+        This change starts generating abbreviated previews for objects / arrays at the moment of their
+        logging and passes this information along into the front-end. This only happens when the front-end
+        is already opened, it only works for console.log(), not live console interaction.
+
+        Covered by the existing console tests + collections test has been expanded to capture both: pre and post-
+        front-end opening scenarios.
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        (ConsoleMessage):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::wrapObject):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::enable):
+        (WebCore::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._format):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameter):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsObject):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArrayOrObject):
+        (WebInspector.ConsoleMessageImpl.prototype._appendObjectPreview):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsNode):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArray):
+        (WebInspector.ConsoleMessageImpl.prototype._printArray):
+        (WebInspector.ConsoleMessageImpl.prototype._formatAsArrayEntry):
+        (WebInspector.ConsoleMessageImpl.prototype._formatWithSubstitutionString):
+        * inspector/front-end/DOMExtension.js:
+        (Element.prototype.createTextChild):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection):
+        * inspector/front-end/PropertiesSection.js:
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject):
+        (WebInspector.RemoteObject.fromPayload):
+        (WebInspector.RemoteObject.prototype.get previewProperties):
+        * inspector/front-end/Section.js:
+        * inspector/front-end/inspector.css:
+        (.console-group-messages .section .header .title):
+        (.section .console-formatted-node):
+        (.console-object-preview):
+        (.section .properties .name, .event-properties .name, .console-formatted-object .name):
+
+2012-07-31  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] media/media-continues-playing-after-replace-source.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=86310
+
+        Reviewed by Eric Carlson.
+
+        Reset the player's network and ready states, this allows the media
+        player client to potentially emit a timeupdate event while the new
+        location is being loaded. States are synchronized again after the
+        pipeline pre-rolled.
+
+        No new tests but fixes
+        media/media-continues-playing-after-replace-source.html
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::load):
+
+2012-08-08  Alexandru Chiculita  <achicu@adobe.com>
+
+        [Chromium] Skia assert triggered by custom filter unmultiplied results
+        https://bugs.webkit.org/show_bug.cgi?id=92758
+
+        Reviewed by Dean Jackson.
+
+        The FECustomFilter (which renders the CSS Shaders) used premultiplied colors for both input and ouput.
+        The problem with that is that some shaders do not pre-multiply the values and the reality is that
+        we cannot trust the shader to do that. The easy way would be to use only unpremultiplied colors and do the
+        computation in C++ code. This will be changed when the mix blending is implemented to do that in the shader itself. 
+
+        No new tests, just updated existing tests to take unpremultiplied colors instead.
+
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::platformApplySoftware):
+
+2012-08-08  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, build fix after r125041.
+
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (StreamingClient::didReceiveResponse): Fix arguments order of the
+        notifyGstTagsOnPad() call.
+
+2012-08-08  Vineet Chaudhary  <rgf748@motorola.com>
+
+        Remove All Custom binding code for TypedArray.
+        https://bugs.webkit.org/show_bug.cgi?id=93371
+
+        Reviewed by Kentaro Hara.
+
+        Removing Custom bindings completely with help of [TypedArray] attribute.
+
+        Tests: TestTypedArray.idl
+        There should not be any behavioral change and all tests should pass.
+
+        * GNUmakefile.list.am: Removed Custom files.
+        * Target.pri: Ditto.
+        * UseJSC.cmake: Ditto.
+        * UseV8.cmake: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSBindingsAllInOne.cpp: Ditto.
+        * bindings/js/JSFloat32ArrayCustom.cpp: Removed.
+        * bindings/js/JSFloat64ArrayCustom.cpp: Removed.
+        * bindings/js/JSInt16ArrayCustom.cpp: Removed.
+        * bindings/js/JSInt32ArrayCustom.cpp: Removed.
+        * bindings/js/JSInt8ArrayCustom.cpp: Removed.
+        * bindings/js/JSUint16ArrayCustom.cpp: Removed.
+        * bindings/js/JSUint32ArrayCustom.cpp: Removed.
+        * bindings/js/JSUint8ArrayCustom.cpp: Removed.
+        * bindings/js/JSUint8ClampedArrayCustom.cpp: Removed.
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (GenerateHeader): Skip implementaion for TypedArray.
+        (GenerateImplementation): Skip implementaion for TypedArray.
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GenerateFunction): Skip implementaion for TypedArray.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation): Generates binding for set() call.
+        (GenerateConstructorDefinition): ConstructorTemplate implementation for TypedArray.
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (GenerateHeader): Skip implementaion for TypedArray.
+        (GenerateImplementation): Skip implementaion for TypedArray.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateFunctionCallback): Generates binding for setCallback().
+        (GenerateTypedArrayConstructorCallback): Generates binding for constructorCallback().
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt: Support ConstructorTemplate for TypedArray as well.
+        * bindings/scripts/test/JS/JSFloat64Array.cpp: Binding tests results.
+        (WebCore::toJS):
+        (WebCore::JSFloat64Array::indexSetter):
+        (WebCore::JSFloat64ArrayConstructor::getConstructData):
+        (WebCore::jsFloat64ArrayPrototypeFunctionFoo):
+        (WebCore::jsFloat64ArrayPrototypeFunctionSet):
+        * bindings/scripts/test/JS/JSFloat64Array.h: Binding tests results.
+        * bindings/scripts/test/TestTypedArray.idl: Binding tests.
+        * bindings/scripts/test/V8/V8Float64Array.cpp: Binding tests results.
+        (WebCore::Float64ArrayV8Internal::setCallback):
+        (Float64ArrayV8Internal):
+        (WebCore):
+        (WebCore::V8Float64Array::constructorCallback):
+        (WebCore::ConfigureV8Float64ArrayTemplate):
+        * bindings/v8/custom/V8Float32ArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8Float64ArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8Int16ArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8Int32ArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8Int8ArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8Uint16ArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8Uint32ArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8Uint8ArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp: Removed.
+        * html/canvas/Float32Array.idl: Using [ConstructorTemplate = TypedArray] instead of custom implementaion.
+        * html/canvas/Float64Array.idl: Ditto.
+        * html/canvas/Int16Array.idl: Ditto.
+        * html/canvas/Int32Array.idl: Ditto.
+        * html/canvas/Int8Array.idl: Ditto.
+        * html/canvas/Uint16Array.idl: Ditto.
+        * html/canvas/Uint32Array.idl: Ditto.
+        * html/canvas/Uint8Array.idl: Ditto.
+        * html/canvas/Uint8ClampedArray.idl: Ditto.
+
+2012-08-08  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] 0.11 build broken (again)
+        https://bugs.webkit.org/show_bug.cgi?id=93474
+
+        Reviewed by Martin Robinson.
+
+        Adapt the GStreamer media player backend to the latest GStreamer
+        0.11 API changes.
+
+        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
+        (WTF::adoptGRef):
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
+        (gstObjectIsFloating):
+        * platform/graphics/gstreamer/GStreamerVersioning.h:
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (StreamingClient::didReceiveResponse):
+
+2012-08-08  Loïc Yhuel  <loic.yhuel@softathome.com>
+
+        [Qt] Compile errors with OpenGLES2
+        https://bugs.webkit.org/show_bug.cgi?id=93206
+
+        Reviewed by Noam Rosenthal.
+
+        Fix build with OpenGLES2 on Linux desktop
+
+        * platform/graphics/OpenGLESShims.h: removed unused define conflicting with gl2ext.h from ANGLE
+
+2012-08-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: store last evaluation result in $_
+        https://bugs.webkit.org/show_bug.cgi?id=93377
+
+        Reviewed by Vsevolod Vlasov.
+
+        All "console" evaluations end up in that variable on command line API.
+
+        Test: inspector/console/console-last-result.html
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+
+2012-08-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Port internal findMethodIndex method matcher to use JSC C API
+        https://bugs.webkit.org/show_bug.cgi?id=93463
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Based on patch by No'am Rosenthal.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::setException):
+        (Bindings):
+        (JSC::Bindings::findMethodIndex): Fixed also coding style while at it.
+        (JSC::Bindings::QtRuntimeMetaMethod::call): Use new findMethodIndex. The
+        created JSValueRefs should not need GC protection because we only support
+        up to 10 method arguments and thus they will live on the stack storage
+        of the vector.
+        * bridge/qt/qt_runtime.h:
+        (Bindings):
+
+2012-08-08  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: move setTouchEventEmulationEnabled from DOMAgent to PageAgent
+        https://bugs.webkit.org/show_bug.cgi?id=93437
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::clearFrontend):
+        (WebCore::InspectorDOMAgent::restore):
+        * inspector/InspectorDOMAgent.h:
+        (InspectorDOMAgent):
+        * inspector/InspectorPageAgent.cpp:
+        (PageAgentState):
+        (WebCore::InspectorPageAgent::clearFrontend):
+        (WebCore::InspectorPageAgent::restore):
+        (WebCore):
+        (WebCore::InspectorPageAgent::updateTouchEventEmulationInPage):
+        (WebCore::InspectorPageAgent::setTouchEmulationEnabled):
+        * inspector/InspectorPageAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._emulateTouchEventsChanged):
+
+2012-08-08  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Unreviewed build fix for Qt on Linux.
+
+        * platform/qt/GamepadsQt.cpp:
+
+2012-08-08  KwangYong Choi  <ky0.choi@samsung.com>
+
+        [EFL] Support DataList for <input type="range">
+        https://bugs.webkit.org/show_bug.cgi?id=92634
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        DataList theme for EFL is implemented. DataList feature of
+        <input type="range"> is supported.
+
+        Test: fast/forms/datalist/input-list.html
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::paintSliderTrack):
+        (WebCore::RenderThemeEfl::sliderTickSize):
+        (WebCore::RenderThemeEfl::sliderTickOffsetFromTrackCenter):
+        (WebCore::RenderThemeEfl::supportsDataListUI):
+        (WebCore):
+        * platform/efl/RenderThemeEfl.h:
+        (RenderThemeEfl):
+
+2012-08-08  Sergey Rogulenko  <rogulenko@google.com>
+
+        Web Inspector: renaming DOMNodeHighlighter to InspectorOverlay
+        https://bugs.webkit.org/show_bug.cgi?id=93253
+
+        Reviewed by Pavel Feldman.
+
+        Renaming DOMNodeHighlighter to InspectorOverlay where necessary.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorAllInOne.cpp:
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorDOMAgent.cpp:
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorOverlay.cpp: Renamed from Source/WebCore/inspector/DOMNodeHighlighter.cpp.
+        (WebCore::InspectorOverlay::InspectorOverlay):
+        (WebCore):
+        (WebCore::InspectorOverlay::paint):
+        (WebCore::InspectorOverlay::drawOutline):
+        (WebCore::InspectorOverlay::getHighlight):
+        (WebCore::InspectorOverlay::setPausedInDebuggerMessage):
+        (WebCore::InspectorOverlay::hideHighlight):
+        (WebCore::InspectorOverlay::highlightNode):
+        (WebCore::InspectorOverlay::highlightRect):
+        (WebCore::InspectorOverlay::highlightedNode):
+        (WebCore::InspectorOverlay::update):
+        (WebCore::InspectorOverlay::drawNodeHighlight):
+        (WebCore::InspectorOverlay::drawRectHighlight):
+        (WebCore::InspectorOverlay::drawPausedInDebugger):
+        * inspector/InspectorOverlay.h: Renamed from Source/WebCore/inspector/DOMNodeHighlighter.h.
+        (WebCore):
+        (HighlightConfig):
+        (WebCore::Highlight::setColors):
+        (Highlight):
+        (InspectorOverlay):
+        (WebCore::InspectorOverlay::create):
+        * inspector/InspectorPageAgent.cpp:
+        * inspector/PageDebuggerAgent.cpp:
+        * page/GestureTapHighlighter.h:
+        * testing/Internals.cpp:
+
+2012-08-08  Chris Guan  <chris.guan@torchmobile.com.cn>
+
+        [Blackberry] missing a Multipart header when m_multipartResponse is null
+        https://bugs.webkit.org/show_bug.cgi?id=93440
+
+        Reviewed by George Staikos.
+
+        when m_multipartResponse is null, we just created new one but not called 
+        setHTTPHeaderField. So we missed this received multipart Header. We should 
+        call setHTTPHeaderField for each reveived header.
+
+        No new tests, because those current multipart test cases (http/tests/multipart/*) 
+        are enough.
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::handleNotifyMultipartHeaderReceived):
+
+2012-08-08  Mike West  <mkwst@chromium.org>
+
+        Refactor console logging out of CSPDirectiveList into ContentSecurityPolicy
+        https://bugs.webkit.org/show_bug.cgi?id=93205
+
+        Reviewed by Adam Barth.
+
+        We currently pass a protected resource's ScriptExecutionContext down
+        into CSPDirectiveList in order to log errors, grab the SecurityOrigin,
+        resolve relative URLs, and one or two other bits. This implementation
+        requires us to maintain state inside of low-level objects that shouldn't
+        really know about the ScriptExecutionContext, and makes logging errors
+        difficult, as CSPDirectiveList is the only piece of the puzzle that can
+        interact with the console.
+
+        This patch removes the dependence on ScriptExecutionContext, replacing
+        it with a pointer to the ContentSecurityPolicy object itself. The low-
+        level objects like CSPDirectiveList now make requests to the policy
+        object, which understands how to resolve them. This gives a cleaner
+        separation between the CSP implementation and the rest of WebCore, and
+        opens the door for future patches that teach the remaining low-level
+        objects about the policy in which they're contained in order to improve
+        error logging.
+
+        This should be a purely internal refactoring of the location from which
+        warnings are logged to the console. No new tests have been added; the
+        behavior should be covered by the existing CSP tests.
+
+        * page/ContentSecurityPolicy.cpp:
+        (CSPSourceList):
+        (WebCore::CSPSourceList::CSPSourceList):
+            Pass the policy object into CSPSourceList, rather than a pointer to
+            ScriptExecutionContext.
+        (WebCore::CSPSourceList::parse):
+        (WebCore::CSPSourceList::addSourceSelf):
+            Read the SecurityOrigin from the policy object, rather than from the
+            ScriptExecutionContext.
+        (WebCore::CSPDirective::CSPDirective):
+            Pass the policy object into CSPDirective, rather than a pointer to
+            ScriptExecutionContext. Use it to read the protected resource's
+            URL.
+        (CSPDirectiveList):
+        (WebCore::CSPDirectiveList::CSPDirectiveList):
+            Pass the policy object into CSPSourceList, rather than a pointer to
+            ScriptExecutionContext.
+        (WebCore::CSPDirectiveList::create):
+            Move the enforcement of eval restrictions out of CSPDirectiveList,
+            and into ContentSecurityPolicy::ContentSecurityPolicy.
+        (WebCore::CSPDirectiveList::reportViolation):
+            Move most of the logic out of this method, and into
+            ContentSecurityPolicy::reportViolation.
+        (WebCore::CSPDirectiveList::parseDirective):
+            Use the policy object for logging.
+        (WebCore::CSPDirectiveList::parseReportURI):
+            Use the policy object for logging, and URL completion.
+        (WebCore::CSPDirectiveList::parseScriptNonce):
+            Use the policy object for logging.
+        (WebCore::CSPDirectiveList::setCSPDirective):
+            Use the policy object for logging.
+        (WebCore::CSPDirectiveList::applySandboxPolicy):
+            Use the policy object for logging, and move enforcement to
+            ContentSecurityPolicy::enforceSandboxFlags.
+        (WebCore::CSPDirectiveList::addDirective):
+            Use the policy object for logging.
+        (WebCore::ContentSecurityPolicy::didReceiveHeader):
+            Pass the policy object to CSPDirectiveList, and disable eval if
+            necessary after parsing the policy.
+        (WebCore::ContentSecurityPolicy::securityOrigin):
+        (WebCore):
+        (WebCore::ContentSecurityPolicy::url):
+        (WebCore::ContentSecurityPolicy::completeURL):
+        (WebCore::ContentSecurityPolicy::enforceSandboxFlags):
+            Move the enforcement of the sandbox directive out of
+            CSPDirectiveList and into the policy object.
+        (WebCore::ContentSecurityPolicy::reportViolation):
+        (WebCore::ContentSecurityPolicy::reportUnrecognizedDirective):
+        (WebCore::ContentSecurityPolicy::reportDuplicateDirective):
+        (WebCore::ContentSecurityPolicy::reportInvalidNonce):
+            Move CSPDirectiveList::logXXX out to the policy object. The
+            directive list is now responsible for reporting errors and
+            violations; the policy decides what to do with them.
+        (WebCore::ContentSecurityPolicy::logToConsole):
+            Wrap the call to addConsoleMessage to make it simpler for the
+            various ContentSecurityPolicy::reportXXX methods.
+        * page/ContentSecurityPolicy.h:
+        (WebCore):
+
+2012-08-08  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Rename V8Helpers to V8BindingHelpers
+        https://bugs.webkit.org/show_bug.cgi?id=93318
+
+        Reviewed by Eric Seidel.
+
+        For naming consistency, a file including binding utility methods
+        should be prefixed by "V8Binding". In a follow-up patch, I'll move
+        methods from V8Binding to V8BindingHelpers.
+
+        In addition this patch makes V8Binding.h include V8BindingHelpers.h,
+        and removes #include V8BindingHelpers.h from binding files.
+
+        No tests. No change in behavior.
+
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/V8BindingHelpers.cpp: Renamed from Source/WebCore/bindings/v8/V8Helpers.cpp.
+        (WebCore):
+        (WebCore::toV8Context):
+        (WebCore::toV8Proxy):
+        * bindings/v8/V8BindingHelpers.h: Renamed from Source/WebCore/bindings/v8/V8Helpers.h.
+        (WebCore):
+        * bindings/v8/V8NPObject.cpp:
+
+2012-08-08  Kentaro Hara  <haraken@chromium.org>
+
+        'class WrapperTypeInfo' should be 'struct WrapperTypeInfo'
+
+        Unreviewed. Build fix for r125015.
+
+        * bindings/v8/V8BindingPerIsolateData.h:
+        (WebCore):
+
+2012-08-08  Matt Arsenault  <arsenm2@gmail.com>
+
+        Crash when inspecting an element with border-image
+        https://bugs.webkit.org/show_bug.cgi?id=93380
+
+        Reviewed by Tim Horton.
+
+        The second value in the CSSPair should be the same as the first if
+        we are in a shorthand and the next value is not a
+        border-image-repeat keyword.
+
+        Test: fast/css/parse-border-image-repeat-null-crash.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseBorderImageRepeat):
+
+2012-08-08  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Factor out V8BindingPerIsolateData from V8Binding to a separate file
+        https://bugs.webkit.org/show_bug.cgi?id=93333
+
+        Reviewed by Adam Barth.
+
+        This patch moves V8BindingPerIsolateData to V8BindingPerIsolateData.{h,cpp}.
+
+        To avoid circular #include dependency, I used OwnPtrs for m_stringCache,
+        m_integerCache, m_hiddenPropertyName and m_gcEventData.
+
+        No tests. No change in behavior.
+
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/v8/ScriptGCEvent.cpp:
+        (WebCore::isolateGCEventData):
+        (WebCore::ScriptGCEvent::addEventListener):
+        (WebCore::ScriptGCEvent::removeEventListener):
+        (WebCore::ScriptGCEvent::gcPrologueCallback):
+        (WebCore::ScriptGCEvent::gcEpilogueCallback):
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        (GCEventData):
+        (WebCore):
+        * bindings/v8/V8BindingPerIsolateData.cpp: Added.
+        (WebCore):
+        (WebCore::V8BindingPerIsolateData::V8BindingPerIsolateData):
+        (WebCore::V8BindingPerIsolateData::~V8BindingPerIsolateData):
+        (WebCore::V8BindingPerIsolateData::create):
+        (WebCore::V8BindingPerIsolateData::ensureInitialized):
+        (WebCore::V8BindingPerIsolateData::dispose):
+        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
+        * bindings/v8/V8BindingPerIsolateData.h: Added.
+        (WebCore):
+        (V8BindingPerIsolateData):
+        (WebCore::V8BindingPerIsolateData::current):
+        (WebCore::V8BindingPerIsolateData::rawTemplateMap):
+        (WebCore::V8BindingPerIsolateData::templateMap):
+        (WebCore::V8BindingPerIsolateData::toStringName):
+        (WebCore::V8BindingPerIsolateData::toStringTemplate):
+        (WebCore::V8BindingPerIsolateData::lazyEventListenerToStringTemplate):
+        (WebCore::V8BindingPerIsolateData::stringCache):
+        (WebCore::V8BindingPerIsolateData::integerCache):
+        (WebCore::V8BindingPerIsolateData::allStores):
+        (WebCore::V8BindingPerIsolateData::hiddenPropertyName):
+        (WebCore::V8BindingPerIsolateData::auxiliaryContext):
+        (WebCore::V8BindingPerIsolateData::registerDOMDataStore):
+        (WebCore::V8BindingPerIsolateData::unregisterDOMDataStore):
+        (WebCore::V8BindingPerIsolateData::domDataStore):
+        (WebCore::V8BindingPerIsolateData::setDOMDataStore):
+        (WebCore::V8BindingPerIsolateData::recursionLevel):
+        (WebCore::V8BindingPerIsolateData::incrementRecursionLevel):
+        (WebCore::V8BindingPerIsolateData::decrementRecursionLevel):
+        (WebCore::V8BindingPerIsolateData::globalHandleMap):
+        (WebCore::V8BindingPerIsolateData::internalScriptRecursionLevel):
+        (WebCore::V8BindingPerIsolateData::incrementInternalScriptRecursionLevel):
+        (WebCore::V8BindingPerIsolateData::decrementInternalScriptRecursionLevel):
+        (WebCore::V8BindingPerIsolateData::gcEventData):
+        (WebCore::V8BindingPerIsolateData::setShouldCollectGarbageSoon):
+        (WebCore::V8BindingPerIsolateData::clearShouldCollectGarbageSoon):
+        (WebCore::V8BindingPerIsolateData::shouldCollectGarbageSoon):
+
+2012-08-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: show whitespace nodes if they are the only tag's children.
+        https://bugs.webkit.org/show_bug.cgi?id=93441
+
+        Reviewed by Vsevolod Vlasov.
+
+        Pass whitespace node info into the front-end when it is the only element's child.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+
+2012-08-08  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Pass Isolate to ArrayValue and Dictionary
+        https://bugs.webkit.org/show_bug.cgi?id=93315
+
+        Reviewed by Adam Barth.
+
+        This patch passes Isolate to ArrayValue and Dictionary.
+
+        Rationale 1: We want to replace V8Proxy::throwError(ExceptionCode)
+        with setDOMException(ExceptionCode, Isolate*). For the replacement,
+        we need to pass Isolate to V8Utilities::extractTransferables().
+        To pass Isolate to V8Utilities::extractTransferables(), ( ...omitted... ),
+        we need to pass Isolate to ArrayValue and Dictionary.
+
+        Rationale 2: JSC already passes ExecState to ArrayValue and Dictionary.
+
+        Tests: storage/indexeddb/*
+               fast/files/*
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateEventConstructorCallback):
+        (JSValueToNative):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore::V8TestEventConstructor::constructorCallback):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::optionsObjectCallback):
+        * bindings/v8/ArrayValue.cpp:
+        (WebCore::ArrayValue::operator=):
+        (WebCore::ArrayValue::get):
+        * bindings/v8/ArrayValue.h:
+        (WebCore::ArrayValue::ArrayValue):
+        (ArrayValue):
+        * bindings/v8/Dictionary.cpp:
+        (WebCore::Dictionary::Dictionary):
+        (WebCore::Dictionary::operator=):
+        (WebCore::Dictionary::get):
+        * bindings/v8/Dictionary.h:
+        (Dictionary):
+        * bindings/v8/custom/V8BlobCustom.cpp:
+        (WebCore::V8Blob::constructorCallback):
+        * bindings/v8/custom/V8IntentConstructor.cpp:
+        (WebCore::V8Intent::constructorCallback):
+
+2012-08-08  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: cached images memory instrumentation regression after r124744
+        https://bugs.webkit.org/show_bug.cgi?id=93366
+
+        Reviewed by Vsevolod Vlasov.
+
+        CachedImage memory usage data no includes size of both encoded and
+        decoded data.
+
+        Test: inspector/profiler/memory-instrumentation-cached-images.html
+
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::reportMemoryUsage):
+
+2012-08-08  Kentaro Hara  <haraken@chromium.org>
+
+        Optimize Element::hasAttribute() by replacing String with AtomicString
+        https://bugs.webkit.org/show_bug.cgi?id=90273
+
+        Reviewed by Adam Barth.
+
+        Based on the observation described in this ChangeLog
+        (http://trac.webkit.org/changeset/121439), this patch optimizes the
+        performance of Element::hasAttribute() by replacing String with AtomicString.
+
+        Performance test: https://bugs.webkit.org/attachment.cgi?id=150144
+
+        hasAttribute (Chromium/Linux):
+        329.60ms => 259.00ms
+
+        hasAttributeNS (Chromium/Linux):
+        549.60ms => 435.80ms
+
+        * dom/Element.cpp:
+        (WebCore::Element::hasAttribute):
+        (WebCore::Element::hasAttributeNS):
+        * dom/Element.h:
+        (Element):
+
+2012-08-08  Kentaro Hara  <haraken@chromium.org>
+
+        Optimize Element::removeAttribute() by replacing String with AtomicString
+        https://bugs.webkit.org/show_bug.cgi?id=90265
+
+        Reviewed by Adam Barth.
+
+        Based on the observation described in this ChangeLog
+        (http://trac.webkit.org/changeset/121439), this patch optimizes
+        Element::removeAttribute() by replacing String with AtomicString.
+
+        Performance test: https://bugs.webkit.org/attachment.cgi?id=150140
+
+        removeAttribute (Chromium/Linux):
+        334.20ms => 240.60ms
+
+        removeAttributeNS (Chromium/Linux):
+        552.80ms => 421.60ms
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttribute):
+        (WebCore::Element::removeAttributeNS):
+        * dom/Element.h:
+        (Element):
+
+2012-08-08  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Remove Element::ensureShadowRoot
+        https://bugs.webkit.org/show_bug.cgi?id=77608
+
+        Reviewed by Ryosuke Niwa.
+
+        Since Element::ensureShadowRoot is not used anymore, we can remove this safely.
+
+        No new tests, no change in behavior.
+
+        * WebCore.order:
+        * dom/Element.cpp:
+        * dom/Element.h:
+        (Element):
+
+2012-08-08  Kentaro Hara  <haraken@chromium.org>
+
+        Remove an unused member variable.
+
+        Unreviewed, build fix for r124990.
+
+        * dom/ContainerNode.h:
+        (WebCore::ChildNodesLazySnapshot::ChildNodesLazySnapshot):
+        (ChildNodesLazySnapshot):
+
+2012-08-07  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: TabbedPane should use floating point width values for measuring.
+        https://bugs.webkit.org/show_bug.cgi?id=93349
+
+        Reviewed by Pavel Feldman.
+
+        TabbedPane now uses getBoundingClientRect().width instead of offsetWidth for more precise calculation.
+
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPane.prototype._totalWidth):
+        (WebInspector.TabbedPane.prototype._updateTabsDropDown):
+        (WebInspector.TabbedPane.prototype._measureDropDownButton):
+        (WebInspector.TabbedPane.prototype._updateWidths):
+        (WebInspector.TabbedPaneTab.prototype._measure):
+
+2012-08-08  Douglas Stockwell  <dstockwell@chromium.org>
+
+        'highlight' should not be parsed for a composite operation
+        https://bugs.webkit.org/show_bug.cgi?id=92615
+
+        Reviewed by Ryosuke Niwa.
+
+        r88144 removed support for highlight as a composite operation but did
+        not update the parser.
+
+        Test: fast/backgrounds/composite-highlight-is-invalid.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+
+2012-08-08  Takashi Sakamoto  <tasak@google.com>
+
+        showNodePath should show the age of ShadowRoot
+        https://bugs.webkit.org/show_bug.cgi?id=93347
+
+        Reviewed by Ryosuke Niwa.
+
+        No new tests, because this patch is for fixing a bug of a method for
+        debugging. If NDEBUG is defined, the method is not compiled.
+
+        * dom/Node.cpp:
+        (WebCore::Node::showNodePathForThis):
+        Fixed the bug to obtain the oldest shadow root from a shadow root.
+        oldestShadowRootFor only works for an element node, not for a shadow root.
+
+2012-08-07  Kent Tamura  <tkent@chromium.org>
+
+        Remove fractionDigits argument of WebCore::convertToLocalizedNumber()
+        https://bugs.webkit.org/show_bug.cgi?id=93435
+
+        Reviewed by Kentaro Hara.
+
+        Remove the fractionDigits argument of convertToLocalizedNumber because
+        we don't use it any more. Also, we can remove
+        parseToDoubleForNumberTypeWithDecimalPlaces() functions, which are used
+        to obtain the fractionDigits argument.
+
+        No new tests because of no behavior changes.
+
+        * platform/text/LocalizedNumber.h:
+        (WebCore): Remove the fractionDigits argument of convertToLocalizedNumber.
+        * platform/text/LocalizedNumberICU.cpp:
+        (WebCore::convertToLocalizedNumber): ditto.
+        * platform/text/LocalizedNumberNone.cpp:
+        (WebCore::convertToLocalizedNumber): ditto.
+        * platform/text/mac/LocalizedNumberMac.mm:
+        (WebCore::convertToLocalizedNumber): ditto.
+        * platform/text/win/LocalizedNumberWin.cpp:
+        (WebCore::convertToLocalizedNumber): ditto.
+
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::localizeValue):
+        Remove the code to make the decimalPlace value.
+        * html/parser/HTMLParserIdioms.cpp:
+        Remove parseToDoubleForNumberTypeWithDecimalPlaces.
+        * html/parser/HTMLParserIdioms.h: ditto.
+
+2012-08-08  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        REGRESSION(r65062): out of bound access in TextIterator (5 editing tests) on GTK
+        https://bugs.webkit.org/show_bug.cgi?id=63611
+
+        Reviewed by Ryosuke Niwa.
+
+        Ensure document's layout is up-to-date before using TextIterator
+        to properly calculate the offset for a text change when emitting
+        accessibility related signals in GTK.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::nodeTextChangePlatformNotification): Call
+        to document->updateLayout() before using TextIterator.
+
+2012-08-07  Hayato Ito  <hayato@chromium.org>
+
+        Unreviewed build fix after http://trac.webkit.org/changeset/124975
+
+        Remove assertion introduced in r124975.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::EventDispatcher):
+        (WebCore::EventDispatcher::dispatchEvent):
+        * dom/EventDispatcher.h:
+        (EventDispatcher):
+
+2012-08-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124969.
+        http://trac.webkit.org/changeset/124969
+        https://bugs.webkit.org/show_bug.cgi?id=93436
+
+        Causes assertion failure in RenderQueue (Requested by toyoshim
+        on #webkit).
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::removeChildNode):
+        (WebCore::RenderObjectChildList::appendChildNode):
+        (WebCore::RenderObjectChildList::insertChildNode):
+        * rendering/RenderQuote.cpp:
+        (WebCore::adjustDepth):
+        (WebCore::RenderQuote::RenderQuote):
+        (WebCore::RenderQuote::~RenderQuote):
+        (WebCore::RenderQuote::willBeDestroyed):
+        (WebCore::RenderQuote::renderName):
+        (WebCore):
+        (WebCore::RenderQuote::placeQuote):
+        (WebCore::RenderQuote::originalText):
+        (WebCore::RenderQuote::computePreferredLogicalWidths):
+        (WebCore::RenderQuote::rendererSubtreeAttached):
+        (WebCore::RenderQuote::rendererRemovedFromTree):
+        (WebCore::RenderQuote::styleDidChange):
+        * rendering/RenderQuote.h:
+        (RenderQuote):
+        (WebCore::RenderQuote::isQuote):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::RenderView):
+        * rendering/RenderView.h:
+        (WebCore):
+        (RenderView):
+        (WebCore::RenderView::addRenderQuote):
+        (WebCore::RenderView::removeRenderQuote):
+        (WebCore::RenderView::hasRenderQuotes):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        Optimize ChildNode{Insertion,Removal}Notifier::notify() by lazily taking a snapshot of child nodes
+        https://bugs.webkit.org/show_bug.cgi?id=92965
+
+        Reviewed by Adam Barth.
+
+        This patch improves performance of Dromaeo/dom-modify by 8.2% in both Chromium and Safari.
+
+        [Mac/Safari]     4590.33 runs/s  =>  4965.79 runs/s  (+8.18%)
+        [Chromium/Linux] 3970.63 runs/s  =>  4299.65 runs/s  (+8.29%)
+
+        notifyDescendantRemovedFromDocument() cannot iterate child nodes in this way:
+
+        void notifyDescendantRemovedFromDocument(Node* node) {
+            for (Node* child = node->firstChild(); child; child = child->nextSibling()) {
+                ...;
+                notifyNodeRemovedFromDocument(child);
+            }
+        }
+
+        This is because notifyNodeRemovedFromDocument(child) might dispatch events
+        and the events might change child trees. To avoid security issues, the current
+        code takes a snapshot of child nodes before starting the iteration.
+
+        void notifyDescendantRemovedFromDocument(Node* node) {
+            NodeVector children;
+            getChildNodes(node, children); // Take a snapshot.
+            for (int i = 0; i < children.size(); i++) {
+                ...;
+                notifyNodeRemovedFromDocument(children[i]);
+            }
+        }
+
+        Based on the observation that in almost all cases events won't be dispatched
+        from inside notifyNodeRemovedFromDocument(), this patch implements
+        a "lazy" snapshot. The snapshot is taken at the point where
+        EventDispatcher::dispatchEvent() is invoked. The snapshot is not taken unless
+        any event is dispatched.
+
+        No tests. Confirm that all existing tests pass.
+        Actually, at present there is (should be) no case where an event is
+        dispatched from inside notifyNodeRemovedFromDocument(). Even DOMNodeInserted
+        and DOMNodeRemoved events are not dispatched. Originally the snapshot was
+        implemented "just in case" to protect the code from future attacks.
+        I manually confirmed that the lazy snapshot works correctly by inserting
+        takeChildNodesSnapshot() to notifyDescendantRemovedFromDocument()
+        in a random manner.
+
+        * dom/ContainerNode.cpp:
+        (WebCore):
+        * dom/ContainerNode.h:
+        (ChildNodesLazySnapshot):
+        (WebCore::ChildNodesLazySnapshot::ChildNodesLazySnapshot):
+        (WebCore::ChildNodesLazySnapshot::~ChildNodesLazySnapshot):
+        (WebCore::ChildNodesLazySnapshot::nextNode):
+        (WebCore::ChildNodesLazySnapshot::takeSnapshot):
+        (WebCore::ChildNodesLazySnapshot::nextSnapshot):
+        (WebCore::ChildNodesLazySnapshot::hasSnapshot):
+        (WebCore::ChildNodesLazySnapshot::takeChildNodesLazySnapshot):
+        (WebCore):
+        * dom/ContainerNodeAlgorithms.cpp:
+        (WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoDocument):
+        (WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromDocument):
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchEvent):
+
+2012-08-07  Ojan Vafai  <ojan@chromium.org>
+
+        percentage margins + flex incorrectly overflows the flexbox
+        https://bugs.webkit.org/show_bug.cgi?id=93411
+
+        Reviewed by Tony Chang.
+
+        Percent margins should always be computed with respect to the containing
+        block's width, not it's height. We were getting this wrong in column flows.
+
+        Test: css3/flexbox/percent-margins.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::computeMarginValue):
+        (WebCore):
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
+        * rendering/RenderFlexibleBox.h:
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Replace throwError(ExceptionCode, Isolate*) with setDOMException(ExceptionCode, Isolate*) in v8/* and v8/custom/*
+        https://bugs.webkit.org/show_bug.cgi?id=93226
+
+        Reviewed by Eric Seidel.
+
+        Now throwError(ExceptionCode, Isolate*) is equivalent to
+        setDOMException(ExceptionCode, Isolate*). We can replace the former with
+        the latter. After this replacement, the rule becomes simple and sane:
+        "Use throwError() for throwing JavaScript errors, use setDOMException()
+        for throwing DOM exceptions".
+
+        No tests. No change in behavior.
+
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::transferArrayBuffers):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/v8/custom/V8AudioContextCustom.cpp:
+        (WebCore::V8AudioContext::constructorCallback):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::V8CSSStyleDeclaration::namedPropertySetter):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::V8DOMStringMap::namedPropertySetter):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::handlePostMessageCallback):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::handlePostMessageCallback):
+        * bindings/v8/custom/V8DirectoryEntryCustom.cpp:
+        (WebCore::V8DirectoryEntry::getDirectoryCallback):
+        (WebCore::V8DirectoryEntry::getFileCallback):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::V8Document::evaluateCallback):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8IntentConstructor.cpp:
+        (WebCore::V8Intent::constructorCallback):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::handlePostMessageCallback):
+        * bindings/v8/custom/V8MutationObserverCustom.cpp:
+        (WebCore::V8MutationObserver::constructorCallback):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::V8NotificationCenter::createHTMLNotificationCallback):
+        (WebCore::V8NotificationCenter::createNotificationCallback):
+        (WebCore::V8NotificationCenter::requestPermissionCallback):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::V8SQLTransaction::executeSqlCallback):
+        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
+        (WebCore::V8SQLTransactionSync::executeSqlCallback):
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::storageSetter):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8WebSocket::constructorCallback):
+        (WebCore::V8WebSocket::sendCallback):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::V8WorkerContext::importScriptsCallback):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::handlePostMessageCallback):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::responseTextAccessorGetter):
+        (WebCore::V8XMLHttpRequest::openCallback):
+        (WebCore::V8XMLHttpRequest::sendCallback):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Replace v8::Handle<v8::Value>() in custom bindings with v8Undefined()
+        https://bugs.webkit.org/show_bug.cgi?id=93215
+
+        Reviewed by Eric Seidel.
+
+        We should use v8Undefined() everywhere in V8 bindings.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::V8CSSStyleDeclaration::namedPropertyGetter):
+        (WebCore::V8CSSStyleDeclaration::namedPropertySetter):
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        (WebCore::V8Console::traceCallback):
+        (WebCore::V8Console::assertCallback):
+        (WebCore::V8Console::profileCallback):
+        (WebCore::V8Console::profileEndCallback):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::V8DOMStringMap::namedPropertyGetter):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::indexedPropertyGetter):
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+        * bindings/v8/custom/V8DataViewCustom.cpp:
+        (WebCore::V8DataView::setInt8Callback):
+        (WebCore::V8DataView::setUint8Callback):
+        * bindings/v8/custom/V8DeviceMotionEventCustom.cpp:
+        (WebCore::V8DeviceMotionEvent::initDeviceMotionEventCallback):
+        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
+        (WebCore::V8DeviceOrientationEvent::initDeviceOrientationEventCallback):
+        * bindings/v8/custom/V8DirectoryEntryCustom.cpp:
+        (WebCore::V8DirectoryEntry::getDirectoryCallback):
+        (WebCore::V8DirectoryEntry::getFileCallback):
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::V8HTMLAllCollection::namedPropertyGetter):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::V8HTMLCollection::namedPropertyGetter):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::V8HTMLDocument::GetNamedProperty):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::V8HTMLFormElement::indexedPropertyGetter):
+        (WebCore::V8HTMLFormElement::namedPropertyGetter):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        (WebCore::V8HTMLFrameSetElement::namedPropertyGetter):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::V8HTMLOptionsCollection::indexedPropertyGetter):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::npObjectNamedGetter):
+        (WebCore::npObjectNamedSetter):
+        (WebCore::npObjectIndexedGetter):
+        (WebCore::npObjectIndexedSetter):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::V8HTMLSelectElement::indexedPropertyGetter):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::reloadAccessorGetter):
+        (WebCore::V8Location::replaceAccessorGetter):
+        (WebCore::V8Location::assignAccessorGetter):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::V8NamedNodeMap::indexedPropertyGetter):
+        (WebCore::V8NamedNodeMap::namedPropertyGetter):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::V8NodeList::namedPropertyGetter):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        (WebCore::V8SVGLength::convertToSpecifiedUnitsCallback):
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::storageGetter):
+        (WebCore::V8Storage::namedPropertyGetter):
+        (WebCore::storageSetter):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::V8StyleSheetList::namedPropertyGetter):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Replace v8::Handle<v8::Value>() in bindings/v8/* with v8Undefined()
+        https://bugs.webkit.org/show_bug.cgi?id=93211
+
+        Reviewed by Eric Seidel.
+
+        We should use v8Undefined() everywhere in V8 bindings.
+        Replacing v8::Local<v8::Value>() etc with v8Undefined() can cause build
+        errors due to type conversion mismatch. I'll do the replacement in follow-up
+        patches.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::pauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::handleV8DebugEvent):
+        * bindings/v8/SerializedScriptValue.cpp:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::batchConfigureCallbacks):
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):
+        (WebCore::collectionNamedPropertyGetter):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8NPObject.cpp:
+        (WebCore::npObjectGetProperty):
+        (WebCore::npObjectSetProperty):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
+        (WebCore::V8Proxy::throwError):
+        * bindings/v8/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::addListener):
+
+2012-08-07  Joe Mason  <jmason@rim.com>
+
+        Fix regression in credential storage when using Negotiate auth
+        https://bugs.webkit.org/show_bug.cgi?id=93386
+
+        Reviewed by George Staikos.
+
+        r124205 regressed credential storage and lookup.  It added code to update the scheme used in
+        credential storage if the scheme chosen by the network stack is different from that requested by
+        webkit (currently this is only used when webkit requests Negotiate auth, but the Negotiate
+        infrastructure isn't set up correctly, so the network stack falls back to another auth type, usually
+        NTLM).  But the credentials are saved when a "success" status is received, and the scheme in the
+        credentials is not updated until notifyAuthReceived is called to report the actual auth scheme used.
+        The result is that the credentials are stored with the wrong auth scheme and can never be retreived.
+
+        Fixed by delaying the credential save until notifyAuthReceived.
+
+        RIM PR 166514
+        Internally reviewed by George Staikos
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::handleNotifyStatusReceived): Stop storing credentials here.
+        (WebCore::NetworkJob::notifyAuthReceived): Store credentials here instead.
+
+2012-08-07  Kent Tamura  <tkent@chromium.org>
+
+        [Mac] Do not reformat numbers in <input type=number>
+        https://bugs.webkit.org/show_bug.cgi?id=93236
+
+        Reviewed by Hajime Morita.
+
+        We had bugs such as stripping leading zeros, dropping lower digits of
+        large numbers because we parse a user-input string to a double value,
+        and generate a string from the double value.
+
+        In order to avoid such reformatting, we use
+        platform/text/NumberLocalizer, which maps ASCII digits to the
+        corresponding localized digits.
+
+        Test: fast/forms/number/number-lossless-localization.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add the following files:
+         - platform/text/NumberLocalizer.cpp
+         - platform/text/NumberLocalizer.h
+         - platform/mac/LocaleMac.h
+         - platform/mac/LocaleMac.mm
+        * platform/text/mac/LocaleMac.h:
+        (LocaleMac): Inherit NumberLocalizer, and declare
+        initializeNumberLocalizerData() for it.
+        Add m_didInitializeNumberData flag.
+        * platform/text/mac/LocaleMac.mm:
+        (WebCore::LocaleMac::LocaleMac): Initialize m_didInitializeNumberData
+        (WebCore::LocaleMac::initializeNumberLocalizerData):
+        Added. Prepare data for number localization, and call
+        NumberLocalizer::setNumberLocalizerData().
+        A tricky part is to format 9876543210 for m_locale. It seems OSX doesn't
+        have API to get localized digits.
+        * platform/text/mac/LocalizedNumberMac.mm:
+        Remove many lines, and calls the corresponding functions of LocaleMac.
+        (WebCore::convertToLocalizedNumber):
+        (WebCore::convertFromLocalizedNumber):
+        (WebCore::localizedDecimalSeparator):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Move V8BindingMacros.h from bindings/v8/custom/ to bindings/v8/
+        https://bugs.webkit.org/show_bug.cgi?id=93254
+
+        Reviewed by Eric Seidel.
+
+        V8BindingMacros.h should exist in bindings/v8/.
+        This patch also moves related enums from V8Binding.h to V8BindingMacros.h.
+
+        No tests. No change in behavior.
+
+        * WebCore.gypi:
+        * bindings/v8/V8BindingMacros.h: Renamed from Source/WebCore/bindings/v8/custom/V8BindingMacros.h.
+        (WebCore):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] StringCache::m_lastStringImpl and StringCache::m_lastV8String should be in sync
+        https://bugs.webkit.org/show_bug.cgi?id=93065
+
+        Reviewed by Eric Seidel.
+
+        StringCache::m_lastStringImpl caches a StringImpl that was accessed most
+        recently. StringCache::m_lastV8String caches Persistent<String> corresponding
+        to the StringImpl. Hence m_lastStringImpl and m_lastV8String should be in sync.
+
+        However, StringCache::remove() breaks the sync. StringCache::remove() clears
+        m_lastStringImpl but does not clear m_lastV8String. As far as I analyze the code,
+        this won't cause any problem, but we should fix it just in case.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::StringCache::remove):
+
+2012-08-07  Hayato Ito  <hayato@chromium.org>
+
+        Don't re-use the same EventDispatcher instance to dispatch events.
+        https://bugs.webkit.org/show_bug.cgi?id=93322
+
+        Reviewed by Dimitri Glazkov.
+
+        It is potentially dangerous to call
+        EventDispatcher::dispatchEvent(PassRefPtr<Event>) twice for the
+        same EventDispatcher instance.  Some member functions in
+        EventDispatcher assume that dispatchEvent(PassRefPtr<Event>) is
+        never called more than once in its life cycle.
+
+        For example, EventDispatcher::ensureEventAncestor never
+        recalculates ancestors of node even when
+        dispatchEvent(PassRefPtr<Event)) is called again with a different
+        event parameter.
+
+        A 'dblclick' event violates this rule. A 'dblclick' dispatching
+        reuses the same dispatcher instance.  So stop re-using the same
+        dispatcher and add ASSERT to make sure dispatchEvent() is never
+        called more than once.
+
+        No new tests, no change in functionality.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::EventDispatcher):
+        (WebCore::EventDispatcher::dispatchEvent):
+        * dom/EventDispatcher.h:
+        (EventDispatcher):
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEventDispatchMediator::dispatchEvent):
+
+2012-08-07  Joshua Bell  <jsbell@chromium.org>
+
+        Layout Test storage/indexeddb/intversion-omit-parameter.html is flaky
+        https://bugs.webkit.org/show_bug.cgi?id=92952
+
+        Reviewed by Tony Chang.
+
+        Account for events being propagated from the back-end to front-end after
+        front-end context is stopped (i.e. document is being destroyed). The IDBRequest
+        lifecycle was tightened up in http://trac.webkit.org/changeset/123275 with more
+        asserts but the stopped state wasn't accounted for.
+
+        Test: [chromium] webkit_unit_tests --gtest_filter='IDBRequestTest.EventsAfterStopping'
+
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::abort):
+        (WebCore::IDBRequest::onError):
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::onSuccessWithContinuation):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        Optimize Element::getAttributeNode() by replacing String with AtomicString
+        https://bugs.webkit.org/show_bug.cgi?id=90274
+
+        Reviewed by Adam Barth.
+
+        Based on the observation described in this ChangeLog
+        (http://trac.webkit.org/changeset/121439), this patch optimizes
+        the performance of Element::getAttributeNode() by replacing String
+        with AtomicString.
+
+        Performance test: https://bugs.webkit.org/attachment.cgi?id=150147
+
+        getAttributeNode (Chromium/Linux):
+        375.20ms => 310.80ms
+
+        getAttributeNodeNS (Chromium/Linux):
+        684.40ms => 539.00ms
+
+        * dom/Element.cpp:
+        (WebCore::Element::getAttributeNode):
+        (WebCore::Element::getAttributeNodeNS):
+        * dom/Element.h:
+        (Element):
+
+2012-08-07  Michelangelo De Simone  <michelangelo@webkit.org>
+
+        CSSParser::parseTransform() refactor to accept valueList as argument
+        https://bugs.webkit.org/show_bug.cgi?id=93295
+
+        Reviewed by Darin Adler.
+
+        CSS::parseTranform() is now accepting the related CSSParserValueList as
+        argument. This change will be used by the code to parse the 3d-transforms
+        within the custom() function, see bug #71443.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseTransform):
+        * css/CSSParser.h:
+
+2012-08-07  Elliott Sprehn  <esprehn@gmail.com>
+
+        Reimplement RenderQuote placement algorithm
+        https://bugs.webkit.org/show_bug.cgi?id=93056
+
+        Reviewed by Eric Seidel.
+
+        Greatly simplify the code that maintains the linked list of RenderQuotes. Now RenderQuote
+        is placed into the linked list in computePreferredLogicalWidths on first access and is
+        detached when destroyed (or explicitly removed).
+
+        The new algorithm doesn't require walking up the tree of renderers when there are no
+        RenderQuotes in the tree yet, and also removes the need to walk over every subtree
+        when inserting in rendererSubtreeAttached.
+
+        No new tests because this patch doesn't change any behavior.
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::removeChildNode): Call detachQuote when removing from a child list.
+        (WebCore::RenderObjectChildList::appendChildNode):
+        (WebCore::RenderObjectChildList::insertChildNode):
+        * rendering/RenderQuote.cpp:
+        (WebCore::RenderQuote::RenderQuote):
+        (WebCore::RenderQuote::~RenderQuote):
+        (WebCore::RenderQuote::willBeDestroyed): Call detachQuote to ensure all destroyed quotes are detached.
+        (WebCore::RenderQuote::originalText):
+        (WebCore::RenderQuote::computePreferredLogicalWidths): Attach quote before computing the width.
+        (WebCore):
+        (WebCore::RenderQuote::attachQuote): Puts the RenderQuote in the linked list of quotes and computes the depth.
+        (WebCore::RenderQuote::detachQuote): Removes the quote from the linked list.
+        (WebCore::RenderQuote::updateDepth):
+        * rendering/RenderQuote.h:
+        (RenderQuote):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff): Return StyleDifferenceLayout if quotes change and remove check in styleDidChange in RenderQuote.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::RenderView):
+        * rendering/RenderView.h:
+        (WebCore):
+        (WebCore::RenderView::setRenderQuoteHead):
+        (WebCore::RenderView::renderQuoteHead): Stores the first quote in the document.
+        (RenderView):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove a bunch of Persistent::New()s on setJSWrapperForXXXObject()
+        https://bugs.webkit.org/show_bug.cgi?id=93342
+
+        Reviewed by Adam Barth.
+
+        There are a lot of custom bindings like this:
+
+            V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), v8::Persistent<v8::Object>::New(args.Holder()));
+
+        Manually written Persistent::New() is error-prone. We can remove the
+        Persistent::New() by allocating the Persistent handle inside
+        setJSWrapperForDOMObject().
+
+        A new setJSWrapperForDOMObject() receives a wrapper object, allocates
+        the Persistent handle of the wrapper object, and return the Persistent handle.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateConstructorCallback):
+        (GenerateEventConstructorCallback):
+        (GenerateNamedConstructorCallback):
+        (GenerateToV8Converters):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore::V8Float64Array::wrapSlow):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::V8TestActiveDOMObject::wrapSlow):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore::V8TestCustomNamedGetter::wrapSlow):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore::V8TestEventConstructor::constructorCallback):
+        (WebCore::V8TestEventConstructor::wrapSlow):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore::V8TestEventTarget::wrapSlow):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore::V8TestException::wrapSlow):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::constructorCallback):
+        (WebCore::V8TestInterface::wrapSlow):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore::V8TestMediaQueryListListener::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructorConstructorCallback):
+        (WebCore::V8TestNamedConstructor::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::constructorCallback):
+        (WebCore::V8TestNode::wrapSlow):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::V8TestObj::constructorCallback):
+        (WebCore::V8TestObj::wrapSlow):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::V8TestSerializedScriptValueInterface::constructorCallback):
+        (WebCore::V8TestSerializedScriptValueInterface::wrapSlow):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::installDOMWindow):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
+        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMNode):
+        * bindings/v8/V8DOMWrapper.h:
+        (V8DOMWrapper):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
+        (WebCore::V8ArrayBuffer::constructorCallback):
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        (WebCore::wrapArrayBufferView):
+        (WebCore::constructWebGLArray):
+        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
+        (WebCore::V8DOMFormData::constructorCallback):
+        * bindings/v8/custom/V8DataViewCustom.cpp:
+        (WebCore::V8DataView::constructorCallback):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        * bindings/v8/custom/V8IntentConstructor.cpp:
+        (WebCore::V8Intent::constructorCallback):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::V8MessageChannel::constructorCallback):
+        * bindings/v8/custom/V8MutationObserverCustom.cpp:
+        (WebCore::V8MutationObserver::constructorCallback):
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        (WebCore::V8WebKitPoint::constructorCallback):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8WebSocket::constructorCallback):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::V8XMLHttpRequest::constructorCallback):
+
+2012-08-07  Erik Arvidsson  <arv@chromium.org>
+
+        Evolution, empathy no longer build with webkint 1.9.6:  webkit_dom_html_element_set_class_name is gone
+        https://bugs.webkit.org/show_bug.cgi?id=93384
+
+        Reviewed by Adam Barth.
+
+        The GObject bindings do not do inheritance so when className was moved from HTMLElement to Element,
+        webkit_dom_html_element_set_class_name was no longer defined. This patch re-adds the binding for the
+        GObject bindings to HTMLElement.
+
+        No new tests.
+
+        * html/HTMLElement.idl:
+
+2012-08-07  Dirk Pranke  <dpranke@chromium.org>
+
+        fix chromium win build after r124945
+        https://bugs.webkit.org/show_bug.cgi?id=93421
+
+        Unreviewed, build fix.
+
+        Two Efl files were removed in r124945 but we forgot to remove
+        them from WebCore.gypi.
+
+        * WebCore.gypi:
+
+2012-08-07  Dean Jackson  <dino@apple.com>
+
+        Unreviewed build fix for Mac port after http://trac.webkit.org/changeset/124954
+
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::isKeyboardFocusable):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Move setIsolatedWorldSecurityOrigin() from V8Proxy to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=93334
+
+        Reviewed by Adam Barth.
+
+        The goal is to move factor out V8Proxy methods to ScriptController.
+        As a starting point, this patch moves setIsolatedWorldSecurityOrigin().
+
+        isolatedWorlds() and isolatedWorldSecurityOrigins() are temporary methods.
+        They will be soon removed after moving all related methods
+        and m_isolatedWorlds and m_isolatedWorldSecurityOrigins.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::setIsolatedWorldSecurityOrigin):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+        (WebCore):
+        (V8Proxy):
+        (WebCore::V8Proxy::isolatedWorlds):
+        (WebCore::V8Proxy::isolatedWorldSecurityOrigins):
+
+2012-08-07  Yoshifumi Inoue  <yosin@chromium.org>
+
+        translateZ(0) shifts file name in file input
+        https://bugs.webkit.org/show_bug.cgi?id=69248
+
+        Reviewed by Simon Fraser.
+
+        This patch changes to use relative y-coordinate rather than absolute
+        y-coordinate for baseline of text of input type "file" what we've already
+        done for file icon y-coordinate.
+
+        Test: file-appearance-transform-no-effects.html
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject): Changed to use paintOffset
+        instead of absoluteBoundingBoxRectIgnoringTransforms().
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Replace throwError(ExceptionCode, Isolate*) with
+        setDOMException(ExceptionCode, Isolate*) in CodeGeneratorV8.pm
+        https://bugs.webkit.org/show_bug.cgi?id=93223
+
+        Reviewed by Adam Barth.
+
+        Now throwError(ExceptionCode, Isolate*) is equivalent to
+        setDOMException(ExceptionCode, Isolate*). We can replace the former
+        with the latter. After this replacement, the rule becomes simple
+        and sane: "Use throwError() for throwing JavaScript errors, use
+        setDOMException() for throwing DOM exceptions".
+
+        Test: bindings/scripts/test/TestObj.idl
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateParametersCheck):
+        (GenerateConstructorCallback):
+        (GenerateNamedConstructorCallback):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::constructorCallback):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructorConstructorCallback):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::methodWithCallbackArgCallback):
+        (WebCore::TestObjV8Internal::methodWithNonCallbackArgAndCallbackArgCallback):
+        (WebCore::TestObjV8Internal::methodWithCallbackAndOptionalArgCallback):
+        (WebCore::TestObjV8Internal::overloadedMethod5Callback):
+        (WebCore::V8TestObj::constructorCallback):
+
+2012-08-07  Fady Samuel  <fsamuel@chromium.org>
+
+        Allow plugins to decide whether they are keyboard focusable
+        https://bugs.webkit.org/show_bug.cgi?id=88958
+
+        Reviewed by Anders Carlsson.
+
+        * dom/Node.h:
+        (WebCore::Node::isPluginElement):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings):
+        * html/HTMLEmbedElement.h:
+        (HTMLEmbedElement):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
+        * html/HTMLObjectElement.h:
+        (HTMLObjectElement):
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::pluginWidget):
+        (WebCore::HTMLPlugInElement::isKeyboardFocusable):
+        (WebCore):
+        (WebCore::HTMLPlugInElement::isPluginElement):
+        * html/HTMLPlugInElement.h:
+        (HTMLPlugInElement):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocusInDocumentOrder):
+        * plugins/PluginViewBase.h:
+        (WebCore::PluginViewBase::supportsKeyboardFocus):
+
+2012-08-07  Anna Cavender  <annacc@chromium.org>
+
+        Create a MediaSource object.
+        https://bugs.webkit.org/show_bug.cgi?id=91773
+
+        Reviewed by Eric Carlson.
+
+        MediaSource object is needed in order to implement the new
+        object-oriented MediaSource API:
+        http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html
+
+        No new tests - will be able to test after landing:
+        https://bugs.webkit.org/show_bug.cgi?id=91775
+
+        Adding new files to build files:
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        New MediaSource object:
+        * Modules/mediasource/MediaSource.cpp: Added.
+        * Modules/mediasource/MediaSource.h: Added.
+        * Modules/mediasource/MediaSource.idl: Added.
+
+        Create a registry for the blob storage and lookup:
+        * Modules/mediasource/MediaSourceRegistry.cpp: Added.
+        * Modules/mediasource/MediaSourceRegistry.h: Added.
+
+        Connect SourceBuffer to MediaSource:
+        * Modules/mediasource/SourceBuffer.cpp:
+        (WebCore::SourceBuffer::SourceBuffer):
+        (WebCore::SourceBuffer::buffered): Forward call to MediaSource.
+        (WebCore::SourceBuffer::append): Ditto.
+        (WebCore::SourceBuffer::abort): Ditto.
+        * Modules/mediasource/SourceBuffer.h:
+        (WebCore::SourceBuffer::create): Add a MediaSource to the constructor.
+        (WebCore::SourceBuffer::clear): Clear the MediaSource.
+        (SourceBuffer):
+        * Modules/mediasource/SourceBufferList.cpp: include SourceBuffer.h
+        * Modules/mediasource/SourceBufferList.h:
+
+        Make MediaSource an EventTarget:
+        * dom/EventTarget.h:
+        (WebCore):
+        * dom/EventTargetFactory.in:
+
+        Enable creation of MediaSource object URL from JavaScript:
+        * html/DOMURL.cpp:
+        (WebCore):
+        (WebCore::DOMURL::createObjectURL):
+        (WebCore::DOMURL::revokeObjectURL):
+        * html/DOMURL.h:
+        (WebCore):
+        (DOMURL):
+        * html/DOMURL.idl:
+        * html/PublicURLManager.h: create a new sourceURLs list for storing
+            reigstered MediaSource URLS.
+        (WebCore::PublicURLManager::contextDestroyed): make sure everything is
+            removed from the sourceURLs list upon destruction.
+        (PublicURLManager):
+        (WebCore::PublicURLManager::sourceURLs): getter for the sourceURLs list.
+
+        New MediaSource constructor:
+        * page/DOMWindow.idl:
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Implement V8Proxy::registerExtensionIfNeeded() and remove redundant methods
+        https://bugs.webkit.org/show_bug.cgi?id=93209
+
+        Reviewed by Adam Barth.
+
+        By implementing V8Proxy::registerExtensionIfNeeded(), we can remove
+        registeredExtensionWithV8() and registerExtension().
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::createNewContext):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::registerExtensionIfNeeded):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+
+2012-08-07  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Remove PlatformTouchEventEfl and PlatformTouchPointEfl
+        https://bugs.webkit.org/show_bug.cgi?id=93270
+
+        Reviewed by Eric Seidel.
+
+        PlatformTouchEventEfl and PlatformTouchPointEfl initialize PlatformTouchEvent
+        directly from Ewk_TouchEvent which is WebKit1/Efl API and they can not be
+        shared with WebKit2/Efl.
+
+        In order to remove this WebKit dependency from WebCore, this patch removes Efl
+        specific codes from PlatformTouchXXX and adds the classes which convert
+        Ewk_Touch_XXX to PlatformTouchXXX.
+
+        No new tests. Just a refactoring.
+
+        * PlatformEfl.cmake: Removed PlatformTouchEventEfl.cpp and PlatformTouchPointEfl.cpp
+        * platform/PlatformTouchEvent.h: Removed Efl specific codes.
+        (PlatformTouchEvent):
+        * platform/PlatformTouchPoint.h: Ditto.
+        (PlatformTouchPoint):
+        * platform/efl/PlatformTouchEventEfl.cpp: Removed.
+        * platform/efl/PlatformTouchPointEfl.cpp: Removed.
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Avoid dependending on implicit WebString -> String conversion in compositor
+        https://bugs.webkit.org/show_bug.cgi?id=93408
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::initialize):
+        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
+        (WebCore::CCResourceProvider::initialize):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Factor out V8Binding methods that configures DOM attributes and methods
+        https://bugs.webkit.org/show_bug.cgi?id=93239
+
+        Reviewed by Adam Barth.
+
+        V8Binding is messy. This patch factors out V8Binding methods that configures
+        DOM attributes and methods into another file. This patch just moves the methods
+        from V8Binding.{h,cpp} to V8ConfigureDOMAttributesAndMethods.{h,cpp}.
+
+        No tests. No change in behavior.
+
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        * bindings/v8/V8ConfigureDOMAttributesAndMethods.cpp: Added.
+        (WebCore):
+        (WebCore::batchConfigureAttributes):
+        (WebCore::batchConfigureConstants):
+        (WebCore::batchConfigureCallbacks):
+        (WebCore::configureTemplate):
+        * bindings/v8/V8ConfigureDOMAttributesAndMethods.h: Added.
+        (WebCore):
+        (BatchedAttribute):
+        (WebCore::configureAttribute):
+        (BatchedConstant):
+        (BatchedCallback):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Replace all V8 undefined values in the rest of custom bindings with v8Undefined()
+        https://bugs.webkit.org/show_bug.cgi?id=93220
+
+        Reviewed by Eric Seidel.
+
+        We should use v8Undefined() everywhere in V8 bindings.
+        This patch replaces all V8 undefined values in the rest of custom bindings
+        with v8Undefined().
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::V8DOMStringMap::namedPropertyQuery): Simple refactoring not related to
+        this patch. Since other bindings are using 0 instead of v8::None, we should use 0 here too.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8ScriptProfileCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8ScriptProfileNodeCustom.cpp:
+        (WebCore::toV8):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove #include V8BindingMacros.h
+        https://bugs.webkit.org/show_bug.cgi?id=93312
+
+        Reviewed by Eric Seidel.
+
+        We are factoring out V8Binding methods to separate files.
+        After the refactoring, V8Binding.h will include binding related
+        header files (e.g. V8BindingMacros.h, V8BindingHelper.h, etc), so that
+        custom V8 binding files just need to include V8Binding.h only.
+
+        We can remove '#include V8BindingMacros.h' from V8 binding files.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNormalAttrSetter):
+        (GenerateParametersCheck):
+        (GenerateEventConstructorCallback):
+        (ConvertToV8Parameter):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/custom/V8BlobCustom.cpp:
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DataViewCustom.cpp:
+        * bindings/v8/custom/V8DeviceMotionEventCustom.cpp:
+        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
+        * bindings/v8/custom/V8DirectoryEntryCustom.cpp:
+        * bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp:
+        * bindings/v8/custom/V8IntentConstructor.cpp:
+        * bindings/v8/custom/V8MutationObserverCustom.cpp:
+        * bindings/v8/custom/V8PerformanceCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebKitAnimationCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove #include Frame.h from V8Binding.h
+        https://bugs.webkit.org/show_bug.cgi?id=93326
+
+        Reviewed by Adam Barth.
+
+        We want to remove unnecessary #include in V8Binding.h
+        to avoid circular include dependency.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateDomainSafeFunctionGetter):
+        (GenerateNormalAttrGetter):
+        (GenerateReplaceableAttrSetter):
+        (GenerateFunctionCallback):
+        (GenerateNamedConstructorCallback):
+        (GenerateToV8Converters):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        * bindings/v8/ScheduledAction.cpp:
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
+        * testing/v8/WebCoreTestSupport.cpp:
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Factor out V8Binding classes that manage V8 value's cache
+        https://bugs.webkit.org/show_bug.cgi?id=93343
+
+        Reviewed by Adam Barth.
+
+        We are factoring out V8Binding methods to separate files.
+        This patch moves V8Binding classes that manage V8 value's cache
+        to V8ValueCache.{h,cpp}.
+
+        No tests. No change in behavior.
+
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        * bindings/v8/V8ValueCache.cpp: Added.
+        (WebCore):
+        (WebCore::makeExternalString):
+        (WebCore::cachedStringCallback):
+        (WebCore::StringCache::remove):
+        (WebCore::StringCache::v8ExternalStringSlow):
+        (WebCore::IntegerCache::createSmallIntegers):
+        (WebCore::IntegerCache::~IntegerCache):
+        * bindings/v8/V8ValueCache.h: Added.
+        (WebCore):
+        (StringCache):
+        (WebCore::StringCache::StringCache):
+        (WebCore::StringCache::v8ExternalString):
+        (WebCore::StringCache::clearOnGC):
+        (WebCoreStringResource):
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::webcoreString):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::visitStrings): This method is used by inspector
+        and thus is not performance-critical. To avoid circular #include dependency,
+        I moved the implementation to cpp.
+        (WebCore::WebCoreStringResource::toStringResource):
+        (IntegerCache):
+        (WebCore::IntegerCache::IntegerCache):
+        (WebCore::IntegerCache::v8Integer):
+        (WebCore::IntegerCache::v8UnsignedInteger):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Switch PlatformLayer typedef to Platform API type for PLATFORM(CHROMIUM)
+        https://bugs.webkit.org/show_bug.cgi?id=93335
+
+        Reviewed by Adrienne Walker.
+
+        This converts the PlatformLayer typedef to WebKit::WebLayer (part of the chromium Platform API) for the
+        Chromium port. This involves some odd const_cast<>s in places since cross-platform interfaces assume that
+        PlatformLayer is a potentially heavy implementation class, but WebLayer is a thin smart pointer type.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::createScrollbarLayer):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setLayerIsContainerForFixedPositionLayers):
+        (WebCore::ScrollingCoordinator::setLayerIsFixedToContainerLayer):
+        * platform/graphics/PlatformLayer.h:
+        (WebKit):
+        (WebCore):
+        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
+        (WebCore::Canvas2DLayerBridge::layer):
+        * platform/graphics/chromium/Canvas2DLayerBridge.h:
+        (Canvas2DLayerBridge):
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBufferPrivate::layer):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::removeFromParent):
+        (WebCore::GraphicsLayerChromium::setDrawsContent):
+        (WebCore::GraphicsLayerChromium::setContentsVisible):
+        (WebCore::GraphicsLayerChromium::setMaskLayer):
+        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
+        (WebCore::GraphicsLayerChromium::setContentsToMedia):
+        (WebCore::GraphicsLayerChromium::primaryLayer):
+        (WebCore::GraphicsLayerChromium::platformLayer):
+        (WebCore::GraphicsLayerChromium::updateChildList):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (GraphicsLayerChromium):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use WebCompositor interface in Platform API instead of CCProxy to query threaded compositor status
+        https://bugs.webkit.org/show_bug.cgi?id=93398
+
+        Reviewed by Adam Barth.
+
+        Converts non-compositor code that cares about threaded compositing status over to query WebCompositor instead of
+        CCProxy.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        * platform/chromium/support/WebCompositorImpl.cpp:
+        (WebKit):
+        (WebKit::WebCompositor::threadingEnabled):
+        (WebKit::WebCompositor::onCompositorThread):
+        (WebKit::WebCompositorImpl::threadingEnabled):
+        * platform/chromium/support/WebCompositorImpl.h:
+        (WebCompositorImpl):
+        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
+        (WebCore::Canvas2DLayerBridge::Canvas2DLayerBridge):
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::DrawingBuffer):
+
+2012-08-07  Anders Carlsson  <andersca@apple.com>
+
+        Knob slot animation is flipped
+        https://bugs.webkit.org/show_bug.cgi?id=93396
+
+        Reviewed by Beth Dakin.
+
+        When painting the scrollbar knob slot, use rectForPart: since it correctly takes the expansion transition state into account.
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::scrollbarPainterPaint):
+
+2012-08-07  Adrienne Walker  <enne@google.com>
+
+        50% fixed position coverage slow scroll heuristic is incorrect when invalidations aren't clipped
+        https://bugs.webkit.org/show_bug.cgi?id=92011
+
+        Reviewed by Simon Fraser.
+
+        The heuristic in scrollContentsFastPath to slow scroll by invalidating
+        the entire frame if fixed position elements cover 50% of the frame
+        takes away the ability of ports to make their own decisions about how
+        to best handle invalidations. Therefore, remove this heuristic.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollContentsFastPath):
+
+2012-08-07  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Change how devicePixelRatio is set.
+        https://bugs.webkit.org/show_bug.cgi?id=93385
+
+        Reviewed by Antonio Gomes.
+
+        Update the theme to adjust to a constant devicePixelRatio.
+
+        Not testable.
+
+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore::determineFullScreenMultiplier):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move WebCompositor interface into Platform API
+        https://bugs.webkit.org/show_bug.cgi?id=93391
+
+        Reviewed by Adam Barth.
+
+        Moves the support files for WebCompositor into WebCore/platform/support/. CCThreadImpl is a helper class used
+        only by WebCompositorImpl.
+
+        Refactor/renaming only, so no new tests.
+
+        * WebCore.gypi:
+        * platform/chromium/support/CCThreadImpl.cpp: Renamed from Source/WebKit/chromium/src/CCThreadImpl.cpp.
+        (WebKit):
+        (GetThreadIDTask):
+        (WebKit::GetThreadIDTask::GetThreadIDTask):
+        (WebKit::GetThreadIDTask::~GetThreadIDTask):
+        (WebKit::GetThreadIDTask::run):
+        (CCThreadTaskAdapter):
+        (WebKit::CCThreadTaskAdapter::CCThreadTaskAdapter):
+        (WebKit::CCThreadTaskAdapter::~CCThreadTaskAdapter):
+        (WebKit::CCThreadTaskAdapter::run):
+        (WebKit::CCThreadImpl::create):
+        (WebKit::CCThreadImpl::~CCThreadImpl):
+        (WebKit::CCThreadImpl::postTask):
+        (WebKit::CCThreadImpl::postDelayedTask):
+        (WebKit::CCThreadImpl::threadID):
+        (WebKit::CCThreadImpl::CCThreadImpl):
+        * platform/chromium/support/CCThreadImpl.h: Renamed from Source/WebKit/chromium/src/CCThreadImpl.h.
+        (WebKit):
+        (CCThreadImpl):
+        * platform/chromium/support/WebCompositorImpl.cpp: Renamed from Source/WebKit/chromium/src/WebCompositorImpl.cpp.
+        (WebKit):
+        (WebKit::WebCompositor::initialize):
+        (WebKit::WebCompositor::shutdown):
+        (WebKit::WebCompositor::setPerTilePaintingEnabled):
+        (WebKit::WebCompositor::setPartialSwapEnabled):
+        (WebKit::WebCompositor::setAcceleratedAnimationEnabled):
+        (WebKit::WebCompositorImpl::initialize):
+        (WebKit::WebCompositorImpl::initialized):
+        (WebKit::WebCompositorImpl::shutdown):
+        * platform/chromium/support/WebCompositorImpl.h: Renamed from Source/WebKit/chromium/src/WebCompositorImpl.h.
+        (WebCore):
+        (WebKit):
+        (WebCompositorImpl):
+
+2012-08-07  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in ContainerNode::cloneChildNodes.
+        https://bugs.webkit.org/show_bug.cgi?id=93378
+
+        Reviewed by Levi Weintraub.
+
+        Re-enabling the editing delete button controller in cloneChildNode was causing style changes,
+        thereby causing load events to fire. The load event can blow our nodes from underneath. This causes
+        crashes when we are nested inside cloneChildNodes. The patch just skips the delete button controller's
+        container element from being cloned and removes the hacky enable/disable logic. 
+
+        Test: fast/dom/clone-node-load-event-crash.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::cloneChildNodes):
+
+2012-08-07  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        GraphicsLayerAnimation shouldn't use HashMap<String>
+        https://bugs.webkit.org/show_bug.cgi?id=93284
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use a vector containing all the animations instead of a map of String to Vector.
+        The HashMap contains very few elements, which makes it inefficient relatively to a vector.
+        This has been shown to be a bottleneck in valgrind.
+
+        Covered by existing animation tests.
+
+        * platform/graphics/GraphicsLayerAnimation.cpp:
+        (WebCore::GraphicsLayerAnimation::GraphicsLayerAnimation):
+        (WebCore::GraphicsLayerAnimations::hasActiveAnimationsOfType):
+        (WebCore::GraphicsLayerAnimations::hasRunningAnimations):
+        (WebCore::GraphicsLayerAnimations::add):
+        (WebCore::GraphicsLayerAnimations::pause):
+        (WebCore::GraphicsLayerAnimations::remove):
+        (WebCore::GraphicsLayerAnimations::apply):
+        * platform/graphics/GraphicsLayerAnimation.h:
+        (GraphicsLayerAnimation):
+        (WebCore::GraphicsLayerAnimation::name):
+        (GraphicsLayerAnimations):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::addAnimation):
+
+2012-08-07  Marcelo Lira  <marcelo.lira@openbossa.org>
+
+        [Qt] Add support for the Gamepad API
+        https://bugs.webkit.org/show_bug.cgi?id=90637
+
+        Reviewed by Alexis Menard.
+
+        Adds support for Gamepad API on the Qt port.
+
+        The implementation of this class relies on the Linux
+        kernel joystick API.
+
+        Gamepad devices are recognized through the GamepadsQt
+        class, which uses the udev library to watch for connection,
+        disconnection and other gamepad related events.
+
+        Tests for this feature already exist.
+
+        * DerivedSources.pri:
+        * Target.pri:
+        * WebCore.pri:
+        * platform/qt/GamepadsQt.cpp: Added.
+        (WebCore):
+        (GamepadDeviceLinuxQt):
+        (WebCore::GamepadDeviceLinuxQt::create):
+        (WebCore::GamepadDeviceLinuxQt::GamepadDeviceLinuxQt):
+        (WebCore::GamepadDeviceLinuxQt::~GamepadDeviceLinuxQt):
+        (WebCore::GamepadDeviceLinuxQt::readCallback):
+        (GamepadsQt):
+        (WebCore::GamepadsQt::GamepadsQt):
+        (WebCore::GamepadsQt::~GamepadsQt):
+        (WebCore::GamepadsQt::isGamepadDevice):
+        (WebCore::GamepadsQt::onGamePadChange):
+        (WebCore::GamepadsQt::registerDevice):
+        (WebCore::GamepadsQt::unregisterDevice):
+        (WebCore::GamepadsQt::updateGamepadList):
+        (WebCore::sampleGamepads):
+
+2012-08-07  Mike Reed  <reed@google.com>
+
+        reimplement fastMod w/o (soon to be) private skia macros
+        https://bugs.webkit.org/show_bug.cgi?id=93370
+
+        Reviewed by Adrienne Walker.
+
+        fastMod() reimplemented (same functionality) to stop using soon-to-be private macros in
+        SkMath.h. The new version is functionally identical.
+
+        No new tests -- existing layouttests exercise GraphicsContext::strokeArc(), the only caller
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+
+2012-08-07  Brian Anderson  <brianderson@chromium.org>
+
+        Add CCDelayBasedTimeSource::setTimebaseAndInterval
+        https://bugs.webkit.org/show_bug.cgi?id=92825
+
+        Reviewed by James Robinson.
+
+        Allows CCDelayBaseTimeSource to have it's timebase and interval updated
+        on the fly.  Accounts for double ticking due to jitter or resetting the
+        timer multiple times quickly.
+
+        CCDelayBasedTimeSourceTest updated with two tests for proper handling
+        of jittery timebase/interval source and immediate handling of
+        significant timebase/interval changes.
+
+        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
+        (WebCore::CCDelayBasedTimeSource::CCDelayBasedTimeSource):
+        (WebCore::CCDelayBasedTimeSource::nextTickTime):
+        (WebCore):
+        (WebCore::CCDelayBasedTimeSource::onTimerFired):
+        (WebCore::CCDelayBasedTimeSource::setTimebaseAndInterval):
+        (WebCore::CCDelayBasedTimeSource::postNextTickTask):
+        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.h:
+
+2012-07-23  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Reuse precompiled shaders across elements
+        https://bugs.webkit.org/show_bug.cgi?id=88427
+
+        Reviewed by Dean Jackson.
+
+        Added CustomFilterProgramInfo as a link between the CustomFilterProgram and the CustomFilterCompiledProgram.
+        CustomFilterGlobalContext now acts as a cache for the compiled shaders. Note that only the shaders displayed on the page
+        are cached, making it useful in animations or when more elements share the same shader filter.
+
+        For CSS Shaders we need two files, vertex and fragment shaders, so that's why we have a CustomFilterProgram. 
+        CustomFilterProgram is the platform object, so StyleCustomFilterProgram implements it and is referenced from the RenderStyle.
+
+        StyleCustomFilterProgram is also the one that actually keeps references to the CachedShaders and has all the loading logic.
+        The only problem is that there might be multiple StyleCustomFilterProgram with the same set of CachedShaders.
+        That's why in this patch I've added CustomFilterProgramInfo as a simple class to be used as a key in a hash map.
+
+        For now CustomFilterProgramInfo should act similar to a pair<String, String>. There's only one exception: one of the strings
+        is allowed to be null. A null string is the placeholder for the default shader.
+
+        Note that alpha compositing and blending will be added to the CustomFilterProgramInfo after the mix() 
+        function parsing will land in https://bugs.webkit.org/show_bug.cgi?id=90101 .
+
+        Test: css3/filters/custom/custom-filter-shader-reuse.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/CustomFilterCompiledProgram.cpp:
+        (WebCore::CustomFilterCompiledProgram::CustomFilterCompiledProgram):
+        (WebCore::CustomFilterCompiledProgram::getDefaultShaderString): Returns the default shader based on the type.
+        (WebCore):
+        (WebCore::CustomFilterCompiledProgram::compileShader): Added check for isNull and used the default shader in that case.
+        (WebCore::CustomFilterCompiledProgram::~CustomFilterCompiledProgram): Added call to CustomFilterGlobalContext::removeCompiledProgram.
+        * platform/graphics/filters/CustomFilterCompiledProgram.h:
+        (WebCore::CustomFilterCompiledProgram::detachFromGlobalContext): Called from ~CustomFilterGlobalContext, so that it doesn't call into a deleted object later when ~CustomFilterCompiledProgram is called. It should only happen when CustomFilterGlobalContext dies before the 
+        CustomFilterCompiledPrograms that it caches.
+        (WebCore):
+        * platform/graphics/filters/CustomFilterGlobalContext.cpp:
+        (WebCore::CustomFilterGlobalContext::~CustomFilterGlobalContext):
+        (WebCore::CustomFilterGlobalContext::getCompiledProgram): Gets or creates a compiled shader for a specific CustomFilterProgramInfo.
+        (WebCore):
+        (WebCore::CustomFilterGlobalContext::removeCompiledProgram): Called by ~CustomFilterCompiledProgram.
+        * platform/graphics/filters/CustomFilterGlobalContext.h:
+        (WebCore):
+        (CustomFilterGlobalContext):
+        * platform/graphics/filters/CustomFilterProgram.cpp:
+        (WebCore::CustomFilterProgram::programInfo):
+        * platform/graphics/filters/CustomFilterProgram.h:
+        (WebCore):
+        * platform/graphics/filters/CustomFilterProgramInfo.cpp: Added.
+        (WebCore):
+        (WebCore::hashPossiblyNullString): We need to allow null strings in the hash, so this is a helper to check for isNull 
+        before asking for the hash.
+        (WebCore::CustomFilterProgramInfo::CustomFilterProgramInfo):
+        (WebCore::CustomFilterProgramInfo::isEmptyValue):
+        (WebCore::CustomFilterProgramInfo::isHashTableDeletedValue):
+        (WebCore::CustomFilterProgramInfo::hash):
+        (WebCore::CustomFilterProgramInfo::operator==):
+        * platform/graphics/filters/CustomFilterProgramInfo.h: Added.
+        (WebCore):
+        (CustomFilterProgramInfo):
+        (WebCore::CustomFilterProgramInfo::vertexShaderString):
+        (WebCore::CustomFilterProgramInfo::fragmentShaderString):
+        (WebCore::CustomFilterProgramInfoHash::hash):
+        (WebCore::CustomFilterProgramInfoHash::equal):
+        (CustomFilterProgramInfoHash): Structures needed to make this a key in the hash map.
+        (CustomFilterProgramInfoHashTraits):
+        (WebCore::CustomFilterProgramInfoHashTraits::isEmptyValue): I've used the deleted strings value to mark a deleted
+        CustomFilterProgramInfo object. Those are not safe to compare to deleted, so there's a need to set safeToCompareToEmptyOrDeleted to false, meaning that there's a need to manually check for empty values.
+        (WTF):
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::initializeContext): Moved to using the cached shader instead.
+
+2012-08-07  Florin Malita  <fmalita@chromium.org>
+
+        [Chromium] Unreviewed build fix after r124879.
+
+        * WebCore.gypi: Remove deleted file references.
+
+2012-08-07  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] We should fail the HTTP auth silently for non-main loads
+        in the non-viewer process.
+        https://bugs.webkit.org/show_bug.cgi?id=93230
+
+        Reviewed by Rob Buis.
+
+        No way to test this in WebKit.
+
+        * platform/network/blackberry/NetworkJob.cpp: Add early return.
+        (WebCore::NetworkJob::sendRequestWithCredentials):
+
+2012-08-07  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Typing backslash in Console traverses the panel history when using German keyboard layout
+        https://bugs.webkit.org/show_bug.cgi?id=93357
+
+        Reviewed by Vsevolod Vlasov.
+
+        For some reason, in the German keyboard layout keyIdentifier for '\' is the same as that for '['
+        in the ordinary English-US layout.
+        Remove a too-safe-side check and never switch panels on key combinations that result in "keypress" events.
+
+        * inspector/front-end/InspectorView.js:
+        (WebInspector.InspectorView):
+        (WebInspector.InspectorView.prototype._keyPress):
+
+2012-08-07  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] GL scissor test is accidentally turned off
+        https://bugs.webkit.org/show_bug.cgi?id=93360
+        PR #161020
+
+        Reviewed by Antonio Gomes.
+
+        The GL scissor test is accidentally turned off inside drawTextures().
+        This is wrong and should be removed.
+
+        * platform/graphics/blackberry/LayerCompositingThread.cpp:
+        (WebCore::LayerCompositingThread::drawTextures):
+
+2012-08-07  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in InlineFlowBox::deleteLine.
+        https://bugs.webkit.org/show_bug.cgi?id=88795
+
+        Reviewed by Tony Chang.
+
+        When we move the fullscreen object from its parent to RenderFullScreen, we forgot to clear the
+        line box tree underneath the object's containing block and mark it for layout. Before the patch,
+        the containing block never got laid out and maintained references to removed line boxes (since the
+        object moved under RenderFullScreen did get laid out and its lineboxes replaced with new ones).
+
+        Test: fullscreen/full-screen-line-boxes-crash.html
+
+        * rendering/RenderFullScreen.cpp:
+        (RenderFullScreen::wrapRenderer):
+
+2012-08-07  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Do not disable network tracking while profiling cpu.
+        https://bugs.webkit.org/show_bug.cgi?id=93359
+
+        Reviewed by Yury Semikhatsky.
+
+        Removed network tracking enabling/disabling machinery.
+
+        * inspector/front-end/CPUProfileView.js:
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager.get this):
+        (WebInspector.NetworkManager.get NetworkAgent):
+        (WebInspector.NetworkManager):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel):
+
+2012-08-07  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: make the MemoryClassInfo class a not-template
+        https://bugs.webkit.org/show_bug.cgi?id=93265
+
+        Reviewed by Yury Semikhatsky.
+
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::reportMemoryUsage):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::reportMemoryUsage):
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        (WebCore::ChunkedTable::reportMemoryUsage):
+        * bindings/v8/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::reportMemoryUsage):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
+        (WebCore::StringCache::reportMemoryUsage):
+        * bindings/v8/V8DOMMap.h:
+        * css/CSSAspectRatioValue.cpp:
+        (WebCore::CSSAspectRatioValue::reportDescendantMemoryUsage):
+        * css/CSSBorderImageSliceValue.cpp:
+        (WebCore::CSSBorderImageSliceValue::reportDescendantMemoryUsage):
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcValue::reportDescendantMemoryUsage):
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::reportDescendantMemoryUsage):
+        * css/CSSCharsetRule.cpp:
+        (WebCore::CSSCharsetRule::reportDescendantMemoryUsage):
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::reportMemoryUsage):
+        * css/CSSCrossfadeValue.cpp:
+        (WebCore::CSSCrossfadeValue::reportDescendantMemoryUsage):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::CSSCursorImageValue::reportDescendantMemoryUsage):
+        * css/CSSFontFaceRule.cpp:
+        (WebCore::CSSFontFaceRule::reportDescendantMemoryUsage):
+        * css/CSSFontFaceSrcValue.cpp:
+        (WebCore::CSSFontFaceSrcValue::reportDescendantMemoryUsage):
+        * css/CSSFunctionValue.cpp:
+        (WebCore::CSSFunctionValue::reportDescendantMemoryUsage):
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientColorStop::reportMemoryUsage):
+        (WebCore::CSSGradientValue::reportBaseClassMemoryUsage):
+        (WebCore::CSSLinearGradientValue::reportDescendantMemoryUsage):
+        (WebCore::CSSRadialGradientValue::reportDescendantMemoryUsage):
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::reportBaseClassMemoryUsage):
+        * css/CSSImageSetValue.cpp:
+        (WebCore::CSSImageSetValue::reportDescendantMemoryUsage):
+        (WebCore::CSSImageSetValue::ImageWithScale::reportMemoryUsage):
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::reportDescendantMemoryUsage):
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::reportDescendantMemoryUsage):
+        * css/CSSInheritedValue.cpp:
+        (WebCore::CSSInheritedValue::reportDescendantMemoryUsage):
+        * css/CSSInitialValue.cpp:
+        (WebCore::CSSInitialValue::reportDescendantMemoryUsage):
+        * css/CSSLineBoxContainValue.cpp:
+        (WebCore::CSSLineBoxContainValue::reportDescendantMemoryUsage):
+        * css/CSSMediaRule.cpp:
+        (WebCore::CSSMediaRule::reportDescendantMemoryUsage):
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::reportDescendantMemoryUsage):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::reportDescendantMemoryUsage):
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::reportMemoryUsage):
+        * css/CSSReflectValue.cpp:
+        (WebCore::CSSReflectValue::reportDescendantMemoryUsage):
+        * css/CSSRule.cpp:
+        (WebCore::CSSRule::reportBaseClassMemoryUsage):
+        * css/CSSRuleList.cpp:
+        (WebCore::StaticCSSRuleList::reportMemoryUsage):
+        * css/CSSRuleList.h:
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::reportMemoryUsage):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::reportDescendantMemoryUsage):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::reportMemoryUsage):
+        * css/CSSTimingFunctionValue.cpp:
+        (WebCore::CSSLinearTimingFunctionValue::reportDescendantMemoryUsage):
+        (WebCore::CSSCubicBezierTimingFunctionValue::reportDescendantMemoryUsage):
+        (WebCore::CSSStepsTimingFunctionValue::reportDescendantMemoryUsage):
+        * css/CSSUnicodeRangeValue.cpp:
+        (WebCore::CSSUnicodeRangeValue::reportDescendantMemoryUsage):
+        * css/CSSUnknownRule.h:
+        (WebCore::CSSUnknownRule::reportDescendantMemoryUsage):
+        * css/CSSValue.cpp:
+        (WebCore::TextCloneCSSValue::reportDescendantMemoryUsage):
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::reportDescendantMemoryUsage):
+        * css/CSSVariableValue.h:
+        (WebCore::CSSVariableValue::reportDescendantMemoryUsage):
+        * css/FontFeatureValue.cpp:
+        (WebCore::FontFeatureValue::reportDescendantMemoryUsage):
+        * css/FontValue.cpp:
+        (WebCore::FontValue::reportDescendantMemoryUsage):
+        * css/MediaList.cpp:
+        (WebCore::MediaQuerySet::reportMemoryUsage):
+        (WebCore::MediaList::reportMemoryUsage):
+        * css/MediaQuery.cpp:
+        (WebCore::MediaQuery::reportMemoryUsage):
+        * css/MediaQueryExp.cpp:
+        (WebCore::MediaQueryExp::reportMemoryUsage):
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::reportMemoryUsage):
+        (WebCore::StyleRuleCSSStyleDeclaration::reportMemoryUsage):
+        (WebCore::InlineCSSStyleDeclaration::reportMemoryUsage):
+        * css/ShadowValue.cpp:
+        (WebCore::ShadowValue::reportDescendantMemoryUsage):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::reportMemoryUsage):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::Features::reportMemoryUsage):
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/StyleRule.cpp:
+        (WebCore::StyleRuleBase::reportMemoryUsage):
+        (WebCore::StyleRule::reportDescendantMemoryUsage):
+        (WebCore::StyleRulePage::reportDescendantMemoryUsage):
+        (WebCore::StyleRuleFontFace::reportDescendantMemoryUsage):
+        (WebCore::StyleRuleBlock::reportDescendantMemoryUsage):
+        (WebCore::StyleRuleMedia::reportDescendantMemoryUsage):
+        (WebCore::StyleRuleRegion::reportDescendantMemoryUsage):
+        * css/StyleRuleImport.cpp:
+        (WebCore::StyleRuleImport::reportDescendantMemoryUsage):
+        * css/StyleSheetContents.cpp:
+        (WebCore::StyleSheetContents::reportMemoryUsage):
+        * css/WebKitCSSFilterValue.cpp:
+        (WebCore::WebKitCSSFilterValue::reportDescendantMemoryUsage):
+        * css/WebKitCSSKeyframeRule.cpp:
+        (WebCore::StyleKeyframe::reportMemoryUsage):
+        (WebCore::WebKitCSSKeyframeRule::reportDescendantMemoryUsage):
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::StyleRuleKeyframes::reportDescendantMemoryUsage):
+        (WebCore::WebKitCSSKeyframesRule::reportDescendantMemoryUsage):
+        * css/WebKitCSSMixFunctionValue.cpp:
+        (WebCore::WebKitCSSMixFunctionValue::reportDescendantMemoryUsage):
+        * css/WebKitCSSRegionRule.cpp:
+        (WebCore::WebKitCSSRegionRule::reportDescendantMemoryUsage):
+        * css/WebKitCSSSVGDocumentValue.cpp:
+        (WebCore::WebKitCSSSVGDocumentValue::reportDescendantMemoryUsage):
+        * css/WebKitCSSShaderValue.cpp:
+        (WebCore::WebKitCSSShaderValue::reportDescendantMemoryUsage):
+        * css/WebKitCSSTransformValue.cpp:
+        (WebCore::WebKitCSSTransformValue::reportDescendantMemoryUsage):
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::reportMemoryUsage):
+        * dom/ContainerNode.h:
+        (WebCore::ContainerNode::reportMemoryUsage):
+        * dom/Document.cpp:
+        (WebCore::Document::reportMemoryUsage):
+        * dom/Element.h:
+        (WebCore::Element::reportMemoryUsage):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::reportMemoryUsage):
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (MemoryObjectInfo):
+        (WebCore::MemoryObjectInfo::reportObjectInfo):
+        (MemoryClassInfo):
+        (WebCore::MemoryClassInfo::MemoryClassInfo):
+        * dom/Node.cpp:
+        (WebCore::Node::reportMemoryUsage):
+        * dom/QualifiedName.h:
+        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
+        (WebCore::QualifiedName::reportMemoryUsage):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::reportMemoryUsage):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::reportMemoryUsage):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::reportMemoryUsage):
+        * loader/cache/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::reportMemoryUsage):
+        * loader/cache/CachedFont.cpp:
+        (WebCore::CachedFont::reportMemoryUsage):
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::reportMemoryUsage):
+        * loader/cache/CachedRawResource.cpp:
+        (WebCore::CachedRawResource::reportMemoryUsage):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::reportMemoryUsage):
+        * loader/cache/CachedResourceHandle.cpp:
+        (WebCore::CachedResourceHandleBase::reportMemoryUsage):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::reportMemoryUsage):
+        * loader/cache/CachedSVGDocument.cpp:
+        (WebCore::CachedSVGDocument::reportMemoryUsage):
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::reportMemoryUsage):
+        * loader/cache/CachedShader.cpp:
+        (WebCore::CachedShader::reportMemoryUsage):
+        * loader/cache/CachedXSLStyleSheet.cpp:
+        (WebCore::CachedXSLStyleSheet::reportMemoryUsage):
+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::reportMemoryUsage):
+        * page/Frame.cpp:
+        (WebCore::Frame::reportMemoryUsage):
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::reportMemoryUsage):
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::reportMemoryUsage):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::reportMemoryUsage):
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::reportMemoryUsage):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::reportMemoryUsage):
+        * svg/SVGColor.cpp:
+        (WebCore::SVGColor::reportDescendantMemoryUsage):
+        * svg/SVGPaint.cpp:
+        (WebCore::SVGPaint::reportDescendantMemoryUsage):
+
+2012-08-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove Qt 4 specific code paths
+        https://bugs.webkit.org/show_bug.cgi?id=88161
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Target.pri:
+        * WebCore.pri:
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fallbackObject):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getPropertyNames):
+        (JSC::Bindings::QtInstance::stringValue):
+        (JSC::Bindings::QtField::setValueToInstance):
+        * bridge/qt/qt_runtime.h:
+        (QtConnectionObject):
+        * bridge/qt/qt_runtime_qt4.cpp: Removed.
+        * editing/qt/SmartReplaceQt.cpp: Removed.
+        * page/qt/EventHandlerQt.cpp:
+        (WebCore::EventHandler::tabsToAllFormControls):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/OpenGLShims.cpp:
+        (WebCore::getProcAddress):
+        * platform/graphics/OpenGLShims.h:
+        * platform/graphics/gstreamer/PlatformVideoWindowPrivate.h:
+        * platform/graphics/gstreamer/PlatformVideoWindowQt.cpp:
+        (FullScreenVideoWindow::FullScreenVideoWindow):
+        (FullScreenVideoWindow::keyPressEvent):
+        (FullScreenVideoWindow::event):
+        (FullScreenVideoWindow::showFullScreen):
+        (PlatformVideoWindow::PlatformVideoWindow):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DPrivate::blitMultisampleFramebufferAndRestoreContext):
+        (WebCore::GraphicsContext3DPrivate::makeCurrentIfNeeded):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::create):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/texmap/TextureMapper.h:
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGLData::SharedGLData::getCurrentGLContext):
+        * platform/qt/DeviceMotionProviderQt.h:
+        * platform/qt/DeviceOrientationProviderQt.h:
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::operator QUrl):
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/QWebPageClient.h:
+        (QWebPageClient):
+        * platform/qt/RenderThemeQt.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp: Removed.
+        * plugins/qt/PluginContainerQt.cpp: Removed.
+        * plugins/qt/PluginContainerQt.h: Removed.
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::paintUsingXPixmap):
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::platformGetValue):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+
+2012-08-06  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: implement reusable progress bar
+        https://bugs.webkit.org/show_bug.cgi?id=93267
+
+        - Generic progress bar implementation to be used
+            by various long-running operations in inspector.
+
+        Test: inspector/progress-bar.html
+
+        Reviewed by Pavel Feldman.
+
+        * WebCore.gypi: Added ProgressBar.js
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * inspector/compile-front-end.py: ditto.
+        * inspector/front-end/AdvancedSearchController.js: renamed style for stop button.
+        (WebInspector.SearchView):
+        * inspector/front-end/ProgressBar.js: Added.
+        (WebInspector.Progress): Interface for both ProgressIndicator and SubProgress.
+        (WebInspector.Progress.prototype.setTotalWork):
+        (WebInspector.Progress.prototype.setTitle):
+        (WebInspector.Progress.prototype.setWorked):
+        (WebInspector.Progress.prototype.done):
+        (WebInspector.Progress.prototype.isCanceled):
+        (WebInspector.ProgressIndicator): A UI control that implements Progress.
+        (WebInspector.ProgressIndicator.prototype.show):
+        (WebInspector.ProgressIndicator.prototype.hide):
+        (WebInspector.ProgressIndicator.prototype.done):
+        (WebInspector.ProgressIndicator.prototype._cancel):
+        (WebInspector.ProgressIndicator.prototype.isCanceled):
+        (WebInspector.ProgressIndicator.prototype.setTitle):
+        (WebInspector.ProgressIndicator.prototype.setTotalWork):
+        (WebInspector.ProgressIndicator.prototype.setWorked):
+        (WebInspector.CompositeProgress): A progress bar that is composed of several SubProgress bars and uses a Progress to display total progress of all tasks.
+        (WebInspector.CompositeProgress.prototype._childDone):
+        (WebInspector.CompositeProgress.prototype.createSubProgress):
+        (WebInspector.CompositeProgress.prototype._update):
+        (WebInspector.SubProgress): A child of CompositeProgress, implements Progress interface.
+        (WebInspector.SubProgress.prototype.isCanceled):
+        (WebInspector.SubProgress.prototype.setTitle):
+        (WebInspector.SubProgress.prototype.done):
+        (WebInspector.SubProgress.prototype.setTotalWork):
+        (WebInspector.SubProgress.prototype.setWorked):
+        * inspector/front-end/WebKit.qrc: Added ProgressBar.js
+        * inspector/front-end/inspector.css:
+        (.progress-bar-stop-button-item):
+        (.progress-bar-stop-button .glyph):
+        (.progress-bar-container):
+        (.progress-bar-container span):
+        (.progress-bar-container progress):
+        (.progress-bar-container button.status-bar-item):
+        * inspector/front-end/inspector.html:
+
+2012-08-07  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: display function scope in UI
+        https://bugs.webkit.org/show_bug.cgi?id=90631
+
+        Reviewed by Yury Semikhatsky.
+
+        Two new tree element types added: function scope group node and scope node.
+        Scope node is only used to represent closure and catch scopes. Scopes that
+        have a real object beneath are represented as a property node.
+        A method that reads properties from RemoteObject and populate tree element
+        is factored out from RemoteObjectTreeElement for reuse.
+
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.Populate.callback):
+        (WebInspector.ObjectPropertyTreeElement.Populate):
+        (WebInspector.FunctionScopeMainTreeElement):
+        (WebInspector.FunctionScopeMainTreeElement.prototype.onpopulate.didGetDetails):
+        (WebInspector.FunctionScopeMainTreeElement.prototype.onpopulate):
+        (WebInspector.FunctionScopeMainTreeElement.prototype.onattach):
+        (WebInspector.FunctionScopeMainTreeElement.prototype.update):
+        (WebInspector.ScopeTreeElement):
+        (WebInspector.ScopeTreeElement.prototype.onpopulate):
+        (WebInspector.ScopeTreeElement.prototype.onattach):
+        (WebInspector.ScopeTreeElement.prototype.update):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObjectProperty.fromScopeValue):
+
+
+2012-08-07  Vineet Chaudhary  <rgf748@motorola.com>
+
+        [V8] Remove custom toV8() calls for TypedArray.
+        https://bugs.webkit.org/show_bug.cgi?id=93248
+
+        Reviewed by Kentaro Hara.
+
+        With the support of [TypedArray] we can remove the custom calls toV8().
+        TypedArray spec : http://www.khronos.org/registry/typedarray/specs/latest/#7
+
+        Tests: TestTypedArray.idl
+        Tests under below folders should pass as this does not cause any behavioral changes.
+               fast/canvas/webgl
+               compositing/webgl
+
+        * bindings/js/JSInt8ArrayCustom.cpp:
+        * bindings/js/JSUint8ArrayCustom.cpp:
+        * bindings/js/JSUint8ClampedArrayCustom.cpp:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateImplementation): Modified Generator code to generate bindings for toV8().
+        (IsWrapperType):
+        (GetTypeNameOfExternalTypedArray): Method to get view type of TypedArray.
+        * bindings/scripts/test/V8/V8Float64Array.cpp: Tests results.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8Float32ArrayCustom.cpp: Removed custom call toV8().
+        * bindings/v8/custom/V8Float64ArrayCustom.cpp: Ditto.
+        * bindings/v8/custom/V8Int16ArrayCustom.cpp: Ditto.
+        * bindings/v8/custom/V8Int32ArrayCustom.cpp: Ditto.
+        * bindings/v8/custom/V8Int8ArrayCustom.cpp: Ditto.
+        * bindings/v8/custom/V8Uint16ArrayCustom.cpp: Ditto.
+        * bindings/v8/custom/V8Uint32ArrayCustom.cpp: Ditto.
+        * bindings/v8/custom/V8Uint8ArrayCustom.cpp: Ditto.
+        * bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp: Ditto.
+        * html/canvas/Int8Array.idl: Using TypedArray.
+        * html/canvas/Uint8Array.idl: Ditto.
+        * html/canvas/Uint8ClampedArray.idl: Ditto.
+
+2012-08-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: [regression r121673] restore link between the command and the result.
+        https://bugs.webkit.org/show_bug.cgi?id=93280
+
+        Reviewed by Vsevolod Vlasov.
+
+        Passing lost parameter along.
+
+        Test: inspector/console/console-originating-command.html
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.runScript.runCallback):
+        (WebInspector.ConsoleView.prototype.runScript):
+        (WebInspector.ConsoleView.prototype._printResult):
+
+2012-08-07  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        CUSTOM_SCHEME_HANDLER flag should depend on REGISTER_PROTOCOL_HANDLER
+        https://bugs.webkit.org/show_bug.cgi?id=93081
+
+        Reviewed by Adam Barth.
+
+        CUSTOM_SCHEME_HANDLER #if guards are enclosed in the REGISTER_PROTOCOL_HANDLER guards.
+        The whole NavigatorRegisterProtocolHandler interface is conditional on REGISTER_PROTOCOL_HANDLER
+        CUSTOM_SCHEME_HANDLER-specific methods only are conditional on CUSTOM_SCHEME_HANDLER.
+
+        No new tests. No new functionality is added.
+
+        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.cpp:
+        (WebCore::NavigatorRegisterProtocolHandler::registerProtocolHandler):
+        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.h:
+        (NavigatorRegisterProtocolHandler):
+        * Modules/protocolhandler/NavigatorRegisterProtocolHandler.idl:
+        * Modules/protocolhandler/RegisterProtocolHandlerClient.h:
+
+2012-08-07  Xingnan Wang  <xingnan.wang@intel.com>
+
+        IndexedDB: Size the Vector in encodeInt/encodeVarInt/encodeString
+        https://bugs.webkit.org/show_bug.cgi?id=91813
+
+        Reviewed by Kentaro Hara.
+
+        To avoid memory re-allocation in Vector, init the capability or size of Vector in encodeInt(), encodeVarInt(),
+        encodeBool(), encodeIDBKey() etc.
+
+        No new tests - Low level functions covered by existing layout tests and also covered by Chromium
+        webkit_unit_tests IDBLevelIDBCodingTest.* which validates the sizes of buffers returned by encodeVarInt.
+
+        * Modules/indexeddb/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::encodeInt):
+        (WebCore::IDBLevelDBCoding::encodeVarInt):
+        (WebCore::IDBLevelDBCoding::encodeString):
+
+2012-08-06  Arko Saha  <arko@motorola.com>
+
+        Microdata: itemType[index] must be undefined for out-of-range index.
+        https://bugs.webkit.org/show_bug.cgi?id=92988
+
+        Reviewed by Kentaro Hara.
+
+        Made changes in IndexedGetter property so that it returns undefined
+        for out-of-range index.
+        Spec: http://www.w3.org/TR/WebIDL/#idl-indexed-properties
+        Firefox and Opera's behavior is consistent with the spec. Both returns
+        undefined for out-of-range index.
+
+        Also renamed the function name collectionStringOrNullIndexedPropertyGetter and
+        setCollectionStringOrNullIndexedGetter to collectionStringOrUndefinedIndexedPropertyGetter
+        and setCollectionStringOrUndefinedIndexedGetter respectively.
+
+        Test: fast/dom/MicroData/domsettabletokenlist-attributes-out-of-range-index.html
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateImplementationIndexer):
+        * bindings/v8/V8Collection.h:
+        (WebCore::collectionStringOrUndefinedIndexedPropertyGetter):
+        (WebCore::setCollectionStringOrUndefinedIndexedGetter):
+
+2012-08-06  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Make leveldb store integer versions and migrate old schemas
+        https://bugs.webkit.org/show_bug.cgi?id=92883
+
+        Reviewed by Tony Chang.
+
+        Our first schema change. If an existing DB doesn't have integer
+        versions, this will add one to all object stores in the origin.
+
+        No new tests - chrome test for the migration forthcoming. Will involve
+        starting with a leveldb directory from an old build of chrome, opening
+        it up with the migration code in place, and checking the new database.
+        http://codereview.chromium.org/10826159/
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::putVarInt):
+        (WebCore):
+        (WebCore::setUpMetadata):
+        Uses the ASSERT-but-still-handle-corruption pattern recently discussed
+        in https://bugs.webkit.org/show_bug.cgi?id=92725#c13.
+
+        (WebCore::IDBLevelDBBackingStore::open):
+        (WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
+        Because we can't store negative numbers, store 0 instead of -1.
+
+        (WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::updateIDBDatabaseIntVersion):
+        * Modules/indexeddb/IDBLevelDBCoding.h:
+        * Modules/indexeddb/IDBMetadata.h:
+
+2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124780.
+        http://trac.webkit.org/changeset/124780
+        https://bugs.webkit.org/show_bug.cgi?id=93340
+
+        We don't want an incomplete feature set for the chromium
+        branch cut. (Requested by annacc on #webkit).
+
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Modules/mediasource/MediaSource.cpp: Removed.
+        * Modules/mediasource/MediaSource.h: Removed.
+        * Modules/mediasource/MediaSource.idl: Removed.
+        * Modules/mediasource/MediaSourceRegistry.cpp: Removed.
+        * Modules/mediasource/MediaSourceRegistry.h: Removed.
+        * Modules/mediasource/SourceBuffer.cpp:
+        (WebCore::SourceBuffer::SourceBuffer):
+        (WebCore::SourceBuffer::buffered):
+        (WebCore::SourceBuffer::append):
+        (WebCore::SourceBuffer::abort):
+        * Modules/mediasource/SourceBuffer.h:
+        (WebCore::SourceBuffer::create):
+        (WebCore::SourceBuffer::clear):
+        (SourceBuffer):
+        * Modules/mediasource/SourceBufferList.cpp:
+        * Modules/mediasource/SourceBufferList.h:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/EventTarget.h:
+        (WebCore):
+        * dom/EventTargetFactory.in:
+        * html/DOMURL.cpp:
+        * html/DOMURL.h:
+        (WebCore):
+        (DOMURL):
+        * html/DOMURL.idl:
+        * page/DOMWindow.idl:
+
+2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124798.
+        http://trac.webkit.org/changeset/124798
+        https://bugs.webkit.org/show_bug.cgi?id=93337
+
+        We don't want an incomplete feature set for the chromium
+        branch cut. (Requested by annacc on #webkit).
+
+        * html/DOMURL.cpp:
+        (WebCore::DOMURL::createObjectURL):
+        * html/PublicURLManager.h:
+        (WebCore::PublicURLManager::contextDestroyed):
+        (PublicURLManager):
+
+2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124848.
+        http://trac.webkit.org/changeset/124848
+        https://bugs.webkit.org/show_bug.cgi?id=93336
+
+        Caused 3 tests to crash on chromium Linux32/Mac10.6/Linux
+        (Requested by toyoshim on #webkit).
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore):
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::parseAttribute):
+        (WebCore::HTMLMediaElement::prepareForLoad):
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::noneSupported):
+        (WebCore::HTMLMediaElement::mediaEngineError):
+        (WebCore::HTMLMediaElement::mediaPlayerSourceOpened):
+        (WebCore::HTMLMediaElement::isValidSourceId):
+        (WebCore::HTMLMediaElement::seek):
+        (WebCore::HTMLMediaElement::webkitSourceAddId):
+        (WebCore::HTMLMediaElement::webkitSourceRemoveId):
+        (WebCore::HTMLMediaElement::webkitSourceBuffered):
+        (WebCore::HTMLMediaElement::webkitSourceAppend):
+        (WebCore::HTMLMediaElement::webkitSourceAbort):
+        (WebCore::HTMLMediaElement::webkitSourceEndOfStream):
+        (WebCore::HTMLMediaElement::webkitSourceState):
+        (WebCore::HTMLMediaElement::setSourceState):
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+        (WebCore::HTMLMediaElement::createMediaPlayer):
+        * html/HTMLMediaElement.h:
+        (HTMLMediaElement):
+        * html/HTMLMediaElement.idl:
+
+2012-08-06  Anna Cavender  <annacc@chromium.org>
+
+        Update HTMLMediaElement to the new OO MediaSource API.
+        https://bugs.webkit.org/show_bug.cgi?id=91775
+
+        Reviewed by Eric Carlson.
+
+        This patch rips out the old-style MediaSource API and allows a
+        MediaSource object to be attached to HTMLMediaElement.
+        http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html
+
+        Test: http/tests/media/media-source/video-media-source-add-and-remove-buffers.html
+
+        Tests: updates to http/tests/media/media-source/*
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore):
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Remove old style API resources.
+        (WebCore::HTMLMediaElement::parseAttribute): Remove old style event attributes.
+        (WebCore::HTMLMediaElement::prepareForLoad): Set source state to "closed".
+        (WebCore::HTMLMediaElement::loadResource): Get MediaSource object from blob registry
+            look up and, if found, set it's MediaPlayer pointer to the current MediaPlayer.
+        (WebCore::HTMLMediaElement::noneSupported): Set source state to "closed".
+        (WebCore::HTMLMediaElement::mediaEngineError): Set source state to "closed".
+        (WebCore::HTMLMediaElement::mediaPlayerSourceOpened): Set source state to "open".
+        (WebCore::HTMLMediaElement::mediaPlayerSourceURL): Change to new blob URL.
+        (WebCore::HTMLMediaElement::seek): Check if source state is "closed".
+        (WebCore::HTMLMediaElement::setSourceState): Helper function so that we don't have to
+            keep checking for m_mediaSource.
+        (WebCore::HTMLMediaElement::userCancelledLoad): Set source state to "closed".
+        (WebCore::HTMLMediaElement::createMediaPlayer): If the current MediaPlayer is re-
+            created, notify the MediaSource and reset its MediaPlayer.
+
+        * html/HTMLMediaElement.h: Remove old style API code and add a MediaSource object.
+        (HTMLMediaElement):
+        * html/HTMLMediaElement.idl: Remove old style API.
+
+2012-08-06  Adam Barth  <abarth@webkit.org>
+
+        BindingSecurity::shouldAllowAccessToFrame shouldn't use a raw boolean parameter
+        https://bugs.webkit.org/show_bug.cgi?id=93323
+
+        Reviewed by Eric Seidel.
+
+        As requested by Eric. This patch also renames the function to match its
+        counterpart in the JavaScriptCore bindings.
+
+        * bindings/generic/BindingSecurity.cpp:
+        (WebCore::canAccessDocument):
+        (WebCore::BindingSecurity::shouldAllowAccessToFrame):
+        (WebCore::BindingSecurity::shouldAllowAccessToNode):
+        (WebCore::BindingSecurity::allowSettingFrameSrcToJavascriptUrl):
+        * bindings/generic/BindingSecurity.h:
+        (BindingSecurity):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateDomainSafeFunctionGetter):
+        (GenerateReplaceableAttrSetter):
+        (GenerateFunctionCallback):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::TestActiveDOMObjectV8Internal::excitingFunctionCallback):
+        (WebCore::TestActiveDOMObjectV8Internal::postMessageAttrGetter):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::canAccessFromCurrentOrigin):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
+        (WebCore::V8DOMWindow::eventAccessorGetter):
+        (WebCore::V8DOMWindow::eventAccessorSetter):
+        (WebCore::V8DOMWindow::openerAccessorSetter):
+        (WebCore::V8DOMWindow::addEventListenerCallback):
+        (WebCore::V8DOMWindow::removeEventListenerCallback):
+        (WebCore::V8DOMWindow::showModalDialogCallback):
+        (WebCore::V8DOMWindow::openCallback):
+        (WebCore::V8DOMWindow::namedSecurityCheck):
+        (WebCore::V8DOMWindow::indexedSecurityCheck):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::indexedSecurityCheck):
+        (WebCore::V8History::namedSecurityCheck):
+        * bindings/v8/custom/V8InjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::reloadAccessorGetter):
+        (WebCore::V8Location::replaceAccessorGetter):
+        (WebCore::V8Location::assignAccessorGetter):
+        (WebCore::V8Location::toStringCallback):
+        (WebCore::V8Location::indexedSecurityCheck):
+        (WebCore::V8Location::namedSecurityCheck):
+
+2012-08-06  Yuta Kitamura  <yutak@chromium.org>
+
+        WebSocket.send() should accept ArrayBufferView
+        https://bugs.webkit.org/show_bug.cgi?id=90877
+
+        Reviewed by Kent Tamura.
+
+        Accept ArrayBufferView as an argument of WebSocket.send() to comply with recent change
+        in specification: <http://html5.org/tools/web-apps-tracker?from=7084&to=7085>.
+
+        Once WebSocket.send(ArrayBuffer) was removed from the specification, but added back
+        in <http://html5.org/tools/web-apps-tracker?from=7202&to=7203>. Thus the functionality
+        of send(ArrayBuffer) is kept as-is.
+
+        Tests: http/tests/websocket/tests/hybi/send-arraybufferview.html
+               http/tests/websocket/tests/hybi/workers/send-arraybufferview.html
+
+        * Modules/websockets/ThreadableWebSocketChannel.h:
+        Change the signature of send() to receive offset and length so the clients can send
+        subrange of an ArrayBuffer.
+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::send):
+        WebSocket.send(ArrayBufferView) is added, which puts the sub region of the given
+        ArrayBuffer into the outgoing frame queue.
+        * Modules/websockets/WebSocket.h:
+        * Modules/websockets/WebSocket.idl:
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send):
+        * Modules/websockets/WebSocketChannel.h:
+        (WebSocketChannel):
+        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::send):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::send):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
+        Send only necessary part of data to the main thread.
+        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
+        (WorkerThreadableWebSocketChannel):
+        (Bridge):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::send): Accept ArrayBufferView in send().
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8WebSocket::sendCallback): Ditto.
+
+2012-08-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Add gyp variable to control which compositor target is depended on
+        https://bugs.webkit.org/show_bug.cgi?id=93165
+
+        Reviewed by Adam Barth.
+
+        This adds a use_libcc_for_compositor gyp variable to control whether webcore_platform links in the compositor
+        code from the webcore_chromium_compositor target or from cc from the chromium repo.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2012-08-06  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Crash in GenericEventQueue::timerFired since the owner of GenericEventQueue is deleted during dispatching events.
+        https://bugs.webkit.org/show_bug.cgi?id=92946
+
+        Reviewed by Eric Carlson.
+
+        In GenericEventQueue::timerFired(), the owner of GenericEventQueue might be deleted.
+        We have to protect the owner of GenericEventQueue during dispatching events.
+
+        Test: media/event-queue-crash.html
+
+        * dom/GenericEventQueue.cpp:
+        (WebCore::GenericEventQueue::timerFired): Added a protection.
+
+2012-08-06  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Remove IDBRequest::finishCursor() and plumbing
+        https://bugs.webkit.org/show_bug.cgi?id=93274
+
+        Reviewed by Tony Chang.
+
+        Delete an unused flag and code for setting it, rendered obsolete in r123275.
+
+        No new tests - no functional changes.
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::close):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::IDBRequest):
+        * Modules/indexeddb/IDBRequest.h:
+        (IDBRequest):
+
+2012-08-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove lingering unwrap<>() calls in GraphicsLayerChromium.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=93319
+
+        Reviewed by Adrienne Walker.
+
+        Gets rid of all (but one) of the remaining unwrap<LayerChromium>() calls in GraphicsLayer chromium to avoid
+        punching through the WebLayer API.  Covered by many layout tests, mostly in compositing/
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::willBeDestroyed):
+        (WebCore::GraphicsLayerChromium::setName):
+        (WebCore::GraphicsLayerChromium::updateNames):
+        (WebCore::GraphicsLayerChromium::setMaskLayer):
+        (WebCore::GraphicsLayerChromium::setReplicatedByLayer):
+        (WebCore::GraphicsLayerChromium::setContentsToImage):
+        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
+        (WebCore::GraphicsLayerChromium::setContentsToMedia):
+        (WebCore::GraphicsLayerChromium::updateChildList):
+        (WebCore::GraphicsLayerChromium::setupContentsLayer):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (GraphicsLayerChromium):
+
+2012-08-06  Adrienne Walker  <enne@google.com>
+
+        [chromium] Convert WebScrollbarThemeGeometry from a concrete class to an interface
+        https://bugs.webkit.org/show_bug.cgi?id=93308
+
+        Reviewed by James Robinson.
+
+        Convert WebScrollbarThemeGeometry to be an interface. Create a new
+        WebScrollbarThemeGeometryNative implementation to wrap a native theme
+        pointer.
+
+        Update ScrollbarLayerChromium/CCScrollbarLayerImpl to use a pointer to
+        this interface rather than a concrete member variable. Because both
+        layer types need to access the theme during painting or compositing
+        and either layer could go away at any time, the theme is cloned during
+        commit rather than dealing with refcounting across threads or having
+        one layer type be the sole owner.
+
+        * WebCore.gypi:
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::createScrollbarLayer):
+        * platform/chromium/support/WebScrollbarThemeGeometryNative.cpp: Renamed from Source/WebKit/chromium/src/WebScrollbarThemeGeometry.cpp.
+        (WebKit):
+        (WebKit::WebScrollbarThemeGeometryNative::create):
+        (WebKit::WebScrollbarThemeGeometryNative::WebScrollbarThemeGeometryNative):
+        (WebKit::WebScrollbarThemeGeometryNative::clone):
+        (WebKit::WebScrollbarThemeGeometryNative::thumbPosition):
+        (WebKit::WebScrollbarThemeGeometryNative::thumbLength):
+        (WebKit::WebScrollbarThemeGeometryNative::trackPosition):
+        (WebKit::WebScrollbarThemeGeometryNative::trackLength):
+        (WebKit::WebScrollbarThemeGeometryNative::hasButtons):
+        (WebKit::WebScrollbarThemeGeometryNative::hasThumb):
+        (WebKit::WebScrollbarThemeGeometryNative::trackRect):
+        (WebKit::WebScrollbarThemeGeometryNative::thumbRect):
+        (WebKit::WebScrollbarThemeGeometryNative::minimumThumbLength):
+        (WebKit::WebScrollbarThemeGeometryNative::scrollbarThickness):
+        (WebKit::WebScrollbarThemeGeometryNative::backButtonStartRect):
+        (WebKit::WebScrollbarThemeGeometryNative::backButtonEndRect):
+        (WebKit::WebScrollbarThemeGeometryNative::forwardButtonStartRect):
+        (WebKit::WebScrollbarThemeGeometryNative::forwardButtonEndRect):
+        (WebKit::WebScrollbarThemeGeometryNative::constrainTrackRectToTrackPieces):
+        (WebKit::WebScrollbarThemeGeometryNative::splitTrack):
+        * platform/chromium/support/WebScrollbarThemeGeometryNative.h: Added.
+        (WebKit):
+        (WebScrollbarThemeGeometryNative):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::create):
+        (WebCore::ScrollbarLayerChromium::ScrollbarLayerChromium):
+        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
+        (WebCore::ScrollbarBackgroundPainter::create):
+        (WebCore::ScrollbarBackgroundPainter::ScrollbarBackgroundPainter):
+        (ScrollbarBackgroundPainter):
+        (WebCore::ScrollbarThumbPainter::create):
+        (WebCore::ScrollbarThumbPainter::ScrollbarThumbPainter):
+        (ScrollbarThumbPainter):
+        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
+        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
+        (WebCore::ScrollbarLayerChromium::update):
+        * platform/graphics/chromium/ScrollbarLayerChromium.h:
+        (ScrollbarLayerChromium):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        (WebCore::CCScrollbarLayerImpl::setScrollbarGeometry):
+        (WebCore::CCScrollbarLayerImpl::setScrollbarData):
+        (WebCore::CCScrollbarLayerImpl::appendQuads):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+        (WebCore::CCScrollbarLayerImpl::scrollbarGeometry):
+        (CCScrollbarLayerImpl):
+
+2012-08-06  Adam Barth  <abarth@webkit.org>
+
+        JSC should use BindingState to determine the activeDOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=93307
+
+        Reviewed by Eric Seidel.
+
+        This patch moves activeDOMWindow from JSDOMBindings.cpp to
+        BindingState.cpp. This is a first step towards sharing the core
+        security logic in the bindings between JavaScriptCore and V8. Once the
+        logic is shared, we will be able to refactor the logic to avoid the
+        need for DOMWindow::m_securityOrigin.
+
+        This patch doesn't actually share any code (yet). It just sets the
+        stage by creating BindingState as a typedef of ExecState and adding the
+        appropriate files to the build systems.
+
+        This patch also renames activeWindow and firstWindow in the V8 bindings
+        to activeDOMWindow and firstDOMWindow to match the names in the
+        JavaScriptCore bindings.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UseJSC.cmake:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/generic/BindingSecurity.cpp:
+        (WebCore::canAccessDocument):
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore):
+        * bindings/v8/BindingState.cpp:
+        (WebCore::activeDOMWindow):
+        (WebCore::firstDOMWindow):
+        * bindings/v8/BindingState.h:
+        (WebCore):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::locationAccessorSetter):
+        (WebCore::handlePostMessageCallback):
+        (WebCore::V8DOMWindow::showModalDialogCallback):
+        (WebCore::V8DOMWindow::openCallback):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::V8Document::locationAccessorSetter):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::hashAccessorSetter):
+        (WebCore::V8Location::hostAccessorSetter):
+        (WebCore::V8Location::hostnameAccessorSetter):
+        (WebCore::V8Location::hrefAccessorSetter):
+        (WebCore::V8Location::pathnameAccessorSetter):
+        (WebCore::V8Location::portAccessorSetter):
+        (WebCore::V8Location::protocolAccessorSetter):
+        (WebCore::V8Location::searchAccessorSetter):
+        (WebCore::V8Location::reloadCallback):
+        (WebCore::V8Location::replaceCallback):
+        (WebCore::V8Location::assignCallback):
+
+2012-08-05  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-Mac] Use the default locale only if the browser locale matches to it
+        https://bugs.webkit.org/show_bug.cgi?id=93227
+
+        Reviewed by Hajime Morita.
+
+        For a calendar picker, we have used month names and day-of-week names
+        obtained from the OS default locale. However, the year-month format and
+        [Today] [Clear] labels are decided with the browser locale. It made
+        calendar pickers with mixed languages.
+
+        To make calendar pickers with a single language, we use the OS default
+        locale only if the browser locale matches to it.
+
+        No new tests. Behavior for locale setting is not testable in WebKit.
+
+        * platform/text/mac/LocaleMac.mm:
+        (WebCore::languageFromLocale):
+        A helper for determineLocale. This returns the language part of the
+        specified locale identifier.
+        (WebCore::determineLocale):
+        If the browser language matches to the language of the current NSLocale,
+        returns the current NSLocale. Otherwise, returns a NSLocale with the
+        browser language.
+        Note that [NSLolca localeIdentifier] returns a string in
+        <language>_<country> format though defaultLanguage() in Chromium returns
+        a string in <language>-<country> format.
+        (WebCore::LocaleMac::currentLocale):
+        Use determineLocale.
+
+2012-08-06  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle variables in CSSParser::parseValidPrimitive(), preventing null return value.
+        https://bugs.webkit.org/show_bug.cgi?id=93235
+
+        Reviewed by Tony Chang.
+
+        By returning null here (and failing to handle the variable) the current code would cause null pointer dereferences in StyleResolver at several points.
+        Instead we create a primitive value for the variable reference and return it.
+
+        Test: fast/css/variables/invalid-font-reference.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValidPrimitive):
+
+2012-08-06  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Rename CCTextureUpdater to CCTextureUpdateQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=93293
+
+        Reviewed by Adrienne Walker.
+
+        No new tests.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::update):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (ContentLayerChromium):
+        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp:
+        (WebCore::HeadsUpDisplayLayerChromium::update):
+        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.h:
+        (HeadsUpDisplayLayerChromium):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::update):
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        (ImageLayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore):
+        (WebCore::LayerChromium::update):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::updatePart):
+        (WebCore::ScrollbarLayerChromium::update):
+        * platform/graphics/chromium/ScrollbarLayerChromium.h:
+        (WebCore):
+        (ScrollbarLayerChromium):
+        * platform/graphics/chromium/TextureLayerChromium.cpp:
+        (WebCore::TextureLayerChromium::update):
+        * platform/graphics/chromium/TextureLayerChromium.h:
+        (TextureLayerChromiumClient):
+        (TextureLayerChromium):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::updateTiles):
+        (WebCore::TiledLayerChromium::updateContentRect):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::updateLayers):
+        (WebCore::CCLayerTreeHost::paintMasksForRenderSurface):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::doCommit):
+        (WebCore::CCSingleThreadProxy::commitAndComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCTextureUpdateController.cpp:
+        (WebCore::CCTextureUpdateController::updateTextures):
+        (WebCore::CCTextureUpdateController::CCTextureUpdateController):
+        (WebCore::CCTextureUpdateController::hasMoreUpdates):
+        (WebCore::CCTextureUpdateController::updateMoreTextures):
+        * platform/graphics/chromium/cc/CCTextureUpdateController.h:
+        (WebCore::CCTextureUpdateController::create):
+        (CCTextureUpdateController):
+        * platform/graphics/chromium/cc/CCTextureUpdateQueue.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp.
+        (WebCore):
+        (WebCore::CCTextureUpdateQueue::CCTextureUpdateQueue):
+        (WebCore::CCTextureUpdateQueue::~CCTextureUpdateQueue):
+        (WebCore::CCTextureUpdateQueue::appendFullUpload):
+        (WebCore::CCTextureUpdateQueue::appendPartialUpload):
+        (WebCore::CCTextureUpdateQueue::appendCopy):
+        (WebCore::CCTextureUpdateQueue::takeFirstFullUpload):
+        (WebCore::CCTextureUpdateQueue::takeFirstPartialUpload):
+        (WebCore::CCTextureUpdateQueue::takeFirstCopy):
+        (WebCore::CCTextureUpdateQueue::hasMoreUpdates):
+        * platform/graphics/chromium/cc/CCTextureUpdateQueue.h: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.h.
+        (WebCore):
+        (CCTextureUpdateQueue):
+        (WebCore::CCTextureUpdateQueue::fullUploadSize):
+        (WebCore::CCTextureUpdateQueue::partialUploadSize):
+        (WebCore::CCTextureUpdateQueue::copySize):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (WebCore):
+        (CCThreadProxy):
+
+2012-08-06  Anders Carlsson  <andersca@apple.com>
+
+        Clear out the TileCache backpointer for all tile layers when the tile cache is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=93317
+        <rdar://problem/11566543>
+
+        Reviewed by Dean Jackson.
+
+        It seems that in some rare cases, the tile cache layer can be destroyed in the same transaction as tile layers
+        are being asked to paint. Make sure to null out the TileCache back pointer for all layers in the TileCache destructor.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::~TileCache):
+
+2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124816.
+        http://trac.webkit.org/changeset/124816
+        https://bugs.webkit.org/show_bug.cgi?id=93311
+
+        made some tests crash (Requested by noamr on #webkit).
+
+        * platform/graphics/GraphicsLayerAnimation.cpp:
+        (WebCore::GraphicsLayerAnimation::GraphicsLayerAnimation):
+        (WebCore::GraphicsLayerAnimations::hasActiveAnimationsOfType):
+        (WebCore::GraphicsLayerAnimations::hasRunningAnimations):
+        (WebCore::GraphicsLayerAnimations::add):
+        (WebCore::GraphicsLayerAnimations::pause):
+        (WebCore::GraphicsLayerAnimations::apply):
+        * platform/graphics/GraphicsLayerAnimation.h:
+        (GraphicsLayerAnimation):
+        (GraphicsLayerAnimations):
+        (WebCore::GraphicsLayerAnimations::remove):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::addAnimation):
+
+2012-08-06  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Shaders] Parse mix function
+        https://bugs.webkit.org/show_bug.cgi?id=90101
+
+        Reviewed by Dirk Schulze.
+
+        Parse the mix function syntax for CSS Shaders as defined in the Filter Effects spec:
+        https://dvcs.w3.org/hg/FXTF/raw-file/tip/filters/index.html#FilterFunction
+
+        The fragment shader argument of the custom filter function can now be a mix function with
+        the following syntax:
+        mix(<uri> [ <blend-mode> || <alpha-compositing> ]?)
+
+        For example:
+        -webkit-filter: custom(url(shader.vert) mix(url(shader.frag multiply source-over))
+
+        The Filter Effects spec references the Compositing and Blending spec, which defines the
+        supported blend modes and alpha compositing modes.
+
+        Blend modes:
+        https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html#blend-mode
+
+        This patch adds all of the blend modes in the spec.
+
+        Alpha compositing modes:
+        https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html#alpha-compositing
+
+        This patch does not add any new CSS values for alpha compositing. Currently, we parse the
+        values that are the same between the spec and the -webkit-background-composite property,
+        including:
+            clear
+            copy
+            source-over
+            source-in
+            source-out
+            source-atop
+            destination-over
+            destination-in
+            destination-out
+            destination-atop
+            xor
+
+        In the future, we may need to add the following CSS values for alpha compositing:
+            lighter
+            destination
+
+        This is currently under discussion on the www-style mailing list:
+        http://lists.w3.org/Archives/Public/www-style/2012Aug/0123.html
+
+        No new test files. Add test cases in:
+            css3/filters/script-tests/custom-filter-property-computed-style.js:
+            css3/filters/script-tests/custom-filter-property-parsing-invalid.js:
+            css3/filters/script-tests/custom-filter-property-parsing.js:
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::isBlendMode):
+        (WebCore):
+        (WebCore::CSSParser::isCompositeOperator):
+        (WebCore::CSSParser::parseMixFunction):
+        (WebCore::CSSParser::parseCustomFilter):
+        * css/CSSParser.h:
+        (WebCore):
+        * css/CSSParserValues.h:
+        (WebCore::CSSParserValueList::currentIndex):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore):
+        (WebCore::CSSPrimitiveValue::operator BlendMode):
+        * css/CSSValue.cpp:
+        (WebCore::CSSValue::reportMemoryUsage):
+        (WebCore::CSSValue::cssText):
+        (WebCore::CSSValue::destroy):
+        (WebCore::CSSValue::cloneForCSSOM):
+        * css/CSSValue.h:
+        (WebCore::CSSValue::isWebKitCSSMixFunctionValue):
+        (CSSValue):
+        * css/CSSValueKeywords.in:
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/WebKitCSSMixFunctionValue.cpp: Added.
+        (WebCore):
+        (WebCore::WebKitCSSMixFunctionValue::WebKitCSSMixFunctionValue):
+        (WebCore::WebKitCSSMixFunctionValue::customCssText):
+        (WebCore::WebKitCSSMixFunctionValue::cloneForCSSOM):
+        (WebCore::WebKitCSSMixFunctionValue::reportDescendantMemoryUsage):
+        * css/WebKitCSSMixFunctionValue.h: Added.
+        (WebCore):
+        (WebKitCSSMixFunctionValue):
+        (WebCore::WebKitCSSMixFunctionValue::create):
+        * platform/graphics/GraphicsTypes.h:
+        * platform/graphics/filters/CustomFilterProgram.cpp:
+        (WebCore::CustomFilterProgram::CustomFilterProgram):
+        * platform/graphics/filters/CustomFilterProgram.h:
+        (WebCore::CustomFilterProgramMixSettings::CustomFilterProgramMixSettings):
+        (CustomFilterProgramMixSettings):
+        (WebCore):
+        * rendering/style/StyleCustomFilterProgram.h:
+        (WebCore::StyleCustomFilterProgram::create):
+        (WebCore::StyleCustomFilterProgram::StyleCustomFilterProgram):
+
+2012-08-06  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        GraphicsLayerAnimation shouldn't use HashMap<String>
+        https://bugs.webkit.org/show_bug.cgi?id=93284
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use a vector containing all the animations instead of a map of String to Vector.
+        The HashMap contains very few elements, which makes it inefficient relatively to a vector.
+        This has been shown to be a bottleneck in valgrind.
+
+        Covered by existing animation tests.
+
+        * platform/graphics/GraphicsLayerAnimation.cpp:
+        (WebCore::GraphicsLayerAnimation::GraphicsLayerAnimation):
+        (WebCore::GraphicsLayerAnimations::hasActiveAnimationsOfType):
+        (WebCore::GraphicsLayerAnimations::hasRunningAnimations):
+        (WebCore::GraphicsLayerAnimations::add):
+        (WebCore::GraphicsLayerAnimations::pause):
+        (WebCore::GraphicsLayerAnimations::remove):
+        (WebCore::GraphicsLayerAnimations::apply):
+        * platform/graphics/GraphicsLayerAnimation.h:
+        (GraphicsLayerAnimation):
+        (WebCore::GraphicsLayerAnimation::name):
+        (GraphicsLayerAnimations):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::addAnimation):
+
+2012-08-06  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=93199
+        REGRESSION (r124489): Crash in FrameView::scrollContentsFastPath when 
+        scrolling Facebook and Google image search
+        -and corresponding-
+        <rdar://problem/12035066>
+
+        Reviewed by Anders Carlsson.
+
+        As the comment in setShouldUpdateScrollLayerPositionOnMainThread() 
+        indicates, the goal of adding a call to 
+        updateMainFrameScrollPositionAndScrollLayerPosition() within that 
+        function was just to make sure the layer position was up-to-date 
+        since that is what is not kept up to date when scrolling is happening 
+        on the scrolling thread. So I'm fixing this crash by having that code 
+        ONLY update the layer position instead of also updating the scroll 
+        position, since it was updating the scroll position that led to this 
+        crash.
+
+        New function updateMainFrameScrollLayerPosition() will update JUST 
+        the layer position.
+        * page/scrolling/ScrollingCoordinator.h:
+        (ScrollingCoordinator):        
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollLayerPosition):
+
+        Update just the layer position here instead of the layer position and 
+        the scroll position.
+        (WebCore)::
+(WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+
+2012-08-06  Anna Cavender  <annacc@chromium.org>
+
+        MediaSource should use it's own list of source URLs
+        https://bugs.webkit.org/show_bug.cgi?id=93285
+
+        Reviewed by Eric Carlson.
+
+        r124780 added MediaSource objects to PublicURLManager's streamURLs list,
+        piggy-backing on MEDIA_STREAM.  This patch creates a sourceURLs list so
+        that MediaSource can stand on its own.
+
+        Test: builds on Andriod even when MEDIA_STREAM is disabled.
+
+        * html/DOMURL.cpp:
+        (WebCore::DOMURL::createObjectURL):
+        * html/PublicURLManager.h:
+        (WebCore::PublicURLManager::contextDestroyed):
+        (PublicURLManager):
+        (WebCore::PublicURLManager::sourceURLs):
+
+2012-08-06  Nico Weber  <thakis@chromium.org>
+
+        [chromium/mac] Unbreak debug builds with the 10.7 SDK
+        https://bugs.webkit.org/show_bug.cgi?id=93202
+
+        Reviewed by James Robinson.
+
+        FMGetATSFontRefFromFont() is not available with the 10.7 SDK
+        when targetting 10.6. Don't delete this code completely yet,
+        it's still used with the 10.6 SDK when targetting 10.6 (which
+        chromium's build bots use).
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore):
+
+2012-07-31  Ojan Vafai  <ojan@chromium.org>
+
+        need tests to ensure flexboxes play nicely with box-sizing
+        https://bugs.webkit.org/show_bug.cgi?id=70771
+
+        Reviewed by Tony Chang.
+
+        Anytime we grab the width/height off of the RenderStyle, we need to adjust
+        it for box-sizing. Fortunately, we only do this two places in RenderFlexibleBox.
+        Also, delete crossAxisLength since it's unused.
+
+        Test: css3/flexbox/box-sizing.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild):
+        * rendering/RenderFlexibleBox.h:
+
+2012-08-06  John J. Barton  <johnjbarton@chromium.org>
+
+        Web Inspector: WebInspector.linkifyStringAsFragment gives wrong typeof lineNumber
+        https://bugs.webkit.org/show_bug.cgi?id=93019
+
+        Reviewed by Pavel Feldman.
+
+        Add test for WebInspector.linkifyStringAsFragment()
+
+        * inspector/front-end/ResourceUtils.js:
+        (WebInspector.linkifyStringAsFragmentWithCustomLinkifier):
+
+2012-08-06  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Refactor CCTextureUpdater into CCTextureUpdater and CCTextureUpdateController.
+        https://bugs.webkit.org/show_bug.cgi?id=92596
+
+        Reviewed by Adrienne Walker.
+
+        The CCTextureUpdater interface is used by the main thread to queue
+        texture updates. The CCTextureUpdateController constructor takes a
+        CCTextureUpdater and contains the logic required to perform texture
+        uploads and texture copies. This class is only used by the impl thread.
+
+        No new tests.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::updatePart):
+        * platform/graphics/chromium/TextureCopier.cpp:
+        (WebCore::AcceleratedTextureCopier::copyTexture):
+        * platform/graphics/chromium/TextureCopier.h:
+        (Parameters):
+        (TextureCopier):
+        (AcceleratedTextureCopier):
+        * platform/graphics/chromium/TextureUploader.h:
+        (Parameters):
+        (TextureUploader):
+        * platform/graphics/chromium/ThrottledTextureUploader.cpp:
+        (WebCore::ThrottledTextureUploader::uploadTexture):
+        * platform/graphics/chromium/ThrottledTextureUploader.h:
+        (ThrottledTextureUploader):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::updateTiles):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::doCommit):
+        * platform/graphics/chromium/cc/CCTextureUpdateController.cpp: Added.
+        (WebCore):
+        (WebCore::CCTextureUpdateController::maxPartialTextureUpdates):
+        (WebCore::CCTextureUpdateController::updateTextures):
+        (WebCore::CCTextureUpdateController::CCTextureUpdateController):
+        (WebCore::CCTextureUpdateController::~CCTextureUpdateController):
+        (WebCore::CCTextureUpdateController::hasMoreUpdates):
+        (WebCore::CCTextureUpdateController::updateMoreTextures):
+        (WebCore::CCTextureUpdateController::updateMoreTexturesSize):
+        * platform/graphics/chromium/cc/CCTextureUpdateController.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.h.
+        (WebCore):
+        (CCTextureUpdateController):
+        (WebCore::CCTextureUpdateController::create):
+        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
+        (WebCore::CCTextureUpdater::appendFullUpload):
+        (WebCore::CCTextureUpdater::appendPartialUpload):
+        (WebCore::CCTextureUpdater::appendCopy):
+        (WebCore::CCTextureUpdater::takeFirstFullUpload):
+        (WebCore::CCTextureUpdater::takeFirstPartialUpload):
+        (WebCore::CCTextureUpdater::takeFirstCopy):
+        (WebCore::CCTextureUpdater::hasMoreUpdates):
+        * platform/graphics/chromium/cc/CCTextureUpdater.h:
+        (CCTextureUpdater):
+        (WebCore::CCTextureUpdater::fullUploadSize):
+        (WebCore::CCTextureUpdater::partialUploadSize):
+        (WebCore::CCTextureUpdater::copySize):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
+        (WebCore::CCThreadProxy::hasMoreResourceUpdates):
+        (WebCore::CCThreadProxy::scheduledActionUpdateMoreResources):
+        (WebCore::CCThreadProxy::scheduledActionCommit):
+        (WebCore::CCThreadProxy::maxPartialTextureUpdates):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (WebCore):
+        (WebCore::CCThreadProxy::BeginFrameAndCommitState::BeginFrameAndCommitState):
+        (BeginFrameAndCommitState):
+        (CCThreadProxy):
+
+2012-08-06  Douglas Stockwell  <dstockwell@chromium.org>
+
+        Crash in WebCore::RenderListItem::updateMarkerLocation
+        https://bugs.webkit.org/show_bug.cgi?id=90476
+
+        Reviewed by Abhishek Arya.
+
+        In some cases an anonymous block is destroyed when its last child is
+        removed. RenderListItem did not expect this and has it's own logic for
+        cleaning up such blocks when the list marker is removed. Detect this
+        case in RenderBlock::removeChild to defer to the logic in RenderListItem::updateListMarker.
+
+        Test: fast/lists/list-marker-remove-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+
+2012-08-06  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Non-preserves-3d requires explicit flattening of screen-space transform.
+        https://bugs.webkit.org/show_bug.cgi?id=85808
+
+        Reviewed by Adrienne Walker.
+
+        When computing the screen-space transforms, z values were not
+        being flattened when they should be. This caused incorrect
+        clipping due to occlusion tracking that relied on the screen-space
+        transform. The fix is to flatten the screen-space transform just
+        like the "sublayerMatrix" is flattened, when the layer does not
+        preserve-3d.
+
+        In addition to making the simple fix, it was convenient to make a
+        helper function for the flattening code.
+
+        Additional unit test added to exercise that flattening code:
+          CCLayerTreeHostCommonTest.verifyTransformsForFlatteningLayer
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsInternal):
+        * platform/graphics/chromium/cc/CCMathUtil.cpp:
+        (WebCore::CCMathUtil::flattenTransformTo2d):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCMathUtil.h:
+        (CCMathUtil):
+
+2012-08-06  Anna Cavender  <annacc@chromium.org>
+
+        Create a MediaSource object.
+        https://bugs.webkit.org/show_bug.cgi?id=91773
+
+        Reviewed by Eric Carlson.
+
+        MediaSource object is needed in order to implement the new
+        object-oriented MediaSource API:
+        http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html
+
+        No new tests - will be able to test after landing:
+        https://bugs.webkit.org/show_bug.cgi?id=91775
+ 
+        Adding new files to build files:
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        New MediaSource object:
+        * Modules/mediasource/MediaSource.cpp: Added.
+        * Modules/mediasource/MediaSource.h: Added.
+        * Modules/mediasource/MediaSource.idl: Added.
+
+        Create a registry for the blob storage and lookup:
+        * Modules/mediasource/MediaSourceRegistry.cpp: Added.
+        * Modules/mediasource/MediaSourceRegistry.h: Added.
+
+        Connect SourceBuffer to MediaSource:
+        * Modules/mediasource/SourceBuffer.cpp:
+        (WebCore::SourceBuffer::SourceBuffer):
+        (WebCore::SourceBuffer::buffered): Forward call to MediaSource.
+        (WebCore::SourceBuffer::append): Ditto.
+        (WebCore::SourceBuffer::abort): Ditto.
+        * Modules/mediasource/SourceBuffer.h:
+        (WebCore::SourceBuffer::create): Add a MediaSource to the constructor.
+        (WebCore::SourceBuffer::clear): Clear the MediaSource.
+        (SourceBuffer):
+        * Modules/mediasource/SourceBufferList.cpp: include SourceBuffer.h
+        * Modules/mediasource/SourceBufferList.h:
+ 
+        Make MediaSource an EventTarget:
+        * dom/EventTarget.h:
+        (WebCore):
+        * dom/EventTargetFactory.in:
+
+        Enable creation of MediaSource object URL from JavaScript:
+        * html/DOMURL.cpp:
+        (WebCore):
+        (WebCore::DOMURL::createObjectURL):
+        * html/DOMURL.h:
+        (WebCore):
+        (DOMURL):
+        * html/DOMURL.idl:
+
+        New MediaSource constructor:
+        * page/DOMWindow.idl:
+
+2012-08-06  Andreas Kling  <kling@webkit.org>
+
+        Simplify CSSOM style declaration's grabbing at internals.
+        <http://webkit.org/b/93261>
+
+        Reviewed by Antti Koivisto.
+
+        It was already the case that StylePropertySets exposed in CSSOM were guaranteed mutable,
+        so remove the mechanism to convert immutable backing objects to mutable ones.
+
+        Made ensureCSSStyleDeclaration() non-const to prevent callers that may have an
+        immutable StylePropertySet from wrapping a CSSOM object around it.
+
+        * css/PropertySetCSSStyleDeclaration.h:
+        (PropertySetCSSStyleDeclaration):
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::length):
+        (WebCore::PropertySetCSSStyleDeclaration::item):
+        (WebCore::PropertySetCSSStyleDeclaration::cssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
+        (WebCore::PropertySetCSSStyleDeclaration::isPropertyImplicit):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::copy):
+        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
+        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
+
+            Remove indirection and access StylePropertySet member directly.
+
+        * css/StylePropertySet.h:
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::ensureCSSStyleDeclaration):
+        (WebCore::StylePropertySet::ensureInlineCSSStyleDeclaration):
+
+            Made these two non-const. CSSOM wrappers should only ever be constructed around
+            mutable StylePropertySets.
+            Also added ASSERT(isMutable()).
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::buildObjectForAttributesStyle):
+
+            Cast away the constness of StyledElement::attributeStyle(). It's not pretty,
+            but these objects are guaranteed mutable, and there's an assertion to protect
+            us in ensureCSSStyleDeclaration() if something changes in the future.
+
+2012-08-06  Andrei Poenaru  <poenaru@adobe.com>
+
+        Web Inspector: Protocol: Add "namedFlowCreated" and "namedFlowRemoved" events
+        https://bugs.webkit.org/show_bug.cgi?id=92739
+
+        Reviewed by Pavel Feldman.
+
+        Implemented "namedFlowCreated" and "namedFlowRemoved" events.
+
+        Modified test: inspector/styles/protocol-css-regions-commands.html.
+
+        * dom/WebKitNamedFlowCollection.cpp:
+        (WebCore::WebKitNamedFlowCollection::ensureFlowWithName):
+        (WebCore::WebKitNamedFlowCollection::discardNamedFlow):
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::reset):
+        (WebCore::InspectorCSSAgent::didCreateNamedFlow):
+        (WebCore):
+        (WebCore::InspectorCSSAgent::didRemoveNamedFlow):
+        (WebCore::InspectorCSSAgent::getNamedFlowCollection):
+        * inspector/InspectorCSSAgent.h:
+        (InspectorCSSAgent):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::didCreateNamedFlowImpl):
+        (WebCore::InspectorInstrumentation::didRemoveNamedFlowImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::didCreateNamedFlow):
+        (WebCore):
+        (WebCore::InspectorInstrumentation::didRemoveNamedFlow):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._namedFlowCreated.callback):
+        (WebInspector.CSSStyleModel.prototype._namedFlowCreated):
+        (WebInspector.CSSStyleModel.prototype._namedFlowRemoved.callback):
+        (WebInspector.CSSStyleModel.prototype._namedFlowRemoved):
+        (WebInspector.CSSDispatcher.prototype.styleSheetChanged):
+        (WebInspector.CSSDispatcher.prototype.namedFlowCreated):
+        (WebInspector.CSSDispatcher.prototype.namedFlowRemoved):
+
+2012-08-06  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in FrameLoader::stopAllLoaders.
+        https://bugs.webkit.org/show_bug.cgi?id=90805
+
+        Reviewed by Nate Chapin.
+
+        Calling m_provisionalDocumentLoader->stopLoading() can blow away the frame
+        from underneath. Protect it with a RefPtr.
+
+        No new tests. We don't have a reliable testcase to reproduce this. However,
+        the crash and free stack from ClusterFuzz point clearly at the bug.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopAllLoaders):
+
+2012-08-06  Hironori Bono  <hbono@chromium.org>
+
+        Rolling out my r123067 and r123572
+        https://bugs.webkit.org/show_bug.cgi?id=93234
+
+        Reviewed by Ryosuke Niwa.
+
+        This change manually rolls out my r123067 and r123572 (except layout tests)
+        because it renders RTL text to a wrong place when an RTL element shows a
+        vertical scrollbar at its left side.
+
+        No new tests because this change rolls out my changes.
+
+        * dom/Element.cpp:
+        (WebCore::Element::clientLeft):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverflowFromPositionedObjects):
+        (WebCore::RenderBlock::determineLogicalLeftPositionForChild):
+        (WebCore::RenderBlock::paintObject):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::topLeftLocationOffset):
+
+2012-08-06  Andrei Bucur  <abucur@adobe.com>
+
+        [CSS Regions] Add the NamedFlow.getRegions() API
+        https://bugs.webkit.org/show_bug.cgi?id=93240
+
+        Reviewed by Andreas Kling.
+
+        This patch adds the NamedFlow.getRegions() API call as specified by http://www.w3.org/TR/2012/WD-css3-regions-20120503/#dom-named-flow .
+        For now, WebKit supports only one type of regions, Element. The Region interface will be introduced when other interfaces will be capable
+        of becoming regions.
+
+        New test: fast/regions/webkit-named-flow-get-regions.html
+
+        * dom/WebKitNamedFlow.cpp:
+        (WebCore::WebKitNamedFlow::getRegionsByContent): Add a check not to include the pseudo-elements that are regions; those don't have a node attached.
+        (WebCore::WebKitNamedFlow::getRegions):
+        (WebCore):
+        * dom/WebKitNamedFlow.h:
+        (WebKitNamedFlow):
+        * dom/WebKitNamedFlow.idl:
+
+2012-08-06  Andrei Bucur  <abucur@adobe.com>
+
+        [CSS Regions] Rename regionOverflow to regionOverset
+        https://bugs.webkit.org/show_bug.cgi?id=93256
+
+        Reviewed by Andreas Kling.
+
+        Link to spec: http://www.w3.org/TR/2012/WD-css3-regions-20120503/#dom-region-regionoverset
+        The regionOverflow property has been renamed to regionOverset in the latest working draft. This patch applies the change both externally and
+        internally in the code.
+
+        Tests: No new tests because this is not a functional change.
+
+        * dom/Element.cpp:
+        (WebCore::Element::renderRegion): Convenience method to access the renderer for a region element.
+        (WebCore):
+        (WebCore::Element::webkitRegionOverset):
+        * dom/Element.h:
+        (WebCore):
+        * dom/Element.idl:
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::paintIntoRegion):
+        (WebCore::RenderFlowThread::hitTestRegion):
+        (WebCore::RenderFlowThread::repaintRectangleInRegions):
+        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::regionOversetRect):
+        * rendering/RenderRegion.h:
+        (RenderRegion):
+
+2012-08-06  Sergey Rogulenko  <rogulenko@google.com>
+
+        Web Inspector: a tiny refactoring of Highlighter in InspectorDOMAgent
+        https://bugs.webkit.org/show_bug.cgi?id=93257
+
+        Reviewed by Pavel Feldman.
+
+        Moving error string setting inside highlightConfigFromInspectorObject.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setSearchingForNode):
+        (WebCore::InspectorDOMAgent::highlightConfigFromInspectorObject):
+        (WebCore::InspectorDOMAgent::highlightNode):
+        * inspector/InspectorDOMAgent.h:
+        (InspectorDOMAgent):
+
+2012-08-03  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add memory instrumentation for CSSValue and its descendants
+        https://bugs.webkit.org/show_bug.cgi?id=93130
+
+        Reviewed by Pavel Feldman.
+
+        Added memory footprint reporting routine to CSSValue and its descendants.
+
+        Memory reporing for CSSValue is organized in a following way:
+        - CSSValue implements reportMemoryUsage method that switches by the value
+          type and calls reportDescendantMemoryUsage on the concrete type
+        - There may be some intermediate classes in the inheritance chain between
+          CSSValue and the leaf class implementing reportDescendantMemoryUsage. Those
+          intermediate classes implement reportBaseClassMemoryUsage method that can
+          be called from a descendant to collect memory information for the base class
+          members. Having reportDescendantMemoryUsage only on the leaf classes prevents
+          us from accidentally adding the intermediate classes to the switch block
+          in the CSSValue::reportMemoryUsage.
+
+        * css/CSSAspectRatioValue.cpp:
+        (WebCore::CSSAspectRatioValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSAspectRatioValue.h:
+        (CSSAspectRatioValue):
+        * css/CSSBorderImageSliceValue.cpp:
+        (WebCore::CSSBorderImageSliceValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSBorderImageSliceValue.h:
+        (CSSBorderImageSliceValue):
+        * css/CSSCalculationValue.cpp:
+        (WebCore):
+        (WebCore::CSSCalcValue::reportDescendantMemoryUsage):
+        (CSSCalcPrimitiveValue):
+        * css/CSSCalculationValue.h:
+        (CSSCalcExpressionNode):
+        (CSSCalcValue):
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSCanvasValue.h:
+        (CSSCanvasValue):
+        * css/CSSCrossfadeValue.cpp:
+        (WebCore::CSSCrossfadeValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSCrossfadeValue.h:
+        (CSSCrossfadeValue):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::CSSCursorImageValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSCursorImageValue.h:
+        (CSSCursorImageValue):
+        * css/CSSFontFaceSrcValue.cpp:
+        (WebCore::CSSFontFaceSrcValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSFontFaceSrcValue.h:
+        (CSSFontFaceSrcValue):
+        * css/CSSFunctionValue.cpp:
+        (WebCore::CSSFunctionValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSFunctionValue.h:
+        (CSSFunctionValue):
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientColorStop::reportMemoryUsage):
+        (WebCore):
+        (WebCore::CSSGradientValue::reportBaseClassMemoryUsage):
+        (WebCore::CSSLinearGradientValue::reportDescendantMemoryUsage):
+        (WebCore::CSSRadialGradientValue::reportDescendantMemoryUsage):
+        * css/CSSGradientValue.h:
+        (CSSGradientColorStop):
+        (CSSGradientValue):
+        (CSSLinearGradientValue):
+        (CSSRadialGradientValue):
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::reportBaseClassMemoryUsage):
+        (WebCore):
+        * css/CSSImageGeneratorValue.h:
+        (CSSImageGeneratorValue):
+        * css/CSSImageSetValue.cpp:
+        (WebCore::CSSImageSetValue::reportDescendantMemoryUsage):
+        (WebCore):
+        (WebCore::CSSImageSetValue::ImageWithScale::reportMemoryUsage):
+        * css/CSSImageSetValue.h:
+        (ImageWithScale):
+        (CSSImageSetValue):
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSImageValue.h:
+        (CSSImageValue):
+        * css/CSSInheritedValue.cpp:
+        (WebCore::CSSInheritedValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSInheritedValue.h:
+        (CSSInheritedValue):
+        * css/CSSInitialValue.cpp:
+        (WebCore::CSSInitialValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSInitialValue.h:
+        (CSSInitialValue):
+        * css/CSSLineBoxContainValue.cpp:
+        (WebCore::CSSLineBoxContainValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSLineBoxContainValue.h:
+        (CSSLineBoxContainValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSPrimitiveValue.h:
+        (CSSPrimitiveValue):
+        * css/CSSReflectValue.cpp:
+        (WebCore::CSSReflectValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSReflectValue.h:
+        (CSSReflectValue):
+        * css/CSSTimingFunctionValue.cpp:
+        (WebCore::CSSLinearTimingFunctionValue::reportDescendantMemoryUsage):
+        (WebCore):
+        (WebCore::CSSCubicBezierTimingFunctionValue::reportDescendantMemoryUsage):
+        (WebCore::CSSStepsTimingFunctionValue::reportDescendantMemoryUsage):
+        * css/CSSTimingFunctionValue.h:
+        (CSSLinearTimingFunctionValue):
+        (CSSCubicBezierTimingFunctionValue):
+        (CSSStepsTimingFunctionValue):
+        * css/CSSUnicodeRangeValue.cpp:
+        (WebCore::CSSUnicodeRangeValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSUnicodeRangeValue.h:
+        (CSSUnicodeRangeValue):
+        * css/CSSValue.cpp:
+        (WebCore::TextCloneCSSValue::reportDescendantMemoryUsage):
+        (TextCloneCSSValue):
+        (WebCore::CSSValue::reportMemoryUsage):
+        (WebCore):
+        * css/CSSValue.h:
+        (WebCore):
+        (CSSValue):
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSValueList.h:
+        (CSSValueList):
+        * css/CSSVariableValue.h:
+        (WebCore::CSSVariableValue::reportDescendantMemoryUsage):
+        (CSSVariableValue):
+        * css/FontFeatureValue.cpp:
+        (WebCore::FontFeatureValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/FontFeatureValue.h:
+        (FontFeatureValue):
+        * css/FontValue.cpp:
+        (WebCore::FontValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/FontValue.h:
+        (FontValue):
+        * css/MediaQueryExp.cpp:
+        (WebCore::MediaQueryExp::reportMemoryUsage):
+        * css/ShadowValue.cpp:
+        (WebCore::ShadowValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/ShadowValue.h:
+        (ShadowValue):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/WebKitCSSFilterValue.cpp:
+        (WebCore::WebKitCSSFilterValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/WebKitCSSFilterValue.h:
+        (WebKitCSSFilterValue):
+        * css/WebKitCSSSVGDocumentValue.cpp:
+        (WebCore::WebKitCSSSVGDocumentValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/WebKitCSSSVGDocumentValue.h:
+        (WebKitCSSSVGDocumentValue):
+        * css/WebKitCSSShaderValue.cpp:
+        (WebCore::WebKitCSSShaderValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/WebKitCSSShaderValue.h:
+        (WebKitCSSShaderValue):
+        * css/WebKitCSSTransformValue.cpp:
+        (WebCore::WebKitCSSTransformValue::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/WebKitCSSTransformValue.h:
+        (WebKitCSSTransformValue):
+        * dom/MemoryInstrumentation.cpp:
+        (WebCore::MemoryInstrumentation::addString):
+        (WebCore):
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (WebCore::MemoryClassInfo::addHashCountedSet):
+        (WebCore::MemoryClassInfo::addMember):
+        * svg/SVGColor.cpp:
+        (WebCore::SVGColor::reportDescendantMemoryUsage):
+        (WebCore):
+        * svg/SVGColor.h:
+        (SVGColor):
+        * svg/SVGPaint.cpp:
+        (WebCore::SVGPaint::reportDescendantMemoryUsage):
+        (WebCore):
+        * svg/SVGPaint.h:
+        (SVGPaint):
+
+2012-08-06  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: rename WorkerAgent.setWorkerInspectionEnabled to WorkerAgent.enable and make it return error
+        https://bugs.webkit.org/show_bug.cgi?id=92545
+
+        Reviewed by Pavel Feldman.
+
+        - Replaced WorkerAgent.setWorkerInspectionEnabled with WorkerAgent.enable/disable
+        - Replaced Preferences.exposeWorkersInspection with InspectorFrontendHost.canInspectWorkers()
+          that tells if inspector front-end on the given platform can launch dedicated worker
+          front-end.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorFrontendClient.h:
+        (InspectorFrontendClient):
+        * inspector/InspectorFrontendClientLocal.h:
+        (WebCore::InspectorFrontendClientLocal::canInspectWorkers):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::canInspectWorkers):
+        (WebCore):
+        * inspector/InspectorFrontendHost.h:
+        (InspectorFrontendHost):
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/InspectorWorkerAgent.cpp:
+        (WebCore::InspectorWorkerAgent::enable):
+        (WebCore):
+        (WebCore::InspectorWorkerAgent::disable):
+        * inspector/InspectorWorkerAgent.h:
+        (InspectorWorkerAgent):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.setZoomFactor):
+        (.WebInspector.InspectorFrontendHostStub.prototype.canInspectWorkers):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/Settings.js:
+
+2012-08-06  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [WK2][GTK] Improvements for the new spell-checking API
+        https://bugs.webkit.org/show_bug.cgi?id=93262
+
+        Reviewed by Carlos Garcia Campos.
+
+        Provide a way to ask TextCheckerEnchant helper class for the list
+        of languages currently available for the spell checking feature.
+
+        * platform/text/gtk/TextCheckerEnchant.cpp:
+        (enchantDictDescribeCallback): Renamed from
+        getAvailableDictionariesCallback, for consistency.
+        (TextCheckerEnchant::updateSpellCheckingLanguages): Updated usage
+        of getAvailableDictionariesCallback to enchantDictDescribeCallback.
+        (TextCheckerEnchant::getSpellCheckingLanguages): New. Will build
+        and return a String with a comma-separated list of languages
+        currently in use by the spell checking feature.
+        * platform/text/gtk/TextCheckerEnchant.h:
+        (TextCheckerEnchant): Added new function getSpellCheckingLanguages.
+
+2012-08-06  Andreas Kling  <kling@webkit.org>
+
+        Pass presentational attribute StylePropertySets by const pointer where possible.
+        <http://webkit.org/b/93187>
+
+        Reviewed by Antti Koivisto.
+
+        Minor cleanup to enforce (at compile time) the fact that no methods that have the
+        side-effect of incurring immutable-to-mutable-StylePropertySet conversion.
+
+        This was already covered by assertions, we're just making it stricter and adding
+        some documentational flavor.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::addElementStyleProperties):
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/StyleResolver.h:
+        (StyleResolver):
+        * dom/ElementAttributeData.h:
+        (WebCore::ElementAttributeData::attributeStyle):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::additionalAttributeStyle):
+        (StyledElement):
+        (WebCore::StyledElement::attributeStyle):
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::additionalAttributeStyle):
+        * html/HTMLTableCellElement.h:
+        (HTMLTableCellElement):
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::additionalAttributeStyle):
+        * html/HTMLTableColElement.h:
+        (HTMLTableColElement):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::additionalAttributeStyle):
+        (WebCore::HTMLTableElement::additionalCellStyle):
+        (WebCore::HTMLTableElement::additionalGroupStyle):
+        * html/HTMLTableElement.h:
+        (HTMLTableElement):
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::additionalAttributeStyle):
+        * html/HTMLTableSectionElement.h:
+        (HTMLTableSectionElement):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::buildObjectForAttributesStyle):
+
+2012-08-06  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add DeviceProximityEvent interface
+        https://bugs.webkit.org/show_bug.cgi?id=92942
+
+        Reviewed by Kentaro Hara.
+
+        Spec : http://www.w3.org/TR/proximity/#idl-def-DeviceProximityEvent
+
+        Add DeviceProximityEvent interface of Proximity Events.
+        And add onwebkitdeviceproximity event handler to the DOMWindow.
+
+        Tests: fast/dom/Proximity/check-event-deviceproximity.html
+               fast/dom/Proximity/create-event-deviceproximity.html
+               fast/events/constructors/device-proximity-event-constructor.html
+
+        * CMakeLists.txt:
+        * Modules/proximity/DeviceProximityEvent.cpp: Added.
+        (WebCore):
+        (WebCore::DeviceProximityEvent::DeviceProximityEvent):
+        * Modules/proximity/DeviceProximityEvent.h: Added.
+        (WebCore):
+        (WebCore::DeviceProximityEventInit::DeviceProximityEventInit):
+        (DeviceProximityEventInit):
+        (DeviceProximityEvent):
+        (WebCore::DeviceProximityEvent::~DeviceProximityEvent):
+        (WebCore::DeviceProximityEvent::create):
+        (WebCore::DeviceProximityEvent::value):
+        (WebCore::DeviceProximityEvent::min):
+        (WebCore::DeviceProximityEvent::max):
+        (WebCore::DeviceProximityEvent::interfaceName):
+        * Modules/proximity/DeviceProximityEvent.idl: Added.
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/EventNames.in:
+        * page/DOMWindow.h:
+        (DOMWindow):
+        * page/DOMWindow.idl:
+
+2012-08-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Remove unexistent header file.
+
+2012-08-06  Vineet Chaudhary  <rgf748@motorola.com>
+
+        [JSC] Remove custom JSBindings for constructArrayBufferView()
+        https://bugs.webkit.org/show_bug.cgi?id=93097
+
+        Reviewed by Kentaro Hara.
+
+        Currently TypedArray files have the custom implementation of constructArrayBufferView().
+        We can can remove these modifying CodeGeneratorJS.pm
+
+        Tests: TestTypedArray.idl
+
+        * bindings/js/JSFloat32ArrayCustom.cpp: Removed custom call constructArrayBufferView().
+        * bindings/js/JSFloat64ArrayCustom.cpp: Ditto.
+        * bindings/js/JSInt16ArrayCustom.cpp: Ditto.
+        * bindings/js/JSInt32ArrayCustom.cpp: Ditto.
+        * bindings/js/JSUint16ArrayCustom.cpp: Ditto.
+        * bindings/js/JSUint32ArrayCustom.cpp: Ditto.
+        * bindings/scripts/CodeGeneratorJS.pm: Modified Generator code to generate bindings for
+        constructArrayBufferView()
+        (GenerateConstructorDefinition):
+        * bindings/scripts/IDLAttributes.txt: Added [TypedArray] attribute.
+        * bindings/scripts/test/JS/JSFloat64Array.cpp: Tests result.
+        (WebCore::JSFloat64ArrayConstructor::getConstructData):
+        (WebCore::JSFloat64ArrayConstructor::constructJSFloat64Array):
+        * bindings/scripts/test/TestTypedArray.idl: Test.
+        * html/canvas/Float32Array.idl: Using [TypedArray].
+        * html/canvas/Float64Array.idl: Ditto.
+        * html/canvas/Int16Array.idl: Ditto.
+        * html/canvas/Int32Array.idl: Ditto.
+        * html/canvas/Uint16Array.idl: Ditto.
+        * html/canvas/Uint32Array.idl: Ditto.
+
+2012-08-06  Shinya Kawanaka  <shinyak@chromium.org>
+
+        AuthorShadowDOM for progress element
+        https://bugs.webkit.org/show_bug.cgi?id=91969
+
+        Reviewed by Hajime Morita.
+
+        We add support for AuthorShadowDOM for progress element.
+
+        According to the Shadow DOM spec, a progress element should behave like having a UserAgentShadowRoot and
+        an element in UserAgentShadowRoot draws a real 'progress' bar. In this patch, we change the inner structure
+        of a progress element so that we can distribute an element having RenderProgress to AuthorShadowDOM.
+
+        Before this patch, a progress element has the following inner structure.
+
+            <progress>--UserAgentShadowRoot -- -- -- -- -- -- -- -- -- -- AuthorShadowRoot
+                               |
+                               +-- ProgressBarElement
+                               |
+                               +-- ProgressValueElement
+
+        After this patch, a progress element will have the following inner structure.
+
+            <progress>--UserAgentShadowRoot -- -- -- -- -- -- -- -- -- -- AuthorShadowRoot
+                               |
+                               +-- ProgressInnerElement
+                                           |
+                                           +-- ProgressBarElement
+                                           |
+                                           +-- ProgressValueElement
+
+
+        Tests: fast/dom/shadow/shadowdom-for-progress-dynamic.html
+               fast/dom/shadow/shadowdom-for-progress-multiple.html
+               fast/dom/shadow/shadowdom-for-progress-with-style.html
+               fast/dom/shadow/shadowdom-for-progress-without-appearance.html
+               fast/dom/shadow/shadowdom-for-progress-without-shadow-element.html
+               fast/dom/shadow/shadowdom-for-progress.html
+
+        * css/html.css:
+        (progress::-webkit-progress-inner-element):
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::HTMLProgressElement):
+        (WebCore::HTMLProgressElement::createRenderer):
+        (WebCore::HTMLProgressElement::renderProgress): Returns RenderProgress gotten from UserAgentShadowDOM.
+        (WebCore):
+        (WebCore::HTMLProgressElement::willAddAuthorShadowRoot):
+        (WebCore::HTMLProgressElement::didElementStateChange):
+        (WebCore::HTMLProgressElement::createShadowSubtree): Creates a new Shadow DOM structure.
+        * html/HTMLProgressElement.h:
+        (WebCore):
+        (WebCore::HTMLProgressElement::hasAuthorShadowRoot):
+        (HTMLProgressElement):
+        (WebCore::isHTMLProgressElement):
+        (WebCore::toHTMLProgressElement):
+        * html/shadow/ProgressShadowElement.cpp:
+        (WebCore::ProgressShadowElement::ProgressShadowElement):
+        (WebCore::ProgressShadowElement::progressElement):
+        (WebCore::ProgressInnerElement::ProgressInnerElement): We introduce a new element having RenderProgress
+        so that we can distribute an element having RenderProgress to AuthorShadowDOM.
+        (WebCore):
+        (WebCore::ProgressInnerElement::create):
+        (WebCore::ProgressInnerElement::shadowPseudoId):
+        (WebCore::ProgressInnerElement::createRenderer):
+        (WebCore::ProgressInnerElement::rendererIsNeeded):
+        * html/shadow/ProgressShadowElement.h:
+        (ProgressShadowElement):
+        (WebCore):
+        (ProgressInnerElement):
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::RenderProgress):
+        (WebCore::RenderProgress::progressElement):
+        * rendering/RenderProgress.h:
+        (RenderProgress):
+
+2012-08-06  Keishi Hattori  <keishi@webkit.org>
+
+        Remove minimum window size for PagePopup
+        https://bugs.webkit.org/show_bug.cgi?id=93100
+
+        Reviewed by Kent Tamura.
+
+        DOMWindow had a minimum size of 100x100 pixels. We need to remove that limit for PagePopup window.
+
+        No new tests. Covered in platform/chromium/fast/forms/color/color-suggestion-picker-{one,two}-row-appearance.html.
+
+        * Resources/colorSuggestionPicker.css:
+        (.color-swatch-container):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::minimumWindowSize):
+        (ChromeClient):
+        * page/DOMWindow.cpp:
+        (WebCore):
+        (WebCore::DOMWindow::adjustWindowRect): Asks Chrome::minimumWindowSize for minimum window size.
+        * page/DOMWindow.h:
+        (DOMWindow):
+
+2012-08-06  Arko Saha  <arko@motorola.com>
+
+        Microdata: document.getItems() must treat no token as no parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=93071
+
+        Reviewed by Ryosuke Niwa.
+
+        document.getItems() must return all top-level microdata items in the
+        document when no tokens specified in the argument.
+        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#dom-document-getitems
+
+        Test: fast/dom/MicroData/getitems-empty-string-as-arg.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::getItems): Create an empty string identifier when typeNames is null string
+        to map such request in the cache.
+        * dom/MicroDataItemList.cpp:
+        (WebCore::MicroDataItemList::undefinedItemType): Changed undefinedItemType() to empty string.
+        (WebCore::MicroDataItemList::nodeMatches): Return true if m_typeNames contains no token.
+
+2012-08-06  Sergey Rogulenko  <rogulenko@google.com>
+
+        Web Inspector: extracting HighlightInfo from HighlightData in DOMNodeHighlighter
+        https://bugs.webkit.org/show_bug.cgi?id=91632
+
+        Reviewed by Pavel Feldman.
+
+        Extracted struct HighlightInfo from struct HighlightData in DOMNodeHighlighter.
+        Now InspectorOverlay receives node or rect to highlight together with highlightInfo.
+
+        * inspector/DOMNodeHighlighter.cpp:
+        (WebCore::InspectorOverlay::paint):
+        (WebCore::InspectorOverlay::getHighlight):
+        (WebCore::InspectorOverlay::hideHighlight):
+        (WebCore::InspectorOverlay::highlightNode):
+        (WebCore::InspectorOverlay::highlightRect):
+        (WebCore::InspectorOverlay::highlightedNode):
+        (WebCore::InspectorOverlay::update):
+        (WebCore::InspectorOverlay::drawNodeHighlight):
+        (WebCore):
+        (WebCore::InspectorOverlay::drawRectHighlight):
+        (WebCore::InspectorOverlay::drawPausedInDebugger):
+        * inspector/DOMNodeHighlighter.h:
+        (HighlightConfig):
+        (WebCore::Highlight::setColors):
+        (Highlight):
+        (InspectorOverlay):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::clearFrontend):
+        (WebCore::InspectorDOMAgent::inspect):
+        (WebCore::InspectorDOMAgent::mouseDidMoveOverElement):
+        (WebCore::InspectorDOMAgent::setSearchingForNode):
+        (WebCore::InspectorDOMAgent::highlightConfigFromInspectorObject):
+        (WebCore::InspectorDOMAgent::setInspectModeEnabled):
+        (WebCore::InspectorDOMAgent::highlightRect):
+        (WebCore::InspectorDOMAgent::highlightNode):
+        (WebCore::InspectorDOMAgent::highlightFrame):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore):
+        (InspectorDOMAgent):
+
+2012-08-06  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed: Web Inspector: single line test fix for r124744.
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::reportMemoryUsage):
+
+2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124739.
+        http://trac.webkit.org/changeset/124739
+        https://bugs.webkit.org/show_bug.cgi?id=93241
+
+        newly added test crash on chromium linux debug (Requested by
+        toyoshim on #webkit).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+
+2012-08-06  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Fix layoutMod in fractional layout units.
+        https://bugs.webkit.org/show_bug.cgi?id=92374
+
+        Reviewed by Levi Weintraub.
+
+        The modulo operation is upgraded from only being performed in integer to 
+        being performed in fractionalLayoutUnits, so that it returns an accurate
+        remainder for fractionalLayoutUnit division.
+
+        An alternative modulo operation is added and used to find the remainder
+        after division with natural integer results, for instance, the remainding
+        height after pagination.
+
+        No new functionality. No new tests.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::intMod):
+        (WebCore::operator%):
+        * rendering/LayoutTypes.h:
+        (WebCore::layoutMod):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::pageRemainingLogicalHeightForOffset):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::regionRemainingLogicalHeightForLine):
+
+2012-08-06  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: native memory instrumentation: cover MemoryCache with MemoryInstrumentation
+        https://bugs.webkit.org/show_bug.cgi?id=91734
+
+        Reviewed by Yury Semikhatsky.
+
+        Old version of native memory instrumentation doesn't mark the memory cache objects as visited.
+        As a result MI could count the same objects multiple times.
+        The new version just traverses through MemoryCache the same way as through DOM.
+        Also not all the cached resource types were counted.
+
+        * dom/Document.cpp:
+        (WebCore::Document::reportMemoryUsage):
+        * dom/MemoryInstrumentation.h:
+        * inspector/InspectorMemoryAgent.cpp:
+        (MemoryBlockName):
+        (WebCore):
+        (WebCore::collectDomTreeInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * loader/cache/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::reportMemoryUsage):
+        (WebCore):
+        * loader/cache/CachedCSSStyleSheet.h:
+        (WebCore):
+        (CachedCSSStyleSheet):
+        * loader/cache/CachedFont.cpp:
+        (WebCore::CachedFont::reportMemoryUsage):
+        (WebCore):
+        * loader/cache/CachedFont.h:
+        (CachedFont):
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::reportMemoryUsage):
+        (WebCore):
+        * loader/cache/CachedImage.h:
+        (CachedImage):
+        * loader/cache/CachedRawResource.cpp:
+        (WebCore::CachedRawResource::reportMemoryUsage):
+        (WebCore):
+        * loader/cache/CachedRawResource.h:
+        (WebCore):
+        (CachedRawResource):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::reportMemoryUsage):
+        (WebCore):
+        * loader/cache/CachedResource.h:
+        (WebCore):
+        (CachedResource):
+        * loader/cache/CachedResourceHandle.cpp:
+        (WebCore::CachedResourceHandleBase::reportMemoryUsage):
+        (WebCore):
+        * loader/cache/CachedResourceHandle.h:
+        (WebCore):
+        (CachedResourceHandleBase):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore):
+        (WebCore::CachedResourceLoader::reportMemoryUsage):
+        * loader/cache/CachedResourceLoader.h:
+        (WebCore):
+        (CachedResourceLoader):
+        * loader/cache/CachedSVGDocument.cpp:
+        (WebCore::CachedSVGDocument::reportMemoryUsage):
+        (WebCore):
+        * loader/cache/CachedSVGDocument.h:
+        (CachedSVGDocument):
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::reportMemoryUsage):
+        (WebCore):
+        * loader/cache/CachedScript.h:
+        (WebCore):
+        (CachedScript):
+        * loader/cache/CachedShader.cpp:
+        (WebCore::CachedShader::reportMemoryUsage):
+        (WebCore):
+        * loader/cache/CachedShader.h:
+        (WebCore):
+        (CachedShader):
+        * loader/cache/CachedXSLStyleSheet.cpp:
+        (WebCore::CachedXSLStyleSheet::reportMemoryUsage):
+        (WebCore):
+        * loader/cache/CachedXSLStyleSheet.h:
+        (WebCore):
+        (CachedXSLStyleSheet):
+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::reportMemoryUsage):
+        (WebCore):
+        * loader/cache/MemoryCache.h:
+        (WebCore):
+        (MemoryCache):
+        * platform/PurgeableBuffer.h:
+        (WebCore):
+        (PurgeableBuffer):
+
+2012-08-06  Douglas Stockwell  <dstockwell@chromium.org>
+
+        Crash in WebCore::RenderListItem::updateMarkerLocation
+        https://bugs.webkit.org/show_bug.cgi?id=90476
+
+        Reviewed by Abhishek Arya.
+
+        In some cases an anonymous block is destroyed when its last child is
+        removed. RenderListItem did not expect this and has it's own logic for
+        cleaning up such blocks when the list marker is removed. Detect this
+        case in RenderBlock::removeChild to defer to the logic in RenderListItem::updateListMarker.
+
+        Test: fast/lists/list-marker-remove-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+
+2012-08-06  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: NMI: replace addString with addMember overload function.
+        https://bugs.webkit.org/show_bug.cgi?id=93201
+
+        Reviewed by Yury Semikhatsky.
+
+        It is impossible to implement nice instrumentation for template containers
+        content when we have different function names for different types.
+
+        Drive by: fix the most annoing warning in Element.h detected by our clang plugin.
+
+        * css/CSSCharsetRule.cpp:
+        (WebCore::CSSCharsetRule::reportDescendantMemoryUsage):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::reportMemoryUsage):
+        * css/MediaQuery.cpp:
+        (WebCore::MediaQuery::reportMemoryUsage):
+        * css/MediaQueryExp.cpp:
+        (WebCore::MediaQueryExp::reportMemoryUsage):
+        * css/StyleRuleImport.cpp:
+        (WebCore::StyleRuleImport::reportDescendantMemoryUsage):
+        * css/StyleSheetContents.cpp:
+        (WebCore::StyleSheetContents::reportMemoryUsage):
+        * css/WebKitCSSKeyframeRule.cpp:
+        (WebCore::StyleKeyframe::reportMemoryUsage):
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::StyleRuleKeyframes::reportDescendantMemoryUsage):
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::reportMemoryUsage):
+        * dom/Document.cpp:
+        (WebCore::Document::reportMemoryUsage):
+        * dom/Element.h:
+        (WebCore::Element::reportMemoryUsage):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::reportMemoryUsage):
+        * dom/MemoryInstrumentation.cpp:
+        (WebCore::MemoryInstrumentation::addObject):
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (WebCore::MemoryClassInfo::addMember):
+        * dom/QualifiedName.h:
+        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::reportMemoryUsage):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::reportMemoryUsage):
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::reportMemoryUsage):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::reportMemoryUsage):
+
+2012-08-05  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-win] Use system locale for number representation
+        https://bugs.webkit.org/show_bug.cgi?id=93085
+
+        Reviewed by Hajime Morita.
+
+        We have used LocaleICU for number localization (presentation of <input
+        type=number>) even on Windows. This patch introduces number localization
+        feature with Windows API to LocaleWin, and we stop using LocaleICU on
+        Windows.
+
+        Tests: Add new test cases to WebKit/chromium/tests/LocaleWinTest.cpp.
+
+        * WebCore.gyp/WebCore.gyp:
+        - Stop using LocaleICU.{cpp,h} and LocalizedNumberICU.cpp.
+        - Add LocalizedNumberWin.cpp.
+        * platform/text/LocaleWin.cpp:
+        (WebCore::LocaleWin::LocaleWin):
+         - Initialize m_didInitializeNumberData.
+         - Use getLocaleInfo() to obtain LOCALE_IFIRSTDAYOFWEEK.
+        (WebCore::LocaleWin::getLocaleInfo):
+        Added. A helper to obtain integer locale value.
+        (WebCore::LocaleWin::initializeNumberLocalizerData):
+        Added. Prepare data for number localization, and pass it to NumberLocalizer.
+        * platform/text/LocaleWin.h:
+        (LocaleWin): Inherit NumberLocalizer, and declare some new members.
+        * platform/text/win/LocalizedNumberWin.cpp: Added.
+        (WebCore::convertToLocalizedNumber):
+        Forward to the corresponding function of LocaleWin.
+        (WebCore::convertFromLocalizedNumber): ditto.
+        (WebCore::localizedDecimalSeparator): ditto.
+
+2012-08-05  Philip Rogers  <pdr@google.com>
+
+        Fix assertion during detach of SVG wrappers without baseVal
+        https://bugs.webkit.org/show_bug.cgi?id=93063
+
+        Reviewed by Nikolas Zimmermann.
+
+        r131583 introduced a change where SVGAnimatedListPropertyTearOff required
+        a baseVal to be set before detaching wrappers. This caused an assertion
+        to be hit if no baseVal was set.
+        This patch changes this behavior so that wrappers are detached even if
+        no baseVal is set.
+
+        Test: svg/animations/dynamic-modify-transform-without-baseval.html
+
+        * svg/properties/SVGAnimatedListPropertyTearOff.h:
+        (WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
+        * svg/properties/SVGListProperty.h:
+        (WebCore::SVGListProperty::detachListWrappersAndResize): Extracted this static method for detaching wrappers without needing an SVGListProperty.
+        (SVGListProperty):
+        (WebCore::SVGListProperty::detachListWrappers):
+
+2012-08-05  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Remove DeviceMotionEvent.h and DeviceOrientationEvent.h from Document.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=93224
+
+        Reviewed by Kentaro Hara.
+
+        Need to remove DeviceMotionEvent.h and DeviceOrientationEvent.h from Document.cpp.
+        They are not used anymore in that file.
+
+        No new tests. No change in behavior.
+
+        * dom/Document.cpp:
+
+2012-08-05  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [CMAKE] Move media source files from #ifdef ENABLE(MEDIA_SOURCE) to existing file list
+        https://bugs.webkit.org/show_bug.cgi?id=93219
+
+        Reviewed by Hajime Morita.
+
+        r122688 removed duplicating #ifdef guards from CMakeLists.txt. But, ENABLE_MEDIA_SOURCE is added to
+        CMakeList using duplicating #ifdef again.
+
+        No new tests. No change in behavior.
+
+        * CMakeLists.txt:
+
+2012-08-05  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: [JSC] implement setting breakpoints by line:column
+        https://bugs.webkit.org/show_bug.cgi?id=53003
+
+        Reviewed by Geoffrey Garen.
+
+        Since JSC can provide column info now, ScriptDebugServer can use it to support "Pretty Print"
+        debug mode. The related interfaces derived from JSC::Debugger was added a parameter. 
+
+        No new tests for this patch.
+
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        (WebCore):
+        (WebCore::ScriptDebugServer::updateCurrentStatementPosition):
+        (WebCore::ScriptDebugServer::hasBreakpoint):
+        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::callEvent):
+        (WebCore::ScriptDebugServer::atStatement):
+        (WebCore::ScriptDebugServer::returnEvent):
+        (WebCore::ScriptDebugServer::exception):
+        (WebCore::ScriptDebugServer::willExecuteProgram):
+        (WebCore::ScriptDebugServer::didExecuteProgram):
+        (WebCore::ScriptDebugServer::didReachBreakpoint):
+        * bindings/js/ScriptDebugServer.h:
+        (ScriptDebugServer):
+
+2012-08-05  Luke Macpherson   <macpherson@chromium.org>
+
+        Fix null pointer dereference when CSSParser::sinkFloatingValueList() returns null and is passed to storeVariableDeclaration().
+        https://bugs.webkit.org/show_bug.cgi?id=92461
+
+        Reviewed by Eric Seidel.
+
+        Invalid variable lists could cause CSSGrammar.y to pass null as value to storeVariableDeclaration, so we now check for null.
+
+        Test: fast/css/variables/invalid-value-list-crash.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::storeVariableDeclaration):
+
+2012-08-03  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-win] Use the default locale only if the browser locale matches to it
+        https://bugs.webkit.org/show_bug.cgi?id=93083
+
+        Reviewed by Hajime Morita.
+
+        For a calendar picker, we have used month names and day-of-week names
+        obtained from the OS default locale. However, the year-month format and
+        [Today] [Clear] labels are decided with the browser locale. It made
+        calendar pickers with mixed languages.
+
+        To make calendar pickers with a single language, we use the OS default
+        locale only if the browser locale matches to it.
+        This patch changes the behavior for Windows Vista or later. No change
+        for Windows XP because of API support limitation.
+
+        No new tests.  Behavior for locale setting is not testable in WebKit.
+
+        * platform/text/LocaleWin.cpp:
+        (determineCurrentLCID):
+        Added. If the system has no LocaleNameToLCID API, just returns
+        LOCALE_USER_DEFAULT. Otherwise, if the system locale matches to the
+        browser locale, it returns LOCALE_USER_DEFAULT, otherwise it returns the
+        LCID for the browser locale.
+        (WebCore::LocaleWin::currentLocale): Uses determineCurrentLCID().
+
+2012-08-05  Antti Koivisto  <antti@apple.com>
+
+        Don't reuse cached stylesheet with failed or canceled resource loads
+        https://bugs.webkit.org/show_bug.cgi?id=93203
+
+        Reviewed by Simon Fraser.
+
+        1) Go to apple.com
+        2) Reload repeatedly
+
+        Eventually you can get into state where some images don't load.
+        
+        The problem is that a cached stylesheet may end up pointing to image resources that have been canceled (by the reload).
+        If this happens they stay in the canceled state even when the stylesheet is applied to a new document.
+        
+        Fix by checking if all loads are complete (or pending) when restoring a cached stylesheet. The sheet is only used
+        if there are no failed or canceled loads. There are potential more sophisticated fixes but this is simple and safe.
+        Walking the sheet is fast and since it is only done on cache restore the cost is minimal.
+
+        No regression test yet though the new code does get exercised by the existing tests.
+
+        * css/CSSCrossfadeValue.cpp:
+        (WebCore::CSSCrossfadeValue::hasFailedOrCanceledSubresources):
+        (WebCore):
+        * css/CSSCrossfadeValue.h:
+        (CSSCrossfadeValue):
+        * css/CSSFontFaceSrcValue.cpp:
+        (WebCore::CSSFontFaceSrcValue::hasFailedOrCanceledSubresources):
+        (WebCore):
+        * css/CSSFontFaceSrcValue.h:
+        (CSSFontFaceSrcValue):
+        * css/CSSImageSetValue.cpp:
+        (WebCore::CSSImageSetValue::hasFailedOrCanceledSubresources):
+        (WebCore):
+        * css/CSSImageSetValue.h:
+        (CSSImageSetValue):
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::hasFailedOrCanceledSubresources):
+        (WebCore):
+        * css/CSSImageValue.h:
+        (CSSImageValue):
+        * css/CSSValue.cpp:
+        (WebCore::CSSValue::hasFailedOrCanceledSubresources):
+        (WebCore):
+        * css/CSSValue.h:
+        (CSSValue):
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::hasFailedOrCanceledSubresources):
+        (WebCore):
+        * css/CSSValueList.h:
+        (CSSValueList):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::hasFailedOrCanceledSubresources):
+        (WebCore):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+        * css/StyleSheetContents.cpp:
+        (WebCore::childRulesHaveFailedOrCanceledSubresources):
+        (WebCore):
+        (WebCore::StyleSheetContents::hasFailedOrCanceledSubresources):
+        * css/StyleSheetContents.h:
+        (StyleSheetContents):
+        * loader/cache/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::restoreParsedStyleSheet):
+        * loader/cache/CachedResource.h:
+        (WebCore::CachedResource::loadFailedOrCanceled):
+
+2012-08-05  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Move V8Proxy methods that set DOM attributes/callbacks to V8Binding
+        https://bugs.webkit.org/show_bug.cgi?id=93103
+
+        Reviewed by Adam Barth.
+
+        To remove V8Proxy, we can move V8Proxy methods that set DOM
+        attributes/callbacks to V8Binding.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::batchConfigureAttributes):
+        (WebCore):
+        (WebCore::batchConfigureCallbacks):
+        (WebCore::batchConfigureConstants):
+        * bindings/v8/V8Binding.h:
+        (BatchedAttribute):
+        (WebCore):
+        (WebCore::configureAttribute):
+        (BatchedConstant):
+        (BatchedCallback):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+        (WebCore):
+
+2012-08-05  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove V8Proxy::registerExtensionWithV8()
+        https://bugs.webkit.org/show_bug.cgi?id=93115
+
+        Reviewed by Adam Barth.
+
+        V8Proxy::registerExtensionWithV8() is used by V8Proxy::registerExtension()
+        only. We can remove the redundant method.
+
+        In a follow-up patch, I will implement V8Proxy::registerExtentionIfNeeded()
+        and remove registerExtensionWithV8() and registerExtension().
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::staticExtensionsList): Just moved to near related methods.
+        (WebCore):
+        (WebCore::V8Proxy::extensions):
+        (WebCore::V8Proxy::registerExtension):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+
+2012-08-05  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove unused enum and typedefs in V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=93105
+
+        Reviewed by Adam Barth.
+
+        In preparation for removing V8Proxy, we can remove unused enum
+        and typedefs in V8Proxy.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+        (WebCore::throwError):
+
+2012-08-04  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11875795> REGRESSION (tiled drawing): Page’s scroll bars flash with each character you type in a textarea (affects Wikipedia and YouTube)
+        https://bugs.webkit.org/show_bug.cgi?id=91348
+
+        Reviewed by Andy Estes.
+
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::scrollPositionChanged): Changed to call notifyContentAreaScrolled()
+        only if the scroll position after the change differs from what it was before the change.
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scrollPosition): Added an override of this ScrollableArea function.
+        * rendering/RenderListBox.h:
+
+2012-08-04  Ami Fischman  <fischman@chromium.org>
+
+        HTMLMediaElement may fire the seeked event before currentTime reaches the seek time
+        https://bugs.webkit.org/show_bug.cgi?id=92881
+
+        Reviewed by Eric Carlson.
+
+        Testing provided by media/video-seek-past-end-paused.html, hopefully demonstrating lack of redness on all ports/bots this time.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): don't finishSeek() until the media player is no longer seeking.
+
+2012-08-04  Dan Bernstein  <mitz@apple.com>
+
+        Tried to fix the Qt Windows build after r124654.
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::glyphForCharacter): Enclosed this function in
+        #if !(PLATFORM(QT) && !HAVE(QRAWFONT)).
+
+2012-08-04  Mike West  <mkwst@chromium.org>
+
+        Refactor SubframeLoader::requestPlugin/loadPlugin for clarity.
+        https://bugs.webkit.org/show_bug.cgi?id=93138
+
+        Reviewed by Adam Barth.
+
+        SubframeLoader::requestPlugin and SubframeLoader::loadPlugin both do a
+        variety of checks to determine whether or not a specific resource ought
+        to instantiate a plugin in a specific context. r124636[1] moved one of
+        those checks, but there doesn't seem to be a clear way to determine
+        which checks should be performed where.
+
+        This patch refactors the checks out of those two methods for clarity,
+        moving them all into a new method: SubframeLoader::pluginIsLoadable.
+        That method requires the resource URL and MIME type, as well as the
+        `object` or `embed` element that owns this bit of rendering. The URL
+        and type are used directly to determine availability, while the element
+        is currently used only to create a renderer on which
+        setPluginUnavailabilityReason can be called if the plugin is blocked by
+        Content Security Policy.
+
+        This patch introduces no new tests, as it shouldn't change the code's
+        behavior: it should be a straightforward refactoring without web-visible
+        side-effects.
+
+        [1]: http://trac.webkit.org/changeset/124636
+
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::pluginIsLoadable):
+            A new method that extracts the various 'Should we allow this plugin
+            in this context?' checks from requestPlugin and loadPlugin into ine
+            location, rather than spreading them across both.
+        (WebCore):
+        (WebCore::SubframeLoader::requestPlugin):
+        (WebCore::SubframeLoader::loadPlugin):
+        * loader/SubframeLoader.h:
+        (SubframeLoader):
+
+2012-08-04  John J. Barton  <johnjbarton@chromium.org>
+
+        Web Inspector: filteredItemSelectionDialog.css has wrong selector for highlights
+        https://bugs.webkit.org/show_bug.cgi?id=93168
+
+        Reviewed by Pavel Feldman.
+
+        Selector required span to be a child, but highlights are themselves span. Used descendent selector.
+        No new tests: I'll make one next week, to go with bug 93166
+
+        * inspector/front-end/filteredItemSelectionDialog.css:
+        (.js-outline-dialog > .container > div.item span.highlight):
+
+2012-08-03  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: overflow-applies-to-001 fails
+        https://bugs.webkit.org/show_bug.cgi?id=93148
+
+        Reviewed by Eric Seidel.
+
+        Overflow no longer applies to table-rows or table-row-groups, it only applies
+        to block containers: http://www.w3.org/TR/CSS21/visufx.html#overflow
+
+        Tests:  css2.1/20110323/overflow-applies-to-001.htm
+                css2.1/20110323/overflow-applies-to-002.htm
+                css2.1/20110323/overflow-applies-to-003.htm
+                css2.1/20110323/overflow-applies-to-004.htm
+                css2.1/20110323/overflow-applies-to-005.htm
+                css2.1/20110323/overflow-applies-to-006.htm
+                css2.1/20110323/overflow-applies-to-007.htm
+                css2.1/20110323/overflow-applies-to-008.htm
+                css2.1/20110323/overflow-applies-to-009.htm
+                css2.1/20110323/overflow-applies-to-010.htm
+                css2.1/20110323/overflow-applies-to-012.htm
+                css2.1/20110323/overflow-applies-to-013.htm
+                css2.1/20110323/overflow-applies-to-014.htm
+                css2.1/20110323/overflow-applies-to-015.htm
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::updateBoxModelInfoFromStyle):
+
+2012-08-04  Adam Barth  <abarth@webkit.org>
+
+        BindingSecurity::shouldAllowAccessToNode shouldn't detour through Frame to find the node's document
+        https://bugs.webkit.org/show_bug.cgi?id=93140
+
+        Reviewed by Eric Seidel.
+
+        Previously, shouldAllowAccessToNode took a detour through the Frame to
+        find the Document associated with a given Node. That's crazy! Nodes
+        already know their documents. This patch removes the detour.
+
+        It's theoretically possible that this patch changes behavior in the
+        case where the Frame is 0, but I couldn't find any situations in which
+        we call this function on nodes in inactive documents because the
+        typical way you find a node worth checking security on is via
+        a JavaScript window object.
+
+        * bindings/generic/BindingSecurity.cpp:
+        (WebCore::canAccessDocument):
+        (WebCore::BindingSecurity::shouldAllowAccessToNode):
+        (WebCore::BindingSecurity::allowSettingFrameSrcToJavascriptUrl):
+
+2012-08-04  Adam Barth  <abarth@webkit.org>
+
+        [V8] Re-wire "target" half of the same-origin security check through Document rather than DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=93079
+
+        Reviewed by Eric Seidel.
+
+        Before this patch, we were traversing from Nodes to Frames to
+        DOMWindows to SecurityOrigins when determing the "target" of an
+        operation for the same-origin policy security check. Rather than
+        detouring through DOMWindow, these security checks should operate in
+        terms of ScriptExecutionContexts (aka Documents) because that's the
+        canonical place we store SecurityOrigin objects.
+
+        A future patch will re-wire the "active" part of the security check to
+        use ScriptExecutionContexts as well and we'll be able to remove the
+        extra copy of SecurityOrigin that we keep in DOMWindow.
+
+        * bindings/generic/BindingSecurity.cpp:
+        (WebCore::canAccessDocument):
+        (WebCore::BindingSecurity::canAccessFrame):
+        (WebCore::BindingSecurity::shouldAllowAccessToNode):
+        * bindings/v8/BindingState.cpp:
+        (WebCore::immediatelyReportUnsafeAccessTo):
+        * bindings/v8/BindingState.h:
+        (WebCore):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::reportUnsafeJavaScriptAccess):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::reportUnsafeAccessTo):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+
+2012-08-03  Adam Barth  <abarth@webkit.org>
+
+        Disabling eval changes the timing of DidCreateScriptContext
+        https://bugs.webkit.org/show_bug.cgi?id=92189
+
+        Reviewed by Eric Seidel.
+
+        When we implemented Content-Security-Policy, we added the ability to
+        disable eval in the JavaScript engine. However, when we process the
+        Content-Security-Policy header, we might not have initialized the
+        script context for the given frame.
+
+        Previously, we would initialize the context, but that generates a
+        DidCreateScriptContext callback to the embedder earlier in the Document's
+        lifetime that before. A natural thing to do in this callback is to run
+        script to customize the script context, but Document isn't fully
+        initialized yet, which leads to odd bugs and general confusion.
+
+        In this patch, we delay actually disabling eval until we would have
+        created the scripting context previously. From the perspective of the
+        web platform, this has the same behavior. The only difference is that
+        now the DidCreateScriptContext notification occurs at the same time
+        regardless of whether Content-Security-Policy disables eval.
+
+        I tried to write a test for this change, but it was unclear to me how
+        to write a good test. I tried writing a Chromium WebKit unit test to no
+        avail. The good news is that this patch will be covered by the
+        PlatformAppBrowserTest.Iframes test in Chromium once
+        https://bugs.webkit.org/show_bug.cgi?id=93079 lands. That's not the
+        best way to test this change, but it might be sufficient.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::disableEval):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::enableEval):
+        (WebCore::ScriptController::disableEval):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+
+2012-08-03  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Stop relying on implicit WebFoo <-> WebCore conversion operators in compositor
+        https://bugs.webkit.org/show_bug.cgi?id=93169
+
+        Reviewed by Adrienne Walker.
+
+        This removes the compositor's reliance on implicit conversion operators from Web* types to WebKit-internal
+        types, specifically WebRect <-> WebCore::IntRect and WebString <-> WTF::String.
+
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
+        (WebCore::CanvasLayerTextureUpdater::paintContents):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
+        (WebCore::ScrollbarLayerChromium::update):
+        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
+        (WebCore::CCFontAtlas::drawOneLineOfTextInternal):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounter):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawDebugRects):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        (WebCore::toUVRect):
+        (WebCore::CCScrollbarLayerImpl::appendQuads):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::size):
+
+2012-08-03  Michael Nordman  <michaeln@google.com>
+
+        [Chromium] Cross-thread-copy a couple more recently added ResourceResponse data members, apparently
+        these got missed when they were added. And fix a bug with how the m_remoteIPAddress
+        data member is handled, an isolatedCopy() is needed for thread safety.
+        https://bugs.webkit.org/show_bug.cgi?id=93158
+
+        Reviewed by David Levin.
+
+        No new tests, minor cleanup.
+
+        * platform/network/chromium/ResourceResponse.cpp:
+        (WebCore::ResourceResponse::doPlatformCopyData): make deep copies
+        (WebCore::ResourceResponse::doPlatformAdopt): take ownership of them
+        * platform/network/chromium/ResourceResponse.h:
+        (ResourceResponse):
+        (CrossThreadResourceResponseData):
+
+2012-08-03  Florin Malita  <fmalita@chromium.org>
+
+        [SVG] Tref target event listener cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=93004
+
+        Reviewed by Abhishek Arya.
+
+        Currently SVGTRefElement allocates event listeners dynamically as it attaches to its
+        targets. Synchronizing the lifetime of the target listener vs. the tref element is
+        error prone, as various events can stack and trigger nested handlers.
+
+        In order to reduce complexity and address a couple of outstanding issues, this patch
+        changes the way event listeners are allocated: only one target listener is created
+        for the lifetime of the SVGTRefElement, and gets reused if the target element changes.
+
+        Test: svg/custom/tref-nested-events-crash.svg
+
+        * dom/EventListener.h:
+        Added new <tref> target event listener type.
+        * svg/SVGTRefElement.cpp:
+        (WebCore):
+        (WebCore::SVGTRefTargetEventListener::create):
+        (WebCore::SVGTRefTargetEventListener::cast):
+        (SVGTRefTargetEventListener):
+        (WebCore::SVGTRefTargetEventListener::isAttached):
+        (WebCore::SVGTRefTargetEventListener::SVGTRefTargetEventListener):
+        (WebCore::SVGTRefTargetEventListener::attach):
+        (WebCore::SVGTRefTargetEventListener::detach):
+        (WebCore::SVGTRefTargetEventListener::operator==):
+        (WebCore::SVGTRefTargetEventListener::handleEvent):
+        No need to check m_trefElement anymore - the listener is allocated for the whole element
+        lifetime, detached when the element is removed and deallocated when the element is
+        destroyed.
+        (WebCore::SVGTRefElement::SVGTRefElement):
+        Allocate one target listener per element, at construction time.
+        (WebCore::SVGTRefElement::~SVGTRefElement):
+        Detach the listener if necessary.
+        (WebCore::SVGTRefElement::detachTarget):
+        Check whether the element is still in document after updating the text (may have been
+        removed by event handlers).
+        (WebCore::SVGTRefElement::buildPendingResource):
+        Attach the event listener before updating the text content to avoid racing with event
+        handlers (which can remove the element).
+        (WebCore::SVGTRefElement::removedFrom):
+        * svg/SVGTRefElement.h:
+        (WebCore):
+        (SVGTRefElement):
+
+2012-08-03  Michael Saboff  <msaboff@apple.com>
+
+        Convert HTML parser to handle 8-bit resources without converting to UChar*
+        https://bugs.webkit.org/show_bug.cgi?id=90321
+
+        Reviewed by Adam Barth.
+
+        No new tests, no new functionality therefore covered by existing tests.
+
+        Changed the parsing of HTML to handle 8-bit strings without converting the 
+        whole string to 16-bits.  Primary change was to use the appropriate 
+        character pointer type (LChar* or UChar*) depending on the source string.
+        This access is abstracted in SegmentedSubstring by getCurrentChar{8,16} and
+        incrementAndGetCurrentChar{8,16} methods.  In SegmentedString, the advance()
+        and advanceAndUpdateLineNumber() methods have been refactored into a
+        state machine managed pair of function pointers.  The possible functions
+        have not only the 8 and 16 bitness factored out, they also have the 
+        "exclude line numbers" logic factored out for advanceAndUpdateLineNumber().
+        This change also has improvements over http://trac.webkit.org/changeset/123679.
+        The most prominent change was to inline the 8 bit paths for both advance()
+        and advanceAndUpdateLineNumber().
+        This provides a net speed-up even with the 8/16 bit testing.
+        Other changes involve using String methods to access and compare with the
+        source data.
+
+        * html/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryDocumentParser::append): Changed to use currentChar()
+        instead of SegmentedString '*' operator.
+        * html/parser/HTMLEntityParser.cpp: Changed to use currentChar() instead of
+        SegmentedString '*' operator.
+        * html/parser/HTMLParserIdioms.cpp:
+        (WebCore::stripLeadingAndTrailingHTMLSpaces): Added 8-bit fast path.
+        * html/parser/HTMLSourceTracker.cpp:
+        (WebCore::HTMLSourceTracker::sourceForToken): Changed to use currentChar() instead of
+        SegmentedString '*' operator.
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::script): Updated to use new String::dataSize() method.
+        * platform/text/SegmentedString.cpp:
+        (WebCore::SegmentedString::SegmentedString):
+        (WebCore::SegmentedString::operator=):
+        (WebCore::SegmentedString::clear):
+        (WebCore::SegmentedString::append):
+        (WebCore::SegmentedString::prepend):
+        (WebCore::SegmentedString::advanceSubstring):
+        (WebCore::SegmentedString::advance):
+        (WebCore::SegmentedString::advance8): Fast path advance function for 8 bit data.
+        (WebCore::SegmentedString::advance16): Fast path advance function for 16 bit data.
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber8): Fast path
+        advanceAndUpdateLineNumber for 8 bit data when we need to update the line number.
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber16): Fast path
+        advanceAndUpdateLineNumber for 16 bit data when we need to update the line number.
+        (WebCore::SegmentedString::advanceSlowCase): Slow case advance function for both
+        8 and 16 bit advance.
+        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase): Slow case
+        advanceAndUpdateLineNumber function for both 8 and 16 bit data.
+        (WebCore::SegmentedString::advanceEmpty): Advance function when input has been exhausted.
+        (WebCore::SegmentedString::updateSlowCaseFunctionPointers): Set advance function
+        pointers to slow case functions.
+        * platform/text/SegmentedString.h:
+        (WebCore::SegmentedSubstring::SegmentedSubstring):
+        (WebCore::SegmentedSubstring::clear):
+        (SegmentedSubstring):
+        (WebCore::SegmentedSubstring::is8Bit): New getter.
+        (WebCore::SegmentedSubstring::appendTo):
+        (WebCore::SegmentedSubstring::getCurrentChar8): New getter for the 8 bit case.
+        (WebCore::SegmentedSubstring::getCurrentChar16): New getter for the 16 bit case.
+        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar8): New wrapper functions
+        that pre-increments the 8 bit pointer and returns the next character.
+        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar16): New wrapper functions
+        that pre-increments the 16 bit pointer and returns the next character.
+        (WebCore::SegmentedSubstring::currentSubString):
+        (WebCore::SegmentedSubstring::getCurrentChar):
+        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar):
+        (WebCore::SegmentedString::SegmentedString):
+        (WebCore::SegmentedString::push):
+        (WebCore::SegmentedString::isEmpty):
+        (WebCore::SegmentedString::lookAhead):
+        (WebCore::SegmentedString::lookAheadIgnoringCase):
+        (WebCore::SegmentedString::advance): Wrapper that contains 8 bit fast path
+        or calls via member function point to approriate advance() flavor.
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber): Wrapper that
+        contains 8 bit fast path or calls via member function point to approriate
+        advance() flavor.
+        (WebCore::SegmentedString::advanceAndASSERT):
+        (WebCore::SegmentedString::advanceAndASSERTIgnoringCase):
+        (WebCore::SegmentedString::advancePastNonNewline):
+        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
+        (WebCore::SegmentedString::currentChar):
+        (WebCore::SegmentedString::decrementAndCheckLength): Decrement substring length and
+        change to slow case functions when only one character left.
+        (WebCore::SegmentedString::updateAdvanceFunctionPointers): Select appropriate
+        advance functions based on current substring.
+        (WebCore::SegmentedString::lookAheadInline): Changed to use String::startsWith().
+        (WebCore::SegmentedString::lookAheadSlowCase):
+        * xml/parser/CharacterReferenceParserInlineMethods.h:
+        (WebCore::consumeCharacterReference): Changed to use currentChar() instead of
+        SegmentedString '*' operator.
+        * xml/parser/MarkupTokenizerBase.h:
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::nextInputCharacter):
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek): Changed to use
+        currentChar() instead of SegmentedString '*' operator.
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):
+
+2012-08-03  Arnaud Renevier  <a.renevier@sisa.samsung.com>
+
+        Update TypedArrays to throw RangeError or similar instead of INDEX_SIZE_ERR
+        https://bugs.webkit.org/show_bug.cgi?id=45118
+
+        Reviewed by Kenneth Russell.
+
+        Update TypedArrays to raise JavaScript RangeError instead of dom
+        INDEX_SIZE_ERR exceptions. Also, update TypedArrays to raise TypeError
+        instead of JavaScript SyntaxError or dom exceptions SYNTAX_ERR when
+        calling set method with invalid arguments.
+
+        Specification does not define the type of exceptions to raise, but
+        other browsers raise JavaScript errors, so those changes will improve
+        compatibility.
+
+        New Test: fast/canvas/webgl/array-set-invalid-arguments.html
+
+        Updated Tests expectations:
+            fast/canvas/webgl/array-set-out-of-bounds.html
+            fast/canvas/webgl/data-view-crash.html
+            fast/canvas/webgl/data-view-test.html
+
+        * bindings/js/JSArrayBufferViewHelper.h:
+        (WebCore):
+        (WebCore::setWebGLArrayWithTypedArrayArgument):
+        (WebCore::setWebGLArrayHelper):
+        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
+        (WebCore::constructArrayBufferViewWithArrayBufferArgument):
+        (WebCore::constructArrayBufferView):
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        (WebCore):
+        (WebCore::constructWebGLArrayWithArrayBufferArgument):
+        (WebCore::setWebGLArrayHelper):
+
+2012-08-03  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Fix Renderer4.CompositorThreadImplDrawDelay histogram.
+        https://bugs.webkit.org/show_bug.cgi?id=93159
+
+        Reviewed by Adrienne Walker.
+
+        The histogram is using the frame number instead of the frame time by mistake.
+
+        * platform/graphics/chromium/cc/CCFrameRateCounter.cpp:
+        (WebCore::CCFrameRateCounter::markBeginningOfFrame):
+
+2012-08-03  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Core upgradeneeded logic
+        https://bugs.webkit.org/show_bug.cgi?id=92558
+
+        Reviewed by Ojan Vafai.
+
+        This is the backend webkit logic needed for integer versions. The rest
+        is in https://bugs.webkit.org/show_bug.cgi?id=89505.
+
+        I tried to make use of the existing processPendingCalls and added two
+        more queues, pendingOpenWithVersionCalls and
+        pendingSecondHalfOpenWithVersionCalls. The "second half" refers to
+        how there are two events that need to be fired in response to an
+        open-with-version call. The "second half" queue holds the open
+        requests that should immediately follow the caller's upgradeneeded
+        handler.
+
+        No new tests, there are so many they are in their own patch:
+        https://bugs.webkit.org/show_bug.cgi?id=92560
+
+        Though this patch doesn't change any expected behavior anyway, lack of
+        regressions is what we're hoping for here.
+
+        * Modules/indexeddb/IDBBackingStore.h:
+        (IDBBackingStore):
+        * Modules/indexeddb/IDBCallbacks.h:
+        (WebCore::IDBCallbacks::onBlocked):
+        (WebCore::IDBCallbacks::onUpgradeNeeded):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (IDBDatabaseBackendImpl::PendingOpenCall):
+        (IDBDatabaseBackendImpl::PendingOpenWithVersionCall):
+        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::create):
+        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::callbacks):
+        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::version):
+        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::PendingOpenWithVersionCall):
+        (WebCore):
+        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
+        (WebCore::IDBDatabaseBackendImpl::openInternal):
+        (WebCore::IDBDatabaseBackendImpl::metadata):
+        (WebCore::IDBDatabaseBackendImpl::setVersion):
+        (WebCore::IDBDatabaseBackendImpl::setIntVersionInternal):
+        (WebCore::IDBDatabaseBackendImpl::transactionFinished):
+        (WebCore::IDBDatabaseBackendImpl::transactionFinishedAndEventsFired):
+        When an upgradeneeded event is fired in response to an
+        open-with-version call, the version change transaction must receive its
+        complete event before processPendingCalls fires a success event at
+        IDBOpenDBRequest. In the future this should probably be changed
+        instead to transactionFinishedAndAbortFired and
+        transactionFinishedAndCompleteFired so that we'll know to fire a
+        success or error event at IDBOpenDBRequest. Currently, instead of
+        firing error when there's an abort, we don't fire anything.
+
+        (WebCore::IDBDatabaseBackendImpl::processPendingCalls):
+        Now that this is called after a connection is opened, we unfortunately
+        lose the invariant that there is only one existing connection when this
+        is called, but nothing inside this function actually relied on that.
+        Additionally, the secondHalfOpen calls only ever need to be serviced
+        in one place: right after a version change transaction completes, so
+        it could be moved out of here.
+
+        (WebCore::IDBDatabaseBackendImpl::registerFrontendCallbacks):
+        Now that setVersion and deleteDatabase calls are queued up behind
+        secondHalfOpen calls, we have to service those queues when
+        secondHalfOpen calls complete, which is here.  So call
+        processPendingCalls().
+
+        (WebCore::IDBDatabaseBackendImpl::runIntVersionChangeTransaction):
+        (WebCore::IDBDatabaseBackendImpl::openConnectionWithVersion):
+        (WebCore::IDBDatabaseBackendImpl::deleteDatabase):
+        (WebCore::IDBDatabaseBackendImpl::close):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBDatabaseCallbacks.h:
+        (WebCore::IDBDatabaseCallbacks::onVersionChange):
+        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::open):
+        This is refactored some so that the call to openConection{WithVersion}
+        happens once, at the end.
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::updateIDBDatabaseIntVersion):
+        (WebCore):
+        (WebCore::IDBLevelDBBackingStore::deleteDatabase):
+        * Modules/indexeddb/IDBLevelDBBackingStore.h:
+        (IDBLevelDBBackingStore):
+        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::commit):
+        See above comments about transactionFinishedAndEventsFired. I tried
+        moving the call to transactionFinished after the events were fired but
+        that failed some asserts. But changing those asserts is still an
+        alternative to splitting up transactionFinished as is done here.
+
+2012-08-03  Rick Byers  <rbyers@chromium.org>
+
+        Double tap gesture should send dblclick event
+        https://bugs.webkit.org/show_bug.cgi?id=92412
+
+        Reviewed by Adam Barth.
+
+        Propagate the tap count from PlatformGestureEvent in the derived mouse
+        events.
+
+        Also fixes a crash with unexpected GestureDoubleTap events by just
+        supressing them early.  They will probably be removed soon anyway.
+
+        Test: fast/events/touch/gesture/gesture-dblclick.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        (WebCore::EventHandler::handleGestureTap):
+
+2012-08-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124668.
+        http://trac.webkit.org/changeset/124668
+        https://bugs.webkit.org/show_bug.cgi?id=93167
+
+        Broke Mac build (Requested by kbr_google on #webkit).
+
+        * bindings/js/JSArrayBufferViewHelper.h:
+        (WebCore::setWebGLArrayWithTypedArrayArgument):
+        (WebCore::setWebGLArrayHelper):
+        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
+        (WebCore::constructArrayBufferViewWithArrayBufferArgument):
+        (WebCore::constructArrayBufferView):
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        (WebCore::constructWebGLArrayWithArrayBufferArgument):
+        (WebCore):
+        (WebCore::constructWebGLArray):
+        (WebCore::setWebGLArrayHelper):
+
+2012-08-03  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Implement computePreferredLogicalWidths on RenderGrid
+        https://bugs.webkit.org/show_bug.cgi?id=92908
+
+        Reviewed by Ojan Vafai.
+
+        This functions implements a primitive computePreferredLogicalWidths
+        so that we properly handle vertical writing modes.
+
+        Covered by fast/css-grid-layout/place-cell-by-index.html.
+
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::computePreferredLogicalWidths):
+        * rendering/RenderGrid.h:
+        Added computePreferredLogicalWidths.
+
+2012-08-03  Arnaud Renevier  <a.renevier@sisa.samsung.com>
+
+        Update TypedArrays to throw RangeError or similar instead of INDEX_SIZE_ERR
+        https://bugs.webkit.org/show_bug.cgi?id=45118
+
+        Reviewed by Kenneth Russell.
+
+        Update TypedArrays to raise JavaScript RangeError instead of dom
+        INDEX_SIZE_ERR exceptions. Also, update TypedArrays to raise TypeError
+        instead of JavaScript SyntaxError or dom exceptions SYNTAX_ERR when
+        calling set method with invalid arguments.
+
+        Specification does not define the type of exceptions to raise, but
+        other browsers raise JavaScript errors, so those changes will improve
+        compatibility.
+
+        New Test: fast/canvas/webgl/array-set-invalid-arguments.html
+
+        Updated Tests expectations:
+            fast/canvas/webgl/array-set-out-of-bounds.html
+            fast/canvas/webgl/data-view-crash.html
+            fast/canvas/webgl/data-view-test.html
+
+        * bindings/js/JSArrayBufferViewHelper.h:
+        (WebCore):
+        (WebCore::setWebGLArrayWithTypedArrayArgument):
+        (WebCore::setWebGLArrayHelper):
+        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
+        (WebCore::constructArrayBufferViewWithArrayBufferArgument):
+        (WebCore::constructArrayBufferView):
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        (WebCore):
+        (WebCore::constructWebGLArrayWithArrayBufferArgument):
+        (WebCore::setWebGLArrayHelper):
+
+2012-08-03  Levi Weintraub  <leviw@chromium.org>
+
+        Switch mapLocalToContainer to use a flag instead of boolean parameters
+        https://bugs.webkit.org/show_bug.cgi?id=92927
+
+        Reviewed by Dirk Schulze.
+
+        Changing mapLocalToContainer to use a uint flag to set the mode of operation. This removes
+        simplifies the contract, removes boolean arguments and paves the way for an additional mode
+        for sub-pixel layout support. See https://bugs.webkit.org/show_bug.cgi?id=89238 for the
+        sub-pixel use case. Other than the new MapLocalToContainerMode enum and MapLocalToContainerFlags
+        typedef, this change is purely mechanical.
+
+        No new tests as this doesn't change current behavior.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        * rendering/RenderGeometryMap.cpp:
+        (WebCore::RenderGeometryMap::mapToAbsolute):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::mapLocalToContainer):
+        * rendering/RenderInline.h:
+        (RenderInline):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::mapLocalToContainer):
+        (WebCore::RenderObject::localToContainerQuad):
+        (WebCore::RenderObject::localToContainerPoint):
+        * rendering/RenderObject.h:
+        (RenderObject): Adding the MapLocalToContainerMode enum and MapLocalToContainerFlags unsigned
+        int, and removing the old ApplyContainerFlipOrNot enum.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::mapLocalToContainer):
+        * rendering/RenderView.h:
+        (RenderView):
+        * rendering/svg/RenderSVGForeignObject.cpp:
+        (WebCore::RenderSVGForeignObject::mapLocalToContainer):
+        * rendering/svg/RenderSVGForeignObject.h:
+        (RenderSVGForeignObject):
+        * rendering/svg/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::mapLocalToContainer):
+        * rendering/svg/RenderSVGInline.h:
+        (RenderSVGInline):
+        * rendering/svg/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::mapLocalToContainer):
+        * rendering/svg/RenderSVGModelObject.h:
+        (RenderSVGModelObject):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/svg/RenderSVGRoot.h:
+        (RenderSVGRoot):
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::mapLocalToContainer):
+        * rendering/svg/RenderSVGText.h:
+        (RenderSVGText):
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::mapLocalToContainer):
+
+2012-08-03  Emil A Eklund  <eae@chromium.org>
+
+        Remove dependency on LayoutTypes.h from transformation code
+        https://bugs.webkit.org/show_bug.cgi?id=93037
+
+        Reviewed by Levi Weintraub.
+
+        TransformationMatrix and HitTestingTransformState includes LayoutTypes.h
+        which is in rendering. This is a layering violation.
+        Remove this dependency as it is no longer needed.
+
+        No new tests, no change in functionality.
+
+        * rendering/LayoutTypes.h:
+        Remove clampToLayoutUnit
+        
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::clamp):
+        Add FractionalLayoutUnit::clamp method that clamps a double to a FractionalLayoutUnit.
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::clampEdgeValue):
+        (WebCore::TransformationMatrix::clampedBoundsOfProjectedQuad):
+        Use clamp/max/min from FractionalLayoutUnit instead of going through LayoutUnit abstraction.
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * rendering/HitTestingTransformState.cpp:
+        * rendering/HitTestingTransformState.h:
+        Replace use of LayoutRect with FractionalLayoutRect as LayoutRect maps to FractionalLayoutRect on all platforms.
+
+2012-08-03  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/12005188> REGRESSION (Safari 5.1 - 6): Cannot correctly display Traditional Mongolian Script
+        https://bugs.webkit.org/show_bug.cgi?id=92864
+
+        Reviewed by Sam Weinig.
+
+        Test: platform/mac/fast/text/combining-character-sequence-vertical.html
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::glyphForCharacter): Added this helper function.
+        * platform/graphics/SimpleFontData.h:
+        (SimpleFontData): Declared glyphDataForCharacter.
+        * platform/graphics/mac/FontComplexTextMac.cpp:
+        (WebCore::Font::fontDataForCombiningCharacterSequence): Added logic to use the appropriate
+        variant of each font in the fallback list, which mimcs the equivalent logic in
+        glyphDataAndPageForCharacter().
+
+2012-08-03  Kenneth Russell  <kbr@google.com>
+
+        [Chromium] Web Inspector: Win Dbg tests timing out (r123556 or r123560?)
+        https://bugs.webkit.org/show_bug.cgi?id=92570
+
+        Reviewed by Pavel Feldman.
+
+        Try restricting the use of the GC hint for canvas contexts to only
+        WebGL contexts, where it is most needed, to see whether this
+        clears up the timeouts.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+
+2012-08-02  Jeffrey Pfau  <jpfau@apple.com>
+
+        Add API for enabling blanket third-party data blocking
+        https://bugs.webkit.org/show_bug.cgi?id=93022
+
+        Reviewed by Anders Carlsson.
+
+        Added API for enabling third-party storage blocking.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setThirdPartyStorageBlockingEnabled):
+        (WebCore::Settings::thirdPartyStorageBlockingEnabled):
+        (Settings):
+
+2012-08-03  Anna Cavender  <annacc@chromium.org>
+
+        Negative timestamps for TextTrackCues should not be allowed.
+        https://bugs.webkit.org/show_bug.cgi?id=92939
+
+        Reviewed by Eric Carlson.
+
+        Make sure cues added in JavaScript are not allowed negative timestamps.
+        Attempting to add a cue with a negative timestamp is not successful
+        and setting a timestamp to a negative value has no effect.
+
+        Test: media/track/track-cue-negative-timestamp.html
+
+        * html/track/TextTrack.cpp:
+        (WebCore::TextTrack::addCue): If the cue's startTime or endTime is 
+            negative, do not add the cue.
+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCue::setStartTime): Ignore negative values.
+        (WebCore::TextTrackCue::setEndTime): Ignore negative values.
+        * html/track/TextTrackCueList.cpp:
+        (WebCore::TextTrackCueList::add): Add ASSERTs to check startTime and
+            endTime are positive.
+
+2012-08-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124594.
+        http://trac.webkit.org/changeset/124594
+        https://bugs.webkit.org/show_bug.cgi?id=93152
+
+        Broke PlatformAppBrowserTest.Iframes browser_test on Chromium
+        bots (Requested by dimich on #webkit).
+
+        * bindings/generic/BindingSecurity.cpp:
+        (WebCore::canAccess):
+        (WebCore::BindingSecurity::canAccessFrame):
+        (WebCore::BindingSecurity::shouldAllowAccessToNode):
+        * bindings/v8/BindingState.cpp:
+        (WebCore::immediatelyReportUnsafeAccessTo):
+        * bindings/v8/BindingState.h:
+        (WebCore):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::reportUnsafeJavaScriptAccess):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::reportUnsafeAccessTo):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+
+2012-08-03  Terry Anderson  <tdanderson@chromium.org>
+
+        Apply target fuzzing when sending a context menu event
+        https://bugs.webkit.org/show_bug.cgi?id=92914
+
+        Reviewed by Antonio Gomes.
+
+        If TOUCH_ADJUSTMENT is enabled, use bestClickableNodeForTouchPoint to possibly
+        adjust the location of a context menu event. This change uses the same set of
+        candidates for touch adjustment as is used for a GestureTap event (which
+        admittedly is a simplifying assumption).
+
+        Test: touchadjustment/touch-links-longpress.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureTap):
+        Some code moved to the new function adjustGesturePosition.
+        (WebCore):
+        (WebCore::EventHandler::adjustGesturePosition):
+        Added this function to avoid repeated code in handleGestureTap and
+        sendContextMenuEventForGesture.
+        (WebCore::EventHandler::sendContextMenuEventForGesture):
+        Try to adjust the location of |mouseEvent| to correspond to the most
+        probable gesture target. If no such target exists, the location of
+        |mouseEvent| is unchanged.
+        * page/EventHandler.h:
+        (EventHandler):
+
+2012-08-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124475 and r124496.
+        http://trac.webkit.org/changeset/124475
+        http://trac.webkit.org/changeset/124496
+        https://bugs.webkit.org/show_bug.cgi?id=93151
+
+        Causing assertion failures in table-section-node-at-point-
+        crash.html (Requested by inferno-sec on #webkit).
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paint):
+
+2012-08-03  Jan Keromnes  <janx@linux.com>
+
+        Web Inspector: Create and interface for TextEditor
+        https://bugs.webkit.org/show_bug.cgi?id=93126
+
+        Reviewed by Pavel Feldman.
+
+        For more extensibility, TextEditor needs to be an interface that other
+        classes can implement, e.g. the new class DefaultTextEditor.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.set mimeType):
+        (WebInspector.TextEditor.prototype.setReadOnly):
+        (WebInspector.TextEditor.prototype.readOnly):
+        (WebInspector.TextEditor.prototype.defaultFocusedElement):
+        (WebInspector.TextEditor.prototype.revealLine):
+        (WebInspector.TextEditor.prototype.addDecoration):
+        (WebInspector.TextEditor.prototype.removeDecoration):
+        (WebInspector.TextEditor.prototype.markAndRevealRange):
+        (WebInspector.TextEditor.prototype.highlightLine):
+        (WebInspector.TextEditor.prototype.clearLineHighlight):
+        (WebInspector.TextEditor.prototype.freeCachedElements):
+        (WebInspector.TextEditor.prototype.elementsToRestoreScrollPositionsFor):
+        (WebInspector.TextEditor.prototype.inheritScrollPositions):
+        (WebInspector.TextEditor.prototype.beginUpdates):
+        (WebInspector.TextEditor.prototype.endUpdates):
+        (WebInspector.TextEditor.prototype.onResize):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype.editRange):
+        (WebInspector.TextEditor.prototype.scrollToLine):
+        (WebInspector.TextEditor.prototype.selection):
+        (WebInspector.TextEditor.prototype.lastSelection):
+        (WebInspector.TextEditor.prototype.setSelection):
+        (WebInspector.TextEditor.prototype.setText):
+        (WebInspector.TextEditor.prototype.text):
+        (WebInspector.TextEditor.prototype.range):
+        (WebInspector.TextEditor.prototype.line):
+        (WebInspector.TextEditor.prototype.get linesCount):
+        (WebInspector.TextEditor.prototype.setAttribute):
+        (WebInspector.TextEditor.prototype.getAttribute):
+        (WebInspector.TextEditor.prototype.removeAttribute):
+        (WebInspector.TextEditor.prototype.wasShown):
+        (WebInspector.TextEditor.prototype._handleFocused):
+        (WebInspector.TextEditor.prototype.willHide):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-08-03  Mike West  <mkwst@chromium.org>
+
+        Blocking a plugin via CSP should result in one (and only one) console message.
+        https://bugs.webkit.org/show_bug.cgi?id=92649
+
+        Reviewed by Adam Barth.
+
+        Currently, blocking a plugin via Content Security Policy results in some
+        leakage of console log messages between tests. I'm unclear as to the
+        root cause, but the symptoms exhibited include
+        `SubframeLoader::requestPlugin` being called multiple times for a single
+        element, which in turn causes multiple console logs to be sent. These
+        messages tend to appear in the subsequent test, making the
+        `http/test/security/contentSecurityPolicy/object-src-*` set of tests
+        flakey indeed.
+
+        This patch addresses the issue by marking elements' plugins as
+        unavailable when they're blocked by CSP. No new tests have been added:
+        this patch should simply make the current tests actually pass.
+
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::requestPlugin):
+            We check the CSP status in `SubframeLoader::loadPlugin`, which is
+            called at the end of this function. Checking CSP status in both
+            locations is redundant.
+        (WebCore::SubframeLoader::loadPlugin):
+            If the plugin is blocked by CSP, tell the element's embedded object
+            renderer that the plugin is unavailable.
+        * platform/LocalizedStrings.cpp:
+        (WebCore::blockedPluginByContentSecurityPolicyText):
+        (WebCore):
+        * platform/LocalizedStrings.h:
+        (WebCore):
+        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
+        (WebCore::blockedPluginByContentSecurityPolicyText):
+        (WebCore):
+        * platform/efl/LocalizedStringsEfl.cpp:
+        (WebCore::blockedPluginByContentSecurityPolicyText):
+        (WebCore):
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::blockedPluginByContentSecurityPolicyText):
+        (WebCore):
+        * platform/qt/LocalizedStringsQt.cpp:
+        (WebCore::blockedPluginByContentSecurityPolicyText):
+        (WebCore):
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::unavailablePluginReplacementText):
+        * rendering/RenderEmbeddedObject.h:
+            Return appropriate text when the plugin is blocked by CSP.
+
+2012-08-03  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Add an IsExecutionTerminating() check to setDOMException()
+        https://bugs.webkit.org/show_bug.cgi?id=93101
+
+        Reviewed by Adam Barth.
+
+        In preparation for moving exception related code from V8Proxy to V8Binding,
+        I am going to remove throwError(ExceptionCode, v8::Isolate*) from V8Proxy.
+        throwError(ExceptionCode, v8::Isolate*) will be replaced with
+        setDOMException(ExceptionCode, v8::Isolate*). By this refactoring,
+        the way to throw JavaScript errors and DOM exceptions becomes simple:
+        "Throw JavaScript errors by throwError(). Throw DOM exceptions by setDOMException()".
+        (Currently some DOM exceptions are being thrown by throwError().)
+
+        To keep the current behavior of throwError(ExceptionCode, v8::Isolate*),
+        before the replacement, we need to insert the IsExecutionTerminating()
+        check to setDOMException(). This will add an extra check to the current
+        setDOMException(), but I don't think it's a problem.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
+
+2012-08-03  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Avoid dispatching gesture events of unknown types
+        https://bugs.webkit.org/show_bug.cgi?id=93060
+
+        Reviewed by Adam Barth.
+
+        WebCore gesture events do not always correspond 1-to-1 to the Platform gesture events. So
+        avoid dispatching the unknown gesture events to nodes.
+
+        * dom/GestureEvent.cpp:
+        (WebCore::GestureEvent::create):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGestureEvent):
+
+2012-08-03  Stephen Chenney  <schenney@chromium.org>
+
+        Crash when a clip path referencing a clip path changes documents
+        https://bugs.webkit.org/show_bug.cgi?id=93023
+
+        Reviewed by Dirk Schulze.
+
+        The SVGClipPathElement is set to not need pending resource handling,
+        when in fact it can have pending resources. The result is a crash when
+        the element is moved to a new document (which deletes all resources
+        and leaves them pending) and then immediately deleted (which asserts
+        that there are no pending resources). There is code to remove pending
+        resources upon deletion and removal from the DOM, but it was not
+        executing for clips because of the aforementioned code claiming that
+        clips don't require such handling.
+
+        The assertion that there be no pending resources is necessary to
+        prevent caches of pending resources from trying to access the deleted
+        element.
+
+        This change removes the check for needsPendingResourceHandling in
+        SVGStyledElement upon deletion and removal from the DOM. Pending resources
+        will always be checked in such cases to ensure we do not introduce
+        security issues.
+
+        Test: svg/custom/clip-path-document-change-assert.html
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::~SVGStyledElement): Removed needsPendingResourceHandling in the conditional to clean up resources.
+        (WebCore::SVGStyledElement::removedFrom): Removed needsPendingResourceHandling in the conditional to clean up resources.
+
+2012-08-03  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove unused methods in V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=93106
+
+        Reviewed by Adam Barth.
+
+        In preparation for removing V8Proxy, we can remove unused methods in V8Proxy.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+
+2012-08-03  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Implement v8Undefined()
+        https://bugs.webkit.org/show_bug.cgi?id=93093
+
+        Reviewed by Adam Barth.
+
+        There are a couple of equivalent ways to create an undefined value,
+        e.g. v8::Undefined(), v8::Undefined(isolate), v8::Handle<v8::Value>(), etc.
+        We should implement v8Undefined() and use it everywhere.
+
+        In this bug, we implement v8Undefined() and use it in CodeGeneratorV8.pm.
+        We can implement v8Undefined() like this:
+
+            v8::Handle<v8::Value> v8Undefined() { v8::Handle<v8::Value>(); }
+
+        This is based on the following performance results:
+
+        // 14.5 ns
+        v8::Handle<v8::Value> xxxAttrGetter(..., info) {
+            return v8::Undefined();
+        }
+
+        // 8.24 ns (This cannot be used where isolate can be 0.)
+        v8::Handle<v8::Value> xxxAttrGetter(..., info) {
+            return v8::Undefined(info.GetIsolate());
+        }
+
+        // 8.54 ns
+        v8::Handle<v8::Value> xxxAttrGetter(..., info) {
+            v8::Isolate* isolate = info.GetIsolate();
+            return isolate ? v8::Handle<v8::Value>(v8::Undefined(isolate)) : v8::Handle<v8::Value>();
+        }
+
+        // 8.52 ns
+        v8::Handle<v8::Value> xxxAttrGetter(..., info) {
+            return v8::Handle<v8::Value>();
+        }
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateConstructorGetter):
+        (GenerateNormalAttrGetter):
+        (GenerateNewFunctionTemplate):
+        (GenerateEventListenerCallback):
+        (GenerateFunctionCallback):
+        (GenerateCallWith):
+        (GenerateParametersCheck):
+        (GenerateEventConstructorCallback):
+        (GenerateNonStandardFunction):
+        (GenerateImplementation):
+        (NativeToJSValue):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore::ConfigureV8Float64ArrayTemplate):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::TestActiveDOMObjectV8Internal::excitingFunctionCallback):
+        (WebCore::TestActiveDOMObjectV8Internal::postMessageCallback):
+        (WebCore::TestActiveDOMObjectV8Internal::postMessageAttrGetter):
+        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):
+        (WebCore::V8TestActiveDOMObject::wrapSlow):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore::TestCustomNamedGetterV8Internal::anotherFunctionCallback):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore::V8TestEventConstructor::constructorCallback):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore::TestEventTargetV8Internal::addEventListenerCallback):
+        (WebCore::TestEventTargetV8Internal::removeEventListenerCallback):
+        (WebCore::ConfigureV8TestEventTargetTemplate):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::TestInterfaceV8Internal::supplementalMethod1Callback):
+        (WebCore::TestInterfaceV8Internal::supplementalMethod2Callback):
+        (WebCore::TestInterfaceV8Internal::supplementalMethod4Callback):
+        (WebCore::ConfigureV8TestInterfaceTemplate):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore::TestMediaQueryListListenerV8Internal::methodCallback):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::readOnlyTestObjAttrAttrGetter):
+        (WebCore::TestObjV8Internal::withScriptStateAttributeAttrGetter):
+        (WebCore::TestObjV8Internal::withScriptExecutionContextAttributeAttrGetter):
+        (WebCore::TestObjV8Internal::withScriptStateAttributeRaisesAttrGetter):
+        (WebCore::TestObjV8Internal::withScriptExecutionContextAttributeRaisesAttrGetter):
+        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeAttrGetter):
+        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrGetter):
+        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrGetter):
+        (WebCore::TestObjV8Internal::withScriptArgumentsAndCallStackAttributeAttrGetter):
+        (WebCore::TestObjV8Internal::withScriptArgumentsAndCallStackAttributeAttrSetter):
+        (WebCore::TestObjV8Internal::cachedAttribute1AttrGetter):
+        (WebCore::TestObjV8Internal::cachedAttribute2AttrGetter):
+        (WebCore::TestObjV8Internal::TestObjConstructorGetter):
+        (WebCore::TestObjV8Internal::voidMethodCallback):
+        (WebCore::TestObjV8Internal::voidMethodWithArgsCallback):
+        (WebCore::TestObjV8Internal::methodWithSequenceArgCallback):
+        (WebCore::TestObjV8Internal::serializedValueCallback):
+        (WebCore::TestObjV8Internal::idbKeyCallback):
+        (WebCore::TestObjV8Internal::optionsObjectCallback):
+        (WebCore::TestObjV8Internal::methodWithExceptionCallback):
+        (WebCore::TestObjV8Internal::addEventListenerCallback):
+        (WebCore::TestObjV8Internal::removeEventListenerCallback):
+        (WebCore::TestObjV8Internal::withScriptStateVoidCallback):
+        (WebCore::TestObjV8Internal::withScriptStateVoidExceptionCallback):
+        (WebCore::TestObjV8Internal::withScriptExecutionContextCallback):
+        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateCallback):
+        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateObjExceptionCallback):
+        (WebCore::TestObjV8Internal::withScriptExecutionContextAndScriptStateWithSpacesCallback):
+        (WebCore::TestObjV8Internal::withScriptArgumentsAndCallStackCallback):
+        (WebCore::TestObjV8Internal::methodWithOptionalArgCallback):
+        (WebCore::TestObjV8Internal::methodWithNonOptionalArgAndOptionalArgCallback):
+        (WebCore::TestObjV8Internal::methodWithNonOptionalArgAndTwoOptionalArgsCallback):
+        (WebCore::TestObjV8Internal::methodWithOptionalStringCallback):
+        (WebCore::TestObjV8Internal::methodWithOptionalStringIsUndefinedCallback):
+        (WebCore::TestObjV8Internal::methodWithOptionalStringIsNullStringCallback):
+        (WebCore::TestObjV8Internal::methodWithCallbackArgCallback):
+        (WebCore::TestObjV8Internal::methodWithNonCallbackArgAndCallbackArgCallback):
+        (WebCore::TestObjV8Internal::methodWithCallbackAndOptionalArgCallback):
+        (WebCore::TestObjV8Internal::conditionalMethod2Callback):
+        (WebCore::TestObjV8Internal::conditionalMethod3Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod1Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod2Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod3Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod4Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod5Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod6Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod7Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod8Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod9Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod10Callback):
+        (WebCore::TestObjV8Internal::classMethodCallback):
+        (WebCore::TestObjV8Internal::overloadedMethod11Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod12Callback):
+        (WebCore::TestObjV8Internal::classMethodWithClampCallback):
+        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod1Callback):
+        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod2Callback):
+        (WebCore::TestObjV8Internal::enabledPerContextMethod1Callback):
+        (WebCore::TestObjV8Internal::enabledPerContextMethod2Callback):
+        (WebCore::TestObjV8Internal::convert1Callback):
+        (WebCore::TestObjV8Internal::convert2Callback):
+        (WebCore::TestObjV8Internal::convert3Callback):
+        (WebCore::TestObjV8Internal::convert4Callback):
+        (WebCore::TestObjV8Internal::convert5Callback):
+        (WebCore::TestObjV8Internal::orangeCallback):
+        (WebCore::ConfigureV8TestObjTemplate):
+        (WebCore::V8TestObj::installPerContextProperties):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::acceptTransferListCallback):
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::multiTransferListCallback):
+        (WebCore::V8TestSerializedScriptValueInterface::constructorCallback):
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8Undefined):
+        (WebCore):
+
+2012-08-03  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove v8StringToWebCoreString()
+        https://bugs.webkit.org/show_bug.cgi?id=93087
+
+        Reviewed by Adam Barth.
+
+        There should be only one API that converts V8 String
+        to WebCore String. v8ValueToWebCoreString() does it.
+        We can remove v8StringToWebCoreString().
+
+        No tests. No change in behavior.
+
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToWebCoreString):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+
+2012-07-20  Jon Lee  <jonlee@apple.com>
+
+        Crash in Notification when setting a non-object as an event listener (91881)
+        https://bugs.webkit.org/show_bug.cgi?id=91881
+        <rdar://problem/11923341>
+
+        Reviewed by Oliver Hunt.
+
+        Check to make sure that the value being retrieved is an object. This is similar
+        to the isObject() check done in the bindings code.
+
+        Test: fast/notifications/notifications-event-listener-crash.html
+
+        * bindings/js/Dictionary.h:
+        (WebCore::Dictionary::getEventListener):
+
+2012-08-03  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove v8StringToAtomicWebCoreString()
+        https://bugs.webkit.org/show_bug.cgi?id=93086
+
+        Reviewed by Dimitri Glazkov.
+
+        There should be only one API that converts V8 String to
+        AtomicString. v8ValueToAtomicWebCoreString() does it.
+        We can remove v8StringToAtomicWebCoreString().
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToAtomicWebCoreString):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::getter):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::V8HTMLAllCollection::namedPropertyGetter):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::V8HTMLCollection::namedPropertyGetter):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::V8HTMLFormElement::namedPropertyGetter):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        (WebCore::V8HTMLFrameSetElement::namedPropertyGetter):
+
+2012-08-03  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: eliminate visitBaseClass method from NMI. It introduces unnecessary complexity.
+        https://bugs.webkit.org/show_bug.cgi?id=93129
+
+        Reviewed by Yury Semikhatsky.
+
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::StyleRuleCSSStyleDeclaration::reportMemoryUsage):
+        (WebCore::InlineCSSStyleDeclaration::reportMemoryUsage):
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::reportMemoryUsage):
+        * dom/ContainerNode.h:
+        (WebCore::ContainerNode::reportMemoryUsage):
+        * dom/Document.cpp:
+        (WebCore::Document::reportMemoryUsage):
+        * dom/Element.h:
+        (WebCore::Element::reportMemoryUsage):
+        * dom/MemoryInstrumentation.h:
+        * dom/Node.cpp:
+        (WebCore::Node::reportMemoryUsage):
+
+2012-08-03  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Move ubercomp quads back into CC
+        https://bugs.webkit.org/show_bug.cgi?id=93062
+
+        Reviewed by James Robinson.
+
+        Because GTFO is almost done, we can move back the quad types
+        to CC and pickle them there.  This patch moves everything back
+        to where it was before and changes types like WebRect to IntRect.
+
+        As a bonus, I also added CCRenderPassDrawQuad and CCYUVVideoDrawQuad
+        (which had been left in the CC files) to CCDrawQuad::size(), so now
+        every quad type is ready for serialization.
+
+        No new tests (no-op refactoring).
+
+        * WebCore.gypi:
+        * platform/chromium/support/WebCompositorStreamVideoQuad.cpp: Removed.
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawQuad):
+        * platform/graphics/chromium/cc/CCCheckerboardDrawQuad.cpp: Copied from Source/WebCore/platform/graphics/chromium/cc/CCQuadSink.h.
+        (WebCore):
+        (WebCore::CCCheckerboardDrawQuad::create):
+        (WebCore::CCCheckerboardDrawQuad::CCCheckerboardDrawQuad):
+        (WebCore::CCCheckerboardDrawQuad::materialCast):
+        * platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h:
+        (WebCore):
+        (CCCheckerboardDrawQuad):
+        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorDebugBorderQuad.cpp.
+        (WebCore):
+        (WebCore::CCDebugBorderDrawQuad::create):
+        (WebCore::CCDebugBorderDrawQuad::CCDebugBorderDrawQuad):
+        (WebCore::CCDebugBorderDrawQuad::materialCast):
+        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h:
+        (WebCore):
+        (CCDebugBorderDrawQuad):
+        (WebCore::CCDebugBorderDrawQuad::color):
+        (WebCore::CCDebugBorderDrawQuad::width):
+        * platform/graphics/chromium/cc/CCDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorQuad.cpp.
+        (WebCore):
+        (WebCore::CCDrawQuad::CCDrawQuad):
+        (WebCore::CCDrawQuad::opaqueRect):
+        (WebCore::CCDrawQuad::setQuadVisibleRect):
+        (WebCore::CCDrawQuad::size):
+        (WebCore::CCDrawQuad::setSharedQuadState):
+        * platform/graphics/chromium/cc/CCDrawQuad.h:
+        (WebCore):
+        (CCDrawQuad):
+        (WebCore::CCDrawQuad::quadRect):
+        (WebCore::CCDrawQuad::quadTransform):
+        (WebCore::CCDrawQuad::visibleContentRect):
+        (WebCore::CCDrawQuad::scissorRect):
+        (WebCore::CCDrawQuad::opacity):
+        (WebCore::CCDrawQuad::needsBlending):
+        (WebCore::CCDrawQuad::isLayerAxisAlignedIntRect):
+        (WebCore::CCDrawQuad::quadVisibleRect):
+        (WebCore::CCDrawQuad::isDebugQuad):
+        (WebCore::CCDrawQuad::material):
+        (WebCore::CCDrawQuad::sharedQuadState):
+        (WebCore::CCDrawQuad::sharedQuadStateId):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
+        (WebCore::CCHeadsUpDisplayLayerImpl::appendQuads):
+        * platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorIOSurfaceQuad.cpp.
+        (WebCore):
+        (WebCore::CCIOSurfaceDrawQuad::create):
+        (WebCore::CCIOSurfaceDrawQuad::CCIOSurfaceDrawQuad):
+        (WebCore::CCIOSurfaceDrawQuad::materialCast):
+        * platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h:
+        (WebCore):
+        (CCIOSurfaceDrawQuad):
+        (WebCore::CCIOSurfaceDrawQuad::ioSurfaceSize):
+        (WebCore::CCIOSurfaceDrawQuad::ioSurfaceTextureId):
+        (WebCore::CCIOSurfaceDrawQuad::orientation):
+        * platform/graphics/chromium/cc/CCQuadCuller.h:
+        (CCQuadCuller):
+        * platform/graphics/chromium/cc/CCQuadSink.h:
+        (WebCore):
+        (CCQuadSink):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
+        (WebCore::CCRenderPassDrawQuad::create):
+        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
+        (WebCore::CCRenderPassDrawQuad::materialCast):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
+        (CCRenderPassDrawQuad):
+        * platform/graphics/chromium/cc/CCSharedQuadState.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorSharedQuadState.cpp.
+        (WebCore):
+        (WebCore::CCSharedQuadState::CCSharedQuadState):
+        (WebCore::CCSharedQuadState::create):
+        (WebCore::CCSharedQuadState::isLayerAxisAlignedIntRect):
+        * platform/graphics/chromium/cc/CCSharedQuadState.h:
+        (WebCore):
+        (CCSharedQuadState):
+        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorSolidColorQuad.cpp.
+        (WebCore):
+        (WebCore::CCSolidColorDrawQuad::create):
+        (WebCore::CCSolidColorDrawQuad::CCSolidColorDrawQuad):
+        (WebCore::CCSolidColorDrawQuad::materialCast):
+        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.h:
+        (WebCore):
+        (CCSolidColorDrawQuad):
+        (WebCore::CCSolidColorDrawQuad::color):
+        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorCheckerboardQuad.cpp.
+        (WebCore):
+        (WebCore::CCStreamVideoDrawQuad::create):
+        (WebCore::CCStreamVideoDrawQuad::CCStreamVideoDrawQuad):
+        (WebCore::CCStreamVideoDrawQuad::materialCast):
+        * platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h:
+        (WebCore):
+        (CCStreamVideoDrawQuad):
+        (WebCore::CCStreamVideoDrawQuad::textureId):
+        (WebCore::CCStreamVideoDrawQuad::matrix):
+        * platform/graphics/chromium/cc/CCTextureDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorTextureQuad.cpp.
+        (WebCore):
+        (WebCore::CCTextureDrawQuad::create):
+        (WebCore::CCTextureDrawQuad::CCTextureDrawQuad):
+        (WebCore::CCTextureDrawQuad::setNeedsBlending):
+        (WebCore::CCTextureDrawQuad::materialCast):
+        * platform/graphics/chromium/cc/CCTextureDrawQuad.h:
+        (WebCore):
+        (CCTextureDrawQuad):
+        (WebCore::CCTextureDrawQuad::uvRect):
+        (WebCore::CCTextureDrawQuad::resourceId):
+        (WebCore::CCTextureDrawQuad::premultipliedAlpha):
+        (WebCore::CCTextureDrawQuad::flipped):
+        * platform/graphics/chromium/cc/CCTileDrawQuad.cpp: Renamed from Source/WebCore/platform/chromium/support/WebCompositorTileQuad.cpp.
+        (WebCore):
+        (WebCore::CCTileDrawQuad::create):
+        (WebCore::CCTileDrawQuad::CCTileDrawQuad):
+        (WebCore::CCTileDrawQuad::materialCast):
+        * platform/graphics/chromium/cc/CCTileDrawQuad.h:
+        (WebCore):
+        (CCTileDrawQuad):
+        (WebCore::CCTileDrawQuad::resourceId):
+        (WebCore::CCTileDrawQuad::textureOffset):
+        (WebCore::CCTileDrawQuad::textureSize):
+        (WebCore::CCTileDrawQuad::textureFilter):
+        (WebCore::CCTileDrawQuad::swizzleContents):
+        (WebCore::CCTileDrawQuad::leftEdgeAA):
+        (WebCore::CCTileDrawQuad::topEdgeAA):
+        (WebCore::CCTileDrawQuad::rightEdgeAA):
+        (WebCore::CCTileDrawQuad::bottomEdgeAA):
+        (WebCore::CCTileDrawQuad::isAntialiased):
+        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp:
+        (WebCore::CCYUVVideoDrawQuad::create):
+        (WebCore::CCYUVVideoDrawQuad::CCYUVVideoDrawQuad):
+        (WebCore::CCYUVVideoDrawQuad::materialCast):
+        * platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h:
+        (CCYUVVideoDrawQuad):
+
+2012-08-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Unreviewed, restore Web Inspector JS frontend compilability after r124484 (fix JSDoc annotations).
+
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SettingsScreen.js:
+        * inspector/front-end/UserAgentSupport.js:
+        (WebInspector.UserAgentSupport.DeviceOrientation):
+
+2012-08-03  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, rolling out r124614.
+        http://trac.webkit.org/changeset/124614
+        https://bugs.webkit.org/show_bug.cgi?id=91727
+
+        gstreamer core .po files mess up the build again
+
+        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
+        (WTF::adoptGRef):
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
+        (setGstElementClassMetadata):
+        * platform/graphics/gstreamer/GStreamerVersioning.h:
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (StreamingClient::didReceiveResponse):
+
+2012-08-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        Initialize the Event Names' string from read only memory
+        https://bugs.webkit.org/show_bug.cgi?id=92435
+
+        Reviewed by Anders Carlsson.
+
+        Similarily to r123689, we can initialize the event names' string from memory without copying the data.
+        This saves us memory and initialization time.
+
+        * dom/EventNames.cpp:
+        (WebCore):
+
+2012-08-03  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK][jhbuild] Switch to GStreamer 0.11 build
+        https://bugs.webkit.org/show_bug.cgi?id=91727
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Add a new function to encapsulate the GStreamer API removal of
+        GST_OBJECT_IS_FLOATING in the upcoming 1.0 release. Use of this
+        macro can now be replaced by calling the g_object_is_floating
+        function.
+
+        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
+        (WTF::adoptGRef):
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
+        (gstObjectIsFloating):
+        * platform/graphics/gstreamer/GStreamerVersioning.h:
+
+2012-08-03  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Add a null check for media implementation to fix a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=93107
+
+        Reviewed by Rob Buis.
+
+        Fixes media/video-size.html.
+
+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore::RenderThemeBlackBerry::paintMediaSliderTrack): Add null check.
+
+2012-08-03  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Fixed WinCE compilation after r124589.
+
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::StyleRuleCSSStyleDeclaration::reportMemoryUsage):
+        (WebCore::InlineCSSStyleDeclaration::reportMemoryUsage):
+
+2012-08-03  Keishi Hattori  <keishi@webkit.org>
+
+        Add keyboard support for color suggestion popup
+        https://bugs.webkit.org/show_bug.cgi?id=93069
+
+        Reviewed by Kent Tamura.
+
+        This adds support for keyboard inside the color suggestion popup.
+        Tab or arrow keys to move around. Return or space to select the color.
+        Escape closes the popup.
+
+        No new tests. Covered in platform/chromium/fast/forms/color/color-suggestion-picker-appearance.html.
+
+        * Resources/colorSuggestionPicker.css:
+        (.color-swatch):
+        (.color-swatch:focus):
+        * Resources/colorSuggestionPicker.js:
+        (ColorPicker):
+        (ColorPicker.prototype._layout):
+        (ColorPicker.prototype.selectColorAtIndex): Selects color at index.
+        (ColorPicker.prototype._handleMouseMove): Set focus to the swatch under the mouse cursor.
+        (ColorPicker.prototype._handleKeyDown): Move focused element on arrow keys.
+        (ColorPicker.prototype._handleMouseDown): Prevents blur on click.
+
+2012-08-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Add missing include to build on Mac OS 10.8
+
+        Reviewed by Ossy.
+
+        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
+
+2012-08-03  Adam Barth  <abarth@webkit.org>
+
+        [V8] Re-wire "target" half of the same-origin security check through Document rather than DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=93079
+
+        Reviewed by Eric Seidel.
+
+        Before this patch, we were traversing from Nodes to Frames to
+        DOMWindows to SecurityOrigins when determing the "target" of an
+        operation for the same-origin policy security check. Rather than
+        detouring through DOMWindow, these security checks should operate in
+        terms of ScriptExecutionContexts (aka Documents) because that's the
+        canonical place we store SecurityOrigin objects.
+
+        A future patch will re-wire the "active" part of the security check to
+        use ScriptExecutionContexts as well and we'll be able to remove the
+        extra copy of SecurityOrigin that we keep in DOMWindow.
+
+        * bindings/generic/BindingSecurity.cpp:
+        (WebCore::canAccessDocument):
+        (WebCore::BindingSecurity::canAccessFrame):
+        (WebCore::BindingSecurity::shouldAllowAccessToNode):
+        * bindings/v8/BindingState.cpp:
+        (WebCore::immediatelyReportUnsafeAccessTo):
+        * bindings/v8/BindingState.h:
+        (WebCore):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::reportUnsafeJavaScriptAccess):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::reportUnsafeAccessTo):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+
+2012-08-03  Keishi Hattori  <keishi@webkit.org>
+
+        ColorSuggestionPicker popup's height doesn't get smaller than 100 px
+        https://bugs.webkit.org/show_bug.cgi?id=92945
+
+        Reviewed by Kent Tamura.
+
+        A window cannot be resized to be smaller than 100x100 pixels so this
+        adjust the color suggestion popup UI to look better when there are only
+        a few suggestions.
+
+        Tests: platform/chromium/fast/forms/color/color-suggestion-picker-one-row-appearance.html
+               platform/chromium/fast/forms/color/color-suggestion-picker-two-row-appearance.html
+
+        * Resources/colorSuggestionPicker.css:
+        (.color-swatch-container): Vertically center the swatches.
+
+2012-08-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Remove InspectorCSSAgent from InstrumentingAgents on clearFrontend()
+        https://bugs.webkit.org/show_bug.cgi?id=93082
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::InspectorCSSAgent):
+        (WebCore::InspectorCSSAgent::~InspectorCSSAgent):
+        (WebCore::InspectorCSSAgent::setFrontend):
+        (WebCore::InspectorCSSAgent::clearFrontend):
+
+2012-08-03  Eugene Klyuchnikov  <eustas.big@gmail.com>
+
+        Web Inspector: Profiles: extract save to file / load from code
+        https://bugs.webkit.org/show_bug.cgi?id=92348
+
+        Reviewed by Yury Semikhatsky.
+
+        Motivation: extract reusable code for timeline load/save.
+        FileUtils.js will contain common code. Not all code moved to FileUtils
+        to make review easier. This code will be moved in next patch.
+
+        Core abstractions: OutputStream and OutputStreamDelegate.
+
+        OutputStream is interface that is used to transfer entity divded
+        to chunks. Transfer process is explicitly initialized (startTransfer)
+        and finalized (finishTrnsfer).
+
+        OutputStreamDelegate is interface to receive notifications about
+        transfer process: onTransferStarted, onChunkTransferred, onTransferFinished.
+
+        ChunkedFileReader: utility class that loads file by chunks of specified
+        size and notifies given delegate. OutputStream is supplied as a
+        parameter of method "start".
+
+        ChunkedFileWriter: implementation of OutputStream that saves data
+        to file specified by file name and notifies given delegate.
+
+        * WebCore.gypi: Added 'FileUtils.js'.
+        * WebCore.vcproj/WebCore.vcproj: Added 'FileUtils.js'.
+        * inspector/compile-front-end.py: Added 'FileUtils.js'.
+        * inspector/front-end/FileUtils.js: Added.
+        (WebInspector.OutputStreamDelegate): Added.
+        (WebInspector.ChunkedFileReader): Added.
+        (WebInspector.createFileSelectorElement): Added utility method to construct
+        hidden input element to select file.
+        * inspector/front-end/HeapSnapshotLoader.js: Adopted new API.
+        * inspector/front-end/HeapSnapshotProxy.js: Adopted new API.
+        * inspector/front-end/HeapSnapshotView.js: Adopted new API.
+        (WebInspector.HeapSnapshotLoadFromFileDelegate):
+        Extracted from existing code.
+        (WebInspector.ChunkedFileWriter): Renamed and refactored.
+        (WebInspector.HeapSnapshotSaveToFileDelegate):
+        Extracted from existing code.
+        * inspector/front-end/ProfilesPanel.js: Adopted new API.
+
+2012-08-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Incorrect blob url href when inspecting
+        https://bugs.webkit.org/show_bug.cgi?id=93076
+
+        Reviewed by Vsevolod Vlasov.
+
+        Special-cased the "blob" scheme to return the original URL intact on completion.
+
+        * inspector/front-end/ResourceUtils.js:
+        (WebInspector.completeURL):
+
+2012-08-03  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add CSSRule memory instrumentation
+        https://bugs.webkit.org/show_bug.cgi?id=92962
+
+        Reviewed by Pavel Feldman.
+
+        Added memory footprint reporting method to CSSRule and its descendants.
+
+        * css/CSSCharsetRule.cpp:
+        (WebCore::CSSCharsetRule::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSCharsetRule.h:
+        (CSSCharsetRule):
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::reportMemoryUsage):
+        (WebCore):
+        * css/CSSComputedStyleDeclaration.h:
+        (CSSComputedStyleDeclaration):
+        * css/CSSFontFaceRule.cpp:
+        (WebCore::CSSFontFaceRule::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSFontFaceRule.h:
+        (CSSFontFaceRule):
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSImportRule.h:
+        (CSSImportRule):
+        * css/CSSMediaRule.cpp:
+        (WebCore::CSSMediaRule::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSMediaRule.h:
+        (CSSMediaRule):
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSPageRule.h:
+        (CSSPageRule):
+        * css/CSSRule.cpp:
+        (WebCore::CSSRule::reportMemoryUsage): we manually implement polymorphic
+        call here to avoid adding vtable pointer to all CSSRule objects. Descendants
+        are expected to report their memory via reportDescendantMemoryUsage. The name
+        is intentionally different from reportMemoryUsage to avoid accidential infitite
+        recursion: if the descendants overrode non-virtual CSSRule::reportMemoryUsage,
+        it would be easy to add a new descendant type to the switch in
+        CSSRule::reportMemoryUsage without providing proper override for reportMemoryUsage
+        and CSSRule::reportMemoryUsage would end up calling itself.
+        (WebCore):
+        (WebCore::CSSRule::reportBaseClassMemoryUsage): again we cannot use
+        MemoryClassInfo::visitBaseClass like we do for virtual methods because it would
+        lead to a recursive call of CSSRule::reportMemoryUsage. This is why we use
+        reportBaseClassMemoryUsage to allow descendants to report objects referenced
+        from their base class.
+        * css/CSSRule.h:
+        (WebCore):
+        (CSSRule):
+        * css/CSSRuleList.cpp:
+        (WebCore::StaticCSSRuleList::reportMemoryUsage):
+        (WebCore):
+        * css/CSSRuleList.h:
+        (WebCore):
+        (CSSRuleList):
+        (StaticCSSRuleList):
+        (LiveCSSRuleList):
+        * css/CSSStyleDeclaration.h:
+        (WebCore):
+        (CSSStyleDeclaration):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/CSSStyleRule.h:
+        (CSSStyleRule):
+        * css/CSSStyleSheet.cpp:
+        (StyleSheetCSSRuleList):
+        (WebCore::CSSStyleSheet::reportMemoryUsage):
+        * css/CSSUnknownRule.h:
+        (CSSUnknownRule):
+        (WebCore::CSSUnknownRule::reportDescendantMemoryUsage):
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::reportMemoryUsage):
+        (WebCore):
+        (WebCore::StyleRuleCSSStyleDeclaration::reportMemoryUsage):
+        (WebCore::InlineCSSStyleDeclaration::reportMemoryUsage):
+        * css/PropertySetCSSStyleDeclaration.h:
+        (PropertySetCSSStyleDeclaration):
+        (StyleRuleCSSStyleDeclaration):
+        (InlineCSSStyleDeclaration):
+        * css/WebKitCSSKeyframeRule.cpp:
+        (WebCore::WebKitCSSKeyframeRule::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/WebKitCSSKeyframeRule.h:
+        (WebKitCSSKeyframeRule):
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/WebKitCSSKeyframesRule.h:
+        (WebKitCSSKeyframesRule):
+        * css/WebKitCSSRegionRule.cpp:
+        (WebCore::WebKitCSSRegionRule::reportDescendantMemoryUsage):
+        (WebCore):
+        * css/WebKitCSSRegionRule.h:
+        (WebKitCSSRegionRule):
+
+2012-08-03  Adam Barth  <abarth@webkit.org>
+
+        WebCore::DragController::cleanupAfterSystemDrag should null-check page
+        https://bugs.webkit.org/show_bug.cgi?id=61815
+
+        Reviewed by Eric Seidel.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::doSystemDrag):
+
+2012-08-03  Sergio Carlos Morales Angeles  <carloschilazo@gmail.com>
+
+        Delete text from password does nothing.
+        https://bugs.webkit.org/show_bug.cgi?id=92040
+
+        Reviewed by Ryosuke Niwa.
+
+        Use Editor::canDelete() to determine if field is editable or not.
+        Added password-delete-contents test.
+
+        Test: editing/deleting/password-delete-contents.html
+
+        * editing/EditorCommand.cpp:
+        (WebCore::enabledDelete):
+
+2012-08-03  Jan Keromnes  <janx@linux.com>
+
+        Web Inspector: Make textModel private to textEditor
+        https://bugs.webkit.org/show_bug.cgi?id=92999
+
+        Reviewed by Pavel Feldman.
+
+        Making textModel private to the textEditor ensures that it is accessed
+        only through the textEditor, making the latter more modular.
+
+        Tests were changed accordingly.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype._restoreBreakpointsAfterEditing):
+        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
+        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointDecoration):
+        (WebInspector.JavaScriptSourceFrame.prototype._lineNumberAfterEditing):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype.replaceAllWith):
+        (WebInspector.SourceFrame.prototype._collectRegexMatches):
+        (WebInspector.SourceFrame.prototype.addMessageToSource):
+        (WebInspector.SourceFrame.prototype.removeMessageFromSource):
+        (WebInspector.TextEditorDelegateForSourceFrame.prototype.commitEditing):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype.setText):
+        (WebInspector.TextEditor.prototype.text):
+        (WebInspector.TextEditor.prototype.range):
+        (WebInspector.TextEditor.prototype.line):
+        (WebInspector.TextEditor.prototype.get linesCount):
+        (WebInspector.TextEditor.prototype.setAttribute):
+        (WebInspector.TextEditor.prototype.getAttribute):
+        (WebInspector.TextEditor.prototype.removeAttribute):
+        * inspector/front-end/UISourceCodeFrame.js:
+        (WebInspector.UISourceCodeFrame.prototype.afterTextChanged):
+
+2012-08-03  Adam Barth  <abarth@webkit.org>
+
+        V8Proxy::retrieve(*) leads to really obfuscated code and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=93072
+
+        Reviewed by Eric Seidel.
+
+        Once upon a time, V8Proxy::retrieve did a bunch of checks before
+        returning the V8Proxy object (such as checking whether script was
+        enabled). Over time, we've removed all of these checks in order to fix
+        various bugs. Now all it does is check whether the Frame is 0. However,
+        because the function ends up returning 0 when its argument is 0, the
+        caller sill needs to have a null check.
+
+        This patch deletes all the variations of V8Proxy::retrieve(*) and
+        inlines them into their callers. In several cases, inlining the
+        function call showed that we were testing the Frame for 0 twice, and
+        I've removed the redundant null checks. In other cases, I've
+        uncontorted the callers to make the code more readable.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateToV8Converters):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::V8TestActiveDOMObject::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructorConstructorCallback):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::wrapSlow):
+        * bindings/v8/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::addListener):
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8EventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::toV8Proxy):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::handleOutOfMemory):
+        (WebCore::V8Proxy::retrievePerContextData):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::toV8Context):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::addEventListenerCallback):
+        (WebCore::V8DOMWindow::removeEventListenerCallback):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::V8HTMLDocument::openCallback):
+        (WebCore::toV8):
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
+        (WebCore::toV8):
+
+2012-08-03  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Add *explicit* keyword to constructors in WebCore/accessibility
+        https://bugs.webkit.org/show_bug.cgi?id=93067
+
+        Reviewed by Kentaro Hara.
+
+        As a step to add *explicit* keyword to constructors which have a parameter,
+        *explicit* keyword is added to Source/WebCore/accessibility in order to avoid
+        implicit type conversion.
+
+        No new tests. Covered by existing tests.
+
+        * accessibility/AXObjectCache.h:
+        (AXObjectCache):
+        * accessibility/AccessibilityARIAGrid.h:
+        (AccessibilityARIAGrid):
+        * accessibility/AccessibilityARIAGridCell.h:
+        (AccessibilityARIAGridCell):
+        * accessibility/AccessibilityARIAGridRow.h:
+        (AccessibilityARIAGridRow):
+        * accessibility/AccessibilityList.h:
+        (AccessibilityList):
+        * accessibility/AccessibilityListBox.h:
+        (AccessibilityListBox):
+        * accessibility/AccessibilityMediaControls.h:
+        (AccessibilityMediaControl):
+        (AccessibilityMediaTimeline):
+        (AccessibilityMediaControlsContainer):
+        (AccessibilityMediaTimeDisplay):
+        * accessibility/AccessibilityMenuList.h:
+        (AccessibilityMenuList):
+        * accessibility/AccessibilityNodeObject.h:
+        (AccessibilityNodeObject):
+        * accessibility/AccessibilityProgressIndicator.h:
+        (AccessibilityProgressIndicator):
+        * accessibility/AccessibilityRenderObject.h:
+        (AccessibilityRenderObject):
+        * accessibility/AccessibilityScrollView.h:
+        (AccessibilityScrollView):
+        * accessibility/AccessibilityScrollbar.h:
+        (AccessibilityScrollbar):
+        * accessibility/AccessibilitySlider.h:
+        (AccessibilitySlider):
+        * accessibility/AccessibilityTable.h:
+        (AccessibilityTable):
+        * accessibility/AccessibilityTableCell.h:
+        (AccessibilityTableCell):
+        * accessibility/AccessibilityTableRow.h:
+        (AccessibilityTableRow):
+
+2012-08-03  Abhishek Arya  <inferno@chromium.org>
+
+        Regression(r124564): Wrong inlineChildrenBlock->hasLayer() computed in RenderBlock::removeChild.
+        https://bugs.webkit.org/show_bug.cgi?id=90800
+
+        Reviewed by Eric Seidel.
+
+        r124564 reversed the sequence of setStyle and removeChildNode calls, but failed to cache the value
+        of inlineChildrenBlock->hasLayer(). So, it will be null when the layer is removed from parent in setStyle.
+        Fixed by the caching the bool value. 
+
+        Covered by existing test fast/block/layer-not-removed-from-parent-crash.html.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+
+2012-08-03  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add a new and reusable enchant-based spellchecker in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=90269
+
+        Reviewed by Martin Robinson.
+
+        Move enchant specific code down to WebCore, into a new class
+        TextCheckerEnchant, that we can use from WK1 and WK2.
+
+        * GNUmakefile.am: Add flags to handle the SPELLCHECK feature.
+        * GNUmakefile.list.am: Added new files.
+        * platform/text/gtk/TextCheckerEnchant.cpp: Added.
+        (getAvailableDictionariesCallback):
+        (TextCheckerEnchant::TextCheckerEnchant):
+        (TextCheckerEnchant::~TextCheckerEnchant):
+        (TextCheckerEnchant::ignoreWord):
+        (TextCheckerEnchant::learnWord):
+        (TextCheckerEnchant::checkSpellingOfString):
+        (TextCheckerEnchant::getGuessesForWord):
+        (TextCheckerEnchant::updateSpellCheckingLanguages):
+        (TextCheckerEnchant::freeEnchantBrokerDictionaries):
+        * platform/text/gtk/TextCheckerEnchant.h: Added.
+        (WebCore):
+        (TextCheckerEnchant):
+        (WebCore::TextCheckerEnchant::create):
+
+2012-08-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Unreviewed r124536 followup, fix the assertion error on Chromium.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+
+2012-08-03  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: simple replace objectType with ownerObjectType in NMI code.
+        https://bugs.webkit.org/show_bug.cgi?id=93001
+
+        Reviewed by Yury Semikhatsky.
+
+        In all the cases when we are visiting members, objectType field is actually the object type of the member's owner object.
+
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryInstrumentation::InstrumentedPointer::InstrumentedPointer):
+        (InstrumentedPointer):
+        (WebCore::MemoryInstrumentation::addObject):
+        (WebCore::MemoryInstrumentation::addInstrumentedObject):
+        (WebCore::MemoryInstrumentation::addRawBuffer):
+        (WebCore::MemoryInstrumentation::OwningTraits::addInstrumentedObject):
+        (WebCore::MemoryInstrumentation::OwningTraits::addObject):
+        (WebCore::MemoryObjectInfo::MemoryObjectInfo):
+        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
+        (WebCore::MemoryInstrumentation::addObjectImpl):
+        (WebCore::MemoryInstrumentation::addHashMap):
+        (WebCore::MemoryInstrumentation::addHashSet):
+        (WebCore::MemoryInstrumentation::addInstrumentedCollection):
+        (WebCore::MemoryInstrumentation::addListHashSet):
+        (WebCore::MemoryInstrumentation::addVector):
+        (WebCore::::process):
+
+2012-08-02  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: extend test coverage for nmi code and fix 2 bugs.
+        https://bugs.webkit.org/show_bug.cgi?id=92994
+
+        Reviewed by Yury Semikhatsky.
+
+        1) owner object type propagation.
+        If a class with object-type DOM has an instrumented member with object-type Other then it has to be recorded as DOM.
+        Sample: We have SharedBuffer class and we don't know the object-type for it but we know that it is owned by an object with object-type CachedResourceImage.
+
+        2) the first member of an instrumented non virtual class was skipped even if it was reported properly.
+        it happened because the first member has the same address as it's owner
+
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryInstrumentation::addRootObject):
+        (WebCore::MemoryInstrumentation::InstrumentedPointer::InstrumentedPointer):
+        (InstrumentedPointer):
+        (WebCore::MemoryInstrumentation::addInstrumentedObject):
+        (MemoryInstrumentation):
+        (WebCore::MemoryInstrumentation::OwningTraits::addInstrumentedObject):
+        (WebCore::MemoryObjectInfo::MemoryObjectInfo):
+        (WebCore::MemoryObjectInfo::reportObjectInfo):
+        (WebCore::MemoryClassInfo::addInstrumentedMember):
+        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
+        (WebCore::MemoryInstrumentation::addObjectImpl):
+        (WebCore::MemoryInstrumentation::addInstrumentedCollection):
+        (WebCore::::process):
+
+2012-08-03  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Make v8NonStringValueToWebCoreString a static method
+        https://bugs.webkit.org/show_bug.cgi?id=93066
+
+        Reviewed by Adam Barth.
+
+        v8NonStringValueToWebCoreString() and v8NonStringValueToAtomicWebCoreString()
+        are not intended to be used from outside V8Binding.cpp.
+        They should be static methods.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8NonStringValueToWebCoreString):
+        (WebCore):
+        (WebCore::v8NonStringValueToAtomicWebCoreString):
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2012-08-02  Abhishek Arya  <inferno@chromium.org>
+
+        Crash due to layer not removed from parent for anonymous block.
+        https://bugs.webkit.org/show_bug.cgi?id=90800
+
+        Reviewed by Kent Tamura.
+
+        Reverse the order of setStyle and removeChildNode calls. This ensures that setting the style
+        properly removes its layer from the parent in RenderBoxModelObject::styleDidChange. Calling
+        removeChildNode before calling setStyle is problematic since the parent layer never gets
+        notified.
+
+        Test: fast/block/layer-not-removed-from-parent-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        V8Proxy::retrieveFrameFor*Context are used only by BindingState and should be removed as separate functions
+        https://bugs.webkit.org/show_bug.cgi?id=93049
+
+        Reviewed by Eric Seidel.
+
+        No one calls these functions directly anymore. This patch removes them
+        from V8Proxy and inlines their logic into BindingState.cpp.
+
+        * bindings/v8/BindingState.cpp:
+        (WebCore::activeContext):
+        (WebCore):
+        (WebCore::activeWindow):
+        (WebCore::activeFrame):
+        (WebCore::firstFrame):
+        (WebCore::currentFrame):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+
+2012-08-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        Make order of attribute/method in HTMLTrackElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80102
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. This patch doesn't change behavior.
+
+        * html/HTMLTrackElement.idl: Reorder attribute/method position.
+
+2012-08-02  Kent Tamura  <tkent@chromium.org>
+
+        Fix crashes for <input> and <textarea> with display:run-in.
+        https://bugs.webkit.org/show_bug.cgi?id=87300
+
+        Reviewed by Abhishek Arya.
+
+        Introduce RenderObject::canBeReplacedWithInlineRunIn, and renderers which
+        should not be run-in override it so that it returns false.
+
+        Test: fast/runin/input-text-runin.html
+              fast/runin/textarea-runin.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded):
+        Checks canBeReplacedWithInlineRunIn instead of checking tag names.
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::canBeReplacedWithInlineRunIn):
+        Added. Disallow run-in.
+        * rendering/RenderFileUploadControl.h:
+        (RenderFileUploadControl): Declare canBeReplacedWithInlineRunIn.
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::canBeReplacedWithInlineRunIn):
+        Added. Disallow run-in. This is not a behavior change.
+        * rendering/RenderListBox.h:
+        (RenderListBox): Declare canBeReplacedWithInlineRunIn.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::canBeReplacedWithInlineRunIn):
+        Added. Disallow run-in. This is not a behavior change.
+        * rendering/RenderMenuList.h:
+        (RenderMenuList): Declare canBeReplacedWithInlineRunIn.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::canBeReplacedWithInlineRunIn):
+        Added. Allow run-in by default.
+        * rendering/RenderObject.h:
+        (RenderObject): Declare canBeReplacedWithInlineRunIn.
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::canBeReplacedWithInlineRunIn):
+        Added. Disallow run-in. This is not a behavior change.
+        * rendering/RenderProgress.h:
+        (RenderProgress): Declare canBeReplacedWithInlineRunIn.
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::canBeReplacedWithInlineRunIn):
+        Added. Disallow run-in.
+        * rendering/RenderSlider.h:
+        (RenderSlider): Declare canBeReplacedWithInlineRunIn.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::canBeReplacedWithInlineRunIn):
+        Added. Disallow run-in.
+        * rendering/RenderTextControl.h:
+        (RenderTextControl): Declare canBeReplacedWithInlineRunIn.
+
+2012-08-02  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        [EFL] Fix wrong assigned value of BatteryStatus
+        https://bugs.webkit.org/show_bug.cgi?id=93058
+
+        Reviewed by Kentaro Hara.
+
+        There is a wrong change in the bug 92964.
+        property variable have to be used after assigned value in the setBatteryClient.
+
+        * platform/efl/BatteryProviderEfl.cpp:
+        (WebCore::BatteryProviderEfl::setBatteryClient):
+
+2012-08-02  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Add default implementation of GraphicsLayerClient::contentsVisible()
+        https://bugs.webkit.org/show_bug.cgi?id=93036
+
+        Reviewed by George Staikos.
+
+        Returning true by default would cause memory usage to balloon, because
+        the LayerTiler would believe every tile is visible and always needs to
+        be rendered. Instead, we choose to return false by default, relying
+        entirely on reactive rendering through render jobs.
+
+        However this revealed a subtle bug. If the entire layer was invalidated
+        every frame, checkerboard would never resolve with this default
+        implementation.
+
+        Fixed by not clearing render jobs when the entire layer is invalidated,
+        thus making us robust against an incomplete contentsVisible
+        implementation.
+
+        Also removed dead code related to the deprecated
+        LayerTiler::m_tilesWebKitThread mechanism, which has been replaced by
+        the implicit visibility management resulting from render jobs.
+
+        With m_tilesWebKitThread out of the way, rename m_tilesCompositingThread
+        to be simply m_tiles.
+
+        PR 187458
+
+        This is not currently testable using BlackBerry testing infrastructure.
+
+        * platform/graphics/GraphicsLayerClient.h:
+        (WebCore::GraphicsLayerClient::contentsVisible): Gets a default implementation instead of being pure virtual.
+        * platform/graphics/blackberry/LayerTile.cpp:
+        (WebCore::LayerTile::LayerTile): Merged LayerTileData into LayerTile now that m_tilesWebKitThread is gone.
+        * platform/graphics/blackberry/LayerTile.h:
+        (LayerTile):
+        * platform/graphics/blackberry/LayerTiler.cpp:
+        (WebCore::LayerTiler::~LayerTiler):
+        (WebCore::LayerTiler::updateTextureContentsIfNeeded): Bug fix to make us robust against the new default implementation of GraphicsLayerClient::contentsVisible()
+        (WebCore::LayerTiler::shouldPerformRenderJob):
+        (WebCore::LayerTiler::layerVisibilityChanged):
+        (WebCore::LayerTiler::uploadTexturesIfNeeded):
+        (WebCore::LayerTiler::drawTexturesInternal):
+        (WebCore::LayerTiler::deleteTextures):
+        (WebCore::LayerTiler::pruneTextures):
+        (WebCore::LayerTiler::bindContentsTexture):
+        * platform/graphics/blackberry/LayerTiler.h:
+        (LayerTiler):
+
+2012-08-02  Keishi Hattori  <keishi@webkit.org>
+
+        Slider should snap to datalist tick marks
+        https://bugs.webkit.org/show_bug.cgi?id=92640
+
+        Reviewed by Kent Tamura.
+
+        Input type=range slider snaps to datalist tick marks.
+
+        Test: fast/forms/datalist/range-snap-to-datalist.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::findClosestTickMarkValue): Just calls InputType::findClosestTickMarkValue.
+        (WebCore):
+        * html/HTMLInputElement.h:
+        (HTMLInputElement):
+        * html/InputType.cpp:
+        (WebCore):
+        (WebCore::InputType::findClosestTickMarkValue): Overridden by RangeInputType.
+        * html/InputType.h:
+        (InputType):
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::RangeInputType):
+        (WebCore):
+        (WebCore::RangeInputType::listAttributeTargetChanged): Mark m_tickMarkValues as dirty.
+        (WebCore::decimalCompare):
+        (WebCore::RangeInputType::updateTickMarkValues): Sets m_tickMarkValues to a list of sorted valid datalist values.
+        (WebCore::RangeInputType::findClosestTickMarkValue): Finds closest tick mark value to a given value.
+        * html/RangeInputType.h:
+        (RangeInputType):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore):
+        (WebCore::SliderThumbElement::setPositionFromPoint): Snaps to the closest tick mark value if it is within a certain distance.
+
+2012-08-02  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Crash while loading plugin after r121467
+        https://bugs.webkit.org/show_bug.cgi?id=92943
+
+        Reviewed by Laszlo Gombos.
+
+        r121467 replaced POSIX dlopen to helpers in eina_module, but some codes
+        are not changed.
+
+        No new tests, behavior has not changed.
+
+        * plugins/efl/PluginPackageEfl.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        Changes dlsym to eina_module_symbol_get to follow changes of r121467.
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        V8 bindings code that tries to find its context should use BindingState functions rather than V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=93038
+
+        Reviewed by Eric Seidel.
+
+        After this patch, most code in the V8 bindings that tries to determine
+        it's "context" goes through BindingState.h rather than V8Proxy. This
+        patch is a step towards unifying all these code paths.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNamedConstructorCallback):
+        * bindings/v8/BindingState.cpp:
+        (WebCore::currentFrame):
+        (WebCore):
+        * bindings/v8/BindingState.h:
+        (WebCore):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::retrieveFrameForEnteredContext):
+        (WebCore::ScriptController::retrieveFrameForCurrentContext):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::v8UncaughtExceptionHandler):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::reportUnsafeAccessTo):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        * bindings/v8/custom/V8AudioContextCustom.cpp:
+        (WebCore::V8AudioContext::constructorCallback):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::handlePostMessageCallback):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::V8HTMLDocument::writeCallback):
+        (WebCore::V8HTMLDocument::writelnCallback):
+        (WebCore::V8HTMLDocument::openCallback):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+
+2012-08-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124540.
+        http://trac.webkit.org/changeset/124540
+        https://bugs.webkit.org/show_bug.cgi?id=93055
+
+        Broke compile on Chromium Win bot (Requested by dimich on
+        #webkit).
+
+        * Modules/indexeddb/IDBBackingStore.h:
+        (IDBBackingStore):
+        * Modules/indexeddb/IDBCallbacks.h:
+        (IDBCallbacks):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::PendingOpenCall::PendingOpenCall):
+        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
+        (WebCore::IDBDatabaseBackendImpl::openInternal):
+        (WebCore::IDBDatabaseBackendImpl::metadata):
+        (WebCore::IDBDatabaseBackendImpl::setVersion):
+        (WebCore::IDBDatabaseBackendImpl::transactionFinished):
+        (WebCore::IDBDatabaseBackendImpl::processPendingCalls):
+        (WebCore::IDBDatabaseBackendImpl::registerFrontendCallbacks):
+        (WebCore::IDBDatabaseBackendImpl::deleteDatabase):
+        (WebCore::IDBDatabaseBackendImpl::close):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBDatabaseCallbacks.h:
+        (IDBDatabaseCallbacks):
+        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::open):
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::deleteDatabase):
+        * Modules/indexeddb/IDBLevelDBBackingStore.h:
+        (IDBLevelDBBackingStore):
+        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::commit):
+
+2012-08-02  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Upstream GraphicsLayerClient::contentsVisible()
+        https://bugs.webkit.org/show_bug.cgi?id=93040
+
+        Reviewed by George Staikos.
+
+        Our LayerTiler uses both proactive and reactive rendering to populate
+        tiles. If contentsVisible() is accurate, it will cause the right tiles
+        to be rendered. Failing that, when a dirty tile is found to be visible
+        on the compositing thread, a render job is scheduled.
+
+        This is not currently testable using BlackBerry testing infrastructure.
+
+        * platform/graphics/GraphicsLayerClient.h:
+        (GraphicsLayerClient): New BlackBerry-specific method "contentsVisible" added.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore):
+        (WebCore::RenderLayerBacking::contentsVisible): BlackBerry-specific implementation.
+
+2012-08-02  Alexandre Elias  <aelias@google.com>
+
+        [chromium] deviceViewportSize cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=92794
+
+        Reviewed by Adrienne Walker.
+
+        In the future, CSS layout size will become increasingly disassociated
+        from physical device size, and it will become impossible to infer one
+        from the other inside the compositor.  Therefore, this patch allows
+        deviceViewportSize to be explicitly passed in by the outside client.
+
+        I also renamed the existing viewportSize field to "layoutViewportSize"
+        for clarity, and converted its uses to deviceViewportSize since
+        that is more appropriate.
+
+        I had to add some default-value scaffolding to WebLayerTreeView in
+        order to avoid breaking ui/compositor.  We can delete it once that's
+        updated.
+
+        No new tests (covered by existing tests).
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setViewportSize):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        (WebCore::CCLayerTreeHost::setDeviceScaleFactor):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::layoutViewportSize):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::canDraw):
+        (WebCore::CCLayerTreeHostImpl::startPageScaleAnimation):
+        (WebCore::CCLayerTreeHostImpl::setViewportSize):
+        (WebCore::CCLayerTreeHostImpl::setDeviceScaleFactor):
+        (WebCore::CCLayerTreeHostImpl::updateMaxScrollPosition):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::layoutViewportSize):
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        V8Proxy::currentContext() doesn't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=93041
+
+        Reviewed by Eric Seidel.
+
+        It's just a wrapper for GetCurrent().
+
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep):
+        * bindings/v8/V8NPUtils.cpp:
+        (WebCore::convertV8ObjectToNPVariant):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieve):
+        (WebCore::V8Proxy::mainWorldContext):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::getJSListenerFunctions):
+
+2012-08-02  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Core upgradeneeded logic
+        https://bugs.webkit.org/show_bug.cgi?id=92558
+
+        Reviewed by Ojan Vafai.
+
+        This is the backend webkit logic needed for integer versions. The rest
+        is in https://bugs.webkit.org/show_bug.cgi?id=89505.
+
+        I tried to make use of the existing processPendingCalls and added two
+        more queues, pendingOpenWithVersionCalls and
+        pendingSecondHalfOpenWithVersionCalls. The "second half" refers to
+        how there are two events that need to be fired in response to an
+        open-with-version call. The "second half" queue holds the open
+        requests that should immediately follow the caller's upgradeneeded
+        handler.
+
+        No new tests, there are so many they are in their own patch:
+        https://bugs.webkit.org/show_bug.cgi?id=92560
+
+        Though this patch doesn't change any expected behavior anyway, lack of
+        regressions is what we're hoping for here.
+
+        * Modules/indexeddb/IDBBackingStore.h:
+        (IDBBackingStore):
+        * Modules/indexeddb/IDBCallbacks.h:
+        (WebCore::IDBCallbacks::onBlocked):
+        (WebCore::IDBCallbacks::onUpgradeNeeded):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (IDBDatabaseBackendImpl::PendingOpenCall):
+        (IDBDatabaseBackendImpl::PendingOpenWithVersionCall):
+        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::create):
+        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::callbacks):
+        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::version):
+        (WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::PendingOpenWithVersionCall):
+        (WebCore):
+        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
+        (WebCore::IDBDatabaseBackendImpl::openInternal):
+        (WebCore::IDBDatabaseBackendImpl::metadata):
+        (WebCore::IDBDatabaseBackendImpl::setVersion):
+        (WebCore::IDBDatabaseBackendImpl::setIntVersionInternal):
+        (WebCore::IDBDatabaseBackendImpl::transactionFinished):
+        (WebCore::IDBDatabaseBackendImpl::transactionFinishedAndEventsFired):
+        When an upgradeneeded event is fired in response to an
+        open-with-version call, the version change transaction must receive its
+        complete event before processPendingCalls fires a success event at
+        IDBOpenDBRequest. In the future this should probably be changed
+        instead to transactionFinishedAndAbortFired and
+        transactionFinishedAndCompleteFired so that we'll know to fire a
+        success or error event at IDBOpenDBRequest. Currently, instead of
+        firing error when there's an abort, we don't fire anything.
+
+        (WebCore::IDBDatabaseBackendImpl::processPendingCalls):
+        Now that this is called after a connection is opened, we unfortunately
+        lose the invariant that there is only one existing connection when this
+        is called, but nothing inside this function actually relied on that.
+        Additionally, the secondHalfOpen calls only ever need to be serviced
+        in one place: right after a version change transaction completes, so
+        it could be moved out of here.
+
+        (WebCore::IDBDatabaseBackendImpl::registerFrontendCallbacks):
+        Now that setVersion and deleteDatabase calls are queued up behind
+        secondHalfOpen calls, we have to service those queues when
+        secondHalfOpen calls complete, which is here.  So call
+        processPendingCalls().
+
+        (WebCore::IDBDatabaseBackendImpl::runIntVersionChangeTransaction):
+        (WebCore::IDBDatabaseBackendImpl::openConnectionWithVersion):
+        (WebCore::IDBDatabaseBackendImpl::deleteDatabase):
+        (WebCore::IDBDatabaseBackendImpl::close):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBDatabaseCallbacks.h:
+        (WebCore::IDBDatabaseCallbacks::onVersionChange):
+        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::open):
+        This is refactored some so that the call to openConection{WithVersion}
+        happens once, at the end.
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::updateIDBDatabaseIntVersion):
+        (WebCore):
+        (WebCore::IDBLevelDBBackingStore::deleteDatabase):
+        * Modules/indexeddb/IDBLevelDBBackingStore.h:
+        (IDBLevelDBBackingStore):
+        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::commit):
+        See above comments about transactionFinishedAndEventsFired. I tried
+        moving the call to transactionFinished after the events were fired but
+        that failed some asserts. But changing those asserts is still an
+        alternative to splitting up transactionFinished as is done here.
+
+2012-08-02  Rob Buis  <rwlbuis@webkit.org>
+
+        SVG text selection doesn't work with hyperlinked text
+        https://bugs.webkit.org/show_bug.cgi?id=29166
+
+        Reviewed by Eric Seidel.
+
+        Cleanup SVGAElement. There is no need to test for middle mouse button here, this
+        is handled elsewhere, so remove isMiddleMouseButtonEvent. Similarly handleLinkClick
+        is not used anymore by HTMLAnchorElement, remove it. Finally, _self indeed is not needed.
+
+        No new tests, since no change in behaviour.
+
+        * WebCore.order:
+        * html/HTMLAnchorElement.cpp:
+        * html/HTMLAnchorElement.h:
+        (WebCore):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler):
+
+2012-08-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Move causesFosterParenting() to HTMLStackItem
+        https://bugs.webkit.org/show_bug.cgi?id=93048
+
+        Reviewed by Adam Barth.
+
+        Changed to share causesFosterParenting() between HTMLTreeBuilder and HTMLConstructionSite
+        by moving this function to HTMLStackItem.
+
+        No functional change, so no new tests.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::shouldFosterParent):
+        * html/parser/HTMLStackItem.h:
+        (WebCore::HTMLStackItem::causesFosterParenting):
+        (HTMLStackItem):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+
+2012-08-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Read tag names and attributes from the saved tokens in HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken*)
+        https://bugs.webkit.org/show_bug.cgi?id=93047
+
+        Reviewed by Adam Barth.
+
+        This is a follow-up patch for r123577.
+        Changed to retrieve the stack item of commonAncestor and read the local name from the saved token.
+
+        No new tests, covered by existing tests.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+
+2012-08-02  Vincent Scheib  <scheib@chromium.org>
+
+        Remove old Pointer Lock API.
+        https://bugs.webkit.org/show_bug.cgi?id=88892
+
+        Reviewed by Adam Barth.
+
+        Removing the old Pointer Lock API as one of the final cleanup
+        changes for the Update to Fullscreen style locking Spec meta
+        bug https://bugs.webkit.org/show_bug.cgi?id=84402.
+
+        This change primarily removes idl, access in navigator,
+        one event, and supporting infrastructure in page/PointerLock.
+
+        In PointerLockController changes were already noted clearly with
+        TODOs differentiating old and new api sections.
+
+        Test: pointer-lock/pointerlockchange-event-on-lock-lost.html
+
+        * WebCore.gypi:
+        * dom/Element.cpp:
+        (WebCore::Element::webkitRequestPointerLock):
+        * dom/EventNames.h:
+        (WebCore):
+        * page/Navigator.cpp:
+        * page/Navigator.h:
+        (WebCore):
+        (Navigator):
+        * page/Navigator.idl:
+        * page/PointerLock.cpp: Removed.
+        * page/PointerLock.h: Removed.
+        * page/PointerLock.idl: Removed.
+        * page/PointerLockController.cpp:
+        (WebCore::PointerLockController::requestPointerLock):
+        (WebCore::PointerLockController::didAcquirePointerLock):
+        (WebCore::PointerLockController::didNotAcquirePointerLock):
+        (WebCore::PointerLockController::didLosePointerLock):
+        * page/PointerLockController.h:
+        (PointerLockController):
+
+2012-08-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        scripts in formaction should be stripped upon paste
+        https://bugs.webkit.org/show_bug.cgi?id=92298
+
+        Reviewed by Eric Seidel.
+
+        Strip formaction attribute values when the URL is of javascript protocol.
+
+        Test: editing/pasteboard/paste-noscript-xhtml.html
+              editing/pasteboard/paste-noscript.html
+
+        * dom/Element.cpp:
+        (WebCore::isAttributeToRemove): Explicitly compare with href and nohref instead of comparing
+        the ends of strings since comparing two AtomicString is much faster.
+
+2012-08-02  Elliott Sprehn  <esprehn@gmail.com>
+
+        Built in quotes don't use lang attribute
+        https://bugs.webkit.org/show_bug.cgi?id=92918
+
+        Reviewed by Alexey Proskuryakov.
+
+        Previously even though there was a table in RenderQuote of languages mapped
+        to quotes we always used basic quotes. This patch removes the broken tree
+        walking and uses Element::computeInheritedLanguage fixing this.
+
+        Tests: fast/css-generated-content/quotes-lang-expected.html
+               fast/css-generated-content/quotes-lang.html
+               fast/css-generated-content/quotes-xml-lang-expected.html
+               fast/css-generated-content/quotes-xml-lang.html
+
+        * rendering/RenderQuote.cpp:
+        (WebCore::RenderQuote::originalText):
+        (WebCore::RenderQuote::quotesData): New method that determines the right QuotesData to use.
+        (WebCore):
+        * rendering/RenderQuote.h:
+        (RenderQuote):
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        Add back a header I mistakenly removed in my previous commit.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-08-02  Adrienne Walker  <enne@google.com>
+
+        [chromium] Remove dependency on Scrollbar.h from ScrollbarLayerChromium
+        https://bugs.webkit.org/show_bug.cgi?id=93024
+
+        Reviewed by James Robinson.
+
+        Change part enum from the Scrollbar version to WebScrollbar's.
+
+        Tested by composited layout tests.
+
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarBackgroundPainter::create):
+        (WebCore::ScrollbarBackgroundPainter::ScrollbarBackgroundPainter):
+        (ScrollbarBackgroundPainter):
+        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        BindingSecurityBase serves no purpose and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=93025
+
+        Reviewed by Eric Seidel.
+
+        Now that we don't use templates in the generic bindings, we can merge
+        BindingSecurity and BindingSecurityBase. This patch also removes some
+        functions that are no longer used (and reduces the number of
+        #includes).
+
+        No behavior change.
+
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * bindings/generic/BindingSecurity.h:
+        (WebCore):
+        (BindingSecurity):
+        * bindings/generic/BindingSecurityBase.cpp: Removed.
+        * bindings/generic/BindingSecurityBase.h: Removed.
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8Utilities.cpp:
+        * bindings/v8/custom/V8MutationObserverCustom.cpp:
+
+2012-08-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Let XCode have its own away and also sort the files.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-08-02  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] Add CCScrollbarAnimationController class for compositor scrollbar animation
+        https://bugs.webkit.org/show_bug.cgi?id=91688
+
+        Reviewed by Adrienne Walker.
+
+        Add CCScrollbarAnimationController that serves as the middle man
+        between the scrolling layer and scrollbar layer. Now all scroll offset
+        information are pushed through the controller, and individual platform
+        can provide specialized controller for extra processing.
+
+        A basic fadeout controller for Android scrollbar is included.
+
+        New test: ScrollbarLayerChromiumTest.scrollOffsetSynchronization
+                  CCScrollbarAnimationControllerLinearFade.*
+
+        * WebCore.gypi:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::calculateScrollbarModesForLayout):
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::createScrollbarLayer):
+        * platform/graphics/chromium/TreeSynchronizer.cpp:
+        (WebCore::TreeSynchronizer::synchronizeTreeRecursive):
+        (WebCore::TreeSynchronizer::updateScrollbarLayerPointersRecursive):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::scrollBy):
+        (WebCore::CCLayerImpl::setMaxScrollPosition):
+        (WebCore):
+        (WebCore::CCLayerImpl::horizontalScrollbarLayer):
+        (WebCore::CCLayerImpl::setHorizontalScrollbarLayer):
+        (WebCore::CCLayerImpl::verticalScrollbarLayer):
+        (WebCore::CCLayerImpl::setVerticalScrollbarLayer):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore):
+        (CCLayerImpl):
+        (WebCore::CCLayerImpl::scrollbarAnimationController):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::animate):
+        (WebCore::CCLayerTreeHostImpl::pinchGestureBegin):
+        (WebCore::CCLayerTreeHostImpl::pinchGestureUpdate):
+        (WebCore::CCLayerTreeHostImpl::pinchGestureEnd):
+        (WebCore::CCLayerTreeHostImpl::animateScrollbars):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::animateScrollbarsRecursive):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCScrollbarAnimationController.cpp: Added.
+        (WebCore):
+        (WebCore::CCScrollbarAnimationController::create):
+        (WebCore::CCScrollbarAnimationController::CCScrollbarAnimationController):
+        (WebCore::CCScrollbarAnimationController::~CCScrollbarAnimationController):
+        (WebCore::CCScrollbarAnimationController::getScrollLayerBounds):
+        (WebCore::CCScrollbarAnimationController::updateScrollOffset):
+        * platform/graphics/chromium/cc/CCScrollbarAnimationController.h: Added.
+        (WebCore):
+        (CCScrollbarAnimationController):
+        (WebCore::CCScrollbarAnimationController::animate):
+        (WebCore::CCScrollbarAnimationController::didPinchGestureBegin):
+        (WebCore::CCScrollbarAnimationController::didPinchGestureUpdate):
+        (WebCore::CCScrollbarAnimationController::didPinchGestureEnd):
+        (WebCore::CCScrollbarAnimationController::setHorizontalScrollbarLayer):
+        (WebCore::CCScrollbarAnimationController::horizontalScrollbarLayer):
+        (WebCore::CCScrollbarAnimationController::setVerticalScrollbarLayer):
+        (WebCore::CCScrollbarAnimationController::verticalScrollbarLayer):
+        * platform/graphics/chromium/cc/CCScrollbarAnimationControllerAndroid.cpp: Added.
+        (WebCore):
+        (WebCore::CCScrollbarAnimationController::create):
+        (WebCore::CCScrollbarAnimationControllerAndroid::CCScrollbarAnimationControllerAndroid):
+        (WebCore::CCScrollbarAnimationControllerAndroid::~CCScrollbarAnimationControllerAndroid):
+        (WebCore::CCScrollbarAnimationControllerAndroid::animate):
+        (WebCore::CCScrollbarAnimationControllerAndroid::didPinchGestureUpdate):
+        (WebCore::CCScrollbarAnimationControllerAndroid::didPinchGestureEnd):
+        (WebCore::CCScrollbarAnimationControllerAndroid::updateScrollOffset):
+        (WebCore::CCScrollbarAnimationControllerAndroid::opacityAtTime):
+        * platform/graphics/chromium/cc/CCScrollbarAnimationControllerAndroid.h: Added.
+        (WebCore):
+        (CCScrollbarAnimationControllerAndroid):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        (WebCore::CCScrollbarLayerImpl::CCScrollbarLayerImpl):
+        (WebCore):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::value):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::currentPos):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::totalSize):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::maximum):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+        (WebCore::CCScrollbarLayerImpl::orientation):
+        (WebCore::CCScrollbarLayerImpl::setCurrentPos):
+        (WebCore::CCScrollbarLayerImpl::setTotalSize):
+        (WebCore::CCScrollbarLayerImpl::setMaximum):
+        (CCScrollbarLayerImpl):
+
+2012-06-15  David Barton  <dbarton@mathscribe.com>
+
+        MathML: nested square root symbols have varying descenders
+        https://bugs.webkit.org/show_bug.cgi?id=43819
+
+        Reviewed by Eric Seidel.
+
+        This bug stems from the use of offsetHeight() on a renderer that's possibly a
+        RenderInline, in getBoxModelObjectHeight() in RenderMathMLBlock.h.
+        RenderInline::offsetHeight() actually returns linesBoundingBox().height(), which can be
+        overly large, especially for the big STIX fonts that include a few mathematical symbols
+        with unusually tall ascenders or descenders. A better solution for MathML in general is
+        the CSS properties { -webkit-line-box-contain: glyphs replaced; line-height: 0; }. This
+        gives tight glyph-based formatting in radical expressions, subscripts, superscripts,
+        underscripts, overscripts, numerators, denominators, etc. To make this work, inline
+        elements such as <mn> and <mi> must be wrapped inside implicit <mrow>s or just
+        RenderMathMLBlocks, when a tight height is desired. We also replace
+        getBoxModelObjectWidth(), which uses offsetWidth(), with contentLogicalWidth(). Finally,
+        we enable the STIXGeneral font for use inside layout tests.
+
+        Tested by existing LayoutTests/mathml/presentation/ files including roots.xhtml.
+
+        * css/mathml.css:
+        (math):
+        (mtext):
+        (mroot > * + *):
+        (mtd):
+        * rendering/mathml/RenderMathMLBlock.cpp:
+        (WebCore::RenderMathMLBlock::preferredLogicalHeightAfterSizing):
+        (WebCore::RenderMathMLBlock::baselinePosition):
+        * rendering/mathml/RenderMathMLBlock.h:
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::baselinePosition):
+        * rendering/mathml/RenderMathMLOperator.cpp:
+        (WebCore::RenderMathMLOperator::createStackableStyle):
+        (WebCore::RenderMathMLOperator::baselinePosition):
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::addChild):
+        (WebCore::RenderMathMLRoot::computePreferredLogicalWidths):
+        (WebCore::RenderMathMLRoot::paint):
+        * rendering/mathml/RenderMathMLRoot.h:
+        * rendering/mathml/RenderMathMLSquareRoot.cpp:
+        * rendering/mathml/RenderMathMLSquareRoot.h:
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::layout):
+        * rendering/mathml/RenderMathMLUnderOver.cpp:
+        (WebCore::RenderMathMLUnderOver::baselinePosition):
+        * rendering/mathml/RenderMathMLUnderOver.h:
+
+2012-08-02  Adrienne Walker  <enne@google.com>
+
+        [chromium] Make CCScrollbarLayerImpl handle lost contexts properly
+        https://bugs.webkit.org/show_bug.cgi?id=93021
+
+        Reviewed by James Robinson.
+
+        The resource ids that CCScrollbarLayerImpl holds onto need to be
+        discarded during a lost context as the resource provider they came
+        from is also destroyed.
+
+        Make a scrollbarGeometry function that wraps all uses of the
+        m_geometry member to make it possible to test CCScrollbarLayerImpl
+        without depending on WebCore.
+
+        Test: CCLayerTreeHostImplTest.dontUseOldResourcesAfterLostContext
+
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        (WebCore::CCScrollbarLayerImpl::scrollbarGeometry):
+        (WebCore):
+        (WebCore::CCScrollbarLayerImpl::appendQuads):
+        (WebCore::CCScrollbarLayerImpl::didLoseContext):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+        (CCScrollbarLayerImpl):
+
+2012-08-02  Oliver Hunt  <oliver@apple.com>
+
+        A few objects aren't being safely protected from GC in all cases
+        https://bugs.webkit.org/show_bug.cgi?id=93031
+
+        Reviewed by Filip Pizlo.
+
+        I haven't seen evidence that anyone is hitting bugs due to this, but any
+        GC error can lead to later -- hard to diagnose -- bugs if they result in
+        resurrecting dead objects.
+
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::JSCustomXPathNSResolver):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSCustomXPathNSResolver.h:
+        (JSCustomXPathNSResolver):
+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::tryGetProperty):
+        * bindings/js/JSDictionary.h:
+        (WebCore::JSDictionary::JSDictionary):
+        (WebCore::JSDictionary::initializerObject):
+
+2012-08-02  Emil A Eklund  <eae@chromium.org>
+
+        Range::isPointInRange incorrectly throws WRONG_DOCUMENT_ERR
+        https://bugs.webkit.org/show_bug.cgi?id=93009
+
+        Reviewed by Ojan Vafai.
+
+        The latest working draft of the DOM4 spec has all but killed the
+        WRONG_DOCUMENT_ERR exception. Update isPointInRange to return false
+        instead of throwing an exception when the range and point are in
+        different documents. This matches the Mozilla behavior.
+
+        Test: fast/html/range-point-in-range-for-different-documents.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::isPointInRange):
+        Return false instead of throwing WRONG_DOCUMENT_ERR when the point is in
+        a different document.
+
+2012-08-02  Erik Arvidsson  <arv@chromium.org>
+
+        DOM4: className should be defined on Element and not on HTMLElement
+        https://bugs.webkit.org/show_bug.cgi?id=93014
+
+        Reviewed by Adam Barth.
+
+        DOM4 specs that Element should have the className WebIDL attribute. This moves the
+        attribute to the correct IDL file.
+
+        Test: fast/dom/Element/class-name.html
+
+        * dom/Element.idl:
+        * html/HTMLElement.idl:
+
+2012-08-02  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Handle case where Error.prototype returns an empty object
+        https://bugs.webkit.org/show_bug.cgi?id=91792
+
+        Reviewed by Kentaro Hara.
+
+        In some edge cases we get an empty object back from Error.prototype.
+
+        No new tests. I cannot reproduce this.
+
+        * bindings/v8/V8BindingPerContextData.cpp:
+        (WebCore::V8BindingPerContextData::constructorForTypeSlowCase):
+
+2012-08-02  Eric Seidel  <eric@webkit.org>
+
+        Add back ASSERT(!needsLayout) to RenderTableSection which is now valid
+        https://bugs.webkit.org/show_bug.cgi?id=92954
+
+        Unreviewed, follow-up per Mitz's request.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paint):
+
+2012-08-02  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove unused includes from compositor code
+        https://bugs.webkit.org/show_bug.cgi?id=92930
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        The generic bindings shouldn't use templates
+        https://bugs.webkit.org/show_bug.cgi?id=93016
+
+        Reviewed by Eric Seidel.
+
+        We originally created the generic bindings to share code between the
+        JavaScriptCore and V8 bindings. However, the code came out sort of ugly
+        because we used templates (with the idea that templates would let us
+        use more than one scripting engine).
+
+        This patch rips out the templates in an attempt to make the code
+        prettier and therefore easier to use in both V8 and JSC. I've tried to
+        keep this patch small by remaning things mostly in place. In the next
+        patch, I'll move a bunch of code out of headers and into cpp files.
+
+        No behavior change.
+
+        * GNUmakefile.am:
+        * UseV8.cmake:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * bindings/generic/BindingSecurity.h:
+        (WebCore):
+        (BindingSecurity):
+        (WebCore::BindingSecurity::canAccessWindow):
+        (WebCore::BindingSecurity::canAccessFrame):
+        (WebCore::BindingSecurity::shouldAllowAccessToNode):
+        (WebCore::BindingSecurity::allowPopUp):
+        (WebCore::BindingSecurity::allowSettingFrameSrcToJavascriptUrl):
+        (WebCore::BindingSecurity::allowSettingSrcToJavascriptURL):
+        * bindings/generic/GenericBinding.h:
+        (WebCore::completeURL):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateDomainSafeFunctionGetter):
+        (GenerateNormalAttrGetter):
+        (GenerateReplaceableAttrSetter):
+        (GenerateFunctionCallback):
+        (GenerateImplementation):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::TestActiveDOMObjectV8Internal::excitingFunctionCallback):
+        (WebCore::TestActiveDOMObjectV8Internal::postMessageAttrGetter):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::contentDocumentAttrGetter):
+        (WebCore::TestObjV8Internal::getSVGDocumentCallback):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        * bindings/v8/BindingState.cpp: Renamed from Source/WebCore/bindings/v8/specialization/V8BindingState.cpp.
+        (WebCore):
+        (WebCore::BindingState::instance):
+        (WebCore::activeWindow):
+        (WebCore::firstWindow):
+        (WebCore::activeFrame):
+        (WebCore::firstFrame):
+        (WebCore::immediatelyReportUnsafeAccessTo):
+        * bindings/v8/BindingState.h: Renamed from Source/WebCore/bindings/v8/specialization/V8BindingState.h.
+        (WebCore):
+        (BindingState):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::canAccessFromCurrentOrigin):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::callingOrEnteredFrame):
+        (WebCore::completeURL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
+        (WebCore::V8DOMWindow::eventAccessorGetter):
+        (WebCore::V8DOMWindow::eventAccessorSetter):
+        (WebCore::V8DOMWindow::locationAccessorSetter):
+        (WebCore::V8DOMWindow::openerAccessorSetter):
+        (WebCore::V8DOMWindow::addEventListenerCallback):
+        (WebCore::V8DOMWindow::removeEventListenerCallback):
+        (WebCore::V8DOMWindow::showModalDialogCallback):
+        (WebCore::V8DOMWindow::openCallback):
+        (WebCore::V8DOMWindow::namedSecurityCheck):
+        (WebCore::V8DOMWindow::indexedSecurityCheck):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::V8Document::locationAccessorSetter):
+        * bindings/v8/custom/V8EntryCustom.cpp:
+        * bindings/v8/custom/V8EntrySyncCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::V8HTMLFrameElement::locationAccessorSetter):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::indexedSecurityCheck):
+        (WebCore::V8History::namedSecurityCheck):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::hashAccessorSetter):
+        (WebCore::V8Location::hostAccessorSetter):
+        (WebCore::V8Location::hostnameAccessorSetter):
+        (WebCore::V8Location::hrefAccessorSetter):
+        (WebCore::V8Location::pathnameAccessorSetter):
+        (WebCore::V8Location::portAccessorSetter):
+        (WebCore::V8Location::protocolAccessorSetter):
+        (WebCore::V8Location::searchAccessorSetter):
+        (WebCore::V8Location::reloadAccessorGetter):
+        (WebCore::V8Location::replaceAccessorGetter):
+        (WebCore::V8Location::assignAccessorGetter):
+        (WebCore::V8Location::reloadCallback):
+        (WebCore::V8Location::replaceCallback):
+        (WebCore::V8Location::assignCallback):
+        (WebCore::V8Location::toStringCallback):
+        (WebCore::V8Location::indexedSecurityCheck):
+        (WebCore::V8Location::namedSecurityCheck):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+
+2012-08-02  Abhishek Arya  <inferno@chromium.org>
+
+        No isChildAllowed checked when adding RenderFullScreen as the child..
+        https://bugs.webkit.org/show_bug.cgi?id=92995
+
+        Reviewed by Eric Seidel.
+
+        Test: fullscreen/fullscreen-child-not-allowed-crash.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::webkitWillEnterFullScreenForElement): pass the object's parent
+        pointer as an additional argument.
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRendererFactory::createRendererIfNeeded): pass the to be parent |parentRenderer|
+        as the argument. 
+        * rendering/RenderFullScreen.cpp:
+        (RenderFullScreen::wrapRenderer): make sure that parent allows RenderFullScreen as the child.
+        * rendering/RenderFullScreen.h: 
+        (RenderFullScreen): support the object's parent
+        pointer as an additional argument.
+
+2012-08-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Wrap shared context getters in WebKit API and avoid WebCore::GraphicsContext3D use in compositor internals
+        https://bugs.webkit.org/show_bug.cgi?id=92917
+
+        Reviewed by Adrienne Walker.
+
+        This uses Platform API wrappers to access the shared WebGraphicsContext3D / Ganesh contexts from the compositor
+        to evaluate accelerated filters or do accelerated painting.
+
+        Filters changes covered by css3/filters/*-hw.html layout tests.
+
+        * WebCore.gypi:
+        * platform/chromium/support/WebSharedGraphicsContext3D.cpp:
+        (WebKit):
+        (WebKit::WebSharedGraphicsContext3D::mainThreadContext):
+        (WebKit::WebSharedGraphicsContext3D::mainThreadGrContext):
+        (WebKit::WebSharedGraphicsContext3D::compositorThreadContext):
+        (WebKit::WebSharedGraphicsContext3D::compositorThreadGrContext):
+        (WebKit::WebSharedGraphicsContext3D::haveCompositorThreadContext):
+        (WebKit::WebSharedGraphicsContext3D::createCompositorThreadContext):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::createAcceleratedCanvas):
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
+        (WebKit):
+        (FrameBufferSkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::applyFilters):
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
+        (WebCore::CCRenderSurfaceFilters::apply):
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.h:
+        (WebKit):
+        (CCRenderSurfaceFilters):
+
+2012-08-02  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=93020
+        REGRESSION (tiled scrolling): Full-screen video is broken if page is 
+        scrolled
+        -and corresponding-
+        <rdar://problem/11629778>
+
+        Reviewed by Anders Carlsson.
+
+        The bug here is that ScrollingTreeNodeMac::setScrollLayerPosition() 
+        uses the CALayer (PlatformLayer) directly to set the position. That 
+        means that the GraphicsLayer that owns that PlatformLayer does not 
+        have updated position information. That results in this bug when we 
+        switch from fast scrolling to main thread scrolling, because at that 
+        point, the GraphicsLayer needs to have the correct information. So 
+        make sure to update the main thread scroll position and layer 
+        position before transitioning to main thread scrolling.
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+
+2012-08-02  Addy Osmani  <addyo@chromium.org>
+
+        Web Inspector: Rename 'User agent' to 'Overrides' in settings screen
+        https://bugs.webkit.org/show_bug.cgi?id=92990
+
+        Reviewed by Pavel Feldman.
+
+        Simple setting rename of User agent -> Overrides
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/SettingsScreen.js:
+
+2012-08-02  Philip Rogers  <pdr@google.com>
+
+        Do not dispatch modification events in SVG attribute synchronization
+        https://bugs.webkit.org/show_bug.cgi?id=92604
+
+        Reviewed by Ryosuke Niwa.
+
+        Previously, calling hasAttribute() during layout could hit a
+        layout-during-layout bug because calling hasAttribute() could dispatch a 
+        subtree modification event which could synchronously force a layout. hasAttribute()
+        exhibits this behavior because property synchronization is done lazily.
+
+        This patch skips dispatching subtree modification events during attribute
+        synchronization.
+
+        Additionally, this patch contains a refactoring of lazy attribute setting. We
+        now have a single place where lazy attributes are set (setSynchronizedLazyAttribute)
+        and lazy attribute flags have been moved to just Element and ElementAttributeData.
+
+        Test: svg/custom/path-domsubtreemodified-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::setSynchronizedLazyAttribute):
+        (WebCore):
+        (WebCore::Element::setAttributeInternal):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::addAttribute):
+        (WebCore::ElementAttributeData::removeAttribute):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateStyleAttribute):
+        * svg/properties/SVGAnimatedPropertyMacros.h:
+        (WebCore::SVGSynchronizableAnimatedProperty::synchronize):
+
+2012-08-02  Konrad Piascik  <kpiascik@rim.com>
+
+        Web Inspector: Override the DeviceOrientation
+        https://bugs.webkit.org/show_bug.cgi?id=91008
+
+        Reviewed by Pavel Feldman.
+
+        Re-added the m_page member variable to DeviceOrientationController and
+        added InspectorInstrumentation to see if the DeviceOrientationData
+        should be overridden or not.
+
+        Added UI to the web inspector front-end to allow users to override the
+        device orientation.  This is currently hidden behind an experiment.
+
+        Test: inspector/device-orientation-success.html
+
+        * English.lproj/localizedStrings.js:
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::DeviceOrientationController::DeviceOrientationController):
+        (WebCore::DeviceOrientationController::create):
+        (WebCore::DeviceOrientationController::didChangeDeviceOrientation):
+        (WebCore::provideDeviceOrientationTo):
+        * dom/DeviceOrientationController.h:
+        (DeviceOrientationController):
+        * inspector/Inspector.json:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::overrideDeviceOrientationImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore):
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::overrideDeviceOrientation):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::setDeviceOrientationOverride):
+        (WebCore):
+        (WebCore::InspectorPageAgent::clearDeviceOrientationOverride):
+        (WebCore::InspectorPageAgent::canOverrideDeviceOrientation):
+        (WebCore::InspectorPageAgent::overrideDeviceOrientation):
+        * inspector/InspectorPageAgent.h:
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.UserAgentSettingsTab):
+        (WebInspector.UserAgentSettingsTab.prototype._createInput):
+        (WebInspector.UserAgentSettingsTab.prototype._createDeviceMetricsElement):
+        (WebInspector.UserAgentSettingsTab.prototype._createGeolocationOverrideElement):
+        (WebInspector.UserAgentSettingsTab.prototype._onDeviceOrientationOverrideCheckboxClicked):
+        (WebInspector.UserAgentSettingsTab.prototype._applyDeviceOrientationUserInput):
+        (WebInspector.UserAgentSettingsTab.prototype._setDeviceOrientation.set if):
+        (WebInspector.UserAgentSettingsTab.prototype._setDeviceOrientation):
+        (WebInspector.UserAgentSettingsTab.prototype._createDeviceOrientationOverrideElement):
+        * inspector/front-end/UserAgentSupport.js:
+        (WebInspector.UserAgentSupport.DeviceOrientation):
+        (WebInspector.UserAgentSupport.DeviceOrientation.prototype.toSetting):
+        (WebInspector.UserAgentSupport.DeviceOrientation.parseSetting):
+        (WebInspector.UserAgentSupport.DeviceOrientation.parseUserInput):
+        (WebInspector.UserAgentSupport.DeviceOrientation.clearDeviceOrientationOverride):
+        * inspector/front-end/inspector.js:
+        (WebInspector.doLoadedDone):
+
+2012-08-02  Arnaud Renevier  <a.renevier@sisa.samsung.com>
+
+        TypedArray set method is slow when called with another typed array
+        https://bugs.webkit.org/show_bug.cgi?id=92556
+
+        Reviewed by Kenneth Russell.
+
+        When setting multiples values to a typed array from an array like
+        element, try to determine if the argument is a typed array. If so,
+        cast the argument to a typed array, and read each element with .item()
+        method. That avoid reading the value as a JSValue, and speedups set
+        method by approximatively 10x.
+
+        Introduce setWebGLArrayWithTypedArrayArgument template function which
+        checks if argument is a typed array. If so, it copies the data to
+        target typed array and returns true. Otherwise, it returns false.
+
+        Introduce copyTypedArrayBuffer template function which copies data
+        from a typed array to another one. This function is also used from
+        constructArrayBufferViewWithTypedArrayArgument.
+
+        * bindings/js/JSArrayBufferViewHelper.h:
+        (WebCore):
+        (WebCore::copyTypedArrayBuffer):
+        (WebCore::setWebGLArrayWithTypedArrayArgument):
+        (WebCore::setWebGLArrayHelper):
+        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
+        * bindings/js/JSFloat32ArrayCustom.cpp:
+        (WebCore::JSFloat32Array::set):
+        * bindings/js/JSFloat64ArrayCustom.cpp:
+        (WebCore::JSFloat64Array::set):
+        * bindings/js/JSInt16ArrayCustom.cpp:
+        (WebCore::JSInt16Array::set):
+        * bindings/js/JSInt32ArrayCustom.cpp:
+        (WebCore::JSInt32Array::set):
+        * bindings/js/JSInt8ArrayCustom.cpp:
+        (WebCore::JSInt8Array::set):
+        * bindings/js/JSUint16ArrayCustom.cpp:
+        (WebCore::JSUint16Array::set):
+        * bindings/js/JSUint32ArrayCustom.cpp:
+        (WebCore::JSUint32Array::set):
+        * bindings/js/JSUint8ArrayCustom.cpp:
+        (WebCore::JSUint8Array::set):
+        * bindings/js/JSUint8ClampedArrayCustom.cpp:
+        (WebCore::JSUint8ClampedArray::set):
+
+2012-08-02  Chris Fleizach  <cfleizach@apple.com>
+
+        AXEnabled = false for AXIncrementors inside text fields
+        https://bugs.webkit.org/show_bug.cgi?id=93008
+
+        Reviewed by Anders Carlsson.
+
+        Mock objects should return "enabled" by default, since they are valid objects.
+
+        * accessibility/AccessibilityMockObject.h:
+        (WebCore::AccessibilityMockObject::isEnabled):
+        (AccessibilityMockObject):
+
+2012-08-02  Eric Seidel  <eric@webkit.org>
+
+        Add back ASSERT(!needsLayout) to RenderTableSection which is now valid
+        https://bugs.webkit.org/show_bug.cgi?id=92954
+
+        Reviewed by Julien Chaffraix.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paint):
+
+2012-08-02  Kevin Ellis  <kevers@chromium.org>
+
+        Month-year selector on calendar picker should be touch friendly.
+        https://bugs.webkit.org/show_bug.cgi?id=92678
+
+        Reviewed by Kent Tamura.
+
+        Previously the month-year popup menu was implemented using a listbox,
+        which does not support CSS customization.  Entries in the listbox
+        were too shallow to reliably target with touch gestures.  The
+        replacement popup is CSS configurable with larger entries on devices
+        that support touch input.
+
+        Manually tested with and without touch support in English, Japanese
+        and Arabic.
+
+        * Resources/calendarPicker.css:
+        (.month-selector-popup): Update to use scrollable div instead of listbox.
+        (.month-selector-popup-contents): Render popup as a table within a scrollable div.
+        (.month-selector-popup-entry): Formatting entries in the month-year popup.
+        (.selected-month-year): Highlight the selected month-year.
+        (@media (pointer:coarse)): Enlarge entries in the popup meu on devices that support touch.
+        * Resources/calendarPicker.js:
+        (YearMonthController.prototype.attachTo): Change selector popup from a list-box to a div.
+        (YearMonthController.prototype._redraw): Populate table based popup rather than listbox.
+        (YearMonthController.prototype._showPopup): Set scroll position and resize for scrollbar.
+        (YearMonthController.prototype._closePopup): Restore focus to the calendar.
+        (YearMonthController.prototype._getSelection): Added to retrieve the selected month-year.
+        (YearMonthController.prototype._handleMouseMove): Added to update selected month-year on hover.
+        (YearMonthController.prototype._handleMonthPopupKey): Add keyboard navigation.
+        (YearMonthController.prototype._handleYearMonthChange): Retrieve value from selected month-year.
+
+2012-08-02  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Regression] context menu does not open on Sources panel tabs on mac
+        https://bugs.webkit.org/show_bug.cgi?id=93000
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/UIUtils.js:
+        (WebInspector._elementDragStart):
+
+2012-08-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Check if the last table element's parent node is an element when determining the foster parent element.
+        https://bugs.webkit.org/show_bug.cgi?id=92977
+
+        Reviewed by Adam Barth.
+
+        According to the HTML5 spec, if the last table element in the stack of open elements has no parent,
+        or ITS PARENT NODE IS NOT AN ELEMENT, then the foster parent element is the element
+        before the last table element in the stack of open elements.
+
+        Changed to check if the table element's parent node is an element.
+
+        Test: fast/parser/foster-parent.html
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::findFosterSite):
+
+2012-08-02  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] Use GST_DEBUG instead of LOG_VERBOSE
+        https://bugs.webkit.org/show_bug.cgi?id=89350
+
+        Reviewed by Martin Robinson.
+
+        Wrap the media player's logging calls to a new macro that also
+        hooks into GStreamer's logging facilities. This way the developer
+        gets the best of both worlds, leaving the choice between GST_DEBUG
+        and WEBKIT_DEBUG environment variables.
+
+        * platform/graphics/gstreamer/GStreamerUtilities.h:
+        (WebCore):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::initializeGStreamerAndRegisterWebKitElements):
+        (WebCore::MediaPlayerPrivateGStreamer::load):
+        (WebCore::MediaPlayerPrivateGStreamer::commitLoad):
+        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition):
+        (WebCore::MediaPlayerPrivateGStreamer::play):
+        (WebCore::MediaPlayerPrivateGStreamer::pause):
+        (WebCore::MediaPlayerPrivateGStreamer::duration):
+        (WebCore::MediaPlayerPrivateGStreamer::seek):
+        (WebCore::MediaPlayerPrivateGStreamer::naturalSize):
+        (WebCore::MediaPlayerPrivateGStreamer::setRate):
+        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):
+        (WebCore::MediaPlayerPrivateGStreamer::processBufferingStats):
+        (WebCore::MediaPlayerPrivateGStreamer::fillTimerFired):
+        (WebCore::MediaPlayerPrivateGStreamer::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivateGStreamer::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivateGStreamer::didLoadingProgress):
+
+2012-08-02  Antti Koivisto  <antti@apple.com>
+
+        Inline stylesheets can confuse style sharing
+        https://bugs.webkit.org/show_bug.cgi?id=92970
+
+        Reviewed by Dan Bernstein.
+
+        Consider document 
+        
+        <div class="i30"></div>
+        <style>.i30 { background-color:green; }</style>
+        <div class="i30"></div>
+        
+        When processing the <style> element the scope optimization marks the first div as needing style recalc. 
+        Next the parser adds the second div to the tree and immediately calculates its style. Since it looks exactly 
+        like the first div the style sharing optimization copies the style from there. The pending recalc of the
+        first div is resolved by a timer but the second div is left with the old style.
+        
+        Fix by disallowing style sharing from elements with pending style recalc.
+
+        Test: fast/css/style-sharing-inline-stylesheet.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::canShareStyleWithElement):
+
+2012-08-02  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Add RTCPeerConnectionHandler infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=92866
+
+        Reviewed by Adam Barth.
+
+        Introducing RTCPeerConnectionHandler & RTCPeerConnectionHandlerClient,
+        together with the Chromium WebKit interface, following the pattern of
+        the previous PeerConnection00Handler but with the optimizations from MediaStreamCenter.
+
+        Not yet testable due to not enough code landed.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/mediastream/RTCPeerConnection.cpp:
+        (WebCore::RTCPeerConnection::create):
+        (WebCore::RTCPeerConnection::RTCPeerConnection):
+        * Modules/mediastream/RTCPeerConnection.h:
+        (RTCPeerConnection):
+        * WebCore.gypi:
+        * platform/mediastream/RTCPeerConnectionHandler.cpp: Added.
+        (WebCore):
+        (RTCPeerConnectionHandlerDummy):
+        (WebCore::RTCPeerConnectionHandler::create):
+        (WebCore::RTCPeerConnectionHandlerDummy::RTCPeerConnectionHandlerDummy):
+        (WebCore::RTCPeerConnectionHandlerDummy::~RTCPeerConnectionHandlerDummy):
+        (WebCore::RTCPeerConnectionHandlerDummy::initialize):
+        * platform/mediastream/RTCPeerConnectionHandler.h: Copied from Source/WebCore/Modules/mediastream/RTCPeerConnection.h.
+        (WebCore):
+        (RTCPeerConnectionHandler):
+        (WebCore::RTCPeerConnectionHandler::~RTCPeerConnectionHandler):
+        (WebCore::RTCPeerConnectionHandler::RTCPeerConnectionHandler):
+        * platform/mediastream/RTCPeerConnectionHandlerClient.h: Copied from Source/WebCore/Modules/mediastream/RTCPeerConnection.h.
+        (WebCore):
+        (RTCPeerConnectionHandlerClient):
+        (WebCore::RTCPeerConnectionHandlerClient::~RTCPeerConnectionHandlerClient):
+        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp: Added.
+        (WebCore):
+        (WebCore::RTCPeerConnectionHandler::create):
+        (WebCore::RTCPeerConnectionHandlerChromium::RTCPeerConnectionHandlerChromium):
+        (WebCore::RTCPeerConnectionHandlerChromium::~RTCPeerConnectionHandlerChromium):
+        (WebCore::RTCPeerConnectionHandlerChromium::initialize):
+        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h: Added.
+        (WebCore):
+        (RTCPeerConnectionHandlerChromium):
+
+2012-08-02  Kent Tamura  <tkent@chromium.org>
+
+        Move number localization code in LocaleICU.cpp to new class
+        https://bugs.webkit.org/show_bug.cgi?id=92976
+
+        Reviewed by Kentaro Hara.
+
+        The number localization code by character mapping is usefull for non-ICU
+        platforms.
+
+        No new tests. This is just a refactoring, and is covered by
+        Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp.
+
+        * WebCore.gypi: Add NumberLocalizer.{cpp,h}.
+        * platform/text/LocaleICU.cpp:
+        (WebCore::LocaleICU::decimalSymbol):
+        Renamed from setDecimalSymbol. This function returns the resultant
+        string instead of setting it to a data member.
+        (WebCore::LocaleICU::decimalTextAttribute):
+        Renamed from setDecimalTextAttributel. This function returns the
+        resultant string instead of setting it to the specified string.
+        (WebCore::LocaleICU::initializeNumberLocalizerData):
+        Renamed from initializeDecimalFormat.
+        Calls NumberLocaizer::setNumberLocalizerData.
+        (WebCore::LocaleICU::localizedDecimalSeparator):
+        Rename initializeDecimalFormat to initializeNumberLocalizerData.
+        * platform/text/LocaleICU.h:
+        (LocaleICU): Remove some members, and inherit NumberLocalizer.
+        * platform/text/NumberLocalizer.cpp: Added. Move the code from LocaleICU.cpp
+        (WebCore):
+        (WebCore::NumberLocalizer::~NumberLocalizer):
+        (WebCore::NumberLocalizer::setNumberLocalizerData): Added.
+        (WebCore::NumberLocalizer::convertToLocalizedNumber):
+        (WebCore::matches):
+        (WebCore::NumberLocalizer::detectSignAndGetDigitRange):
+        (WebCore::NumberLocalizer::matchedDecimalSymbolIndex):
+        (WebCore::NumberLocalizer::convertFromLocalizedNumber):
+        (WebCore::NumberLocalizer::localizedDecimalSeparator):
+        * platform/text/NumberLocalizer.h: Added.
+        (NumberLocalizer):
+        (WebCore::NumberLocalizer::NumberLocalizer):
+
+2012-08-02  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Move DOM breakpoints-related context menu items into a submenu
+        https://bugs.webkit.org/show_bug.cgi?id=92989
+
+        Reviewed by Vsevolod Vlasov.
+
+        A "Break on..." submenu is added to the element context menu, to host all DOM breakpoint items.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DOMBreakpointsSidebarPane.js:
+        (WebInspector.DOMBreakpointsSidebarPane):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype.populateNodeContextMenu):
+
+2012-08-02  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        [Cairo] Add complex font drawing using HarfbuzzNG
+        https://bugs.webkit.org/show_bug.cgi?id=91864
+
+        Reviewed by Martin Robinson.
+
+        Unfortunately the Freetype based approach that avoids allocations and UTF8 conversion
+        fails to produce correct results for some tests.
+
+        No new tests, at least
+          fast/dom/52776.html
+          fast/text/atsui-negative-spacing-features.html
+          fast/text/atsui-spacing-features.html
+        expose this problem.
+
+        * platform/graphics/harfbuzz/ng/HarfBuzzNGFaceCairo.cpp:
+        (WebCore::harfbuzzGetGlyph): Revert to initial cairo_scaled_font based approach.
+
+2012-08-02  Eugene Klyuchnikov  <eustas.big@gmail.com>
+
+        Web Inspector: Fix protocol version check.
+        https://bugs.webkit.org/show_bug.cgi?id=91497
+
+        Reviewed by Pavel Feldman.
+
+        Generated method 'supportsInspectorProtocolVersion' should return
+        false when requested  minor version is *greater* than actual
+        minor version.
+
+        * inspector/generate-inspector-protocol-version: Fixed stub text
+
+2012-08-02  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: count RenderStyle objects in the native memory profiler
+        https://bugs.webkit.org/show_bug.cgi?id=91759
+
+        Reviewed by Yury Semikhatsky.
+
+        The patch adds instrumentation to the following classes:
+          - RenderStyle
+          - StyleRareInheritedData
+          - StyleRareNonInheritedData
+
+        * bindings/js/ScriptWrappable.h:
+        * bindings/v8/ScriptWrappable.h:
+        * dom/MemoryInstrumentation.h:
+        (WebCore):
+        (WebCore::MemoryInstrumentation::OwningTraits::addObject):
+        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
+        (WebCore::MemoryInstrumentation::addObjectImpl):
+        * dom/Node.cpp:
+        (WebCore::Node::reportMemoryUsage):
+        * dom/Node.h:
+        (WebCore):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::reportMemoryUsage):
+        (WebCore):
+        * rendering/style/RenderStyle.h:
+        (WebCore):
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::reportMemoryUsage):
+        (WebCore):
+        * rendering/style/StyleRareInheritedData.h:
+        (WebCore):
+        (StyleRareInheritedData):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::reportMemoryUsage):
+        (WebCore):
+        * rendering/style/StyleRareNonInheritedData.h:
+        (WebCore):
+        (StyleRareNonInheritedData):
+
+2012-08-02  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: rename host->origin in the inspector protocol DOMStorage entry
+        https://bugs.webkit.org/show_bug.cgi?id=92979
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorageDispatcher.prototype.addDOMStorage):
+
+2012-08-02  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        [EFL] Change return value of battey level
+        https://bugs.webkit.org/show_bug.cgi?id=92964
+
+        Reviewed by Simon Hausmann.
+
+        Change return value of navigator.webkitBattery.level from 0~100 to 0~1.0.
+        Battery level have to returns 0~1.0 by Battery Status API spec.
+
+        * platform/efl/BatteryProviderEfl.cpp:
+        (WebCore::BatteryProviderEfl::setBatteryClient):
+
+2012-08-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: remove extraObjectSize parameter from MemoryClassInfo constructor
+        https://bugs.webkit.org/show_bug.cgi?id=92981
+
+        Reviewed by Alexander Pavlov.
+
+        Refactored MemoryInstrumentation to get rid of extraSize parameter from
+        MemoryObjectInfo constructor and MemoryObjectInfo::reportObjectInfo. The
+        extra size should always be reported as an object that occupies these extra
+        bytes.
+
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::reportMemoryUsage):
+        (WebCore):
+        * dom/ElementAttributeData.h:
+        (WebCore):
+        (ElementAttributeData):
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryObjectInfo::reportObjectInfo):
+        (WebCore::MemoryClassInfo::MemoryClassInfo):
+
+2012-08-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124439.
+        http://trac.webkit.org/changeset/124439
+        https://bugs.webkit.org/show_bug.cgi?id=92980
+
+        Broke Chromium Mac Release compile (Requested by apavlov on
+        #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/mediastream/RTCPeerConnection.cpp:
+        (WebCore::RTCPeerConnection::create):
+        (WebCore::RTCPeerConnection::RTCPeerConnection):
+        * Modules/mediastream/RTCPeerConnection.h:
+        * WebCore.gypi:
+        * platform/mediastream/RTCPeerConnectionHandler.cpp: Removed.
+        * platform/mediastream/RTCPeerConnectionHandler.h: Removed.
+        * platform/mediastream/RTCPeerConnectionHandlerClient.h: Removed.
+        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp: Removed.
+        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h: Removed.
+
+2012-08-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Uninitialized memory read in QObject runtime bridge
+        https://bugs.webkit.org/show_bug.cgi?id=92972
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The vargs array has an initial size of 0 and when calling a method with no return value
+        and no arguments, vargs remains empty. Therefore unconditional access to vargs[0] results
+        in access to uninitialized memory.
+
+        No new tests, covered by valgrind in existing qobjectbridge tests.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+
+2012-08-02  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Alignment issue for readTime in PluginDatabase.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=92746
+
+        Reviewed by Simon Hausmann.
+
+        When the byte stream is written, nothing guarantees that
+        the time_t data is aligned. This issue caused alignment
+        traps on ARM CPUs.
+
+        No new tests. Covered by existing tests.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::readTime):
+
+2012-08-02  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Add RTCPeerConnectionHandler infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=92866
+
+        Reviewed by Kentaro Hara.
+
+        Introducing RTCPeerConnectionHandler & RTCPeerConnectionHandlerClient,
+        together with the Chromium WebKit interface, following the pattern of
+        the previous PeerConnection00Handler but with the optimizations from MediaStreamCenter.
+
+        Not yet testable due to not enough code landed.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/mediastream/RTCPeerConnection.cpp:
+        (WebCore::RTCPeerConnection::create):
+        (WebCore::RTCPeerConnection::RTCPeerConnection):
+        * Modules/mediastream/RTCPeerConnection.h:
+        (RTCPeerConnection):
+        * WebCore.gypi:
+        * platform/mediastream/RTCPeerConnectionHandler.cpp: Added.
+        (WebCore):
+        (RTCPeerConnectionHandlerDummy):
+        (WebCore::RTCPeerConnectionHandler::create):
+        (WebCore::RTCPeerConnectionHandlerDummy::RTCPeerConnectionHandlerDummy):
+        (WebCore::RTCPeerConnectionHandlerDummy::~RTCPeerConnectionHandlerDummy):
+        (WebCore::RTCPeerConnectionHandlerDummy::initialize):
+        * platform/mediastream/RTCPeerConnectionHandler.h: Copied from Source/WebCore/Modules/mediastream/RTCPeerConnection.h.
+        (WebCore):
+        (RTCPeerConnectionHandler):
+        (WebCore::RTCPeerConnectionHandler::~RTCPeerConnectionHandler):
+        (WebCore::RTCPeerConnectionHandler::RTCPeerConnectionHandler):
+        * platform/mediastream/RTCPeerConnectionHandlerClient.h: Copied from Source/WebCore/Modules/mediastream/RTCPeerConnection.h.
+        (WebCore):
+        (RTCPeerConnectionHandlerClient):
+        (WebCore::RTCPeerConnectionHandlerClient::~RTCPeerConnectionHandlerClient):
+        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp: Added.
+        (WebCore):
+        (WebCore::RTCPeerConnectionHandler::create):
+        (WebCore::RTCPeerConnectionHandlerChromium::RTCPeerConnectionHandlerChromium):
+        (WebCore::RTCPeerConnectionHandlerChromium::~RTCPeerConnectionHandlerChromium):
+        (WebCore::RTCPeerConnectionHandlerChromium::initialize):
+        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h: Added.
+        (WebCore):
+        (RTCPeerConnectionHandlerChromium):
+
+2012-08-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: rename reportMemoryUsage to reportDescendantMemoryUsage in StyleRuleBase descendants
+        https://bugs.webkit.org/show_bug.cgi?id=92966
+
+        Reviewed by Alexander Pavlov.
+
+        Renamed reportMemoryUsage to reportDescendantMemoryUsage in all descendants of
+        StyleRuleBase to avoid accidental recursive calls to StyleRuleBase::reportMemoryUsage
+        when a new type of rule is added.
+
+        * css/StyleRule.cpp:
+        (WebCore::StyleRuleBase::reportMemoryUsage):
+        (WebCore::StyleRule::reportDescendantMemoryUsage):
+        (WebCore::StyleRulePage::reportDescendantMemoryUsage):
+        (WebCore::StyleRuleFontFace::reportDescendantMemoryUsage):
+        (WebCore::StyleRuleBlock::reportDescendantMemoryUsage):
+        (WebCore::StyleRuleMedia::reportDescendantMemoryUsage):
+        (WebCore::StyleRuleRegion::reportDescendantMemoryUsage):
+        * css/StyleRule.h:
+        (StyleRule):
+        (StyleRuleFontFace):
+        (StyleRulePage):
+        (StyleRuleBlock):
+        (StyleRuleMedia):
+        (StyleRuleRegion):
+        * css/StyleRuleImport.cpp:
+        (WebCore::StyleRuleImport::reportDescendantMemoryUsage):
+        * css/StyleRuleImport.h:
+        (StyleRuleImport):
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::StyleRuleKeyframes::reportDescendantMemoryUsage):
+        * css/WebKitCSSKeyframesRule.h:
+        (StyleRuleKeyframes):
+
+2012-08-02  Hironori Bono  <hbono@chromium.org>
+
+        [Chromium] Implement hyphenation for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=48610
+
+        Reviewed by Eric Seidel.
+
+        This change adds a couple of methods canHyphenate and computeLastHyphenLocation
+        to Platform so Chromium can implement them. Also, this change uses these methods
+        to implement the hyphenation methods of WebCore. (This change does not change
+        any behaviors until Chromium implements these methods.)
+
+        No new tests because this change is for fixing a couple of existing layout tests
+        'fast/text/hyphenate-character.html' and 'fast/text/hyphens.html'.
+
+        * WebCore.gypi:
+        * platform/text/chromium/Hyphenation.cpp: Added.
+        (WebCore):
+        (WebCore::canHyphenate): Called Platform::canHyphenation().
+        (WebCore::lastHyphenLocation): Called Platform::computeLastHyphenLocation().
+
+2012-08-02  ulan@chromium.org  <ulan@chromium.org>
+
+        [chromium] Improve garbage collector hint if page uses Canvas contexts
+        https://bugs.webkit.org/show_bug.cgi?id=92856
+
+        Reviewed by Kentaro Hara.
+
+        Request GC by sending context disposed and idle notification to V8 instead
+        of sending low memory notification. It is faster as it causes one GC
+        instead of seven GCs caused by low memory notification.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::V8BindingPerIsolateData::V8BindingPerIsolateData):
+        * bindings/v8/V8Binding.h:
+        (V8BindingPerIsolateData):
+        (WebCore::V8BindingPerIsolateData::setShouldCollectGarbageSoon):
+        (WebCore::V8BindingPerIsolateData::clearShouldCollectGarbageSoon):
+        (WebCore::V8BindingPerIsolateData::shouldCollectGarbageSoon):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::hintForGCIfNecessary):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+
+2012-08-02  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        CSSRegions: Crash when reattaching a region to a named flow.
+        https://bugs.webkit.org/show_bug.cgi?id=91307
+
+        Reviewed by Abhishek Arya.
+
+        The lifetime of a flow thread  has changed from not being destroyed (until the RenderView is destroyed) to being destroyed,
+        under certain conditions, no attached regions and no content, before RenderView is destroyed.
+        When the flow thread does not have any content and the region to be detached is the last region for the flow thread,
+        the flow thread is destroyed.
+        In this case, if the same region has to be attached again to the flow thread, the flow thread needs to be
+        recreated, otherwise the crash will result.
+
+        Test: fast/regions/region-flow-reattach-crash.html
+
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::attachRegion):
+        We skip the attach if we are in the middle of document destruction.
+        We recreate the flow thread to which the region is intended to be attached only if the region was
+        not previously marked as invalid in relation to the flow thread (because the region was part of a
+        circular dependency).
+        (WebCore::RenderRegion::detachRegion): After the region is detached from flow thread,
+        null the region internal pointer to the flow thread to mark that the region is not
+        attached.
+
+2012-08-02  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Move RTCConfiguration to its proper place
+        https://bugs.webkit.org/show_bug.cgi?id=92867
+
+        Reviewed by Adam Barth.
+
+        This patch moves RTCConfiguration to Source/WebCore/platform/mediastream,
+        and adds its WebKit interface for chromium.
+
+        No functional code changes.
+
+        * GNUmakefile.list.am:
+        * Modules/mediastream/RTCPeerConnection.cpp:
+        * WebCore.gypi:
+        * platform/chromium/support/WebRTCConfiguration.cpp: Added.
+        (WebKit):
+        (WebKit::WebRTCICEServer::WebRTCICEServer):
+        (WebKit::WebRTCICEServer::assign):
+        (WebKit::WebRTCICEServer::reset):
+        (WebKit::WebRTCICEServer::uri):
+        (WebKit::WebRTCICEServer::credential):
+        (WebKit::WebRTCConfiguration::WebRTCConfiguration):
+        (WebKit::WebRTCConfiguration::assign):
+        (WebKit::WebRTCConfiguration::reset):
+        (WebKit::WebRTCConfiguration::numberOfServers):
+        (WebKit::WebRTCConfiguration::server):
+        * platform/mediastream/RTCConfiguration.h: Added.
+        (WebCore):
+        (RTCIceServer):
+        (WebCore::RTCIceServer::create):
+        (WebCore::RTCIceServer::~RTCIceServer):
+        (WebCore::RTCIceServer::uri):
+        (WebCore::RTCIceServer::credential):
+        (WebCore::RTCIceServer::RTCIceServer):
+        (RTCConfiguration):
+        (WebCore::RTCConfiguration::create):
+        (WebCore::RTCConfiguration::~RTCConfiguration):
+        (WebCore::RTCConfiguration::appendServer):
+        (WebCore::RTCConfiguration::numberOfServers):
+        (WebCore::RTCConfiguration::server):
+        (WebCore::RTCConfiguration::RTCConfiguration):
+
+2012-08-02  Alexander Shalamov  <alexander.shalamov@intel.com>
+
+        [EFL] Browser crashes when non-progress element with -webkit-appearance:progress-bar is rendered
+        https://bugs.webkit.org/show_bug.cgi?id=92747
+
+        Reviewed by Hajime Morita.
+
+        When https://bugs.webkit.org/show_bug.cgi?id=40158 was fixed, all ports
+        were fixed except EFL port. This patch fixes assert that is hit when
+        non-progress element is rendered with -webkit-appearance:progress-bar style.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::paintProgressBar):
+
+2012-08-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        REGRESSION(r102741): [Forms] In selects, when disabled, browser skips first option if not in optgroup, then selects first option in optgroup
+        https://bugs.webkit.org/show_bug.cgi?id=92833
+
+        Reviewed by Kent Tamura.
+
+        This patch changes implementation of HTMLOptionElement::disabled() to
+        follow the "disabled" concept of option element in HTML5 specification[1],
+        the option element is disabled if option element has "disabled"
+        attribute or parent optgroup element has "disabled" attribute. Before
+        this patch, HTMLOptionElement::disabled() checks presenting "disabled"
+        attribute in option element itself and any parent element.
+
+        Before this patch, HTMLSelectElement::recalcListItems() didn't considers
+        non-disabled option as default selected option if select element is
+        disabled because HTMLOptionElement::disabled() returned true if select
+        element is disabled.
+
+        After this patch, HTMLOptionElement::disabled() is independent from
+        select element. HTMLSelectElement::recalcListItems() considers
+        non-disabled option as default selected option.
+
+        [1] http://www.whatwg.org/specs/web-apps/current-work/multipage/the-button-element.html#concept-option-disabled
+
+        Tests: fast/forms/basic-selects.html: Fixed expectation to right thing.
+
+        * css/html.css:
+        (select[disabled]>option): Added to render option elements in disabled
+        select element to disabled color as before this patch.
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::disabled): Changed to check parent element
+        is optgroup.
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler): On mouse up
+        and down, don't update selection if select element is disabled.
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground): Added checking select
+        element is disabled. Before this patch, it was done by HTMLOptionElement::disabled().
+
+2012-08-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124406.
+        http://trac.webkit.org/changeset/124406
+        https://bugs.webkit.org/show_bug.cgi?id=92951
+
+        it set the Mac bots on fire (Requested by pizlo on #webkit).
+
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        (WebCore::ScriptDebugServer::hasBreakpoint):
+        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::callEvent):
+        (WebCore::ScriptDebugServer::atStatement):
+        (WebCore::ScriptDebugServer::returnEvent):
+        (WebCore::ScriptDebugServer::exception):
+        (WebCore::ScriptDebugServer::willExecuteProgram):
+        (WebCore::ScriptDebugServer::didExecuteProgram):
+        (WebCore::ScriptDebugServer::didReachBreakpoint):
+        * bindings/js/ScriptDebugServer.h:
+        (ScriptDebugServer):
+
+2012-08-01  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: test native memory instrumentation code with help of unittests
+        https://bugs.webkit.org/show_bug.cgi?id=92743
+
+        Reviewed by Yury Semikhatsky.
+
+        Test a part of existing Native Memory Instrumentation code with help of unit tests.
+        6 tests were added and two bugs were fixed.
+        a drive-by improvement: the method MemoryInstrumentation::addInstrumentedObject
+        was marked as private and addRootObject was introduced instead of it.
+        The new function also calls processDeferedPointers.
+
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryInstrumentation::addRootObject):
+        (MemoryInstrumentation):
+        (WebCore::MemoryInstrumentation::addInstrumentedObject):
+        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
+        (WebCore):
+        (WebCore::MemoryInstrumentation::addObjectImpl):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+        * inspector/MemoryInstrumentationImpl.h:
+        (MemoryInstrumentationImpl):
+        (WebCore::MemoryInstrumentationImpl::totalSize):
+        (WebCore::MemoryInstrumentationImpl::reportedSizeForAllTypes):
+
+2012-08-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Chromium Android build fix after r124402.
+        Initialize the out variables as suggested by the compiler.
+
+        * Modules/indexeddb/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::DatabaseFreeListKey::decode):
+        (WebCore::IDBLevelDBCoding::DatabaseNameKey::decode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::decode):
+        (WebCore::IDBLevelDBCoding::IndexMetaDataKey::decode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreFreeListKey::decode):
+        (WebCore::IDBLevelDBCoding::IndexFreeListKey::decode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreNamesKey::decode):
+        (WebCore::IDBLevelDBCoding::IndexNamesKey::decode):
+
+2012-08-01  Keishi Hattori  <keishi@webkit.org>
+
+        Fix typo in colorSuggestionPicker.js
+        https://bugs.webkit.org/show_bug.cgi?id=92936
+
+        Reviewed by Kent Tamura.
+
+        Fixes typo.
+
+        Test: platform/chromium/fast/forms/color/color-suggestion-picker-with-scrollbar-appearance.html
+
+        * Resources/colorSuggestionPicker.js:
+        (getScrollbarWidth):
+
+2012-08-01  Shinya Kawanaka  <shinyak@chromium.org>
+
+        The elements in Shadow DOM of input should not be modifiable.
+        https://bugs.webkit.org/show_bug.cgi?id=92200
+
+        Reviewed by Kent Tamura.
+
+        Since we don't have "-webkit-user-modify: read-only !important;" for the elements in Shadow DOM of
+        input element, user can change them and it causes a crash.
+
+        We should have "-webkit-user-modify: read-only !important;" for those elements.
+
+        Test: fast/forms/input-user-modify.html
+
+        * css/html.css:
+        (input::-webkit-textfield-decoration-container):
+        (input[type="search"]::-webkit-search-cancel-button):
+        (input[type="search"]::-webkit-search-decoration):
+        (input[type="search"]::-webkit-search-results-decoration):
+        (input[type="search"]::-webkit-search-results-button):
+        (input::-webkit-inner-spin-button):
+        (input::-webkit-input-speech-button):
+        (input::-webkit-input-placeholder, isindex::-webkit-input-placeholder):
+        (input[type="file"]::-webkit-file-upload-button):
+        (input[type="range"]::-webkit-slider-container, input[type="range"]::-webkit-media-slider-container):
+        (input[type="range"]::-webkit-slider-runnable-track):
+        (input[type="range"]::-webkit-slider-thumb, input[type="range"]::-webkit-media-slider-thumb):
+        (input[type="color"]::-webkit-color-swatch-wrapper):
+        (input[type="color"]::-webkit-color-swatch):
+        (input::-webkit-calendar-picker-indicator):
+
+2012-08-01  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: [JSC] implement setting breakpoints by line:column
+        https://bugs.webkit.org/show_bug.cgi?id=53003
+
+        Reviewed by Geoffrey Garen.
+
+        As JSC is enabled to provide column info of statement, ScriptDebugServer can use it to
+        support "Pretty Print" debug mode.
+
+        No new test case for this patch.
+
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        (WebCore):
+        (WebCore::ScriptDebugServer::updateCurrentStatementPosition):
+        (WebCore::ScriptDebugServer::hasBreakpoint):
+        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::callEvent):
+        (WebCore::ScriptDebugServer::atStatement):
+        (WebCore::ScriptDebugServer::returnEvent):
+        (WebCore::ScriptDebugServer::exception):
+        (WebCore::ScriptDebugServer::willExecuteProgram):
+        (WebCore::ScriptDebugServer::didExecuteProgram):
+        (WebCore::ScriptDebugServer::didReachBreakpoint):
+        * bindings/js/ScriptDebugServer.h:
+        (ScriptDebugServer):
+
+2012-08-01  Xingnan Wang  <xingnan.wang@intel.com>
+
+        IndexedDB: ObjectStoreMetaDataKey::m_metaDataType should use byte type
+        https://bugs.webkit.org/show_bug.cgi?id=92725
+
+        Reviewed by Kentaro Hara.
+
+        No new tests - Low level functions covered by existing layout tests and also covered by Chromium
+        webkit_unit_tests IDBLevelIDBCodingTest.*.
+
+        * Modules/indexeddb/IDBLevelDBCoding.cpp:
+        (IDBLevelDBCoding):
+        (WebCore::IDBLevelDBCoding::decodeByte):
+        (WebCore::IDBLevelDBCoding::DatabaseFreeListKey::decode):
+        (WebCore::IDBLevelDBCoding::DatabaseNameKey::decode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::decode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::encode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::metaDataType):
+        (WebCore::IDBLevelDBCoding::IndexMetaDataKey::decode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreFreeListKey::decode):
+        (WebCore::IDBLevelDBCoding::IndexFreeListKey::decode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreNamesKey::decode):
+        (WebCore::IDBLevelDBCoding::IndexNamesKey::decode):
+        * Modules/indexeddb/IDBLevelDBCoding.h:
+        (IDBLevelDBCoding):
+
+2012-08-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use new-style tracing macros with explicit category
+        https://bugs.webkit.org/show_bug.cgi?id=92928
+
+        Reviewed by Adam Barth.
+
+        The chromium tracing system supports using a string identifier for trace categories that can be used to filter
+        events. This switches over to setting an explicit category for all traces and removes the old-style
+        TRACE_EVENT() macro.
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * platform/ScrollAnimatorNone.cpp:
+        (WebCore::ScrollAnimatorNone::scroll):
+        (WebCore::ScrollAnimatorNone::animationTimerFired):
+        * platform/chromium/TraceEvent.h:
+        * platform/graphics/chromium/ProgramBinding.cpp:
+        (WebCore::ProgramBindingBase::init):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::drawResampledBitmap):
+        (WebCore::paintSkBitmap):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/NativeImageSkia.cpp:
+        (WebCore::NativeImageSkia::resizedBitmap):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::bitmap):
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::decode):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::decode):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
+        (WebCore::WEBPImageDecoder::decode):
+
+2012-08-01  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL] Crash at WebCore::toRenderSlider
+        https://bugs.webkit.org/show_bug.cgi?id=92893
+
+        Reviewed by Hajime Morita.
+
+        Added a type check before casting a render object to RenderSlider as 
+        an arbitrary element can have for example webkit-appearance: slider-horizontal.
+
+        No new tests. Existing test fast/forms/range/slider-appearance-crash.html covers the case.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::paintThemePart):
+
+2012-08-01  Koji Ishii  <kojiishi@gmail.com>
+
+        Cache support for OpenTypeVerticalData
+        https://bugs.webkit.org/show_bug.cgi?id=81332
+
+        Reviewed by Tony Chang.
+
+        This patch adds FontCache to cache OpenTypeVerticalData class
+        instances that was introduced in bug 81326.
+
+        We need one instance of the class per OpenType font file, and we don't
+        have a class to hold such instances today.
+
+        ENABLE_OPENTYPE_VERTICAL isn't enabled for any platforms yet, so this
+        patch isn't on any code path. Apple Windows port (bug 48459) is going
+        to use this code, and probably Chromium (51450, 69282) as well.
+
+        "FIXME" comment in SimpleFontData.h will be implemented in 48459.
+
+        No new tests are required. No behavior changes.
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::getCachedFontPlatformData): Ignore leading "@" on Windows to disable Windows feature for vertical flow.
+        (WebCore):
+        (WebCore::FontCache::getVerticalData): Get cached OpenTypeVerticalData from FontPlatformData, or crete one.
+        (WebCore::FontCache::purgeInactiveFontData): Purge inactive OpenTypeVerticalData.
+        * platform/graphics/FontCache.h:
+        (WebCore):
+        * platform/graphics/SimpleFontData.h:
+        (SimpleFontData):
+        (WebCore::SimpleFontData::verticalData): A dummy implementation for purgeInactiveFontData() to work.
+        * platform/graphics/opentype/OpenTypeVerticalData.h: Added m_inFontCache for mark & sweep.
+        (OpenTypeVerticalData):
+
+2012-08-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move compositor HUD font atlas initialization code out of compositor core
+        https://bugs.webkit.org/show_bug.cgi?id=92924
+
+        Reviewed by Adrienne Walker.
+
+        This moves the HUD font atlas initialization code out of the compositor implementation to cut out Font-related
+        dependencies. The new flow is that an embedder can pass a font atlas to the CCLayerTreeHost, after which the
+        atlas is provided the HUD layer (if any) on the next commit. The HUD layer renders text using the font atlas if
+        it has any if the settings require text.
+
+        HUD tested manually, we don't have automated tests for this debugging-only feature.
+
+        * platform/graphics/chromium/CompositorHUDFontAtlas.cpp:
+        (WebCore):
+        (WebCore::CompositorHUDFontAtlas::generateFontAtlas):
+        * platform/graphics/chromium/CompositorHUDFontAtlas.h:
+        (CompositorHUDFontAtlas):
+        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp:
+        (WebCore::HeadsUpDisplayLayerChromium::create):
+        (WebCore::HeadsUpDisplayLayerChromium::HeadsUpDisplayLayerChromium):
+        (WebCore::HeadsUpDisplayLayerChromium::setFontAtlas):
+        (WebCore):
+        (WebCore::HeadsUpDisplayLayerChromium::createCCLayerImpl):
+        (WebCore::HeadsUpDisplayLayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.h:
+        (HeadsUpDisplayLayerChromium):
+        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
+        (WebCore::CCFontAtlas::CCFontAtlas):
+        * platform/graphics/chromium/cc/CCFontAtlas.h:
+        (WebCore):
+        (WebCore::CCFontAtlas::create):
+        (CCFontAtlas):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
+        (WebCore::CCHeadsUpDisplayLayerImpl::CCHeadsUpDisplayLayerImpl):
+        (WebCore::CCHeadsUpDisplayLayerImpl::setFontAtlas):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h:
+        (WebCore::CCHeadsUpDisplayLayerImpl::create):
+        (CCHeadsUpDisplayLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::setFontAtlas):
+        (WebCore):
+        (WebCore::CCLayerTreeHost::willCommit):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        (CCLayerTreeHost):
+
+2012-08-01  Antoine Labour  <piman@chromium.org>
+
+        [chromium] factor out the optimization pass in CCRenderSurfaceFilters::apply
+        https://bugs.webkit.org/show_bug.cgi?id=92453
+
+        Reviewed by James Robinson.
+
+        This separates the "optimization" pass in CCRenderSurfaceFilters::apply
+        to resolve a succession of color matrix filters into a single operation.
+        This allows testing of that code.
+        This introduces a new generic color matrix WebFilterOperation, which can
+        also be used on its own.
+
+        New test: CCRenderSurfaceFiltersTest.
+
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
+        (WebCore::CCRenderSurfaceFilters::optimize):
+        (WebCore):
+        (WebCore::CCRenderSurfaceFilters::apply):
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.h:
+        (CCRenderSurfaceFilters):
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port
+        https://bugs.webkit.org/show_bug.cgi?id=90298
+
+        Reviewed by Adam Barth.
+
+        The css property "-webkit-widget-region" is essentially a synonym of
+        "-webkit-dashboard-region" that allows us to expose dashboard region
+        support for other port. This patch also adds a new feature define
+        ENABLE(WIDGET_REGION) such that "-webkit-dashboard-region" is only
+        provided under ENABLE(DASHBOARD_SUPPORT) as it is now and
+        "-webkit-widget-region" is only exposed under ENABLE(WIDGET_REGION).
+
+        Change almost all the code pieces guarded by ENABLE(DASHBOARD_SUPPORT)
+        to make them also guarded by ENABLE(WIDGET_REGION), except those
+        that are specific to Apple/WebKit.
+
+        Currently ENABLE(WIDGET_REGION) has been turned on by default for
+        Mac/WebKit and chromium ports.
+
+        Test: fast/css/widget-region-parser.html
+
+        * Configurations/FeatureDefines.xcconfig: Add ENABLE_WIDGET_REGION define.
+        * DerivedSources.make:
+        * GNUmakefile.am: Add ENABLE_WIDGET_REGION define.
+        * WebCore.exp.in:
+        * css/CSSComputedStyleDeclaration.cpp: Handle CSSPropertyWebkitWidgetRegion.
+        (WebCore):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp: Parse "-webkit-widget-region".
+        (WebCore::CSSParser::parseValue):
+        (WebCore):
+        (WebCore::CSSParser::parseDashboardRegions):
+        * css/CSSProperty.cpp: Handle CSSPropertyWebkitWidgetRegion.
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore):
+        (WebCore::CSSPrimitiveValue::customCssText):
+        (WebCore::CSSPrimitiveValue::cloneForCSSOM):
+        * css/CSSPropertyNames.in: Add "-webkit-widget-region" property.
+        * css/DashboardRegion.h:
+        (DashboardRegion):
+        * css/StyleResolver.cpp: Handle CSSPropertyWebkitWidgetRegion.
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore):
+        * dom/Document.h:
+        (WebCore):
+        (Document):
+        * page/Chrome.cpp:
+        (WebCore):
+        * page/ChromeClient.h:
+        (ChromeClient):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h:
+        (FrameView):
+        * rendering/RenderInline.cpp:
+        (WebCore):
+        * rendering/RenderInline.h:
+        (RenderInline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollTo):
+        (WebCore::RenderLayer::setHasHorizontalScrollbar):
+        (WebCore::RenderLayer::setHasVerticalScrollbar):
+        (WebCore::RenderLayer::updateScrollbarsAfterLayout):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::setHasVerticalScrollbar):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        (WebCore):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleDashboardRegion.h:
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+        (WebCore):
+        (StyleRareNonInheritedData):
+
+2012-08-01  Arnaud Renevier  <a.renevier@sisa.samsung.com>
+
+        [V8] TypedArray binding performance improvements
+        https://bugs.webkit.org/show_bug.cgi?id=92557
+
+        Reviewed by Kenneth Russell.
+
+        Improve TypedArray bindings performance:
+        - create arrays with createUninitialized when possible. Typed Array
+        construction is about 10% faster.
+        - when creating a typed array from a same typed array, memcpy data
+        from source to target.
+
+        In order to detect if argument array is the same type as
+        implementation array, we pass the javascript wrapper type as a new
+        type argument to template function constructWebGLArray.
+
+        Introduce wrapArrayBufferView which wraps typed array into a v8::Value
+
+        No new tests: Performance tests are already handled by
+        Bindings/typed-array-construct-from-same-type.html and
+        Bindings/typed-array-construct-from-typed.html
+
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        (WebCore):
+        (WebCore::constructWebGLArray):
+        * bindings/v8/custom/V8Float32ArrayCustom.cpp:
+        (WebCore::V8Float32Array::constructorCallback):
+        * bindings/v8/custom/V8Float64ArrayCustom.cpp:
+        (WebCore::V8Float64Array::constructorCallback):
+        * bindings/v8/custom/V8Int16ArrayCustom.cpp:
+        (WebCore::V8Int16Array::constructorCallback):
+        * bindings/v8/custom/V8Int32ArrayCustom.cpp:
+        (WebCore::V8Int32Array::constructorCallback):
+        * bindings/v8/custom/V8Int8ArrayCustom.cpp:
+        (WebCore::V8Int8Array::constructorCallback):
+        * bindings/v8/custom/V8Uint16ArrayCustom.cpp:
+        (WebCore::V8Uint16Array::constructorCallback):
+        * bindings/v8/custom/V8Uint32ArrayCustom.cpp:
+        (WebCore::V8Uint32Array::constructorCallback):
+        * bindings/v8/custom/V8Uint8ArrayCustom.cpp:
+        (WebCore::V8Uint8Array::constructorCallback):
+        * bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp:
+        (WebCore::V8Uint8ClampedArray::constructorCallback):
+
+2012-08-01  Antoine Labour  <piman@chromium.org>
+
+        [chromium] Fix lost context handling on hud layer
+        https://bugs.webkit.org/show_bug.cgi?id=92915
+
+        Reviewed by Adrienne Walker.
+
+        On lost context we need to release CCScopedTextures, otherwise later on
+        we will try to re-allocate it using a stale CCResourceProvider.
+
+        Test CCLayerTreeHostImplTest.dontUseOldResourcesAfterLostContext
+        extended.
+
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
+        (WebCore::CCHeadsUpDisplayLayerImpl::didLoseContext):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h:
+
+2012-08-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Read tag names and attributes from the saved tokens in HTMLElementStack
+        https://bugs.webkit.org/show_bug.cgi?id=92830
+
+        Reviewed by Adam Barth.
+
+        This is a follow-up patch for r123577.
+        Replaced top()->hasTagName(x) with topStackItem()->hasTagName(x).
+        Also replaced item->element()->hasTagName(x) with item->hasTagName(x).
+
+        No new tests, covered by existing tests.
+
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLElementStack::pop):
+        (WebCore::HTMLElementStack::popUntil):
+        (WebCore::HTMLElementStack::pushHTMLHtmlElement):
+        (WebCore::HTMLElementStack::pushHTMLHeadElement):
+        (WebCore::HTMLElementStack::pushHTMLBodyElement):
+        (WebCore::HTMLElementStack::push):
+        (WebCore::HTMLElementStack::insertAbove):
+        (WebCore::HTMLElementStack::popCommon):
+
+2012-08-01  Antoine Labour  <piman@chromium.org>
+
+        [chromium] remove unused fields from LayerRendererCapabilities
+        https://bugs.webkit.org/show_bug.cgi?id=92906
+
+        Reviewed by James Robinson.
+
+        No new tests (just removing dead code).
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::initialize):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::LayerRendererCapabilities::LayerRendererCapabilities):
+        (LayerRendererCapabilities):
+
+2012-08-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move compositor HUD font atlas generation out of compositor core
+        https://bugs.webkit.org/show_bug.cgi?id=92901
+
+        Reviewed by Adrienne Walker.
+
+        This moves the font atlas generation out of CCFontAtlas into a separate helper class and ports the CCFontAtlas
+        text drawing code over to use skia directly.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/CompositorHUDFontAtlas.cpp: Added.
+        (WebCore):
+        (WebCore::wrapPositionIfNeeded):
+        (WebCore::CompositorHUDFontAtlas::generateFontAtlas):
+        * platform/graphics/chromium/CompositorHUDFontAtlas.h: Added.
+        (WebCore):
+        (CompositorHUDFontAtlas):
+        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
+        (WebCore::CCFontAtlas::CCFontAtlas):
+        (WebCore::CCFontAtlas::~CCFontAtlas):
+        (WebCore::CCFontAtlas::initialize):
+        (WebCore::CCFontAtlas::drawText):
+        (WebCore::CCFontAtlas::drawOneLineOfTextInternal):
+        (WebCore::CCFontAtlas::drawDebugAtlas):
+        * platform/graphics/chromium/cc/CCFontAtlas.h:
+        (WebCore):
+        (CCFontAtlas):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
+
+2012-08-01  Peter Beverloo  <peter@chromium.org>
+
+        [Text Autosizing] Provide an API for influencing the font scale factor
+        https://bugs.webkit.org/show_bug.cgi?id=92882
+
+        Reviewed by Adam Barth.
+
+        Add the font scale factor to settings, and provide an API in
+        window.internal.settings to change it from layout tests.
+
+        The font scale factor applied to Text Autosizing influences the sizing
+        of text, and will influence the scaling of boosted blocks once the
+        implementation progresses. For Android, it will be set to the font size
+        chosen in the user's system-wide preferences.
+
+        Test: fast/text-autosizing/font-scale-factor.html
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore):
+        (WebCore::Settings::setTextAutosizingFontScaleFactor):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::textAutosizingFontScaleFactor):
+        * rendering/TextAutosizer.cpp:
+        (WebCore::TextAutosizer::processBlock):
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::Backup::Backup):
+        (WebCore::InternalSettings::Backup::restoreTo):
+        (WebCore::InternalSettings::setTextAutosizingFontScaleFactor):
+        (WebCore):
+        * testing/InternalSettings.h:
+        (Backup):
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-08-01  Mike West  <mkwst@chromium.org>
+
+        CSP should correctly block plugin resources rendered in PluginDocuments.
+        https://bugs.webkit.org/show_bug.cgi?id=92675
+
+        Reviewed by Adam Barth.
+
+        In certain cases, plugins aren't loaded directly, but are stuffed into a
+        newly-created PluginDocument before rendering. While we were already
+        correctly populating information that allowed us to make decisions about
+        that document's security origin, and already dealing with sandbox
+        status by creating a 'SinkDocument' that ignored plugin data, we weren't
+        correctly inheriting the parent frame's Content Security Policy. This
+        patch ensures that PluginDocuments correctly inherit their parent's
+        Content Security Policy, meaning that the plugin is blocked or allowed
+        according to the policy of the protected resource in which the
+        PluginDocument is embedded.
+
+        Tests: http/tests/security/contentSecurityPolicy/object-src-url-allowed.html
+               http/tests/security/contentSecurityPolicy/object-src-url-blocked.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::initContentSecurityPolicy):
+            Populate a created PluginDocument with its frame's parent's Content
+            Security Policy.
+
+2012-08-01  Florin Malita  <fmalita@chromium.org>
+
+        SVG animation not working for elements inserted after parsing is finished
+        https://bugs.webkit.org/show_bug.cgi?id=92025
+
+        Reviewed by Nikolas Zimmermann.
+
+        Time containers for SVG elements inserted after document parsing is finished need to be
+        initialized on insertion (since they've missed the Document::implicitClose() initialization
+        point).
+
+        Test: svg/animations/deferred-insertion.html
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::insertedInto):
+
+2012-08-01  Vincent Scheib  <scheib@chromium.org>
+
+        Block pointer lock for sandboxed iframes.
+        https://bugs.webkit.org/show_bug.cgi?id=92796
+
+        Reviewed by Adam Barth.
+
+        Sandboxed iframe documents should be blocked from using the
+        pointer lock API until there is specification agreement
+        on what attribute to use to allow the feature. After
+        specification this restriction can be relaxed, but not
+        restricting it now would require breaking applications
+        later.
+
+        Test: http/tests/pointer-lock/iframe-sandboxed.html
+
+        * dom/SecurityContext.h:
+        * page/PointerLockController.cpp:
+        (WebCore::PointerLockController::requestPointerLock):
+
+2012-08-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Replace WTF::getCurrentLocalTime() with GregorianDateTime::setToCurrentLocalTime()
+        https://bugs.webkit.org/show_bug.cgi?id=92286
+
+        Reviewed by Geoffrey Garen.
+
+        Add a method to GregorianDateTime to set its values to the current locale time.
+        Replacing all occurrences of getCurrentLocalTime with the new function allows
+        us to remove getCurrentLocalTime in a next step.
+
+        * html/FTPDirectoryDocument.cpp:
+        (WebCore::processFileDateString):
+        * loader/archive/mhtml/MHTMLArchive.cpp:
+        (WebCore::MHTMLArchive::generateMHTMLData):
+
+2012-08-01  Ojan Vafai  <ojan@chromium.org>
+
+        Remove code duplication in determining if display is inline or replaced
+        https://bugs.webkit.org/show_bug.cgi?id=92880
+
+        Reviewed by Julien Chaffraix.
+
+        Deduplicate lists of display types by using private helpers.
+
+        No new tests. No change in behavior.
+
+        * rendering/style/RenderStyle.h:
+
+2012-08-01  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Add ExtraData capability to MediaStreamSource
+        https://bugs.webkit.org/show_bug.cgi?id=92860
+
+        Reviewed by Adam Barth.
+
+        The Chromium port needs to store some related data in MediaStreamSource objects.
+
+        Not testable from a LayoutTest.
+
+        * platform/chromium/support/WebMediaStreamSource.cpp:
+        (ExtraDataContainer):
+        (WebKit::ExtraDataContainer::ExtraDataContainer):
+        (WebKit::ExtraDataContainer::extraData):
+        (WebKit):
+        (WebKit::WebMediaStreamSource::extraData):
+        (WebKit::WebMediaStreamSource::setExtraData):
+        * platform/mediastream/MediaStreamSource.h:
+        (ExtraData):
+        (WebCore::MediaStreamSource::ExtraData::~ExtraData):
+        (MediaStreamSource):
+        (WebCore::MediaStreamSource::extraData):
+        (WebCore::MediaStreamSource::setExtraData):
+
+2012-08-01  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: IDBCursor.continue(key) does not throw for key "behind" cursor
+        https://bugs.webkit.org/show_bug.cgi?id=92562
+
+        Reviewed by Ojan Vafai.
+
+        Per spec, IDBCursor.continue(key) should throw for forward cursors
+        if key <= current key, and for reverse cursors if key >= current key.
+        Code was present on the back end but the error code was ignored, possibly
+        broken in a recent refactor, and there were no tests for this case.
+
+        Test: storage/indexeddb/cursor-continue-dir.html
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::advance): Handle async transaction termination.
+        (WebCore::IDBCursor::continueFunction): Move checks here from backend.
+        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::IDBCursorBackendImpl): Don't need direction param.
+        (WebCore::IDBCursorBackendImpl::continueFunction): Remove checks.
+        * Modules/indexeddb/IDBCursorBackendImpl.h: Only IDBBackingStore::cursor needs direction now.
+        (WebCore::IDBCursorBackendImpl::create):
+        (IDBCursorBackendImpl):
+        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::openCursorInternal): Drop unused param.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal): Ditto.
+
+2012-08-01  Rick Byers  <rbyers@chromium.org>
+
+        Don't request a clickCount of 1 on mouseMove event generated by tap gestures
+        https://bugs.webkit.org/show_bug.cgi?id=92779
+
+        Reviewed by Adam Barth.
+
+        mousemove events don't have a click count, so we shouldn't be passing 1
+        here.  Note this makes no real difference in practice since the value is
+        ignored - fixed strictly for pedantics.
+        
+        Test: fast/events/touch/gesture/gesture-click
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureTap):
+
+2012-08-01  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Dropping webkit prefix from Vibration API
+        https://bugs.webkit.org/show_bug.cgi?id=92840
+
+        Reviewed by Adam Barth.
+
+        Remove webkit prefix from navigator.webkitVibrate().
+        - Vibration API have been entered CR already.
+        - Firefox already implements Vibration API.
+
+        No new tests. Covered by fast/dom/navigator-vibration.html
+
+        * Modules/vibration/NavigatorVibration.cpp:
+        (WebCore::NavigatorVibration::vibrate):
+        * Modules/vibration/NavigatorVibration.h:
+        (NavigatorVibration):
+        * Modules/vibration/NavigatorVibration.idl:
+
+2012-08-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Read tag names and attributes from the saved tokens in HTMLFormattingElementList::closestElementInScopeWithName(const AtomicString&)
+        https://bugs.webkit.org/show_bug.cgi?id=92841
+
+        Reviewed by Adam Barth.
+
+        This is a follow-up patch for r123577.
+        Replaced entry.element()->hasLocalName(targetName) with entry.stackItem()->hasLocalName(targetName).
+
+        No new tests, covered by existing tests.
+
+        * html/parser/HTMLFormattingElementList.cpp:
+        (WebCore::HTMLFormattingElementList::closestElementInScopeWithName):
+
+2012-08-01  Kwang Yul Seo  <skyul@company100.net>
+
+        HTMLTreeBuilder passes a wrong token when pushing the head element
+        https://bugs.webkit.org/show_bug.cgi?id=92838
+
+        Reviewed by Adam Barth.
+
+        When the tree builder pushes the head element in the "after head" insertion mode,
+        it creates a HTMLStackItem from a wrong token.
+
+        Added HTMLConstructionSite::headStackItem() to retrieve the stack item for the head
+        element. Modified the tree builder to pass the correct stack item when pushing the head
+        element in the "after head" insertion mode.
+
+        No new tests, covered by existing tests.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertHTMLHeadElement):
+        * html/parser/HTMLConstructionSite.h:
+        (WebCore::HTMLConstructionSite::head):
+        (WebCore::HTMLConstructionSite::headStackItem):
+        (HTMLConstructionSite):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+
+2012-08-01  Andrei Bucur  <abucur@adobe.com>
+
+        [CSS Regions] The regionLayoutUpdate event should be dispatched on the NamedFlow object
+        https://bugs.webkit.org/show_bug.cgi?id=88778
+
+        Reviewed by Adam Barth.
+
+        Spec: http://www.w3.org/TR/css3-regions/#region-flow-layout-events
+
+        This patch implements the regionLayoutUpdate event per May 3rd CSS Regions spec recommendation.
+        Before this patch the event was dispatched individually on each region whenever its overflow state changed. The trigger conditions are preserved with the following additions:
+        - the event is dispatched when the last region is removed
+        - the event is not dispatched when the named flow switches to the NULL state
+        Also, the NamedFlow objects are not deleted if they switch to the NULL state and have listeners attached. In that scenario the JS wrapper will not release the reference
+        until the parent Document is destroyed.
+
+        Tests: The old tests have been modified to use the event on the NamedFlow object rather the one on the Region. New tests have been added to verify the
+        correct behavior in the special states of the NamedFlow (no region chain, NULL state).
+
+        * dom/Document.cpp:
+        (WebCore::Document::addListenerTypeIfNeeded): Listeners are not added on Nodes any more so the regionLayoutUpdate type was removed from the list.
+        * dom/Document.h:
+        * dom/EventTarget.h:
+        (WebCore):
+        * dom/EventTargetFactory.in:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        (Node):
+        * dom/WebKitNamedFlow.cpp:
+        (WebCore::WebKitNamedFlow::eventTargetData):
+        (WebCore):
+        (WebCore::WebKitNamedFlow::ensureEventTargetData):
+        (WebCore::WebKitNamedFlow::dispatchRegionLayoutUpdateEvent): The 3rd May WD says the event is bubbling. However this doesn't make sense as this object doesn't belong to the DOM tree. This was fixed in the ED.
+        (WebCore::WebKitNamedFlow::interfaceName):
+        (WebCore::WebKitNamedFlow::scriptExecutionContext):
+        (WebCore::WebKitNamedFlow::base): Getter for the owner Document used by the wrapper to determine if the object is reachable.
+        * dom/WebKitNamedFlow.h:
+        (WebCore):
+        (WebKitNamedFlow):
+        (WebCore::WebKitNamedFlow::refEventTarget):
+        (WebCore::WebKitNamedFlow::derefEventTarget):
+        * dom/WebKitNamedFlow.idl:
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::RenderFlowThread):
+        (WebCore::RenderFlowThread::layout): The event dispatching is now handled by the implementation of RenderFlowThread.
+        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderNamedFlowThread.cpp:
+        (WebCore::RenderNamedFlowThread::RenderNamedFlowThread):
+        (WebCore::RenderNamedFlowThread::removeRegionFromThread): The layout doesn't detect changes caused by removing the last region. This case is handled separately.
+        (WebCore::RenderNamedFlowThread::dispatchRegionLayoutUpdateEvent):
+        (WebCore):
+        (WebCore::RenderNamedFlowThread::regionLayoutUpdateEventTimerFired):
+        * rendering/RenderNamedFlowThread.h:
+        (RenderNamedFlowThread):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::RenderRegion):
+        * rendering/RenderRegion.h:
+        (RenderRegion):
+
+2012-07-31  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: margin-collapse-012 fails
+        https://bugs.webkit.org/show_bug.cgi?id=80219
+
+        Reviewed by Eric Seidel.
+
+        Tests: css2.1/20110323/margin-collapse-012.htm
+               fast/css/margin-collapse-abspos-negmargin.htm
+
+        I also ran this against the full margin-collapse-* CSS 2.1 suite without regressions.
+
+        Per http://www.w3.org/TR/CSS21/box.html#collapsing-margins don't collapse the margins of 
+        positioned blocks. Instead, just use the margin of the sibling/container to offset the 
+        positioned block's logical top - its own margin gets added in later at 
+        RenderBox::computePositionedLogicalHeightUsing().
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPositionedBlock):
+
+2012-08-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124334.
+        http://trac.webkit.org/changeset/124334
+        https://bugs.webkit.org/show_bug.cgi?id=92879
+
+        Broke MemoryInstrumentationTest.sizeOf from webkit_unit_tests
+        on Chromium canaries (Requested by apavlov1 on #webkit).
+
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryInstrumentation::addInstrumentedObject):
+        (MemoryInstrumentation):
+        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+        * inspector/MemoryInstrumentationImpl.h:
+        (MemoryInstrumentationImpl):
+        (WebCore::MemoryInstrumentationImpl::totalTypeSize):
+
+2012-08-01  Han Shen  <shenhan@google.com>
+
+        Fix gcc 4.7 compile warnings.
+        https://bugs.webkit.org/show_bug.cgi?id=92797
+
+        Reviewed by Kentaro Hara.
+
+        GCC 4.7 gives (more strict) warnings on uninitialized variables,
+        fixed by providing initilization values.
+
+        Tested by gcc 4.7 building. No change in behavior.
+
+        * platform/graphics/filters/arm/NEONHelpers.h:
+        (WebCore::loadRGBA8AsFloat): Add initilizaton value for local variable.
+
+2012-08-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r122498): Assertion failure: m_nodeListCounts is sometimes not zero in the Document destructor
+        https://bugs.webkit.org/show_bug.cgi?id=92742
+
+        Reviewed by Andreas Kling.
+
+        The bug was caused by adoptTreeScope's not always calling unregisterNodeListCache and registerNodeListCache
+        on node lists that use m_atomicNameCaches and m_nameCaches.
+
+        Tests: fast/dom/NodeList/nodelist-moved-to-fragment-2.html
+               fast/dom/NodeList/nodelist-moved-to-fragment.html
+
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::adoptTreeScope):
+
+2012-08-01  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Crashes in NetworkResourcesData.
+        https://bugs.webkit.org/show_bug.cgi?id=92874
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::contentSizeInBytes):
+        (WebCore):
+        (WebCore::NetworkResourcesData::ResourceData::removeContent):
+        (WebCore::NetworkResourcesData::ResourceData::decodeDataToContent):
+        (WebCore::NetworkResourcesData::setResourceContent):
+        (WebCore::NetworkResourcesData::maybeDecodeDataToContent):
+
+2012-08-01  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: test native memory instrumentation code with help of unittests
+        https://bugs.webkit.org/show_bug.cgi?id=92743
+
+        Reviewed by Yury Semikhatsky.
+
+        Test a part of existing Native Memory Instrumentation code with help of unit tests.
+        6 tests were added and two bugs were fixed.
+        a drive-by improvement: the method MemoryInstrumentation::addInstrumentedObject
+        was marked as private and addRootObject was introduced instead of it.
+        The new function also calls processDeferedPointers.
+
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryInstrumentation::addRootObject):
+        (MemoryInstrumentation):
+        (WebCore::MemoryInstrumentation::addInstrumentedObject):
+        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
+        (WebCore):
+        (WebCore::MemoryInstrumentation::addObjectImpl):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+        * inspector/MemoryInstrumentationImpl.h:
+        (MemoryInstrumentationImpl):
+
+2012-08-01  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [GTK] Memory leak found while running webaudio tests
+        https://bugs.webkit.org/show_bug.cgi?id=92861
+
+        Reviewed by Philippe Normand.
+
+        Fix a memory leak in decodeAudioForBusCreation by adopting
+        an allocation of GInputStream.
+
+        No new tests. No change in behavior.
+
+        * platform/audio/gstreamer/AudioFileReaderGStreamer.cpp:
+        (WebCore::AudioFileReader::decodeAudioForBusCreation):
+
+2012-08-01  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: count DOM storage cache memory for native snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=91617
+
+        Reviewed by Yury Semikhatsky.
+
+        Add memory size used for DOM storage cache reporting interface.
+        Report it to the native memory snapshot instrumentation framework.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        * inspector/InspectorDOMStorageAgent.cpp:
+        (WebCore::InspectorDOMStorageAgent::memoryBytesUsedByStorageCache):
+        (WebCore):
+        * inspector/InspectorDOMStorageAgent.h:
+        (InspectorDOMStorageAgent):
+        * inspector/InspectorMemoryAgent.cpp:
+        (MemoryBlockName):
+        (WebCore):
+        (WebCore::dumpDOMStorageCache):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        (WebCore::InspectorMemoryAgent::InspectorMemoryAgent):
+        * inspector/InspectorMemoryAgent.h:
+        (WebCore):
+        (WebCore::InspectorMemoryAgent::create):
+        (InspectorMemoryAgent):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.MemoryBlockViewProperties._initialize):
+        * storage/StorageArea.h:
+        (StorageArea):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::memoryBytesUsedByCache):
+        (WebCore):
+        * storage/StorageAreaImpl.h:
+        (StorageAreaImpl):
+
+2012-07-31  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add CSSStyleSheet memory instrumentation
+        https://bugs.webkit.org/show_bug.cgi?id=92748
+
+        Reviewed by Antti Koivisto.
+
+        Added MemoryInstrumentation for CSSStyleSheet, StyleSheetContents, StyleRule,
+        CSSSelectorList and StylePropertySet. The coverage is not complete as the
+        patch was growing too big.
+
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::CSSSelectorList):
+        (WebCore::CSSSelectorList::length):
+        (WebCore):
+        (WebCore::CSSSelectorList::reportMemoryUsage):
+        * css/CSSSelectorList.h:
+        (WebCore):
+        (CSSSelectorList):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::reportMemoryUsage):
+        (WebCore):
+        * css/CSSStyleSheet.h:
+        (WebCore):
+        (CSSStyleSheet):
+        * css/MediaList.cpp:
+        (WebCore):
+        (WebCore::MediaQuerySet::reportMemoryUsage):
+        (WebCore::MediaList::reportMemoryUsage):
+        * css/MediaList.h:
+        (WebCore):
+        (MediaQuerySet):
+        (MediaList):
+        * css/MediaQuery.cpp:
+        (WebCore::MediaQuery::reportMemoryUsage):
+        (WebCore):
+        * css/MediaQuery.h:
+        (WebCore):
+        (MediaQuery):
+        * css/MediaQueryExp.cpp:
+        (WebCore::MediaQueryExp::reportMemoryUsage):
+        (WebCore):
+        * css/MediaQueryExp.h:
+        (WebCore):
+        (MediaQueryExp):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::reportMemoryUsage):
+        (WebCore):
+        * css/StylePropertySet.h:
+        (WebCore):
+        (StylePropertySet):
+        * css/StyleRule.cpp:
+        (WebCore::StyleRuleBase::reportMemoryUsage): We cannot make
+        reportMemoryUsage virtual as it would add vtable to StyleRuleBase
+        and its descendants and would blow its memory footprint. This
+        is why we have a switch over StyleRule type here.
+        (WebCore):
+        (WebCore::StyleRule::reportMemoryUsage):
+        (WebCore::StyleRulePage::reportMemoryUsage):
+        (WebCore::StyleRuleFontFace::reportMemoryUsage):
+        (WebCore::StyleRuleBlock::reportMemoryUsage):
+        (WebCore::StyleRuleMedia::reportMemoryUsage):
+        (WebCore::StyleRuleRegion::reportMemoryUsage):
+        * css/StyleRule.h:
+        (WebCore):
+        (StyleRuleBase):
+        (StyleRule):
+        (StyleRuleFontFace):
+        (StyleRulePage):
+        (StyleRuleBlock):
+        (StyleRuleMedia):
+        (StyleRuleRegion):
+        * css/StyleSheetContents.cpp:
+        (WebCore::StyleSheetContents::reportMemoryUsage):
+        (WebCore):
+        * css/StyleSheetContents.h:
+        (WebCore):
+        (StyleSheetContents):
+        * dom/Document.cpp:
+        (WebCore::Document::reportMemoryUsage):
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryClassInfo::addInstrumentedVectorPtr):
+        (WebCore::MemoryClassInfo::addVectorPtr):
+
+2012-08-01  Keishi Hattori  <keishi@webkit.org>
+
+        Attempt to fix flakiness of color-suggestion-picker-appearance.html
+        https://bugs.webkit.org/show_bug.cgi?id=92848
+
+        Reviewed by Kent Tamura.
+
+        * Resources/colorSuggestionPicker.js:
+        (ColorPicker.prototype._layout): We put the width and height into
+        variables so we don't call window.onresize twice.
+
+2012-08-01  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix GTK+ build with recent version of GTK+.
+
+        Use g_threads_enter/leave instead of the wrapper macros. This
+        gives a compile warning because they are now deprecated but at
+        least it builds.
+
+        * plugins/gtk/gtk2xtbin.c:
+        (xt_event_prepare):
+        (xt_event_check):
+        (xt_event_dispatch):
+
+2012-08-01  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Add native memory used by GlyphCache to the snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=90615
+
+        Reviewed by Yury Semikhatsky.
+
+        Adds interface for reporting memory usage of platform specific
+        components.
+        Report memory usage of the font cache allocated by skia in chromium.
+
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore::addPlatformComponentsInfo):
+        (WebCore):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.MemoryBlockViewProperties._initialize):
+        * platform/MemoryUsageSupport.cpp:
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+        (WebCore):
+        * platform/MemoryUsageSupport.h:
+        (MemoryUsageSupport):
+        (ComponentInfo):
+        (WebCore::MemoryUsageSupport::ComponentInfo::ComponentInfo):
+        * platform/chromium/MemoryUsageSupportChromium.cpp:
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+        (WebCore):
+        * platform/qt/MemoryUsageSupportQt.cpp:
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+        (WebCore):
+
+2012-08-01  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [CSS] Add selectors for multiple fields time input UI.
+        https://bugs.webkit.org/show_bug.cgi?id=92834
+
+        Reviewed by Kent Tamura.
+
+        This patch adds new selectors and "height" property to spin button
+        for multiple fields time input UI.
+
+        RenderTextControlSingleLine::layout() sets height of spin button for
+        input type "number" and other input types using RenderTextControlSingleLine
+        as renderer object. However, multiple fields time input UI doesn't use
+        it and needs to set height of spin button.
+
+        No new tests. This patch doesn't change behavior.
+
+        * css/html.css:
+        (input::-webkit-datetime-edit): Added.
+        (input::-webkit-datetime-edit-ampm-field): Added.
+        (input::-webkit-datetime-edit-hour-field): Added.
+        (input::-webkit-datetime-edit-millisecond-field): Added.
+        (input::-webkit-datetime-edit-minute-field): Added.
+        (input::-webkit-datetime-edit-minute-field[readonly]): Added. This selector
+        is used for step>=3600 second and time format contains minute field.
+        (input::-webkit-datetime-edit-second-field): Added.
+        (input::-webkit-datetime-edit-second-field[readonly]): Added. This selector
+        is used for step>=60 second and time format contains second field.
+        (input::-webkit-inner-spin-button): Add "height" property for using
+        spin button other than RenderTextControlSingleLine.
+
+2012-08-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Make HTMLConstructionSite::createHTMLElement(AtomicHTMLToken*) private.
+        https://bugs.webkit.org/show_bug.cgi?id=92846
+
+        Reviewed by Eric Seidel.
+
+        This method is internal to HTMLConstructionSite.
+
+        No functional change.
+
+        * html/parser/HTMLConstructionSite.h:
+        (HTMLConstructionSite):
+
+2012-08-01  Kinuko Yasuda  <kinuko@chromium.org>
+
+        [Filesystem] Assertion on $0.webkitEntries while on the input field.
+        https://bugs.webkit.org/show_bug.cgi?id=91954
+
+        Reviewed by Kent Tamura.
+
+        Accessing .webkitEntries should not crash when input type is not for file.
+
+        Tests: fast/filesystem/input-access-entries.html
+
+        * Modules/filesystem/HTMLInputElementFileSystem.cpp:
+        (WebCore::HTMLInputElementFileSystem::webkitEntries):
+
+2012-08-01  Eugene Klyuchnikov  <eustas.big@gmail.com>
+
+        Web Inspector: Profiles: cleanup HeapSnapshotReceiver interface
+        https://bugs.webkit.org/show_bug.cgi?id=92390
+
+        Reviewed by Yury Semikhatsky.
+
+        Remove callback parameter and return values from methods startLoading
+        and finishLoading. All implementations of HeapSnapshotReceiver honestly
+        override interface methods now.
+
+        * inspector/front-end/HeapSnapshotLoader.js: Adopted new API.
+        * inspector/front-end/HeapSnapshotProxy.js: Adopted new API. 
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.isStarted): Added.
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.addConsumer): Added.
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading):
+        Explicitly finishes loading and build snapshot.
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotReceiver.prototype.startLoading):
+        Removed callback parameter and return value.
+        (WebInspector.HeapSnapshotReceiver.prototype.finishLoading):
+        Removed callback parameter.
+        (WebInspector.HeapSnapshotSaveToFileReceiver): Adopted new API.
+
+2012-04-07  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: extract MemoryInstrumentationImpl into separate files for future reusing in unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=92751
+
+        Reviewed by Yury Semikhatsky.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorAllInOne.cpp:
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+        * inspector/MemoryInstrumentationImpl.cpp: Added.
+        (WebCore):
+        (WebCore::MemoryInstrumentationImpl::MemoryInstrumentationImpl):
+        (WebCore::MemoryInstrumentationImpl::processDeferredInstrumentedPointers):
+        (WebCore::MemoryInstrumentationImpl::countObjectSize):
+        (WebCore::MemoryInstrumentationImpl::deferInstrumentedPointer):
+        (WebCore::MemoryInstrumentationImpl::visited):
+        (WebCore::MemoryInstrumentationImpl::selfSize):
+        * inspector/MemoryInstrumentationImpl.h: Added.
+        (WebCore):
+        (MemoryInstrumentationImpl):
+        (WebCore::MemoryInstrumentationImpl::totalTypeSize):
+
+2012-07-31  MORITA Hajime  <morrita@google.com>
+
+        Internals::setAuthorShadowDOMForAnyElementEnabled should be on InternalSettings
+        https://bugs.webkit.org/show_bug.cgi?id=92823
+
+        Reviewed by Kentaro Hara.
+
+        This change moves Internals::setAuthorShadowDOMForAnyElementEnabled() to
+        InternalSettings to support original value recovery.
+
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::Backup::Backup):
+        (WebCore::InternalSettings::Backup::restoreTo):
+        (WebCore::InternalSettings::setAuthorShadowDOMForAnyElementEnabled): Moved from Internals.
+        (WebCore):
+        * testing/InternalSettings.h:
+        (Backup):
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+        * testing/Internals.cpp:
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-07-31  Vincent Scheib  <scheib@chromium.org>
+
+        webkitRequestPointerLock and webkitExitPointerLock limited to the same document of an active Pointer lock.
+        https://bugs.webkit.org/show_bug.cgi?id=91284
+
+        Reviewed by Adrienne Walker.
+
+        Previously, cross-talk between documents was possible, e.g. allowing one
+        document.webkitExitPointerLock to exit the lock from another document.
+        This change brings Pointer Lock closer to the Fullscreen API behavior,
+        and stops the pointer lock target from being transferable between
+        documents.
+
+        Test: http/tests/pointer-lock/requestPointerLock-can-not-transfer-between-documents.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::webkitExitPointerLock):
+        * page/PointerLockController.cpp:
+        (WebCore::PointerLockController::requestPointerLock):
+
+2012-07-31  Keishi Hattori  <keishi@webkit.org>
+
+        ColorInputType::typeMismatchFor is returning the opposite bool
+        https://bugs.webkit.org/show_bug.cgi?id=92836
+
+        Reviewed by Kent Tamura.
+
+        No new tests. Covered by color-suggestion-picker-appearance.html.
+
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::typeMismatchFor):
+
+2012-07-31  Douglas Stockwell  <dstockwell@chromium.org>
+
+        -webkit-flex-flow does not work with inherit/initial values
+        https://bugs.webkit.org/show_bug.cgi?id=92709
+
+        Reviewed by Ojan Vafai.
+
+        Add a new handler for flex-flow and move flex to StyleBuilder to mirror the standard pattern for handling initial/inherit in shorthands.
+
+        Test: css3/flexbox/flex-flow-initial.html
+
+        * css/StyleBuilder.cpp:
+        (WebCore::StyleBuilder::StyleBuilder): Added handlers for flex and flex-flow.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList): Removed hand written logic for handling flex.
+
+2012-07-31  Emil A Eklund  <eae@chromium.org>
+
+        Float imprecision causes incorrect wrapping in LineLayout with subpixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=92778
+
+        Reviewed by Eric Seidel.
+
+        Due to float imprecision an incorrect wrapping decision is made in
+        certain cases where the values being compare are close but not exactly
+        the same. This can happen as the size of blocks is represented in layout
+        units while line layout uses floats.
+
+        Test: fast/sub-pixel/inline-block-should-not-wrap.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineWidth::fitsOnLine):
+        Use LayoutUnit::epsilon when comparing values as that is the maximum
+        precision we support.
+
+2012-07-31  Hayato Ito  <hayato@chromium.org>
+
+        Refactor EventDispatcher::dispatchEvent() so that we can call each phase (Caputure, Target and Bubbling) of event dispatching separately.
+        https://bugs.webkit.org/show_bug.cgi?id=92621
+
+        Reviewed by Dimitri Glazkov.
+
+        This is one of the required refactorings to support event
+        propagation for seamless iframes.  I've removed 'goto' statements
+        from EventDispatcher::dispatchEvent() as a result.
+
+        I've verified that all separated functions are successfully
+        inlined. I could not see any performance regression.  The
+        benchmark result is:
+
+        Before this patch:
+        % ./Tools/Scripts/run-perf-tests PerformanceTests/DOM/Events.html
+        Running 1 tests
+        Running DOM/Events.html (1 of 1)
+        RESULT DOM: Events= 243.986607143 ms
+        median= 242.297619048 ms, stdev= 5.74748351315 ms, min= 239.80952381 ms, max= 268.0 ms
+
+        After this patch:
+        % ./Tools/Scripts/run-perf-tests PerformanceTests/DOM/Events.html
+        Running 1 tests
+        Running DOM/Events.html (1 of 1)
+        RESULT DOM: Events= 242.291666667 ms
+        median= 240.452380952 ms, stdev= 5.8718643632 ms, min= 238.214285714 ms, max= 266.5 ms
+
+        No new tests, no behavior change.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchEvent):
+        (WebCore::EventDispatcher::dispatchEventPreProcess):
+        (WebCore):
+        (WebCore::EventDispatcher::dispatchEventAtCapturing):
+        (WebCore::EventDispatcher::dispatchEventAtTarget):
+        (WebCore::EventDispatcher::dispatchEventAtBubbling):
+        (WebCore::EventDispatcher::dispatchEventPostProcess):
+        (WebCore::EventDispatcher::topEventContext):
+        * dom/EventDispatcher.h:
+        (WebCore):
+        (EventDispatcher):
+
+2012-07-31  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Chromium] Enable ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS
+        https://bugs.webkit.org/show_bug.cgi?id=92822
+
+        Reviewed by Kent Tamura.
+
+        This patch touches header files for compiling files which contains
+        ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/text/DateTimeFormat.h:
+        * platform/text/LocaleICU.h:
+        * platform/text/LocaleWin.h:
+        * platform/text/LocalizedDate.h:
+        * platform/text/LocalizedNumber.h:
+        * platform/text/mac/LocaleMac.h:
+
+2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r120979): Node list returned by getElementsByTagNameNS isn't invalidated when children changes
+        https://bugs.webkit.org/show_bug.cgi?id=92705
+
+        Reviewed by Abhishek Arya.
+
+        The bug was caused by a typo in NodeListsNodeData::invalidateCaches. We need to invalidate
+        tag name node lists when child nodes change and not when attributes change.
+
+        Test: fast/dom/NodeList/nodelist-namespace-invalidation.html
+
+        * dom/Node.cpp:
+        (WebCore::NodeListsNodeData::invalidateCaches):
+
+2012-07-31  Tony Chang  <tony@chromium.org>
+
+        flexbox should avoid floats
+        https://bugs.webkit.org/show_bug.cgi?id=92661
+
+        Reviewed by Ojan Vafai.
+
+        Block types should avoid floats. Deprecated flexbox and grid already avoid floats.
+
+        Tests: css3/flexbox/floated-flexbox.html - added a test case.
+
+        * rendering/RenderFlexibleBox.h:
+
+2012-07-31  Tony Chang  <tony@chromium.org>
+
+        REGRESSION: flexbox content-size fails to exclude scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=92667
+
+        Reviewed by Ojan Vafai.
+
+        In r123909, we switched to computing the height using computeContentLogicalHeightUsing().
+        Unfortunately, this includes the scrollbar when we want the content height. Add a helper
+        method for computing the value needed by flexbox.
+
+        Test: css3/flexbox/content-height-with-scrollbars.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::mainAxisContentExtent): Use computeLogicalClientHeight
+        (WebCore::RenderFlexibleBox::computeLogicalClientHeight): Add new method for taking scrollbar into consideration.
+        (WebCore::RenderFlexibleBox::computeAvailableFreeSpace): Use computeLogicalClientHeight
+        (WebCore::RenderFlexibleBox::lineBreakLength): Use computeLogicalClientHeight
+        * rendering/RenderFlexibleBox.h:
+
+2012-07-31  Kwang Yul Seo  <skyul@company100.net>
+
+        Remove unused method HTMLElementStack::bottom()
+        https://bugs.webkit.org/show_bug.cgi?id=92807
+
+        Reviewed by Kentaro Hara.
+
+        HTMLElementStack::bottom() was replaced with HTMLElementStack::rootNode()
+        in r80231.
+
+        No functional change, so no new tests.
+
+        * html/parser/HTMLElementStack.cpp:
+        * html/parser/HTMLElementStack.h:
+        (HTMLElementStack):
+
+2012-07-31  Tony Chang  <tony@chromium.org>
+
+        -webkit-order should take an integer, not a number
+        https://bugs.webkit.org/show_bug.cgi?id=92688
+
+        Reviewed by Ojan Vafai.
+
+        The spec changed back from floats to integers:
+        http://lists.w3.org/Archives/Public/www-style/2012Jul/0607.html
+
+        Tests: css3/flexbox/css-properties.html: Updated.
+               css3/flexbox/flex-order.html: Test cases modified.
+
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/StyleBuilder.cpp:
+        (WebCore::StyleBuilder::StyleBuilder):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore):
+        (RenderFlexibleBox::OrderHashTraits):
+        (WebCore::RenderFlexibleBox::OrderHashTraits::emptyValue):
+        (WebCore::RenderFlexibleBox::OrderHashTraits::constructDeletedValue):
+        (WebCore::RenderFlexibleBox::OrderHashTraits::isDeletedValue):
+        (RenderFlexibleBox::OrderIterator):
+        * rendering/RenderFlexibleBox.h:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleRareNonInheritedData.h:
+        (StyleRareNonInheritedData):
+
+2012-07-31  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use skia directly in CCHeadsUpDisplayLayerImpl
+        https://bugs.webkit.org/show_bug.cgi?id=92810
+
+        Reviewed by Adrienne Walker.
+
+        The chromium compositor HUD doesn't need to use a full GraphicsContext/etc, all it draws are rectangles and a
+        simple stroked path. This draws the HUD with straight skia calls and removes the now unnecessary PlatformCanvas
+        wrapper.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/PlatformCanvas.cpp: Removed.
+        * platform/graphics/chromium/PlatformCanvas.h: Removed.
+        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
+        (WebCore::CCFontAtlas::drawText):
+        * platform/graphics/chromium/cc/CCFontAtlas.h:
+        (CCFontAtlas):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
+        (WebCore::CCHeadsUpDisplayLayerImpl::willDraw):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawHudContents):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounter):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounterText):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawDebugRects):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h:
+        (WebCore):
+
+2012-07-31  Dean Jackson  <dino@apple.com>
+
+        ImageCG doesn't initialize m_decodedPropertiesSize in BitmapImage constructor
+        https://bugs.webkit.org/show_bug.cgi?id=92418
+
+        Reviewed by Dan Bernstein.
+
+        Tested by existing content.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::BitmapImage): initialize m_decodedPropertiesSize to zero.
+
+2012-07-31  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Hit test points are being clipped by layers that should not clip
+        https://bugs.webkit.org/show_bug.cgi?id=92786
+
+        Reviewed by James Robinson.
+
+        On impl-side hit testing for chromium compositor, we are
+        accidentally checking all ancestor layers for clipping, instead of
+        only layers that actually clip something. This patch fixes it.
+
+        Added new unit test that reproduces the scenario:
+          CCLayerTreeHostCommonTest.verifyHitTestingForNonClippingIntermediateLayer
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::pointIsClippedBySurfaceOrClipRect):
+
+2012-07-31  James Robinson  <jamesr@chromium.org>
+
+        [chromium] REGRESSION(r123644) Compositor HUD crashes immediately with --show-paint-rects
+        https://bugs.webkit.org/show_bug.cgi?id=92775
+
+        Reviewed by Adrienne Walker.
+
+        In r123644, the compositor HUD was turned into a normal layer. When the HUD is supposed to cover the entire
+        viewport - for instance if the showPlatformLayerTree or showDebugRects settings are true -
+        HeadsUpDisplayLayerChromium's constructor tries to size itself to its layerTreeHost()'s device viewport size.
+        Unfortunately, its layerTreeHost pointer is always nil in the constructor since the layer is not yet in the
+        tree. Additionally, this doesn't handle resize at all.
+
+        To fix this, this grabs the device viewport size and settings in a LayerChromium::update() OVERRIDE. Also
+        changes CCLayerTreeHost::willCommit to only reparent the HUD layer if needed instead of on every frame.
+
+        Tested manually, we don't have any layout tests for the debug HUD.
+
+        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp:
+        (WebCore::HeadsUpDisplayLayerChromium::create):
+        (WebCore::HeadsUpDisplayLayerChromium::HeadsUpDisplayLayerChromium):
+        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.h:
+        (HeadsUpDisplayLayerChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::willCommit):
+
+2012-07-31  Sam Weinig  <sam@webkit.org>
+
+        Stop masking 8 bits off of the visited link hash. We need all the bits!
+        https://bugs.webkit.org/show_bug.cgi?id=92799
+
+        Reviewed by Anders Carlsson.
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::urlHostHash):
+        * platform/network/blackberry/CredentialBackingStore.cpp:
+        (WebCore::hashCredentialInfo):
+        * plugins/blackberry/PluginPackageBlackBerry.cpp:
+        (WebCore::PluginPackage::hash):
+        Update for new function names.
+
+2012-07-31  Chris Rogers  <crogers@google.com>
+
+        Allow AudioDestination to support local/live audio input
+        https://bugs.webkit.org/show_bug.cgi?id=90318
+
+        Reviewed by Kenneth Russell.
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * GNUmakefile.list.am:
+        Add AudioIOCallback.h to make files.
+
+        * Modules/webaudio/AudioDestinationNode.h:
+        * Modules/webaudio/AudioDestinationNode.cpp:
+        (WebCore::AudioDestinationNode::render):
+        Change provideInput() method to render() to support optional audio input.
+
+        (AudioDestinationNode):
+        (WebCore::AudioDestinationNode::localAudioInputProvider):
+        Expose public access to an AudioSourceProvider for local/live audio input.
+
+        (LocalAudioInputProvider):
+        (WebCore::AudioDestinationNode::LocalAudioInputProvider::LocalAudioInputProvider):
+        (WebCore::AudioDestinationNode::LocalAudioInputProvider::set):
+        (WebCore::AudioDestinationNode::LocalAudioInputProvider::provideInput):
+        Add simple AudioSourceProvider implementation which dishes out a single AudioBus each
+        render quantum for optional local/live audio input.
+
+        * Modules/webaudio/OfflineAudioDestinationNode.h:
+        * Modules/webaudio/OfflineAudioDestinationNode.cpp:
+        (WebCore::OfflineAudioDestinationNode::startRendering):
+        (WebCore::OfflineAudioDestinationNode::offlineRenderEntry):
+        (WebCore::OfflineAudioDestinationNode::offlineRender):
+        Simple name change using "offline" prefix to avoid confusion with AudioDestinationNode::render() method (implementing AudioIOCallback)
+
+        * platform/audio/AudioDestination.h:
+        Switch create() method to take an AudioIOCallback instead of AudioSourceProvider.
+
+        * platform/audio/AudioIOCallback.h:
+        (WebCore::AudioIOCallback::~AudioIOCallback):
+        Add new AudioIOCallback interface for audio input/output.
+
+        * platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
+        (WebCore::AudioDestination::create):
+        (WebCore::AudioDestinationGStreamer::AudioDestinationGStreamer):
+        * platform/audio/gstreamer/AudioDestinationGStreamer.h:
+        (AudioDestinationGStreamer):
+        (WebCore::AudioDestinationGStreamer::callback):
+        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
+        (_WebKitWebAudioSourcePrivate):
+        (webKitWebAudioSrcSetProperty):
+        (webKitWebAudioSrcLoop):
+        Small tweaks to AudioDestinationGStreamer implementation to account for switch to AudioIOCallback.
+
+        * platform/audio/mac/AudioDestinationMac.cpp:
+        (WebCore::AudioDestination::create):
+        (WebCore::AudioDestinationMac::AudioDestinationMac):
+        (WebCore::AudioDestinationMac::render):
+        * platform/audio/mac/AudioDestinationMac.h:
+        (AudioDestinationMac):
+        Small tweaks to AudioDestinationMac implementation to account for switch to AudioIOCallback.
+
+2012-07-31  Kwang Yul Seo  <skyul@company100.net>
+
+        Read tag names and attributes from the saved tokens in HTMLTreeBuilder::processEndTag(AtomicHTMLToken*)
+        https://bugs.webkit.org/show_bug.cgi?id=92715
+
+        Reviewed by Adam Barth.
+
+        This is a follow-up patch for r123577. Changed oneBelowTop to return HTMLStackItem*.
+
+        No new tests, covered by existing tests.
+
+        * html/parser/HTMLConstructionSite.h:
+        (WebCore::HTMLConstructionSite::oneBelowTop):
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLElementStack::oneBelowTop):
+        * html/parser/HTMLElementStack.h:
+        (HTMLElementStack):
+
+2012-07-31  Eric Seidel  <eric@webkit.org>
+
+        StyleResolver::canShareStyleWithElement does not need to use getAttribute for classAttr in the non-SVG case
+        https://bugs.webkit.org/show_bug.cgi?id=92687
+
+        Reviewed by Antti Koivisto.
+
+        Previously 10% of samples in canShareStyleWithElement hit this line, after this change < 1% do.
+        This is a small speedup for the non-SVG case.  Since this call is made for every element
+        when style is resolved, any small speedup in this function matters on large documents.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-07-31  Luke Macpherson   <macpherson@chromium.org>
+
+        Heap-use-after-free in WebCore::StyleResolver::loadPendingImage
+        https://bugs.webkit.org/show_bug.cgi?id=92606
+
+        Reviewed by Abhishek Arya.
+
+        Changes StyleResolver's m_pendingImageProperties set to a map, such that for each property we keep
+        a RefPtr to the CSSValue used to set that property. This ensures that CSSValues are not freed before
+        they are needed by loadPendingImage.
+
+        Test: fast/css/variables/deferred-image-load-from-variable.html
+
+        * css/StyleResolver.cpp:
+        * css/StyleResolver.h:
+
+2012-07-31  Chris Rogers  <crogers@google.com>
+
+        Add stub implementation for MediaStreamAudioSourceNode
+        https://bugs.webkit.org/show_bug.cgi?id=90110
+
+        Reviewed by Kenneth Russell.
+
+        Test: webaudio/mediastreamaudiosourcenode.html
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add MediaStreamAudioSourceNode files to make files.
+
+        * Modules/webaudio/AudioContext.cpp:
+        * Modules/webaudio/AudioContext.h:
+        * Modules/webaudio/AudioContext.idl:
+        (WebCore::AudioContext::createMediaStreamSource):
+        Add new createMediaStreamSource() method.
+
+        * Modules/webaudio/AudioNode.h:
+        Add NodeTypeMediaStreamAudioSource.
+
+        * Modules/webaudio/MediaStreamAudioSourceNode.cpp: Added.
+        * Modules/webaudio/MediaStreamAudioSourceNode.h: Added.
+        (WebCore::MediaStreamAudioSourceNode::create):
+        (WebCore::MediaStreamAudioSourceNode::MediaStreamAudioSourceNode):
+        (WebCore::MediaStreamAudioSourceNode::~MediaStreamAudioSourceNode):
+        (WebCore::MediaStreamAudioSourceNode::setFormat):
+        (WebCore::MediaStreamAudioSourceNode::process):
+        (WebCore::MediaStreamAudioSourceNode::reset):
+        (WebCore::MediaStreamAudioSourceNode::mediaStream):
+        (WebCore::MediaStreamAudioSourceNode::audioSourceProvider):
+        Basic MediaStreamAudioSourceNode implementation.
+
+        * Modules/webaudio/MediaStreamAudioSourceNode.idl: Added.
+
+2012-07-31  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        FractionalLayoutUnit minor math bugs
+        https://bugs.webkit.org/show_bug.cgi?id=86065
+
+        Reviewed by Levi Weintraub.
+
+        Implement a consistent set of subject modifying operators, to ensure
+        operations that need to be in float are performed in float.
+
+        Scale FractionalLayoutSize in FractionalLayoutUnits instead of intergers.
+
+        No new functionality. No new tests.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::operator-=):
+        (WebCore::operator*=):
+        (WebCore::operator/=):
+        * platform/graphics/FractionalLayoutSize.h:
+        (WebCore::FractionalLayoutSize::scale):
+
+2012-07-31  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [BlackBerry] Enable CSS Filter Effects
+        https://bugs.webkit.org/show_bug.cgi?id=92685
+
+        Reviewed by Rob Buis.
+
+        Enable CSS filter effects, with the exception of custom effects (CSS shaders) and reference effects (SVG effects)
+
+        No new tests, because this is covered by tests from other platforms.
+
+        Internally reviewed by Arvid Nilsson <anilsson@rim.com> and Antonio Gomes <agomes@rim.com>.
+
+        * CMakeLists.txt:
+        * PlatformBlackBerry.cmake:
+        * platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp:
+        (WebCore):
+        (WebCore::GraphicsLayerBlackBerry::setFilters):
+        (WebCore::GraphicsLayerBlackBerry::updateFilters):
+        * platform/graphics/blackberry/GraphicsLayerBlackBerry.h:
+        (GraphicsLayerBlackBerry):
+        (WebCore::GraphicsLayerBlackBerry::filters):
+        * platform/graphics/blackberry/LayerCompositingThread.h:
+        (LayerOverride):
+        (WebCore):
+        (WebCore::LayerCompositingThread::filterOperationsChanged):
+        (WebCore::LayerCompositingThread::setFilterOperationsChanged):
+        (LayerCompositingThread):
+        (WebCore::LayerCompositingThread::filterActions):
+        (WebCore::LayerCompositingThread::setFilterActions):
+        * platform/graphics/blackberry/LayerData.h:
+        (LayerData):
+        (WebCore::LayerData::filters):
+        * platform/graphics/blackberry/LayerFilterRenderer.cpp: Added.
+        (WebCore):
+        (WebCore::operationTypeToProgramID):
+        (WebCore::Uniformf::Uniformf):
+        (WebCore::Uniform1f::apply):
+        (WebCore::Uniform1f::create):
+        (WebCore::Uniform1f::Uniform1f):
+        (WebCore::Uniform2f::apply):
+        (WebCore::Uniform2f::create):
+        (WebCore::Uniform2f::Uniform2f):
+        (WebCore::Uniform3f::apply):
+        (WebCore::Uniform3f::create):
+        (WebCore::Uniform3f::Uniform3f):
+        (WebCore::LayerFilterRendererAction::create):
+        (WebCore::LayerFilterRendererAction::LayerFilterRendererAction):
+        (WebCore::LayerFilterRendererAction::~LayerFilterRendererAction):
+        (WebCore::LayerFilterRendererAction::useActionOn):
+        (WebCore::LayerFilterRenderer::create):
+        (WebCore::LayerFilterRenderer::LayerFilterRenderer):
+        (WebCore::LayerFilterRenderer::bindCommonAttribLocation):
+        (WebCore::LayerFilterRenderer::initializeSharedGLObjects):
+        (WebCore::LayerFilterRenderer::ping):
+        (WebCore::LayerFilterRenderer::pong):
+        (WebCore::LayerFilterRenderer::pushSnapshot):
+        (WebCore::LayerFilterRenderer::popSnapshot):
+        (WebCore::LayerFilterRenderer::actionsForOperations):
+        (WebCore::LayerFilterRenderer::applyActions):
+        * platform/graphics/blackberry/LayerFilterRenderer.h: Added.
+        (WebCore):
+        (Uniformf):
+        (WebCore::Uniformf::location):
+        (Uniform1f):
+        (Uniform2f):
+        (Uniform3f):
+        (LayerFilterRendererAction):
+        (WebCore::LayerFilterRendererAction::shouldPushSnapshot):
+        (WebCore::LayerFilterRendererAction::setPushSnapshot):
+        (WebCore::LayerFilterRendererAction::shouldPopSnapshot):
+        (WebCore::LayerFilterRendererAction::setPopSnapshot):
+        (WebCore::LayerFilterRendererAction::appendUniform):
+        (LayerFilterRenderer):
+        (WebCore::LayerFilterRenderer::isEnabled):
+        (WebCore::LayerFilterRenderer::disable):
+        * platform/graphics/blackberry/LayerRenderer.cpp:
+        (WebCore::LayerRenderer::loadShader):
+        (WebCore::LayerRenderer::loadShaderProgram):
+        (WebCore::LayerRenderer::drawLayersOnSurfaces):
+        (WebCore::LayerRenderer::updateLayersRecursive):
+        (WebCore):
+        (WebCore::LayerRenderer::initializeSharedGLObjects):
+        * platform/graphics/blackberry/LayerRenderer.h:
+        (LayerRenderer):
+        * platform/graphics/blackberry/LayerWebKitThread.cpp:
+        (WebCore::LayerWebKitThread::LayerWebKitThread):
+        (WebCore::LayerWebKitThread::commitOnCompositingThread):
+        (WebCore):
+        (WebCore::LayerWebKitThread::filtersCanBeComposited):
+        * platform/graphics/blackberry/LayerWebKitThread.h:
+        (LayerWebKitThread):
+        (WebCore::LayerWebKitThread::setFilters):
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::platformApplySoftware):
+        (WebCore::FECustomFilter::resizeContext):
+        (WebCore::FECustomFilter::bindProgramAndBuffers):
+        * platform/graphics/filters/FilterOperation.h:
+        (WebCore):
+        (FilterOperation):
+
+2012-07-31  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Get rid of "parser" type casts in CSSGrammar.y
+        https://bugs.webkit.org/show_bug.cgi?id=92760
+
+        Reviewed by Adam Barth.
+
+        r124099 now type the parser parameter, it is therefore not needed to
+        cast to CSSParser* everywhere as we know have a CSSParser* type
+        already.
+
+        No new tests : refactor with no behavior change expected.
+
+        * css/CSSGrammar.y:
+
+2012-07-31  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Use WebAnimation and related classes in GraphicsLayerChromium and AnimTranslationUtil
+        https://bugs.webkit.org/show_bug.cgi?id=90468
+
+        Reviewed by James Robinson.
+
+        No new tests. No new functionality.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/AnimationTranslationUtil.cpp:
+        (WebCore::appendKeyframe):
+        (WebCore::WebTransformAnimationCurve):
+        (WebCore::createWebAnimation):
+        * platform/graphics/chromium/AnimationTranslationUtil.h:
+        (WebKit):
+        (WebCore):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::willBeDestroyed):
+        (WebCore::GraphicsLayerChromium::addAnimation):
+        (WebCore::GraphicsLayerChromium::pauseAnimation):
+        (WebCore::GraphicsLayerChromium::removeAnimation):
+        (WebCore::GraphicsLayerChromium::suspendAnimations):
+        (WebCore::GraphicsLayerChromium::resumeAnimations):
+        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (GraphicsLayerChromium):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebKit):
+        (WebCore):
+        (WebCore::LayerChromium::setLayerAnimationDelegate):
+        (LayerChromium):
+        * platform/graphics/chromium/LinkHighlight.h:
+        (LinkHighlight):
+
+2012-07-31  Taiju Tsuiki  <tzik@chromium.org>
+
+        Fix potential build error on LocalFileSystem::deleteFileSystem.
+        https://bugs.webkit.org/show_bug.cgi?id=92695
+
+        Non-Chrome build of WebKit with FILE_SYSTEM flag will be broken at
+        LocalFileSystem::deleteFileSystem.
+        Chrome does not use this source and most of other ports don't turn on
+        FILE_SYSTEM flag for now. So, we've not seen the breakage explicitly yet.
+
+        Reviewed by Adam Barth.
+
+        Non-Chrome WebKit build with FILE_SYSTEM should be finished successfully.
+
+        * Modules/filesystem/LocalFileSystem.cpp:
+        (WebCore::LocalFileSystem::deleteFileSystem):
+
+2012-07-31  Li Yin  <li.yin@intel.com>
+
+        AudioPannerNode should raise exception when distanceModel is set incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=90952
+
+        Reviewed by Chris Rogers.
+
+        Spec: http://www.w3.org/TR/webaudio/#AudioPannerNode-section
+        The distance model can be only set to LINEAR_DISTANCE, INVERSE_DISTANCE or EXPONENTIAL_DISTANCE.
+        If the incorrect value is set, it will raise the exception.
+        Use the unsigned short to replace unsigned long in AudioPannerNode.idl.
+
+        Test: webaudio/audiopannernode-basic.html
+
+        * Modules/webaudio/AudioPannerNode.cpp:
+        (WebCore::AudioPannerNode::setDistanceModel): raise exception
+        (WebCore):
+        * Modules/webaudio/AudioPannerNode.h:
+        (AudioPannerNode):
+        * Modules/webaudio/AudioPannerNode.idl: using unsigned short to replace unsigned long
+
+2012-07-31  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Shaders] CSS parser rejects parameter names that are also CSS keywords
+        https://bugs.webkit.org/show_bug.cgi?id=92537
+
+        Reviewed by Dirk Schulze.
+
+        Remove the CSS keyword check for CSS Shaders parameter names. Parameters are allowed to be
+        any valid CSS identifier, including CSS keywords. See the spec:
+        https://dvcs.w3.org/hg/FXTF/raw-file/tip/custom/index.html#feCustom
+
+        The CSS parser was rejecting input like the following because it uses a CSS keyword
+        "background" as a parameter name:
+        -webkit-filter: custom(none url(fragment.shader), background 0 1 0 1);
+
+        Test: css3/filters/custom/custom-filter-css-keyword-as-parameter-name.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseCustomFilter): Do not return early when the parameter name is a
+        CSS keyword (i.e. when the CSSParserValue has a non-zero id).
+
+2012-07-31  Pravin D  <pravind.2k4@gmail.com>
+
+        Caret position is wrong when a editable container has word-wrap:normal set
+        https://bugs.webkit.org/show_bug.cgi?id=89649
+
+        Reviewed by Levi Weintraub.
+
+        Correcting the incorrect addumption that the min and max position for the caret rect is constrained to 
+        the logical containing block width. This assumption is incorrect when the text has word-wrap:normal and 
+        flows beyound the visible rect of the container.
+
+        Test: editing/input/editable-container-with-word-wrap-normal.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect):
+
+2012-07-31  Antti Koivisto  <antti@apple.com>
+
+        Crash in FrameLoader::checkLoadComplete with non-browser client app
+        https://bugs.webkit.org/show_bug.cgi?id=92774
+
+        Reviewed by Alexey Proskuryakov..
+
+        Speculative fix. It is possible that CSSFontSelector could get deleted during the timer callback
+        and memory reused, making m_document point to some garbage when it is tested at the end.
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::beginLoadTimerFired):
+
+2012-07-31  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: Throw exception for start() when already started
+        https://bugs.webkit.org/show_bug.cgi?id=92756
+
+        Reviewed by Adam Barth.
+
+        Make the start() function throw an exception if the SpeechRecognition
+        object was already started.
+
+        Test: fast/speech/scripted/start-exception.html
+
+        * Modules/speech/SpeechRecognition.cpp:
+        (WebCore::SpeechRecognition::start):
+        (WebCore::SpeechRecognition::stopFunction):
+        (WebCore::SpeechRecognition::abort):
+        (WebCore::SpeechRecognition::didReceiveError):
+        (WebCore::SpeechRecognition::didEnd):
+        (WebCore::SpeechRecognition::SpeechRecognition):
+        * Modules/speech/SpeechRecognition.h:
+        (SpeechRecognition):
+        * Modules/speech/SpeechRecognition.idl:
+
+2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124207.
+        http://trac.webkit.org/changeset/124207
+        https://bugs.webkit.org/show_bug.cgi?id=92773
+
+        Patch causes crashes on the 64-bit debug builder (and other
+        builders likely) (Requested by zdobersek on #webkit).
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * platform/text/gtk/TextCheckerEnchant.cpp: Removed.
+        * platform/text/gtk/TextCheckerEnchant.h: Removed.
+
+2012-07-07  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] Live stream support is weak
+        https://bugs.webkit.org/show_bug.cgi?id=90084
+
+        Reviewed by Martin Robinson.
+
+        Make sure on-disk buffering is disabled for live streams. It is
+        enabled initially when loading any remote media file if preload is
+        set to Auto. Later on if the player detects that the media is live
+        it disables on-disk buffering. This patch also adds support for
+        caching the total size of the media.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
+        (WebCore::MediaPlayerPrivateGStreamer::load): Keep track of the
+        media url as an instance attribute.
+        (WebCore::MediaPlayerPrivateGStreamer::duration): Logging improvement.
+        (WebCore::MediaPlayerPrivateGStreamer::setRate): use the new
+        isLiveStream() method.
+        (WebCore::MediaPlayerPrivateGStreamer::buffered): Ditto.
+        (WebCore::MediaPlayerPrivateGStreamer::handleMessage): Indicate
+        source of duration message.
+        (WebCore::MediaPlayerPrivateGStreamer::fillTimerFired): Perform an
+        anonymous duration change emission, mostly to cache its value.
+        (WebCore::MediaPlayerPrivateGStreamer::totalBytes): Return
+        cached size when available.
+        (WebCore::MediaPlayerPrivateGStreamer::updateStates): Use the new
+        isLiveStream() method and handle state change corner cases for live streams.
+        (WebCore::MediaPlayerPrivateGStreamer::durationChanged): Cache
+        media total size and re-enable on-disk buffering if caching succeeds.
+        (WebCore::MediaPlayerPrivateGStreamer::movieLoadType): New
+        implementation handling on-disk buffered and live streaming cases.
+        (WebCore::MediaPlayerPrivateGStreamer::setPreload): Remember the
+        case where preload is updated from Auto to another value, do
+        on-disk buffering only for Auto preload attribute.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
+        (WebCore::MediaPlayerPrivateGStreamer::isLiveStream): Utility
+        method, a stream is live if it goes to PAUSE without prerolling.
+
+2012-07-17  Antonio Gomes  <agomes@rim.com>
+
+        [Blackberry][FullScreen] HTML5 <video> controls are scaled differently depending on the current webpage scale
+        https://bugs.webkit.org/show_bug.cgi?id=90884
+        PR #162839
+
+        Reviewed by Rob Buis.
+
+        The way the BlackBerry port implements the FULLSCREEN_API for media
+        elements might result in the controls being oversized, proportionally
+        to the current page scale. That happens because the fullscreen element
+        gets sized to be as big as the viewport size, and the viewport size might
+        get outstretched to fit to the screen dimensions.
+
+        In order to fix that, the patch strips out the Page scale factor from
+        the media controls multiplier.
+
+        Patch also changes many integer-based calculations to be float-based, in
+        order to get the needed precision.
+
+        Internally reviewed by Jacky Jiang.
+
+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore):
+        (WebCore::determineFullScreenMultiplier):
+        (WebCore::RenderThemeBlackBerry::adjustSliderThumbSize):
+        (WebCore::RenderThemeBlackBerry::adjustMediaControlStyle):
+        (WebCore::RenderThemeBlackBerry::adjustSliderTrackStyle):
+        (WebCore::RenderThemeBlackBerry::paintMediaSliderTrack):
+        (WebCore::RenderThemeBlackBerry::paintMediaSliderThumb):
+
+2012-07-31  Stephen White  <senorblanco@chromium.org>
+
+        Remove the clone() method from FilterOperation (and subclasses).
+        https://bugs.webkit.org/show_bug.cgi?id=92757
+
+        Reviewed by Kentaro Hara.
+
+        Since the move to WebFilterOperation in Chromium, this is now dead
+        code.
+
+        Covered by existing tests in css3/filters.
+
+        * platform/graphics/filters/CustomFilterOperation.h:
+        * platform/graphics/filters/FilterOperation.h:
+
+2012-07-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Regression(r124135): SVG tests crashing on ports using Cairo
+        https://bugs.webkit.org/show_bug.cgi?id=92752
+
+        Reviewed by Martin Robinson.
+
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::operator=):
+
+2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124208.
+        http://trac.webkit.org/changeset/124208
+        https://bugs.webkit.org/show_bug.cgi?id=92765
+
+        it broke compilation on mac (Requested by loislo on #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorAllInOne.cpp:
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+        * inspector/MemoryInstrumentationImpl.cpp: Removed.
+        * inspector/MemoryInstrumentationImpl.h: Removed.
+
+2012-07-31  Stephen Chenney  <schenney@chromium.org>
+
+        xmlserializer strips xlink from xlink:html svg image tag
+        https://bugs.webkit.org/show_bug.cgi?id=79586
+
+        Reviewed by Nikolas Zimmermann.
+
+        Adding code to ensure the correct prefix on attributes in the xml,
+        xmlns and xlink namespaces. We now follow the rules in
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/the-end.html#serializing-html-fragments
+        (circa the time of this change).
+
+        Rob Buis wrote the original test for this patch and did the initial work.
+
+        Tests: fast/dom/XMLSerializer-xml-namespace.html
+               svg/custom/xlink-prefix-in-attributes.html
+
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::attributeIsInSerializedNamespace): Test for an attribute in
+        a specially serialized namespace: xml, xmlns, xlink.
+        (WebCore):
+        (WebCore::MarkupAccumulator::appendAttribute): Check the namespace of
+        attributes upon serialization, and add any necessary prefixes.
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::adjustForeignAttributes): Use WTF::xmlAtom etc for AtomicString arguments.
+
+2012-07-31  Mike Reed  <reed@google.com>
+
+        skia: switch to conical gradient to match css/svg spec for two-point gradients
+        https://bugs.webkit.org/show_bug.cgi?id=92754
+
+        Reviewed by Stephen White.
+
+        Switching to skia's TwoPointConical gradient, which has been written explicitly to match the css/svg spec.
+        Leaving the existing TwoPointRadial gradient in skia, for other callers that may want the old behavior.
+
+        No new tests. existing layouttests exercise this change (9 pending rebaselines associated with this CL).
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2012-04-06  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: extract MemoryInstrumentationImpl into separate files for future reusing in unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=92751
+
+        Reviewed by Yury Semikhatsky.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorAllInOne.cpp:
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+        * inspector/MemoryInstrumentationImpl.cpp: Added.
+        (WebCore):
+        (WebCore::MemoryInstrumentationImpl::MemoryInstrumentationImpl):
+        (WebCore::MemoryInstrumentationImpl::processDeferredInstrumentedPointers):
+        (WebCore::MemoryInstrumentationImpl::countObjectSize):
+        (WebCore::MemoryInstrumentationImpl::deferInstrumentedPointer):
+        (WebCore::MemoryInstrumentationImpl::visited):
+        (WebCore::MemoryInstrumentationImpl::selfSize):
+        * inspector/MemoryInstrumentationImpl.h: Added.
+        (WebCore):
+        (MemoryInstrumentationImpl):
+        (WebCore::MemoryInstrumentationImpl::totalTypeSize):
+
+2012-07-31  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add a new and reusable enchant-based spellchecker in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=90269
+
+        Reviewed by Martin Robinson.
+
+        Move enchant specific code down to WebCore, into a new class
+        TextCheckerEnchant, that we can use from WK1 and WK2.
+
+        * GNUmakefile.am: Add flags to handle the SPELLCHECK feature.
+        * GNUmakefile.list.am: Added new files.
+        * platform/text/gtk/TextCheckerEnchant.cpp: Added.
+        (getAvailableDictionariesCallback):
+        (TextCheckerEnchant::TextCheckerEnchant):
+        (TextCheckerEnchant::~TextCheckerEnchant):
+        (TextCheckerEnchant::ignoreWord):
+        (TextCheckerEnchant::learnWord):
+        (TextCheckerEnchant::checkSpellingOfString):
+        (TextCheckerEnchant::getGuessesForWord):
+        (TextCheckerEnchant::updateSpellCheckingLanguages):
+        (TextCheckerEnchant::freeEnchantBrokerDictionaries):
+        * platform/text/gtk/TextCheckerEnchant.h: Added.
+        (WebCore):
+        (TextCheckerEnchant):
+        (WebCore::TextCheckerEnchant::create):
+
+2012-07-31  Joe Mason  <jmason@rim.com>
+
+        [BlackBerry] Support Negotiate auth
+        https://bugs.webkit.org/show_bug.cgi?id=91871
+
+        Reviewed by George Staikos.
+
+        Add Negotiate to the list of auth schemes allowed in the platform request.
+
+        Add "success" and "requireCredentials" parameters to notifyAuthReceived (which is now called
+        with success = true on successful authentication, as well as on failures).
+
+        When success is true, update the stored credential to use the auth scheme actually reported
+        rather than that set in the request. (This is used when Negotiate auth can't get a ticket
+        and falls back to a different supported auth type.)
+
+        When requireCredentials is false, just set the auth type and start a new request using empty
+        credentials.
+
+        RIM PR# 166514
+        Internally reviewed by Jonathan Dong
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::notifyAuthReceived): Add Negotiate to the auth scheme switch. Handle
+        success param by updating auth type in stored credentials; pass requireCredentials param on
+        to sendRequestWithCredentials.
+        (WebCore::NetworkJob::startNewJobWithRequest): Fix typo in increaseRedirectCount parameter
+        name.
+        (WebCore::NetworkJob::sendRequestWithCredentials): Use empty credentials if
+        requireCredentials is false.
+        * platform/network/blackberry/NetworkJob.h:
+        (NetworkJob):
+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob): Add Negotiate to the auth scheme switch.
+
+2012-07-31  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: take into account the whole security origin instead of just host
+        https://bugs.webkit.org/show_bug.cgi?id=92740
+
+        Reviewed by Pavel Feldman.
+
+        Make the DOM Storage Agent take into account all the
+        information relevant to the security origin, i.e. protocol, host, and
+        port. Previously only the host was taken into account. That caused
+        inspector to show the first storage only in the case a page operated
+        over several security origins sharing the same host (but having
+        different protocols e.g. http and https).
+
+        * inspector/InspectorDOMStorageAgent.cpp:
+        (WebCore::InspectorDOMStorageAgent::storageId):
+        (WebCore::InspectorDOMStorageAgent::didUseDOMStorage):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::isSameOriginAndType):
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDOMStorageResource.h:
+        (InspectorDOMStorageResource):
+
+2012-07-31  Keishi Hattori  <keishi@webkit.org>
+
+        Slider ticks are drawn at wrong positions
+        https://bugs.webkit.org/show_bug.cgi?id=92720
+
+        Reviewed by Kent Tamura.
+
+        Slider tick marks for vertical sliders were drawn reversed. And the tick
+        mark positions were slightly off from the thumb position because of rounding.
+
+        No new tests. Covered in input-appearance-range-with-datalist.html.
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paintSliderTicks):
+
+2012-07-31  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Older ShadowDOM is still rendered when a new ShadowDOM is added when they don't have any InsertionPoints.
+        https://bugs.webkit.org/show_bug.cgi?id=92456
+
+        Reviewed by Hajime Morita.
+
+        When adding a new ShadowRoot to an element having other ShadowRoots, and they don't have any InsretionPoint,
+        the older ShadowDOM is still rendered.
+
+        When ContentDistributor's validity is 'Undetermined', ElementShadow reattaches the host and the whole shadow
+        subtree. Since adding a new ShadowRoot makes the validity 'Undetermined', we have had to make it 'Undetermined'.
+
+        This change enables us to remove a unnecessary InvalidationType flag from the code. We should call
+        setValidityUndetermined() instead of using InvalidateAndForceReattach.
+
+        Test: fast/dom/shadow/invalidate-distribution.html
+
+        * dom/ElementShadow.cpp:
+        (WebCore::ElementShadow::addShadowRoot): Calls setValidityUndetermined().
+        (WebCore::ElementShadow::removeAllShadowRoots):
+        (WebCore::ElementShadow::setValidityUndetermined):
+        (WebCore::ElementShadow::invalidateDistribution): When validity is undetermined, we will reattach the
+        host and the shadow subtree.
+        * dom/ElementShadow.h:
+        (ElementShadow):
+        * html/shadow/ContentDistributor.cpp:
+        * html/shadow/ContentDistributor.h:
+        (WebCore::ContentDistributor::setValidity):
+        (ContentDistributor):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::insertedInto): Calls setValidityUndetermined().
+
+2012-07-31  Tommy Widenflycht  <tommyw@google.com>
+
+        Introduce a minimal RTCPeerConnection together with Dictionary changes
+        https://bugs.webkit.org/show_bug.cgi?id=92380
+
+        Reviewed by Kentaro Hara.
+
+        This patch introduces a shell RTCPeerConnection together with neccecary changes to
+        Dictionary.
+
+        The W3C specification can be found here:
+        http://dev.w3.org/2011/webrtc/editor/webrtc.html#rtcpeerconnection
+
+        Since Dictionaries can't be fully copied around adding
+        get(const String& name, Vector<Dictionary>& result)
+        isn't feasible so I have added a new ArrayValue class.
+
+        Test: fast/mediastream/RTCPeerConnection.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/mediastream/DOMWindowMediaStream.idl:
+        * Modules/mediastream/RTCPeerConnection.cpp: Added.
+        (WebCore):
+        (RTCIceServer):
+        (WebCore::RTCIceServer::create):
+        (WebCore::RTCIceServer::~RTCIceServer):
+        (WebCore::RTCIceServer::uri):
+        (WebCore::RTCIceServer::credential):
+        (WebCore::RTCIceServer::RTCIceServer):
+        (RTCConfiguration):
+        (WebCore::RTCConfiguration::create):
+        (WebCore::RTCConfiguration::~RTCConfiguration):
+        (WebCore::RTCConfiguration::appendServer):
+        (WebCore::RTCConfiguration::numberOfServers):
+        (WebCore::RTCConfiguration::server):
+        (WebCore::RTCConfiguration::RTCConfiguration):
+        (WebCore::RTCPeerConnection::parseConfiguration):
+        (WebCore::RTCPeerConnection::create):
+        (WebCore::RTCPeerConnection::RTCPeerConnection):
+        (WebCore::RTCPeerConnection::~RTCPeerConnection):
+        (WebCore::RTCPeerConnection::interfaceName):
+        (WebCore::RTCPeerConnection::scriptExecutionContext):
+        (WebCore::RTCPeerConnection::stop):
+        (WebCore::RTCPeerConnection::eventTargetData):
+        (WebCore::RTCPeerConnection::ensureEventTargetData):
+        * Modules/mediastream/RTCPeerConnection.h: Added.
+        (WebCore):
+        (RTCPeerConnection):
+        (WebCore::RTCPeerConnection::refEventTarget):
+        (WebCore::RTCPeerConnection::derefEventTarget):
+        * Modules/mediastream/RTCPeerConnection.idl: Added.
+        * Target.pri:
+        * UseJSC.cmake:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::webkitRTCPeerConnectionEnabled):
+        * bindings/js/ArrayValue.cpp: Added.
+        (WebCore):
+        (WebCore::ArrayValue::ArrayValue):
+        (WebCore::ArrayValue::operator=):
+        (WebCore::ArrayValue::isUndefinedOrNull):
+        (WebCore::ArrayValue::length):
+        (WebCore::ArrayValue::get):
+        * bindings/js/ArrayValue.h: Added.
+        (WebCore):
+        (ArrayValue):
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::convertValue):
+        (WebCore):
+        * bindings/js/JSDictionary.h:
+        (WebCore):
+        * bindings/v8/ArrayValue.cpp: Added.
+        (WebCore):
+        (WebCore::ArrayValue::operator=):
+        (WebCore::ArrayValue::isUndefinedOrNull):
+        (WebCore::ArrayValue::length):
+        (WebCore::ArrayValue::get):
+        * bindings/v8/ArrayValue.h: Added.
+        (WebCore):
+        (ArrayValue):
+        (WebCore::ArrayValue::ArrayValue):
+        (WebCore::ArrayValue::~ArrayValue):
+        * bindings/v8/Dictionary.cpp:
+        (WebCore::Dictionary::get):
+        (WebCore):
+        * bindings/v8/Dictionary.h:
+        (WebCore):
+        (Dictionary):
+        * dom/EventTargetFactory.in:
+
+2012-07-31  Raul Hudea  <rhudea@adobe.com>
+
+        Inspector crashes when trying to inspect a page with CSS region styling
+        https://bugs.webkit.org/show_bug.cgi?id=91503
+
+        Reviewed by Alexander Pavlov.
+
+        Fix by making sure a CSSRuleSourceData is always created when parsing @-webkit-region rules.
+
+        Test: inspector/styles/region-style-crash.html
+
+        * css/CSSGrammar.y: Made ruleset called explicitly markRuleBodyStart instead of depending on updateLastSelectorLineAndPosition to call it.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::updateLastSelectorLineAndPosition): markRuleBodyStart should be called via at_rule_body_start. 
+        * css/CSSPropertySourceData.h:
+
+2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124179.
+        http://trac.webkit.org/changeset/124179
+        https://bugs.webkit.org/show_bug.cgi?id=92730
+
+        Breaks Chromium Linux 32 bots with "error: integer constant is
+        too large for 'long' type" in IDBLevelDBCodingTest.cpp
+        (Requested by apavlov on #webkit).
+
+        * Modules/indexeddb/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::encodeByte):
+        (WebCore::IDBLevelDBCoding::encodeBool):
+        (WebCore::IDBLevelDBCoding::encodeInt):
+        (WebCore::IDBLevelDBCoding::encodeVarInt):
+        (WebCore::IDBLevelDBCoding::encodeString):
+        (WebCore::IDBLevelDBCoding::encodeDouble):
+        (WebCore::IDBLevelDBCoding::encodeIDBKey):
+        (WebCore::IDBLevelDBCoding::encodeIDBKeyPath):
+        (WebCore::IDBLevelDBCoding::KeyPrefix::encode):
+        * Modules/indexeddb/IDBLevelDBCoding.h:
+        (IDBLevelDBCoding):
+
+2012-07-31  Danilo Cesar Lemes de Paula  <danilo.cesar@collabora.co.uk>
+
+        add Farstream flags/deps to WebKit, for WebRTC
+        https://bugs.webkit.org/show_bug.cgi?id=87524
+
+        Reviewed by Philippe Normand.
+
+        Since Farstream will be used as the backend for GTK's WebRTC, this
+        patch adds it as a dependency to the build system.
+
+        No new features or code changes were added, so new tests aren't necessary.
+
+        * GNUmakefile.am:
+
+2012-07-31  Zan Dobersek  <zandobersek@gmail.com>
+
+        Unreviewed crash fix after r124135.
+
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::Path): Ensure the Cairo path when acquiring its context,
+        crashes ensue otherwise.
+
+2012-07-31  Yoshifumi Inoue  <yosin@chromium.org>
+
+        Change Element::isReadOnlyFormControl to Element::shouldMatchReadOnlySelector/shouldMatchReadWriteSelector or HTMLFormControlElement::readOnly
+        https://bugs.webkit.org/show_bug.cgi?id=92602
+
+        Reviewed by Kent Tamura.
+
+        This patch replaces Element::isReadOnlyFormControl() by
+        Element::shouldMatchReadOnlySelector/shouldMatchReadOnlySelector or
+        HTMLFormControlElement::readOnly() to make intention of functions
+        self descriptive.
+
+        No new tests. This patch doesn't change behavior.
+
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector): Replaced isReadOnlyFormControl() by shouldMatchReadOnlySelector() for :read-only pseudo class, and replaced isReadOnlyFormControl() by shouldMatchReadOnlySelector() for :read-only pseudo class.
+        * dom/Element.cpp:
+        (WebCore::Element::shouldMatchReadOnlySelector): Added for default implementation.
+        (WebCore::Element::shouldMatchReadWriteSelector): for default implementation.
+        * dom/Element.h:
+        (Element): Removed isReadOnlyFormControl() and added shouldMatchReadOnlySelector and shouldMatchReadWriteSelector.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::shouldMatchReadOnlySelector): Added.
+        (WebCore::HTMLFormControlElement::shouldMatchReadWriteSelector): Added.
+        * html/HTMLFormControlElement.h:
+        (HTMLFormControlElement): Removed isReadOnlyFormControl() and added shouldMatchReadOnlySelector and shouldMatchReadWriteSelector.
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::shouldMatchReadOnlySelector): Added.
+        (WebCore::SliderThumbElement::shouldMatchReadWriteSelector): Added.
+        (WebCore::SliderThumbElement::willRespondToMouseMoveEvents): Replaced isReadOnlyFormControl() by readOnly().
+        (WebCore::SliderThumbElement::willRespondToMouseClickEvents): ditto.
+        (SliderThumbElement):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::SearchFieldCancelButtonElement::willRespondToMouseClickEvents): Replaced isReadOnlyFormControl() by readOnly().
+        (WebCore::SpinButtonElement::willRespondToMouseMoveEvents): ditto.
+        (WebCore::SpinButtonElement::willRespondToMouseClickEvents): ditto.
+        (WebCore::SpinButtonElement::shouldMatchReadOnlySelector): Added.
+        (WebCore::SpinButtonElement::shouldMatchReadWriteSelector): Added.
+        (WebCore::InputFieldSpeechButtonElement::willRespondToMouseClickEvents): Replaced isReadOnlyFormControl() by readOnly().
+        * html/shadow/TextControlInnerElements.h:
+        (SpinButtonElement): Removed isReadOnlyFormControl() and added shouldMatchReadOnlySelector and shouldMatchReadWriteSelector.
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isReadOnlyControl): Replaced isReadOnlyControl() by shouldMatchReadOnlySelector().
+
+2012-07-31  Xingnan Wang  <xingnan.wang@intel.com>
+
+        IndexedDB: Size the Vector in encodeInt/encodeVarInt/encodeString
+        https://bugs.webkit.org/show_bug.cgi?id=91813
+
+        Reviewed by Kentaro Hara.
+
+        To avoid memory re-allocation in Vector, init the capability or size of Vector in encodeInt(), encodeVarInt(),
+        encodeBool(), encodeIDBKey() etc.
+
+        No new tests - Low level functions covered by existing layout tests and also covered by Chromium
+        webkit_unit_tests IDBLevelIDBCodingTest.* which validates the sizes of buffers returned by encodeVarInt.
+
+        * Modules/indexeddb/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::encodeInt):
+        (WebCore::IDBLevelDBCoding::encodeVarInt):
+        (WebCore::IDBLevelDBCoding::encodeString):
+
+2012-07-30  Huang Dongsung  <luxtella@company100.net>
+
+        [Texmap] Remove the backing store after 'style.visibility' for an element sets 'hidden'.
+        https://bugs.webkit.org/show_bug.cgi?id=92492
+
+        Reviewed by Noam Rosenthal.
+
+        This patch's purpose is to save vram memory.
+        When visibility of the element sets hidden, we do not need to draw the element,
+        so we do not need to keep a texture of the backing store.
+        Currently, Texmap does not draw the element with visibility:hidden because
+        RenderLayerBacking::paintIntoLayer does not draw anything.
+        This patch just removes unused textures.
+
+        No new tests - no new testable functionality.
+
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::setContentsVisible):
+        (WebCore):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+        (GraphicsLayerTextureMapper):
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::updateBackingStore):
+        (WebCore::TextureMapperLayer::paintSelf):
+        (WebCore::TextureMapperLayer::isVisible):
+        (WebCore::TextureMapperLayer::syncCompositingStateSelf):
+        * platform/graphics/texmap/TextureMapperLayer.h:
+        (State):
+        (WebCore::TextureMapperLayer::State::State):
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        Test: platform/chromium/fast/forms/color/color-suggestion-picker-appearance.html
+
+        * rendering/RenderThemeChromiumCommon.cpp:
+        (WebCore::RenderThemeChromiumCommon::supportsDataListUI): Added color to types supporting datalist.
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124171.
+        http://trac.webkit.org/changeset/124171
+        https://bugs.webkit.org/show_bug.cgi?id=92712
+
+        Start failing fast/css/square-button-appearance.html
+        (Requested by yosin on #webkit).
+
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector):
+        * dom/Element.cpp:
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::isReadOnlyFormControl):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::isReadOnlyFormControl):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::isReadOnlyFormControl):
+        (WebCore::SliderThumbElement::willRespondToMouseMoveEvents):
+        (WebCore::SliderThumbElement::willRespondToMouseClickEvents):
+        * html/shadow/SliderThumbElement.h:
+        (SliderThumbElement):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::SearchFieldCancelButtonElement::willRespondToMouseClickEvents):
+        (WebCore::SpinButtonElement::willRespondToMouseMoveEvents):
+        (WebCore::SpinButtonElement::willRespondToMouseClickEvents):
+        (WebCore::InputFieldSpeechButtonElement::willRespondToMouseClickEvents):
+        * html/shadow/TextControlInnerElements.h:
+        (WebCore::SpinButtonElement::isReadOnlyFormControl):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isReadOnlyControl):
+
+2012-07-30  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [CSS] Change Element::isReadOnlyFormControl to shouldMatchReadWriteSelector or HTMLTextFormControlElement::readOnly
+        https://bugs.webkit.org/show_bug.cgi?id=92602
+
+        Reviewed by Kent Tamura.
+
+        This patch renames Element::isReadOnlyFormControl() to Element::shouldMatchReadWriteSelector()
+        or HTMLTextFormControlElement::readOnly() to make intention of
+        shouldMatchReadWriteSelector(was isReadOnlyFormControl) self descriptive.
+
+        No new tests. This patch doesn't change behavior.
+
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector): Replaced isReadOnlyFormControl() by shouldMatchReadWriteSelector().
+        * dom/Element.cpp:
+        (WebCore::Element::shouldMatchReadWriteSelector): Added default implementation.
+        * dom/Element.h:
+        (WebCore::Element::shouldMatchReadWriteSelector): Replaced isReadOnlyFormControl() by shouldMatchReadWriteSelector().
+        * html/HTMLFormControlElement.h:
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::shouldMatchReadWriteSelector): Replaced isReadOnlyFormControl() by shouldMatchReadWriteSelector().
+        (WebCore::SliderThumbElement::willRespondToMouseMoveEvents): Replaced isReadOnlyFormControl() by readOnly().
+        (WebCore::SliderThumbElement::willRespondToMouseClickEvents): ditto.
+        * html/shadow/SliderThumbElement.h:
+        (SliderThumbElement): Replaced isReadOnlyFormControl() by shouldMatchReadWriteSelector().
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::SearchFieldCancelButtonElement::willRespondToMouseClickEvents): Replaced isReadOnlyFormControl() by readOnly().
+        (WebCore::SpinButtonElement::willRespondToMouseMoveEvents): Replaced isReadOnlyFormControl() by readOnly().
+        (WebCore::SpinButtonElement::willRespondToMouseClickEvents): Replaced isReadOnlyFormControl() by readOnly().
+        (WebCore::InputFieldSpeechButtonElement::willRespondToMouseClickEvents): Replaced isReadOnlyFormControl() by readOnly().
+        * html/shadow/TextControlInnerElements.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isReadOnlyControl): Replaced isReadOnlyFormControl() by shouldMatchReadWriteSelector().
+
+2012-07-30  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Remove overflow: scroll handling in block flow layout methods
+        https://bugs.webkit.org/show_bug.cgi?id=92689
+
+        Reviewed by Simon Fraser.
+
+        The overflow: scroll scrollbars creation was done at layout time for all RenderBlocks and
+        descendants. This was not only wrong ('overflow' only changes at style change time) but it
+        was also introducing some code duplication.
+
+        The gist of this change is to share the code by moving it to RenderLayer::updateScrollbarsAfterStyleChange,
+        this includes the code from bug 69993 to special case list box part.
+
+        Covered by existing tests:
+        - All fast/overflow ones.
+        - For the list box change:
+            fast/forms/select-overflow-scroll-inherited.html
+            fast/forms/select-overflow-scroll.html
+        - For the flexbox:
+            css3/flexbox/preferred-widths-orthogonal.html
+            css3/flexbox/preferred-widths.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::layoutBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        Removed the common code here.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidths):
+        Changed to an ASSERT now that the right scrollbars are created. This is
+        fine as overflow-x/y are physical coordinates and our access was following that.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::invalidateScrollbarRect):
+        Added an early return here if we are not attached yet as RenderLayer::styleChanged
+        is called at attachment time before we are inserted in the tree. This is fine as the
+        scrollbars are part of the object which will be painted after the first layout.
+
+        (WebCore::overflowRequiresAScrollbar):
+        (WebCore::overflowDefinesAutomaticScrollbar):
+        Split the logic in those 2 functions.
+
+        (WebCore::RenderLayer::updateScrollbarsAfterLayout):
+        Updated to use the require / can-have functions. Also added
+        an early return for list box parts as required by bug 69993.
+
+        (WebCore::RenderLayer::updateScrollbarsAfterStyleChange):
+        Added an early return for list box parts as required by bug 69993,
+        also removed some unneeded NULL-checks that were added for list box parts.
+
+2012-07-30  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        fillWithEmptyClients method should also initialize chromeClient with EmptyChromeClient
+        https://bugs.webkit.org/show_bug.cgi?id=92703
+
+        Reviewed by Kent Tamura.
+
+        fillWithEmptyClients should also intialize PageClients.chromeClient with EmptyChromeClient 
+        as its required for creating a Empty page and to minimize the exported symbols.
+
+        No new tests as no change in functionality.
+
+        * loader/EmptyClients.cpp:
+        (WebCore::fillWithEmptyClients):
+
+2012-07-30  Adrienne Walker  <enne@google.com>
+
+        [chromium] Wrap ScrollbarLayerChromium in WebScrollbarLayer
+        https://bugs.webkit.org/show_bug.cgi?id=91032
+
+        Reviewed by James Robinson.
+
+        Modify ScrollingCoordinatorChromium to operate on WebScrollbarLayer
+        instead of ScrollbarLayerChromium. This removes the dependency on
+        ScrollbarLayerChromium.
+
+        No change in functionality, so no new tests.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
+        (WebCore::ScrollingCoordinatorPrivate::setHorizontalScrollbarLayer):
+        (WebCore::ScrollingCoordinatorPrivate::setVerticalScrollbarLayer):
+        (ScrollingCoordinatorPrivate):
+        (WebCore::createScrollbarLayer):
+
+2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Another Qt build fix attempt after r124098.
+        "interface" is a keyword. Don't use it. 
+
+        * dom/GestureEvent.cpp:
+        (WebCore::GestureEvent::interfaceName):
+
+2012-07-30  Elliott Sprehn  <esprehn@gmail.com>
+
+        Make QuotesData use a Vector of pairs
+        https://bugs.webkit.org/show_bug.cgi?id=92448
+
+        Reviewed by Julien Chaffraix.
+
+        QuotesData::create returned an array of memory that contained in place instantiations
+        of a QuotesData and then String instances. This changes the code to use a Vector of
+        pairs making it safer and ensuring that quotes are always balanced. This also uses a
+        HashMap directly in the QuoteRenderer instead of building it on first access reducing
+        the amount of code needed for picking quotes by language.
+
+        Test: fast/css-generated-content/close-quote-negative-depth.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList): Create pairs and use the new QuotesData API.
+        * rendering/RenderQuote.cpp:
+        (WebCore):
+        (WebCore::quotesDataLanguageMap): New function that returns the HashMap of languages.
+        (WebCore::basicQuotesData): Returns the simple form of quotes, " and '.
+        (WebCore::defaultQuotes): Changed to use the new map.
+        (WebCore::RenderQuote::styleDidChange):
+        (WebCore::RenderQuote::originalText): Changed to use the new getOpenQuote and getCloseQuote which ensure bounds checks.
+        * rendering/style/QuotesData.cpp:
+        (WebCore::QuotesData::create): Now returns a plain instance of QuotesData without the in place allocation.
+        (WebCore):
+        (WebCore::QuotesData::addPair): Adds an std::pair of strings ensuring quotes are always balanced.
+        (WebCore::QuotesData::getOpenQuote):
+        (WebCore::QuotesData::getCloseQuote):
+        (WebCore::QuotesData::equals): Renamed equals (added the s).
+        * rendering/style/QuotesData.h:
+        (WebCore::QuotesData::create):
+        (QuotesData):
+        (WebCore::QuotesData::QuotesData):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setQuotes):
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::operator==):
+
+2012-07-30  MORITA Hajime  <morrita@google.com>
+
+        Node::replaceChild() can create bad DOM topology with MutationEvent
+        https://bugs.webkit.org/show_bug.cgi?id=92619
+
+        Reviewed by Ryosuke Niwa.
+
+        Node::replaceChild() calls insertBeforeCommon() after dispatching
+        a MutationEvent event for removeChild(). But insertBeforeCommon()
+        expects call sites to check the invariant and doesn't have
+        suffient check. So a MutationEvent handler can let some bad tree
+        topology to slip into insertBeforeCommon().
+
+        This change adds a guard for checking the invariant using
+        checkReplaceChild() between removeChild() and insertBeforeCommon().
+
+        Test: fast/events/mutation-during-replace-child.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::replaceChild): Added a guard.
+
+2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Qt Windows build fix attempt after r124098.
+
+        * dom/GestureEvent.cpp:
+
+2012-07-30  Wei James  <james.wei@intel.com>
+
+        [Chromium] Enable web audio IPP for x86 chromium android
+        https://bugs.webkit.org/show_bug.cgi?id=91973
+
+        Reviewed by Tony Chang.
+
+        Include the IPP libraries at link-time for Android builds when
+        compiling the Web Audio API with IPP support.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-07-30  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Get rid of Element::isReadOnlyFormControl other than CSS related
+        https://bugs.webkit.org/show_bug.cgi?id=92612
+
+        Reviewed by Kent Tamura.
+
+        This patch replaces Element::isReadOnlyFormControl() not related to
+        CSS selector matching to HTMLFormControlElement::readOnly() for
+        preparation of introducing Element::shouldMatchReadWriteSelector(), bug 92602.
+
+        No new tests. This patch doesn't change behavior.
+
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::defaultEventHandler): Changed isReadOnlyFormControl() to readOnly().
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler): Changed isReadOnlyFormControl() to readOnly().
+        (WebCore::SpinButtonElement::defaultEventHandler): ditto.
+        (WebCore::SpinButtonElement::step): ditto.
+        (WebCore::InputFieldSpeechButtonElement::defaultEventHandler): ditto.
+        (WebCore::InputFieldSpeechButtonElement::setRecognitionResult): ditto.
+        * rendering/RenderTextControl.cpp:
+        (updateUserModifyProperty): Changed isReadOnlyFormControl() to readOnly().
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSearchFieldCancelButton): Changed isReadOnlyFormControl() to readOnly().
+
+2012-07-30  Eric Seidel  <eric@webkit.org>
+
+        Grid Demo spends 1.5% of total time allocating Path objects in RenderBoxModelObject::paintBorderSides
+        https://bugs.webkit.org/show_bug.cgi?id=92252
+
+        Reviewed by Simon Fraser.
+
+        This change introduces the concept of a "null Path" very similar to a null WTF::String.
+        Just like String functions as a RefPtr around a StringImpl, Path (for most ports)
+        functions as an OwnPtr around a PlatformPathPtr.
+
+        In various places in the code, we declare a local Path variable, but don't necessarily
+        use that Path variable in all code paths, or might pass that Path variable along to GraphicsContext
+        functions, without ever actually adding points to that Path.
+        On most platforms, this Path default constructor was causing a malloc!
+        In some of these case, the code-path in question (like paintBorderSides) can be quite hot.
+        Introducing this null-Path and delaying instantiation of the PlatformPath object
+        until it's actually needed, saves a malloc for these hot paths.
+
+        To test this, I loaded a few popular pages, and added printfs to both the Path constructor
+        and destructor, logging during construction and destruction when the path was still null at destruction time.
+
+        This simple testing showed this to be a small win (avoiding mallocs) on many sites and a huge win for Google Spreadsheets:
+        apple.com: 147 Paths created, 9 (6%) destroyed null.
+        google.com: 58 Paths created, 26 (44%) destroyed null (google seems creating 5 paths every second after load?  1 of which is destroyed empty.)
+        amazon.com: 130 Paths created, 130 (100%) destroyed null.
+        Loading an empty spreadsheet from drive.google.com: 5237 created, 4861 destroyed null (92%!) :)
+
+        * platform/graphics/Path.h:
+        (Path):
+        (WebCore::Path::isNull):
+        (WebCore::Path::ensurePlatformPath):
+        * platform/graphics/cairo/CairoUtilities.cpp:
+        (WebCore::appendWebCorePathToCairoContext):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::clip):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore::Path::ensurePlatformPath):
+        (WebCore):
+        (WebCore::Path::operator=):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::currentPoint):
+        (WebCore::Path::translate):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::contains):
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::clipOut):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore):
+        (WebCore::Path::ensurePlatformPath):
+        (WebCore::Path::operator=):
+        (WebCore::Path::contains):
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::fastBoundingRect):
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::platformAddPathForRoundedRect):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::currentPoint):
+        (WebCore::Path::apply):
+        * platform/graphics/gpu/LoopBlinnPathProcessor.cpp:
+        (WebCore):
+        (WebCore::LoopBlinnPathProcessor::buildContours):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PainterOpenVG::drawPath):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::canvasClip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore):
+        (WebCore::Path::ensurePlatformPath):
+        (WebCore::Path::operator=):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::hasCurrentPoint):
+        (WebCore::Path::currentPoint):
+        (WebCore::Path::contains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::strokeContains):
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::operator=):
+        (WebCore::Path::ensurePlatformPath):
+        (WebCore):
+        (WebCore::Path::clear):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::transform):
+        (WebCore::Path::currentPoint):
+
+2012-07-30  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Avoid Assertion Failure in HarfBuzzRun::characterIndexForXPosition
+        https://bugs.webkit.org/show_bug.cgi?id=92376
+
+        Reviewed by Tony Chang.
+
+        Previously, the if condition in offsetForPosition gating the call to
+        characterIndexForXPosition was comparing a different value than what was actually used
+        as the argument to calling it. In some cases, this can lead to a minuscule difference
+        when comparing the two floats - enough to trigger the assertion. To resolve this,
+        the accuracy of the index calculation is improved by changing the types from int
+        to floats and rephrasing the if condition to be exactly the same as what is checked
+        for in the assertion.
+
+        Manual test ManualTests/harfbuzz-mouse-selection-crash.html added
+        which reliably reproduces the assertion failure before this change.
+
+        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp:
+        (WebCore::HarfBuzzShaper::HarfBuzzRun::characterIndexForXPosition): Types changed to float.
+        (WebCore::HarfBuzzShaper::offsetForPosition): Types changed to float, if condition rephrased.
+        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.h:
+        (HarfBuzzRun):
+
+2012-06-29  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove WebTransformationMatrix::mapPoint overrides
+        https://bugs.webkit.org/show_bug.cgi?id=90329
+
+        Reviewed by Adrienne Walker.
+
+        Add more functionality for mapping points to CCMathUtil and use it in CCLayerSorter / drawTileQuad. These
+        mappings should never clip.
+
+        * platform/chromium/support/WebTransformationMatrix.cpp:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawTileQuad):
+        * platform/graphics/chromium/cc/CCLayerSorter.cpp:
+        (WebCore::CCLayerSorter::LayerShape::LayerShape):
+        * platform/graphics/chromium/cc/CCMathUtil.cpp:
+        (WebCore::mapHomogeneousPoint):
+        (WebCore::CCMathUtil::mapPoint):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCMathUtil.h:
+        (WebCore::HomogeneousCoordinate::cartesianPoint3d):
+        (HomogeneousCoordinate):
+        (CCMathUtil):
+
+2012-07-30  Anders Carlsson  <andersca@apple.com>
+
+        Crash in logging code if MIME type is null
+        https://bugs.webkit.org/show_bug.cgi?id=92683
+        <rdar://problem/11985295>
+
+        Reviewed by Dan Bernstein.
+
+        If the MIME type is null, try to figure it out from the URL extension. If this fails, return early instead of crashing
+        trying to insert the null string into a hash set.
+
+        * loader/SubframeLoader.cpp:
+        (WebCore::logPluginRequest):
+
+2012-07-30  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Build fix with newer bison 2.6.
+        https://bugs.webkit.org/show_bug.cgi?id=92264
+
+        Reviewed by Adam Barth.
+
+        As stated in http://www.gnu.org/software/bison/manual/html_node/Table-of-Symbols.html
+        YYLEX_PARAM and YYPARSE_PARAM are depecreated since version 1.875. So far all Mac OS
+        version I had access to as well as recent Linux runs at least version 2.3 so it's safe
+        to use the replacement of these deprecated macros in favor of %lex-param and %parse-param.
+        As announced http://lists.gnu.org/archive/html/info-gnu/2012-07/msg00011.html with the release
+        of version 2.6 YYLEX_PARAM and YYPARSE_PARAM are not supported anymore.
+
+        No new tests : build fix and the patch should not trigger any regressions
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        * xml/XPathGrammar.y: Refactored a bit to not use an intermediate PARSER define.
+        * xml/XPathParser.cpp: bison 2.6 declare xpathyyparse in the .h file now, i.e. XPathGrammar.h
+        therefore including this file within the namespace {} declarations leads to xpathyyparse being
+        defined part of WebCore::XPath namespaces but the actual implementation of xpathyyparse is in XPathGrammar.cpp
+        (generated) and not implemented within the WebCore::XPath so it lead to linking issues. Last, XPathGrammar.h needs 
+        to be included after the other includes as it uses some XPath types. It breaks the style but CSSParser.cpp is doing the same.
+
+2012-07-30  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Propagate gesture events to plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=92281
+
+        Reviewed by Adam Barth.
+
+        Propagate gesture events to plugins. This change does not expose the gesture events
+        to JavaScript, since there is no spec for that at the moment. Exposing gesture events
+        to JavaScript will be done separately, once there is a spec for it.
+
+        Test: platform/chromium/plugins/gesture-events.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/EventNames.h:
+        (WebCore):
+        (WebCore::EventNames::isGestureEventType):
+        (EventNames):
+        * dom/GestureEvent.cpp: Added.
+        (WebCore):
+        (WebCore::GestureEvent::create):
+        (WebCore::GestureEvent::initGestureEvent):
+        (WebCore::GestureEvent::interfaceName):
+        (WebCore::GestureEvent::GestureEvent):
+        (WebCore::GestureEventDispatchMediator::GestureEventDispatchMediator):
+        (WebCore::GestureEventDispatchMediator::event):
+        (WebCore::GestureEventDispatchMediator::dispatchEvent):
+        * dom/GestureEvent.h: Added.
+        (WebCore):
+        (GestureEvent):
+        (WebCore::GestureEvent::~GestureEvent):
+        (WebCore::GestureEvent::deltaX):
+        (WebCore::GestureEvent::deltaY):
+        (WebCore::GestureEvent::GestureEvent):
+        (GestureEventDispatchMediator):
+        (WebCore::GestureEventDispatchMediator::create):
+        * dom/Node.cpp:
+        (WebCore):
+        (WebCore::Node::dispatchGestureEvent):
+        * dom/Node.h:
+        (WebCore):
+        (Node):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleGestureEvent):
+        * page/EventHandler.h:
+
+2012-07-30  John Bates  <jbates@google.com>
+
+        Plumb vsync-enabled flag up to compositor thread and support disable-vsync
+        https://bugs.webkit.org/show_bug.cgi?id=92323
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
+        (WebCore::CCFrameRateController::CCFrameRateController):
+        (WebCore::CCFrameRateController::disableTimeSourceThrottling):
+        (WebCore):
+        (WebCore::CCFrameRateController::setActive):
+        (WebCore::CCFrameRateController::postManualTick):
+        (WebCore::CCFrameRateController::onTimerFired):
+        (WebCore::CCFrameRateController::didBeginFrame):
+        (WebCore::CCFrameRateController::didFinishFrame):
+        * platform/graphics/chromium/cc/CCFrameRateController.h:
+        (WebCore):
+        (CCFrameRateController):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
+        (CCLayerTreeSettings):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::initializeImplOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-07-30  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Add miscellaneous missing includes and OVERRIDE declarations in compositor code
+        https://bugs.webkit.org/show_bug.cgi?id=92680
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/TextureCopier.h:
+        (AcceleratedTextureCopier):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
+        * platform/graphics/chromium/cc/CCResourceProvider.h:
+        (WebCore):
+
+2012-07-30  Adrienne Walker  <enne@google.com>
+
+        [chromium] Remove dependency on ScrollbarTheme from the compositor
+        https://bugs.webkit.org/show_bug.cgi?id=90528
+
+        Reviewed by James Robinson.
+
+        Tested by existing layout tests.
+
+        ScrollbarLayerChromium is modified to use the Platform API for
+        WebScrollbar, WebScrollbarThemePainter, and WebScrollbarThemeGeometry.
+        This prevents API dependencies from the compositor code into WebCore
+        scrollbar and theme code.
+
+        CCScrollbarLayerImpl::CCScrollbar now implements the WebScrollbar API
+        instead of the ScrollbarThemeClient API.
+
+        Also, CCScrollbarLayerImpl now no longer gets the theme from a static
+        accessor. It now gets a "copy" of the theme from the main thread via
+        WebScrollbarThemeGeometry, which is more correct for render theme
+        scrollbars which were previously using the native theme to get part
+        geometry. Using the correct theme unfortunately causes crashes due to
+        bad casts in RenderScrollbarTheme, so this patch turns back off the
+        use of ScrollbarLayerChromium for themed scrollbars until that can be
+        resolved.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::createScrollbarLayer):
+        * platform/ScrollbarThemeClient.h:
+        (ScrollbarThemeClient):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::create):
+        (WebCore::ScrollbarLayerChromium::ScrollbarLayerChromium):
+        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
+        (WebCore::ScrollbarBackgroundPainter::create):
+        (WebCore::ScrollbarBackgroundPainter::ScrollbarBackgroundPainter):
+        (ScrollbarBackgroundPainter):
+        (WebCore::ScrollbarThumbPainter::create):
+        (WebCore::ScrollbarThumbPainter::ScrollbarThumbPainter):
+        (ScrollbarThumbPainter):
+        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
+        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
+        (WebCore::ScrollbarLayerChromium::update):
+        * platform/graphics/chromium/ScrollbarLayerChromium.h:
+        (ScrollbarLayerChromium):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        (WebCore::CCScrollbarLayerImpl::CCScrollbarLayerImpl):
+        (WebCore::CCScrollbarLayerImpl::setScrollbarData):
+        (WebCore::toUVRect):
+        (WebCore::CCScrollbarLayerImpl::appendQuads):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isOverlay):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::value):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::location):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::size):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::enabled):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::maximum):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::totalSize):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isScrollViewScrollbar):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isScrollableAreaActive):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::getTickmarks):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::controlSize):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::pressedPart):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::hoveredPart):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::scrollbarOverlayStyle):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::orientation):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isCustomScrollbar):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+        (CCScrollbarLayerImpl):
+        (CCScrollbar):
+
+2012-07-30  Andreas Kling  <kling@webkit.org>
+
+        REGRESSION(r123636): Heap-use-after-free in StyleResolver::collectMatchingRules.
+        <http://webkit.org/b/92430>
+
+        Reviewed by Antti Koivisto.
+
+        Don't hold on to a reference to StyledElement::classNames() as that may become
+        invalid after mutating the element's attribute data.
+
+        In this case it was happening below Element::hasAttributes() which is unfortunately
+        naive enough to always serialize lazy attributes. That is a minor inefficiency that
+        can be addressed in a separate patch.
+
+        Covered by valgrind on existing tests.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRules):
+
+2012-07-30  James Robinson  <jamesr@chromium.org>
+
+        [chromium] CCThreadTask should not depend on CrossThreadTask and does not need to depend on CrossThreadCopier
+        https://bugs.webkit.org/show_bug.cgi?id=90132
+
+        Reviewed by David Levin.
+
+        CrossThreadTask is defined in WebCore/dom/ and depends on concepts like ScriptExecutionConcept. CCThreadTask,
+        being in WebCore/platform/, should not depend on /dom/ or anything from that layer.
+
+        CrossThreadCopier is not a layering violation per se, but it's also not at all helpful for CCThreadTask - we
+        never use any types for which it would be useful.
+
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::finishAllRendering):
+        (WebCore::CCThreadProxy::initializeContext):
+        (WebCore::CCThreadProxy::setVisible):
+        (WebCore::CCThreadProxy::initializeLayerRenderer):
+        (WebCore::CCThreadProxy::recreateContext):
+        (WebCore::CCThreadProxy::implSideRenderingStats):
+        (WebCore::CCThreadProxy::start):
+        (WebCore::CCThreadProxy::stop):
+        (WebCore::CCThreadProxy::forceSerializeOnSwapBuffers):
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::acquireLayerTextures):
+        * platform/graphics/chromium/cc/CCThreadTask.h:
+        (CCThreadTask1):
+        (WebCore::CCThreadTask1::create):
+        (WebCore::CCThreadTask1::CCThreadTask1):
+        (CCThreadTask2):
+        (WebCore::CCThreadTask2::create):
+        (WebCore::CCThreadTask2::CCThreadTask2):
+        (CCThreadTask3):
+        (WebCore::CCThreadTask3::create):
+        (WebCore::CCThreadTask3::CCThreadTask3):
+        (CCThreadTask4):
+        (WebCore::CCThreadTask4::create):
+        (WebCore::CCThreadTask4::CCThreadTask4):
+        (CCThreadTask5):
+        (WebCore::CCThreadTask5::create):
+        (WebCore::CCThreadTask5::CCThreadTask5):
+        (WebCore::createCCThreadTask):
+
+2012-07-30  Paul Irish  <paul.irish@gmail.com>
+
+        Web Inspector: Rename Databases to Web SQL
+        https://bugs.webkit.org/show_bug.cgi?id=92646
+
+        Reviewed by Pavel Feldman.
+
+        Renamed Databases to Web SQL. Drive-by fix for EmptyView
+        selection.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/EmptyView.js:
+        * inspector/front-end/ResourcesPanel.js:
+
+2012-07-30  Tony Chang  <tony@chromium.org>
+
+        new flexbox should ignore float set on flexitems
+        https://bugs.webkit.org/show_bug.cgi?id=70792
+
+        Reviewed by Ojan Vafai.
+
+        Force flex items to not float.
+
+        Test: css3/flexbox/floated-flexitem.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::adjustRenderStyle): Force NoFloat on flex items.
+
+2012-07-30  Adrienne Walker  <enne@google.com>
+
+        [chromium] Turn back on ScrollbarLayerChromium for Windows
+        https://bugs.webkit.org/show_bug.cgi?id=92409
+
+        Reviewed by James Robinson.
+
+        This reverts r122791. As GDI issues were addressed in Chromium via
+        http://src.chromium.org/viewvc/chrome?view=rev&revision=148215,
+        scrollbar parts can now be composited on the thread.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::createScrollbarLayer):
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124025.
+        http://trac.webkit.org/changeset/124025
+        https://bugs.webkit.org/show_bug.cgi?id=92658
+
+        Causes color-suggestion-picker-appearance layout test to time
+        out on all Chromium platforms (Requested by tomhudson_ on
+        #webkit).
+
+        * rendering/RenderThemeChromiumCommon.cpp:
+        (WebCore::RenderThemeChromiumCommon::supportsDataListUI):
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123966 and r123967.
+        http://trac.webkit.org/changeset/123966
+        http://trac.webkit.org/changeset/123967
+        https://bugs.webkit.org/show_bug.cgi?id=92656
+
+        This patch is causing assertion failures on the debug bot
+        (also rolling out a dependent patch) (Requested by mrobinson
+        on #webkit).
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * platform/text/gtk/TextCheckerEnchant.cpp: Removed.
+        * platform/text/gtk/TextCheckerEnchant.h: Removed.
+
+2012-07-30  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        ASSERTION FAILED: !rect.isEmpty()  : void WebCore::GraphicsContext::drawRect(const WebCore::IntRect &)
+        https://bugs.webkit.org/show_bug.cgi?id=92187
+
+        Reviewed by Simon Fraser.
+
+        The border painting logic (RenderBoxModelObject::paintOneBorderSide) would pass a rect with a 0px length
+        to RenderObject::drawLineForBoxSide. We do check the width (thickness) but not the length so we would pass
+        the rect to GraphicsContext and hit the ASSERT. This change adds a check for the length too as it is the safest
+        way, it means that we may still do unneeded operations before bailing out but that's an existing problem in the code.
+
+        Tests: fast/borders/0px-borders-no-line-height.html
+               fast/borders/double-1px-border-assert.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        Added a 0px length check. While renaming confusing variables and re-using others,
+        I also found a potential empty border that I fixed (tested by the 2nd case above).
+
+2012-07-26  Stephen White  <senorblanco@chromium.org>
+
+        [chromium] Refactor the computation of resampled bitmap size in
+        drawImage and drawPattern.
+        https://bugs.webkit.org/show_bug.cgi?id=92408
+
+        Reviewed by Adrienne Walker.
+
+        We used to have a special-purpose function called TransformDimensions()
+        which did pretty much the same thing as SkRect::mapRect() does.  This
+        change unifies the drawPattern code to use mapRect() in the same way
+        that drawImage() does.
+
+        Covered by existing tests, e.g., fast/backgrounds/size/*.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore):
+        (WebCore::Image::drawPattern):
+        Note:  we're now doing using the original (float) source rect, and
+        converting to int only after applying the matrix transform.  This
+        might result in different decisions about resampling mode, but it's
+        more correct anyway.
+
+2012-07-30  Vineet Chaudhary  <rgf748@motorola.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=92642
+        [Bindings]Remove custom JS/V8 bindings for WebSocket::close() using [Clamp]
+
+        Reviewed by Kentaro Hara.
+
+        With support of [Clamp] as extended attribute we can replace custom bindings from WebSocket::close().
+        Spec for WebSocket::close() : http://www.whatwg.org/specs/web-apps/current-work/multipage/network.html#websocket
+
+        No new tests. There should be no behavioural changes 
+        Existing tests under http/websocket/tests/hybi/ should cover this.
+
+        * Modules/websockets/WebSocket.h:
+        (WebCore::WebSocket::close):
+        * Modules/websockets/WebSocket.idl: Used [Clamp].
+        * bindings/js/JSWebSocketCustom.cpp: Removed custom call close().
+        (WebCore):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateParametersCheck):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjPrototypeFunctionClassMethodWithClamp):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::classMethodWithClampCallback):
+        * bindings/v8/custom/V8WebSocketCustom.cpp: Removed custom call close().
+        (WebCore):
+
+2012-07-29  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Resource agent's reference to cached resources should be weak.
+        https://bugs.webkit.org/show_bug.cgi?id=92108
+
+        Reviewed by Pavel Feldman.
+
+        NetworkResourcesData now stores a raw pointer to CachedResource.
+        CachedResource now notifies InspectorInstrumentation that it will be destroyed.
+        InspectorInstrumentation stores a set of InstrumentingAgents and broadcasts willDestroyCachedResource event to all available resourceAgents.
+        Destroyed resources content is saved to NetworkResourcesData.
+
+        Tests: http/tests/inspector/network/cached-resource-destroyed-moved-to-storage.html
+               http/tests/inspector/network/cached-resource-destroyed-too-big-discarded.html
+
+        * WebCore.exp.in:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::willDestroyCachedResourceImpl):
+        (WebCore::InspectorInstrumentation::registerInstrumentingAgents):
+        (WebCore::InspectorInstrumentation::unregisterInstrumentingAgents):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willDestroyCachedResource):
+        (WebCore):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didReceiveData):
+        (WebCore::InspectorResourceAgent::willDestroyCachedResource):
+        (WebCore):
+        (WebCore::InspectorResourceAgent::getResponseBody):
+        * inspector/InspectorResourceAgent.h:
+        (InspectorResourceAgent):
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::NetworkResourcesData::ResourceData::ResourceData):
+        (WebCore::NetworkResourcesData::ResourceData::setContent):
+        (WebCore::NetworkResourcesData::setResourceContent):
+        (WebCore::NetworkResourcesData::removeCachedResource):
+        (WebCore):
+        * inspector/NetworkResourcesData.h:
+        (ResourceData):
+        (WebCore::NetworkResourcesData::ResourceData::base64Encoded):
+        (WebCore::NetworkResourcesData::ResourceData::cachedResource):
+        (NetworkResourcesData):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::~CachedResource):
+        (WebCore::CachedResource::removeClient):
+        (WebCore::CachedResource::deleteIfPossible):
+        (WebCore):
+        * loader/cache/CachedResource.h:
+        (CachedResource):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::garbageCollectDocumentResourcesTimerFired):
+        (WebCore::CachedResourceLoader::garbageCollectDocumentResources):
+        (WebCore::CachedResourceLoader::clearPreloads):
+        * loader/cache/CachedResourceLoader.h:
+        (CachedResourceLoader):
+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::evict):
+        * testing/InternalSettings.cpp:
+        * testing/Internals.cpp:
+        (WebCore::Internals::garbageCollectDocumentResources):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-07-30  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Prohibit having AuthorShadowDOM of input or textarea element for a while and having a flag to enable it in Internals.
+        https://bugs.webkit.org/show_bug.cgi?id=92611
+
+        Reviewed by Hajime Morita.
+
+        Prohibit having AuthorShadowDOM of input elemnet unless a flag in RuntimeEnabledFeatures is not enabled.
+        The flag can be enabled in Internals.
+
+        The elements in UserAgentShadowDOM of input element assume that they have a renderer when the input
+        element has a renderer. However, this does not hold when AuthorShadowDOM is added to input element.
+        So until we fix the issue, we should disable to have AuthorShadowDOM for input element, because it may
+        cause crashes and security problems.
+
+        Tests: fast/dom/shadow/input-with-validation-without-shadow.html
+               fast/dom/shadow/input-with-validation.html
+               fast/dom/shadow/shadow-disable.html
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::authorShadowDOMForAnyElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::setAuthorShadowDOMForAnyElementEnabled):
+        * dom/ShadowRoot.cpp:
+        (WebCore::allowsAuthorShadowRoot): The input element or textarea element does not allow to have a ShadowDOM unless
+        is a flag in RuntimeEnabledFeatures is not enabled.
+        * html/HTMLInputElement.h:
+        (WebCore::isHTMLInputElement):
+        (WebCore):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::isHTMLTextAreaElement):
+        (WebCore):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setAuthorShadowDOMForAnyElementEnabled):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-07-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: support --line-numbers mapping for SASS
+        https://bugs.webkit.org/show_bug.cgi?id=92400
+
+        Reviewed by Vsevolod Vlasov.
+
+        There is --debug-info and --line-numbers ways of referencing the source scss file, adding support for --line-numbers here.
+
+        * inspector/front-end/SASSSourceMapping.js:
+        (WebInspector.SASSSourceMapping.prototype._resourceAdded.didRequestContent):
+        (WebInspector.SASSSourceMapping.prototype._resourceAdded):
+        (_bindUISourceCode):
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        Test: platform/chromium/fast/forms/color/color-suggestion-picker-appearance.html
+
+        * rendering/RenderThemeChromiumCommon.cpp:
+        (WebCore::RenderThemeChromiumCommon::supportsDataListUI): Added color to types supporting datalist.
+
+2012-07-30  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Wheel events on a page with frames are not handled in fixed layout
+        https://bugs.webkit.org/show_bug.cgi?id=90550
+
+        Reviewed by Antonio Gomes.
+
+        Based on patch by Andras Becsi.
+
+        Frame-rect size is not the right value to check against to see if the document
+        can be contained within the full visible content rect, since it does not handle
+        fixedVisibleContentRect. Instead visibleContentRect(true) should be used which
+        returns the full visible content rect disregarding scrollbars, and which is
+        the same a frame-rect size when fixedVisibleContentRect is not set.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2012-07-30  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        There is no way to tell whether an element can be activated or not
+        https://bugs.webkit.org/show_bug.cgi?id=92093
+
+        Reviewed by Antonio Gomes.
+
+        This patch adds the willRespondToMouseClickEvents and willRespondToMouseMoveEvents
+        functions, named after similar functions in the iOS fork of WebKit.
+
+        Touch-adjustment will now use these two functions, which improves accuracy when
+        targeting shadow-dom elements, and also means touch adjustment will prefer enabled
+        form-elements over disabled ones.
+
+        Test: touchadjustment/disabled-formelements.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::willRespondToMouseMoveEvents):
+        (WebCore::Node::willRespondToMouseClickEvents):
+        * dom/Node.h:
+        (Node):
+        * editing/DeleteButton.h:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::willRespondToMouseClickEvents):
+        * html/HTMLAnchorElement.h:
+        (HTMLAnchorElement):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::willRespondToMouseClickEvents):
+        * html/HTMLButtonElement.h:
+        (HTMLButtonElement):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::willRespondToMouseClickEvents):
+        * html/HTMLInputElement.h:
+        (HTMLInputElement):
+        * html/HTMLLabelElement.cpp:
+        (WebCore::HTMLLabelElement::willRespondToMouseClickEvents):
+        * html/HTMLLabelElement.h:
+        (HTMLLabelElement):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::willRespondToMouseClickEvents):
+        * html/HTMLMediaElement.h:
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::willRespondToMouseClickEvents):
+        * html/HTMLSummaryElement.h:
+        (HTMLSummaryElement):
+        * html/shadow/CalendarPickerElement.cpp:
+        (WebCore::CalendarPickerElement::willRespondToMouseClickEvents):
+        * html/shadow/CalendarPickerElement.h:
+        (CalendarPickerElement):
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::willRespondToMouseClickEvents):
+        (WebCore::MediaControlTimelineElement::setPosition):
+        (WebCore::MediaControlVolumeSliderElement::willRespondToMouseMoveEvents):
+        (WebCore::MediaControlVolumeSliderElement::willRespondToMouseClickEvents):
+        * html/shadow/MediaControlElements.h:
+        (MediaControlTimelineElement):
+        (MediaControlVolumeSliderElement):
+        * html/shadow/MediaControlRootElement.h:
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::willRespondToMouseMoveEvents):
+        (WebCore::SliderThumbElement::willRespondToMouseClickEvents):
+        * html/shadow/SliderThumbElement.h:
+        (SliderThumbElement):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::SearchFieldResultsButtonElement::willRespondToMouseClickEvents):
+        (WebCore::SearchFieldCancelButtonElement::willRespondToMouseClickEvents):
+        (WebCore::SpinButtonElement::willRespondToMouseMoveEvents):
+        (WebCore::SpinButtonElement::willRespondToMouseClickEvents):
+        (WebCore::InputFieldSpeechButtonElement::willRespondToMouseClickEvents):
+        * html/shadow/TextControlInnerElements.h:
+        (SearchFieldResultsButtonElement):
+        (SearchFieldCancelButtonElement):
+        (SpinButtonElement):
+        * html/shadow/TextFieldDecorationElement.cpp:
+        (WebCore::TextFieldDecorationElement::willRespondToMouseClickEvents):
+        * html/shadow/TextFieldDecorationElement.h:
+        (TextFieldDecorationElement):
+        * page/TouchAdjustment.cpp:
+        (WebCore::TouchAdjustment::nodeRespondsToTapGesture):
+
+2012-07-30  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Content size variables in NetworkResourcesData should have size_t type instead of int.
+        https://bugs.webkit.org/show_bug.cgi?id=92618
+
+        Reviewed by Yury Semikhatsky.
+
+        Changed content size variables type in NetworkResourcesData from int to size_t.
+        Drive-by: Switched String length calculation to recently added StringImpl's sizeInBytes.
+
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::NetworkResourcesData::ResourceData::removeContent):
+        (WebCore::NetworkResourcesData::ResourceData::dataLength):
+        (WebCore::NetworkResourcesData::ResourceData::appendData):
+        (WebCore::NetworkResourcesData::ResourceData::decodeDataToContent):
+        (WebCore::NetworkResourcesData::setResourceContent):
+        (WebCore::NetworkResourcesData::maybeAddResourceData):
+        (WebCore::NetworkResourcesData::maybeDecodeDataToContent):
+        (WebCore::NetworkResourcesData::setResourcesDataSizeLimits):
+        (WebCore::NetworkResourcesData::ensureFreeSpace):
+        * inspector/NetworkResourcesData.h:
+        (ResourceData):
+        (NetworkResourcesData):
+
+2012-07-30  Hayato Ito  <hayato@chromium.org>
+
+        Remove an useless member variable, m_shouldPreventDispatch, from EventDispatcher.
+        https://bugs.webkit.org/show_bug.cgi?id=92625
+
+        Reviewed by Hajime Morita.
+
+        EventDispatcher::m_shouldPreventDispatch does not have any effects. We can remove that.
+
+        No new tests, no behavior change.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::EventDispatcher):
+        (WebCore::EventDispatcher::dispatchEvent):
+        * dom/EventDispatcher.h:
+        (EventDispatcher):
+
+2012-07-30  Hayato Ito  <hayato@chromium.org>
+
+        Remove an useless member variable, m_shouldPreventDispatch, from EventDispatcher.
+        https://bugs.webkit.org/show_bug.cgi?id=92625
+
+        Reviewed by Hajime Morita.
+
+        EventDispatcher::m_shouldPreventDispatch does not have any effects. We can remove that.
+
+        No new tests, no behavior change.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::EventDispatcher):
+        (WebCore::EventDispatcher::dispatchEvent):
+        * dom/EventDispatcher.h:
+        (EventDispatcher):
+
+2012-07-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: make MemoryInstrumentation methods private
+        https://bugs.webkit.org/show_bug.cgi?id=92379
+
+        Reviewed by Vsevolod Vlasov.
+
+        MemoryInstrumentation was refactored.
+        - All reporting methods on MemoryInstrumentation except add*Object are
+          private to enforce MemoryClassInfo usage.
+        - MemoryInstrumentation::Add*Member methods renamed to Add*Object
+        - String reporting is implemented directly in the MemoryInstrumentation,
+          not in its descendants.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
+        * dom/MemoryInstrumentation.cpp: Added.
+        (WebCore):
+        (WebCore::MemoryInstrumentation::addString):
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryInstrumentation::addInstrumentedObject):
+        (WebCore::MemoryInstrumentation::addObject):
+        (MemoryInstrumentation):
+        (InstrumentedPointerBase):
+        (WebCore::MemoryInstrumentation::InstrumentedPointerBase::~InstrumentedPointerBase):
+        (InstrumentedPointer):
+        (WebCore::MemoryInstrumentation::InstrumentedPointer::InstrumentedPointer):
+        (WebCore::MemoryInstrumentation::OwningTraits::addInstrumentedObject):
+        (WebCore::MemoryInstrumentation::OwningTraits::addObject):
+        (WebCore::MemoryInstrumentation::addInstrumentedObjectImpl):
+        (WebCore::MemoryClassInfo::addInstrumentedMember):
+        (WebCore::MemoryClassInfo::addMember):
+        (WebCore):
+        (WebCore::MemoryInstrumentation::addObjectImpl):
+        (WebCore::MemoryInstrumentation::addInstrumentedCollection):
+        (WebCore::MemoryInstrumentation::calculateContainerSize):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+
+2012-07-30  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] No color swatch for the SVG "fill" and "stroke" property values
+        https://bugs.webkit.org/show_bug.cgi?id=92638
+
+        Reviewed by Vsevolod Vlasov.
+
+        Added the "fill" and "stroke" properties to the list of color-aware properties.
+
+        * inspector/front-end/CSSKeywordCompletions.js:
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124000.
+        http://trac.webkit.org/changeset/124000
+        https://bugs.webkit.org/show_bug.cgi?id=92632
+
+        seems to have broken chromium Range_InstanceSizeUnknown unit
+        test across many platforms (Requested by tomhudson on
+        #webkit).
+
+        * WebCore.exp.in:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didReceiveData):
+        (WebCore::InspectorResourceAgent::getResponseBody):
+        * inspector/InspectorResourceAgent.h:
+        (InspectorResourceAgent):
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::NetworkResourcesData::ResourceData::ResourceData):
+        (WebCore::NetworkResourcesData::ResourceData::setContent):
+        (WebCore::NetworkResourcesData::setResourceContent):
+        * inspector/NetworkResourcesData.h:
+        (ResourceData):
+        (WebCore::NetworkResourcesData::ResourceData::cachedResource):
+        (NetworkResourcesData):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::~CachedResource):
+        (WebCore::CachedResource::removeClient):
+        (WebCore::CachedResource::deleteIfPossible):
+        (WebCore):
+        * loader/cache/CachedResource.h:
+        (CachedResource):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::garbageCollectDocumentResourcesTimerFired):
+        (WebCore::CachedResourceLoader::clearPreloads):
+        * loader/cache/CachedResourceLoader.h:
+        (CachedResourceLoader):
+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::evict):
+        * testing/InternalSettings.cpp:
+        * testing/Internals.cpp:
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-07-30  Hayato Ito  <hayato@chromium.org>
+
+        Remove an unused member variable, m_originalTarget, from EventDispatcher.
+        https://bugs.webkit.org/show_bug.cgi?id=92614
+
+        Reviewed by Andreas Kling.
+
+        No one uses EventDispatcher::m_originalTarget.
+
+        No new tests, no behavior change.
+
+        * dom/EventDispatcher.h:
+        (EventDispatcher):
+
+2012-07-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Fix issues remaining with fixed positioned layers
+        https://bugs.webkit.org/show_bug.cgi?id=92528
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::syncCompositingStateSelf):
+        Make sure that the delta is used when syncCompositingStateSelf is called afterward.
+        (WebCore::TextureMapperLayer::setScrollPositionDeltaIfNeeded):
+        * platform/graphics/texmap/TextureMapperLayer.h:
+        Use a FloatSize instead of an IntPoint for the delta.
+        (TextureMapperLayer):
+        (WebCore::TextureMapperLayer::adjustedPosition):
+
+2012-07-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Replace UnicodeWinCE with UnicodeWchar
+        https://bugs.webkit.org/show_bug.cgi?id=92539
+
+        Reviewed by Ryosuke Niwa.
+
+        UnicodeWinCE never contained WinCE specific code. UnicodeWchar
+        is a replacement for it, which is mainly based on the functions
+        from <wchar.h>. It is ment as a minimal Unicode backend, which
+        can be used very easy and has no external dependencies.
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::extendTextCodecMaps):
+
+2012-07-30  Hayato Ito  <hayato@chromium.org>
+
+        Remove unnecessary code which set event's target from EventDispatcher::dispatchEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=92613
+
+        Reviewed by Hajime Morita.
+
+        EventContext::handleLocalEvents does all required jobs so we don't
+        need to set target in EventDispacher::dispatchEvent() for TARGET phase.
+
+        No new tests, no behavior change.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchEvent):
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124004.
+        http://trac.webkit.org/changeset/124004
+        https://bugs.webkit.org/show_bug.cgi?id=92622
+
+        Broke Android build (Requested by keishi on #webkit).
+
+        * rendering/RenderThemeChromiumCommon.cpp:
+        (WebCore::RenderThemeChromiumCommon::supportsDataListUI):
+
+2012-07-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: element tag disappears after editing
+        https://bugs.webkit.org/show_bug.cgi?id=92385
+
+        Reviewed by Vsevolod Vlasov.
+
+        This has regressed when we started hiding elements panel upon
+        batch updates. Narrowing hiding cases, updating selection
+        in on-screen mode only.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.updateSelection):
+
+2012-07-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: move StringImpl size calculation to StringImpl
+        https://bugs.webkit.org/show_bug.cgi?id=92359
+
+        Reviewed by Pavel Feldman.
+
+        Moved stringSize(StringImpl*) implementation from InspectorMemoryAgent to
+        StringImpl::sizeInBytes();
+
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+
+2012-07-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: workers inspector is broken in the remote debugging mode
+        https://bugs.webkit.org/show_bug.cgi?id=92540
+
+        Reviewed by Yury Semikhatsky.
+
+        The problem was that worker manager re-used complete url with query parameters
+        for spin-off worker front-ends. As a result, in case of remote debugging, newly
+        created front-ends were connecting to the same web socket (because of the ws parameter).
+
+        * inspector/front-end/WorkerManager.js:
+        (WebInspector.WorkerManager.isDedicatedWorkerFrontend):
+        * inspector/front-end/inspector.js:
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        Test: platform/chromium/fast/forms/color/color-suggestion-picker-appearance.html
+
+        * rendering/RenderThemeChromiumCommon.cpp:
+        (WebCore::RenderThemeChromiumCommon::supportsDataListUI): Added color to types supporting datalist.
+
+2012-07-30  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        REGRESSION (r123767): platform/gtk/accessibility/object-with-title.html failing on GTK
+        https://bugs.webkit.org/show_bug.cgi?id=92477
+
+        Reviewed by Chris Fleizach.
+
+        Consider title and accessibilityDescription together with helpText to
+        decide whether an object should be exposed in the accessibility tree.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
 2012-07-29  Vsevolod Vlasov  <vsevik@chromium.org>
 
         Web Inspector: Resource agent's reference to cached resources should be weak.
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index 70cf60c23..10257077c 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -40,6 +40,7 @@ ENABLE_CSP_NEXT = ;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
+ENABLE_CSS_HIERARCHIES = ;
 ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
@@ -134,7 +135,9 @@ ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
 ENABLE_WEB_TIMING = ;
+ENABLE_WIDGET_REGION = $(ENABLE_WIDGET_REGION_$(REAL_PLATFORM_NAME));
+ENABLE_WIDGET_REGION_macosx = ENABLE_WIDGET_REGION;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WIDGET_REGION) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebCore/Configurations/Version.xcconfig b/Source/WebCore/Configurations/Version.xcconfig
index 0e5c3b032..c5c8365a3 100644
--- a/Source/WebCore/Configurations/Version.xcconfig
+++ b/Source/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 3;
+MINOR_VERSION = 6;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebCore/DerivedSources.cpp b/Source/WebCore/DerivedSources.cpp
index f80a9e20b..b72567215 100644
--- a/Source/WebCore/DerivedSources.cpp
+++ b/Source/WebCore/DerivedSources.cpp
@@ -116,6 +116,7 @@
 #include "JSEvent.cpp"
 #include "JSEventException.cpp"
 #include "JSEventSource.cpp"
+#include "JSEventTarget.cpp"
 #include "JSFile.cpp"
 #include "JSFileCallback.cpp"
 #include "JSFileEntry.cpp"
@@ -237,6 +238,9 @@
 #include "JSMediaError.cpp"
 #include "JSMediaList.cpp"
 #include "JSMediaQueryList.cpp"
+#if ENABLE(MEDIA_SOURCE)
+#include "JSMediaSource.cpp"
+#endif
 #include "JSMemoryInfo.cpp"
 #include "JSMessageChannel.cpp"
 #include "JSMessageEvent.cpp"
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index 32e692625..c57ad9bb9 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -106,6 +106,7 @@ BINDING_IDLS = \
     $(WebCore)/Modules/indexeddb/IDBVersionChangeEvent.idl \
     $(WebCore)/Modules/indexeddb/IDBVersionChangeRequest.idl \
     $(WebCore)/Modules/indexeddb/WorkerContextIndexedDatabase.idl \
+    $(WebCore)/Modules/mediasource/MediaSource.idl \
     $(WebCore)/Modules/mediasource/SourceBuffer.idl \
     $(WebCore)/Modules/mediasource/SourceBufferList.idl \
     $(WebCore)/Modules/notifications/DOMWindowNotifications.idl \
@@ -140,6 +141,7 @@ BINDING_IDLS = \
     $(WebCore)/Modules/webaudio/DynamicsCompressorNode.idl \
     $(WebCore)/Modules/webaudio/JavaScriptAudioNode.idl \
     $(WebCore)/Modules/webaudio/MediaElementAudioSourceNode.idl \
+    $(WebCore)/Modules/webaudio/MediaStreamAudioSourceNode.idl \
     $(WebCore)/Modules/webaudio/Oscillator.idl \
     $(WebCore)/Modules/webaudio/OfflineAudioCompletionEvent.idl \
     $(WebCore)/Modules/webaudio/RealtimeAnalyserNode.idl \
@@ -694,10 +696,18 @@ endif
 
 endif # MACOS
 
+ifndef ENABLE_WIDGET_REGION
+    ENABLE_WIDGET_REGION = 0
+endif
+
 ifeq ($(ENABLE_ORIENTATION_EVENTS), 1)
     ADDITIONAL_IDL_DEFINES := $(ADDITIONAL_IDL_DEFINES) ENABLE_ORIENTATION_EVENTS
 endif
 
+ifeq ($(ENABLE_WIDGET_REGION), 1)
+    ADDITIONAL_IDL_DEFINES := $(ADDITIONAL_IDL_DEFINES) ENABLE_WIDGET_REGION
+endif
+
 # --------
 
 # CSS property names and value keywords
@@ -947,15 +957,36 @@ preprocess_idls_script = perl $(addprefix -I $(WebCore)/, $(sort $(dir $(1)))) $
 # JS bindings generator
 
 IDL_INCLUDES = \
+    $(WebCore)/Modules/battery \
+    $(WebCore)/Modules/filesystem \
+    $(WebCore)/Modules/gamepad \
+    $(WebCore)/Modules/geolocation \
+    $(WebCore)/Modules/indexeddb \
+    $(WebCore)/Modules/intents \
+    $(WebCore)/Modules/mediasource \
+    $(WebCore)/Modules/mediastream \
+    $(WebCore)/Modules/networkinfo \
+    $(WebCore)/Modules/notifications \
+    $(WebCore)/Modules/speech \
+    $(WebCore)/Modules/vibration \
+    $(WebCore)/Modules/webaudio \
+    $(WebCore)/Modules/webdatabase \
+    $(WebCore)/Modules/websockets \
+    $(WebCore)/css \
     $(WebCore)/dom \
     $(WebCore)/fileapi \
     $(WebCore)/html \
-    $(WebCore)/css \
-    $(WebCore)/Modules/mediasource \
-    $(WebCore)/Modules/notifications \
+    $(WebCore)/html/canvas \
+    $(WebCore)/html/shadow \
+    $(WebCore)/html/track \
+    $(WebCore)/inspector \
+    $(WebCore)/loader/appcache \
     $(WebCore)/page \
-    $(WebCore)/xml \
-    $(WebCore)/svg
+    $(WebCore)/plugins \
+    $(WebCore)/storage \
+    $(WebCore)/svg \
+    $(WebCore)/workers \
+    $(WebCore)/xml
 
 IDL_COMMON_ARGS = $(IDL_INCLUDES:%=--include %) --write-dependencies --outputDir .
 
diff --git a/Source/WebCore/DerivedSources.pri b/Source/WebCore/DerivedSources.pri
index 93f3dda6a..3bc4d91b6 100644
--- a/Source/WebCore/DerivedSources.pri
+++ b/Source/WebCore/DerivedSources.pri
@@ -613,6 +613,13 @@ contains(DEFINES, ENABLE_SVG=1) {
     $$PWD/svg/SVGZoomEvent.idl
 }
 
+contains(DEFINES, ENABLE_GAMEPAD=1) {
+  IDL_BINDINGS += \
+    $$PWD/Modules/gamepad/Gamepad.idl \
+    $$PWD/Modules/gamepad/GamepadList.idl \
+    $$PWD/Modules/gamepad/NavigatorGamepad.idl
+}
+
 contains(DEFINES, ENABLE_VIDEO_TRACK=1) {
   IDL_BINDINGS += \
     $$PWD/html/track/TextTrack.idl \
@@ -624,6 +631,7 @@ contains(DEFINES, ENABLE_VIDEO_TRACK=1) {
 
 contains(DEFINES, ENABLE_MEDIA_SOURCE=1) {
   IDL_BINDINGS += \
+    $$PWD/Modules/mediasource/MediaSource.idl \
     $$PWD/Modules/mediasource/SourceBuffer.idl \
     $$PWD/Modules/mediasource/SourceBufferList.idl
 }
@@ -706,19 +714,29 @@ generateBindings.commands = perl -I$$PWD/bindings/scripts $$generateBindings.scr
                             --include $$PWD/Modules/filesystem \
                             --include $$PWD/Modules/geolocation \
                             --include $$PWD/Modules/indexeddb \
+                            --include $$PWD/Modules/mediasource \
+                            --include $$PWD/Modules/notifications \
                             --include $$PWD/Modules/quota \
                             --include $$PWD/Modules/webaudio \
                             --include $$PWD/Modules/webdatabase \
                             --include $$PWD/Modules/websockets \
+                            --include $$PWD/css \
                             --include $$PWD/dom \
+                            --include $$PWD/editing \
                             --include $$PWD/fileapi \
                             --include $$PWD/html \
-                            --include $$PWD/xml \
-                            --include $$PWD/svg \
+                            --include $$PWD/html/canvas \
+                            --include $$PWD/html/shadow \
+                            --include $$PWD/html/track \
+                            --include $$PWD/inspector \
+                            --include $$PWD/loader/appcache \
+                            --include $$PWD/page \
+                            --include $$PWD/plugins \
                             --include $$PWD/storage \
-                            --include $$PWD/css \
+                            --include $$PWD/svg \
                             --include $$PWD/testing \
                             --include $$PWD/workers \
+                            --include $$PWD/xml \
                             --outputDir ${QMAKE_FUNC_FILE_OUT_PATH} \
                             --supplementalDependencyFile ${QMAKE_FUNC_FILE_OUT_PATH}/$$SUPPLEMENTAL_DEPENDENCY_FILE \
                             --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index 79694bec7..b6baa795e 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
@@ -90,6 +90,7 @@ localizedStrings["Audit Present State"] = "Audit Present State";
 localizedStrings["Audits"] = "Audits";
 localizedStrings["Average"] = "Average";
 localizedStrings["Blocking"] = "Blocking";
+localizedStrings["Break on..."] = "Break on...";
 localizedStrings["Breakpoints"] = "Breakpoints";
 localizedStrings["Cookies"] = "Cookies";
 localizedStrings["COUNTERS"] = "COUNTERS";
@@ -143,7 +144,7 @@ localizedStrings["Copy response headers"] = "Copy response headers";
 localizedStrings["Copy Response Headers"] = "Copy Response Headers";
 localizedStrings["Copy XPath"] = "Copy XPath";
 localizedStrings["Count"] = "Count";
-localizedStrings["Databases"] = "Databases";
+localizedStrings["Web SQL"] = "Web SQL";
 localizedStrings["DNS Lookup"] = "DNS Lookup";
 localizedStrings["DOMContent event fired"] = "DOMContent event fired";
 localizedStrings["DOMContent event"] = "DOMContent event";
@@ -285,6 +286,7 @@ localizedStrings["Objects"] = "Objects";
 localizedStrings["Offline"] = "Offline";
 localizedStrings["Online"] = "Online";
 localizedStrings["Only enable for this session"] = "Only enable for this session";
+localizedStrings["Overrides"] = "Overrides";
 localizedStrings["Reveal in Network Panel"] = "Reveal in Network Panel";
 localizedStrings["Reveal in network panel"] = "Reveal in network panel";
 localizedStrings["Open Link in New Tab"] = "Open Link in New Tab";
@@ -292,7 +294,7 @@ localizedStrings["Open link in new tab"] = "Open link in new tab";
 localizedStrings["Open Link in Resources Panel"] = "Open Link in Resources Panel";
 localizedStrings["Open link in Resources panel"] = "Open link in Resources panel";
 localizedStrings["Other"] = "Other";
-localizedStrings["Override device metrics"] = "Override device metrics";
+localizedStrings["Device metrics"] = "Device metrics";
 localizedStrings["Paint"] = "Paint";
 localizedStrings["Parse"] = "Parse";
 localizedStrings["Parser"] = "Parser";
@@ -473,12 +475,12 @@ localizedStrings["view URL encoded"] = "view URL encoded";
 localizedStrings["view decoded"] = "view decoded";
 localizedStrings["view parsed"] = "view parsed";
 localizedStrings["view source"] = "view source";
-localizedStrings["Break on Attributes Modifications"] = "Break on Attributes Modifications";
-localizedStrings["Break on attributes modifications"] = "Break on attributes modifications";
-localizedStrings["Break on Node Removal"] = "Break on Node Removal";
-localizedStrings["Break on node removal"] = "Break on node removal";
-localizedStrings["Break on Subtree Modifications"] = "Break on Subtree Modifications";
-localizedStrings["Break on subtree modifications"] = "Break on subtree modifications";
+localizedStrings["Attributes Modifications"] = "Attributes Modifications";
+localizedStrings["Attributes modifications"] = "Attributes modifications";
+localizedStrings["Node Removal"] = "Node Removal";
+localizedStrings["Node removal"] = "Node removal";
+localizedStrings["Subtree Modifications"] = "Subtree Modifications";
+localizedStrings["Subtree modifications"] = "Subtree modifications";
 localizedStrings["<node>"] = "<node>";
 localizedStrings["Paused on a \"%s\" breakpoint set on %s, because a new child was added to its descendant %s."] = "Paused on a \"%s\" breakpoint set on %s, because a new child was added to its descendant %s.";
 localizedStrings["Paused on a \"%s\" breakpoint set on %s, because a new child was added to that node."] = "Paused on a \"%s\" breakpoint set on %s, because a new child was added to that node.";
@@ -622,7 +624,7 @@ localizedStrings["4 spaces"] = "4 spaces";
 localizedStrings["8 spaces"] = "8 spaces";
 localizedStrings["Tab character"] = "Tab character";
 localizedStrings["Search in content scripts"] = "Search in content scripts";
-localizedStrings["Override User Agent"] = "Override User Agent";
+localizedStrings["User Agent"] = "User Agent";
 localizedStrings["Other..."] = "Other...";
 localizedStrings["Search across all sources"] = "Search across all sources";
 localizedStrings["Evaluate in console"] = "Evaluate in console";
@@ -725,3 +727,4 @@ localizedStrings["Paused in debugger"] = "Paused in debugger";
 localizedStrings["Emulate position unavailable"] = "Emulate position unavailable";
 localizedStrings["Override Geolocation"] = "Override Geolocation";
 localizedStrings["Geolocation Position"] = "Geolocation Position";
+localizedStrings["Override Device Orientation"] = "Override Device Orientation";
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index 32af5c37c..e714c5ada 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -26,7 +26,6 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/WebCore/bindings \
 	-I$(srcdir)/Source/WebCore/bindings/generic \
 	-I$(srcdir)/Source/WebCore/bindings/js \
-	-I$(srcdir)/Source/WebCore/bindings/js/specialization \
 	-I$(srcdir)/Source/WebCore/bridge \
 	-I$(srcdir)/Source/WebCore/bridge/c \
 	-I$(srcdir)/Source/WebCore/bridge/jni/jsc \
@@ -750,6 +749,14 @@ webcore_cppflags += -DENABLE_LINK_PREFETCH=1
 endif  # END ENABLE_LINK_PREFETCH
 
 # ---
+# Widget region support
+# ---
+if ENABLE_WIDGET_REGION
+FEATURE_DEFINES += ENABLE_WIDGET_REGION=1
+webcore_cppflags += -DENABLE_WIDGET_REGION=1
+endif  # END ENABLE_WIDGET_REGION
+
+# ---
 # Spell check support
 # ---
 if ENABLE_SPELLCHECK
@@ -1053,6 +1060,7 @@ libWebCoreGtk_la_CPPFLAGS = \
 	$(HILDON_CPPFLAGS) \
 	$(COVERAGE_CFLAGS) \
 	$(ENCHANT_CFLAGS) \
+	$(FARSTREAM_CFLAGS) \
 	$(GAIL_CFLAGS) \
 	$(GEOCLUE_CFLAGS) \
 	$(GLIB_CFLAGS) \
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
index c9e923090..c61bb8df4 100644
--- a/Source/WebCore/GNUmakefile.list.am
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -383,6 +383,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSMediaError.h \
 	DerivedSources/WebCore/JSMediaList.cpp \
 	DerivedSources/WebCore/JSMediaList.h \
+	DerivedSources/WebCore/JSMediaSource.cpp \
+	DerivedSources/WebCore/JSMediaSource.h \
 	DerivedSources/WebCore/JSMediaStream.cpp \
 	DerivedSources/WebCore/JSMediaStream.h \
 	DerivedSources/WebCore/JSMediaStreamEvent.cpp \
@@ -491,6 +493,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSRect.h \
 	DerivedSources/WebCore/JSRGBColor.cpp \
 	DerivedSources/WebCore/JSRGBColor.h \
+	DerivedSources/WebCore/JSRTCPeerConnection.cpp \
+	DerivedSources/WebCore/JSRTCPeerConnection.h \
 	DerivedSources/WebCore/JSScreen.cpp \
 	DerivedSources/WebCore/JSScreen.h \
 	DerivedSources/WebCore/JSScriptProfile.cpp \
@@ -698,6 +702,7 @@ dom_binding_idls += \
 	$(WebCore)/Modules/geolocation/PositionCallback.idl \
 	$(WebCore)/Modules/geolocation/PositionError.idl \
 	$(WebCore)/Modules/geolocation/PositionErrorCallback.idl \
+	$(WebCore)/Modules/mediasource/MediaSource.idl \
 	$(WebCore)/Modules/mediasource/SourceBuffer.idl \
 	$(WebCore)/Modules/mediasource/SourceBufferList.idl \
 	$(WebCore)/Modules/mediastream/DOMWindowMediaStream.idl \
@@ -715,6 +720,7 @@ dom_binding_idls += \
 	$(WebCore)/Modules/mediastream/NavigatorUserMediaErrorCallback.idl \
 	$(WebCore)/Modules/mediastream/NavigatorUserMediaSuccessCallback.idl \
 	$(WebCore)/Modules/mediastream/PeerConnection00.idl \
+	$(WebCore)/Modules/mediastream/RTCPeerConnection.idl \
 	$(WebCore)/Modules/mediastream/SessionDescription.idl \
 	$(WebCore)/Modules/notifications/Notification.idl \
 	$(WebCore)/Modules/notifications/NotificationCenter.idl \
@@ -1169,6 +1175,10 @@ webcore_modules_sources += \
 	Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.h \
 	Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.cpp \
 	Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.h \
+	Source/WebCore/Modules/mediasource/MediaSource.cpp \
+	Source/WebCore/Modules/mediasource/MediaSource.h \
+	Source/WebCore/Modules/mediasource/MediaSourceRegistry.cpp \
+	Source/WebCore/Modules/mediasource/MediaSourceRegistry.h \
 	Source/WebCore/Modules/mediasource/SourceBuffer.cpp \
 	Source/WebCore/Modules/mediasource/SourceBuffer.h \
 	Source/WebCore/Modules/mediasource/SourceBufferList.cpp \
@@ -1199,6 +1209,8 @@ webcore_modules_sources += \
 	Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.h \
 	Source/WebCore/Modules/mediastream/PeerConnection00.cpp \
 	Source/WebCore/Modules/mediastream/PeerConnection00.h \
+	Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp \
+	Source/WebCore/Modules/mediastream/RTCPeerConnection.h \
 	Source/WebCore/Modules/mediastream/SessionDescription.cpp \
 	Source/WebCore/Modules/mediastream/SessionDescription.h \
 	Source/WebCore/Modules/mediastream/UserMediaClient.h \
@@ -1358,12 +1370,15 @@ webcore_sources += \
 	Source/WebCore/accessibility/AXObjectCache.h \
 	Source/WebCore/bindings/generic/ActiveDOMCallback.cpp \
 	Source/WebCore/bindings/generic/ActiveDOMCallback.h \
-	Source/WebCore/bindings/generic/BindingSecurityBase.cpp \
-	Source/WebCore/bindings/generic/BindingSecurityBase.h \
+	Source/WebCore/bindings/generic/BindingSecurity.cpp \
 	Source/WebCore/bindings/generic/BindingSecurity.h \
 	Source/WebCore/bindings/generic/GenericBinding.h \
 	Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp \
 	Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h \
+	Source/WebCore/bindings/js/ArrayValue.cpp \
+	Source/WebCore/bindings/js/ArrayValue.h \
+	Source/WebCore/bindings/js/BindingState.cpp \
+	Source/WebCore/bindings/js/BindingState.h \
 	Source/WebCore/bindings/js/CachedScriptSourceProvider.h \
 	Source/WebCore/bindings/js/CallbackFunction.cpp \
 	Source/WebCore/bindings/js/CallbackFunction.h \
@@ -1445,8 +1460,6 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSExceptionBase.cpp \
 	Source/WebCore/bindings/js/JSExceptionBase.h \
 	Source/WebCore/bindings/js/JSFileReaderCustom.cpp \
-	Source/WebCore/bindings/js/JSFloat32ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSFloat64ArrayCustom.cpp \
 	Source/WebCore/bindings/js/JSGeolocationCustom.cpp \
 	Source/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp \
 	Source/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp \
@@ -1479,9 +1492,6 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp \
 	Source/WebCore/bindings/js/JSInjectedScriptManager.cpp \
 	Source/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp \
-	Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSInt32ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSInt8ArrayCustom.cpp \
 	Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp \
 	Source/WebCore/bindings/js/JSLazyEventListener.cpp \
 	Source/WebCore/bindings/js/JSLazyEventListener.h \
@@ -1533,10 +1543,6 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSTrackCustom.h \
 	Source/WebCore/bindings/js/JSTrackEventCustom.cpp \
 	Source/WebCore/bindings/js/JSTreeWalkerCustom.cpp \
-	Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSUint8ClampedArrayCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
@@ -1804,6 +1810,8 @@ webcore_sources += \
 	Source/WebCore/css/WebKitCSSKeyframesRule.h \
 	Source/WebCore/css/WebKitCSSMatrix.cpp \
 	Source/WebCore/css/WebKitCSSMatrix.h \
+	Source/WebCore/css/WebKitCSSMixFunctionValue.cpp \
+	Source/WebCore/css/WebKitCSSMixFunctionValue.h \
 	Source/WebCore/css/WebKitCSSRegionRule.cpp \
 	Source/WebCore/css/WebKitCSSRegionRule.h \
 	Source/WebCore/css/WebKitCSSSVGDocumentValue.cpp \
@@ -1952,6 +1960,8 @@ webcore_sources += \
 	Source/WebCore/dom/ExceptionCodePlaceholder.cpp \
 	Source/WebCore/dom/ExceptionCodePlaceholder.h \
 	Source/WebCore/dom/FragmentScriptingPermission.h \
+	Source/WebCore/dom/GestureEvent.cpp \
+	Source/WebCore/dom/GestureEvent.h \
 	Source/WebCore/dom/IgnoreDestructiveWriteCountIncrementer.h \
 	Source/WebCore/dom/ExceptionCodePlaceholder.h \
 	Source/WebCore/dom/GenericEventQueue.cpp \
@@ -1965,6 +1975,7 @@ webcore_sources += \
 	Source/WebCore/dom/HashChangeEvent.h \
 	Source/WebCore/dom/KeyboardEvent.cpp \
 	Source/WebCore/dom/KeyboardEvent.h \
+	Source/WebCore/dom/MemoryInstrumentation.cpp \
 	Source/WebCore/dom/MemoryInstrumentation.h \
 	Source/WebCore/dom/MessageChannel.cpp \
 	Source/WebCore/dom/MessageChannel.h \
@@ -2714,8 +2725,6 @@ webcore_sources += \
 	Source/WebCore/inspector/ContentSearchUtils.h \
 	Source/WebCore/inspector/DOMEditor.cpp \
 	Source/WebCore/inspector/DOMEditor.h \
-	Source/WebCore/inspector/DOMNodeHighlighter.cpp \
-	Source/WebCore/inspector/DOMNodeHighlighter.h \
 	Source/WebCore/inspector/DOMPatchSupport.cpp \
 	Source/WebCore/inspector/DOMPatchSupport.h \
 	Source/WebCore/inspector/IdentifiersFactory.cpp \
@@ -2780,6 +2789,8 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorInstrumentation.h \
 	Source/WebCore/inspector/InspectorMemoryAgent.cpp \
 	Source/WebCore/inspector/InspectorMemoryAgent.h \
+	Source/WebCore/inspector/InspectorOverlay.cpp \
+	Source/WebCore/inspector/InspectorOverlay.h \
 	Source/WebCore/inspector/InspectorPageAgent.cpp \
 	Source/WebCore/inspector/InspectorPageAgent.h \
 	Source/WebCore/inspector/InspectorProfilerAgent.cpp \
@@ -2807,6 +2818,8 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorWorkerResource.h \
 	Source/WebCore/inspector/InstrumentingAgents.cpp \
 	Source/WebCore/inspector/InstrumentingAgents.h \
+	Source/WebCore/inspector/MemoryInstrumentationImpl.cpp \
+	Source/WebCore/inspector/MemoryInstrumentationImpl.h \
 	Source/WebCore/inspector/NetworkResourcesData.cpp \
 	Source/WebCore/inspector/NetworkResourcesData.h \
 	Source/WebCore/inspector/PageConsoleAgent.cpp \
@@ -2974,6 +2987,7 @@ webcore_sources += \
 	Source/WebCore/loader/SubframeLoader.h \
 	Source/WebCore/loader/SubresourceLoader.cpp \
 	Source/WebCore/loader/SubresourceLoader.h \
+	Source/WebCore/loader/SubstituteData.cpp \
 	Source/WebCore/loader/SubstituteData.h \
 	Source/WebCore/loader/SubstituteResource.h \
 	Source/WebCore/loader/TextResourceDecoder.cpp \
@@ -3107,7 +3121,6 @@ webcore_sources += \
 	Source/WebCore/page/PerformanceResourceTiming.h \
 	Source/WebCore/page/PerformanceTiming.cpp \
 	Source/WebCore/page/PerformanceTiming.h \
-	Source/WebCore/page/PointerLock.h \
 	Source/WebCore/page/PointerLockController.cpp \
 	Source/WebCore/page/PointerLockController.h \
 	Source/WebCore/page/PrintContext.cpp \
@@ -3229,6 +3242,7 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/ColorSpace.h \
 	Source/WebCore/platform/graphics/DashArray.h \
 	Source/WebCore/platform/graphics/Extensions3D.h \
+	Source/WebCore/platform/graphics/NativeImagePtr.h \
 	Source/WebCore/platform/graphics/cairo/BitmapImageCairo.cpp \
 	Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp \
 	Source/WebCore/platform/graphics/cairo/CairoUtilities.h \
@@ -3263,6 +3277,8 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/filters/CustomFilterParameter.h \
 	Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp \
 	Source/WebCore/platform/graphics/filters/CustomFilterProgram.h \
+	Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.cpp \
+	Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.h \
 	Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp \
 	Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h \
 	Source/WebCore/platform/graphics/filters/DistantLightSource.cpp \
@@ -3406,6 +3422,7 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/MediaPlayer.cpp \
 	Source/WebCore/platform/graphics/MediaPlayer.h \
 	Source/WebCore/platform/graphics/MediaPlayerPrivate.h \
+	Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.h \
 	Source/WebCore/platform/graphics/Path.cpp \
 	Source/WebCore/platform/graphics/Path.h \
 	Source/WebCore/platform/graphics/PathTraversalState.cpp \
@@ -3548,6 +3565,10 @@ webcore_sources += \
 	Source/WebCore/platform/mediastream/PeerConnection00Handler.cpp \
 	Source/WebCore/platform/mediastream/PeerConnection00Handler.h \
 	Source/WebCore/platform/mediastream/PeerConnection00HandlerClient.h \
+	Source/WebCore/platform/mediastream/RTCConfiguration.h \
+	Source/WebCore/platform/mediastream/RTCPeerConnectionHandler.cpp \
+	Source/WebCore/platform/mediastream/RTCPeerConnectionHandler.h \
+	Source/WebCore/platform/mediastream/RTCPeerConnectionHandlerClient.h \
 	Source/WebCore/platform/mediastream/SessionDescriptionDescriptor.cpp \
 	Source/WebCore/platform/mediastream/SessionDescriptionDescriptor.h \
 	Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp \
@@ -4794,7 +4815,6 @@ webcoregtk_sources += \
 	Source/WebCore/accessibility/gtk/WebKitAccessibleUtil.h \
 	Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp \
 	Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.h \
-	Source/WebCore/bindings/js/ScriptControllerGtk.cpp \
 	Source/WebCore/editing/gtk/FrameSelectionGtk.cpp \
 	Source/WebCore/page/gtk/DragControllerGtk.cpp \
 	Source/WebCore/page/gtk/EventHandlerGtk.cpp \
@@ -5731,6 +5751,8 @@ webcore_sources += \
 	Source/WebCore/Modules/webaudio/JavaScriptAudioNode.h \
 	Source/WebCore/Modules/webaudio/MediaElementAudioSourceNode.cpp \
 	Source/WebCore/Modules/webaudio/MediaElementAudioSourceNode.h \
+	Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.cpp \
+	Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.h \
 	Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.h \
 	Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.cpp \
 	Source/WebCore/Modules/webaudio/OfflineAudioCompletionEvent.h \
@@ -5753,7 +5775,6 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSAudioContextCustom.cpp \
 	Source/WebCore/bindings/js/JSConvolverNodeCustom.cpp \
 	Source/WebCore/bindings/js/JSJavaScriptAudioNodeCustom.cpp \
-	Source/WebCore/bindings/js/JSWaveShaperNodeCustom.cpp \
 	Source/WebCore/platform/audio/AudioArray.h \
 	Source/WebCore/platform/audio/AudioBus.cpp \
 	Source/WebCore/platform/audio/AudioBus.h \
@@ -5764,6 +5785,7 @@ webcore_sources += \
 	Source/WebCore/platform/audio/AudioDSPKernelProcessor.cpp \
 	Source/WebCore/platform/audio/AudioDSPKernelProcessor.h \
 	Source/WebCore/platform/audio/AudioFileReader.h \
+	Source/WebCore/platform/audio/AudioIOCallback.h \
 	Source/WebCore/platform/audio/AudioProcessor.h \
 	Source/WebCore/platform/audio/AudioResampler.cpp \
 	Source/WebCore/platform/audio/AudioResampler.h \
@@ -5870,6 +5892,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSOfflineAudioCompletionEvent.h \
 	DerivedSources/WebCore/JSMediaElementAudioSourceNode.cpp \
 	DerivedSources/WebCore/JSMediaElementAudioSourceNode.h \
+	DerivedSources/WebCore/JSMediaStreamAudioSourceNode.cpp \
+	DerivedSources/WebCore/JSMediaStreamAudioSourceNode.h \
 	DerivedSources/WebCore/JSRealtimeAnalyserNode.cpp \
 	DerivedSources/WebCore/JSRealtimeAnalyserNode.h
 
@@ -5892,6 +5916,7 @@ dom_binding_idls += \
 	$(WebCore)/Modules/webaudio/DelayNode.idl \
 	$(WebCore)/Modules/webaudio/JavaScriptAudioNode.idl \
 	$(WebCore)/Modules/webaudio/MediaElementAudioSourceNode.idl \
+	$(WebCore)/Modules/webaudio/MediaStreamAudioSourceNode.idl \
 	$(WebCore)/Modules/webaudio/OfflineAudioCompletionEvent.idl \
     $(WebCore)/Modules/webaudio/Oscillator.idl \
 	$(WebCore)/Modules/webaudio/RealtimeAnalyserNode.idl \
diff --git a/Source/WebCore/Modules/filesystem/HTMLInputElementFileSystem.cpp b/Source/WebCore/Modules/filesystem/HTMLInputElementFileSystem.cpp
index c0ed985df..8a8cfdf78 100644
--- a/Source/WebCore/Modules/filesystem/HTMLInputElementFileSystem.cpp
+++ b/Source/WebCore/Modules/filesystem/HTMLInputElementFileSystem.cpp
@@ -49,6 +49,10 @@ namespace WebCore {
 PassRefPtr<EntryArray> HTMLInputElementFileSystem::webkitEntries(ScriptExecutionContext* scriptExecutionContext, HTMLInputElement* input)
 {
     RefPtr<EntryArray> array = EntryArray::create();
+    FileList* files = input->files();
+
+    if (!files)
+        return array;
 
     RefPtr<DOMFileSystem> filesystem = DOMFileSystem::createIsolatedFileSystem(scriptExecutionContext, input->droppedFileSystemId());
     if (!filesystem) {
@@ -56,8 +60,6 @@ PassRefPtr<EntryArray> HTMLInputElementFileSystem::webkitEntries(ScriptExecution
         return array;
     }
 
-    FileList* files = input->files();
-    ASSERT(files);
     for (unsigned i = 0; i < files->length(); ++i) {
         File* file = files->item(i);
 
diff --git a/Source/WebCore/Modules/filesystem/LocalFileSystem.cpp b/Source/WebCore/Modules/filesystem/LocalFileSystem.cpp
index 968f44b0b..19e2f159f 100644
--- a/Source/WebCore/Modules/filesystem/LocalFileSystem.cpp
+++ b/Source/WebCore/Modules/filesystem/LocalFileSystem.cpp
@@ -101,7 +101,7 @@ void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, FileSys
     context->postTask(createCallbackTask(&openFileSystem, fileSystemBasePath(), context->securityOrigin()->databaseIdentifier(), true, callbacks));
 }
 
-void LocalFileSystem::deleteFileSystem(ScriptExecutionContext* context, FileSystemType type, PassRefPtr<ErrorCallback> callbacks)
+void LocalFileSystem::deleteFileSystem(ScriptExecutionContext* context, FileSystemType type, PassRefPtr<AsyncFileSystemCallbacks> callbacks)
 {
     // AsyncFileSystem::deleteFileSystem calls callbacks synchronously, so the method needs to be called asynchronously.
     context->postTask(createCallbackTask(&deleteFileSystem, filesystemBasePath(), context->securityOrigin()->databaseIdentifier(), type, callbacks);
diff --git a/Source/WebCore/Modules/indexeddb/IDBBackingStore.h b/Source/WebCore/Modules/indexeddb/IDBBackingStore.h
index f8de68202..90c85c180 100644
--- a/Source/WebCore/Modules/indexeddb/IDBBackingStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBBackingStore.h
@@ -47,8 +47,9 @@ public:
     virtual ~IDBBackingStore() {};
 
     virtual void getDatabaseNames(Vector<String>& foundNames) = 0;
-    virtual bool getIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId) = 0;
-    virtual bool createIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId) = 0;
+    virtual bool getIDBDatabaseMetaData(const String& name, String& foundStringVersion, int64_t& foundIntVersion, int64_t& foundId) = 0;
+    virtual bool createIDBDatabaseMetaData(const String& name, const String& stringVersion, int64_t intVersion, int64_t& rowId) = 0;
+    virtual bool updateIDBDatabaseIntVersion(int64_t rowId, int64_t intVersion) = 0;
     virtual bool updateIDBDatabaseMetaData(int64_t rowId, const String& version) = 0;
     virtual bool deleteDatabase(const String& name) = 0;
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBCallbacks.h b/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
index 853ffc72d..8e85c4201 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
@@ -30,9 +30,11 @@
 #define IDBCallbacks_h
 
 #include "DOMStringList.h"
+#include "IDBDatabaseBackendInterface.h"
 #include "IDBDatabaseError.h"
 #include "IDBKey.h"
 #include "IDBKeyPath.h"
+#include "IDBTransactionBackendInterface.h"
 #include "SerializedScriptValue.h"
 #include <wtf/Threading.h>
 
@@ -40,9 +42,7 @@
 
 namespace WebCore {
 class IDBCursorBackendInterface;
-class IDBDatabaseBackendInterface;
 class IDBObjectStoreBackendInterface;
-class IDBTransactionBackendInterface;
 
 // FIXME: All child classes need to be made threadsafe.
 class IDBCallbacks : public ThreadSafeRefCounted<IDBCallbacks> {
@@ -59,7 +59,9 @@ public:
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, const IDBKeyPath&) = 0;
     virtual void onSuccessWithContinuation() = 0;
     virtual void onSuccessWithPrefetch(const Vector<RefPtr<IDBKey> >& keys, const Vector<RefPtr<IDBKey> >& primaryKeys, const Vector<RefPtr<SerializedScriptValue> >& values) = 0;
-    virtual void onBlocked() = 0;
+    virtual void onBlocked() { ASSERT_NOT_REACHED(); }
+    virtual void onBlocked(int64_t existingVersion) { ASSERT_NOT_REACHED(); }
+    virtual void onUpgradeNeeded(int64_t oldVersion, PassRefPtr<IDBTransactionBackendInterface>, PassRefPtr<IDBDatabaseBackendInterface>) { ASSERT_NOT_REACHED(); }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursor.cpp b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
index 05ddb251e..156e484ec 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
@@ -183,6 +183,8 @@ void IDBCursor::advance(unsigned long count, ExceptionCode& ec)
     m_request->setPendingCursor(this);
     m_gotValue = false;
     m_backend->advance(count, m_request, ec);
+    if (ec)
+        m_request->markEarlyDeath();
 }
 
 void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
@@ -203,11 +205,28 @@ void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
         return;
     }
 
+    if (key) {
+        ASSERT(m_currentKey);
+        if (m_direction == IDBCursor::NEXT || m_direction == IDBCursor::NEXT_NO_DUPLICATE) {
+            if (!m_currentKey->isLessThan(key.get())) {
+                ec = IDBDatabaseException::DATA_ERR;
+                return;
+            }
+        } else {
+            if (!key->isLessThan(m_currentKey.get())) {
+                ec = IDBDatabaseException::DATA_ERR;
+                return;
+            }
+        }
+    }
+
     // FIXME: We're not using the context from when continue was called, which means the callback
     //        will be on the original context openCursor was called on. Is this right?
     m_request->setPendingCursor(this);
     m_gotValue = false;
     m_backend->continueFunction(key, m_request, ec);
+    if (ec)
+        m_request->markEarlyDeath();
 }
 
 PassRefPtr<IDBRequest> IDBCursor::deleteFunction(ScriptExecutionContext* context, ExceptionCode& ec)
@@ -243,7 +262,6 @@ void IDBCursor::postSuccessHandlerCallback()
 void IDBCursor::close()
 {
     ASSERT(m_request);
-    m_request->finishCursor();
     m_request.clear();
 }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
index 0a39a8fbc..9569990cd 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
@@ -42,9 +42,8 @@
 
 namespace WebCore {
 
-IDBCursorBackendImpl::IDBCursorBackendImpl(PassRefPtr<IDBBackingStore::Cursor> cursor, IDBCursor::Direction direction, CursorType cursorType, IDBTransactionBackendImpl* transaction, IDBObjectStoreBackendImpl* objectStore)
+IDBCursorBackendImpl::IDBCursorBackendImpl(PassRefPtr<IDBBackingStore::Cursor> cursor, CursorType cursorType, IDBTransactionBackendImpl* transaction, IDBObjectStoreBackendImpl* objectStore)
     : m_cursor(cursor)
-    , m_direction(direction)
     , m_cursorType(cursorType)
     , m_transaction(transaction)
     , m_objectStore(objectStore)
@@ -88,21 +87,6 @@ void IDBCursorBackendImpl::continueFunction(PassRefPtr<IDBKey> prpKey, PassRefPt
     IDB_TRACE("IDBCursorBackendImpl::continue");
     RefPtr<IDBKey> key = prpKey;
 
-    if (m_cursor && key) {
-        ASSERT(m_cursor->key());
-        if (m_direction == IDBCursor::NEXT || m_direction == IDBCursor::NEXT_NO_DUPLICATE) {
-            if (!m_cursor->key()->isLessThan(key.get())) {
-                ec = IDBDatabaseException::DATA_ERR;
-                return;
-            }
-        } else {
-            if (!key->isLessThan(m_cursor->key().get())) {
-                ec = IDBDatabaseException::DATA_ERR;
-                return;
-            }
-        }
-    }
-
     if (!m_transaction->scheduleTask(createCallbackTask(&IDBCursorBackendImpl::continueFunctionInternal, this, key, prpCallbacks)))
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
 }
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
index 5097c5387..8c9b2e6ed 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
@@ -47,9 +47,9 @@ class SerializedScriptValue;
 
 class IDBCursorBackendImpl : public IDBCursorBackendInterface {
 public:
-    static PassRefPtr<IDBCursorBackendImpl> create(PassRefPtr<IDBBackingStore::Cursor> cursor, IDBCursor::Direction direction, CursorType cursorType, IDBTransactionBackendImpl* transaction, IDBObjectStoreBackendImpl* objectStore)
+    static PassRefPtr<IDBCursorBackendImpl> create(PassRefPtr<IDBBackingStore::Cursor> cursor, CursorType cursorType, IDBTransactionBackendImpl* transaction, IDBObjectStoreBackendImpl* objectStore)
     {
-        return adoptRef(new IDBCursorBackendImpl(cursor, direction, cursorType, transaction, objectStore));
+        return adoptRef(new IDBCursorBackendImpl(cursor, cursorType, transaction, objectStore));
     }
     virtual ~IDBCursorBackendImpl();
 
@@ -67,7 +67,7 @@ public:
     void close();
 
 private:
-    IDBCursorBackendImpl(PassRefPtr<IDBBackingStore::Cursor>, IDBCursor::Direction, CursorType, IDBTransactionBackendImpl*, IDBObjectStoreBackendImpl*);
+    IDBCursorBackendImpl(PassRefPtr<IDBBackingStore::Cursor>, CursorType, IDBTransactionBackendImpl*, IDBObjectStoreBackendImpl*);
 
     static void advanceInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl>, unsigned long, PassRefPtr<IDBCallbacks>);
     static void continueFunctionInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl>, PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
@@ -75,7 +75,6 @@ private:
 
     RefPtr<IDBBackingStore::Cursor> m_cursor;
     RefPtr<IDBBackingStore::Cursor> m_savedCursor;
-    IDBCursor::Direction m_direction;
     CursorType m_cursorType;
     RefPtr<IDBTransactionBackendImpl> m_transaction;
     RefPtr<IDBObjectStoreBackendImpl> m_objectStore;
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
index e45147d5c..a31251c8d 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
@@ -52,9 +52,29 @@ private:
         : m_callbacks(callbacks)
     {
     }
+
     RefPtr<IDBCallbacks> m_callbacks;
 };
 
+class IDBDatabaseBackendImpl::PendingOpenWithVersionCall : public RefCounted<PendingOpenWithVersionCall> {
+public:
+    static PassRefPtr<PendingOpenWithVersionCall> create(PassRefPtr<IDBCallbacks> callbacks, int64_t version)
+    {
+        return adoptRef(new PendingOpenWithVersionCall(callbacks, version));
+    }
+    PassRefPtr<IDBCallbacks> callbacks() { return m_callbacks; }
+    int64_t version() { return m_version; }
+
+private:
+    PendingOpenWithVersionCall(PassRefPtr<IDBCallbacks> callbacks, int64_t version)
+        : m_callbacks(callbacks)
+        , m_version(version)
+    {
+    }
+    RefPtr<IDBCallbacks> m_callbacks;
+    int64_t m_version;
+};
+
 class IDBDatabaseBackendImpl::PendingDeleteCall : public RefCounted<PendingDeleteCall> {
 public:
     static PassRefPtr<PendingDeleteCall> create(PassRefPtr<IDBCallbacks> callbacks)
@@ -106,6 +126,7 @@ IDBDatabaseBackendImpl::IDBDatabaseBackendImpl(const String& name, IDBBackingSto
     , m_id(InvalidId)
     , m_name(name)
     , m_version("")
+    , m_intVersion(IDBDatabaseMetadata::NoIntVersion)
     , m_identifier(uniqueIdentifier)
     , m_factory(factory)
     , m_transactionCoordinator(coordinator)
@@ -116,13 +137,13 @@ IDBDatabaseBackendImpl::IDBDatabaseBackendImpl(const String& name, IDBBackingSto
 
 bool IDBDatabaseBackendImpl::openInternal()
 {
-    bool success = m_backingStore->getIDBDatabaseMetaData(m_name, m_version, m_id);
-    ASSERT(success == (m_id != InvalidId));
+    bool success = m_backingStore->getIDBDatabaseMetaData(m_name, m_version, m_intVersion, m_id);
+    ASSERT_WITH_MESSAGE(success == (m_id != InvalidId), "success = %s, m_id = %lld", success ? "true" : "false", static_cast<long long>(m_id));
     if (success) {
         loadObjectStores();
         return true;
     }
-    return m_backingStore->createIDBDatabaseMetaData(m_name, m_version, m_id);
+    return m_backingStore->createIDBDatabaseMetaData(m_name, m_version, m_intVersion, m_id);
 }
 
 IDBDatabaseBackendImpl::~IDBDatabaseBackendImpl()
@@ -136,7 +157,7 @@ PassRefPtr<IDBBackingStore> IDBDatabaseBackendImpl::backingStore() const
 
 IDBDatabaseMetadata IDBDatabaseBackendImpl::metadata() const
 {
-    IDBDatabaseMetadata metadata(m_name, m_version, IDBDatabaseMetadata::NoIntVersion);
+    IDBDatabaseMetadata metadata(m_name, m_version, m_intVersion);
     for (ObjectStoreMap::const_iterator it = m_objectStores.begin(); it != m_objectStores.end(); ++it)
         metadata.objectStores.set(it->first, it->second->metadata());
     return metadata;
@@ -214,6 +235,10 @@ void IDBDatabaseBackendImpl::setVersion(const String& version, PassRefPtr<IDBCal
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::IDB_ABORT_ERR, "Connection was closed before set version transaction was created"));
         return;
     }
+    if (m_intVersion != IDBDatabaseMetadata::NoIntVersion) {
+        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, String::format("You can't use the setVersion function if you've already set the version through an open call.  The current integer version is %lld", static_cast<long long>(m_intVersion))));
+        return;
+    }
     for (DatabaseCallbacksSet::const_iterator it = m_databaseCallbacksSet.begin(); it != m_databaseCallbacksSet.end(); ++it) {
         if (*it != databaseCallbacks)
             (*it)->onVersionChange(version);
@@ -259,6 +284,20 @@ void IDBDatabaseBackendImpl::setVersionInternal(ScriptExecutionContext*, PassRef
     callbacks->onSuccess(PassRefPtr<IDBTransactionBackendInterface>(transaction));
 }
 
+void IDBDatabaseBackendImpl::setIntVersionInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, int64_t version, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
+{
+    int64_t databaseId = database->id();
+    int64_t oldVersion = database->m_intVersion;
+    ASSERT(version > oldVersion);
+    database->m_intVersion = version;
+    if (!database->m_backingStore->updateIDBDatabaseIntVersion(databaseId, database->m_intVersion)) {
+        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
+        transaction->abort();
+        return;
+    }
+    callbacks->onUpgradeNeeded(oldVersion, transaction, database);
+}
+
 void IDBDatabaseBackendImpl::transactionStarted(PassRefPtr<IDBTransactionBackendImpl> prpTransaction)
 {
     RefPtr<IDBTransactionBackendImpl> transaction = prpTransaction;
@@ -276,6 +315,16 @@ void IDBDatabaseBackendImpl::transactionFinished(PassRefPtr<IDBTransactionBacken
     if (transaction->mode() == IDBTransaction::VERSION_CHANGE) {
         ASSERT(transaction.get() == m_runningVersionChangeTransaction.get());
         m_runningVersionChangeTransaction.clear();
+    }
+}
+
+void IDBDatabaseBackendImpl::transactionFinishedAndEventsFired(PassRefPtr<IDBTransactionBackendImpl> prpTransaction)
+{
+    RefPtr<IDBTransactionBackendImpl> transaction = prpTransaction;
+    if (transaction->mode() == IDBTransaction::VERSION_CHANGE) {
+        // If this was an open-with-version call, there will be a "second
+        // half" open call waiting for us in processPendingCalls.
+        // FIXME: When we no longer support setVersion, assert such a thing.
         processPendingCalls();
     }
 }
@@ -287,7 +336,16 @@ int32_t IDBDatabaseBackendImpl::connectionCount()
 
 void IDBDatabaseBackendImpl::processPendingCalls()
 {
-    ASSERT(connectionCount() <= 1);
+    // FIXME: Change from queue to just a single place holder.
+    ASSERT(m_pendingSecondHalfOpenWithVersionCalls.size() <= 1);
+    while (!m_pendingSecondHalfOpenWithVersionCalls.isEmpty()) {
+        RefPtr<PendingOpenWithVersionCall> pendingOpenWithVersionCall = m_pendingSecondHalfOpenWithVersionCalls.takeFirst();
+        ASSERT(pendingOpenWithVersionCall->version() == m_intVersion);
+        ASSERT(m_id != InvalidId);
+        ++m_pendingConnectionCount;
+        pendingOpenWithVersionCall->callbacks()->onSuccess(this);
+        return;
+    }
 
     // Pending calls may be requeued or aborted
     Deque<RefPtr<PendingSetVersionCall> > pendingSetVersionCalls;
@@ -325,6 +383,13 @@ void IDBDatabaseBackendImpl::processPendingCalls()
     if (m_runningVersionChangeTransaction || !m_pendingSetVersionCalls.isEmpty() || !m_pendingDeleteCalls.isEmpty())
         return;
 
+    Deque<RefPtr<PendingOpenWithVersionCall> > pendingOpenWithVersionCalls;
+    m_pendingOpenWithVersionCalls.swap(pendingOpenWithVersionCalls);
+    while (!pendingOpenWithVersionCalls.isEmpty()) {
+        RefPtr<PendingOpenWithVersionCall> pendingOpenWithVersionCall = pendingOpenWithVersionCalls.takeFirst();
+        openConnectionWithVersion(pendingOpenWithVersionCall->callbacks(), pendingOpenWithVersionCall->version());
+    }
+
     // Given the check above, it appears that calls cannot be requeued by
     // openConnection, but use a different queue for iteration to be safe.
     Deque<RefPtr<PendingOpenCall> > pendingOpenCalls;
@@ -356,6 +421,10 @@ void IDBDatabaseBackendImpl::registerFrontendCallbacks(PassRefPtr<IDBDatabaseCal
     ASSERT(m_pendingConnectionCount);
     --m_pendingConnectionCount;
     m_databaseCallbacksSet.add(RefPtr<IDBDatabaseCallbacks>(callbacks));
+    // We give max priority to open calls that follow upgradeneeded
+    // events; trigger the rest of the queues to be serviced when those open
+    // calls are finished.
+    processPendingCalls();
 }
 
 void IDBDatabaseBackendImpl::openConnection(PassRefPtr<IDBCallbacks> callbacks)
@@ -373,6 +442,80 @@ void IDBDatabaseBackendImpl::openConnection(PassRefPtr<IDBCallbacks> callbacks)
     }
 }
 
+void IDBDatabaseBackendImpl::runIntVersionChangeTransaction(int64_t requestedVersion, PassRefPtr<IDBCallbacks> prpCallbacks)
+{
+    // FIXME: This function won't be reached until it's exposed to script in
+    // wbk.ug/92897.
+    ASSERT_NOT_REACHED();
+
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    ASSERT(callbacks);
+    for (DatabaseCallbacksSet::const_iterator it = m_databaseCallbacksSet.begin(); it != m_databaseCallbacksSet.end(); ++it) {
+        // Note that some connections might close in the versionchange event
+        // handler for some other connection, after which its own versionchange
+        // event should not be fired. The backend doesn't worry about this, we
+        // just queue up a version change event for every connection. The
+        // frontend takes care to only dispatch to open connections.
+        (*it)->onVersionChange(m_intVersion, requestedVersion);
+    }
+    // The spec dictates we wait until all the version change events are
+    // delivered and then check m_databaseCallbacks.empty() before proceeding
+    // or firing a blocked event, but instead we should be consistent with how
+    // the old setVersion (incorrectly) did it.
+    // FIXME: Remove the call to onBlocked and instead wait until the frontend
+    // tells us that all the blocked events have been delivered. See
+    // https://bugs.webkit.org/show_bug.cgi?id=71130
+    if (connectionCount() > 0)
+        callbacks->onBlocked(m_intVersion);
+    // FIXME: Add test for m_runningVersionChangeTransaction.
+    if (m_runningVersionChangeTransaction || connectionCount() > 0) {
+        m_pendingOpenWithVersionCalls.append(PendingOpenWithVersionCall::create(callbacks, requestedVersion));
+        return;
+    }
+
+    RefPtr<DOMStringList> objectStoreNames = DOMStringList::create();
+    ExceptionCode ec = 0;
+    RefPtr<IDBTransactionBackendInterface> transactionInterface = transaction(objectStoreNames.get(), IDBTransaction::VERSION_CHANGE, ec);
+    RefPtr<IDBTransactionBackendImpl> transaction = IDBTransactionBackendImpl::from(transactionInterface.get());
+    ASSERT(!ec);
+
+    RefPtr<IDBDatabaseBackendImpl> database = this;
+    OwnPtr<ScriptExecutionContext::Task> intVersionTask = createCallbackTask(&IDBDatabaseBackendImpl::setIntVersionInternal, database, requestedVersion, callbacks, transaction);
+    // FIXME: Make this reset the integer version as well.
+    OwnPtr<ScriptExecutionContext::Task> resetVersionOnAbortTask = createCallbackTask(&IDBDatabaseBackendImpl::resetVersion, database, m_version);
+    if (!transaction->scheduleTask(intVersionTask.release(), resetVersionOnAbortTask.release()))
+        ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
+    m_pendingSecondHalfOpenWithVersionCalls.append(PendingOpenWithVersionCall::create(callbacks, requestedVersion));
+}
+
+void IDBDatabaseBackendImpl::openConnectionWithVersion(PassRefPtr<IDBCallbacks> prpCallbacks, int64_t version)
+{
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    if (!m_pendingDeleteCalls.isEmpty() || m_runningVersionChangeTransaction || !m_pendingSetVersionCalls.isEmpty()) {
+        m_pendingOpenWithVersionCalls.append(PendingOpenWithVersionCall::create(callbacks, version));
+        return;
+    }
+    if (m_id == InvalidId) {
+        if (openInternal())
+            ASSERT(m_intVersion == IDBDatabaseMetadata::NoIntVersion);
+        else {
+            callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
+            return;
+        }
+    }
+    if (version > m_intVersion) {
+        runIntVersionChangeTransaction(version, callbacks);
+        return;
+    }
+    if (version < m_intVersion) {
+        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::VER_ERR, String::format("The requested version (%lld) is less than the existing version (%lld).", static_cast<long long>(version), static_cast<long long>(m_intVersion))));
+        return;
+    }
+    ASSERT(version == m_intVersion);
+    ++m_pendingConnectionCount;
+    callbacks->onSuccess(this);
+}
+
 void IDBDatabaseBackendImpl::deleteDatabase(PassRefPtr<IDBCallbacks> prpCallbacks)
 {
     if (m_runningVersionChangeTransaction || !m_pendingSetVersionCalls.isEmpty()) {
@@ -388,17 +531,19 @@ void IDBDatabaseBackendImpl::deleteDatabase(PassRefPtr<IDBCallbacks> prpCallback
     // FIXME: Only fire onBlocked if there are open connections after the
     // VersionChangeEvents are received, not just set up to fire.
     // https://bugs.webkit.org/show_bug.cgi?id=71130
-    if (!m_databaseCallbacksSet.isEmpty()) {
+    if (connectionCount() >= 1) {
         m_pendingDeleteCalls.append(PendingDeleteCall::create(callbacks));
         callbacks->onBlocked();
         return;
     }
+    ASSERT(m_backingStore);
     if (!m_backingStore->deleteDatabase(m_name)) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
         return;
     }
     m_version = "";
     m_id = InvalidId;
+    m_intVersion = IDBDatabaseMetadata::NoIntVersion;
     m_objectStores.clear();
     callbacks->onSuccess(SerializedScriptValue::nullValue());
 }
@@ -411,12 +556,17 @@ void IDBDatabaseBackendImpl::close(PassRefPtr<IDBDatabaseCallbacks> prpCallbacks
     if (connectionCount() > 1)
         return;
 
+    TransactionSet transactions(m_transactions);
     processPendingCalls();
 
-    if (!connectionCount()) {
-        TransactionSet transactions(m_transactions);
+    ASSERT(m_transactions.size() - transactions.size() <= 1);
+    // FIXME: Instead of relying on transactions.size(), make connectionCount
+    // aware of in-flight upgradeneeded events as well as in-flight success
+    // events.
+    if (!connectionCount() && !m_pendingDeleteCalls.size() && m_transactions.size() == transactions.size()) {
         for (TransactionSet::const_iterator it = transactions.begin(); it != transactions.end(); ++it)
             (*it)->abort();
+
         ASSERT(m_transactions.isEmpty());
 
         m_backingStore.clear();
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
index 805eb617f..220de5113 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
@@ -57,6 +57,7 @@ public:
 
     void registerFrontendCallbacks(PassRefPtr<IDBDatabaseCallbacks>);
     void openConnection(PassRefPtr<IDBCallbacks>);
+    void openConnectionWithVersion(PassRefPtr<IDBCallbacks>, int64_t version);
     void deleteDatabase(PassRefPtr<IDBCallbacks>);
 
     // IDBDatabaseBackendInterface
@@ -71,11 +72,13 @@ public:
     IDBTransactionCoordinator* transactionCoordinator() const { return m_transactionCoordinator.get(); }
     void transactionStarted(PassRefPtr<IDBTransactionBackendImpl>);
     void transactionFinished(PassRefPtr<IDBTransactionBackendImpl>);
+    void transactionFinishedAndEventsFired(PassRefPtr<IDBTransactionBackendImpl>);
 
 private:
     IDBDatabaseBackendImpl(const String& name, IDBBackingStore* database, IDBTransactionCoordinator*, IDBFactoryBackendImpl*, const String& uniqueIdentifier);
 
     bool openInternal();
+    void runIntVersionChangeTransaction(int64_t requestedVersion, PassRefPtr<IDBCallbacks>);
     void loadObjectStores();
     int32_t connectionCount();
     void processPendingCalls();
@@ -83,6 +86,7 @@ private:
     static void createObjectStoreInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBTransactionBackendImpl>);
     static void deleteObjectStoreInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBTransactionBackendImpl>);
     static void setVersionInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, const String& version, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendImpl>);
+    static void setIntVersionInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, int64_t version, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
 
     // These are used as setVersion transaction abort tasks.
     static void removeObjectStoreFromMap(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, PassRefPtr<IDBObjectStoreBackendImpl>);
@@ -93,6 +97,7 @@ private:
     int64_t m_id;
     String m_name;
     String m_version;
+    int64_t m_intVersion;
 
     String m_identifier;
     // This might not need to be a RefPtr since the factory's lifetime is that of the page group, but it's better to be conservitive than sorry.
@@ -113,6 +118,10 @@ private:
     class PendingOpenCall;
     Deque<RefPtr<PendingOpenCall> > m_pendingOpenCalls;
 
+    class PendingOpenWithVersionCall;
+    Deque<RefPtr<PendingOpenWithVersionCall> > m_pendingOpenWithVersionCalls;
+    Deque<RefPtr<PendingOpenWithVersionCall> > m_pendingSecondHalfOpenWithVersionCalls;
+
     class PendingDeleteCall;
     Deque<RefPtr<PendingDeleteCall> > m_pendingDeleteCalls;
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h
index b3f244f51..16a9ea6c5 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h
@@ -38,6 +38,7 @@ public:
     virtual ~IDBDatabaseCallbacks() { }
 
     virtual void onVersionChange(const String& version) = 0;
+    virtual void onVersionChange(int64_t currentVersion, int64_t requestedVersion) { ASSERT_NOT_REACHED(); }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
index dfb1457a3..63bd4783e 100644
--- a/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
@@ -35,6 +35,7 @@
 #include "IDBDatabaseException.h"
 #include "IDBLevelDBBackingStore.h"
 #include "IDBTransactionCoordinator.h"
+#include "SecurityOrigin.h"
 #include <wtf/Threading.h>
 #include <wtf/UnusedParam.h>
 
@@ -151,30 +152,34 @@ PassRefPtr<IDBBackingStore> IDBFactoryBackendImpl::openBackingStore(PassRefPtr<S
 
 void IDBFactoryBackendImpl::open(const String& name, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> prpSecurityOrigin, ScriptExecutionContext*, const String& dataDirectory)
 {
+    // FIXME: Make this a parameter and plumb through from javascript.
+    int64_t version = IDBDatabaseMetadata::NoIntVersion;
     RefPtr<SecurityOrigin> securityOrigin = prpSecurityOrigin;
     const String uniqueIdentifier = computeUniqueIdentifier(name, securityOrigin.get());
 
+    RefPtr<IDBDatabaseBackendImpl> databaseBackend;
     IDBDatabaseBackendMap::iterator it = m_databaseBackendMap.find(uniqueIdentifier);
-    if (it != m_databaseBackendMap.end()) {
-        // If it's already been opened, we have to wait for any pending
-        // setVersion calls to complete.
-        it->second->openConnection(callbacks);
-        return;
-    }
-
-    // FIXME: Everything from now on should be done on another thread.
-    RefPtr<IDBBackingStore> backingStore = openBackingStore(securityOrigin, dataDirectory);
-    if (!backingStore) {
-        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
-        return;
-    }
+    if (it == m_databaseBackendMap.end()) {
+        RefPtr<IDBBackingStore> backingStore = openBackingStore(securityOrigin, dataDirectory);
+        if (!backingStore) {
+            callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
+            return;
+        }
+
+        databaseBackend = IDBDatabaseBackendImpl::create(name, backingStore.get(), m_transactionCoordinator.get(), this, uniqueIdentifier);
+        if (databaseBackend)
+            m_databaseBackendMap.set(uniqueIdentifier, databaseBackend.get());
+        else {
+            callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
+            return;
+        }
+    } else
+        databaseBackend = it->second;
 
-    RefPtr<IDBDatabaseBackendImpl> databaseBackend = IDBDatabaseBackendImpl::create(name, backingStore.get(), m_transactionCoordinator.get(), this, uniqueIdentifier);
-    if (databaseBackend) {
-        m_databaseBackendMap.set(uniqueIdentifier, databaseBackend.get());
+    if (version == IDBDatabaseMetadata::NoIntVersion)
         databaseBackend->openConnection(callbacks);
-    } else
-        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
+    else
+        databaseBackend->openConnectionWithVersion(callbacks, version);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
index 134008491..61289a5b8 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
@@ -99,7 +99,7 @@ void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr
         return;
     }
 
-    RefPtr<IDBCursorBackendInterface> cursor = IDBCursorBackendImpl::create(backingStoreCursor.get(), direction, cursorType, transaction.get(), index->m_objectStoreBackend);
+    RefPtr<IDBCursorBackendInterface> cursor = IDBCursorBackendImpl::create(backingStoreCursor.get(), cursorType, transaction.get(), index->m_objectStoreBackend);
     callbacks->onSuccess(cursor.release());
 }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
index 0513c3533..a809bc92a 100644
--- a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
@@ -87,6 +87,12 @@ static bool putInt(DBOrTransaction* db, const Vector<char>& key, int64_t value)
 }
 
 template <typename DBOrTransaction>
+static bool putVarInt(DBOrTransaction* db, const Vector<char>& key, int64_t value)
+{
+    return db->put(key, encodeVarInt(value));
+}
+
+template <typename DBOrTransaction>
 static bool getString(DBOrTransaction* db, const Vector<char>& key, String& foundString)
 {
     Vector<char> result;
@@ -129,7 +135,7 @@ public:
     virtual const char* name() const { return "idb_cmp1"; }
 };
 
-static bool setUpMetadata(LevelDBDatabase* db)
+static bool setUpMetadata(LevelDBDatabase* db, const String& origin)
 {
     const Vector<char> metaDataKey = SchemaVersionKey::encode();
 
@@ -138,12 +144,40 @@ static bool setUpMetadata(LevelDBDatabase* db)
         schemaVersion = 0;
         if (!putInt(db, metaDataKey, schemaVersion))
             return false;
+    } else {
+        if (!schemaVersion) {
+            schemaVersion = 1;
+            RefPtr<LevelDBTransaction> transaction = LevelDBTransaction::create(db);
+            transaction->put(metaDataKey, encodeInt(schemaVersion));
+
+            const Vector<char> startKey = DatabaseNameKey::encodeMinKeyForOrigin(origin);
+            const Vector<char> stopKey = DatabaseNameKey::encodeStopKeyForOrigin(origin);
+            OwnPtr<LevelDBIterator> it = db->createIterator();
+            for (it->seek(startKey); it->isValid() && compareKeys(it->key(), stopKey) < 0; it->next()) {
+                Vector<char> value;
+                bool ok = transaction->get(it->key(), value);
+                if (!ok) {
+                    ASSERT_NOT_REACHED();
+                    return false;
+                }
+                int databaseId = decodeInt(value.begin(), value.end());
+                Vector<char> intVersionKey = DatabaseMetaDataKey::encode(databaseId, DatabaseMetaDataKey::UserIntVersion);
+                transaction->put(intVersionKey, encodeVarInt(IDBDatabaseMetadata::DefaultIntVersion));
+                ok = transaction->get(it->key(), value);
+                if (!ok) {
+                    ASSERT_NOT_REACHED();
+                    return false;
+                }
+            }
+            bool ok = transaction->commit();
+            if (!ok) {
+                ASSERT_NOT_REACHED();
+                return false;
+            }
+        }
+        ASSERT(schemaVersion == 1);
     }
 
-    // FIXME: Eventually, we'll need to be able to transition between schemas.
-    if (schemaVersion)
-        return false; // Don't know what to do with this version.
-
     return true;
 }
 
@@ -208,7 +242,7 @@ PassRefPtr<IDBBackingStore> IDBLevelDBBackingStore::open(SecurityOrigin* securit
     RefPtr<IDBLevelDBBackingStore> backingStore(adoptRef(new IDBLevelDBBackingStore(fileIdentifier, factory, db.release())));
     backingStore->m_comparator = comparator.release();
 
-    if (!setUpMetadata(backingStore->m_db.get()))
+    if (!setUpMetadata(backingStore->m_db.get(), fileIdentifier))
         return PassRefPtr<IDBBackingStore>();
 
     return backingStore.release();
@@ -234,7 +268,7 @@ void IDBLevelDBBackingStore::getDatabaseNames(Vector<String>& foundNames)
     }
 }
 
-bool IDBLevelDBBackingStore::getIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId)
+bool IDBLevelDBBackingStore::getIDBDatabaseMetaData(const String& name, String& foundStringVersion, int64_t& foundIntVersion, int64_t& foundId)
 {
     const Vector<char> key = DatabaseNameKey::encode(m_identifier, name);
 
@@ -242,10 +276,16 @@ bool IDBLevelDBBackingStore::getIDBDatabaseMetaData(const String& name, String&
     if (!ok)
         return false;
 
-    ok = getString(m_db.get(), DatabaseMetaDataKey::encode(foundId, DatabaseMetaDataKey::UserVersion), foundVersion);
+    ok = getString(m_db.get(), DatabaseMetaDataKey::encode(foundId, DatabaseMetaDataKey::UserVersion), foundStringVersion);
     if (!ok)
         return false;
 
+    ok = getInt(m_db.get(), DatabaseMetaDataKey::encode(foundId, DatabaseMetaDataKey::UserIntVersion), foundIntVersion);
+    if (!ok)
+        return false;
+    if (foundIntVersion == IDBDatabaseMetadata::DefaultIntVersion)
+        foundIntVersion = IDBDatabaseMetadata::NoIntVersion;
+
     return true;
 }
 
@@ -264,7 +304,7 @@ static int64_t getNewDatabaseId(LevelDBDatabase* db)
     return databaseId;
 }
 
-bool IDBLevelDBBackingStore::createIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId)
+bool IDBLevelDBBackingStore::createIDBDatabaseMetaData(const String& name, const String& version, int64_t intVersion, int64_t& rowId)
 {
     rowId = getNewDatabaseId(m_db.get());
     if (rowId < 0)
@@ -275,6 +315,22 @@ bool IDBLevelDBBackingStore::createIDBDatabaseMetaData(const String& name, const
         return false;
     if (!putString(m_db.get(), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::UserVersion), version))
         return false;
+    if (intVersion == IDBDatabaseMetadata::NoIntVersion)
+        intVersion = IDBDatabaseMetadata::DefaultIntVersion;
+    if (!putVarInt(m_db.get(), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::UserIntVersion), intVersion))
+        return false;
+    return true;
+}
+
+bool IDBLevelDBBackingStore::updateIDBDatabaseIntVersion(int64_t rowId, int64_t intVersion)
+{
+    ASSERT(m_currentTransaction);
+    // FIXME: Change this to strictly greater than 0 once we throw TypeError for
+    // bad versions.
+    ASSERT_WITH_MESSAGE(intVersion >= 0, "intVersion was %lld", static_cast<long long>(intVersion));
+    if (!putVarInt(m_currentTransaction.get(), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::UserIntVersion), intVersion))
+        return false;
+
     return true;
 }
 
@@ -305,7 +361,8 @@ bool IDBLevelDBBackingStore::deleteDatabase(const String& name)
 
     int64_t databaseId;
     String version;
-    if (!getIDBDatabaseMetaData(name, version, databaseId)) {
+    int64_t intVersion;
+    if (!getIDBDatabaseMetaData(name, version, intVersion, databaseId)) {
         transaction->rollback();
         return true;
     }
diff --git a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h
index 0be934ffd..479efecc0 100644
--- a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h
@@ -45,9 +45,10 @@ public:
     virtual ~IDBLevelDBBackingStore();
 
     virtual void getDatabaseNames(Vector<String>& foundNames);
-    virtual bool getIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId);
-    virtual bool createIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId);
+    virtual bool getIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundIntVersion, int64_t& foundId);
+    virtual bool createIDBDatabaseMetaData(const String& name, const String& version, int64_t intVersion, int64_t& rowId);
     virtual bool updateIDBDatabaseMetaData(int64_t rowId, const String& version);
+    virtual bool updateIDBDatabaseIntVersion(int64_t rowId, int64_t intVersion);
     virtual bool deleteDatabase(const String& name);
 
     virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<IDBKeyPath>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags);
diff --git a/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp
index 3af454f0a..b3d78efb2 100644
--- a/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp
@@ -64,7 +64,7 @@
 //
 // Object store meta-data:
 //
-//     The prefix is followed by a type byte, then a variable-length integer, and then another variable-length integer (FIXME: this should be a byte).
+//     The prefix is followed by a type byte, then a variable-length integer, and then another type byte.
 //
 //     <database id, 0, 0, 50, object store id, 0> => utf16 object store name [ObjectStoreMetaDataKey]
 //     <database id, 0, 0, 50, object store id, 1> => utf16 key path [ObjectStoreMetaDataKey]
@@ -162,16 +162,27 @@ static const unsigned char IndexFreeListTypeByte = 151;
 static const unsigned char ObjectStoreNamesTypeByte = 200;
 static const unsigned char IndexNamesKeyTypeByte = 201;
 
-static const int64_t ObjectMetaDataTypeMaximum = INT64_MAX;
+static const unsigned char ObjectMetaDataTypeMaximum = 255;
 static const unsigned char IndexMetaDataTypeMaximum = 255;
 
 Vector<char> encodeByte(unsigned char c)
 {
-    Vector<char> v;
+    Vector<char, DefaultInlineBufferSize> v;
     v.append(c);
+
+    ASSERT(v.size() <= DefaultInlineBufferSize);
     return v;
 }
 
+const char* decodeByte(const char* p, const char* limit, unsigned char& foundChar)
+{
+    if (p >= limit)
+        return 0;
+
+    foundChar = *p++;
+    return p;
+}
+
 Vector<char> maxIDBKey()
 {
     return encodeByte(IDBKeyNullTypeByte);
@@ -184,8 +195,10 @@ Vector<char> minIDBKey()
 
 Vector<char> encodeBool(bool b)
 {
-    Vector<char> ret(1);
-    ret[0] = b ? 1 : 0;
+    Vector<char, DefaultInlineBufferSize> ret;
+    ret.append(b ? 1 : 0);
+
+    ASSERT(ret.size() <= DefaultInlineBufferSize);
     return ret;
 }
 
@@ -199,7 +212,7 @@ Vector<char> encodeInt(int64_t nParam)
 {
     ASSERT(nParam >= 0);
     uint64_t n = static_cast<uint64_t>(nParam);
-    Vector<char> ret; // FIXME: Size this at creation.
+    Vector<char, DefaultInlineBufferSize> ret;
 
     do {
         unsigned char c = n;
@@ -207,6 +220,7 @@ Vector<char> encodeInt(int64_t nParam)
         n >>= 8;
     } while (n);
 
+    ASSERT(ret.size() <= DefaultInlineBufferSize);
     return ret;
 }
 
@@ -242,7 +256,7 @@ Vector<char> encodeVarInt(int64_t nParam)
 {
     ASSERT(nParam >= 0);
     uint64_t n = static_cast<uint64_t>(nParam);
-    Vector<char> ret; // FIXME: Size this at creation.
+    Vector<char, DefaultInlineBufferSize> ret;
 
     do {
         unsigned char c = n & 0x7f;
@@ -252,6 +266,7 @@ Vector<char> encodeVarInt(int64_t nParam)
         ret.append(c);
     } while (n);
 
+    ASSERT(ret.size() <= DefaultInlineBufferSize);
     return ret;
 }
 
@@ -274,14 +289,14 @@ const char* decodeVarInt(const char* p, const char* limit, int64_t& foundInt)
 
 Vector<char> encodeString(const String& s)
 {
-    Vector<char> ret; // FIXME: Size this at creation.
+    Vector<char> ret(s.length() * 2);
 
     for (unsigned i = 0; i < s.length(); ++i) {
         UChar u = s[i];
         unsigned char hi = u >> 8;
         unsigned char lo = u;
-        ret.append(hi);
-        ret.append(lo);
+        ret[2 * i] = hi;
+        ret[2 * i + 1] = lo;
     }
 
     return ret;
@@ -364,9 +379,10 @@ Vector<char> encodeDouble(double x)
 {
     // FIXME: It would be nice if we could be byte order independent.
     const char* p = reinterpret_cast<char*>(&x);
-    Vector<char> v;
+    Vector<char, DefaultInlineBufferSize> v;
     v.append(p, sizeof(x));
-    ASSERT(v.size() == sizeof(x));
+
+    ASSERT(v.size() <= DefaultInlineBufferSize);
     return v;
 }
 
@@ -383,12 +399,12 @@ const char* decodeDouble(const char* p, const char* limit, double* d)
 
 Vector<char> encodeIDBKey(const IDBKey& key)
 {
-    Vector<char> ret;
+    Vector<char, DefaultInlineBufferSize> ret;
     encodeIDBKey(key, ret);
     return ret;
 }
 
-void encodeIDBKey(const IDBKey& key, Vector<char>& into)
+void encodeIDBKey(const IDBKey& key, Vector<char, DefaultInlineBufferSize>& into)
 {
     size_t previousSize = into.size();
     ASSERT(key.isValid());
@@ -640,7 +656,7 @@ Vector<char> encodeIDBKeyPath(const IDBKeyPath& keyPath)
     // May be typed, or may be a raw string. An invalid leading
     // byte is used to identify typed coding. New records are
     // always written as typed.
-    Vector<char> ret;
+    Vector<char, DefaultInlineBufferSize> ret;
     ret.append(IDBKeyPathTypeCodedByte1);
     ret.append(IDBKeyPathTypeCodedByte2);
     ret.append(static_cast<char>(keyPath.type()));
@@ -884,12 +900,13 @@ Vector<char> KeyPrefix::encode() const
 
 
     unsigned char firstByte = (databaseIdString.size() - 1) << 5 | (objectStoreIdString.size() - 1) << 2 | (indexIdString.size() - 1);
-    Vector<char> ret;
+    Vector<char, DefaultInlineBufferSize> ret;
     ret.append(firstByte);
     ret.append(databaseIdString);
     ret.append(objectStoreIdString);
     ret.append(indexIdString);
 
+    ASSERT(ret.size() <= DefaultInlineBufferSize);
     return ret;
 }
 
@@ -961,7 +978,8 @@ const char* DatabaseFreeListKey::decode(const char* start, const char* limit, Da
     ASSERT(!prefix.m_indexId);
     if (p == limit)
         return 0;
-    unsigned char typeByte = *p++;
+    unsigned char typeByte = 0;
+    p = decodeByte(p, limit, typeByte);
     ASSERT_UNUSED(typeByte, typeByte == DatabaseFreeListTypeByte);
     if (p == limit)
         return 0;
@@ -1005,7 +1023,8 @@ const char* DatabaseNameKey::decode(const char* start, const char* limit, Databa
     ASSERT(!prefix.m_indexId);
     if (p == limit)
         return 0;
-    unsigned char typeByte = *p++;
+    unsigned char typeByte = 0;
+    p = decodeByte(p, limit, typeByte);
     ASSERT_UNUSED(typeByte, typeByte == DatabaseNameTypeByte);
     if (p == limit)
         return 0;
@@ -1068,7 +1087,8 @@ const char* ObjectStoreMetaDataKey::decode(const char* start, const char* limit,
     ASSERT(!prefix.m_indexId);
     if (p == limit)
         return 0;
-    unsigned char typeByte = *p++;
+    unsigned char typeByte = 0;
+    p = decodeByte(p, limit, typeByte);
     ASSERT_UNUSED(typeByte, typeByte == ObjectStoreMetaDataTypeByte);
     if (p == limit)
         return 0;
@@ -1078,16 +1098,16 @@ const char* ObjectStoreMetaDataKey::decode(const char* start, const char* limit,
     ASSERT(result->m_objectStoreId);
     if (p == limit)
         return 0;
-    return decodeVarInt(p, limit, result->m_metaDataType);
+    return decodeByte(p, limit, result->m_metaDataType);
 }
 
-Vector<char> ObjectStoreMetaDataKey::encode(int64_t databaseId, int64_t objectStoreId, int64_t metaDataType)
+Vector<char> ObjectStoreMetaDataKey::encode(int64_t databaseId, int64_t objectStoreId, unsigned char metaDataType)
 {
     KeyPrefix prefix(databaseId, 0, 0);
     Vector<char> ret = prefix.encode();
     ret.append(encodeByte(ObjectStoreMetaDataTypeByte));
     ret.append(encodeVarInt(objectStoreId));
-    ret.append(encodeVarInt(metaDataType));
+    ret.append(encodeByte(metaDataType));
     return ret;
 }
 
@@ -1106,7 +1126,7 @@ int64_t ObjectStoreMetaDataKey::objectStoreId() const
     ASSERT(m_objectStoreId >= 0);
     return m_objectStoreId;
 }
-int64_t ObjectStoreMetaDataKey::metaDataType() const
+unsigned char ObjectStoreMetaDataKey::metaDataType() const
 {
     ASSERT(m_metaDataType >= 0);
     return m_metaDataType;
@@ -1142,7 +1162,8 @@ const char* IndexMetaDataKey::decode(const char* start, const char* limit, Index
     ASSERT(!prefix.m_indexId);
     if (p == limit)
         return 0;
-    unsigned char typeByte = *p++;
+    unsigned char typeByte = 0;
+    p = decodeByte(p, limit, typeByte);
     ASSERT_UNUSED(typeByte, typeByte == IndexMetaDataTypeByte);
     if (p == limit)
         return 0;
@@ -1154,8 +1175,7 @@ const char* IndexMetaDataKey::decode(const char* start, const char* limit, Index
         return 0;
     if (p == limit)
         return 0;
-    result->m_metaDataType = *p++;
-    return p;
+    return decodeByte(p, limit, result->m_metaDataType);
 }
 
 Vector<char> IndexMetaDataKey::encode(int64_t databaseId, int64_t objectStoreId, int64_t indexId, unsigned char metaDataType)
@@ -1213,7 +1233,8 @@ const char* ObjectStoreFreeListKey::decode(const char* start, const char* limit,
     ASSERT(!prefix.m_indexId);
     if (p == limit)
         return 0;
-    unsigned char typeByte = *p++;
+    unsigned char typeByte = 0;
+    p = decodeByte(p, limit, typeByte);
     ASSERT_UNUSED(typeByte, typeByte == ObjectStoreFreeListTypeByte);
     if (p == limit)
         return 0;
@@ -1266,7 +1287,8 @@ const char* IndexFreeListKey::decode(const char* start, const char* limit, Index
     ASSERT(!prefix.m_indexId);
     if (p == limit)
         return 0;
-    unsigned char typeByte = *p++;
+    unsigned char typeByte = 0;
+    p = decodeByte(p, limit, typeByte);
     ASSERT_UNUSED(typeByte, typeByte == IndexFreeListTypeByte);
     if (p == limit)
         return 0;
@@ -1326,7 +1348,8 @@ const char* ObjectStoreNamesKey::decode(const char* start, const char* limit, Ob
     ASSERT(!prefix.m_indexId);
     if (p == limit)
         return 0;
-    unsigned char typeByte = *p++;
+    unsigned char typeByte = 0;
+    p = decodeByte(p, limit, typeByte);
     ASSERT_UNUSED(typeByte, typeByte == ObjectStoreNamesTypeByte);
     return decodeStringWithLength(p, limit, result->m_objectStoreName);
 }
@@ -1363,7 +1386,8 @@ const char* IndexNamesKey::decode(const char* start, const char* limit, IndexNam
     ASSERT(!prefix.m_indexId);
     if (p == limit)
         return 0;
-    unsigned char typeByte = *p++;
+    unsigned char typeByte = 0;
+    p = decodeByte(p, limit, typeByte);
     ASSERT_UNUSED(typeByte, typeByte == IndexNamesKeyTypeByte);
     if (p == limit)
         return 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.h b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.h
index 3113e7d8a..1b1666ae8 100644
--- a/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.h
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.h
@@ -43,7 +43,12 @@ namespace IDBLevelDBCoding {
 
 const unsigned char MinimumIndexId = 30;
 
+// As most of the IDBKeys and encoded values are short, we initialize some Vectors with a default inline buffer size
+// to reduce the memory re-allocations when the Vectors are appended.
+static const size_t DefaultInlineBufferSize = 32;
+
 Vector<char> encodeByte(unsigned char);
+const char* decodeByte(const char* p, const char* limit, unsigned char& foundChar);
 Vector<char> maxIDBKey();
 Vector<char> minIDBKey();
 Vector<char> encodeBool(bool);
@@ -59,7 +64,7 @@ const char* decodeStringWithLength(const char* p, const char* limit, String& fou
 int compareEncodedStringsWithLength(const char*& p, const char* limitP, const char*& q, const char* limitQ);
 Vector<char> encodeDouble(double);
 const char* decodeDouble(const char* p, const char* limit, double*);
-void encodeIDBKey(const IDBKey&, Vector<char>& into);
+void encodeIDBKey(const IDBKey&, Vector<char, DefaultInlineBufferSize>& into);
 Vector<char> encodeIDBKey(const IDBKey&);
 const char* decodeIDBKey(const char* p, const char* limit, RefPtr<IDBKey>& foundKey);
 const char* extractEncodedIDBKey(const char* start, const char* limit, Vector<char>* result);
@@ -140,7 +145,8 @@ public:
         OriginName = 0,
         DatabaseName = 1,
         UserVersion = 2,
-        MaxObjectStoreId = 3
+        MaxObjectStoreId = 3,
+        UserIntVersion = 4
     };
 
     static Vector<char> encode(int64_t databaseId, MetaDataType);
@@ -161,16 +167,16 @@ public:
 
     ObjectStoreMetaDataKey();
     static const char* decode(const char* start, const char* limit, ObjectStoreMetaDataKey* result);
-    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, int64_t metaDataType);
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, unsigned char metaDataType);
     static Vector<char> encodeMaxKey(int64_t databaseId);
     static Vector<char> encodeMaxKey(int64_t databaseId, int64_t objectStoreId);
     int64_t objectStoreId() const;
-    int64_t metaDataType() const;
+    unsigned char metaDataType() const;
     int compare(const ObjectStoreMetaDataKey& other);
 
 private:
     int64_t m_objectStoreId;
-    int64_t m_metaDataType; // FIXME: Make this a byte.
+    unsigned char m_metaDataType;
 };
 
 class IndexMetaDataKey {
diff --git a/Source/WebCore/Modules/indexeddb/IDBMetadata.h b/Source/WebCore/Modules/indexeddb/IDBMetadata.h
index dd230620c..2dc66e7d4 100644
--- a/Source/WebCore/Modules/indexeddb/IDBMetadata.h
+++ b/Source/WebCore/Modules/indexeddb/IDBMetadata.h
@@ -42,8 +42,10 @@ struct IDBObjectStoreMetadata;
 struct IDBIndexMetadata;
 
 struct IDBDatabaseMetadata {
+    // FIXME: These can probably be collapsed into 0.
     enum {
-        NoIntVersion = -1
+        NoIntVersion = -1,
+        DefaultIntVersion = 0
     };
 
     IDBDatabaseMetadata()
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
index 746933ef0..ce0915a30 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
@@ -539,7 +539,7 @@ void IDBObjectStoreBackendImpl::openCursorInternal(ScriptExecutionContext*, Pass
         return;
     }
 
-    RefPtr<IDBCursorBackendInterface> cursor = IDBCursorBackendImpl::create(backingStoreCursor.release(), direction, IDBCursorBackendInterface::ObjectStoreCursor, transaction.get(), objectStore.get());
+    RefPtr<IDBCursorBackendInterface> cursor = IDBCursorBackendImpl::create(backingStoreCursor.release(), IDBCursorBackendInterface::ObjectStoreCursor, transaction.get(), objectStore.get());
     callbacks->onSuccess(cursor.release());
 }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBRequest.cpp b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
index cd25c3102..1270efccd 100644
--- a/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
@@ -58,7 +58,6 @@ IDBRequest::IDBRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> sourc
     , m_transaction(transaction)
     , m_readyState(PENDING)
     , m_requestAborted(false)
-    , m_cursorFinished(false)
     , m_contextStopped(false)
     , m_cursorType(IDBCursorBackendInterface::InvalidCursorType)
     , m_cursorDirection(IDBCursor::NEXT)
@@ -142,10 +141,10 @@ void IDBRequest::markEarlyDeath()
 
 void IDBRequest::abort()
 {
-    ASSERT(m_readyState == PENDING || m_readyState == DONE);
     ASSERT(!m_requestAborted);
     if (m_contextStopped || !scriptExecutionContext())
         return;
+    ASSERT(m_readyState == PENDING || m_readyState == DONE);
     if (m_readyState == DONE)
         return;
 
@@ -211,19 +210,24 @@ void IDBRequest::setResultCursor(PassRefPtr<IDBCursor> prpCursor)
     m_result = IDBAny::create(IDBCursorWithValue::fromCursor(prpCursor));
 }
 
-void IDBRequest::finishCursor()
+bool IDBRequest::shouldEnqueueEvent() const
 {
+    if (m_contextStopped || !scriptExecutionContext())
+        return false;
     ASSERT(m_readyState == PENDING || m_readyState == DONE);
-    m_cursorFinished = true;
+    if (m_requestAborted)
+        return false;
+    ASSERT(m_readyState == PENDING);
+    ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
+    return true;
 }
 
 void IDBRequest::onError(PassRefPtr<IDBDatabaseError> error)
 {
-    ASSERT(m_readyState == PENDING || m_readyState == DONE);
-    if (m_requestAborted)
+    IDB_TRACE("IDBRequest::onError()");
+    if (!shouldEnqueueEvent())
         return;
-    ASSERT(m_readyState == PENDING);
-    ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
+
     m_errorCode = error->code();
     m_errorMessage = error->message();
     m_error = DOMError::create(IDBDatabaseException::getErrorName(error->idbCode()));
@@ -239,11 +243,9 @@ static PassRefPtr<Event> createSuccessEvent()
 void IDBRequest::onSuccess(PassRefPtr<DOMStringList> domStringList)
 {
     IDB_TRACE("IDBRequest::onSuccess(DOMStringList)");
-    ASSERT(m_readyState == PENDING || m_readyState == DONE);
-    if (m_requestAborted)
+    if (!shouldEnqueueEvent())
         return;
-    ASSERT(m_readyState == PENDING);
-    ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
+
     m_result = IDBAny::create(domStringList);
     enqueueEvent(createSuccessEvent());
 }
@@ -251,11 +253,9 @@ void IDBRequest::onSuccess(PassRefPtr<DOMStringList> domStringList)
 void IDBRequest::onSuccess(PassRefPtr<IDBCursorBackendInterface> backend)
 {
     IDB_TRACE("IDBRequest::onSuccess(IDBCursor)");
-    ASSERT(m_readyState == PENDING || m_readyState == DONE);
-    if (m_requestAborted)
+    if (!shouldEnqueueEvent())
         return;
-    ASSERT(m_readyState == PENDING);
-    ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
+
     ASSERT(m_cursorType != IDBCursorBackendInterface::InvalidCursorType);
     RefPtr<IDBCursor> cursor;
     if (m_cursorType == IDBCursorBackendInterface::IndexKeyCursor)
@@ -270,12 +270,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBCursorBackendInterface> backend)
 void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 {
     IDB_TRACE("IDBRequest::onSuccess(IDBDatabase)");
-    ASSERT(m_readyState == PENDING || m_readyState == DONE);
-    if (m_requestAborted)
-        return;
-    ASSERT(m_readyState == PENDING);
-    ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
-    if (m_contextStopped || !scriptExecutionContext())
+    if (!shouldEnqueueEvent())
         return;
 
     RefPtr<IDBDatabase> idbDatabase = IDBDatabase::create(scriptExecutionContext(), backend);
@@ -288,11 +283,9 @@ void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
     IDB_TRACE("IDBRequest::onSuccess(IDBKey)");
-    ASSERT(m_readyState == PENDING || m_readyState == DONE);
-    if (m_requestAborted)
+    if (!shouldEnqueueEvent())
         return;
-    ASSERT(m_readyState == PENDING);
-    ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
+
     if (idbKey && idbKey->isValid())
         m_result = IDBAny::create(idbKey);
     else
@@ -303,17 +296,16 @@ void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend)
 {
     IDB_TRACE("IDBRequest::onSuccess(IDBTransaction)");
-    ASSERT(m_readyState == PENDING || m_readyState == DONE);
-    if (m_requestAborted)
-        return;
-    ASSERT(m_readyState == PENDING);
-    ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
     RefPtr<IDBTransactionBackendInterface> backend = prpBackend;
 
     if (m_contextStopped || !scriptExecutionContext()) {
-        backend->abort();
+        // Should only be null in tests.
+        if (backend.get())
+            backend->abort();
         return;
     }
+    if (!shouldEnqueueEvent())
+        return;
 
     RefPtr<IDBTransaction> frontend = IDBTransaction::create(scriptExecutionContext(), backend, IDBTransaction::VERSION_CHANGE, m_source->idbDatabase().get());
     backend->setCallbacks(frontend.get());
@@ -329,11 +321,9 @@ void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend
 void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptValue)
 {
     IDB_TRACE("IDBRequest::onSuccess(SerializedScriptValue)");
-    ASSERT(m_readyState == PENDING || m_readyState == DONE);
-    if (m_requestAborted)
+    if (!shouldEnqueueEvent())
         return;
-    ASSERT(m_readyState == PENDING);
-    ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
+
     m_result = IDBAny::create(serializedScriptValue);
     m_pendingCursor.clear();
     enqueueEvent(createSuccessEvent());
@@ -354,8 +344,10 @@ static PassRefPtr<IDBObjectStore> effectiveObjectStore(PassRefPtr<IDBAny> source
 
 void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> prpSerializedScriptValue, PassRefPtr<IDBKey> prpPrimaryKey, const IDBKeyPath& keyPath)
 {
-    if (m_requestAborted)
+    IDB_TRACE("IDBRequest::onSuccess(SerializedScriptValue, IDBKey, IDBKeyPath)");
+    if (!shouldEnqueueEvent())
         return;
+
 #ifndef NDEBUG
     ASSERT(keyPath == effectiveObjectStore(m_source)->keyPath());
 #endif
@@ -380,10 +372,9 @@ void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> prpSerializedScript
 void IDBRequest::onSuccessWithContinuation()
 {
     IDB_TRACE("IDBRequest::onSuccessWithContinuation");
-    ASSERT(m_readyState == PENDING || m_readyState == DONE);
-    if (m_requestAborted)
+    if (!shouldEnqueueEvent())
         return;
-    ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
+
     ASSERT(m_pendingCursor);
     setResultCursor(m_pendingCursor.release());
     enqueueEvent(createSuccessEvent());
diff --git a/Source/WebCore/Modules/indexeddb/IDBRequest.h b/Source/WebCore/Modules/indexeddb/IDBRequest.h
index a804c2bd5..f5cb5b742 100644
--- a/Source/WebCore/Modules/indexeddb/IDBRequest.h
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.h
@@ -76,7 +76,6 @@ public:
     void markEarlyDeath();
     void setCursorDetails(IDBCursorBackendInterface::CursorType, IDBCursor::Direction);
     void setPendingCursor(PassRefPtr<IDBCursor>);
-    void finishCursor();
     void abort();
 
     // IDBCallbacks
@@ -109,6 +108,8 @@ public:
 protected:
     IDBRequest(ScriptExecutionContext*, PassRefPtr<IDBAny> source, IDBTransaction*);
     void enqueueEvent(PassRefPtr<Event>);
+    bool shouldEnqueueEvent() const;
+
     RefPtr<IDBAny> m_result;
     unsigned short m_errorCode;
     String m_errorMessage;
@@ -129,7 +130,6 @@ private:
 
     ReadyState m_readyState;
     bool m_requestAborted; // May be aborted by transaction then receive async onsuccess; ignore vs. assert.
-    bool m_cursorFinished;
     bool m_contextStopped;
     Vector<RefPtr<Event> > m_enqueuedEvents;
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
index 70f3367ab..1bbd23b56 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
@@ -227,6 +227,8 @@ void IDBTransactionBackendImpl::commit()
     else
         m_callbacks->onAbort();
 
+    m_database->transactionFinishedAndEventsFired(this);
+
     m_database = 0;
 }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
index bdc52ffe3..0e4126cb0 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
@@ -49,6 +49,11 @@ class IDBTransactionBackendInterface : public ThreadSafeRefCounted<IDBTransactio
 public:
     virtual ~IDBTransactionBackendInterface() { }
 
+    enum TaskType {
+        NormalTask = 0,
+        PreemptiveTask
+    };
+
     virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name, ExceptionCode&) = 0;
     virtual void didCompleteTaskEvents() = 0;
     virtual void commit() = 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.cpp b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.cpp
index f13ca9d3c..c741a7be4 100644
--- a/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.cpp
@@ -58,6 +58,8 @@ const AtomicString& IDBVersionChangeRequest::interfaceName() const
 
 void IDBVersionChangeRequest::onBlocked()
 {
+    if (!shouldEnqueueEvent())
+        return;
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     enqueueEvent(IDBVersionChangeEvent::create(m_version, eventNames().blockedEvent));
 }
diff --git a/Source/WebCore/Modules/mediasource/MediaSource.cpp b/Source/WebCore/Modules/mediasource/MediaSource.cpp
new file mode 100644
index 000000000..6f84d9439
--- /dev/null
+++ b/Source/WebCore/Modules/mediasource/MediaSource.cpp
@@ -0,0 +1,287 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MediaSource.h"
+
+#if ENABLE(MEDIA_SOURCE)
+
+#include "ContentType.h"
+#include "Event.h"
+#include "TimeRanges.h"
+#include <wtf/Uint8Array.h>
+
+namespace WebCore {
+
+PassRefPtr<MediaSource> MediaSource::create(ScriptExecutionContext* context)
+{
+    return adoptRef(new MediaSource(context));
+}
+
+MediaSource::MediaSource(ScriptExecutionContext* context)
+    : ContextDestructionObserver(context)
+    , m_readyState(closedKeyword())
+    , m_player(0)
+    , m_nextSourceBufferId(0)
+{
+    m_sourceBuffers = SourceBufferList::create(scriptExecutionContext());
+    m_activeSourceBuffers = SourceBufferList::create(scriptExecutionContext());
+}
+
+SourceBufferList* MediaSource::sourceBuffers()
+{
+    return m_sourceBuffers.get();
+}
+
+SourceBufferList* MediaSource::activeSourceBuffers()
+{
+    // FIXME(91649): support track selection
+    return m_activeSourceBuffers.get();
+}
+
+SourceBuffer* MediaSource::addSourceBuffer(const String& type, ExceptionCode& ec)
+{
+    // 3.1 http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html#dom-addsourcebuffer
+    // 1. If type is null or an empty then throw an INVALID_ACCESS_ERR exception and
+    // abort these steps.
+    if (type.isNull() || type.isEmpty()) {
+        ec = INVALID_ACCESS_ERR;
+        return 0;
+    }
+
+    // 2. If type contains a MIME type that is not supported ..., then throw a
+    // NOT_SUPPORTED_ERR exception and abort these steps.
+    ContentType contentType(type);
+    Vector<String> codecs = contentType.codecs();
+
+    if (!codecs.size()) {
+        ec = NOT_SUPPORTED_ERR;
+        return 0;
+    }
+    
+    // 4. If the readyState attribute is not in the "open" state then throw an
+    // INVALID_STATE_ERR exception and abort these steps.
+    if (!m_player || m_readyState != openKeyword()) {
+        ec = INVALID_STATE_ERR;
+        return 0;
+    }
+
+    // 5. Create a new SourceBuffer object and associated resources.
+    RefPtr<SourceBuffer> buffer = SourceBuffer::create(String::number(++m_nextSourceBufferId), this);
+
+    switch (m_player->sourceAddId(buffer->id(), contentType.type(), codecs)) {
+    case MediaPlayer::Ok:
+        // 6. Add the new object to sourceBuffers and fire a addsourcebuffer on that object.
+        m_sourceBuffers->add(buffer);
+        m_activeSourceBuffers->add(buffer);
+        // 7. Return the new object to the caller.
+        return buffer.get();
+    case MediaPlayer::NotSupported:
+        // 2 (cont). If type contains a MIME type ... that is not supported with the types 
+        // specified for the other SourceBuffer objects in sourceBuffers, then throw
+        // a NOT_SUPPORTED_ERR exception and abort these steps.
+        ec = NOT_SUPPORTED_ERR;
+        return 0;
+    case MediaPlayer::ReachedIdLimit:
+        // 3 (cont). If the user agent can't handle any more SourceBuffer objects then throw 
+        // a QUOTA_EXCEEDED_ERR exception and abort these steps.
+        ec = QUOTA_EXCEEDED_ERR;
+        return 0;
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+void MediaSource::removeSourceBuffer(SourceBuffer* buffer, ExceptionCode& ec)
+{
+    // 3.1 http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html#dom-removesourcebuffer
+    // 1. If sourceBuffer is null then throw an INVALID_ACCESS_ERR exception and
+    // abort these steps.
+    if (!buffer) {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+
+    // 2. If sourceBuffers is empty then throw an INVALID_STATE_ERR exception and
+    // abort these steps.
+    if (!m_player || !m_sourceBuffers->length()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    // 3. If sourceBuffer specifies an object that is not in sourceBuffers then
+    // throw a NOT_FOUND_ERR exception and abort these steps.
+    // 6. Remove sourceBuffer from sourceBuffers and fire a removesourcebuffer event
+    // on that object.
+    if (!m_sourceBuffers->remove(buffer)) {
+        ec = NOT_FOUND_ERR;
+        return;
+    }
+
+    // 7. Destroy all resources for sourceBuffer.
+    m_activeSourceBuffers->remove(buffer);
+    m_player->sourceRemoveId(buffer->id());
+
+    // 4. Remove track information from audioTracks, videoTracks, and textTracks for all tracks 
+    // associated with sourceBuffer and fire a simple event named change on the modified lists.
+    // FIXME(91649): support track selection
+
+    // 5. If sourceBuffer is in activeSourceBuffers, then remove it from that list and fire a
+    // removesourcebuffer event on that object.
+    // FIXME(91649): support track selection
+}
+
+const String& MediaSource::readyState() const
+{
+    return m_readyState;
+}
+
+void MediaSource::setReadyState(const String& state)
+{
+    ASSERT(state == openKeyword() || state == closedKeyword() || state == endedKeyword());
+    if (m_readyState == state)
+        return;
+
+    String oldState = m_readyState;
+    m_readyState = state;
+
+    if (m_readyState == closedKeyword()) {
+        m_sourceBuffers->clear();
+        m_activeSourceBuffers->clear();
+        m_player = 0;
+        dispatchEvent(Event::create(eventNames().webkitsourcecloseEvent, false, false));
+        return;
+    }
+    
+    if (oldState == openKeyword() && m_readyState == endedKeyword()) {
+        dispatchEvent(Event::create(eventNames().webkitsourceendedEvent, false, false));
+        return;
+    }
+
+    if (m_readyState == openKeyword()) {
+        dispatchEvent(Event::create(eventNames().webkitsourceopenEvent, false, false));
+        return;
+    }
+}
+
+void MediaSource::endOfStream(const String& error, ExceptionCode& ec)
+{
+    // 3.1 http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html#dom-endofstream
+    // 1. If the readyState attribute is not in the "open" state then throw an
+    // INVALID_STATE_ERR exception and abort these steps.
+    if (!m_player || m_readyState != openKeyword()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    MediaPlayer::EndOfStreamStatus eosStatus = MediaPlayer::EosNoError;
+
+    if (error.isNull() || error.isEmpty())
+        eosStatus = MediaPlayer::EosNoError;
+    else if (error == "network")
+        eosStatus = MediaPlayer::EosNetworkError;
+    else if (error == "decode")
+        eosStatus = MediaPlayer::EosDecodeError;
+    else {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+
+    // 2. Change the readyState attribute value to "ended".
+    setReadyState(endedKeyword());
+    m_player->sourceEndOfStream(eosStatus);
+}
+
+PassRefPtr<TimeRanges> MediaSource::buffered(const String& id, ExceptionCode& ec) const
+{
+    if (!m_player || m_readyState == closedKeyword()) {
+        ec = INVALID_STATE_ERR;
+        return 0;
+    }
+
+    return m_player->sourceBuffered(id);
+}
+
+void MediaSource::append(const String& id, PassRefPtr<Uint8Array> data, ExceptionCode& ec)
+{
+    if (!data.get()) {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+
+    if (!m_player || m_readyState != openKeyword()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    if (!data->length())
+        return;
+
+    if (!m_player->sourceAppend(id, data->data(), data->length())) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+}
+
+void MediaSource::abort(const String& id, ExceptionCode& ec)
+{
+    if (!m_player || m_readyState != openKeyword()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    if (!m_player->sourceAbort(id))
+        ASSERT_NOT_REACHED();
+}
+
+const AtomicString& MediaSource::interfaceName() const
+{
+    return eventNames().interfaceForMediaSource;
+}
+
+ScriptExecutionContext* MediaSource::scriptExecutionContext() const
+{
+    return ContextDestructionObserver::scriptExecutionContext();
+}
+
+EventTargetData* MediaSource::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* MediaSource::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/Modules/mediasource/MediaSource.h b/Source/WebCore/Modules/mediasource/MediaSource.h
new file mode 100644
index 000000000..646ac3ae7
--- /dev/null
+++ b/Source/WebCore/Modules/mediasource/MediaSource.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MediaSource_h
+#define MediaSource_h
+
+#if ENABLE(MEDIA_SOURCE)
+
+#include "ContextDestructionObserver.h"
+#include "MediaPlayer.h"
+#include "SourceBuffer.h"
+#include "SourceBufferList.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class MediaSource : public RefCounted<MediaSource>, public EventTarget, public ContextDestructionObserver {
+public:
+    static const String& openKeyword()
+    {
+        DEFINE_STATIC_LOCAL(const String, open, ("open"));
+        return open;
+    }
+
+    static const String& closedKeyword()
+    {
+        DEFINE_STATIC_LOCAL(const String, closed, ("closed"));
+        return closed;
+    }
+
+    static const String& endedKeyword()
+    {
+        DEFINE_STATIC_LOCAL(const String, ended, ("ended"));
+        return ended;
+    }
+
+    static PassRefPtr<MediaSource> create(ScriptExecutionContext*);
+    virtual ~MediaSource() { }
+
+    SourceBufferList* sourceBuffers();
+    SourceBufferList* activeSourceBuffers();
+
+    SourceBuffer* addSourceBuffer(const String& type, ExceptionCode&);
+    void removeSourceBuffer(SourceBuffer*, ExceptionCode&);
+
+    const String& readyState() const;
+    void setReadyState(const String&);
+
+    void endOfStream(const String& error, ExceptionCode&);
+
+    void setMediaPlayer(MediaPlayer* player) { m_player = player; }
+    
+    PassRefPtr<TimeRanges> buffered(const String& id, ExceptionCode&) const;
+    void append(const String& id, PassRefPtr<Uint8Array> data, ExceptionCode&);
+    void abort(const String& id, ExceptionCode&);
+
+    // EventTarget interface
+    virtual const AtomicString& interfaceName() const OVERRIDE;
+    virtual ScriptExecutionContext* scriptExecutionContext() const OVERRIDE;
+
+    using RefCounted<MediaSource>::ref;
+    using RefCounted<MediaSource>::deref;
+
+private:
+    explicit MediaSource(ScriptExecutionContext*);
+
+    virtual EventTargetData* eventTargetData() OVERRIDE;
+    virtual EventTargetData* ensureEventTargetData() OVERRIDE;
+
+    virtual void refEventTarget() OVERRIDE { ref(); }
+    virtual void derefEventTarget() OVERRIDE { deref(); }
+
+    EventTargetData m_eventTargetData;
+
+    String m_readyState;
+    MediaPlayer* m_player;
+
+    RefPtr<SourceBufferList> m_sourceBuffers;
+    RefPtr<SourceBufferList> m_activeSourceBuffers;
+    int m_nextSourceBufferId;
+};
+
+} // namespace WebCore
+
+#endif
+#endif
diff --git a/Source/WebCore/Modules/mediasource/MediaSource.idl b/Source/WebCore/Modules/mediasource/MediaSource.idl
new file mode 100644
index 000000000..25f7dec1b
--- /dev/null
+++ b/Source/WebCore/Modules/mediasource/MediaSource.idl
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+module html {
+
+    interface [
+        Conditional=MEDIA_SOURCE,
+        V8EnabledAtRuntime=mediaSource,
+        EventTarget,
+        Constructor,
+        CallWith=ScriptExecutionContext
+    ] MediaSource {
+        // All the source buffers created by this object.
+        readonly attribute SourceBufferList sourceBuffers;
+
+        // Subset of sourceBuffers that provide data for the selected/enabled tracks.
+        readonly attribute SourceBufferList activeSourceBuffers;
+
+        SourceBuffer addSourceBuffer(in DOMString type) raises (DOMException);
+        void removeSourceBuffer(in SourceBuffer buffer) raises (DOMException);
+
+        readonly attribute DOMString readyState;
+        
+        void endOfStream(in [Optional=DefaultIsNullString] DOMString error)
+            raises (DOMException);
+        
+        // EventTarget interface
+        void addEventListener(in DOMString type,
+                              in EventListener listener,
+                              in [Optional] boolean useCapture);
+        void removeEventListener(in DOMString type,
+                                 in EventListener listener,
+                                 in [Optional] boolean useCapture);
+        boolean dispatchEvent(in Event event)
+            raises(EventException);
+    };
+
+}
diff --git a/Source/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp b/Source/WebCore/Modules/mediasource/MediaSourceRegistry.cpp
index 246704a23..0fb8ceb38 100644
--- a/Source/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp
+++ b/Source/WebCore/Modules/mediasource/MediaSourceRegistry.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,38 +29,41 @@
  */
 
 #include "config.h"
-#include <wtf/ArrayBuffer.h>
-#include <wtf/Int8Array.h>
+#include "MediaSourceRegistry.h"
 
-#include "V8Binding.h"
-#include "V8ArrayBuffer.h"
-#include "V8ArrayBufferViewCustom.h"
-#include "V8Int8Array.h"
-#include "V8Proxy.h"
+#if ENABLE(MEDIA_SOURCE)
+
+#include "KURL.h"
+#include "MediaSource.h"
+#include <wtf/MainThread.h>
 
 namespace WebCore {
 
-v8::Handle<v8::Value> V8Int8Array::constructorCallback(const v8::Arguments& args)
+MediaSourceRegistry& MediaSourceRegistry::registry()
 {
-    INC_STATS("DOM.Int8Array.Contructor");
+    ASSERT(isMainThread());
+    DEFINE_STATIC_LOCAL(MediaSourceRegistry, instance, ());
+    return instance;
+}
 
-    return constructWebGLArray<Int8Array, signed char>(args, &info, v8::kExternalByteArray);
+void MediaSourceRegistry::registerMediaSourceURL(const KURL& url, PassRefPtr<MediaSource> source)
+{
+    ASSERT(isMainThread());
+    m_mediaSources.set(url.string(), source);
 }
 
-v8::Handle<v8::Value> V8Int8Array::setCallback(const v8::Arguments& args)
+void MediaSourceRegistry::unregisterMediaSourceURL(const KURL& url)
 {
-    INC_STATS("DOM.Int8Array.set()");
-    return setWebGLArrayHelper<Int8Array, V8Int8Array>(args);
+    ASSERT(isMainThread());
+    m_mediaSources.remove(url.string());
 }
 
-v8::Handle<v8::Value> toV8(Int8Array* impl, v8::Isolate* isolate)
+MediaSource* MediaSourceRegistry::lookupMediaSource(const String& url)
 {
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8Int8Array::wrap(impl, isolate);
-    if (!wrapper.IsEmpty())
-        wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), v8::kExternalByteArray, impl->length());
-    return wrapper;
+    ASSERT(isMainThread());
+    return m_mediaSources.get(url).get();
 }
 
 } // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/Modules/mediasource/MediaSourceRegistry.h b/Source/WebCore/Modules/mediasource/MediaSourceRegistry.h
new file mode 100644
index 000000000..96da6b347
--- /dev/null
+++ b/Source/WebCore/Modules/mediasource/MediaSourceRegistry.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MediaSourceRegistry_h
+#define MediaSourceRegistry_h
+
+#if ENABLE(MEDIA_SOURCE)
+
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class KURL;
+class MediaSource;
+
+class MediaSourceRegistry {
+public:
+    // Returns a single instance of MediaSourceRegistry.
+    static MediaSourceRegistry& registry();
+
+    // Registers a blob URL referring to the specified media source.
+    void registerMediaSourceURL(const KURL&, PassRefPtr<MediaSource>);
+    void unregisterMediaSourceURL(const KURL&);
+
+    MediaSource* lookupMediaSource(const String& url);
+
+private:
+    HashMap<String, RefPtr<MediaSource> > m_mediaSources;
+};
+
+} // namespace WebCore
+
+#endif
+#endif
diff --git a/Source/WebCore/Modules/mediasource/SourceBuffer.cpp b/Source/WebCore/Modules/mediasource/SourceBuffer.cpp
index 7b368216a..591910803 100644
--- a/Source/WebCore/Modules/mediasource/SourceBuffer.cpp
+++ b/Source/WebCore/Modules/mediasource/SourceBuffer.cpp
@@ -38,8 +38,9 @@
 
 namespace WebCore {
 
-SourceBuffer::SourceBuffer(const String& id)
+SourceBuffer::SourceBuffer(const String& id, PassRefPtr<MediaSource> source)
     : m_id(id)
+    , m_source(source)
 {
 }
 
@@ -47,20 +48,34 @@ SourceBuffer::~SourceBuffer()
 {
 }
 
-PassRefPtr<TimeRanges> SourceBuffer::buffered(ExceptionCode&) const
+PassRefPtr<TimeRanges> SourceBuffer::buffered(ExceptionCode& ec) const
 {
-    // FIXME(91773): return buffered data from media source.
-    return 0;
+    if (!m_source) {
+        ec = INVALID_STATE_ERR;
+        return 0;
+    }
+
+    return m_source->buffered(id(), ec);
 }
 
-void SourceBuffer::append(PassRefPtr<Uint8Array>, ExceptionCode&)
+void SourceBuffer::append(PassRefPtr<Uint8Array> data, ExceptionCode& ec)
 {
-    // FIXME(91773): append the data to the media source.
+    if (!m_source) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    m_source->append(id(), data, ec);
 }
 
-void SourceBuffer::abort(ExceptionCode&)
+void SourceBuffer::abort(ExceptionCode& ec)
 {
-    // FIXME(91773): signal the media source to abort this source buffer.
+    if (!m_source) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    m_source->abort(id(), ec);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/mediasource/SourceBuffer.h b/Source/WebCore/Modules/mediasource/SourceBuffer.h
index 0cbff3e13..d180dd4d7 100644
--- a/Source/WebCore/Modules/mediasource/SourceBuffer.h
+++ b/Source/WebCore/Modules/mediasource/SourceBuffer.h
@@ -34,6 +34,7 @@
 #if ENABLE(MEDIA_SOURCE)
 
 #include "ExceptionCode.h"
+#include "MediaSource.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/text/WTFString.h>
@@ -44,9 +45,9 @@ class TimeRanges;
 
 class SourceBuffer : public RefCounted<SourceBuffer> {
 public:
-    static PassRefPtr<SourceBuffer> create(const String& id)
+    static PassRefPtr<SourceBuffer> create(const String& id, PassRefPtr<MediaSource> source)
     {
-        return adoptRef(new SourceBuffer(id));
+        return adoptRef(new SourceBuffer(id, source));
     }
 
     virtual ~SourceBuffer();
@@ -59,12 +60,13 @@ public:
     
     const String& id() const { return m_id; }
 
-    void clear() { }
+    void clear() { m_source.clear(); }
 
 private:
-    explicit SourceBuffer(const String& id);
+    explicit SourceBuffer(const String& id, PassRefPtr<MediaSource>);
 
     String m_id;
+    RefPtr<MediaSource> m_source;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/mediasource/SourceBufferList.cpp b/Source/WebCore/Modules/mediasource/SourceBufferList.cpp
index 3cc467831..662b46f0f 100644
--- a/Source/WebCore/Modules/mediasource/SourceBufferList.cpp
+++ b/Source/WebCore/Modules/mediasource/SourceBufferList.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(MEDIA_SOURCE)
 
 #include "Event.h"
+#include "SourceBuffer.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/Modules/mediasource/SourceBufferList.h b/Source/WebCore/Modules/mediasource/SourceBufferList.h
index 7e9f83152..6f7f9a789 100644
--- a/Source/WebCore/Modules/mediasource/SourceBufferList.h
+++ b/Source/WebCore/Modules/mediasource/SourceBufferList.h
@@ -34,12 +34,13 @@
 #if ENABLE(MEDIA_SOURCE)
 
 #include "EventTarget.h"
-#include "SourceBuffer.h"
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
+class SourceBuffer;
+
 class SourceBufferList : public RefCounted<SourceBufferList>, public EventTarget {
 public:
     static PassRefPtr<SourceBufferList> create(ScriptExecutionContext* context)
diff --git a/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl b/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl
index 742a62463..ea946a496 100644
--- a/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl
+++ b/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl
@@ -32,6 +32,7 @@ module window {
     ] DOMWindowMediaStream {
         attribute [V8EnabledAtRuntime] MediaStreamConstructor webkitMediaStream;
         attribute [V8EnabledAtRuntime] PeerConnection00Constructor webkitPeerConnection00;
+        attribute [V8EnabledAtRuntime] RTCPeerConnectionConstructor webkitRTCPeerConnection;
         attribute SessionDescriptionConstructor SessionDescription;
         attribute IceCandidateConstructor IceCandidate;
         attribute MediaStreamEventConstructor MediaStreamEvent;
diff --git a/Source/WebCore/Modules/mediastream/MediaStreamRegistry.cpp b/Source/WebCore/Modules/mediastream/MediaStreamRegistry.cpp
index eb9fdbbb3..843eaab4c 100644
--- a/Source/WebCore/Modules/mediastream/MediaStreamRegistry.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamRegistry.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 
 MediaStreamRegistry& MediaStreamRegistry::registry()
 {
+    // Since WebWorkers cannot obtain MediaSource objects, we should be on the main thread.
     ASSERT(isMainThread());
     DEFINE_STATIC_LOCAL(MediaStreamRegistry, instance, ());
     return instance;
diff --git a/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp b/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
new file mode 100644
index 000000000..77addad9e
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "RTCPeerConnection.h"
+
+#include "ArrayValue.h"
+#include "ExceptionCode.h"
+#include "KURL.h"
+#include "RTCConfiguration.h"
+#include "ScriptExecutionContext.h"
+
+namespace WebCore {
+
+PassRefPtr<RTCConfiguration> RTCPeerConnection::parseConfiguration(const Dictionary& configuration, ExceptionCode& ec)
+{
+    if (configuration.isUndefinedOrNull())
+        return 0;
+
+    ArrayValue iceServers;
+    bool ok = configuration.get("iceServers", iceServers);
+    if (!ok || iceServers.isUndefinedOrNull()) {
+        ec = TYPE_MISMATCH_ERR;
+        return 0;
+    }
+
+    size_t numberOfServers;
+    ok = iceServers.length(numberOfServers);
+    if (!ok) {
+        ec = TYPE_MISMATCH_ERR;
+        return 0;
+    }
+
+    RefPtr<RTCConfiguration> rtcConfiguration = RTCConfiguration::create();
+
+    for (size_t i = 0; i < numberOfServers; ++i) {
+        Dictionary iceServer;
+        ok = iceServers.get(i, iceServer);
+        if (!ok) {
+            ec = TYPE_MISMATCH_ERR;
+            return 0;
+        }
+
+        String uri, credential;
+        ok = iceServer.get("uri", uri);
+        if (!ok) {
+            ec = TYPE_MISMATCH_ERR;
+            return 0;
+        }
+        KURL url(KURL(), uri);
+        if (!url.isValid() || !(url.protocolIs("turn") || url.protocolIs("stun"))) {
+            ec = TYPE_MISMATCH_ERR;
+            return 0;
+        }
+
+        iceServer.get("credential", credential);
+
+        rtcConfiguration->appendServer(RTCIceServer::create(url, credential));
+    }
+    return rtcConfiguration.release();
+}
+
+PassRefPtr<RTCPeerConnection> RTCPeerConnection::create(ScriptExecutionContext* context, const Dictionary& rtcConfiguration, const Dictionary&, ExceptionCode& ec)
+{
+    RefPtr<RTCConfiguration> configuration = parseConfiguration(rtcConfiguration, ec);
+    if (ec)
+        return 0;
+
+    RefPtr<RTCPeerConnection> peerConnection = adoptRef(new RTCPeerConnection(context, configuration.release(), ec));
+    peerConnection->suspendIfNeeded();
+    if (ec)
+        return 0;
+
+    return peerConnection.release();
+}
+
+RTCPeerConnection::RTCPeerConnection(ScriptExecutionContext* context, PassRefPtr<RTCConfiguration>, ExceptionCode& ec)
+    : ActiveDOMObject(context, this)
+{
+    m_peerHandler = RTCPeerConnectionHandler::create(this);
+    if (!m_peerHandler || !m_peerHandler->initialize())
+        ec = NOT_SUPPORTED_ERR;
+}
+
+RTCPeerConnection::~RTCPeerConnection()
+{
+}
+
+const AtomicString& RTCPeerConnection::interfaceName() const
+{
+    return eventNames().interfaceForRTCPeerConnection;
+}
+
+ScriptExecutionContext* RTCPeerConnection::scriptExecutionContext() const
+{
+    return ActiveDOMObject::scriptExecutionContext();
+}
+
+void RTCPeerConnection::stop()
+{
+    // FIXME: Make sure that this object stops posting events and releases resources at this stage.
+}
+
+EventTargetData* RTCPeerConnection::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* RTCPeerConnection::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/Modules/mediastream/RTCPeerConnection.h b/Source/WebCore/Modules/mediastream/RTCPeerConnection.h
new file mode 100644
index 000000000..10423029b
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/RTCPeerConnection.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RTCPeerConnection_h
+#define RTCPeerConnection_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "ActiveDOMObject.h"
+#include "Dictionary.h"
+#include "EventTarget.h"
+#include "ExceptionBase.h"
+#include "RTCPeerConnectionHandler.h"
+#include "RTCPeerConnectionHandlerClient.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+class RTCConfiguration;
+
+class RTCPeerConnection : public RefCounted<RTCPeerConnection>, public RTCPeerConnectionHandlerClient, public EventTarget, public ActiveDOMObject {
+public:
+    static PassRefPtr<RTCPeerConnection> create(ScriptExecutionContext*, const Dictionary& rtcConfiguration, const Dictionary& mediaConstraints, ExceptionCode&);
+    ~RTCPeerConnection();
+
+    // EventTarget
+    virtual const AtomicString& interfaceName() const OVERRIDE;
+    virtual ScriptExecutionContext* scriptExecutionContext() const OVERRIDE;
+
+    // ActiveDOMObject
+    virtual void stop() OVERRIDE;
+
+    using RefCounted<RTCPeerConnection>::ref;
+    using RefCounted<RTCPeerConnection>::deref;
+
+private:
+    RTCPeerConnection(ScriptExecutionContext*, PassRefPtr<RTCConfiguration>, ExceptionCode&);
+
+    static PassRefPtr<RTCConfiguration> parseConfiguration(const Dictionary& configuration, ExceptionCode&);
+
+    // EventTarget implementation.
+    virtual EventTargetData* eventTargetData();
+    virtual EventTargetData* ensureEventTargetData();
+    virtual void refEventTarget() { ref(); }
+    virtual void derefEventTarget() { deref(); }
+    EventTargetData m_eventTargetData;
+
+    OwnPtr<RTCPeerConnectionHandler> m_peerHandler;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // RTCPeerConnection_h
diff --git a/Source/WebCore/Modules/mediastream/RTCPeerConnection.idl b/Source/WebCore/Modules/mediastream/RTCPeerConnection.idl
new file mode 100644
index 000000000..44ad7235b
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/RTCPeerConnection.idl
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module mediastream {
+
+    interface [
+        Conditional=MEDIA_STREAM,
+        ActiveDOMObject,
+        Constructor(in Dictionary rtcICEServers, in [Optional=DefaultIsUndefined] Dictionary mediaConstraints),
+        ConstructorRaisesException,
+        CallWith=ScriptExecutionContext,
+        EventTarget
+    ] RTCPeerConnection {
+        // EventTarget interface
+        void addEventListener(in DOMString type,
+                              in EventListener listener,
+                              in [Optional] boolean useCapture);
+        void removeEventListener(in DOMString type,
+                                 in EventListener listener,
+                                 in [Optional] boolean useCapture);
+        boolean dispatchEvent(in Event event)
+            raises(EventException);
+    };
+
+}
diff --git a/Source/WebCore/Modules/notifications/Notification.cpp b/Source/WebCore/Modules/notifications/Notification.cpp
index 348992aeb..9248e1bba 100644
--- a/Source/WebCore/Modules/notifications/Notification.cpp
+++ b/Source/WebCore/Modules/notifications/Notification.cpp
@@ -254,7 +254,7 @@ void Notification::taskTimerFired(Timer<Notification>* timer)
 
 
 #if ENABLE(NOTIFICATIONS)
-const String& Notification::permissionLevel(ScriptExecutionContext* context)
+const String& Notification::permission(ScriptExecutionContext* context)
 {
     ASSERT(context->isDocument());
     ASSERT(static_cast<Document*>(context)->page());
diff --git a/Source/WebCore/Modules/notifications/Notification.h b/Source/WebCore/Modules/notifications/Notification.h
index 8de910073..17a039518 100644
--- a/Source/WebCore/Modules/notifications/Notification.h
+++ b/Source/WebCore/Modules/notifications/Notification.h
@@ -138,7 +138,7 @@ public:
     void finalize();
 
 #if ENABLE(NOTIFICATIONS)
-    static const String& permissionLevel(ScriptExecutionContext*);
+    static const String& permission(ScriptExecutionContext*);
     static const String& permissionString(NotificationClient::Permission);
     static void requestPermission(ScriptExecutionContext*, PassRefPtr<NotificationPermissionCallback>);
 #endif
diff --git a/Source/WebCore/Modules/notifications/Notification.idl b/Source/WebCore/Modules/notifications/Notification.idl
index da2eb7f24..0f029f863 100644
--- a/Source/WebCore/Modules/notifications/Notification.idl
+++ b/Source/WebCore/Modules/notifications/Notification.idl
@@ -52,7 +52,7 @@ module threads {
 
 
 #if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
-        [CallWith=ScriptExecutionContext] static DOMString permissionLevel();
+        static readonly attribute [CallWith=ScriptExecutionContext] DOMString permission;
         [Custom] static void requestPermission(in NotificationPermissionCallback callback);
 #endif
 
diff --git a/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.cpp b/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.cpp
index 650376a96..71d06a04f 100644
--- a/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.cpp
+++ b/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "NavigatorRegisterProtocolHandler.h"
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 
 #include "Document.h"
 #include "ExceptionCode.h"
@@ -124,7 +124,6 @@ PassRefPtr<NavigatorRegisterProtocolHandler> NavigatorRegisterProtocolHandler::c
     return adoptRef(new NavigatorRegisterProtocolHandler(client));
 }
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 void NavigatorRegisterProtocolHandler::registerProtocolHandler(Navigator* navigator, const String& scheme, const String& url, const String& title, ExceptionCode& ec)
 {
     if (!navigator->frame())
@@ -144,7 +143,6 @@ void NavigatorRegisterProtocolHandler::registerProtocolHandler(Navigator* naviga
 
     NavigatorRegisterProtocolHandler::from(navigator->frame()->page())->client()->registerProtocolHandler(scheme, baseURL, url, navigator->frame()->displayStringModifiedByEncoding(title));
 }
-#endif
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
 static String customHandlersStateString(const RegisterProtocolHandlerClient::CustomHandlersState state)
@@ -216,5 +214,5 @@ void provideRegisterProtocolHandlerTo(Page* page, RegisterProtocolHandlerClient*
 
 } // namespace WebCore
 
-#endif // ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
 
diff --git a/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.h b/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.h
index 23b3d1b55..5e909e537 100644
--- a/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.h
+++ b/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.h
@@ -27,7 +27,7 @@
 #ifndef NavigatorRegisterProtocolHandler_h
 #define NavigatorRegisterProtocolHandler_h
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 
 #include "RefCountedSupplement.h"
 #include "RegisterProtocolHandlerClient.h"
@@ -48,9 +48,7 @@ public:
     static const AtomicString& supplementName();
     static NavigatorRegisterProtocolHandler* from(Page*);
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
     static void registerProtocolHandler(Navigator*, const String& scheme, const String& url, const String& title, ExceptionCode&);
-#endif 
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
     static String isProtocolHandlerRegistered(Navigator*, const String& scheme, const String& url, ExceptionCode&);
@@ -71,6 +69,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
 
 #endif // NavigatorRegisterProtocolHandler_h
diff --git a/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.idl b/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.idl
index 1bd57f2fe..274bb5992 100644
--- a/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.idl
+++ b/Source/WebCore/Modules/protocolhandler/NavigatorRegisterProtocolHandler.idl
@@ -25,9 +25,9 @@ module window {
     ] NavigatorRegisterProtocolHandler {
         [Conditional=REGISTER_PROTOCOL_HANDLER] void registerProtocolHandler(in DOMString scheme, in DOMString url, in DOMString title)
             raises(DOMException);
-        [Conditional=CUSTOM_SCHEME_HANDLER] DOMString isProtocolHandlerRegistered(in DOMString scheme, in DOMString url)
+        [Conditional=REGISTER_PROTOCOL_HANDLER&CUSTOM_SCHEME_HANDLER] DOMString isProtocolHandlerRegistered(in DOMString scheme, in DOMString url)
             raises(DOMException);
-        [Conditional=CUSTOM_SCHEME_HANDLER] void unregisterProtocolHandler(in DOMString scheme, in DOMString url)
+        [Conditional=REGISTER_PROTOCOL_HANDLER&CUSTOM_SCHEME_HANDLER] void unregisterProtocolHandler(in DOMString scheme, in DOMString url)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/Modules/protocolhandler/RegisterProtocolHandlerClient.h b/Source/WebCore/Modules/protocolhandler/RegisterProtocolHandlerClient.h
index ad641b307..1a832ace5 100644
--- a/Source/WebCore/Modules/protocolhandler/RegisterProtocolHandlerClient.h
+++ b/Source/WebCore/Modules/protocolhandler/RegisterProtocolHandlerClient.h
@@ -26,7 +26,7 @@
 #ifndef RegisterProtocolHandlerClient_h
 #define RegisterProtocolHandlerClient_h
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 
 #include <wtf/text/WTFString.h>
 
@@ -37,10 +37,7 @@ class Page;
 class RegisterProtocolHandlerClient {
 public:
     virtual ~RegisterProtocolHandlerClient() { }
-
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
     virtual void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title) = 0;
-#endif
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
     enum CustomHandlersState {
@@ -58,5 +55,5 @@ void provideRegisterProtocolHandlerTo(Page*, RegisterProtocolHandlerClient*);
 
 }
 
-#endif
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
 #endif // RegisterProtocolHandlerClient_h
diff --git a/Source/WebCore/Modules/proximity/DeviceProximityEvent.cpp b/Source/WebCore/Modules/proximity/DeviceProximityEvent.cpp
new file mode 100644
index 000000000..cd2c42675
--- /dev/null
+++ b/Source/WebCore/Modules/proximity/DeviceProximityEvent.cpp
@@ -0,0 +1,54 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "DeviceProximityEvent.h"
+
+#if ENABLE(PROXIMITY_EVENTS)
+
+#include <limits>
+
+namespace WebCore {
+
+DeviceProximityEvent::DeviceProximityEvent()
+    : m_value(std::numeric_limits<double>::infinity())
+    , m_min(-std::numeric_limits<double>::infinity())
+    , m_max(std::numeric_limits<double>::infinity())
+{
+}
+
+DeviceProximityEvent::DeviceProximityEvent(const AtomicString& eventType, const double value, const double min, const double max)
+    : Event(eventType, true, false) // Default event is bubbles, not cancelable.
+    , m_value(value)
+    , m_min(min)
+    , m_max(max)
+{
+}
+
+DeviceProximityEvent::DeviceProximityEvent(const AtomicString& eventType, const DeviceProximityEventInit& initializer)
+    : Event(eventType, initializer)
+    , m_value(initializer.value)
+    , m_min(initializer.min)
+    , m_max(initializer.max)
+{
+}
+
+} // namespace WebCore
+
+#endif // PROXIMITY_EVENTS
diff --git a/Source/WebCore/Modules/proximity/DeviceProximityEvent.h b/Source/WebCore/Modules/proximity/DeviceProximityEvent.h
new file mode 100644
index 000000000..d0dd55e98
--- /dev/null
+++ b/Source/WebCore/Modules/proximity/DeviceProximityEvent.h
@@ -0,0 +1,83 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef DeviceProximityEvent_h
+#define DeviceProximityEvent_h
+
+#if ENABLE(PROXIMITY_EVENTS)
+
+#include "Event.h"
+
+namespace WebCore {
+
+struct DeviceProximityEventInit : public EventInit {
+    DeviceProximityEventInit()
+        : value(std::numeric_limits<double>::infinity())
+        , min(-std::numeric_limits<double>::infinity())
+        , max(std::numeric_limits<double>::infinity())
+    {
+        // Default value of bubbles is true by the Proximity Events spec.
+        // http://www.w3.org/TR/proximity/#deviceproximityevent-interface
+        bubbles = true;
+    };
+
+    double value;
+    double min;
+    double max;
+};
+
+class DeviceProximityEvent : public Event {
+public:
+    ~DeviceProximityEvent() { }
+
+    static PassRefPtr<DeviceProximityEvent> create()
+    {
+        return adoptRef(new DeviceProximityEvent());
+    }
+
+    static PassRefPtr<DeviceProximityEvent> create(const AtomicString& eventType, const double value, const double min, const double max)
+    {
+        return adoptRef(new DeviceProximityEvent(eventType, value, min, max));
+    }
+
+    static PassRefPtr<DeviceProximityEvent> create(const AtomicString& type, const DeviceProximityEventInit& initializer)
+    {
+        return adoptRef(new DeviceProximityEvent(type, initializer));
+    }
+
+    double value() { return m_value; }
+    double min() { return m_min; }
+    double max() { return m_max; }
+
+    virtual const AtomicString& interfaceName() const { return eventNames().interfaceForDeviceProximityEvent; }
+
+private:
+    DeviceProximityEvent();
+    DeviceProximityEvent(const AtomicString& eventType, const double value, const double min, const double max);
+    DeviceProximityEvent(const AtomicString& eventType, const DeviceProximityEventInit&);
+
+    double m_value;
+    double m_min;
+    double m_max;
+};
+
+} // namespace WebCore
+
+#endif // DeviceProximityEvent_h
+#endif // PROXIMITY_EVENTS
diff --git a/Source/WebCore/Modules/proximity/DeviceProximityEvent.idl b/Source/WebCore/Modules/proximity/DeviceProximityEvent.idl
new file mode 100644
index 000000000..826090f77
--- /dev/null
+++ b/Source/WebCore/Modules/proximity/DeviceProximityEvent.idl
@@ -0,0 +1,31 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+module core {
+
+    interface [
+        Conditional=PROXIMITY_EVENTS,
+        ConstructorTemplate=Event
+    ] DeviceProximityEvent : Event {
+        readonly attribute [InitializedByEventConstructor] double value;
+        readonly attribute [InitializedByEventConstructor] double min;
+        readonly attribute [InitializedByEventConstructor] double max;
+    };
+
+}
diff --git a/Source/WebCore/Modules/speech/SpeechRecognition.cpp b/Source/WebCore/Modules/speech/SpeechRecognition.cpp
index d2b79b681..b87419c43 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognition.cpp
+++ b/Source/WebCore/Modules/speech/SpeechRecognition.cpp
@@ -30,6 +30,7 @@
 #include "SpeechRecognition.h"
 
 #include "Document.h"
+#include "ExceptionCode.h"
 #include "Page.h"
 #include "SpeechRecognitionController.h"
 #include "SpeechRecognitionError.h"
@@ -44,25 +45,29 @@ PassRefPtr<SpeechRecognition> SpeechRecognition::create(ScriptExecutionContext*
     return speechRecognition.release();
 }
 
-void SpeechRecognition::start()
+void SpeechRecognition::start(ExceptionCode& ec)
 {
     ASSERT(m_controller);
-    // FIXME: Spec should say what to do if we are already started.
+    if (m_started) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
 
     setPendingActivity(this);
     m_controller->start(this, m_grammars.get(), m_lang, m_continuous, m_maxAlternatives);
+    m_started = true;
 }
 
 void SpeechRecognition::stopFunction()
 {
     ASSERT(m_controller);
-    m_controller->stop(this); // FIXME: Spec should say what to do if we are not started.
+    m_controller->stop(this);
 }
 
 void SpeechRecognition::abort()
 {
     ASSERT(m_controller);
-    m_controller->abort(this); // FIXME: Spec should say what to do if we are not started.
+    m_controller->abort(this);
 }
 
 void SpeechRecognition::didStartAudio()
@@ -113,6 +118,7 @@ void SpeechRecognition::didDeleteResult(unsigned resultIndex, PassRefPtr<SpeechR
 void SpeechRecognition::didReceiveError(PassRefPtr<SpeechRecognitionError> error)
 {
     dispatchEvent(error);
+    m_started = false;
 }
 
 void SpeechRecognition::didStart()
@@ -122,6 +128,7 @@ void SpeechRecognition::didStart()
 
 void SpeechRecognition::didEnd()
 {
+    m_started = false;
     if (!m_stoppedByActiveDOMObject)
         dispatchEvent(Event::create(eventNames().endEvent, /*canBubble=*/false, /*cancelable=*/false));
     unsetPendingActivity(this);
@@ -151,6 +158,7 @@ SpeechRecognition::SpeechRecognition(ScriptExecutionContext* context)
     , m_maxAlternatives(1)
     , m_controller(0)
     , m_stoppedByActiveDOMObject(false)
+    , m_started(false)
 {
     ASSERT(scriptExecutionContext()->isDocument());
     Document* document = static_cast<Document*>(scriptExecutionContext());
diff --git a/Source/WebCore/Modules/speech/SpeechRecognition.h b/Source/WebCore/Modules/speech/SpeechRecognition.h
index fe4bd085f..3af67bf0f 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognition.h
+++ b/Source/WebCore/Modules/speech/SpeechRecognition.h
@@ -60,7 +60,7 @@ public:
     void setMaxAlternatives(unsigned long maxAlternatives) { m_maxAlternatives = maxAlternatives; }
 
     // Callable by the user.
-    void start();
+    void start(ExceptionCode&);
     void stopFunction();
     void abort();
 
@@ -122,6 +122,7 @@ private:
 
     SpeechRecognitionController* m_controller;
     bool m_stoppedByActiveDOMObject;
+    bool m_started;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/speech/SpeechRecognition.idl b/Source/WebCore/Modules/speech/SpeechRecognition.idl
index f6e2844d5..6e1b55eef 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognition.idl
+++ b/Source/WebCore/Modules/speech/SpeechRecognition.idl
@@ -36,7 +36,7 @@ module core {
         attribute boolean continuous;
         attribute unsigned long maxAlternatives;
 
-        void start();
+        void start() raises (DOMException);
         [ImplementedAs=stopFunction] void stop();
         void abort();
 
diff --git a/Source/WebCore/Modules/vibration/NavigatorVibration.cpp b/Source/WebCore/Modules/vibration/NavigatorVibration.cpp
index ae46bff9c..6aab85fd3 100644
--- a/Source/WebCore/Modules/vibration/NavigatorVibration.cpp
+++ b/Source/WebCore/Modules/vibration/NavigatorVibration.cpp
@@ -39,7 +39,7 @@ NavigatorVibration::~NavigatorVibration()
 {
 }
 
-void NavigatorVibration::webkitVibrate(Navigator* navigator, unsigned long time, ExceptionCode& ec)
+void NavigatorVibration::vibrate(Navigator* navigator, unsigned long time, ExceptionCode& ec)
 {
     if (!navigator->frame()->page())
         return;
@@ -57,7 +57,7 @@ void NavigatorVibration::webkitVibrate(Navigator* navigator, unsigned long time,
     Vibration::from(navigator->frame()->page())->vibrate(time);
 }
 
-void NavigatorVibration::webkitVibrate(Navigator* navigator, const VibrationPattern& pattern, ExceptionCode& ec)
+void NavigatorVibration::vibrate(Navigator* navigator, const VibrationPattern& pattern, ExceptionCode& ec)
 {
     if (!navigator->frame()->page())
         return;
diff --git a/Source/WebCore/Modules/vibration/NavigatorVibration.h b/Source/WebCore/Modules/vibration/NavigatorVibration.h
index 098f6ad5a..24a63fcdd 100644
--- a/Source/WebCore/Modules/vibration/NavigatorVibration.h
+++ b/Source/WebCore/Modules/vibration/NavigatorVibration.h
@@ -34,8 +34,8 @@ class NavigatorVibration {
 public:
     typedef Vector<unsigned long> VibrationPattern;
 
-    static void webkitVibrate(Navigator*, unsigned long time, ExceptionCode&);
-    static void webkitVibrate(Navigator*, const VibrationPattern&, ExceptionCode&);
+    static void vibrate(Navigator*, unsigned long time, ExceptionCode&);
+    static void vibrate(Navigator*, const VibrationPattern&, ExceptionCode&);
 
 private:
     NavigatorVibration();
diff --git a/Source/WebCore/Modules/vibration/NavigatorVibration.idl b/Source/WebCore/Modules/vibration/NavigatorVibration.idl
index 0e9974fd9..9f3183b25 100644
--- a/Source/WebCore/Modules/vibration/NavigatorVibration.idl
+++ b/Source/WebCore/Modules/vibration/NavigatorVibration.idl
@@ -23,8 +23,8 @@ module window {
         Conditional=VIBRATION,
         Supplemental=Navigator
     ] NavigatorVibration {
-        void webkitVibrate(in sequence<unsigned long> pattern) raises(DOMException);
-        void webkitVibrate(in unsigned long time) raises(DOMException);
+        void vibrate(in sequence<unsigned long> pattern) raises(DOMException);
+        void vibrate(in unsigned long time) raises(DOMException);
     };
 
 }
diff --git a/Source/WebCore/Modules/webaudio/AudioContext.cpp b/Source/WebCore/Modules/webaudio/AudioContext.cpp
index 9ace951a7..ab8e17228 100644
--- a/Source/WebCore/Modules/webaudio/AudioContext.cpp
+++ b/Source/WebCore/Modules/webaudio/AudioContext.cpp
@@ -59,6 +59,11 @@
 #include "WaveShaperNode.h"
 #include "WaveTable.h"
 
+#if ENABLE(MEDIA_STREAM)
+#include "MediaStream.h"
+#include "MediaStreamAudioSourceNode.h"
+#endif
+
 #if ENABLE(VIDEO)
 #include "HTMLMediaElement.h"
 #include "MediaElementAudioSourceNode.h"
@@ -384,6 +389,26 @@ PassRefPtr<MediaElementAudioSourceNode> AudioContext::createMediaElementSource(H
 }
 #endif
 
+#if ENABLE(MEDIA_STREAM)
+PassRefPtr<MediaStreamAudioSourceNode> AudioContext::createMediaStreamSource(MediaStream* mediaStream, ExceptionCode& ec)
+{
+    ASSERT(mediaStream);
+    if (!mediaStream) {
+        ec = INVALID_STATE_ERR;
+        return 0;
+    }
+
+    ASSERT(isMainThread());
+    lazyInitialize();
+
+    // FIXME: For now we don't give it an AudioSourceProvider, so it will output silence.
+    RefPtr<MediaStreamAudioSourceNode> node = MediaStreamAudioSourceNode::create(this, mediaStream, 0);
+
+    refNode(node.get()); // context keeps reference until node is disconnected
+    return node;
+}
+#endif
+
 PassRefPtr<JavaScriptAudioNode> AudioContext::createJavaScriptNode(size_t bufferSize, ExceptionCode& ec)
 {
     // Set number of input/output channels to stereo by default.
diff --git a/Source/WebCore/Modules/webaudio/AudioContext.h b/Source/WebCore/Modules/webaudio/AudioContext.h
index e6fa12dc5..fd40b84aa 100644
--- a/Source/WebCore/Modules/webaudio/AudioContext.h
+++ b/Source/WebCore/Modules/webaudio/AudioContext.h
@@ -49,6 +49,7 @@ class AudioBuffer;
 class AudioBufferCallback;
 class AudioBufferSourceNode;
 class MediaElementAudioSourceNode;
+class MediaStreamAudioSourceNode;
 class HTMLMediaElement;
 class AudioChannelMerger;
 class AudioChannelSplitter;
@@ -115,6 +116,9 @@ public:
 #if ENABLE(VIDEO)
     PassRefPtr<MediaElementAudioSourceNode> createMediaElementSource(HTMLMediaElement*, ExceptionCode&);
 #endif
+#if ENABLE(MEDIA_STREAM)
+    PassRefPtr<MediaStreamAudioSourceNode> createMediaStreamSource(MediaStream*, ExceptionCode&);
+#endif
     PassRefPtr<AudioGainNode> createGainNode();
     PassRefPtr<BiquadFilterNode> createBiquadFilter();
     PassRefPtr<WaveShaperNode> createWaveShaper();
diff --git a/Source/WebCore/Modules/webaudio/AudioContext.idl b/Source/WebCore/Modules/webaudio/AudioContext.idl
index 204b0c7d5..4856d59f1 100644
--- a/Source/WebCore/Modules/webaudio/AudioContext.idl
+++ b/Source/WebCore/Modules/webaudio/AudioContext.idl
@@ -58,10 +58,17 @@ module webaudio {
 
         // Sources
         AudioBufferSourceNode createBufferSource();
+
 #if defined(ENABLE_VIDEO) && ENABLE_VIDEO
         MediaElementAudioSourceNode createMediaElementSource(in HTMLMediaElement mediaElement)
             raises(DOMException);
 #endif
+
+#if defined(ENABLE_MEDIA_STREAM) && ENABLE_MEDIA_STREAM
+        MediaStreamAudioSourceNode createMediaStreamSource(in MediaStream mediaStream)
+            raises(DOMException);
+#endif
+
         // Processing nodes
         AudioGainNode createGainNode();
         DelayNode createDelayNode(in [Optional] double maxDelayTime);
diff --git a/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp b/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp
index 6f489b2a9..2d3eef60d 100644
--- a/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp
+++ b/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp
@@ -28,7 +28,6 @@
 
 #include "AudioDestinationNode.h"
 
-#include "AudioBus.h"
 #include "AudioContext.h"
 #include "AudioNodeInput.h"
 #include "AudioNodeOutput.h"
@@ -51,8 +50,7 @@ AudioDestinationNode::~AudioDestinationNode()
     uninitialize();
 }
 
-// The audio hardware calls us back here to gets its input stream.
-void AudioDestinationNode::provideInput(AudioBus* destinationBus, size_t numberOfFrames)
+void AudioDestinationNode::render(AudioBus* sourceBus, AudioBus* destinationBus, size_t numberOfFrames)
 {
     // We don't want denormals slowing down any of the audio processing
     // since they can very seriously hurt performance.
@@ -69,6 +67,10 @@ void AudioDestinationNode::provideInput(AudioBus* destinationBus, size_t numberO
     // Let the context take care of any business at the start of each render quantum.
     context()->handlePreRenderTasks();
 
+    // Prepare the local audio input provider for this render quantum.
+    if (sourceBus)
+        m_localAudioInputProvider.set(sourceBus);
+
     // This will cause the node(s) connected to us to process, which in turn will pull on their input(s),
     // all the way backwards through the rendering graph.
     AudioBus* renderedBus = input(0)->pull(destinationBus, numberOfFrames);
diff --git a/Source/WebCore/Modules/webaudio/AudioDestinationNode.h b/Source/WebCore/Modules/webaudio/AudioDestinationNode.h
index da7e25a91..2b929a4ef 100644
--- a/Source/WebCore/Modules/webaudio/AudioDestinationNode.h
+++ b/Source/WebCore/Modules/webaudio/AudioDestinationNode.h
@@ -26,6 +26,8 @@
 #define AudioDestinationNode_h
 
 #include "AudioBuffer.h"
+#include "AudioBus.h"
+#include "AudioIOCallback.h"
 #include "AudioNode.h"
 #include "AudioSourceProvider.h"
 
@@ -34,7 +36,7 @@ namespace WebCore {
 class AudioBus;
 class AudioContext;
     
-class AudioDestinationNode : public AudioNode, public AudioSourceProvider {
+class AudioDestinationNode : public AudioNode, public AudioIOCallback {
 public:
     AudioDestinationNode(AudioContext*, float sampleRate);
     virtual ~AudioDestinationNode();
@@ -43,8 +45,9 @@ public:
     virtual void process(size_t) { }; // we're pulled by hardware so this is never called
     virtual void reset() { m_currentSampleFrame = 0; };
     
-    // The audio hardware calls here periodically to gets its input stream.
-    virtual void provideInput(AudioBus*, size_t numberOfFrames);
+    // The audio hardware calls render() to get the next render quantum of audio into destinationBus.
+    // It will optionally give us local/live audio input in sourceBus (if it's not 0).
+    virtual void render(AudioBus* sourceBus, AudioBus* destinationBus, size_t numberOfFrames);
 
     size_t currentSampleFrame() const { return m_currentSampleFrame; }
     double currentTime() const { return currentSampleFrame() / static_cast<double>(sampleRate()); }
@@ -52,13 +55,45 @@ public:
     virtual unsigned numberOfChannels() const { return 2; } // FIXME: update when multi-channel (more than stereo) is supported
 
     virtual void startRendering() = 0;
+
+    AudioSourceProvider* localAudioInputProvider() { return &m_localAudioInputProvider; }
     
 protected:
+    // LocalAudioInputProvider allows us to expose an AudioSourceProvider for local/live audio input.
+    // If there is local/live audio input, we call set() with the audio input data every render quantum.
+    class LocalAudioInputProvider : public AudioSourceProvider {
+    public:
+        LocalAudioInputProvider()
+            : m_sourceBus(2, AudioNode::ProcessingSizeInFrames) // FIXME: handle non-stereo local input.
+        {
+        }
+
+        void set(AudioBus* bus)
+        {
+            if (bus)
+                m_sourceBus.copyFrom(*bus);
+        }
+
+        // AudioSourceProvider.
+        virtual void provideInput(AudioBus* destinationBus, size_t numberOfFrames)
+        {
+            bool isGood = destinationBus && destinationBus->length() == numberOfFrames && m_sourceBus.length() == numberOfFrames;
+            ASSERT(isGood);
+            if (isGood)
+                destinationBus->copyFrom(m_sourceBus);
+        }
+
+    private:
+        AudioBus m_sourceBus;
+    };
+
     virtual double tailTime() const OVERRIDE { return 0; }
     virtual double latencyTime() const OVERRIDE { return 0; }
 
     // Counts the number of sample-frames processed by the destination.
     size_t m_currentSampleFrame;
+
+    LocalAudioInputProvider m_localAudioInputProvider;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/webaudio/AudioNode.h b/Source/WebCore/Modules/webaudio/AudioNode.h
index bee78f7e8..4ef3e6560 100644
--- a/Source/WebCore/Modules/webaudio/AudioNode.h
+++ b/Source/WebCore/Modules/webaudio/AudioNode.h
@@ -63,6 +63,7 @@ public:
         NodeTypeOscillator,
         NodeTypeAudioBufferSource,
         NodeTypeMediaElementAudioSource,
+        NodeTypeMediaStreamAudioSource,
         NodeTypeJavaScript,
         NodeTypeBiquadFilter,
         NodeTypePanner,
diff --git a/Source/WebCore/Modules/webaudio/AudioPannerNode.cpp b/Source/WebCore/Modules/webaudio/AudioPannerNode.cpp
index 4d0ad189c..d851a2513 100644
--- a/Source/WebCore/Modules/webaudio/AudioPannerNode.cpp
+++ b/Source/WebCore/Modules/webaudio/AudioPannerNode.cpp
@@ -171,6 +171,20 @@ void AudioPannerNode::setPanningModel(unsigned short model, ExceptionCode& ec)
     }
 }
 
+void AudioPannerNode::setDistanceModel(unsigned short model, ExceptionCode& ec)
+{
+    switch (model) {
+    case DistanceEffect::ModelLinear:
+    case DistanceEffect::ModelInverse:
+    case DistanceEffect::ModelExponential:
+        m_distanceEffect.setModel(static_cast<DistanceEffect::ModelType>(model), true);
+        break;
+    default:
+        ec = NOT_SUPPORTED_ERR;
+        break;
+    }
+}
+
 void AudioPannerNode::getAzimuthElevation(double* outAzimuth, double* outElevation)
 {
     // FIXME: we should cache azimuth and elevation (if possible), so we only re-calculate if a change has been made.
diff --git a/Source/WebCore/Modules/webaudio/AudioPannerNode.h b/Source/WebCore/Modules/webaudio/AudioPannerNode.h
index 961ef3c2c..0bb861361 100644
--- a/Source/WebCore/Modules/webaudio/AudioPannerNode.h
+++ b/Source/WebCore/Modules/webaudio/AudioPannerNode.h
@@ -96,8 +96,8 @@ public:
 
     // Distance parameters
     unsigned short distanceModel() { return m_distanceEffect.model(); }
-    void setDistanceModel(unsigned short model) { m_distanceEffect.setModel(static_cast<DistanceEffect::ModelType>(model), true); }
-    
+    void setDistanceModel(unsigned short, ExceptionCode&);
+
     float refDistance() { return static_cast<float>(m_distanceEffect.refDistance()); }
     void setRefDistance(float refDistance) { m_distanceEffect.setRefDistance(refDistance); }
 
diff --git a/Source/WebCore/Modules/webaudio/AudioPannerNode.idl b/Source/WebCore/Modules/webaudio/AudioPannerNode.idl
index 5061e7825..1a8688f64 100644
--- a/Source/WebCore/Modules/webaudio/AudioPannerNode.idl
+++ b/Source/WebCore/Modules/webaudio/AudioPannerNode.idl
@@ -38,8 +38,7 @@ module audio {
         const unsigned short EXPONENTIAL_DISTANCE = 2;
 
         // Default model for stereo is HRTF 
-        // FIXME: use unsigned short when glue generation supports it
-        attribute unsigned long panningModel
+        attribute unsigned short panningModel
             setter raises(DOMException);
 
         // Uses a 3D cartesian coordinate system 
@@ -48,7 +47,9 @@ module audio {
         void setVelocity(in float x, in float y, in float z);
 
         // Distance model
-        attribute unsigned long distanceModel; // FIXME: use unsigned short when glue generation supports it
+        attribute unsigned short distanceModel
+            setter raises(DOMException);
+
         attribute float refDistance;
         attribute float maxDistance;
         attribute float rolloffFactor;
diff --git a/Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.cpp b/Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.cpp
new file mode 100644
index 000000000..6a80f04e7
--- /dev/null
+++ b/Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.cpp
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO) && ENABLE(MEDIA_STREAM)
+
+#include "MediaStreamAudioSourceNode.h"
+
+#include "AudioContext.h"
+#include "AudioNodeOutput.h"
+#include "Logging.h"
+#include <wtf/Locker.h>
+
+namespace WebCore {
+
+PassRefPtr<MediaStreamAudioSourceNode> MediaStreamAudioSourceNode::create(AudioContext* context, MediaStream* mediaStream, AudioSourceProvider* audioSourceProvider)
+{
+    return adoptRef(new MediaStreamAudioSourceNode(context, mediaStream, audioSourceProvider));
+}
+
+MediaStreamAudioSourceNode::MediaStreamAudioSourceNode(AudioContext* context, MediaStream* mediaStream, AudioSourceProvider* audioSourceProvider)
+    : AudioSourceNode(context, context->sampleRate())
+    , m_mediaStream(mediaStream)
+    , m_audioSourceProvider(audioSourceProvider)
+    , m_sourceNumberOfChannels(0)
+{
+    // Default to stereo. This could change depending on the format of the MediaStream's audio track.
+    addOutput(adoptPtr(new AudioNodeOutput(this, 2)));
+
+    setNodeType(NodeTypeMediaStreamAudioSource);
+
+    initialize();
+}
+
+MediaStreamAudioSourceNode::~MediaStreamAudioSourceNode()
+{
+    uninitialize();
+}
+
+void MediaStreamAudioSourceNode::setFormat(size_t numberOfChannels, float sourceSampleRate)
+{
+    if (numberOfChannels != m_sourceNumberOfChannels || sourceSampleRate != sampleRate()) {
+        // The sample-rate must be equal to the context's sample-rate.
+        if (!numberOfChannels || numberOfChannels > AudioContext::maxNumberOfChannels() || sourceSampleRate != sampleRate()) {
+            // process() will generate silence for these uninitialized values.
+            LOG(Media, "MediaStreamAudioSourceNode::setFormat(%u, %f) - unhandled format change", static_cast<unsigned>(numberOfChannels), sourceSampleRate);
+            m_sourceNumberOfChannels = 0;
+            return;
+        }
+
+        // Synchronize with process().
+        MutexLocker locker(m_processLock);
+
+        m_sourceNumberOfChannels = numberOfChannels;
+
+        {
+            // The context must be locked when changing the number of output channels.
+            AudioContext::AutoLocker contextLocker(context());
+
+            // Do any necesssary re-configuration to the output's number of channels.
+            output(0)->setNumberOfChannels(numberOfChannels);
+        }
+    }
+}
+
+void MediaStreamAudioSourceNode::process(size_t numberOfFrames)
+{
+    AudioBus* outputBus = output(0)->bus();
+
+    if (!audioSourceProvider()) {
+        outputBus->zero();
+        return;
+    }
+
+    if (!mediaStream() || m_sourceNumberOfChannels != outputBus->numberOfChannels()) {
+        outputBus->zero();
+        return;
+    }
+
+    // Use a tryLock() to avoid contention in the real-time audio thread.
+    // If we fail to acquire the lock then the MediaStream must be in the middle of
+    // a format change, so we output silence in this case.
+    MutexTryLocker tryLocker(m_processLock);
+    if (tryLocker.locked())
+        audioSourceProvider()->provideInput(outputBus, numberOfFrames);
+    else {
+        // We failed to acquire the lock.
+        outputBus->zero();
+    }
+}
+
+void MediaStreamAudioSourceNode::reset()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO) && ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.h b/Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.h
new file mode 100644
index 000000000..8bdf28787
--- /dev/null
+++ b/Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MediaStreamAudioSourceNode_h
+#define MediaStreamAudioSourceNode_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "AudioSourceNode.h"
+#include "AudioSourceProvider.h"
+#include "AudioSourceProviderClient.h"
+#include "MediaStream.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+class AudioContext;
+
+class MediaStreamAudioSourceNode : public AudioSourceNode, public AudioSourceProviderClient {
+public:
+    static PassRefPtr<MediaStreamAudioSourceNode> create(AudioContext*, MediaStream*, AudioSourceProvider*);
+
+    virtual ~MediaStreamAudioSourceNode();
+
+    MediaStream* mediaStream() { return m_mediaStream.get(); }
+
+    // AudioNode
+    virtual void process(size_t framesToProcess);
+    virtual void reset();
+
+    // AudioSourceProviderClient
+    virtual void setFormat(size_t numberOfChannels, float sampleRate);
+
+    AudioSourceProvider* audioSourceProvider() const { return m_audioSourceProvider; }
+
+private:
+    MediaStreamAudioSourceNode(AudioContext*, MediaStream*, AudioSourceProvider*);
+
+    // As an audio source, we will never propagate silence.
+    virtual bool propagatesSilence() const OVERRIDE { return false; }
+
+    RefPtr<MediaStream> m_mediaStream;
+    AudioSourceProvider* m_audioSourceProvider;
+
+    Mutex m_processLock;
+
+    unsigned m_sourceNumberOfChannels;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // MediaStreamAudioSourceNode_h
diff --git a/Source/WebCore/bindings/js/JSWaveShaperNodeCustom.cpp b/Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.idl
index e03a6565a..14b91a2c6 100644
--- a/Source/WebCore/bindings/js/JSWaveShaperNodeCustom.cpp
+++ b/Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011, Google Inc. All rights reserved.
+ * Copyright (C) 2012, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -22,26 +22,11 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-
-#if ENABLE(WEB_AUDIO)
-
-#include "WaveShaperNode.h"
-
-#include "JSFloat32Array.h"
-#include "JSWaveShaperNode.h"
-#include <wtf/Float32Array.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSWaveShaperNode::setCurve(ExecState*, JSValue value)
-{
-    WaveShaperNode* imp = static_cast<WaveShaperNode*>(impl());
-    imp->setCurve(toFloat32Array(value));
+module audio {
+    interface [
+        Conditional=MEDIA_STREAM,
+        JSGenerateToJSObject
+    ] MediaStreamAudioSourceNode : AudioSourceNode {
+        readonly attribute MediaStream mediaStream;
+    };
 }
-
-} // namespace WebCore
-
-#endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.cpp b/Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.cpp
index a40e6057b..083d9bbe9 100644
--- a/Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.cpp
+++ b/Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.cpp
@@ -85,19 +85,19 @@ void OfflineAudioDestinationNode::startRendering()
     if (!m_startedRendering) {
         m_startedRendering = true;
         ref(); // See corresponding deref() call in notifyCompleteDispatch().
-        m_renderThread = createThread(OfflineAudioDestinationNode::renderEntry, this, "offline renderer");
+        m_renderThread = createThread(OfflineAudioDestinationNode::offlineRenderEntry, this, "offline renderer");
     }
 }
 
 // Do offline rendering in this thread.
-void OfflineAudioDestinationNode::renderEntry(void* threadData)
+void OfflineAudioDestinationNode::offlineRenderEntry(void* threadData)
 {
     OfflineAudioDestinationNode* destinationNode = reinterpret_cast<OfflineAudioDestinationNode*>(threadData);
     ASSERT(destinationNode);
-    destinationNode->render();
+    destinationNode->offlineRender();
 }
 
-void OfflineAudioDestinationNode::render()
+void OfflineAudioDestinationNode::offlineRender()
 {
     ASSERT(!isMainThread());
     ASSERT(m_renderBus.get());
@@ -131,7 +131,7 @@ void OfflineAudioDestinationNode::render()
     unsigned n = 0;
     while (framesToProcess > 0) {
         // Render one render quantum.
-        provideInput(m_renderBus.get(), renderQuantumSize);
+        render(0, m_renderBus.get(), renderQuantumSize);
         
         size_t framesAvailableToCopy = min(framesToProcess, renderQuantumSize);
         
diff --git a/Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.h b/Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.h
index c2da6fffc..67ed24130 100644
--- a/Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.h
+++ b/Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.h
@@ -64,8 +64,8 @@ private:
     // Rendering thread.
     volatile ThreadIdentifier m_renderThread;
     bool m_startedRendering;
-    static void renderEntry(void* threadData);
-    void render();
+    static void offlineRenderEntry(void* threadData);
+    void offlineRender();
     
     // For completion callback on main thread.
     static void notifyCompleteDispatch(void* userData);
diff --git a/Source/WebCore/Modules/webaudio/Oscillator.cpp b/Source/WebCore/Modules/webaudio/Oscillator.cpp
index 18588a607..ecbd4db9b 100644
--- a/Source/WebCore/Modules/webaudio/Oscillator.cpp
+++ b/Source/WebCore/Modules/webaudio/Oscillator.cpp
@@ -42,6 +42,11 @@ namespace WebCore {
 
 using namespace VectorMath;
 
+WaveTable* Oscillator::s_waveTableSine = 0;
+WaveTable* Oscillator::s_waveTableSquare = 0;
+WaveTable* Oscillator::s_waveTableSawtooth = 0;
+WaveTable* Oscillator::s_waveTableTriangle = 0;
+
 PassRefPtr<Oscillator> Oscillator::create(AudioContext* context, float sampleRate)
 {
     return adoptRef(new Oscillator(context, sampleRate));
@@ -78,30 +83,40 @@ Oscillator::~Oscillator()
 
 void Oscillator::setType(unsigned short type)
 {
-    RefPtr<WaveTable> waveTable;
+    WaveTable* waveTable = 0;
     float sampleRate = this->sampleRate();
 
     switch (type) {
     case SINE:
-        waveTable = WaveTable::createSine(sampleRate);
+        if (!s_waveTableSine)
+            s_waveTableSine = WaveTable::createSine(sampleRate).leakRef();
+        waveTable = s_waveTableSine;
         break;
     case SQUARE:
-        waveTable = WaveTable::createSquare(sampleRate);
+        if (!s_waveTableSquare)
+            s_waveTableSquare = WaveTable::createSquare(sampleRate).leakRef();
+        waveTable = s_waveTableSquare;
         break;
     case SAWTOOTH:
-        waveTable = WaveTable::createSawtooth(sampleRate);
+        if (!s_waveTableSawtooth)
+            s_waveTableSawtooth = WaveTable::createSawtooth(sampleRate).leakRef();
+        waveTable = s_waveTableSawtooth;
         break;
     case TRIANGLE:
-        waveTable = WaveTable::createTriangle(sampleRate);
+        if (!s_waveTableTriangle)
+            s_waveTableTriangle = WaveTable::createTriangle(sampleRate).leakRef();
+        waveTable = s_waveTableTriangle;
         break;
     case CUSTOM:
-        // FIXME: throw exception since setWaveTable() method must be called explicitly.
+    default:
+        // FIXME: throw exception for invalid types or if the type is CUSTOM since setWaveTable()
+        // method must be called explicitly in that case.
         return;
         break;
     }
 
+    setWaveTable(waveTable);
     m_type = type;
-    setWaveTable(waveTable.get());
 }
 
 bool Oscillator::calculateSampleAccuratePhaseIncrements(size_t framesToProcess)
diff --git a/Source/WebCore/Modules/webaudio/Oscillator.h b/Source/WebCore/Modules/webaudio/Oscillator.h
index 2158a827a..127b31b2d 100644
--- a/Source/WebCore/Modules/webaudio/Oscillator.h
+++ b/Source/WebCore/Modules/webaudio/Oscillator.h
@@ -99,6 +99,12 @@ private:
     AudioFloatArray m_detuneValues;
     
     RefPtr<WaveTable> m_waveTable;
+
+    // Cache the wave tables for different waveform types, except CUSTOM.
+    static WaveTable* s_waveTableSine;
+    static WaveTable* s_waveTableSquare;
+    static WaveTable* s_waveTableSawtooth;
+    static WaveTable* s_waveTableTriangle;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/webaudio/WaveShaperNode.idl b/Source/WebCore/Modules/webaudio/WaveShaperNode.idl
index 16a4acf7c..60b96e902 100644
--- a/Source/WebCore/Modules/webaudio/WaveShaperNode.idl
+++ b/Source/WebCore/Modules/webaudio/WaveShaperNode.idl
@@ -27,6 +27,6 @@ module audio {
         Conditional=WEB_AUDIO,
         JSGenerateToJSObject
     ] WaveShaperNode : AudioNode {
-        attribute [JSCustomSetter] Float32Array curve;
+        attribute Float32Array curve;
     };
 }
diff --git a/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h
index 72bdc878f..18d99a9f0 100644
--- a/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h
@@ -60,7 +60,7 @@ public:
     virtual String subprotocol() = 0; // Will be available after didConnect() callback is invoked.
     virtual String extensions() = 0; // Will be available after didConnect() callback is invoked.
     virtual SendResult send(const String& message) = 0;
-    virtual SendResult send(const ArrayBuffer&) = 0;
+    virtual SendResult send(const ArrayBuffer&, unsigned byteOffset, unsigned byteLength) = 0;
     virtual SendResult send(const Blob&) = 0;
     virtual unsigned long bufferedAmount() const = 0;
     virtual void close(int code, const String& reason) = 0;
diff --git a/Source/WebCore/Modules/websockets/WebSocket.cpp b/Source/WebCore/Modules/websockets/WebSocket.cpp
index c62b655a1..29068b633 100644
--- a/Source/WebCore/Modules/websockets/WebSocket.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocket.cpp
@@ -51,6 +51,8 @@
 #include "SecurityOrigin.h"
 #include "ThreadableWebSocketChannel.h"
 #include "WebSocketChannel.h"
+#include <wtf/ArrayBuffer.h>
+#include <wtf/ArrayBufferView.h>
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -289,7 +291,26 @@ bool WebSocket::send(ArrayBuffer* binaryData, ExceptionCode& ec)
         return false;
     }
     ASSERT(m_channel);
-    return m_channel->send(*binaryData) == ThreadableWebSocketChannel::SendSuccess;
+    return m_channel->send(*binaryData, 0, binaryData->byteLength()) == ThreadableWebSocketChannel::SendSuccess;
+}
+
+bool WebSocket::send(ArrayBufferView* arrayBufferView, ExceptionCode& ec)
+{
+    LOG(Network, "WebSocket %p send arraybufferview %p", this, arrayBufferView);
+    ASSERT(arrayBufferView);
+    if (m_state == CONNECTING) {
+        ec = INVALID_STATE_ERR;
+        return false;
+    }
+    if (m_state == CLOSING || m_state == CLOSED) {
+        unsigned payloadSize = arrayBufferView->byteLength();
+        m_bufferedAmountAfterClose = saturateAdd(m_bufferedAmountAfterClose, payloadSize);
+        m_bufferedAmountAfterClose = saturateAdd(m_bufferedAmountAfterClose, getFramingOverhead(payloadSize));
+        return false;
+    }
+    ASSERT(m_channel);
+    RefPtr<ArrayBuffer> arrayBuffer(arrayBufferView->buffer());
+    return m_channel->send(*arrayBuffer, arrayBufferView->byteOffset(), arrayBufferView->byteLength()) == ThreadableWebSocketChannel::SendSuccess;
 }
 
 bool WebSocket::send(Blob* binaryData, ExceptionCode& ec)
diff --git a/Source/WebCore/Modules/websockets/WebSocket.h b/Source/WebCore/Modules/websockets/WebSocket.h
index 54d027e38..5698e6f5d 100644
--- a/Source/WebCore/Modules/websockets/WebSocket.h
+++ b/Source/WebCore/Modules/websockets/WebSocket.h
@@ -38,6 +38,7 @@
 #include "EventNames.h"
 #include "EventTarget.h"
 #include "KURL.h"
+#include "WebSocketChannel.h"
 #include "WebSocketChannelClient.h"
 #include <wtf/Forward.h>
 #include <wtf/OwnPtr.h>
@@ -70,9 +71,12 @@ public:
 
     bool send(const String& message, ExceptionCode&);
     bool send(ArrayBuffer*, ExceptionCode&);
+    bool send(ArrayBufferView*, ExceptionCode&);
     bool send(Blob*, ExceptionCode&);
 
     void close(int code, const String& reason, ExceptionCode&);
+    void close(ExceptionCode& ec) { close(WebSocketChannel::CloseEventCodeNotSpecified, String(), ec); }
+    void close(int code, ExceptionCode& ec) { close(code, String(), ec); }
 
     const KURL& url() const;
     State readyState() const;
diff --git a/Source/WebCore/Modules/websockets/WebSocket.idl b/Source/WebCore/Modules/websockets/WebSocket.idl
index 92835ae43..e6126fc71 100644
--- a/Source/WebCore/Modules/websockets/WebSocket.idl
+++ b/Source/WebCore/Modules/websockets/WebSocket.idl
@@ -69,12 +69,12 @@ module websockets {
         // booleans, null, undefined and objects except ArrayBuffer and Blob). Current code
         // generator does not handle this rule correctly.
         // boolean send(in ArrayBuffer data) raises(DOMException);
+        // boolean send(in ArrayBufferView data) raises(DOMException);
         // boolean send(in Blob data) raises(DOMException);
         // boolean send(in DOMString data) raises(DOMException);
         [Custom] boolean send(in DOMString data) raises(DOMException);
 
-        // FIXME: Implement and apply [Clamp] attribute instead of [Custom].
-        [Custom] void close(in [Optional] unsigned short code, in [Optional] DOMString reason) raises(DOMException);
+        void close(in [Clamp, Optional] unsigned short code, in [Optional] DOMString reason) raises(DOMException);
 
         // EventTarget interface
         void addEventListener(in DOMString type,
diff --git a/Source/WebCore/Modules/websockets/WebSocketChannel.cpp b/Source/WebCore/Modules/websockets/WebSocketChannel.cpp
index faeafd2d5..8953650a3 100644
--- a/Source/WebCore/Modules/websockets/WebSocketChannel.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketChannel.cpp
@@ -153,10 +153,10 @@ ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const String& mess
     return ThreadableWebSocketChannel::SendSuccess;
 }
 
-ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const ArrayBuffer& binaryData)
+ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const ArrayBuffer& binaryData, unsigned byteOffset, unsigned byteLength)
 {
-    LOG(Network, "WebSocketChannel %p send arraybuffer %p", this, &binaryData);
-    enqueueRawFrame(WebSocketFrame::OpCodeBinary, static_cast<const char*>(binaryData.data()), binaryData.byteLength());
+    LOG(Network, "WebSocketChannel %p send arraybuffer %p %u %u", this, &binaryData, byteOffset, byteLength);
+    enqueueRawFrame(WebSocketFrame::OpCodeBinary, static_cast<const char*>(binaryData.data()) + byteOffset, byteLength);
     return ThreadableWebSocketChannel::SendSuccess;
 }
 
diff --git a/Source/WebCore/Modules/websockets/WebSocketChannel.h b/Source/WebCore/Modules/websockets/WebSocketChannel.h
index 09095c15a..3dde648ec 100644
--- a/Source/WebCore/Modules/websockets/WebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/WebSocketChannel.h
@@ -72,7 +72,7 @@ public:
     virtual String subprotocol() OVERRIDE;
     virtual String extensions() OVERRIDE;
     virtual ThreadableWebSocketChannel::SendResult send(const String& message) OVERRIDE;
-    virtual ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&, unsigned byteOffset, unsigned byteLength) OVERRIDE;
     virtual ThreadableWebSocketChannel::SendResult send(const Blob&) OVERRIDE;
     virtual unsigned long bufferedAmount() const OVERRIDE;
     virtual void close(int code, const String& reason) OVERRIDE; // Start closing handshake.
diff --git a/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
index 250c01961..813e6e89e 100644
--- a/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
+++ b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
@@ -91,11 +91,11 @@ ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::send(co
     return m_bridge->send(message);
 }
 
-ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::send(const ArrayBuffer& binaryData)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::send(const ArrayBuffer& binaryData, unsigned byteOffset, unsigned byteLength)
 {
     if (!m_bridge)
         return ThreadableWebSocketChannel::SendFail;
-    return m_bridge->send(binaryData);
+    return m_bridge->send(binaryData, byteOffset, byteLength);
 }
 
 ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::send(const Blob& binaryData)
@@ -188,7 +188,7 @@ void WorkerThreadableWebSocketChannel::Peer::send(const ArrayBuffer& binaryData)
     ASSERT(isMainThread());
     if (!m_mainWebSocketChannel || !m_workerClientWrapper)
         return;
-    ThreadableWebSocketChannel::SendResult sendRequestResult = m_mainWebSocketChannel->send(binaryData);
+    ThreadableWebSocketChannel::SendResult sendRequestResult = m_mainWebSocketChannel->send(binaryData, 0, binaryData.byteLength());
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSend, m_workerClientWrapper, sendRequestResult), m_taskMode);
 }
 
@@ -488,14 +488,14 @@ ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::Bridge:
     return clientWrapper->sendRequestResult();
 }
 
-ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::Bridge::send(const ArrayBuffer& binaryData)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::Bridge::send(const ArrayBuffer& binaryData, unsigned byteOffset, unsigned byteLength)
 {
     if (!m_workerClientWrapper || !m_peer)
         return ThreadableWebSocketChannel::SendFail;
     // ArrayBuffer isn't thread-safe, hence the content of ArrayBuffer is copied into Vector<char>.
-    OwnPtr<Vector<char> > data = adoptPtr(new Vector<char>(binaryData.byteLength()));
+    OwnPtr<Vector<char> > data = adoptPtr(new Vector<char>(byteLength));
     if (binaryData.byteLength())
-        memcpy(data->data(), binaryData.data(), binaryData.byteLength());
+        memcpy(data->data(), static_cast<const char*>(binaryData.data()) + byteOffset, byteLength);
     setMethodNotCompleted();
     m_loaderProxy.postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadSendArrayBuffer, AllowCrossThreadAccess(m_peer), data.release()));
     RefPtr<Bridge> protect(this);
diff --git a/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h
index 472b98209..2da5da394 100644
--- a/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h
@@ -66,7 +66,7 @@ public:
     virtual String subprotocol() OVERRIDE;
     virtual String extensions() OVERRIDE;
     virtual ThreadableWebSocketChannel::SendResult send(const String& message) OVERRIDE;
-    virtual ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&, unsigned byteOffset, unsigned byteLength) OVERRIDE;
     virtual ThreadableWebSocketChannel::SendResult send(const Blob&) OVERRIDE;
     virtual unsigned long bufferedAmount() const OVERRIDE;
     virtual void close(int code, const String& reason) OVERRIDE;
@@ -134,7 +134,7 @@ private:
         void initialize();
         void connect(const KURL&, const String& protocol);
         ThreadableWebSocketChannel::SendResult send(const String& message);
-        ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&);
+        ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&, unsigned byteOffset, unsigned byteLength);
         ThreadableWebSocketChannel::SendResult send(const Blob&);
         unsigned long bufferedAmount();
         void close(int code, const String& reason);
diff --git a/Source/WebCore/PlatformBlackBerry.cmake b/Source/WebCore/PlatformBlackBerry.cmake
index 1ae5fe690..8f6a77528 100644
--- a/Source/WebCore/PlatformBlackBerry.cmake
+++ b/Source/WebCore/PlatformBlackBerry.cmake
@@ -129,7 +129,6 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
 
 # BlackBerry sources
 LIST(APPEND WebCore_SOURCES
-    bindings/js/ScriptControllerBlackBerry.cpp
     editing/blackberry/EditorBlackBerry.cpp
     editing/blackberry/SmartReplaceBlackBerry.cpp
     page/blackberry/AccessibilityObjectBlackBerry.cpp
@@ -272,6 +271,7 @@ IF (WTF_USE_ACCELERATED_COMPOSITING)
         ${WEBCORE_DIR}/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerAnimation.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerCompositingThread.cpp
+        ${WEBCORE_DIR}/platform/graphics/blackberry/LayerFilterRenderer.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerRenderer.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerRendererSurface.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerTile.cpp
diff --git a/Source/WebCore/PlatformEfl.cmake b/Source/WebCore/PlatformEfl.cmake
index e8c32d830..f437c2110 100644
--- a/Source/WebCore/PlatformEfl.cmake
+++ b/Source/WebCore/PlatformEfl.cmake
@@ -14,12 +14,10 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
   "${WEBCORE_DIR}/platform/text/efl"
   "${WEBCORE_DIR}/plugins/efl"
   "${WEBKIT_DIR}/efl/WebCoreSupport"
-  "${WEBKIT_DIR}/efl/ewk"
 )
 
 LIST(APPEND WebCore_SOURCES
   accessibility/efl/AccessibilityObjectEfl.cpp
-  bindings/js/ScriptControllerEfl.cpp
   page/efl/DragControllerEfl.cpp
   page/efl/EventHandlerEfl.cpp
   platform/Cursor.cpp
@@ -47,8 +45,6 @@ LIST(APPEND WebCore_SOURCES
   platform/efl/PlatformKeyboardEventEfl.cpp
   platform/efl/PlatformMouseEventEfl.cpp
   platform/efl/PlatformScreenEfl.cpp
-  platform/efl/PlatformTouchEventEfl.cpp
-  platform/efl/PlatformTouchPointEfl.cpp
   platform/efl/PlatformWheelEventEfl.cpp
   platform/efl/PopupMenuEfl.cpp
   platform/efl/RefPtrEfl.cpp
diff --git a/Source/WebCore/PlatformWinCE.cmake b/Source/WebCore/PlatformWinCE.cmake
index 102e6699a..ca23c5e7f 100644
--- a/Source/WebCore/PlatformWinCE.cmake
+++ b/Source/WebCore/PlatformWinCE.cmake
@@ -16,8 +16,6 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
 )
 
 LIST(APPEND WebCore_SOURCES
-    bindings/js/ScriptControllerWin.cpp
-
     page/win/DragControllerWin.cpp
     page/win/EventHandlerWin.cpp
     page/wince/FrameWinCE.cpp
diff --git a/Source/WebCore/Resources/calendarPicker.css b/Source/WebCore/Resources/calendarPicker.css
index e4a624aed..721c11e9b 100644
--- a/Source/WebCore/Resources/calendarPicker.css
+++ b/Source/WebCore/Resources/calendarPicker.css
@@ -82,9 +82,48 @@ body {
 }
 
 .month-selector-popup {
+    -webkit-box-sizing: content-box;
+    -webkit-box-shadow:
+        0 0 0 1px rgba(0,0,0,0.1),
+        0 5px 1px 1px rgba(0,0,0,0.1),
+        0 5px 2px 1px rgba(0,0,0,0.1),
+        0 5px 12px 1px rgba(0,0,0,0.5);
+    background: #fff;
     display: none;
-    outline: none;
-    z-index: 2;
+    max-height: 10.8em;
+    overflow-x: hidden;
+    overflow-y: auto;
+    position: absolute;
+    white-space: nowrap;
+}
+
+.month-selector-popup-contents {
+    display: table;
+}
+
+.month-selector-popup-entry {
+    -webkit-padding-start: 5px;
+    -webkit-padding-end: 5px;
+    cursor: pointer;
+    display; table-row;
+    line-height: 1.2em;
+}
+
+.selected-month-year {
+    background-color: highlight;
+    color: highlighttext;
+    text-shadow: none;
+}
+
+@media (pointer:coarse) {
+
+    .month-selector-popup {
+        max-height: 150px;
+    }
+
+    .month-selector-popup-entry {
+        line-height: 30px;
+    }
 }
 
 .month-selector-wall {
diff --git a/Source/WebCore/Resources/calendarPicker.js b/Source/WebCore/Resources/calendarPicker.js
index f2a851f03..a39834c82 100644
--- a/Source/WebCore/Resources/calendarPicker.js
+++ b/Source/WebCore/Resources/calendarPicker.js
@@ -49,10 +49,14 @@ var ClassNames = {
     MonthSelector: "month-selector",
     MonthSelectorBox: "month-selector-box",
     MonthSelectorPopup: "month-selector-popup",
+    MonthSelectorPopupContents: "month-selector-popup-contents",
+    MonthSelectorPopupEntry: "month-selector-popup-entry",
+    MonthSelectorPopupSizer: "month-selector-popup-sizer",
     MonthSelectorWall: "month-selector-wall",
     NoFocusRing: "no-focus-ring",
     NotThisMonth: "not-this-month",
     Selected: "day-selected",
+    SelectedMonthYear: "selected-month-year",
     TodayButton: "today-button",
     TodayClearArea: "today-clear-area",
     Unavailable: "unavailable",
@@ -220,6 +224,25 @@ function serializeDate(year, month, day) {
     return yearString + "-" + ("0" + (month + 1)).substr(-2, 2) + "-" + ("0" + day).substr(-2, 2);
 }
 
+/**
+ * @param {!number} width
+ * @param {!number} height
+ */
+function resizeWindow(width, height) {
+    if (window.frameElement) {
+        window.frameElement.style.width = width + "px";
+        window.frameElement.style.height = height + "px";
+    } else {
+        window.resizeTo(width, height);
+    }
+}
+
+function showMain() {
+    var main = $("main");
+    main.style.webkitTransition = "opacity 0.1s ease";
+    main.style.opacity = "1";
+}
+
 // ----------------------------------------------------------------
 // Initialization
 
@@ -282,9 +305,11 @@ function initialize(args) {
     main.classList.add(ClassNames.NoFocusRing);
 
     var errorString = validateArguments(args);
-    if (errorString)
+    if (errorString) {
         main.textContent = "Internal error: " + errorString;
-    else {
+        resizeWindow(main.offsetWidth, main.offsetHeight);
+        showMain();
+    } else {
         global.params = args;
         checkLimits();
         layout();
@@ -333,14 +358,8 @@ function fixWindowSize() {
     daysAreaElement.style.tableLayout = "fixed";
     document.getElementsByClassName(ClassNames.YearMonthUpper)[0].style.display = "-webkit-box";
     document.getElementsByClassName(ClassNames.MonthSelectorBox)[0].style.display = "block";
-    main.style.webkitTransition = "opacity 0.1s ease";
-    main.style.opacity = "1";
-    if (window.frameElement) {
-        window.frameElement.style.width = desiredBodyWidth + "px";
-        window.frameElement.style.height = mainHeight + "px";
-    } else {
-        window.resizeTo(desiredBodyWidth, mainHeight);
-    }
+    resizeWindow(desiredBodyWidth, mainHeight);
+    showMain();
 }
 
 function checkLimits() {
@@ -432,10 +451,17 @@ YearMonthController.prototype.attachTo = function(main) {
     var box = createElement("div", ClassNames.MonthSelectorBox);
     innerContainer.appendChild(box);
     // We can't use <select> popup in PagePopup.
-    // FIXME: The popup-menu emulation by a listbox is not great.
-    this._monthPopup = createElement("select", ClassNames.MonthSelectorPopup);
+    this._monthPopup = createElement("div", ClassNames.MonthSelectorPopup);
     this._monthPopup.addEventListener("click", bind(this._handleYearMonthChange, this), false);
     this._monthPopup.addEventListener("keydown", bind(this._handleMonthPopupKey, this), false);
+    this._monthPopup.addEventListener("mousemove", bind(this._handleMouseMove, this), false);
+    this._updateSelectionOnMouseMove = true;
+    this._monthPopup.tabIndex = 0;
+    this._monthPopupContents = createElement("div", ClassNames.MonthSelectorPopupContents);
+    this._monthPopup.appendChild(this._monthPopupContents);
+    // Sizer used to determine the width of the viewport in the popup menu.
+    var sizer = createElement("div", ClassNames.MonthSelectorPopupSizer);
+    this._monthPopup.appendChild(sizer);
     box.appendChild(this._monthPopup);
     this._month = createElement("div", ClassNames.MonthSelector);
     this._month.addEventListener("click", bind(this._showPopup, this), false);
@@ -462,7 +488,7 @@ YearMonthController.prototype.attachTo = function(main) {
     }
     this._month.style.minWidth = maxWidth + 'px';
 
-    global.firstFocusableControl = this._left2; // FIXME: Shoud it be this.month?
+    global.firstFocusableControl = this._left2; // FIXME: Should it be this.month?
 };
 
 YearMonthController.addTenYearsButtons = false;
@@ -559,44 +585,122 @@ YearMonthController.prototype._redraw = function() {
     if (this._right3)
         this._right3.disabled = current + 13 > max;
     this._month.innerText = formatYearMonth(this._currentYear, this._currentMonth);
-    while (this._monthPopup.hasChildNodes())
-        this._monthPopup.removeChild(this._monthPopup.firstChild);
+    while (this._monthPopupContents.hasChildNodes())
+        this._monthPopupContents.removeChild(this._monthPopupContents.firstChild);
+
     for (var m = current - 6; m <= current + 6; m++) {
         if (m < min || m > max)
             continue;
-        var option = createElement("option", undefined, formatYearMonth(Math.floor(m / 12), m % 12));
-        option.value = String(Math.floor(m / 12)) + "-" + String(m % 12);
-        this._monthPopup.appendChild(option);
+        var option = createElement("div", ClassNames.MonthSelectorPopupEntry, formatYearMonth(Math.floor(m / 12), m % 12));
+        option.dataset.value = String(Math.floor(m / 12)) + "-" + String(m % 12);
+        this._monthPopupContents.appendChild(option);
         if (m == current)
-            option.selected = true;
+            option.classList.add(ClassNames.SelectedMonthYear);
     }
 };
 
 YearMonthController.prototype._showPopup = function() {
-    this._monthPopup.size = Math.max(4, Math.min(10, this._monthPopup.length));
     this._monthPopup.style.display = "block";
-    this._monthPopup.style.position = "absolute";
     this._monthPopup.style.zIndex = "1000"; // Larger than the days area.
     this._monthPopup.style.left = this._month.offsetLeft + (this._month.offsetWidth - this._monthPopup.offsetWidth) / 2 + "px";
     this._monthPopup.style.top = this._month.offsetTop + this._month.offsetHeight + "px";
-    this._monthPopup.focus();
 
     this._wall.style.display = "block";
     this._wall.style.zIndex = "999"; // This should be smaller than the z-index of monthPopup.
+
+    var popupHeight = this._monthPopup.clientHeight;
+    var fullHeight = this._monthPopupContents.clientHeight;
+    if (fullHeight > popupHeight) {
+        var selected = this._getSelection();
+        if (selected) {
+           var bottom = selected.offsetTop + selected.clientHeight;
+           if (bottom > popupHeight)
+               this._monthPopup.scrollTop = bottom - popupHeight;
+        }
+        var sizer = document.querySelector("." + ClassNames.MonthSelectorPopupSizer);
+        var scrollWidth = this._monthPopupContents.clientWidth - sizer.clientWidth;
+        if (scrollWidth > 0)
+            this._monthPopup.style.webkitPaddingEnd = scrollWidth + 'px';
+    }
+    this._monthPopup.focus();
 };
 
 YearMonthController.prototype._closePopup = function() {
     this._monthPopup.style.display = "none";
     this._wall.style.display = "none";
+    var container = document.querySelector("." + ClassNames.DaysAreaContainer);
+    container.focus();
 };
 
 /**
+ * @return {Element} Selected element in the month-year popup.
+ */
+YearMonthController.prototype._getSelection = function()
+{
+    return document.querySelector("." + ClassNames.SelectedMonthYear);
+}
+
+/**
+ * @param {Event} event
+ */
+YearMonthController.prototype._handleMouseMove = function(event)
+{
+    if (!this._updateSelectionOnMouseMove) {
+        // Selection update turned off while navigating with keyboard to prevent a mouse
+        // move trigged during a scroll from resetting the selection. Automatically
+        // rearm control to enable mouse-based selection.
+        this._updateSelectionOnMouseMove = true;
+    } else {
+        var target = event.target;
+        var selection = this._getSelection();
+        if (target && target != selection && target.classList.contains(ClassNames.MonthSelectorPopupEntry)) {
+            if (selection)
+                selection.classList.remove(ClassNames.SelectedMonthYear);
+            target.classList.add(ClassNames.SelectedMonthYear);
+        }
+    }
+    event.stopPropagation();
+    event.preventDefault();
+}
+
+/**
  * @param {Event} event
  */
 YearMonthController.prototype._handleMonthPopupKey = function(event)
 {
     var key = event.keyIdentifier;
-    if (key == "U+001B") {
+    if (key == "Down") {
+        var selected = this._getSelection();
+        if (selected) {
+            var next = selected.nextSibling;
+            if (next) {
+                selected.classList.remove(ClassNames.SelectedMonthYear);
+                next.classList.add(ClassNames.SelectedMonthYear);
+                var bottom = next.offsetTop + next.clientHeight;
+                if (bottom > this._monthPopup.scrollTop + this._monthPopup.clientHeight) {
+                    this._updateSelectionOnMouseMove = false;
+                    this._monthPopup.scrollTop = bottom - this._monthPopup.clientHeight;
+                }
+            }
+        }
+        event.stopPropagation();
+        event.preventDefault();
+    } else if (key == "Up") {
+        var selected = this._getSelection();
+        if (selected) {
+            var previous = selected.previousSibling;
+            if (previous) {
+                selected.classList.remove(ClassNames.SelectedMonthYear);
+                previous.classList.add(ClassNames.SelectedMonthYear);
+                if (previous.offsetTop < this._monthPopup.scrollTop) {
+                    this._updateSelectionOnMouseMove = false;
+                    this._monthPopup.scrollTop = previous.offsetTop;
+                }
+            }
+        }
+        event.stopPropagation();
+        event.preventDefault();
+    } else if (key == "U+001B") {
         this._closePopup();
         event.stopPropagation();
         event.preventDefault();
@@ -609,8 +713,11 @@ YearMonthController.prototype._handleMonthPopupKey = function(event)
 
 YearMonthController.prototype._handleYearMonthChange = function() {
     this._closePopup();
-
-    var result = this._monthPopup.value.match(/(\d+)-(\d+)/);
+    var selection = this._getSelection();
+    if (!selection)
+        return;
+    var value = selection.dataset.value;
+    var result  = value.match(/(\d+)-(\d+)/);
     if (!result)
         return;
     var newYear = Number(result[1]);
diff --git a/Source/WebCore/Resources/colorSuggestionPicker.css b/Source/WebCore/Resources/colorSuggestionPicker.css
index 580dc9a5f..6f847febc 100644
--- a/Source/WebCore/Resources/colorSuggestionPicker.css
+++ b/Source/WebCore/Resources/colorSuggestionPicker.css
@@ -44,18 +44,23 @@ body {
     width: 20px;
     height: 20px;
     margin: 1px;
+    padding: 0;
     border: 1px solid #e0e0e0;
+    box-sizing: content-box;
 }
 
-.color-swatch:hover {
+.color-swatch:focus {
     border: 1px solid #000000;
-    margin: 1px;
+    outline: none;
 }
 
 .color-swatch-container {
     width: 100%;
     max-height: 104px;
     overflow: auto;
+    display: -webkit-flex;
+    -webkit-flex-flow: row wrap;
+    -webkit-align-items: center;
 }
 
 .other-color {
diff --git a/Source/WebCore/Resources/colorSuggestionPicker.js b/Source/WebCore/Resources/colorSuggestionPicker.js
index be2048451..a827e96d1 100644
--- a/Source/WebCore/Resources/colorSuggestionPicker.js
+++ b/Source/WebCore/Resources/colorSuggestionPicker.js
@@ -42,17 +42,17 @@ function bind(func, context) {
 }
 
 function getScrollbarWidth() {
-    if (gloabal.scrollbarWidth === null) {
+    if (global.scrollbarWidth === null) {
         var scrollDiv = document.createElement("div");
         scrollDiv.style.opacity = "0";
         scrollDiv.style.overflow = "scroll";
         scrollDiv.style.width = "50px";
         scrollDiv.style.height = "50px";
         document.body.appendChild(scrollDiv);
-        gloabal.scrollbarWidth = scrollDiv.offsetWidth - scrollDiv.clientWidth;
+        global.scrollbarWidth = scrollDiv.offsetWidth - scrollDiv.clientWidth;
         scrollDiv.parentNode.removeChild(scrollDiv);
     }
-    return gloabal.scrollbarWidth;
+    return global.scrollbarWidth;
 }
 
 /**
@@ -71,6 +71,19 @@ function createElement(tagName, opt_class, opt_text) {
 }
 
 /**
+ * @param {!number} width
+ * @param {!number} height
+ */
+function resizeWindow(width, height) {
+    if (window.frameElement) {
+        window.frameElement.style.width = width + "px";
+        window.frameElement.style.height = height + "px";
+    } else {
+        window.resizeTo(width, height);
+    }
+}
+
+/**
  * @param {Event} event
  */
 function handleMessage(event) {
@@ -85,9 +98,10 @@ function initialize(args) {
     var main = $("main");
     main.innerHTML = "";
     var errorString = validateArguments(args);
-    if (errorString)
+    if (errorString) {
         main.textContent = "Internal error: " + errorString;
-    else
+        resizeWindow(main.offsetWidth, main.offsetHeight);
+    } else
         new ColorPicker(main, args);
 }
 
@@ -144,7 +158,11 @@ function ColorPicker(element, config) {
     this._config = config;
     if (this._config.values.length === 0)
         this._config.values = DefaultColorPalette;
+    this._container = null;
     this._layout();
+    document.body.addEventListener("keydown", bind(this._handleKeyDown, this));
+    this._element.addEventListener("mousemove", bind(this._handleMouseMove, this));
+    this._element.addEventListener("mousedown", bind(this._handleMouseDown, this));
 }
 
 var SwatchBorderBoxWidth = 24; // keep in sync with CSS
@@ -156,7 +174,8 @@ ColorPicker.prototype._layout = function() {
     var container = createElement("div", "color-swatch-container");
     container.addEventListener("click", bind(this._handleSwatchClick, this), false);
     for (var i = 0; i < this._config.values.length; ++i) {
-        var swatch = createElement("div", "color-swatch");
+        var swatch = createElement("button", "color-swatch");
+        swatch.dataset.index = i;
         swatch.dataset.value = this._config.values[i];
         swatch.title = this._config.values[i];
         swatch.style.backgroundColor = this._config.values[i];
@@ -171,12 +190,64 @@ ColorPicker.prototype._layout = function() {
     var otherButton = createElement("button", "other-color", this._config.otherColorLabel);
     otherButton.addEventListener("click", chooseOtherColor, false);
     this._element.appendChild(otherButton);
-    if (window.frameElement) {
-        window.frameElement.style.width = this._element.offsetWidth + "px";
-        window.frameElement.style.height = this._element.offsetHeight + "px";
-    } else {
-        window.resizeTo(this._element.offsetWidth, this._element.offsetHeight);
+    this._container = container;
+    this._otherButton = otherButton;
+    var elementWidth = this._element.offsetWidth;
+    var elementHeight = this._element.offsetHeight;
+    resizeWindow(elementWidth, elementHeight);
+};
+
+ColorPicker.prototype.selectColorAtIndex = function(index) {
+    index = Math.max(Math.min(this._container.childNodes.length - 1, index), 0);
+    this._container.childNodes[index].focus();
+};
+
+ColorPicker.prototype._handleMouseMove = function(event) {
+    if (event.target.classList.contains("color-swatch"))
+        event.target.focus();
+};
+
+ColorPicker.prototype._handleMouseDown = function(event) {
+    // Prevent blur.
+    if (event.target.classList.contains("color-swatch"))
+        event.preventDefault();
+};
+
+ColorPicker.prototype._handleKeyDown = function(event) {
+    var key = event.keyIdentifier;
+    if (key === "U+001B") // ESC
+        handleCancel();
+    else if (key == "Left" || key == "Up" || key == "Right" || key == "Down") {
+        var selectedElement = document.activeElement;
+        var index = 0;
+        if (selectedElement.classList.contains("other-color")) {
+            if (key != "Right" && key != "Up")
+                return;
+            index = this._container.childNodes.length - 1;
+        } else if (selectedElement.classList.contains("color-swatch")) {
+            index = parseInt(selectedElement.dataset.index, 10);
+            switch (key) {
+            case "Left":
+                index--;
+                break;
+            case "Right":
+                index++;
+                break;
+            case "Up":
+                index -= SwatchesPerRow;
+                break;
+            case "Down":
+                index += SwatchesPerRow;
+                break;
+            }
+            if (index > this._container.childNodes.length - 1) {
+                this._otherButton.focus();
+                return;
+            }
+        }
+        this.selectColorAtIndex(index);
     }
+    event.preventDefault();
 };
 
 ColorPicker.prototype._handleSwatchClick = function(event) {
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index 0e908eb00..b39e897c2 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -16,10 +16,6 @@ CONFIG += staticlib
 
 DEFINES += QT_MAKEDLL
 
-!haveQt(5) {
-    INCLUDEPATH += $$PWD/../WTF/wtf/qt/compat
-}
-
 RESOURCES += \
     $$PWD/WebCore.qrc
 
@@ -69,10 +65,13 @@ SOURCES += \
     accessibility/AccessibilityTableRow.cpp \
     accessibility/AXObjectCache.cpp \
     bindings/generic/ActiveDOMCallback.cpp \
+    bindings/generic/BindingSecurity.cpp \
     bindings/generic/RuntimeEnabledFeatures.cpp
 
 SOURCES += \
      bindings/ScriptControllerBase.cpp \
+     bindings/js/ArrayValue.cpp \
+     bindings/js/BindingState.cpp \
      bindings/js/CallbackFunction.cpp \
      bindings/js/DOMObjectHashTableMap.cpp \
      bindings/js/DOMWrapperWorld.cpp \
@@ -128,8 +127,6 @@ SOURCES += \
      bindings/js/JSEventTargetCustom.cpp \
      bindings/js/JSExceptionBase.cpp \
      bindings/js/JSFileReaderCustom.cpp \
-     bindings/js/JSFloat32ArrayCustom.cpp \
-     bindings/js/JSFloat64ArrayCustom.cpp \
      bindings/js/JSGeolocationCustom.cpp \
      bindings/js/JSHTMLAllCollectionCustom.cpp \
      bindings/js/JSHTMLAppletElementCustom.cpp \
@@ -155,9 +152,6 @@ SOURCES += \
      bindings/js/JSInjectedScriptHostCustom.cpp \
      bindings/js/JSInjectedScriptManager.cpp \
      bindings/js/JSInspectorFrontendHostCustom.cpp \
-     bindings/js/JSInt16ArrayCustom.cpp \
-     bindings/js/JSInt32ArrayCustom.cpp \
-     bindings/js/JSInt8ArrayCustom.cpp \
      bindings/js/JSLazyEventListener.cpp \
      bindings/js/JSLocationCustom.cpp \
      bindings/js/JSMainThreadExecState.cpp \
@@ -189,10 +183,6 @@ SOURCES += \
      bindings/js/JSTouchCustom.cpp \
      bindings/js/JSTouchListCustom.cpp \
      bindings/js/JSTreeWalkerCustom.cpp \
-     bindings/js/JSUint16ArrayCustom.cpp \
-     bindings/js/JSUint32ArrayCustom.cpp \
-     bindings/js/JSUint8ArrayCustom.cpp \
-     bindings/js/JSUint8ClampedArrayCustom.cpp \
      bindings/js/JSWebKitAnimationCustom.cpp \
      bindings/js/JSWebKitAnimationListCustom.cpp \
      bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
@@ -228,17 +218,13 @@ SOURCES += \
      bridge/qt/qt_class.cpp \
      bridge/qt/qt_instance.cpp \
      bridge/qt/qt_pixmapruntime.cpp \
+     bridge/qt/qt_runtime.cpp \
      bridge/runtime_array.cpp \
      bridge/runtime_method.cpp \
      bridge/runtime_object.cpp \
      bridge/runtime_root.cpp \
      testing/js/WebCoreTestSupport.cpp
 
-haveQt(5) {
-    SOURCES += bridge/qt/qt_runtime.cpp
-} else {
-    SOURCES += bridge/qt/qt_runtime_qt4.cpp
-}
 
 SOURCES += \
     Modules/filesystem/DOMFilePath.cpp \
@@ -342,6 +328,7 @@ SOURCES += \
     css/WebKitCSSKeyframeRule.cpp \
     css/WebKitCSSKeyframesRule.cpp \
     css/WebKitCSSMatrix.cpp \
+    css/WebKitCSSMixFunctionValue.cpp \
     css/WebKitCSSRegionRule.cpp \
     css/WebKitCSSSVGDocumentValue.cpp \
     css/WebKitCSSShaderValue.cpp \
@@ -408,10 +395,12 @@ SOURCES += \
     dom/ExceptionBase.cpp \
     dom/ExceptionCodePlaceholder.cpp \
     dom/GenericEventQueue.cpp \
+    dom/GestureEvent.cpp \
     dom/IconURL.cpp \
     dom/IdTargetObserver.cpp \
     dom/IdTargetObserverRegistry.cpp \
     dom/KeyboardEvent.cpp \
+    dom/MemoryInstrumentation.cpp \
     dom/MessageChannel.cpp \
     dom/MessageEvent.cpp \
     dom/MessagePort.cpp \
@@ -735,7 +724,6 @@ SOURCES += \
     inspector/ConsoleMessage.cpp \
     inspector/ContentSearchUtils.cpp \
     inspector/DOMEditor.cpp \
-    inspector/DOMNodeHighlighter.cpp \
     inspector/DOMPatchSupport.cpp \
     inspector/IdentifiersFactory.cpp \
     inspector/InjectedScript.cpp \
@@ -764,6 +752,7 @@ SOURCES += \
     inspector/InspectorHistory.cpp \
     inspector/InspectorInstrumentation.cpp \
     inspector/InspectorMemoryAgent.cpp \
+    inspector/InspectorOverlay.cpp \
     inspector/InspectorPageAgent.cpp \
     inspector/InspectorProfilerAgent.cpp \
     inspector/InspectorResourceAgent.cpp \
@@ -776,6 +765,7 @@ SOURCES += \
     inspector/InspectorWebGLAgent.cpp \
     inspector/InspectorWorkerAgent.cpp \
     inspector/InstrumentingAgents.cpp \
+    inspector/MemoryInstrumentationImpl.cpp \
     inspector/NetworkResourcesData.cpp \
     inspector/PageConsoleAgent.cpp \
     inspector/PageDebuggerAgent.cpp \
@@ -845,6 +835,7 @@ SOURCES += \
     loader/SinkDocument.cpp \
     loader/SubframeLoader.cpp \
     loader/SubresourceLoader.cpp \
+    loader/SubstituteData.cpp \
     loader/TextResourceDecoder.cpp \
     loader/ThreadableLoader.cpp \
     page/animation/AnimationBase.cpp \
@@ -1275,9 +1266,11 @@ HEADERS += \
     accessibility/AXObjectCache.h \
     bindings/ScriptControllerBase.h \
     bindings/generic/ActiveDOMCallback.h \
+    bindings/generic/BindingSecurity.h \
     bindings/generic/RuntimeEnabledFeatures.h
 
 HEADERS += \
+    bindings/js/BindingState.h \
     bindings/js/CachedScriptSourceProvider.h \
     bindings/js/CallbackFunction.h \
     bindings/js/GCController.h \
@@ -1473,6 +1466,7 @@ HEADERS += \
     css/WebKitCSSKeyframeRule.h \
     css/WebKitCSSKeyframesRule.h \
     css/WebKitCSSMatrix.h \
+    css/WebKitCSSMixFunctionValue.h \
     css/WebKitCSSRegionRule.h \
     css/WebKitCSSSVGDocumentValue.h \
     css/WebKitCSSShaderValue.h \
@@ -1536,6 +1530,7 @@ HEADERS += \
     dom/ExceptionBase.h \
     dom/ExceptionCode.h \
     dom/FragmentScriptingPermission.h \
+    dom/GestureEvent.h \
     dom/IdTargetObserver.h \
     dom/IdTargetObserverRegistry.h \
     dom/KeyboardEvent.h \
@@ -1836,7 +1831,6 @@ HEADERS += \
     inspector/ConsoleMessage.h \
     inspector/ContentSearchUtils.h \
     inspector/DOMEditor.h \
-    inspector/DOMNodeHighlighter.h \
     inspector/DOMPatchSupport.h \
     inspector/IdentifiersFactory.h \
     inspector/InjectedScript.h \
@@ -1867,6 +1861,7 @@ HEADERS += \
     inspector/InspectorHistory.h \
     inspector/InspectorInstrumentation.h \
     inspector/InspectorMemoryAgent.h \
+    inspector/InspectorOverlay.h \
     inspector/InspectorPageAgent.h \
     inspector/InspectorProfilerAgent.h \
     inspector/InspectorResourceAgent.h \
@@ -1879,6 +1874,7 @@ HEADERS += \
     inspector/InspectorWebGLInstrumentation.h \
     inspector/InspectorWorkerAgent.h \
     inspector/InstrumentingAgents.h \
+    inspector/MemoryInstrumentationImpl.h \
     inspector/NetworkResourcesData.h \
     inspector/PageConsoleAgent.h \
     inspector/PageDebuggerAgent.h \
@@ -1935,6 +1931,7 @@ HEADERS += \
     loader/ProgressTracker.h \
     loader/ResourceLoader.h \
     loader/SubresourceLoader.h \
+    loader/SubstituteData.h \
     loader/TextResourceDecoder.h \
     loader/TextTrackLoader.h \
     loader/ThreadableLoader.h \
@@ -2091,6 +2088,8 @@ HEADERS += \
     platform/graphics/IntPointHash.h \
     platform/graphics/IntRect.h \
     platform/graphics/MediaPlayer.h \
+    platform/graphics/NativeImagePtr.h \
+    platform/graphics/opentype/OpenTypeVerticalData.h \
     platform/graphics/Path.h \
     platform/graphics/PathTraversalState.h \
     platform/graphics/Pattern.h \
@@ -2805,18 +2804,13 @@ mac {
         platform/text/cf/StringImplCF.cpp
 }
 
-haveQt(5) {
-    contains(QT_CONFIG,icu)|mac: SOURCES += platform/text/TextBreakIteratorICU.cpp
-    mac {
-        # For Mac we use the same SmartReplace implementation as the Apple port.
-        SOURCES += editing/SmartReplaceCF.cpp
-        INCLUDEPATH += $$PWD/icu
-    } else {
-        SOURCES += editing/SmartReplaceICU.cpp
-    }
+contains(QT_CONFIG,icu)|mac: SOURCES += platform/text/TextBreakIteratorICU.cpp
+mac {
+    # For Mac we use the same SmartReplace implementation as the Apple port.
+    SOURCES += editing/SmartReplaceCF.cpp
+    INCLUDEPATH += $$PWD/icu
 } else {
-    SOURCES += platform/text/qt/TextBreakIteratorQt.cpp \
-               editing/qt/SmartReplaceQt.cpp
+    SOURCES += editing/SmartReplaceICU.cpp
 }
 
 contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
@@ -2835,11 +2829,6 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
             SOURCES += \
                 plugins/qt/PluginPackageQt.cpp \
                 plugins/qt/PluginViewQt.cpp
-
-            haveQt(4) {
-                SOURCES += plugins/qt/PluginContainerQt.cpp
-                HEADERS += plugins/qt/PluginContainerQt.h
-            }
         }
     }
 
@@ -3015,9 +3004,13 @@ contains(DEFINES, ENABLE_FILE_SYSTEM=1) {
 
 contains(DEFINES, ENABLE_MEDIA_SOURCE=1) {
     HEADERS += \
+        Modules/mediasource/MediaSource.h \
+        Modules/mediasource/MediaSourceRegistry.h \
         Modules/mediasource/SourceBuffer.h \
         Modules/mediasource/SourceBufferList.h
     SOURCES += \
+        Modules/mediasource/MediaSource.cpp \
+        Modules/mediasource/MediaSourceRegistry.cpp \
         Modules/mediasource/SourceBuffer.cpp \
         Modules/mediasource/SourceBufferList.cpp
 }
@@ -3091,6 +3084,22 @@ contains(DEFINES, ENABLE_QUOTA=1) {
         Modules/quota/StorageInfo.cpp
 }
 
+contains(DEFINES, ENABLE_GAMEPAD=1) {
+    HEADERS += \
+        Modules/gamepad/Gamepad.h\
+        Modules/gamepad/GamepadList.h \
+        Modules/gamepad/NavigatorGamepad.h \
+        platform/linux/GamepadDeviceLinux.h \
+        platform/Gamepads.h
+
+    SOURCES += \
+        Modules/gamepad/Gamepad.cpp \
+        Modules/gamepad/GamepadList.cpp \
+        Modules/gamepad/NavigatorGamepad.cpp \
+        platform/linux/GamepadDeviceLinux.cpp \
+        platform/qt/GamepadsQt.cpp
+}
+
 contains(DEFINES, ENABLE_VIDEO=1) {
     SOURCES += \
         html/HTMLAudioElement.cpp \
diff --git a/Source/WebCore/UseJSC.cmake b/Source/WebCore/UseJSC.cmake
index 00f1be102..c0236b06c 100644
--- a/Source/WebCore/UseJSC.cmake
+++ b/Source/WebCore/UseJSC.cmake
@@ -22,6 +22,8 @@ IF (PORT MATCHES "BlackBerry")
 ENDIF ()
 
 LIST(APPEND WebCore_SOURCES
+    bindings/js/ArrayValue.cpp
+    bindings/js/BindingState.cpp
     bindings/js/CallbackFunction.cpp
     bindings/js/DOMObjectHashTableMap.cpp
     bindings/js/DOMWrapperWorld.cpp
@@ -75,8 +77,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/js/JSEventListener.cpp
     bindings/js/JSEventTargetCustom.cpp
     bindings/js/JSExceptionBase.cpp
-    bindings/js/JSFloat32ArrayCustom.cpp
-    bindings/js/JSFloat64ArrayCustom.cpp
     bindings/js/JSGeolocationCustom.cpp
     bindings/js/JSHTMLAllCollectionCustom.cpp
     bindings/js/JSHTMLAppletElementCustom.cpp
@@ -99,9 +99,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/js/JSHistoryCustom.cpp
     bindings/js/JSImageConstructor.cpp
     bindings/js/JSImageDataCustom.cpp
-    bindings/js/JSInt16ArrayCustom.cpp
-    bindings/js/JSInt32ArrayCustom.cpp
-    bindings/js/JSInt8ArrayCustom.cpp
     bindings/js/JSInjectedScriptHostCustom.cpp
     bindings/js/JSInjectedScriptManager.cpp
     bindings/js/JSInspectorFrontendHostCustom.cpp
@@ -135,10 +132,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/js/JSTouchCustom.cpp
     bindings/js/JSTouchListCustom.cpp
     bindings/js/JSTreeWalkerCustom.cpp
-    bindings/js/JSUint16ArrayCustom.cpp 
-    bindings/js/JSUint32ArrayCustom.cpp
-    bindings/js/JSUint8ArrayCustom.cpp
-    bindings/js/JSUint8ClampedArrayCustom.cpp
     bindings/js/JSWebKitAnimationCustom.cpp
     bindings/js/JSWebKitAnimationListCustom.cpp
     bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp
@@ -285,7 +278,6 @@ IF (ENABLE_WEB_AUDIO)
         bindings/js/JSAudioContextCustom.cpp
         bindings/js/JSConvolverNodeCustom.cpp
         bindings/js/JSJavaScriptAudioNodeCustom.cpp
-        bindings/js/JSWaveShaperNodeCustom.cpp
     )
 ENDIF ()
 
diff --git a/Source/WebCore/UseV8.cmake b/Source/WebCore/UseV8.cmake
index 8690ab238..63890afeb 100755
--- a/Source/WebCore/UseV8.cmake
+++ b/Source/WebCore/UseV8.cmake
@@ -4,7 +4,6 @@ ADD_DEFINITIONS(-DWTF_CHANGES=1)
 LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/bindings/v8"
     "${WEBCORE_DIR}/bindings/v8/custom"
-    "${WEBCORE_DIR}/bindings/v8/specialization"
     "${JAVASCRIPTCORE_DIR}/runtime"
 )
 
@@ -17,6 +16,9 @@ LIST(APPEND WebCore_IDL_INCLUDES
 )
 
 LIST(APPEND WebCore_SOURCES
+    bindings/generic/BindingSecurity.cpp
+
+    bindings/v8/BindingState.cpp
     bindings/v8/DOMData.cpp
     bindings/v8/DOMDataStore.cpp
     bindings/v8/DOMWrapperWorld.cpp
@@ -44,7 +46,9 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/StaticDOMDataStore.cpp
     bindings/v8/V8AbstractEventListener.cpp
     bindings/v8/V8Binding.cpp
+    bindings/v8/V8BindingHelpers.cpp
     bindings/v8/V8Collection.cpp
+    bindings/v8/V8DOMConfiguration.cpp,
     bindings/v8/V8DOMMap.cpp
     bindings/v8/V8DOMWindowShell.cpp
     bindings/v8/V8DOMWrapper.cpp
@@ -52,14 +56,16 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/V8EventListenerList.cpp
     bindings/v8/V8GCController.cpp
     bindings/v8/V8GCForContextDispose.cpp
-    bindings/v8/V8Helpers.cpp
     bindings/v8/V8HiddenPropertyName.cpp
     bindings/v8/V8IsolatedContext.cpp
     bindings/v8/V8LazyEventListener.cpp
     bindings/v8/V8NodeFilterCondition.cpp
+    bindings/v8/V8PerContextData.cpp
+    bindings/v8/V8PerIsolateData.cpp
     bindings/v8/V8Proxy.cpp
     bindings/v8/V8RecursionScope.cpp
     bindings/v8/V8Utilities.cpp
+    bindings/v8/V8ValueCache.cpp
     bindings/v8/V8WindowErrorHandler.cpp
     bindings/v8/V8WorkerContextErrorHandler.cpp
     bindings/v8/V8WorkerContextEventListener.cpp
@@ -97,8 +103,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8EventConstructors.cpp
     bindings/v8/custom/V8EventCustom.cpp
     bindings/v8/custom/V8FileReaderCustom.cpp
-    bindings/v8/custom/V8Float32ArrayCustom.cpp
-    bindings/v8/custom/V8Float64ArrayCustom.cpp
     bindings/v8/custom/V8GeolocationCustom.cpp
     bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
     bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -123,9 +127,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8InjectedScriptHostCustom.cpp
     bindings/v8/custom/V8InjectedScriptManager.cpp
     bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
-    bindings/v8/custom/V8Int16ArrayCustom.cpp
-    bindings/v8/custom/V8Int32ArrayCustom.cpp
-    bindings/v8/custom/V8Int8ArrayCustom.cpp
     bindings/v8/custom/V8LocationCustom.cpp
     bindings/v8/custom/V8MessageChannelConstructor.cpp
     bindings/v8/custom/V8MessageEventCustom.cpp
@@ -148,9 +149,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8StorageCustom.cpp
     bindings/v8/custom/V8StyleSheetCustom.cpp
     bindings/v8/custom/V8StyleSheetListCustom.cpp
-    bindings/v8/custom/V8Uint16ArrayCustom.cpp
-    bindings/v8/custom/V8Uint32ArrayCustom.cpp
-    bindings/v8/custom/V8Uint8ArrayCustom.cpp
     bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
     bindings/v8/custom/V8WebKitAnimationCustom.cpp
     bindings/v8/custom/V8WebKitPointConstructor.cpp
@@ -160,8 +158,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
     bindings/v8/custom/V8XMLHttpRequestCustom.cpp
     bindings/v8/custom/V8XSLTProcessorCustom.cpp
-
-    bindings/v8/specialization/V8BindingState.cpp
 )
 
 LIST(APPEND WebCoreTestSupport_SOURCES
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index 53677310e..bdca1291d 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -914,6 +914,7 @@ __ZN7WebCore8Settings35setExperimentalNotificationsEnabledEb
 __ZN7WebCore8Settings35setTreatsAnyTextCSSLinkAsStylesheetEb
 __ZN7WebCore8Settings36setOfflineWebApplicationCacheEnabledEb
 __ZN7WebCore8Settings37setFixedElementsLayoutRelativeToFrameEb
+__ZN7WebCore8Settings37setScrollingPerformanceLoggingEnabledEb
 __ZN7WebCore8Settings40setJavaScriptCanOpenWindowsAutomaticallyEb
 __ZN7WebCore8Settings40setTextDirectionSubmenuInclusionBehaviorENS_37TextDirectionSubmenuInclusionBehaviorE
 __ZN7WebCore8Settings41setNeedsKeyboardEventDisambiguationQuirksEb
@@ -955,9 +956,11 @@ __ZN7WebCore9FrameView21flushDeferredRepaintsEv
 __ZN7WebCore9FrameView22setBaseBackgroundColorERKNS_5ColorE
 __ZN7WebCore9FrameView23updateCanHaveScrollbarsEv
 __ZN7WebCore9FrameView24forceLayoutForPaginationERKNS_9FloatSizeES3_fNS_19AdjustViewSizeOrNotE
+__ZN7WebCore9FrameView24paintContentsForSnapshotEPNS_15GraphicsContextERKNS_7IntRectENS0_18SelectionInSnaphotE
 __ZN7WebCore9FrameView26adjustPageHeightDeprecatedEPffff
 __ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
 __ZN7WebCore9FrameView37updateLayoutAndStyleIfNeededRecursiveEv
+__ZN7WebCore9FrameView37setScrollingPerformanceLoggingEnabledEb
 __ZN7WebCore9FrameView38scrollPositionChangedViaPlatformWidgetEv
 __ZN7WebCore9FrameView38syncCompositingStateIncludingSubframesEv
 __ZN7WebCore9FrameView6createEPNS_5FrameE
@@ -1200,7 +1203,6 @@ __ZNK7WebCore16HTMLInputElement15isPasswordFieldEv
 __ZNK7WebCore16HTMLInputElement18shouldAutocompleteEv
 __ZNK7WebCore16IconDatabaseBase12databasePathEv
 __ZNK7WebCore16ResourceResponse13nsURLResponseEv
-__ZNK7WebCore16StylePropertySet25ensureCSSStyleDeclarationEv
 __ZNK7WebCore16VisibleSelection17isContentEditableEv
 __ZNK7WebCore16VisibleSelection17toNormalizedRangeEv
 __ZNK7WebCore16VisibleSelection19rootEditableElementEv
@@ -1533,6 +1535,7 @@ __ZN7WebCore16FontPlatformDataC1EP6NSFontfbbbNS_15FontOrientationENS_15TextOrien
 __ZN7WebCore16FontPlatformDataC2EP6NSFontfbbbNS_15FontOrientationENS_15TextOrientationENS_16FontWidthVariantE
 __ZN7WebCore16colorFromNSColorEP7NSColor
 __ZN7WebCore16enclosingIntRectERK7_NSRect
+__ZN7WebCore16StylePropertySet25ensureCSSStyleDeclarationEv
 __ZN7WebCore21DeviceOrientationData6createEbdbdbdbb
 __ZN7WebCore18SearchPopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore19applicationIsSafariEv
@@ -2107,8 +2110,10 @@ __ZNK7WebCore15ContextMenuItem7checkedEv
 __ZNK7WebCore15ContextMenuItem7enabledEv
 #endif // ENABLE(CONTEXT_MENUS)
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 __ZNK7WebCore8Document16dashboardRegionsEv
+#endif
+#if ENABLE(DASHBOARD_SUPPORT)
 __ZN7WebCore8Settings41setUsesDashboardBackwardCompatibilityModeEb
 #endif
 
@@ -2499,6 +2504,7 @@ __ZN7WebCore8Document19accessSVGExtensionsEv
 
 #if ENABLE(THREADED_SCROLLING)
 __ZN7WebCore13ScrollingTree17setDebugRootLayerEP7CALayer
+__ZN7WebCore13ScrollingTree37setScrollingPerformanceLoggingEnabledEb
 __ZN7WebCore13ScrollingTree21tryToHandleWheelEventERKNS_18PlatformWheelEventE
 __ZN7WebCore13ScrollingTree22updateBackForwardStateEbb
 __ZN7WebCore13ScrollingTreeD1Ev
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index 4070766e9..847c2d6ac 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -46,6 +46,10 @@
     # binary and increasing the speed of gdb.
     'enable_svg%': 1,
 
+    # If set to 1, links against the cc library from the chromium repository
+    # instead of the compositor implementation files in platform/graphics/chromium
+    'use_libcc_for_compositor%': 0,
+
     'enable_wexit_time_destructors': 1,
 
     'use_harfbuzz_ng%': 0,
@@ -76,7 +80,6 @@
       '../bindings/generic',
       '../bindings/v8',
       '../bindings/v8/custom',
-      '../bindings/v8/specialization',
       '../bridge',
       '../bridge/jni',
       '../bridge/jni/v8',
@@ -1267,7 +1270,7 @@
           # In generated bindings code: 'switch contains default but no case'.
           'msvs_disabled_warnings': [ 4065 ],
         }],
-        ['OS=="linux" and "WTF_USE_WEBAUDIO_IPP=1" in feature_defines', {
+        ['OS in ("linux", "android") and "WTF_USE_WEBAUDIO_IPP=1" in feature_defines', {
           'cflags': [
             '<!@(pkg-config --cflags-only-I ipp)',
           ],
@@ -1470,7 +1473,7 @@
             'include_dirs++': ['../dom'],
           },
         }],
-        ['OS=="linux" and "WTF_USE_WEBAUDIO_IPP=1" in feature_defines', {
+        ['OS in ("linux", "android") and "WTF_USE_WEBAUDIO_IPP=1" in feature_defines', {
           'direct_dependent_settings': {
             'cflags': [
               '<!@(pkg-config --cflags-only-I ipp)',
@@ -1721,10 +1724,16 @@
 
             ['include', 'WebKit/mac/WebCoreSupport/WebSystemInterface\\.mm$'],
 
-            # We use LocalizedDateMac.cpp with LocaleMac.mm instead of LocalizedDateICU.cpp.
+            # We use LocalizedDateMac.cpp and LocalizedNumberMac.mm with
+            # LocaleMac.mm instead of LocalizedDateICU.cpp in order to apply
+            # system locales.
+            ['exclude', 'platform/text/LocaleICU\\.cpp$'],
+            ['exclude', 'platform/text/LocaleICU\\.h$'],
             ['exclude', 'platform/text/LocalizedDateICU\\.cpp$'],
+            ['exclude', 'platform/text/LocalizedNumberICU\\.cpp$'],
             ['include', 'platform/text/mac/LocaleMac\\.mm$'],
             ['include', 'platform/text/mac/LocalizedDateMac\\.cpp$'],
+            ['include', 'platform/text/mac/LocalizedNumberMac\\.mm$'],
 
             # The Mac uses platform/mac/KillRingMac.mm instead of the dummy
             # implementation.
@@ -1795,10 +1804,14 @@
             # SystemInfo.cpp is useful and we don't want to copy it.
             ['include', 'platform/win/SystemInfo\\.cpp$'],
 
+            ['exclude', 'platform/text/LocaleICU\\.cpp$'],
+            ['exclude', 'platform/text/LocaleICU\\.h$'],
             ['exclude', 'platform/text/LocalizedDateICU\.cpp$'],
+            ['exclude', 'platform/text/LocalizedNumberICU\.cpp$'],
             ['include', 'platform/text/LocalizedDateWin\.cpp$'],
             ['include', 'platform/text/LocaleWin\.cpp$'],
             ['include', 'platform/text/LocaleWin\.h$'],
+            ['include', 'platform/text/win/LocalizedNumberWin\\.cpp$'],
           ],
         },{ # OS!="win"
           'sources/': [
@@ -2074,7 +2087,6 @@
         'webcore_dom',
         'webcore_html',
         'webcore_platform',
-        'webcore_chromium_compositor',
         'webcore_remaining',
         'webcore_rendering',
         # Exported.
@@ -2131,11 +2143,29 @@
             ],
           },
         }],
+        # Use IPP static libraries for x86 Android.
+        ['OS=="android" and "WTF_USE_WEBAUDIO_IPP=1" in feature_defines', {
+          'link_settings': {
+            'libraries': [
+               '<!@(pkg-config --libs ipp|sed s/-L//)/libipps_l.a',
+               '<!@(pkg-config --libs ipp|sed s/-L//)/libippcore_l.a',
+            ]
+          },
+        }],
         ['enable_svg!=0', {
           'dependencies': [
             'webcore_svg',
           ],
         }],
+        ['use_libcc_for_compositor==1', {
+          'dependencies': [
+            '<(chromium_src_dir)/cc/cc.gyp:cc'
+          ],
+        }, { # use_libcc_for_compositor==0
+          'dependencies': [
+            'webcore_chromium_compositor'
+          ],
+        }]
       ],
     },
     {
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index 3ec84f4b5..184049a55 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -188,6 +188,7 @@
             'loader/ResourceLoaderOptions.h',
             'loader/SubframeLoader.h',
             'loader/SubresourceLoader.h',
+            'loader/SubstituteData.cpp',
             'loader/SubstituteData.h',
             'loader/SubstituteResource.h',
             'loader/TextResourceDecoder.h',
@@ -202,6 +203,7 @@
             'loader/archive/mhtml/MHTMLParser.h',
             'loader/cache/CachePolicy.h',
             'loader/cache/CachedImage.h',
+            'loader/cache/CachedImageClient.h',
             'loader/cache/CachedRawResource.h',
             'loader/cache/CachedResource.h',
             'loader/cache/CachedResourceClient.h',
@@ -450,6 +452,9 @@
             'platform/mediastream/MediaStreamSource.h',
             'platform/mediastream/PeerConnection00Handler.h',
             'platform/mediastream/PeerConnection00HandlerClient.h',
+            'platform/mediastream/RTCConfiguration.h',
+            'platform/mediastream/RTCPeerConnectionHandler.h',
+            'platform/mediastream/RTCPeerConnectionHandlerClient.h',
             'platform/mediastream/SessionDescriptionDescriptor.cpp',
             'platform/mediastream/SessionDescriptionDescriptor.h',
             'platform/mediastream/chromium/MediaStreamCenterChromium.cpp',
@@ -457,6 +462,8 @@
             'platform/mediastream/chromium/PeerConnection00Handler.cpp',
             'platform/mediastream/chromium/PeerConnection00HandlerInternal.cpp',
             'platform/mediastream/chromium/PeerConnection00HandlerInternal.h',
+            'platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp',
+            'platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h',
             'platform/mock/DeviceMotionClientMock.h',
             'platform/mock/DeviceOrientationClientMock.h',
             'platform/mock/GeolocationClientMock.h',
@@ -824,6 +831,7 @@
             'Modules/intents/Intent.idl',
             'Modules/intents/IntentResultCallback.idl',
             'Modules/intents/NavigatorIntents.idl',
+            'Modules/mediasource/MediaSource.idl',
             'Modules/mediasource/SourceBuffer.idl',
             'Modules/mediasource/SourceBufferList.idl',
             'Modules/mediastream/DOMWindowMediaStream.idl',
@@ -841,6 +849,7 @@
             'Modules/mediastream/NavigatorUserMediaErrorCallback.idl',
             'Modules/mediastream/NavigatorUserMediaSuccessCallback.idl',
             'Modules/mediastream/PeerConnection00.idl',
+            'Modules/mediastream/RTCPeerConnection.idl',
             'Modules/mediastream/SessionDescription.idl',
             'Modules/notifications/DOMWindowNotifications.idl',
             'Modules/notifications/Notification.idl',
@@ -884,6 +893,7 @@
             'Modules/webaudio/DynamicsCompressorNode.idl',
             'Modules/webaudio/JavaScriptAudioNode.idl',
             'Modules/webaudio/MediaElementAudioSourceNode.idl',
+            'Modules/webaudio/MediaStreamAudioSourceNode.idl',
             'Modules/webaudio/OfflineAudioCompletionEvent.idl',
             'Modules/webaudio/Oscillator.idl',
             'Modules/webaudio/RealtimeAnalyserNode.idl',
@@ -1176,7 +1186,6 @@
             'page/PerformanceNavigation.idl',
             'page/PerformanceResourceTiming.idl',
             'page/PerformanceTiming.idl',
-            'page/PointerLock.idl',
             'page/Screen.idl',
             'page/SpeechInputEvent.idl',
             'page/SpeechInputResult.idl',
@@ -1537,6 +1546,10 @@
             'Modules/intents/IntentResultCallback.h',
             'Modules/intents/NavigatorIntents.cpp',
             'Modules/intents/NavigatorIntents.h',
+            'Modules/mediasource/MediaSource.cpp',
+            'Modules/mediasource/MediaSource.h',
+            'Modules/mediasource/MediaSourceRegistry.cpp',
+            'Modules/mediasource/MediaSourceRegistry.h',
             'Modules/mediasource/SourceBuffer.cpp',
             'Modules/mediasource/SourceBuffer.h',
             'Modules/mediasource/SourceBufferList.cpp',
@@ -1567,6 +1580,8 @@
             'Modules/mediastream/NavigatorUserMediaSuccessCallback.h',
             'Modules/mediastream/PeerConnection00.cpp',
             'Modules/mediastream/PeerConnection00.h',
+            'Modules/mediastream/RTCPeerConnection.cpp',
+            'Modules/mediastream/RTCPeerConnection.h',
             'Modules/mediastream/SessionDescription.cpp',
             'Modules/mediastream/SessionDescription.h',
             'Modules/mediastream/UserMediaClient.h',
@@ -1679,6 +1694,8 @@
             'Modules/webaudio/JavaScriptAudioNode.h',
             'Modules/webaudio/MediaElementAudioSourceNode.cpp',
             'Modules/webaudio/MediaElementAudioSourceNode.h',
+            'Modules/webaudio/MediaStreamAudioSourceNode.cpp',
+            'Modules/webaudio/MediaStreamAudioSourceNode.h',
             'Modules/webaudio/OfflineAudioCompletionEvent.cpp',
             'Modules/webaudio/OfflineAudioCompletionEvent.h',
             'Modules/webaudio/OfflineAudioDestinationNode.cpp',
@@ -1887,9 +1904,8 @@
             'bindings/cpp/WebNativeNodeFilterCondition.h',
             'bindings/generic/ActiveDOMCallback.cpp',
             'bindings/generic/ActiveDOMCallback.h',
+            'bindings/generic/BindingSecurity.cpp',
             'bindings/generic/BindingSecurity.h',
-            'bindings/generic/BindingSecurityBase.cpp',
-            'bindings/generic/BindingSecurityBase.h',
             'bindings/generic/GenericBinding.h',
             'bindings/generic/RuntimeEnabledFeatures.cpp',
             'bindings/generic/RuntimeEnabledFeatures.h',
@@ -1908,6 +1924,10 @@
             'bindings/gobject/WebKitDOMObject.h',
             'bindings/gobject/WebKitHTMLElementWrapperFactory.cpp',
             'bindings/gobject/WebKitHTMLElementWrapperFactory.h',
+            'bindings/js/ArrayValue.cpp',
+            'bindings/js/ArrayValue.h',
+            'bindings/js/BindingState.cpp',
+            'bindings/js/BindingState.h',
             'bindings/js/CachedScriptSourceProvider.h',
             'bindings/js/CallbackFunction.cpp',
             'bindings/js/CallbackFunction.h',
@@ -1986,8 +2006,6 @@
             'bindings/js/JSExceptionBase.cpp',
             'bindings/js/JSExceptionBase.h',
             'bindings/js/JSFileReaderCustom.cpp',
-            'bindings/js/JSFloat32ArrayCustom.cpp',
-            'bindings/js/JSFloat64ArrayCustom.cpp',
             'bindings/js/JSGeolocationCustom.cpp',
             'bindings/js/JSHTMLAllCollectionCustom.cpp',
             'bindings/js/JSHTMLAppletElementCustom.cpp',
@@ -2022,9 +2040,6 @@
             'bindings/js/JSInjectedScriptHostCustom.cpp',
             'bindings/js/JSInjectedScriptManager.cpp',
             'bindings/js/JSInspectorFrontendHostCustom.cpp',
-            'bindings/js/JSInt16ArrayCustom.cpp',
-            'bindings/js/JSInt32ArrayCustom.cpp',
-            'bindings/js/JSInt8ArrayCustom.cpp',
             'bindings/js/JSJavaScriptAudioNodeCustom.cpp',
             'bindings/js/JSJavaScriptCallFrameCustom.cpp',
             'bindings/js/JSLazyEventListener.cpp',
@@ -2076,9 +2091,6 @@
             'bindings/js/JSTrackCustom.h',
             'bindings/js/JSTrackEventCustom.cpp',
             'bindings/js/JSTreeWalkerCustom.cpp',
-            'bindings/js/JSUint16ArrayCustom.cpp',
-            'bindings/js/JSUint32ArrayCustom.cpp',
-            'bindings/js/JSUint8ArrayCustom.cpp',
             'bindings/js/JSWebGLRenderingContextCustom.cpp',
             'bindings/js/JSWebKitAnimationCustom.cpp',
             'bindings/js/JSWebKitAnimationListCustom.cpp',
@@ -2104,12 +2116,8 @@
             'bindings/js/ScriptCallStackFactory.cpp',
             'bindings/js/ScriptCallStackFactory.h',
             'bindings/js/ScriptController.cpp',
-            'bindings/js/ScriptControllerEfl.cpp',
-            'bindings/js/ScriptControllerGtk.cpp',
             'bindings/js/ScriptControllerMac.mm',
             'bindings/js/ScriptControllerQt.cpp',
-            'bindings/js/ScriptControllerWin.cpp',
-            'bindings/js/ScriptControllerWx.cpp',
             'bindings/js/ScriptDebugServer.cpp',
             'bindings/js/ScriptEventListener.cpp',
             'bindings/js/ScriptEventListener.h',
@@ -2151,6 +2159,10 @@
             'bindings/objc/ObjCNodeFilterCondition.mm',
             'bindings/objc/PublicDOMInterfaces.h',
             'bindings/objc/WebScriptObject.mm',
+            'bindings/v8/ArrayValue.cpp',
+            'bindings/v8/ArrayValue.h',
+            'bindings/v8/BindingState.cpp',
+            'bindings/v8/BindingState.h',
             'bindings/v8/DOMData.cpp',
             'bindings/v8/DOMData.h',
             'bindings/v8/DOMDataStore.cpp',
@@ -2227,10 +2239,13 @@
             'bindings/v8/V8AbstractEventListener.h',
             'bindings/v8/V8Binding.cpp',
             'bindings/v8/V8Binding.h',
-            'bindings/v8/V8BindingPerContextData.cpp',
-            'bindings/v8/V8BindingPerContextData.h',
+            'bindings/v8/V8BindingHelpers.cpp',
+            'bindings/v8/V8BindingHelpers.h',
+            'bindings/v8/V8BindingMacros.h',
             'bindings/v8/V8Collection.cpp',
             'bindings/v8/V8Collection.h',
+            'bindings/v8/V8DOMConfiguration.cpp',
+            'bindings/v8/V8DOMConfiguration.h',
             'bindings/v8/V8DOMMap.cpp',
             'bindings/v8/V8DOMMap.h',
             'bindings/v8/V8DOMWindowShell.cpp',
@@ -2245,8 +2260,6 @@
             'bindings/v8/V8GCController.h',
             'bindings/v8/V8GCForContextDispose.cpp',
             'bindings/v8/V8GCForContextDispose.h',
-            'bindings/v8/V8Helpers.cpp',
-            'bindings/v8/V8Helpers.h',
             'bindings/v8/V8HiddenPropertyName.cpp',
             'bindings/v8/V8HiddenPropertyName.h',
             'bindings/v8/V8IsolatedContext.cpp',
@@ -2259,12 +2272,18 @@
             'bindings/v8/V8NPUtils.h',
             'bindings/v8/V8NodeFilterCondition.cpp',
             'bindings/v8/V8NodeFilterCondition.h',
+            'bindings/v8/V8PerContextData.cpp',
+            'bindings/v8/V8PerContextData.h',
+            'bindings/v8/V8PerIsolateData.cpp',
+            'bindings/v8/V8PerIsolateData.h',
             'bindings/v8/V8Proxy.cpp',
             'bindings/v8/V8Proxy.h',
             'bindings/v8/V8RecursionScope.cpp',
             'bindings/v8/V8RecursionScope.h',
             'bindings/v8/V8Utilities.cpp',
             'bindings/v8/V8Utilities.h',
+            'bindings/v8/V8ValueCache.cpp',
+            'bindings/v8/V8ValueCache.h',
             'bindings/v8/V8WindowErrorHandler.cpp',
             'bindings/v8/V8WindowErrorHandler.h',
             'bindings/v8/V8WorkerContextErrorHandler.cpp',
@@ -2285,7 +2304,6 @@
             'bindings/v8/custom/V8ArrayBufferViewCustom.h',
             'bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp',
             'bindings/v8/custom/V8AudioContextCustom.cpp',
-            'bindings/v8/custom/V8BindingMacros.h',
             'bindings/v8/custom/V8BlobCustom.cpp',
             'bindings/v8/custom/V8CSSRuleCustom.cpp',
             'bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp',
@@ -2314,8 +2332,6 @@
             'bindings/v8/custom/V8EntrySyncCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
             'bindings/v8/custom/V8FileReaderCustom.cpp',
-            'bindings/v8/custom/V8Float32ArrayCustom.cpp',
-            'bindings/v8/custom/V8Float64ArrayCustom.cpp',
             'bindings/v8/custom/V8GeolocationCustom.cpp',
             'bindings/v8/custom/V8HTMLAllCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLCanvasElementCustom.cpp',
@@ -2342,9 +2358,6 @@
             'bindings/v8/custom/V8InjectedScriptHostCustom.cpp',
             'bindings/v8/custom/V8InjectedScriptManager.cpp',
             'bindings/v8/custom/V8InspectorFrontendHostCustom.cpp',
-            'bindings/v8/custom/V8Int16ArrayCustom.cpp',
-            'bindings/v8/custom/V8Int32ArrayCustom.cpp',
-            'bindings/v8/custom/V8Int8ArrayCustom.cpp',
             'bindings/v8/custom/V8IntentConstructor.cpp',
             'bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp',
             'bindings/v8/custom/V8LocationCustom.cpp',
@@ -2378,10 +2391,6 @@
             'bindings/v8/custom/V8StyleSheetCustom.cpp',
             'bindings/v8/custom/V8StyleSheetListCustom.cpp',
             'bindings/v8/custom/V8TrackEventCustom.cpp',
-            'bindings/v8/custom/V8Uint16ArrayCustom.cpp',
-            'bindings/v8/custom/V8Uint32ArrayCustom.cpp',
-            'bindings/v8/custom/V8Uint8ArrayCustom.cpp',
-            'bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp',
             'bindings/v8/custom/V8WebGLRenderingContextCustom.cpp',
             'bindings/v8/custom/V8WebKitAnimationCustom.cpp',
             'bindings/v8/custom/V8WebKitPointConstructor.cpp',
@@ -2393,8 +2402,6 @@
             'bindings/v8/custom/V8XSLTProcessorCustom.cpp',
             'bindings/v8/npruntime.cpp',
             'bindings/v8/npruntime_priv.h',
-            'bindings/v8/specialization/V8BindingState.cpp',
-            'bindings/v8/specialization/V8BindingState.h',
             'bridge/IdentifierRep.cpp',
             'bridge/NP_jsobject.cpp',
             'bridge/NP_jsobject.h',
@@ -2605,6 +2612,8 @@
             'css/WebKitCSSKeyframesRule.h',
             'css/WebKitCSSMatrix.cpp',
             'css/WebKitCSSMatrix.h',
+            'css/WebKitCSSMixFunctionValue.cpp',
+            'css/WebKitCSSMixFunctionValue.h',
             'css/WebKitCSSRegionRule.cpp',
             'css/WebKitCSSRegionRule.h',
             'css/WebKitCSSShaderValue.cpp',
@@ -2718,7 +2727,6 @@
             'editing/mac/FrameSelectionMac.mm',
             'editing/markup.cpp',
             'editing/qt/EditorQt.cpp',
-            'editing/qt/SmartReplaceQt.cpp',
             'editing/visible_units.cpp',
             'editing/wx/EditorWx.cpp',
             'fileapi/AsyncFileStream.cpp',
@@ -2794,8 +2802,6 @@
             'inspector/ContentSearchUtils.h',
             'inspector/DOMEditor.cpp',
             'inspector/DOMEditor.h',
-            'inspector/DOMNodeHighlighter.cpp',
-            'inspector/DOMNodeHighlighter.h',
             'inspector/DOMPatchSupport.cpp',
             'inspector/DOMPatchSupport.h',
             'inspector/IdentifiersFactory.cpp',
@@ -2853,6 +2859,8 @@
             'inspector/InspectorInstrumentation.h',
             'inspector/InspectorMemoryAgent.cpp',
             'inspector/InspectorMemoryAgent.h',
+            'inspector/InspectorOverlay.cpp',
+            'inspector/InspectorOverlay.h',
             'inspector/InspectorPageAgent.cpp',
             'inspector/InspectorPageAgent.h',
             'inspector/InspectorProfilerAgent.cpp',
@@ -2879,6 +2887,8 @@
             'inspector/InspectorWorkerAgent.h',
             'inspector/InstrumentingAgents.cpp',
             'inspector/InstrumentingAgents.h',
+            'inspector/MemoryInstrumentationImpl.cpp',
+            'inspector/MemoryInstrumentationImpl.h',
             'inspector/NetworkResourcesData.cpp',
             'inspector/NetworkResourcesData.h',
             'inspector/PageConsoleAgent.cpp',
@@ -3103,8 +3113,6 @@
             'page/PerformanceResourceTiming.h',
             'page/PerformanceTiming.cpp',
             'page/PerformanceTiming.h',
-            'page/PointerLock.cpp',
-            'page/PointerLock.h',
             'page/PointerLockController.cpp',
             'page/PointerLockController.h',
             'page/PrintContext.cpp',
@@ -3282,6 +3290,7 @@
             'platform/audio/AudioFIFO.cpp',
             'platform/audio/AudioFIFO.h',
             'platform/audio/AudioFileReader.h',
+            'platform/audio/AudioIOCallback.h',
             'platform/audio/AudioProcessor.h',
             'platform/audio/AudioPullFIFO.cpp',
             'platform/audio/AudioPullFIFO.h',
@@ -3459,8 +3468,6 @@
             'platform/efl/PlatformKeyboardEventEfl.cpp',
             'platform/efl/PlatformMouseEventEfl.cpp',
             'platform/efl/PlatformScreenEfl.cpp',
-            'platform/efl/PlatformTouchEventEfl.cpp',
-            'platform/efl/PlatformTouchPointEfl.cpp',
             'platform/efl/PlatformWheelEventEfl.cpp',
             'platform/efl/PopupMenuEfl.cpp',
             'platform/efl/PopupMenuEfl.h',
@@ -3522,6 +3529,7 @@
             'platform/graphics/IntRect.cpp',
             'platform/graphics/MediaPlayer.cpp',
             'platform/graphics/MediaPlayerPrivate.h',
+            'platform/graphics/NativeImagePtr.h' ,
             'platform/graphics/Path.cpp',
             'platform/graphics/PathTraversalState.cpp',
             'platform/graphics/PathTraversalState.h',
@@ -3622,6 +3630,8 @@
             'platform/graphics/chromium/AnimationTranslationUtil.h',
             'platform/graphics/chromium/Canvas2DLayerBridge.cpp',
             'platform/graphics/chromium/Canvas2DLayerBridge.h',
+            'platform/graphics/chromium/CompositorHUDFontAtlas.cpp',
+            'platform/graphics/chromium/CompositorHUDFontAtlas.h',
             'platform/graphics/chromium/CrossProcessFontLoading.h',
             'platform/graphics/chromium/CrossProcessFontLoading.mm',
             'platform/graphics/chromium/DrawingBufferChromium.cpp',
@@ -3671,6 +3681,8 @@
             'platform/graphics/filters/CustomFilterParameter.h',
             'platform/graphics/filters/CustomFilterProgram.cpp',
             'platform/graphics/filters/CustomFilterProgram.h',
+            'platform/graphics/filters/CustomFilterProgramInfo.cpp',
+            'platform/graphics/filters/CustomFilterProgramInfo.h',
             'platform/graphics/filters/CustomFilterCompiledProgram.cpp',
             'platform/graphics/filters/CustomFilterCompiledProgram.h',
             'platform/graphics/filters/CustomFilterMesh.cpp',
@@ -4401,7 +4413,6 @@
             'platform/text/AtomicStringKeyedMRUCache.h',
             'platform/text/BidiContext.cpp',
             'platform/text/DateTimeFormat.cpp',
-            'platform/text/Hyphenation.cpp',
             'platform/text/Hyphenation.h',
             'platform/text/LineEnding.cpp',
             'platform/text/LocaleICU.cpp',
@@ -4418,6 +4429,8 @@
             'platform/text/LocalizedNumber.h',
             'platform/text/LocalizedNumberICU.cpp',
             'platform/text/LocalizedNumberNone.cpp',
+            'platform/text/NumberLocalizer.cpp',
+            'platform/text/NumberLocalizer.h',
             'platform/text/ParserUtilities.h',
             'platform/text/QuotedPrintable.h',
             'platform/text/QuotedPrintable.cpp',
@@ -4446,6 +4459,7 @@
             'platform/text/cf/HyphenationCF.cpp',
             'platform/text/cf/StringCF.cpp',
             'platform/text/cf/StringImplCF.cpp',
+            'platform/text/chromium/Hyphenation.cpp',
             'platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp',
             'platform/text/efl/TextBreakIteratorInternalICUEfl.cpp',
             'platform/text/gtk/TextBreakIteratorGtk.cpp',
@@ -4464,11 +4478,11 @@
             'platform/text/mac/TextCodecMac.cpp',
             'platform/text/mac/TextCodecMac.h',
             'platform/text/qt/TextBoundariesQt.cpp',
-            'platform/text/qt/TextBreakIteratorQt.cpp',
             'platform/text/qt/TextCodecQt.cpp',
             'platform/text/qt/TextCodecQt.h',
             'platform/text/transcoder/FontTranscoder.cpp',
             'platform/text/transcoder/FontTranscoder.h',
+            'platform/text/win/LocalizedNumberWin.cpp',
             'platform/text/win/TextBreakIteratorInternalICUWin.cpp',
             'platform/text/win/TextCodecWin.cpp',
             'platform/text/win/TextCodecWin.h',
@@ -4623,8 +4637,6 @@
             'plugins/mac/PluginPackageMac.cpp',
             'plugins/mac/PluginViewMac.mm',
             'plugins/npapi.cpp',
-            'plugins/qt/PluginContainerQt.cpp',
-            'plugins/qt/PluginContainerQt.h',
             'plugins/qt/PluginPackageQt.cpp',
             'plugins/qt/PluginViewQt.cpp',
             'plugins/win/PluginDatabaseWin.cpp',
@@ -5190,6 +5202,8 @@
             'dom/ExceptionCodePlaceholder.cpp',
             'dom/GenericEventQueue.cpp',
             'dom/GenericEventQueue.h',
+            'dom/GestureEvent.cpp',
+            'dom/GestureEvent.h',
             'dom/HashChangeEvent.h',
             'dom/IgnoreDestructiveWriteCountIncrementer.h',
             'dom/IconURL.cpp',
@@ -5199,6 +5213,7 @@
             'dom/IdTargetObserverRegistry.cpp',
             'dom/IdTargetObserverRegistry.h',
             'dom/KeyboardEvent.cpp',
+            'dom/MemoryInstrumentation.cpp',
             'dom/MemoryInstrumentation.h',
             'dom/MessageChannel.cpp',
             'dom/MessageChannel.h',
@@ -5724,6 +5739,16 @@
             'html/shadow/ContentDistributor.h',
             'html/shadow/ContentSelectorQuery.cpp',
             'html/shadow/ContentSelectorQuery.h',
+            'html/shadow/DateTimeEditElement.cpp',
+            'html/shadow/DateTimeEditElement.h',
+            'html/shadow/DateTimeFieldElement.cpp',
+            'html/shadow/DateTimeFieldElement.h',
+            'html/shadow/DateTimeFieldElements.cpp',
+            'html/shadow/DateTimeFieldElements.h',
+            'html/shadow/DateTimeNumericFieldElement.cpp',
+            'html/shadow/DateTimeNumericFieldElement.h',
+            'html/shadow/DateTimeSymbolicFieldElement.cpp',
+            'html/shadow/DateTimeSymbolicFieldElement.h',
             'html/shadow/DetailsMarkerControl.cpp',
             'html/shadow/DetailsMarkerControl.h',
             'html/shadow/HTMLContentElement.cpp',
@@ -6236,6 +6261,7 @@
             'inspector/front-end/BreakpointsSidebarPane.js',
             'inspector/front-end/CallStackSidebarPane.js',
             'inspector/front-end/Checkbox.js',
+            'inspector/front-end/CodeMirrorTextEditor.js',
             'inspector/front-end/Color.js',
             'inspector/front-end/CompilerScriptMapping.js',
             'inspector/front-end/ConsoleMessage.js',
@@ -6259,6 +6285,7 @@
             'inspector/front-end/DataGrid.js',
             'inspector/front-end/DebuggerModel.js',
             'inspector/front-end/DebuggerScriptMapping.js',
+            'inspector/front-end/DefaultTextEditor.js',
             'inspector/front-end/Dialog.js',
             'inspector/front-end/DirectoryContentView.js',
             'inspector/front-end/DOMAgent.js',
@@ -6283,6 +6310,7 @@
             'inspector/front-end/FileContentView.js',
             'inspector/front-end/FileSystemModel.js',
             'inspector/front-end/FileSystemView.js',
+            'inspector/front-end/FileUtils.js',
             'inspector/front-end/FilteredItemSelectionDialog.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/GoToLineDialog.js',
@@ -6333,6 +6361,7 @@
             'inspector/front-end/ProfileDataGridTree.js',
             'inspector/front-end/ProfileLauncherView.js',
             'inspector/front-end/ProfilesPanel.js',
+            'inspector/front-end/ProgressBar.js',
             'inspector/front-end/PropertiesSection.js',
             'inspector/front-end/PropertiesSidebarPane.js',
             'inspector/front-end/RawSourceCode.js',
@@ -6418,9 +6447,12 @@
             'inspector/front-end/inspectorSyntaxHighlight.css',
             'inspector/front-end/popover.css',
             '<@(webinspector_standalone_css_files)',
+            '<@(webinspector_standalone_js_files)',
         ],
         'webinspector_standalone_css_files': [
             'inspector/front-end/auditsPanel.css',
+            'inspector/front-end/cm/codemirror.css',
+            'inspector/front-end/cmdevtools.css',
             'inspector/front-end/dataGrid.css',
             'inspector/front-end/elementsPanel.css',
             'inspector/front-end/filteredItemSelectionDialog.css',
@@ -6444,6 +6476,13 @@
             'inspector/front-end/textPrompt.css',
             'inspector/front-end/timelinePanel.css',
         ],
+        'webinspector_standalone_js_files': [
+            'inspector/front-end/cm/codemirror.js',
+            'inspector/front-end/cm/css.js',
+            'inspector/front-end/cm/htmlmixed.js',
+            'inspector/front-end/cm/javascript.js',
+            'inspector/front-end/cm/xml.js',
+        ],
         'webinspector_uglifyjs_files': [
             'inspector/front-end/UglifyJS/parse-js.js',
         ],
@@ -8185,35 +8224,36 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/XPathGrammar.h',
         ],
         'webcore_platform_support_files': [
+            'platform/chromium/support/CCThreadImpl.cpp',
+            'platform/chromium/support/CCThreadImpl.h',
             'platform/chromium/support/Extensions3DChromium.cpp',
             'platform/chromium/support/GraphicsContext3DChromium.cpp',
             'platform/chromium/support/GraphicsContext3DPrivate.cpp',
             'platform/chromium/support/GraphicsContext3DPrivate.h',
+            'platform/chromium/support/PlatformGestureCurveFactory.cpp',
+            'platform/chromium/support/PlatformGestureCurveFactory.h',
             'platform/chromium/support/WebAudioBus.cpp',
-            'platform/chromium/support/WebCompositorCheckerboardQuad.cpp',
-            'platform/chromium/support/WebCompositorDebugBorderQuad.cpp',
-            'platform/chromium/support/WebCompositorIOSurfaceQuad.cpp',
-            'platform/chromium/support/WebCompositorQuad.cpp',
-            'platform/chromium/support/WebCompositorSharedQuadState.cpp',
-            'platform/chromium/support/WebCompositorSolidColorQuad.cpp',
-            'platform/chromium/support/WebCompositorStreamVideoQuad.cpp',
-            'platform/chromium/support/WebCompositorTextureQuad.cpp',
-            'platform/chromium/support/WebCompositorTileQuad.cpp',
+            'platform/chromium/support/WebCompositorImpl.cpp',
+            'platform/chromium/support/WebCompositorImpl.h',
             'platform/chromium/support/WebData.cpp',
+            'platform/chromium/support/WebFlingAnimatorToGestureCurveAdapter.h',
             'platform/chromium/support/WebHTTPBody.cpp',
             'platform/chromium/support/WebHTTPLoadInfo.cpp',
             'platform/chromium/support/WebICECandidateDescriptor.cpp',
             'platform/chromium/support/WebICEOptions.cpp',
             'platform/chromium/support/WebMediaHints.cpp',
-            'platform/chromium/support/WebMediaHints.cpp',
             'platform/chromium/support/WebMediaStreamComponent.cpp',
             'platform/chromium/support/WebMediaStreamDescriptor.cpp',
             'platform/chromium/support/WebMediaStreamSource.cpp',
             'platform/chromium/support/WebMediaStreamSourcesRequest.cpp',
             'platform/chromium/support/WebPrerender.cpp',
+            'platform/chromium/support/WebRTCConfiguration.cpp',
+            'platform/chromium/support/WebScrollbarThemeGeometryNative.cpp',
+            'platform/chromium/support/WebScrollbarThemeGeometryNative.h',
+            'platform/chromium/support/WebSharedGraphicsContext3D.cpp',
             'platform/chromium/support/WebThreadSafeData.cpp',
-            'platform/chromium/support/WebTransformationMatrix.cpp',
             'platform/chromium/support/WebTransformOperations.cpp',
+            'platform/chromium/support/WebTransformationMatrix.cpp',
             'platform/chromium/support/WebURL.cpp',
             'platform/chromium/support/WebURLError.cpp',
             'platform/chromium/support/WebURLRequest.cpp',
@@ -8250,8 +8290,6 @@
             'platform/graphics/chromium/LayerTextureSubImage.cpp',
             'platform/graphics/chromium/LayerTextureSubImage.h',
             'platform/graphics/chromium/LayerTextureUpdater.h',
-            'platform/graphics/chromium/PlatformCanvas.cpp',
-            'platform/graphics/chromium/PlatformCanvas.h',
             'platform/graphics/chromium/PlatformColor.h',
             'platform/graphics/chromium/ProgramBinding.cpp',
             'platform/graphics/chromium/ProgramBinding.h',
@@ -8287,14 +8325,17 @@
             'platform/graphics/chromium/cc/CCAnimationCurve.cpp',
             'platform/graphics/chromium/cc/CCAnimationCurve.h',
             'platform/graphics/chromium/cc/CCAnimationEvents.h',
+            'platform/graphics/chromium/cc/CCCheckerboardDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h',
             'platform/graphics/chromium/cc/CCDamageTracker.cpp',
             'platform/graphics/chromium/cc/CCDamageTracker.h',
+            'platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h',
             'platform/graphics/chromium/cc/CCDebugRectHistory.cpp',
             'platform/graphics/chromium/cc/CCDebugRectHistory.h',
             'platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp',
             'platform/graphics/chromium/cc/CCDelayBasedTimeSource.h',
+            'platform/graphics/chromium/cc/CCDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCDrawQuad.h',
             'platform/graphics/chromium/cc/CCFontAtlas.cpp',
             'platform/graphics/chromium/cc/CCFontAtlas.h',
@@ -8305,6 +8346,7 @@
             'platform/graphics/chromium/cc/CCGestureCurve.h',
             'platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h',
+            'platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h',
             'platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.h',
@@ -8313,7 +8355,6 @@
             'platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h',
             'platform/graphics/chromium/cc/CCLayerAnimationController.cpp',
             'platform/graphics/chromium/cc/CCLayerAnimationController.h',
-            'platform/graphics/chromium/cc/CCLayerAnimationDelegate.h',
             'platform/graphics/chromium/cc/CCLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerImpl.h',
             'platform/graphics/chromium/cc/CCLayerIterator.cpp',
@@ -8367,28 +8408,39 @@
             'platform/graphics/chromium/cc/CCScopedTexture.cpp',
             'platform/graphics/chromium/cc/CCScopedTexture.h',
             'platform/graphics/chromium/cc/CCScopedThreadProxy.h',
+            'platform/graphics/chromium/cc/CCScrollbarAnimationController.cpp',
+            'platform/graphics/chromium/cc/CCScrollbarAnimationController.h',
+            'platform/graphics/chromium/cc/CCScrollbarAnimationControllerLinearFade.cpp',
+            'platform/graphics/chromium/cc/CCScrollbarAnimationControllerLinearFade.h',
             'platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCScrollbarLayerImpl.h',
             'platform/graphics/chromium/cc/CCSettings.cpp',
             'platform/graphics/chromium/cc/CCSettings.h',
+            'platform/graphics/chromium/cc/CCSharedQuadState.cpp',
             'platform/graphics/chromium/cc/CCSharedQuadState.h',
             'platform/graphics/chromium/cc/CCSingleThreadProxy.cpp',
             'platform/graphics/chromium/cc/CCSingleThreadProxy.h',
+            'platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCSolidColorDrawQuad.h',
             'platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCSolidColorLayerImpl.h',
+            'platform/graphics/chromium/cc/CCStreamVideoDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h',
             'platform/graphics/chromium/cc/CCTexture.cpp',
             'platform/graphics/chromium/cc/CCTexture.h',
+            'platform/graphics/chromium/cc/CCTextureDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCTextureDrawQuad.h',
             'platform/graphics/chromium/cc/CCTextureLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCTextureLayerImpl.h',
-            'platform/graphics/chromium/cc/CCTextureUpdater.cpp',
-            'platform/graphics/chromium/cc/CCTextureUpdater.h',
+            'platform/graphics/chromium/cc/CCTextureUpdateController.cpp',
+            'platform/graphics/chromium/cc/CCTextureUpdateController.h',
+            'platform/graphics/chromium/cc/CCTextureUpdateQueue.cpp',
+            'platform/graphics/chromium/cc/CCTextureUpdateQueue.h',
             'platform/graphics/chromium/cc/CCThread.h',
             'platform/graphics/chromium/cc/CCThreadProxy.cpp',
             'platform/graphics/chromium/cc/CCThreadProxy.h',
             'platform/graphics/chromium/cc/CCThreadTask.h',
+            'platform/graphics/chromium/cc/CCTileDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCTileDrawQuad.h',
             'platform/graphics/chromium/cc/CCTiledLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCTiledLayerImpl.h',
diff --git a/Source/WebCore/WebCore.order b/Source/WebCore/WebCore.order
index 357ea4624..9d9022ca5 100644
--- a/Source/WebCore/WebCore.order
+++ b/Source/WebCore/WebCore.order
@@ -6933,7 +6933,6 @@ __ZN7WebCore14RangeInputType6createEPNS_16HTMLInputElementE
 __ZNK7WebCore14RangeInputType15formControlTypeEv
 __ZN7WebCore14InputTypeNames5rangeEv
 __ZN7WebCore14RangeInputType19createShadowSubtreeEv
-__ZN7WebCore7Element16ensureShadowRootEv
 __ZN7WebCore10ShadowRootC1EPNS_8DocumentE
 __ZN7WebCore9TreeScope18setParentTreeScopeEPS0_
 __ZNK7WebCore10ShadowRoot8nodeTypeEv
@@ -16890,7 +16889,6 @@ __ZN7WebCore12RenderObject32handleDynamicFloatPositionChangeEv
 __ZN7WebCore11RenderBlock20childBecameNonInlineEPNS_12RenderObjectE
 __ZN3WTF9HashTableIPN7WebCore14ScrollableAreaES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E16lookupForWritingERKS3_
 __ZN3WTF9HashTableIPN7WebCore14ScrollableAreaES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_
-__ZN7WebCore15handleLinkClickEPNS_5EventEPNS_8DocumentERKN3WTF6StringES7_b
 __ZN7WebCore11FrameLoader11urlSelectedERKNS_4KURLERKN3WTF6StringENS4_10PassRefPtrINS_5EventEEEbbNS_14ReferrerPolicyE
 __ZN7WebCore11FrameLoader47callContinueFragmentScrollAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
 __ZN7WebCore11FrameLoader18loadInSameDocumentERKNS_4KURLEPNS_21SerializedScriptValueEb
@@ -30182,7 +30180,6 @@ __ZN7WebCore11SVGAElement19defaultEventHandlerEPNS_5EventE
 __ZN7WebCore11isLinkClickEPNS_5EventE
 __ZNK7WebCore11SVGAElement5titleEv
 __ZNK7WebCore11SVGAElement16isMouseFocusableEv
-__ZN7WebCore24isMiddleMouseButtonEventEPNS_5EventE
 __ZNK7WebCore11SVGAElement6targetEv
 __ZN7WebCore17JSSVGImageElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
 __ZN3JSC9lookupPutIN7WebCore17JSSVGImageElementEEEbPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEPKNS_9HashTableEPT_
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index 513d261a4..021933467 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -7,8 +7,7 @@
 
 SOURCE_DIR = $${ROOT_WEBKIT_DIR}/Source/WebCore
 
-QT *= network sql
-haveQt(5): QT *= core-private gui-private
+QT *= network sql core-private gui-private
 
 WEBCORE_GENERATED_SOURCES_DIR = $${ROOT_BUILD_DIR}/Source/WebCore/$${GENERATED_SOURCES_DESTDIR}
 
@@ -57,6 +56,7 @@ INCLUDEPATH += \
     $$SOURCE_DIR/platform/graphics/filters \
     $$SOURCE_DIR/platform/graphics/filters/arm \
     $$SOURCE_DIR/platform/graphics/opengl \
+    $$SOURCE_DIR/platform/graphics/opentype \
     $$SOURCE_DIR/platform/graphics/qt \
     $$SOURCE_DIR/platform/graphics/surfaces \
     $$SOURCE_DIR/platform/graphics/texmap \
@@ -97,7 +97,6 @@ INCLUDEPATH += \
 INCLUDEPATH += \
     $$SOURCE_DIR/bridge/jsc \
     $$SOURCE_DIR/bindings/js \
-    $$SOURCE_DIR/bindings/js/specialization \
     $$SOURCE_DIR/bridge/c \
     $$SOURCE_DIR/testing/js
 
@@ -150,18 +149,8 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
     }
 }
 
-contains(DEFINES, ENABLE_GEOLOCATION=1) {
-    CONFIG *= mobility
-    MOBILITY *= location
-}
-
 contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1)|contains(DEFINES, ENABLE_DEVICE_ORIENTATION=1) {
-    haveQt(5) {
-        QT += sensors
-    } else {
-        CONFIG *= mobility
-        MOBILITY *= sensors
-    }
+    QT += sensors
 }
 
 contains(DEFINES, WTF_USE_QT_MOBILITY_SYSTEMINFO=1) {
@@ -169,6 +158,13 @@ contains(DEFINES, WTF_USE_QT_MOBILITY_SYSTEMINFO=1) {
      MOBILITY *= systeminfo
 }
 
+contains(DEFINES, ENABLE_GAMEPAD=1) {
+    INCLUDEPATH += \
+        $$SOURCE_DIR/platform/linux \
+        $$SOURCE_DIR/Modules/gamepad
+    PKGCONFIG += libudev
+}
+
 contains(DEFINES, ENABLE_VIDEO=1) {
     contains(DEFINES, WTF_USE_QTKIT=1) {
         INCLUDEPATH += $$SOURCE_DIR/platform/graphics/mac
@@ -193,7 +189,6 @@ contains(DEFINES, WTF_USE_3D_GRAPHICS=1) {
     contains(QT_CONFIG, opengles2): LIBS += -lEGL
     mac: LIBS += -framework IOSurface -framework CoreFoundation
     linux-*:contains(DEFINES, HAVE_XCOMPOSITE=1): LIBS += -lXcomposite
-    haveQt(4): QT *= opengl
 }
 
 !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
@@ -204,29 +199,22 @@ contains(DEFINES, WTF_USE_3D_GRAPHICS=1) {
     LIBS += -lsqlite3
 }
 
-haveQt(5) {
-    # Qt5 allows us to use config tests to check for the presence of these libraries
-    config_libjpeg {
-        DEFINES += WTF_USE_LIBJPEG=1
-        LIBS += -ljpeg
-    } else {
-        warning("JPEG library not found! QImageDecoder will decode JPEG images.")
-    }
-    config_libpng {
-        DEFINES += WTF_USE_LIBPNG=1
-        LIBS += -lpng
-    } else {
-        warning("PNG library not found! QImageDecoder will decode PNG images.")
-    }
-    config_libwebp {
-        DEFINES += WTF_USE_WEBP=1
-        LIBS += -lwebp
-    }
+# Qt5 allows us to use config tests to check for the presence of these libraries
+config_libjpeg {
+    DEFINES += WTF_USE_LIBJPEG=1
+    LIBS += -ljpeg
 } else {
-    !win32-*:!mac {
-        DEFINES += WTF_USE_LIBJPEG=1 WTF_USE_LIBPNG=1
-        LIBS += -ljpeg -lpng
-    }
+    warning("JPEG library not found! QImageDecoder will decode JPEG images.")
+}
+config_libpng {
+    DEFINES += WTF_USE_LIBPNG=1
+    LIBS += -lpng
+} else {
+    warning("PNG library not found! QImageDecoder will decode PNG images.")
+}
+config_libwebp {
+    DEFINES += WTF_USE_WEBP=1
+    LIBS += -lwebp
 }
 
 win32-*|wince* {
@@ -276,8 +264,7 @@ unix:!mac:*-g++*:QMAKE_LFLAGS += -Wl,--gc-sections
 linux*-g++*:QMAKE_LFLAGS += $$QMAKE_LFLAGS_NOUNDEF
 
 unix|win32-g++* {
-    QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork
-    haveQt(5): QMAKE_PKGCONFIG_REQUIRES += QtWidgets
+    QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork QtWidgets
 }
 
 # Disable C++0x mode in WebCore for those who enabled it in their Qt's mkspec
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index 642029359..e7acb1ac0 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -25086,6 +25086,22 @@
 				Name="mediasource"
 				>
 				<File
+					RelativePath="..\Modules\mediasource\MediaSource.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\mediasource\MediaSource.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\mediasource\MediaSourceRegistry.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\mediasource\MediaSourceRegistry.h"
+					>
+				</File>
+				<File
 					RelativePath="..\Modules\mediasource\SourceBuffer.cpp"
 					>
 				</File>
@@ -27615,6 +27631,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\loader\SubstituteData.cpp"
+				>
+			</File>
+			<File
 				RelativePath="..\loader\SubstituteData.h"
 				>
 			</File>
@@ -29533,6 +29553,10 @@
 					RelativePath="..\platform\graphics\MediaPlayer.h"
 					>
 				</File>
+ 				<File
+					RelativePath="..\platform\graphics\NativeImagePtr.h"
+					>
+				</File>
 				<File
 					RelativePath="..\platform\graphics\Path.cpp"
 					>
@@ -31673,6 +31697,14 @@
 						>
 					</File>
 					<File
+						RelativePath="..\platform\graphics\filters\CustomFilterProgramInfo.cpp"
+						>
+					</File>
+					<File
+						RelativePath="..\platform\graphics\filters\CustomFilterProgramInfo.h"
+						>
+					</File>
+					<File
 						RelativePath="..\platform\graphics\filters\CustomFilterProgramClient.h"
 						>
 					</File>
@@ -37767,6 +37799,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\WebKitCSSMixFunctionValue.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\css\WebKitCSSMixFunctionValue.h"
+				>
+			</File>
+			<File
 				RelativePath="..\css\WebKitCSSRegionRule.cpp"
 				>
 			</File>
@@ -51531,6 +51571,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\MemoryInstrumentation.cpp"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\MemoryInstrumentation.h"
 				>
 			</File>
@@ -63766,7 +63810,7 @@
 					>
 				</File>
 				<File
-					RelativePath="..\bindings\generic\BindingDOMWindow.h"
+					RelativePath="..\bindings\generic\BindingSecurity.cpp"
 					>
 				</File>
 				<File
@@ -63774,14 +63818,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\bindings\generic\BindingSecurityBase.cpp"
-					>
-				</File>
-				<File
-					RelativePath="..\bindings\generic\BindingSecurityBase.h"
-					>
-				</File>
-				<File
 					RelativePath="..\bindings\generic\GenericBinding.h"
 					>
 				</File>
@@ -63797,6 +63833,62 @@
 			<Filter
 				Name="js"
 				>
+                                <File
+                                        RelativePath="..\bindings\js\ArrayValue.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+                                        RelativePath="..\bindings\js\ArrayValue.h"
+					>
+				</File>
 				<File
 					RelativePath="..\bindings\js\CachedScriptSourceProvider.h"
 					>
@@ -63854,6 +63946,62 @@
 					</FileConfiguration>
 				</File>
 				<File
+					RelativePath="..\bindings\js\BindingState.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\BindingState.h"
+					>
+				</File>
+				<File
 					RelativePath="..\bindings\js\CallbackFunction.h"
 					>
 				</File>
@@ -73799,30 +73947,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\inspector\DOMNodeHighlighter.cpp"
-				>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\inspector\DOMNodeHighlighter.h"
-				>
-			</File>
-			<File
 				RelativePath="..\inspector\DOMPatchSupport.cpp"
 				>
 				<FileConfiguration
@@ -74595,6 +74719,30 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\InspectorOverlay.cpp"
+				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\inspector\InspectorOverlay.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorPageAgent.cpp"
 				>
 				<FileConfiguration
@@ -74895,6 +75043,30 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\MemoryInstrumentationImpl.cpp"
+				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\inspector\MemoryInstrumentationImpl.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\NetworkResourcesData.cpp"
 				>
 				<FileConfiguration
@@ -75254,6 +75426,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\CodeMirrorTextEditor.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\Color.js"
 					>
 				</File>
@@ -75322,6 +75498,34 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\cm\codemirror.css"
+					>
+				</File>
+				<File
+					RelativePath="..\inspector\front-end\cm\codemirror.js"
+					>
+				</File>
+				<File
+					RelativePath="..\inspector\front-end\cm\css.js"
+					>
+				</File>
+				<File
+					RelativePath="..\inspector\front-end\cm\htmlmixed.js"
+					>
+				</File>
+				<File
+					RelativePath="..\inspector\front-end\cm\javascript.js"
+					>
+				</File>
+				<File
+					RelativePath="..\inspector\front-end\cm\xml.js"
+					>
+				</File>
+				<File
+					RelativePath="..\inspector\front-end\cmdevtools.css"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\Database.js"
 					>
 				</File>
@@ -75350,6 +75554,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\DefaultTextEditor.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\dialog.css"
 					>
 				</File>
@@ -75454,6 +75662,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\FileUtils.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\filteredItemSelectionDialog.css"
 					>
 				</File>
@@ -75714,6 +75926,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\ProgressBar.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\PropertiesSection.js"
 					>
 				</File>
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index c3ca34e43..6d08c313b 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -111,7 +111,9 @@
 		070756E014239B4E00414161 /* JSTextTrackCueList.h in Headers */ = {isa = PBXBuildFile; fileRef = 070756DA14239B4E00414161 /* JSTextTrackCueList.h */; };
 		0709FC4E1025DEE30059CDBA /* AccessibilitySlider.h in Headers */ = {isa = PBXBuildFile; fileRef = 0709FC4D1025DEE30059CDBA /* AccessibilitySlider.h */; };
 		0720B0A014D3323500642955 /* GenericEventQueue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0720B09E14D3323500642955 /* GenericEventQueue.cpp */; };
+		0720B0A014D3323500642956 /* GestureEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0720B09F14D3323500642956 /* GestureEvent.cpp */; };
 		0720B0A114D3323500642955 /* GenericEventQueue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0720B09F14D3323500642955 /* GenericEventQueue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0720B0A114D3323500642957 /* GestureEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 0720B09F14D3323500642957 /* GestureEvent.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		072C8B11131C518600A4FCE9 /* MediaPlayerPrivateAVFoundation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 076F0D0912B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.cpp */; };
 		0735EE6A0F40C5E4004A2604 /* MediaPlayerProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0753860214489E9800B78452 /* CachedTextTrack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0753860014489E9800B78452 /* CachedTextTrack.cpp */; };
@@ -919,6 +921,7 @@
 		319E69B313299BBD004AC91A /* WebKitAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 319E69AD13299BBD004AC91A /* WebKitAnimation.h */; };
 		319E69B513299BBD004AC91A /* WebKitAnimationList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 319E69AF13299BBD004AC91A /* WebKitAnimationList.cpp */; };
 		319E69B613299BBD004AC91A /* WebKitAnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 319E69B013299BBD004AC91A /* WebKitAnimationList.h */; };
+		319FBD5F15D2F464009640A6 /* CachedImageClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 319FBD5D15D2F444009640A6 /* CachedImageClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		31C0FF210E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 31C0FF1B0E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp */; };
 		31C0FF220E4CEB6E007D6FE5 /* WebKitAnimationEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 31C0FF1C0E4CEB6E007D6FE5 /* WebKitAnimationEvent.h */; };
 		31C0FF240E4CEB6E007D6FE5 /* WebKitTransitionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 31C0FF1E0E4CEB6E007D6FE5 /* WebKitTransitionEvent.cpp */; };
@@ -1287,6 +1290,8 @@
 		49AE2D97134EE5F90072920A /* CalculationValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 49AE2D95134EE5F90072920A /* CalculationValue.h */; };
 		49AF2D6914435D050016A784 /* DisplayRefreshMonitor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49AF2D6814435D050016A784 /* DisplayRefreshMonitor.h */; };
 		49AF2D6C14435D210016A784 /* DisplayRefreshMonitorMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49AF2D6B14435D210016A784 /* DisplayRefreshMonitorMac.cpp */; };
+		49B3760C15C6C6840059131D /* ArrayValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49B3760A15C6C6840059131D /* ArrayValue.cpp */; };
+		49B3760D15C6C6840059131D /* ArrayValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 49B3760B15C6C6840059131D /* ArrayValue.h */; };
 		49C7B9931042D2D30009D447 /* JSWebGLBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9801042D2D30009D447 /* JSWebGLBuffer.cpp */; };
 		49C7B9941042D2D30009D447 /* JSWebGLBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9811042D2D30009D447 /* JSWebGLBuffer.h */; };
 		49C7B9951042D2D30009D447 /* JSInt8Array.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9821042D2D30009D447 /* JSInt8Array.cpp */; };
@@ -1371,13 +1376,6 @@
 		49EECF0D105070C400099FAB /* JSUint16Array.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFF105070C400099FAB /* JSUint16Array.h */; };
 		49EECF1B105072F300099FAB /* JSArrayBufferView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF19105072F300099FAB /* JSArrayBufferView.cpp */; };
 		49EECF1C105072F300099FAB /* JSArrayBufferView.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF1A105072F300099FAB /* JSArrayBufferView.h */; };
-		49EECF7810508D9C00099FAB /* JSInt8ArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7110508D9C00099FAB /* JSInt8ArrayCustom.cpp */; };
-		49EECF7910508D9C00099FAB /* JSFloat32ArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7210508D9C00099FAB /* JSFloat32ArrayCustom.cpp */; };
-		49EECF7A10508D9C00099FAB /* JSInt32ArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7310508D9C00099FAB /* JSInt32ArrayCustom.cpp */; };
-		49EECF7B10508D9C00099FAB /* JSInt16ArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7410508D9C00099FAB /* JSInt16ArrayCustom.cpp */; };
-		49EECF7C10508D9C00099FAB /* JSUint8ArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7510508D9C00099FAB /* JSUint8ArrayCustom.cpp */; };
-		49EECF7D10508D9C00099FAB /* JSUint32ArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7610508D9C00099FAB /* JSUint32ArrayCustom.cpp */; };
-		49EECF7E10508D9C00099FAB /* JSUint16ArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7710508D9C00099FAB /* JSUint16ArrayCustom.cpp */; };
 		49EED1421051969400099FAB /* JSCanvasRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */; };
 		49EED1431051969400099FAB /* JSCanvasRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */; };
 		49EED1441051969400099FAB /* JSCanvasRenderingContext2D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */; };
@@ -1444,8 +1442,6 @@
 		4E19592C0A39DACC00220FE5 /* MediaQueryEvaluator.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E1959260A39DACC00220FE5 /* MediaQueryEvaluator.h */; };
 		4E19592D0A39DACC00220FE5 /* MediaQueryExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4E1959270A39DACC00220FE5 /* MediaQueryExp.cpp */; };
 		4E19592E0A39DACC00220FE5 /* MediaQueryExp.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E1959280A39DACC00220FE5 /* MediaQueryExp.h */; };
-		4F1442281339FD6200E0D6F8 /* DOMNodeHighlighter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */; };
-		4F1442291339FD6200E0D6F8 /* DOMNodeHighlighter.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F1534DE11B532EC0021FD86 /* EditingBehavior.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DD11B532EC0021FD86 /* EditingBehavior.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F1534E011B533020021FD86 /* EditingBehaviorTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F2D205412EAE7B3005C2874 /* InspectorAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F2D205212EAE7B3005C2874 /* InspectorAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1458,6 +1454,8 @@
 		4F6FDD651341DEDD001F8EE3 /* InspectorPageAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F6FDD631341DEDD001F8EE3 /* InspectorPageAgent.h */; };
 		4F707A9911EF679400ACDA69 /* InspectorBackendDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F707A9711EF679400ACDA69 /* InspectorBackendDispatcher.cpp */; };
 		4F707A9A11EF679400ACDA69 /* InspectorBackendDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F707A9811EF679400ACDA69 /* InspectorBackendDispatcher.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		4F8565E91530356E00FAE776 /* MemoryInstrumentationImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F8565E71530356E00FAE776 /* MemoryInstrumentationImpl.cpp */; };
+		4F8565EA1530356E00FAE776 /* MemoryInstrumentationImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F8565E81530356E00FAE776 /* MemoryInstrumentationImpl.h */; };
 		4FA3B90A125CD12200300BAD /* InspectorState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FA3B908125CD12100300BAD /* InspectorState.cpp */; };
 		4FA3B90B125CD12200300BAD /* InspectorState.h in Headers */ = {isa = PBXBuildFile; fileRef = 4FA3B909125CD12200300BAD /* InspectorState.h */; };
 		4FD8D0F2119C718B002FA825 /* ScriptGCEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FD8D0F0119C718B002FA825 /* ScriptGCEvent.cpp */; };
@@ -1489,6 +1487,8 @@
 		50D405FA147D31F300D30BB5 /* CustomFilterMesh.h in Headers */ = {isa = PBXBuildFile; fileRef = 50D405F8147D31F300D30BB5 /* CustomFilterMesh.h */; };
 		50D40611147D49DE00D30BB5 /* CustomFilterCompiledProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50D4060F147D49DE00D30BB5 /* CustomFilterCompiledProgram.cpp */; };
 		50D40612147D49DE00D30BB5 /* CustomFilterCompiledProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 50D40610147D49DE00D30BB5 /* CustomFilterCompiledProgram.h */; };
+		50D88CB515BDFDAA001809F4 /* CustomFilterProgramInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50D88CB315BDFDAA001809F4 /* CustomFilterProgramInfo.cpp */; };
+		50D88CB615BDFDAA001809F4 /* CustomFilterProgramInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 50D88CB415BDFDAA001809F4 /* CustomFilterProgramInfo.h */; };
 		50E566D6139E38C500214433 /* CSSWrapShapes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 501BAAB11395114B00F7ACEB /* CSSWrapShapes.cpp */; };
 		510184690B08602A004A825F /* CachedPage.h in Headers */ = {isa = PBXBuildFile; fileRef = 510184670B08602A004A825F /* CachedPage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5101846A0B08602A004A825F /* CachedPage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510184680B08602A004A825F /* CachedPage.cpp */; };
@@ -1822,7 +1822,6 @@
 		6E67D2A61280E8A4008758F7 /* Extensions3DOpenGL.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6E67D2A41280E8A4008758F7 /* Extensions3DOpenGL.cpp */; };
 		6E67D2A71280E8A4008758F7 /* Extensions3DOpenGL.h in Headers */ = {isa = PBXBuildFile; fileRef = 6E67D2A51280E8A4008758F7 /* Extensions3DOpenGL.h */; };
 		6E67D2A91280E8BD008758F7 /* Extensions3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 6E67D2A81280E8BD008758F7 /* Extensions3D.h */; };
-		6EBC5D85138B4CE000A0CF8A /* JSFloat64ArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6EBC5D84138B4CE000A0CF8A /* JSFloat64ArrayCustom.cpp */; };
 		6EBC5EAF138B50F200A0CF8A /* JSFloat64Array.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6EBC5EAD138B50F200A0CF8A /* JSFloat64Array.cpp */; };
 		6EBC5EB0138B50F200A0CF8A /* JSFloat64Array.h in Headers */ = {isa = PBXBuildFile; fileRef = 6EBC5EAE138B50F200A0CF8A /* JSFloat64Array.h */; };
 		6EBF0E4812A8926100DB1709 /* OESTextureFloat.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6EBF0E4512A8926100DB1709 /* OESTextureFloat.cpp */; };
@@ -1961,6 +1960,8 @@
 		7B1EA0CF1576C5B50060177D /* JSUndoManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 7B1EA0CD1576C5B50060177D /* JSUndoManager.h */; };
 		7B9184D215758E420092AA93 /* UndoManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7B9184CF15758E420092AA93 /* UndoManager.cpp */; };
 		7B9184D315758E420092AA93 /* UndoManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 7B9184D015758E420092AA93 /* UndoManager.h */; };
+		7C522D4B15B477E8009B7C95 /* InspectorOverlay.cpp */ = {isa = PBXBuildFile; fileRef = 7C522D4915B477E8009B7C95 /* InspectorOverlay.cpp */; };
+		7C522D4C15B478B2009B7C95 /* InspectorOverlay.h */ = {isa = PBXBuildFile; fileRef = 7C522D4A15B477E8009B7C95 /* InspectorOverlay.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7E33CD01127F340D00BE8F17 /* PurgePriority.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E33CD00127F340D00BE8F17 /* PurgePriority.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7E37EF2E1339208800B29250 /* SubresourceLoaderCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E37EF2D1339208800B29250 /* SubresourceLoaderCF.cpp */; };
 		7E99AF510B13846468FB01A5 /* WindowFocusAllowedIndicator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E99AF520B13846468FB01A5 /* WindowFocusAllowedIndicator.cpp */; };
@@ -3098,7 +3099,6 @@
 		9001788112E0370700648462 /* JSOESStandardDerivatives.h in Headers */ = {isa = PBXBuildFile; fileRef = 9001787F12E0370700648462 /* JSOESStandardDerivatives.h */; };
 		91089D3214C33600005AFC49 /* JSUint8ClampedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 91089D3014C335CD005AFC49 /* JSUint8ClampedArray.h */; };
 		91089D3314C33605005AFC49 /* JSUint8ClampedArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 91089D2F14C335CD005AFC49 /* JSUint8ClampedArray.cpp */; };
-		91A3905B14C0F61100F67901 /* JSUint8ClampedArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 91A3905A14C0F61100F67901 /* JSUint8ClampedArrayCustom.cpp */; };
 		9302B0BD0D79F82900C7EE83 /* PageGroup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */; };
 		9302B0BF0D79F82C00C7EE83 /* PageGroup.h in Headers */ = {isa = PBXBuildFile; fileRef = 9302B0BE0D79F82C00C7EE83 /* PageGroup.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9305B24D098F1B6B00C28855 /* Timer.h in Headers */ = {isa = PBXBuildFile; fileRef = 9305B24C098F1B6B00C28855 /* Timer.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3455,6 +3455,10 @@
 		9728C3141268E4390041E89B /* MarkupAccumulator.h in Headers */ = {isa = PBXBuildFile; fileRef = 9728C3121268E4390041E89B /* MarkupAccumulator.h */; };
 		973889A0116EA9DC00ADF313 /* DocumentWriter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9738899E116EA9DC00ADF313 /* DocumentWriter.cpp */; };
 		973889A1116EA9DC00ADF313 /* DocumentWriter.h in Headers */ = {isa = PBXBuildFile; fileRef = 9738899F116EA9DC00ADF313 /* DocumentWriter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		973AA3F415D088F000E38A85 /* BindingState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 973AA3F215D088F000E38A85 /* BindingState.cpp */; };
+		973AA3F515D088F000E38A85 /* BindingState.h in Headers */ = {isa = PBXBuildFile; fileRef = 973AA3F315D088F000E38A85 /* BindingState.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		973AA3F915D0891B00E38A85 /* BindingSecurity.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 973AA3F715D0891B00E38A85 /* BindingSecurity.cpp */; };
+		973AA3FA15D0891B00E38A85 /* BindingSecurity.h in Headers */ = {isa = PBXBuildFile; fileRef = 973AA3F815D0891B00E38A85 /* BindingSecurity.h */; };
 		973DC63F145A9409002842C2 /* ExceptionCodeDescription.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 973DC63D145A9409002842C2 /* ExceptionCodeDescription.cpp */; };
 		973DC640145A9409002842C2 /* ExceptionCodeDescription.h in Headers */ = {isa = PBXBuildFile; fileRef = 973DC63E145A9409002842C2 /* ExceptionCodeDescription.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		973E325610883B7C005BC493 /* ResourceLoadNotifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */; };
@@ -3740,6 +3744,8 @@
 		A1E1154413015C3D0054AC8C /* DistantLightSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1E1154313015C3D0054AC8C /* DistantLightSource.cpp */; };
 		A1E1154613015C4E0054AC8C /* PointLightSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1E1154513015C4E0054AC8C /* PointLightSource.cpp */; };
 		A1E1154813015C5D0054AC8C /* SpotLightSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1E1154713015C5D0054AC8C /* SpotLightSource.cpp */; };
+		A24BF77B15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A24BF77915CC3BAF003191F2 /* WebKitCSSMixFunctionValue.h */; };
+		A24BF77C15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A24BF77A15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.cpp */; };
 		A3BB59F31457A40D00AC56FE /* DocumentEventQueue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A3BB59F11457A40D00AC56FE /* DocumentEventQueue.cpp */; };
 		A3BB59F41457A40D00AC56FE /* DocumentEventQueue.h in Headers */ = {isa = PBXBuildFile; fileRef = A3BB59F21457A40D00AC56FE /* DocumentEventQueue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A3E2643014748991005A8588 /* WorkerEventQueue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A3E2642E14748991005A8588 /* WorkerEventQueue.cpp */; };
@@ -3779,9 +3785,6 @@
 		A6148A6812E41D940044A784 /* DOMHTMLKeygenElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = A6148A6612E41D940044A784 /* DOMHTMLKeygenElement.mm */; };
 		A6148A7812E41E3B0044A784 /* JSHTMLKeygenElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A6148A7612E41E3B0044A784 /* JSHTMLKeygenElement.cpp */; };
 		A6148A7912E41E3B0044A784 /* JSHTMLKeygenElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A6148A7712E41E3B0044A784 /* JSHTMLKeygenElement.h */; };
-		A622A8FB122C44A600A785B3 /* BindingSecurity.h in Headers */ = {isa = PBXBuildFile; fileRef = A622A8F5122C44A600A785B3 /* BindingSecurity.h */; };
-		A622A8FC122C44A600A785B3 /* BindingSecurityBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A622A8F6122C44A600A785B3 /* BindingSecurityBase.cpp */; };
-		A622A8FD122C44A600A785B3 /* BindingSecurityBase.h in Headers */ = {isa = PBXBuildFile; fileRef = A622A8F7122C44A600A785B3 /* BindingSecurityBase.h */; };
 		A622A8FF122C44A600A785B3 /* GenericBinding.h in Headers */ = {isa = PBXBuildFile; fileRef = A622A8F9122C44A600A785B3 /* GenericBinding.h */; };
 		A6D169621346B49B000EB770 /* ShadowRoot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A6D169611346B49B000EB770 /* ShadowRoot.cpp */; };
 		A6D169641346B4C1000EB770 /* ShadowRoot.h in Headers */ = {isa = PBXBuildFile; fileRef = A6D169631346B4C1000EB770 /* ShadowRoot.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3834,7 +3837,6 @@
 		A7B6E69F0B291A9600D0529F /* DragData.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B6E69D0B291A9600D0529F /* DragData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7BBE26611AFB3F20005EA03 /* JSHTMLMeterElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7BBE26411AFB3F20005EA03 /* JSHTMLMeterElement.cpp */; };
 		A7BBE26711AFB3F20005EA03 /* JSHTMLMeterElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A7BBE26511AFB3F20005EA03 /* JSHTMLMeterElement.h */; };
-		A7BE7EDF14C9175A0014489D /* FastMallocStatistics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7BE7EDC14C9175A0014489D /* FastMallocStatistics.cpp */; };
 		A7BF7EDF14C9175A0014489D /* InternalSettings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7BF7EDC14C9175A0014489D /* InternalSettings.cpp */; };
 		A7BF7EE014C9175A0014489D /* InternalSettings.h in Headers */ = {isa = PBXBuildFile; fileRef = A7BF7EDD14C9175A0014489D /* InternalSettings.h */; };
 		A7C9ABF81357A3BF00F5503F /* DetailsMarkerControl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C9ABF61357A3BF00F5503F /* DetailsMarkerControl.cpp */; };
@@ -4824,6 +4826,7 @@
 		B27535740B053814002CE64F /* IntRect.h in Headers */ = {isa = PBXBuildFile; fileRef = B27535460B053814002CE64F /* IntRect.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B27535750B053814002CE64F /* IntSize.h in Headers */ = {isa = PBXBuildFile; fileRef = B27535470B053814002CE64F /* IntSize.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B27535760B053814002CE64F /* IntSizeHash.h in Headers */ = {isa = PBXBuildFile; fileRef = B27535480B053814002CE64F /* IntSizeHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		6B3480940EEF50D400AC1B41 /* NativeImagePtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 6B3480920EEF50D400AC1B41 /* NativeImagePtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B27535770B053814002CE64F /* ColorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = B275354A0B053814002CE64F /* ColorMac.mm */; };
 		B27535780B053814002CE64F /* FloatPointMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = B275354B0B053814002CE64F /* FloatPointMac.mm */; };
 		B27535790B053814002CE64F /* FloatRectMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = B275354C0B053814002CE64F /* FloatRectMac.mm */; };
@@ -5908,11 +5911,10 @@
 		D3D4E973130C7CFE007BA540 /* HTMLSummaryElement.h in Headers */ = {isa = PBXBuildFile; fileRef = D3D4E971130C7CFE007BA540 /* HTMLSummaryElement.h */; };
 		D619A307144E00BE004BC302 /* ChildListMutationScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D619A305144E00BE004BC302 /* ChildListMutationScope.cpp */; };
 		D619A308144E00BE004BC302 /* ChildListMutationScope.h in Headers */ = {isa = PBXBuildFile; fileRef = D619A306144E00BE004BC302 /* ChildListMutationScope.h */; };
-		D630E2AC149BF344005B2F93 /* HistogramSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = D630E2AB149BF344005B2F93 /* HistogramSupport.h */; };
+		D630E2AC149BF344005B2F93 /* LayoutTestSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = D630E2AB149BF344005B2F97 /* LayoutTestSupport.h */; };
 		D630E2AC149BF344005B2F94 /* StatsCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = D630E2AB149BF344005B2F94 /* StatsCounter.h */; };
 		D630E2AC149BF344005B2F95 /* MemoryUsageSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = D630E2AB149BF344005B2F95 /* MemoryUsageSupport.h */; };
 		D630E2AC149BF344005B2F96 /* EventTracer.h in Headers */ = {isa = PBXBuildFile; fileRef = D630E2AB149BF344005B2F96 /* EventTracer.h */; };
-		D630E2AC149BF344005B2F93 /* LayoutTestSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = D630E2AB149BF344005B2F97 /* LayoutTestSupport.h */; };
 		D6E276AF14637455001D280A /* MutationObserverRegistration.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D6E276AD14637455001D280A /* MutationObserverRegistration.cpp */; };
 		D6E276B014637455001D280A /* MutationObserverRegistration.h in Headers */ = {isa = PBXBuildFile; fileRef = D6E276AE14637455001D280A /* MutationObserverRegistration.h */; };
 		D6E528A3149A926D00EFE1F3 /* MutationObserverInterestGroup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D6E528A1149A926D00EFE1F3 /* MutationObserverInterestGroup.cpp */; };
@@ -6142,6 +6144,7 @@
 		F33F0282120947F200E5743A /* ScriptProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F33F0281120947F200E5743A /* ScriptProfile.cpp */; };
 		F33F053D120B0DA500E5743A /* InspectorDebuggerAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F33F053B120B0DA500E5743A /* InspectorDebuggerAgent.cpp */; };
 		F33F053E120B0DA500E5743A /* InspectorDebuggerAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = F33F053C120B0DA500E5743A /* InspectorDebuggerAgent.h */; };
+		F343A70A15D3F56E0032D016 /* SubstituteData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F343A70915D3F56E0032D016 /* SubstituteData.cpp */; };
 		F344C7141125B82C00F26EEE /* InspectorFrontendClient.h in Headers */ = {isa = PBXBuildFile; fileRef = F344C7121125B82C00F26EEE /* InspectorFrontendClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F344C75311294D9D00F26EEE /* InspectorFrontendClientLocal.h in Headers */ = {isa = PBXBuildFile; fileRef = F344C75211294D9D00F26EEE /* InspectorFrontendClientLocal.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F344C75811294FF600F26EEE /* InspectorFrontendClientLocal.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F344C75711294FF600F26EEE /* InspectorFrontendClientLocal.cpp */; };
@@ -6175,6 +6178,7 @@
 		F39BE95B12673BF400E0A674 /* ScriptArguments.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F39BE95912673BF400E0A674 /* ScriptArguments.cpp */; };
 		F39BE95C12673BF400E0A674 /* ScriptArguments.h in Headers */ = {isa = PBXBuildFile; fileRef = F39BE95A12673BF400E0A674 /* ScriptArguments.h */; };
 		F3ABFE0C130E9DA000E7F7D1 /* InstrumentingAgents.h in Headers */ = {isa = PBXBuildFile; fileRef = F3ABFE0B130E9DA000E7F7D1 /* InstrumentingAgents.h */; };
+		F3BFC9D315C177EC004244E5 /* MemoryInstrumentation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3BFC9D215C177EC004244E5 /* MemoryInstrumentation.cpp */; };
 		F3D461481161D53200CA0D09 /* JSErrorHandler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3D461461161D53200CA0D09 /* JSErrorHandler.cpp */; };
 		F3D461491161D53200CA0D09 /* JSErrorHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = F3D461471161D53200CA0D09 /* JSErrorHandler.h */; };
 		F3D4C47812E07663003DA150 /* InspectorDOMDebuggerAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3D4C47612E07663003DA150 /* InspectorDOMDebuggerAgent.cpp */; };
@@ -6193,6 +6197,8 @@
 		F5122C901547FA1B0028A93B /* PagePopupDriver.h in Headers */ = {isa = PBXBuildFile; fileRef = F5122C8F1547FA1B0028A93B /* PagePopupDriver.h */; };
 		F5142C69123F12B000F5BD4C /* LocalizedNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = F5142C68123F12B000F5BD4C /* LocalizedNumber.h */; };
 		F52AD5E41534245F0059FBE6 /* EmptyClients.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F52AD5E31534245F0059FBE6 /* EmptyClients.cpp */; };
+		F544F78815CFB2A800AF33A8 /* NumberLocalizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F544F78615CFB2A800AF33A8 /* NumberLocalizer.cpp */; };
+		F544F78915CFB2A800AF33A8 /* NumberLocalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = F544F78715CFB2A800AF33A8 /* NumberLocalizer.h */; };
 		F553B89315BE26C000B134C9 /* WrapShapes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F553B89215BE26C000B134C9 /* WrapShapes.cpp */; };
 		F55B3DAD1251F12D003EF269 /* BaseTextInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F55B3D791251F12D003EF269 /* BaseTextInputType.cpp */; };
 		F55B3DAE1251F12D003EF269 /* BaseTextInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = F55B3D7A1251F12D003EF269 /* BaseTextInputType.h */; };
@@ -6244,6 +6250,8 @@
 		F55B3DDE1251F12D003EF269 /* URLInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = F55B3DAA1251F12D003EF269 /* URLInputType.h */; };
 		F55B3DDF1251F12D003EF269 /* WeekInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F55B3DAB1251F12D003EF269 /* WeekInputType.cpp */; };
 		F55B3DE01251F12D003EF269 /* WeekInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = F55B3DAC1251F12D003EF269 /* WeekInputType.h */; };
+		F5973DE015CFB2030027F804 /* LocaleMac.h in Headers */ = {isa = PBXBuildFile; fileRef = F5973DDE15CFB2030027F804 /* LocaleMac.h */; };
+		F5973DE115CFB2030027F804 /* LocaleMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = F5973DDF15CFB2030027F804 /* LocaleMac.mm */; };
 		F59C95FF1255B23F000623C0 /* BaseDateAndTimeInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F59C95FD1255B23F000623C0 /* BaseDateAndTimeInputType.cpp */; };
 		F59C96001255B23F000623C0 /* BaseDateAndTimeInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = F59C95FE1255B23F000623C0 /* BaseDateAndTimeInputType.h */; };
 		F5A154271279534D00D0B0C0 /* ValidationMessage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5A154251279534D00D0B0C0 /* ValidationMessage.cpp */; };
@@ -6411,6 +6419,8 @@
 		FD629EA3154B47160006D026 /* AudioBasicInspectorNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FD629EA1154B47160006D026 /* AudioBasicInspectorNode.h */; };
 		FD629EA4154B47160006D026 /* AudioBasicInspectorNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FD629EA2154B47160006D026 /* AudioBasicInspectorNode.cpp */; };
 		FD62F52E145898D80094B0ED /* AudioSourceProviderClient.h in Headers */ = {isa = PBXBuildFile; fileRef = FD62F52D145898D80094B0ED /* AudioSourceProviderClient.h */; };
+		FD671A77159BB07000197559 /* MediaStreamAudioSourceNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FD671A74159BB07000197559 /* MediaStreamAudioSourceNode.cpp */; };
+		FD671A78159BB07000197559 /* MediaStreamAudioSourceNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FD671A75159BB07000197559 /* MediaStreamAudioSourceNode.h */; };
 		FD6ED2C3136B8E42003CF072 /* DynamicsCompressorNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FD6ED2C1136B8E42003CF072 /* DynamicsCompressorNode.cpp */; };
 		FD6ED2C4136B8E42003CF072 /* DynamicsCompressorNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FD6ED2C2136B8E42003CF072 /* DynamicsCompressorNode.h */; };
 		FD6ED2C7136B8E66003CF072 /* DynamicsCompressor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FD6ED2C5136B8E66003CF072 /* DynamicsCompressor.cpp */; };
@@ -6429,7 +6439,6 @@
 		FD82D7F813D4C8BD004E4372 /* JSWaveShaperNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FD82D7F613D4C8BD004E4372 /* JSWaveShaperNode.h */; };
 		FD8C46EB154608E700A5910C /* AudioScheduledSourceNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FD8C46E9154608E700A5910C /* AudioScheduledSourceNode.cpp */; };
 		FD8C46EC154608E700A5910C /* AudioScheduledSourceNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FD8C46EA154608E700A5910C /* AudioScheduledSourceNode.h */; };
-		FD8E9BDF13D4CD2B0050DC72 /* JSWaveShaperNodeCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FD8E9BDE13D4CD2B0050DC72 /* JSWaveShaperNodeCustom.cpp */; };
 		FDA15E9D12B03EE1003A583A /* JSAudioBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDA15E8112B03EE1003A583A /* JSAudioBuffer.cpp */; };
 		FDA15E9E12B03EE1003A583A /* JSAudioBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = FDA15E8212B03EE1003A583A /* JSAudioBuffer.h */; };
 		FDA15E9F12B03EE1003A583A /* JSAudioBufferSourceNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDA15E8312B03EE1003A583A /* JSAudioBufferSourceNode.cpp */; };
@@ -6476,8 +6485,11 @@
 		FDB052E01561A42C00B500D6 /* AudioSummingJunction.h in Headers */ = {isa = PBXBuildFile; fileRef = FDB052DE1561A42C00B500D6 /* AudioSummingJunction.h */; };
 		FDB1700514A2BAB200A2B5D9 /* MultiChannelResampler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDB1700314A2BAB200A2B5D9 /* MultiChannelResampler.cpp */; };
 		FDB1700614A2BAB200A2B5D9 /* MultiChannelResampler.h in Headers */ = {isa = PBXBuildFile; fileRef = FDB1700414A2BAB200A2B5D9 /* MultiChannelResampler.h */; };
+		FDBD480C159BC6870093EB4F /* JSMediaStreamAudioSourceNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDBD480A159BC6870093EB4F /* JSMediaStreamAudioSourceNode.cpp */; };
+		FDBD480D159BC6870093EB4F /* JSMediaStreamAudioSourceNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FDBD480B159BC6870093EB4F /* JSMediaStreamAudioSourceNode.h */; };
 		FDC54F041399B0DA008D9117 /* BiquadFilterNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDC54F011399B0DA008D9117 /* BiquadFilterNode.cpp */; };
 		FDC54F051399B0DA008D9117 /* BiquadFilterNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FDC54F021399B0DA008D9117 /* BiquadFilterNode.h */; };
+		FDE2D55B159E66EB00DCCCF8 /* AudioIOCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = FDE2D55A159E66EB00DCCCF8 /* AudioIOCallback.h */; };
 		FDE6860215B0A93B00BB480C /* WrapShapeFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FD7E95A215ACD6090039E3D0 /* WrapShapeFunctions.cpp */; };
 		FDE6860315B0A96100BB480C /* WrapShapeFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = FD7E95A015ACD5620039E3D0 /* WrapShapeFunctions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FDE6860415B0A96100BB480C /* WrapShapes.h in Headers */ = {isa = PBXBuildFile; fileRef = FDB51CF4159CD70300E227C5 /* WrapShapes.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -6563,7 +6575,6 @@
 			dstSubfolderSpec = 1;
 			files = (
 				5DF7F5C20F01F92A00526B4B /* CSSPropertyNames.h in Copy Generated Headers */,
-				2D9A247615B9C2F400D34527 /* DOMDOMSecurityPolicy.h in Copy Generated Headers */,
 				8538F0300AD71CDB006A81D1 /* DOMAbstractView.h in Copy Generated Headers */,
 				1C11CCBC0AA6093700DADB20 /* DOMAttr.h in Copy Generated Headers */,
 				2E2D99EB10E2BD3900496337 /* DOMBlob.h in Copy Generated Headers */,
@@ -6595,6 +6606,7 @@
 				44311CD812E4E24B000A8D19 /* DOMDocumentPrivate.h in Copy Generated Headers */,
 				1C11CCC00AA6093700DADB20 /* DOMDocumentType.h in Copy Generated Headers */,
 				1C11CCC10AA6093700DADB20 /* DOMDOMImplementation.h in Copy Generated Headers */,
+				2D9A247615B9C2F400D34527 /* DOMDOMSecurityPolicy.h in Copy Generated Headers */,
 				1C11CCC40AA6093700DADB20 /* DOMElement.h in Copy Generated Headers */,
 				1CB4214B0AF2B2CA0085AD91 /* DOMElementInternal.h in Copy Generated Headers */,
 				5DD0A3810D9AC6070056C122 /* DOMElementTimeControl.h in Copy Generated Headers */,
@@ -7073,6 +7085,8 @@
 		070DD8F50F01868000727DEB /* mediaControls.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mediaControls.css; sourceTree = "<group>"; };
 		0720B09E14D3323500642955 /* GenericEventQueue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GenericEventQueue.cpp; sourceTree = "<group>"; };
 		0720B09F14D3323500642955 /* GenericEventQueue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GenericEventQueue.h; sourceTree = "<group>"; };
+		0720B09F14D3323500642956 /* GestureEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GestureEvent.cpp; sourceTree = "<group>"; };
+		0720B09F14D3323500642957 /* GestureEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GestureEvent.h; sourceTree = "<group>"; };
 		0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerProxy.h; sourceTree = "<group>"; };
 		0753860014489E9800B78452 /* CachedTextTrack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedTextTrack.cpp; sourceTree = "<group>"; };
 		0753860114489E9800B78452 /* CachedTextTrack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedTextTrack.h; sourceTree = "<group>"; };
@@ -7971,6 +7985,7 @@
 		319E69AF13299BBD004AC91A /* WebKitAnimationList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitAnimationList.cpp; sourceTree = "<group>"; };
 		319E69B013299BBD004AC91A /* WebKitAnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAnimationList.h; sourceTree = "<group>"; };
 		319E69B113299BBD004AC91A /* WebKitAnimationList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitAnimationList.idl; sourceTree = "<group>"; };
+		319FBD5D15D2F444009640A6 /* CachedImageClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedImageClient.h; sourceTree = "<group>"; };
 		31C0FF1B0E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitAnimationEvent.cpp; sourceTree = "<group>"; };
 		31C0FF1C0E4CEB6E007D6FE5 /* WebKitAnimationEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAnimationEvent.h; sourceTree = "<group>"; };
 		31C0FF1D0E4CEB6E007D6FE5 /* WebKitAnimationEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitAnimationEvent.idl; sourceTree = "<group>"; };
@@ -8386,6 +8401,8 @@
 		49AE2D95134EE5F90072920A /* CalculationValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CalculationValue.h; sourceTree = "<group>"; };
 		49AF2D6814435D050016A784 /* DisplayRefreshMonitor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DisplayRefreshMonitor.h; sourceTree = "<group>"; };
 		49AF2D6B14435D210016A784 /* DisplayRefreshMonitorMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DisplayRefreshMonitorMac.cpp; sourceTree = "<group>"; };
+		49B3760A15C6C6840059131D /* ArrayValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayValue.cpp; sourceTree = "<group>"; };
+		49B3760B15C6C6840059131D /* ArrayValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayValue.h; sourceTree = "<group>"; };
 		49C7B9801042D2D30009D447 /* JSWebGLBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLBuffer.cpp; sourceTree = "<group>"; };
 		49C7B9811042D2D30009D447 /* JSWebGLBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLBuffer.h; sourceTree = "<group>"; };
 		49C7B9821042D2D30009D447 /* JSInt8Array.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInt8Array.cpp; sourceTree = "<group>"; };
@@ -8487,13 +8504,6 @@
 		49EECEFF105070C400099FAB /* JSUint16Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSUint16Array.h; sourceTree = "<group>"; };
 		49EECF19105072F300099FAB /* JSArrayBufferView.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSArrayBufferView.cpp; sourceTree = "<group>"; };
 		49EECF1A105072F300099FAB /* JSArrayBufferView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayBufferView.h; sourceTree = "<group>"; };
-		49EECF7110508D9C00099FAB /* JSInt8ArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInt8ArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7210508D9C00099FAB /* JSFloat32ArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFloat32ArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7310508D9C00099FAB /* JSInt32ArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInt32ArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7410508D9C00099FAB /* JSInt16ArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInt16ArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7510508D9C00099FAB /* JSUint8ArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSUint8ArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7610508D9C00099FAB /* JSUint32ArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSUint32ArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7710508D9C00099FAB /* JSUint16ArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSUint16ArrayCustom.cpp; sourceTree = "<group>"; };
 		49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext.cpp; sourceTree = "<group>"; };
 		49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext.h; sourceTree = "<group>"; };
 		49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2D.cpp; sourceTree = "<group>"; };
@@ -8563,8 +8573,6 @@
 		4E1959260A39DACC00220FE5 /* MediaQueryEvaluator.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaQueryEvaluator.h; sourceTree = "<group>"; };
 		4E1959270A39DACC00220FE5 /* MediaQueryExp.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = MediaQueryExp.cpp; sourceTree = "<group>"; };
 		4E1959280A39DACC00220FE5 /* MediaQueryExp.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaQueryExp.h; sourceTree = "<group>"; };
-		4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMNodeHighlighter.cpp; sourceTree = "<group>"; };
-		4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMNodeHighlighter.h; sourceTree = "<group>"; };
 		4F1534DD11B532EC0021FD86 /* EditingBehavior.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehavior.h; sourceTree = "<group>"; };
 		4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehaviorTypes.h; sourceTree = "<group>"; };
 		4F2D205212EAE7B3005C2874 /* InspectorAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorAgent.h; sourceTree = "<group>"; };
@@ -8578,6 +8586,8 @@
 		4F6FDD631341DEDD001F8EE3 /* InspectorPageAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorPageAgent.h; sourceTree = "<group>"; };
 		4F707A9711EF679400ACDA69 /* InspectorBackendDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorBackendDispatcher.cpp; sourceTree = "<group>"; };
 		4F707A9811EF679400ACDA69 /* InspectorBackendDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorBackendDispatcher.h; sourceTree = "<group>"; };
+		4F8565E71530356E00FAE776 /* MemoryInstrumentationImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MemoryInstrumentationImpl.cpp; sourceTree = "<group>"; };
+		4F8565E81530356E00FAE776 /* MemoryInstrumentationImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryInstrumentationImpl.h; sourceTree = "<group>"; };
 		4FA3B908125CD12100300BAD /* InspectorState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorState.cpp; sourceTree = "<group>"; };
 		4FA3B909125CD12200300BAD /* InspectorState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorState.h; sourceTree = "<group>"; };
 		4FD8D0F0119C718B002FA825 /* ScriptGCEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptGCEvent.cpp; sourceTree = "<group>"; };
@@ -8611,6 +8621,8 @@
 		50D405F8147D31F300D30BB5 /* CustomFilterMesh.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterMesh.h; path = filters/CustomFilterMesh.h; sourceTree = "<group>"; };
 		50D4060F147D49DE00D30BB5 /* CustomFilterCompiledProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterCompiledProgram.cpp; path = filters/CustomFilterCompiledProgram.cpp; sourceTree = "<group>"; };
 		50D40610147D49DE00D30BB5 /* CustomFilterCompiledProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterCompiledProgram.h; path = filters/CustomFilterCompiledProgram.h; sourceTree = "<group>"; };
+		50D88CB315BDFDAA001809F4 /* CustomFilterProgramInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterProgramInfo.cpp; path = filters/CustomFilterProgramInfo.cpp; sourceTree = "<group>"; };
+		50D88CB415BDFDAA001809F4 /* CustomFilterProgramInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterProgramInfo.h; path = filters/CustomFilterProgramInfo.h; sourceTree = "<group>"; };
 		510184670B08602A004A825F /* CachedPage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedPage.h; sourceTree = "<group>"; };
 		510184680B08602A004A825F /* CachedPage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedPage.cpp; sourceTree = "<group>"; };
 		510D4A2D103165EE0049EA54 /* SocketStreamErrorBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamErrorBase.cpp; sourceTree = "<group>"; };
@@ -8963,7 +8975,6 @@
 		6E67D2A51280E8A4008758F7 /* Extensions3DOpenGL.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Extensions3DOpenGL.h; sourceTree = "<group>"; };
 		6E67D2A81280E8BD008758F7 /* Extensions3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Extensions3D.h; sourceTree = "<group>"; };
 		6EBC5D80138B4C4E00A0CF8A /* Float64Array.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Float64Array.idl; path = canvas/Float64Array.idl; sourceTree = "<group>"; };
-		6EBC5D84138B4CE000A0CF8A /* JSFloat64ArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFloat64ArrayCustom.cpp; sourceTree = "<group>"; };
 		6EBC5EAD138B50F200A0CF8A /* JSFloat64Array.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFloat64Array.cpp; sourceTree = "<group>"; };
 		6EBC5EAE138B50F200A0CF8A /* JSFloat64Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFloat64Array.h; sourceTree = "<group>"; };
 		6EBF0E4512A8926100DB1709 /* OESTextureFloat.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OESTextureFloat.cpp; path = canvas/OESTextureFloat.cpp; sourceTree = "<group>"; };
@@ -9121,6 +9132,8 @@
 		7B9184CF15758E420092AA93 /* UndoManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UndoManager.cpp; sourceTree = "<group>"; };
 		7B9184D015758E420092AA93 /* UndoManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UndoManager.h; sourceTree = "<group>"; };
 		7B9184D115758E420092AA93 /* UndoManager.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = UndoManager.idl; sourceTree = "<group>"; };
+		7C522D4915B477E8009B7C95 /* InspectorOverlay.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorOverlay.cpp; sourceTree = "<group>"; };
+		7C522D4A15B478B2009B7C95 /* InspectorOverlay.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorOverlay.h; sourceTree = "<group>"; };
 		7C60128060078BB70E367A95 /* DNSResolveQueue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DNSResolveQueue.cpp; sourceTree = "<group>"; };
 		7E33CD00127F340D00BE8F17 /* PurgePriority.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PurgePriority.h; sourceTree = "<group>"; };
 		7E37EF2D1339208800B29250 /* SubresourceLoaderCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SubresourceLoaderCF.cpp; path = cf/SubresourceLoaderCF.cpp; sourceTree = "<group>"; };
@@ -10221,7 +10234,6 @@
 		91089D2F14C335CD005AFC49 /* JSUint8ClampedArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSUint8ClampedArray.cpp; sourceTree = "<group>"; };
 		91089D3014C335CD005AFC49 /* JSUint8ClampedArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSUint8ClampedArray.h; sourceTree = "<group>"; };
 		91A3905814C0F4B900F67901 /* Uint8ClampedArray.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = Uint8ClampedArray.idl; path = canvas/Uint8ClampedArray.idl; sourceTree = "<group>"; };
-		91A3905A14C0F61100F67901 /* JSUint8ClampedArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSUint8ClampedArrayCustom.cpp; sourceTree = "<group>"; };
 		930062D7159B45B600ACD48A /* NEONHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NEONHelpers.h; sourceTree = "<group>"; };
 		9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageGroup.cpp; sourceTree = "<group>"; };
 		9302B0BE0D79F82C00C7EE83 /* PageGroup.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageGroup.h; sourceTree = "<group>"; };
@@ -10591,6 +10603,10 @@
 		9728C3121268E4390041E89B /* MarkupAccumulator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkupAccumulator.h; sourceTree = "<group>"; };
 		9738899E116EA9DC00ADF313 /* DocumentWriter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentWriter.cpp; sourceTree = "<group>"; };
 		9738899F116EA9DC00ADF313 /* DocumentWriter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentWriter.h; sourceTree = "<group>"; };
+		973AA3F215D088F000E38A85 /* BindingState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BindingState.cpp; sourceTree = "<group>"; };
+		973AA3F315D088F000E38A85 /* BindingState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BindingState.h; sourceTree = "<group>"; };
+		973AA3F715D0891B00E38A85 /* BindingSecurity.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = BindingSecurity.cpp; path = generic/BindingSecurity.cpp; sourceTree = "<group>"; };
+		973AA3F815D0891B00E38A85 /* BindingSecurity.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BindingSecurity.h; path = generic/BindingSecurity.h; sourceTree = "<group>"; };
 		973DC63D145A9409002842C2 /* ExceptionCodeDescription.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionCodeDescription.cpp; sourceTree = "<group>"; };
 		973DC63E145A9409002842C2 /* ExceptionCodeDescription.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionCodeDescription.h; sourceTree = "<group>"; };
 		973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceLoadNotifier.cpp; sourceTree = "<group>"; };
@@ -10915,6 +10931,8 @@
 		A1E1154313015C3D0054AC8C /* DistantLightSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DistantLightSource.cpp; path = filters/DistantLightSource.cpp; sourceTree = "<group>"; };
 		A1E1154513015C4E0054AC8C /* PointLightSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = PointLightSource.cpp; path = filters/PointLightSource.cpp; sourceTree = "<group>"; };
 		A1E1154713015C5D0054AC8C /* SpotLightSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SpotLightSource.cpp; path = filters/SpotLightSource.cpp; sourceTree = "<group>"; };
+		A24BF77915CC3BAF003191F2 /* WebKitCSSMixFunctionValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitCSSMixFunctionValue.h; sourceTree = "<group>"; };
+		A24BF77A15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitCSSMixFunctionValue.cpp; sourceTree = "<group>"; };
 		A3BB59F11457A40D00AC56FE /* DocumentEventQueue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentEventQueue.cpp; sourceTree = "<group>"; };
 		A3BB59F21457A40D00AC56FE /* DocumentEventQueue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentEventQueue.h; sourceTree = "<group>"; };
 		A3E2642E14748991005A8588 /* WorkerEventQueue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerEventQueue.cpp; path = workers/WorkerEventQueue.cpp; sourceTree = "<group>"; };
@@ -10955,9 +10973,6 @@
 		A6148A7612E41E3B0044A784 /* JSHTMLKeygenElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLKeygenElement.cpp; sourceTree = "<group>"; };
 		A6148A7712E41E3B0044A784 /* JSHTMLKeygenElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLKeygenElement.h; sourceTree = "<group>"; };
 		A6148A7F12E41ED10044A784 /* HTMLKeygenElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLKeygenElement.idl; sourceTree = "<group>"; };
-		A622A8F5122C44A600A785B3 /* BindingSecurity.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BindingSecurity.h; path = generic/BindingSecurity.h; sourceTree = "<group>"; };
-		A622A8F6122C44A600A785B3 /* BindingSecurityBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = BindingSecurityBase.cpp; path = generic/BindingSecurityBase.cpp; sourceTree = "<group>"; };
-		A622A8F7122C44A600A785B3 /* BindingSecurityBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BindingSecurityBase.h; path = generic/BindingSecurityBase.h; sourceTree = "<group>"; };
 		A622A8F9122C44A600A785B3 /* GenericBinding.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GenericBinding.h; path = generic/GenericBinding.h; sourceTree = "<group>"; };
 		A6D169611346B49B000EB770 /* ShadowRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ShadowRoot.cpp; sourceTree = "<group>"; };
 		A6D169631346B4C1000EB770 /* ShadowRoot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShadowRoot.h; sourceTree = "<group>"; };
@@ -11606,6 +11621,11 @@
 		B10B697E140C174000BC1C26 /* WebVTTTokenizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebVTTTokenizer.cpp; sourceTree = "<group>"; };
 		B10B697F140C174000BC1C26 /* WebVTTTokenizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebVTTTokenizer.h; sourceTree = "<group>"; };
 		B1827492134CA4C100B98C2D /* CallbackFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallbackFunction.cpp; sourceTree = "<group>"; };
+		B1A942DE15B5CE2200D525D1 /* MediaSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaSource.cpp; sourceTree = "<group>"; };
+		B1A942DF15B5CE2200D525D1 /* MediaSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaSource.h; sourceTree = "<group>"; };
+		B1A942E015B5CE2200D525D1 /* MediaSource.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = MediaSource.idl; sourceTree = "<group>"; };
+		B1A942E115B5CE2200D525D1 /* MediaSourceRegistry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaSourceRegistry.cpp; sourceTree = "<group>"; };
+		B1A942E215B5CE2200D525D1 /* MediaSourceRegistry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaSourceRegistry.h; sourceTree = "<group>"; };
 		B1A942E315B5CE2200D525D1 /* SourceBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SourceBuffer.cpp; sourceTree = "<group>"; };
 		B1A942E415B5CE2200D525D1 /* SourceBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceBuffer.h; sourceTree = "<group>"; };
 		B1A942E515B5CE2200D525D1 /* SourceBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SourceBuffer.idl; sourceTree = "<group>"; };
@@ -12044,6 +12064,7 @@
 		B27535460B053814002CE64F /* IntRect.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = IntRect.h; sourceTree = "<group>"; };
 		B27535470B053814002CE64F /* IntSize.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = IntSize.h; sourceTree = "<group>"; };
 		B27535480B053814002CE64F /* IntSizeHash.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = IntSizeHash.h; sourceTree = "<group>"; };
+		6B3480920EEF50D400AC1B41 /* NativeImagePtr.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = NativeImagePtr.h; sourceTree = "<group>"; };
 		B275354A0B053814002CE64F /* ColorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = ColorMac.mm; sourceTree = "<group>"; };
 		B275354B0B053814002CE64F /* FloatPointMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = FloatPointMac.mm; sourceTree = "<group>"; };
 		B275354C0B053814002CE64F /* FloatRectMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = FloatRectMac.mm; sourceTree = "<group>"; };
@@ -13194,7 +13215,7 @@
 		D630E2AB149BF344005B2F94 /* StatsCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StatsCounter.h; sourceTree = "<group>"; };
 		D630E2AB149BF344005B2F95 /* MemoryUsageSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryUsageSupport.h; sourceTree = "<group>"; };
 		D630E2AB149BF344005B2F96 /* EventTracer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventTracer.h; sourceTree = "<group>"; };
-		D630E2AB149BF344005B2F97 /* HistogramSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LayoutTestSupport.h; sourceTree = "<group>"; };
+		D630E2AB149BF344005B2F97 /* LayoutTestSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LayoutTestSupport.h; sourceTree = "<group>"; };
 		D6E276AD14637455001D280A /* MutationObserverRegistration.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutationObserverRegistration.cpp; sourceTree = "<group>"; };
 		D6E276AE14637455001D280A /* MutationObserverRegistration.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MutationObserverRegistration.h; sourceTree = "<group>"; };
 		D6E528A1149A926D00EFE1F3 /* MutationObserverInterestGroup.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutationObserverInterestGroup.cpp; sourceTree = "<group>"; };
@@ -13466,6 +13487,7 @@
 		F33F0281120947F200E5743A /* ScriptProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptProfile.cpp; sourceTree = "<group>"; };
 		F33F053B120B0DA500E5743A /* InspectorDebuggerAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorDebuggerAgent.cpp; sourceTree = "<group>"; };
 		F33F053C120B0DA500E5743A /* InspectorDebuggerAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorDebuggerAgent.h; sourceTree = "<group>"; };
+		F343A70915D3F56E0032D016 /* SubstituteData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SubstituteData.cpp; sourceTree = "<group>"; };
 		F344C7121125B82C00F26EEE /* InspectorFrontendClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendClient.h; sourceTree = "<group>"; };
 		F344C75211294D9D00F26EEE /* InspectorFrontendClientLocal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendClientLocal.h; sourceTree = "<group>"; };
 		F344C75711294FF600F26EEE /* InspectorFrontendClientLocal.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontendClientLocal.cpp; sourceTree = "<group>"; };
@@ -13499,6 +13521,7 @@
 		F39BE95912673BF400E0A674 /* ScriptArguments.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptArguments.cpp; sourceTree = "<group>"; };
 		F39BE95A12673BF400E0A674 /* ScriptArguments.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptArguments.h; sourceTree = "<group>"; };
 		F3ABFE0B130E9DA000E7F7D1 /* InstrumentingAgents.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InstrumentingAgents.h; sourceTree = "<group>"; };
+		F3BFC9D215C177EC004244E5 /* MemoryInstrumentation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MemoryInstrumentation.cpp; sourceTree = "<group>"; };
 		F3D461461161D53200CA0D09 /* JSErrorHandler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSErrorHandler.cpp; sourceTree = "<group>"; };
 		F3D461471161D53200CA0D09 /* JSErrorHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSErrorHandler.h; sourceTree = "<group>"; };
 		F3D4C47612E07663003DA150 /* InspectorDOMDebuggerAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorDOMDebuggerAgent.cpp; sourceTree = "<group>"; };
@@ -13525,6 +13548,8 @@
 		F523D30302DE4476018635CA /* Range.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Range.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F523D30402DE4476018635CA /* Range.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Range.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F52AD5E31534245F0059FBE6 /* EmptyClients.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EmptyClients.cpp; sourceTree = "<group>"; };
+		F544F78615CFB2A800AF33A8 /* NumberLocalizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NumberLocalizer.cpp; sourceTree = "<group>"; };
+		F544F78715CFB2A800AF33A8 /* NumberLocalizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumberLocalizer.h; sourceTree = "<group>"; };
 		F553B89215BE26C000B134C9 /* WrapShapes.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WrapShapes.cpp; path = style/WrapShapes.cpp; sourceTree = "<group>"; };
 		F55B3D791251F12D003EF269 /* BaseTextInputType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BaseTextInputType.cpp; sourceTree = "<group>"; };
 		F55B3D7A1251F12D003EF269 /* BaseTextInputType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BaseTextInputType.h; sourceTree = "<group>"; };
@@ -13582,6 +13607,8 @@
 		F587864902DE3A9A01EA4122 /* CachePolicy.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = CachePolicy.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F587866202DE3B1101EA4122 /* SSLKeyGenerator.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = SSLKeyGenerator.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F587868402DE3B8601EA4122 /* Cursor.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Cursor.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		F5973DDE15CFB2030027F804 /* LocaleMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocaleMac.h; sourceTree = "<group>"; };
+		F5973DDF15CFB2030027F804 /* LocaleMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LocaleMac.mm; sourceTree = "<group>"; };
 		F59C95FD1255B23F000623C0 /* BaseDateAndTimeInputType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BaseDateAndTimeInputType.cpp; sourceTree = "<group>"; };
 		F59C95FE1255B23F000623C0 /* BaseDateAndTimeInputType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BaseDateAndTimeInputType.h; sourceTree = "<group>"; };
 		F5A154251279534D00D0B0C0 /* ValidationMessage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ValidationMessage.cpp; sourceTree = "<group>"; };
@@ -13780,6 +13807,9 @@
 		FD629EA1154B47160006D026 /* AudioBasicInspectorNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AudioBasicInspectorNode.h; sourceTree = "<group>"; };
 		FD629EA2154B47160006D026 /* AudioBasicInspectorNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AudioBasicInspectorNode.cpp; sourceTree = "<group>"; };
 		FD62F52D145898D80094B0ED /* AudioSourceProviderClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AudioSourceProviderClient.h; sourceTree = "<group>"; };
+		FD671A74159BB07000197559 /* MediaStreamAudioSourceNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaStreamAudioSourceNode.cpp; sourceTree = "<group>"; };
+		FD671A75159BB07000197559 /* MediaStreamAudioSourceNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaStreamAudioSourceNode.h; sourceTree = "<group>"; };
+		FD671A76159BB07000197559 /* MediaStreamAudioSourceNode.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = MediaStreamAudioSourceNode.idl; sourceTree = "<group>"; };
 		FD6ED2C1136B8E42003CF072 /* DynamicsCompressorNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DynamicsCompressorNode.cpp; sourceTree = "<group>"; };
 		FD6ED2C2136B8E42003CF072 /* DynamicsCompressorNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DynamicsCompressorNode.h; sourceTree = "<group>"; };
 		FD6ED2C5136B8E66003CF072 /* DynamicsCompressor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DynamicsCompressor.cpp; sourceTree = "<group>"; };
@@ -13803,7 +13833,6 @@
 		FD82D7F613D4C8BD004E4372 /* JSWaveShaperNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWaveShaperNode.h; sourceTree = "<group>"; };
 		FD8C46E9154608E700A5910C /* AudioScheduledSourceNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AudioScheduledSourceNode.cpp; sourceTree = "<group>"; };
 		FD8C46EA154608E700A5910C /* AudioScheduledSourceNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AudioScheduledSourceNode.h; sourceTree = "<group>"; };
-		FD8E9BDE13D4CD2B0050DC72 /* JSWaveShaperNodeCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWaveShaperNodeCustom.cpp; sourceTree = "<group>"; };
 		FDA15E8112B03EE1003A583A /* JSAudioBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAudioBuffer.cpp; sourceTree = "<group>"; };
 		FDA15E8212B03EE1003A583A /* JSAudioBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSAudioBuffer.h; sourceTree = "<group>"; };
 		FDA15E8312B03EE1003A583A /* JSAudioBufferSourceNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAudioBufferSourceNode.cpp; sourceTree = "<group>"; };
@@ -13852,9 +13881,12 @@
 		FDB1700314A2BAB200A2B5D9 /* MultiChannelResampler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MultiChannelResampler.cpp; sourceTree = "<group>"; };
 		FDB1700414A2BAB200A2B5D9 /* MultiChannelResampler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MultiChannelResampler.h; sourceTree = "<group>"; };
 		FDB51CF4159CD70300E227C5 /* WrapShapes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WrapShapes.h; path = style/WrapShapes.h; sourceTree = "<group>"; };
+		FDBD480A159BC6870093EB4F /* JSMediaStreamAudioSourceNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMediaStreamAudioSourceNode.cpp; sourceTree = "<group>"; };
+		FDBD480B159BC6870093EB4F /* JSMediaStreamAudioSourceNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMediaStreamAudioSourceNode.h; sourceTree = "<group>"; };
 		FDC54F011399B0DA008D9117 /* BiquadFilterNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BiquadFilterNode.cpp; sourceTree = "<group>"; };
 		FDC54F021399B0DA008D9117 /* BiquadFilterNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BiquadFilterNode.h; sourceTree = "<group>"; };
 		FDC54F031399B0DA008D9117 /* BiquadFilterNode.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = BiquadFilterNode.idl; sourceTree = "<group>"; };
+		FDE2D55A159E66EB00DCCCF8 /* AudioIOCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AudioIOCallback.h; sourceTree = "<group>"; };
 		FDEA6240152102E200479DF0 /* JSOscillator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSOscillator.cpp; sourceTree = "<group>"; };
 		FDEA6241152102E200479DF0 /* JSOscillator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSOscillator.h; sourceTree = "<group>"; };
 		FDEA6244152102FC00479DF0 /* JSWaveTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWaveTable.cpp; sourceTree = "<group>"; };
@@ -14032,7 +14064,6 @@
 				1AE82EC90CAAE177002237AE /* storage */,
 				B22277CA0D00BF1E0071B782 /* svg */,
 				417DA4CD13734204007C57FB /* testing */,
-				FD315FA212B025B100C1A359 /* Modules/webaudio */,
 				2E4346310F546A6800B0F1BA /* workers */,
 				E1F0424309839389006694EA /* xml */,
 				656580EC09D12B20000E61D7 /* Derived Sources */,
@@ -14519,8 +14550,6 @@
 				59102FBA14327D3B003C9D04 /* ContentSearchUtils.h */,
 				7AABA25714BC613300AA9A11 /* DOMEditor.cpp */,
 				7AABA25814BC613300AA9A11 /* DOMEditor.h */,
-				4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */,
-				4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */,
 				7A54881614E432A1006AE05A /* DOMPatchSupport.cpp */,
 				7A54881514E432A1006AE05A /* DOMPatchSupport.h */,
 				5913A23F13D49EBA00F5B05C /* IdentifiersFactory.cpp */,
@@ -14592,6 +14621,8 @@
 				20D629251253690B00081543 /* InspectorInstrumentation.h */,
 				7AA51DD3148506A900AD2752 /* InspectorMemoryAgent.cpp */,
 				7AA51DD4148506A900AD2752 /* InspectorMemoryAgent.h */,
+				7C522D4915B477E8009B7C95 /* InspectorOverlay.cpp */,
+				7C522D4A15B478B2009B7C95 /* InspectorOverlay.h */,
 				4F6FDD621341DEDD001F8EE3 /* InspectorPageAgent.cpp */,
 				4F6FDD631341DEDD001F8EE3 /* InspectorPageAgent.h */,
 				9F0D6B2C121BFEBA006C0288 /* InspectorProfilerAgent.cpp */,
@@ -14621,6 +14652,8 @@
 				F3ABFE0B130E9DA000E7F7D1 /* InstrumentingAgents.h */,
 				1C81BA050E97348300266E07 /* JavaScriptCallFrame.idl */,
 				BCC64F5F0DCFB84E0081EF3B /* localizedStrings.js */,
+				4F8565E71530356E00FAE776 /* MemoryInstrumentationImpl.cpp */,
+				4F8565E81530356E00FAE776 /* MemoryInstrumentationImpl.h */,
 				59C27F04138D28C10079B7E2 /* NetworkResourcesData.cpp */,
 				59C27F06138D28CF0079B7E2 /* NetworkResourcesData.h */,
 				F382088A147D35F90010BC06 /* PageConsoleAgent.cpp */,
@@ -15627,8 +15660,6 @@
 		65BF02180974806300C43196 /* page */ = {
 			isa = PBXGroup;
 			children = (
-				2D9A246A15B9BBDD00D34527 /* DOMSecurityPolicy.cpp */,
-				2D9A246B15B9BBDD00D34527 /* DOMSecurityPolicy.h */,
 				316FE1060E6E1D8400BF6088 /* animation */,
 				93C09A820B064F05005ABD4D /* mac */,
 				1AF62EE114DA22A70041556C /* scrolling */,
@@ -15656,6 +15687,10 @@
 				975CA287130365F800E99AD9 /* Crypto.cpp */,
 				975CA288130365F800E99AD9 /* Crypto.h */,
 				975CA289130365F800E99AD9 /* Crypto.idl */,
+				CD37B37415C1A7E1006DC898 /* DiagnosticLoggingKeys.cpp */,
+				CD37B37515C1A7E1006DC898 /* DiagnosticLoggingKeys.h */,
+				2D9A246A15B9BBDD00D34527 /* DOMSecurityPolicy.cpp */,
+				2D9A246B15B9BBDD00D34527 /* DOMSecurityPolicy.h */,
 				BC5A86810C33676000EEA649 /* DOMSelection.cpp */,
 				BC5A86820C33676000EEA649 /* DOMSelection.h */,
 				BC5A86830C33676000EEA649 /* DOMSelection.idl */,
@@ -15800,8 +15835,6 @@
 				E1271A130EEEC80400F61213 /* WorkerNavigator.cpp */,
 				E1271A0A0EEEC77A00F61213 /* WorkerNavigator.h */,
 				E1271A510EEECD1C00F61213 /* WorkerNavigator.idl */,
-				CD37B37415C1A7E1006DC898 /* DiagnosticLoggingKeys.cpp */,
-				CD37B37515C1A7E1006DC898 /* DiagnosticLoggingKeys.h */,
 			);
 			path = page;
 			sourceTree = "<group>";
@@ -15904,9 +15937,6 @@
 		85967D9F0AA8BB59005FEDEE /* Core */ = {
 			isa = PBXGroup;
 			children = (
-				2D9A247215B9C2C700D34527 /* DOMDOMSecurityPolicy.mm */,
-				2D9A247015B9C29500D34527 /* DOMDOMSecurityPolicy.h */,
-				2D9A247115B9C29500D34527 /* DOMDOMSecurityPolicyInternal.h */,
 				85D389B00A991A7F00282145 /* DOMAttr.h */,
 				85D389B10A991A7F00282145 /* DOMAttr.mm */,
 				85089CCF0A98C42700A275AA /* DOMCDATASection.h */,
@@ -15925,6 +15955,9 @@
 				85CA975B0A962E5400690CCF /* DOMDocumentType.mm */,
 				8518DCE70A9CC80C0091B7A6 /* DOMDOMImplementation.h */,
 				8518DCE80A9CC80D0091B7A6 /* DOMDOMImplementation.mm */,
+				2D9A247015B9C29500D34527 /* DOMDOMSecurityPolicy.h */,
+				2D9A247215B9C2C700D34527 /* DOMDOMSecurityPolicy.mm */,
+				2D9A247115B9C29500D34527 /* DOMDOMSecurityPolicyInternal.h */,
 				85ACA9BE0A9B5FA500671E90 /* DOMElement.h */,
 				85ACA9BF0A9B5FA500671E90 /* DOMElement.mm */,
 				85CA96B60A9621A600690CCF /* DOMEntity.h */,
@@ -17596,11 +17629,12 @@
 		971145FE14EF006E00674FD9 /* Modules */ = {
 			isa = PBXGroup;
 			children = (
-				B1A942DD15B5CE2200D525D1 /* mediasource */,
 				971145FF14EF007900674FD9 /* geolocation */,
 				9712A55315004E3C0048AF10 /* indexeddb */,
+				B1A942DD15B5CE2200D525D1 /* mediasource */,
 				333F703D0FB49C16008E12A6 /* notifications */,
 				89F60B08157F68350075E157 /* quota */,
+				FD315FA212B025B100C1A359 /* webaudio */,
 				97BC69D51505F054001B74AC /* webdatabase */,
 				97AABCF714FA09B5007457AE /* websockets */,
 			);
@@ -18043,6 +18077,8 @@
 		A75E8B7F0E1DE2B0007F2481 /* filters */ = {
 			isa = PBXGroup;
 			children = (
+				50D88CB315BDFDAA001809F4 /* CustomFilterProgramInfo.cpp */,
+				50D88CB415BDFDAA001809F4 /* CustomFilterProgramInfo.h */,
 				49ECEB5C1499790D00CDD3A4 /* arm */,
 				50D4060F147D49DE00D30BB5 /* CustomFilterCompiledProgram.cpp */,
 				50D40610147D49DE00D30BB5 /* CustomFilterCompiledProgram.h */,
@@ -18993,6 +19029,7 @@
 				BC64B4CA0CB4295D005F2B62 /* CachedFont.h */,
 				BCB16C020979C3BD00467741 /* CachedImage.cpp */,
 				BCB16C030979C3BD00467741 /* CachedImage.h */,
+				319FBD5D15D2F444009640A6 /* CachedImageClient.h */,
 				D0EDA772143E303C0028E383 /* CachedRawResource.cpp */,
 				D0EDA773143E303C0028E383 /* CachedRawResource.h */,
 				BCB16C060979C3BD00467741 /* CachedResource.cpp */,
@@ -19039,6 +19076,11 @@
 		B1A942DD15B5CE2200D525D1 /* mediasource */ = {
 			isa = PBXGroup;
 			children = (
+				B1A942DE15B5CE2200D525D1 /* MediaSource.cpp */,
+				B1A942DF15B5CE2200D525D1 /* MediaSource.h */,
+				B1A942E015B5CE2200D525D1 /* MediaSource.idl */,
+				B1A942E115B5CE2200D525D1 /* MediaSourceRegistry.cpp */,
+				B1A942E215B5CE2200D525D1 /* MediaSourceRegistry.h */,
 				B1A942E315B5CE2200D525D1 /* SourceBuffer.cpp */,
 				B1A942E415B5CE2200D525D1 /* SourceBuffer.h */,
 				B1A942E515B5CE2200D525D1 /* SourceBuffer.idl */,
@@ -19792,6 +19834,7 @@
 				E4B41E0C0CBF90BD00AF2ECE /* MediaPlayer.cpp */,
 				E4B41E0D0CBF90BD00AF2ECE /* MediaPlayer.h */,
 				079F5E4B0F3BEBEA005E0782 /* MediaPlayerPrivate.h */,
+				6B3480920EEF50D400AC1B41 /* NativeImagePtr.h */,
 				B27535520B053814002CE64F /* Path.cpp */,
 				B27535530B053814002CE64F /* Path.h */,
 				A88DD4880B4629B000C02990 /* PathTraversalState.cpp */,
@@ -19863,6 +19906,8 @@
 				A5732B0C136A16C4005C8D7C /* LocalizedDate.h */,
 				A5732B0E136A1715005C8D7C /* LocalizedDateNone.cpp */,
 				F5142C68123F12B000F5BD4C /* LocalizedNumber.h */,
+				F544F78615CFB2A800AF33A8 /* NumberLocalizer.cpp */,
+				F544F78715CFB2A800AF33A8 /* NumberLocalizer.h */,
 				BC76AC110DD7AD5C00415F34 /* ParserUtilities.h */,
 				B2C3D9FB0D006C1D00EF6F26 /* PlatformString.h */,
 				379E371413736A6600B9E919 /* QuotedPrintable.cpp */,
@@ -19917,6 +19962,8 @@
 				B2AFFC850D00A5DF0030074D /* character-sets.txt */,
 				B2C3D9FA0D006C1D00EF6F26 /* CharsetData.h */,
 				375CD239119D44EA00A2A859 /* HyphenationMac.mm */,
+				F5973DDE15CFB2030027F804 /* LocaleMac.h */,
+				F5973DDF15CFB2030027F804 /* LocaleMac.mm */,
 				F5CC42DB12F801CA00D5F7E3 /* LocalizedNumberMac.mm */,
 				B2AFFC860D00A5DF0030074D /* mac-encodings.txt */,
 				B2AFFC870D00A5DF0030074D /* make-charset-table.pl */,
@@ -19974,9 +20021,8 @@
 			children = (
 				B5D31DF811CF610B009F22B4 /* ActiveDOMCallback.cpp */,
 				B5D31DF911CF610B009F22B4 /* ActiveDOMCallback.h */,
-				A622A8F5122C44A600A785B3 /* BindingSecurity.h */,
-				A622A8F6122C44A600A785B3 /* BindingSecurityBase.cpp */,
-				A622A8F7122C44A600A785B3 /* BindingSecurityBase.h */,
+				973AA3F715D0891B00E38A85 /* BindingSecurity.cpp */,
+				973AA3F815D0891B00E38A85 /* BindingSecurity.h */,
 				A622A8F9122C44A600A785B3 /* GenericBinding.h */,
 			);
 			name = generic;
@@ -20021,6 +20067,10 @@
 				BCCE58B41061E925008FB35A /* Constructors */,
 				BC4EDEF70C08F414007EDD49 /* Custom */,
 				14DFB33F0A7DF7630018F769 /* Derived Sources */,
+				49B3760A15C6C6840059131D /* ArrayValue.cpp */,
+				49B3760B15C6C6840059131D /* ArrayValue.h */,
+				973AA3F215D088F000E38A85 /* BindingState.cpp */,
+				973AA3F315D088F000E38A85 /* BindingState.h */,
 				BCD533630ED6848900887468 /* CachedScriptSourceProvider.h */,
 				93F8B3060A300FEA00F61AB8 /* CodeGeneratorJS.pm */,
 				312D67B01535691F00563D0D /* Dictionary.cpp */,
@@ -20202,8 +20252,6 @@
 				893C485212499B06002B3D86 /* JSEntrySyncCustom.cpp */,
 				BCEFAF4D0C317E6900FA81F6 /* JSEventCustom.cpp */,
 				2E7582ED12764F260062628B /* JSFileReaderCustom.cpp */,
-				49EECF7210508D9C00099FAB /* JSFloat32ArrayCustom.cpp */,
-				6EBC5D84138B4CE000A0CF8A /* JSFloat64ArrayCustom.cpp */,
 				FE80D7A60E9C1ED2000D6F75 /* JSGeolocationCustom.cpp */,
 				BCE7B1920D4E86960075A539 /* JSHistoryCustom.cpp */,
 				BC97E42B10915B060010D361 /* JSHTMLAllCollectionCustom.cpp */,
@@ -20236,9 +20284,6 @@
 				7A0E76D410BF050700A0276E /* JSInjectedScriptHostCustom.cpp */,
 				F316396D1329487600A649CB /* JSInjectedScriptManager.cpp */,
 				7A74ECBC101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp */,
-				49EECF7410508D9C00099FAB /* JSInt16ArrayCustom.cpp */,
-				49EECF7310508D9C00099FAB /* JSInt32ArrayCustom.cpp */,
-				49EECF7110508D9C00099FAB /* JSInt8ArrayCustom.cpp */,
 				FDEAAAFD12B02F4900DCF33B /* JSJavaScriptAudioNodeCustom.cpp */,
 				1C5FAEE60DCFDA6800D58F78 /* JSJavaScriptCallFrameCustom.cpp */,
 				BCE1C43F0D9830F4003B02F2 /* JSLocationCustom.cpp */,
@@ -20280,11 +20325,6 @@
 				07846384145B1B8E00A58DF1 /* JSTrackCustom.h */,
 				07B5A30A14687B8400A81ECE /* JSTrackEventCustom.cpp */,
 				516BB7920CE91E6800512F79 /* JSTreeWalkerCustom.cpp */,
-				49EECF7710508D9C00099FAB /* JSUint16ArrayCustom.cpp */,
-				49EECF7610508D9C00099FAB /* JSUint32ArrayCustom.cpp */,
-				49EECF7510508D9C00099FAB /* JSUint8ArrayCustom.cpp */,
-				91A3905A14C0F61100F67901 /* JSUint8ClampedArrayCustom.cpp */,
-				FD8E9BDE13D4CD2B0050DC72 /* JSWaveShaperNodeCustom.cpp */,
 				49EED14C1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp */,
 				319E68861327C911004AC91A /* JSWebKitAnimationCustom.cpp */,
 				3194623113022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp */,
@@ -20522,6 +20562,7 @@
 				D000ED2611C1B9CD00C47726 /* SubframeLoader.h */,
 				93E227DF0AF589AD00D48324 /* SubresourceLoader.cpp */,
 				656D37300ADBA5DE00A4554D /* SubresourceLoader.h */,
+				F343A70915D3F56E0032D016 /* SubstituteData.cpp */,
 				659A7D120B6DB4D9001155B3 /* SubstituteData.h */,
 				1A8F6B010DB53006001DB794 /* SubstituteResource.h */,
 				F523D27802DE43D7018635CA /* TextResourceDecoder.cpp */,
@@ -21137,6 +21178,8 @@
 				498391550F1E776900C23782 /* WebKitCSSMatrix.cpp */,
 				498391560F1E776900C23782 /* WebKitCSSMatrix.h */,
 				498391570F1E776900C23782 /* WebKitCSSMatrix.idl */,
+				A24BF77A15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.cpp */,
+				A24BF77915CC3BAF003191F2 /* WebKitCSSMixFunctionValue.h */,
 				8AA61CFD144D595B00F37350 /* WebKitCSSRegionRule.cpp */,
 				8AA61CFE144D595B00F37350 /* WebKitCSSRegionRule.h */,
 				8AD0A55614C87425000D83C5 /* WebKitCSSRegionRule.idl */,
@@ -21559,6 +21602,8 @@
 				A853123C11D0471B00D4D077 /* FragmentScriptingPermission.h */,
 				0720B09E14D3323500642955 /* GenericEventQueue.cpp */,
 				0720B09F14D3323500642955 /* GenericEventQueue.h */,
+				0720B09F14D3323500642956 /* GestureEvent.cpp */,
+				0720B09F14D3323500642957 /* GestureEvent.h */,
 				2442BBF81194C9D300D49469 /* HashChangeEvent.h */,
 				8482B7441198C32E00BFB005 /* HashChangeEvent.idl */,
 				45099C401370A7800058D513 /* IconURL.cpp */,
@@ -21574,6 +21619,7 @@
 				BC9A6144146859D9006057FD /* make_dom_exceptions.pl */,
 				BC9A6145146859D9006057FD /* make_event_factory.pl */,
 				BC9A6146146859D9006057FD /* make_names.pl */,
+				F3BFC9D215C177EC004244E5 /* MemoryInstrumentation.cpp */,
 				4F32BB1A14FA85AA00F6C1A3 /* MemoryInstrumentation.h */,
 				E1ADECCD0E76AD8B004A1A5E /* MessageChannel.cpp */,
 				E1ADECCC0E76AD8B004A1A5E /* MessageChannel.h */,
@@ -21745,6 +21791,8 @@
 				D7613A4E1474F13F00DB8606 /* WebKitNamedFlow.cpp */,
 				D7613A4D1474F13F00DB8606 /* WebKitNamedFlow.h */,
 				D7613A4A1474EE9500DB8606 /* WebKitNamedFlow.idl */,
+				12F35EB5158745A40035CB63 /* WebKitNamedFlowCollection.cpp */,
+				12F35EB4158745A40035CB63 /* WebKitNamedFlowCollection.h */,
 				31C0FF1E0E4CEB6E007D6FE5 /* WebKitTransitionEvent.cpp */,
 				31C0FF1F0E4CEB6E007D6FE5 /* WebKitTransitionEvent.h */,
 				31C0FF200E4CEB6E007D6FE5 /* WebKitTransitionEvent.idl */,
@@ -21753,8 +21801,6 @@
 				93EEC1F709C2877700C515D1 /* WheelEvent.idl */,
 				4123E568127B3041000FEEA7 /* WindowEventContext.cpp */,
 				4123E567127B3041000FEEA7 /* WindowEventContext.h */,
-				12F35EB4158745A40035CB63 /* WebKitNamedFlowCollection.h */,
-				12F35EB5158745A40035CB63 /* WebKitNamedFlowCollection.cpp */,
 			);
 			path = dom;
 			sourceTree = "<group>";
@@ -21791,7 +21837,7 @@
 			path = opengl;
 			sourceTree = "<group>";
 		};
-		FD315FA212B025B100C1A359 /* Modules/webaudio */ = {
+		FD315FA212B025B100C1A359 /* webaudio */ = {
 			isa = PBXGroup;
 			children = (
 				FD5686C713AC180200B69C68 /* AsyncAudioDecoder.cpp */,
@@ -21880,6 +21926,9 @@
 				FD6F252913F5EF0E0065165F /* MediaElementAudioSourceNode.cpp */,
 				FD6F252A13F5EF0E0065165F /* MediaElementAudioSourceNode.h */,
 				FD6F252B13F5EF0E0065165F /* MediaElementAudioSourceNode.idl */,
+				FD671A74159BB07000197559 /* MediaStreamAudioSourceNode.cpp */,
+				FD671A75159BB07000197559 /* MediaStreamAudioSourceNode.h */,
+				FD671A76159BB07000197559 /* MediaStreamAudioSourceNode.idl */,
 				FDA3E955134A49EF008D4B5A /* OfflineAudioCompletionEvent.cpp */,
 				FDA3E956134A49EF008D4B5A /* OfflineAudioCompletionEvent.h */,
 				FDA3E95D134A49FF008D4B5A /* OfflineAudioCompletionEvent.idl */,
@@ -21904,6 +21953,7 @@
 				FD581FB21520F93B003A7A75 /* WaveTable.h */,
 				FD581FB31520F93B003A7A75 /* WaveTable.idl */,
 			);
+			name = webaudio;
 			path = Modules/webaudio;
 			sourceTree = "<group>";
 		};
@@ -21921,6 +21971,7 @@
 				FD31604B12B026F700C1A359 /* AudioDSPKernelProcessor.cpp */,
 				FD31604C12B026F700C1A359 /* AudioDSPKernelProcessor.h */,
 				FD31604D12B026F700C1A359 /* AudioFileReader.h */,
+				FDE2D55A159E66EB00DCCCF8 /* AudioIOCallback.h */,
 				FD31604E12B026F700C1A359 /* AudioProcessor.h */,
 				FD31604F12B026F700C1A359 /* AudioResampler.cpp */,
 				FD31605012B026F700C1A359 /* AudioResampler.h */,
@@ -22041,6 +22092,8 @@
 				FDA15ECC12B03F61003A583A /* JSJavaScriptAudioNode.h */,
 				FD23A12313F5FA5900F67001 /* JSMediaElementAudioSourceNode.cpp */,
 				FD23A12413F5FA5900F67001 /* JSMediaElementAudioSourceNode.h */,
+				FDBD480A159BC6870093EB4F /* JSMediaStreamAudioSourceNode.cpp */,
+				FDBD480B159BC6870093EB4F /* JSMediaStreamAudioSourceNode.h */,
 				FDF6BAF6134A4C9800822920 /* JSOfflineAudioCompletionEvent.cpp */,
 				FDF6BAF7134A4C9800822920 /* JSOfflineAudioCompletionEvent.h */,
 				FDEA6240152102E200479DF0 /* JSOscillator.cpp */,
@@ -22062,7 +22115,6 @@
 			isa = PBXHeadersBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				A7BE7EE014C9175A0014489D /* FastMallocStatistics.h in Headers */,
 				417DA6DA13734E6E007C57FB /* Internals.h in Headers */,
 				A7BF7EE014C9175A0014489D /* InternalSettings.h in Headers */,
 				A740B59514C935AB00A77FA4 /* JSFastMallocStatistics.h in Headers */,
@@ -22077,8 +22129,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				97BC69DB1505F076001B74AC /* AbstractDatabase.h in Headers */,
-				FDE6860415B0A96100BB480C /* WrapShapes.h in Headers */,
-				FDE6860315B0A96100BB480C /* WrapShapeFunctions.h in Headers */,
 				41E1B1D10FF5986900576B3B /* AbstractWorker.h in Headers */,
 				29A8122E0FBB9C1D00510293 /* AccessibilityARIAGridCell.h in Headers */,
 				29A812330FBB9C1D00510293 /* AccessibilityARIAGridRow.h in Headers */,
@@ -22130,6 +22180,7 @@
 				512DD8FC0D91E6AF000F89EE /* ArchiveResource.h in Headers */,
 				512DD8F80D91E6AF000F89EE /* ArchiveResourceCollection.h in Headers */,
 				BCFB2F77097A2E1A00BA703D /* Arena.h in Headers */,
+				49B3760D15C6C6840059131D /* ArrayValue.h in Headers */,
 				FD5686CA13AC180200B69C68 /* AsyncAudioDecoder.h in Headers */,
 				E1CDE9221501916900862CC5 /* AsyncFileStream.h in Headers */,
 				89D08DA012228451001241DF /* AsyncFileSystem.h in Headers */,
@@ -22159,6 +22210,7 @@
 				FD3160BF12B0272A00C1A359 /* AudioFileReaderMac.h in Headers */,
 				FD31600A12B0267600C1A359 /* AudioGain.h in Headers */,
 				FD31600D12B0267600C1A359 /* AudioGainNode.h in Headers */,
+				FDE2D55B159E66EB00DCCCF8 /* AudioIOCallback.h in Headers */,
 				FD31601012B0267600C1A359 /* AudioListener.h in Headers */,
 				FD31601312B0267600C1A359 /* AudioNode.h in Headers */,
 				FD31601612B0267600C1A359 /* AudioNodeInput.h in Headers */,
@@ -22201,8 +22253,8 @@
 				BCE789861120E7A60060ECE5 /* BidiRun.h in Headers */,
 				A8C402931348B2220063F1E5 /* BidiRunList.h in Headers */,
 				938192050F87E1EC00D5352A /* BinaryPropertyList.h in Headers */,
-				A622A8FB122C44A600A785B3 /* BindingSecurity.h in Headers */,
-				A622A8FD122C44A600A785B3 /* BindingSecurityBase.h in Headers */,
+				973AA3FA15D0891B00E38A85 /* BindingSecurity.h in Headers */,
+				973AA3F515D088F000E38A85 /* BindingState.h in Headers */,
 				F35AE5AC14925F5B004D5776 /* BindingVisitors.h in Headers */,
 				FD31608D12B026F700C1A359 /* Biquad.h in Headers */,
 				FD31602512B0267600C1A359 /* BiquadDSPKernel.h in Headers */,
@@ -22541,6 +22593,8 @@
 				85E711960AC5D5350053270F /* DOMDocumentTypeInternal.h in Headers */,
 				8518DCE90A9CC80D0091B7A6 /* DOMDOMImplementation.h in Headers */,
 				85E711970AC5D5350053270F /* DOMDOMImplementationInternal.h in Headers */,
+				2D9A247415B9C2E300D34527 /* DOMDOMSecurityPolicy.h in Headers */,
+				2D9A247515B9C2E300D34527 /* DOMDOMSecurityPolicyInternal.h in Headers */,
 				9B3A8872145632F9003AE8F5 /* DOMDOMSettableTokenList.h in Headers */,
 				7694565B1214DB630007CBAE /* DOMDOMTokenList.h in Headers */,
 				7AABA25A14BC613300AA9A11 /* DOMEditor.h in Headers */,
@@ -22718,7 +22772,6 @@
 				85E711D20AC5D5350053270F /* DOMNamedNodeMapInternal.h in Headers */,
 				853BF4DB0ABB6B55008647BB /* DOMNode.h in Headers */,
 				854075260AD6C66700620C57 /* DOMNodeFilter.h in Headers */,
-				4F1442291339FD6200E0D6F8 /* DOMNodeHighlighter.h in Headers */,
 				85B498FB0ADB340200925CBB /* DOMNodeInternal.h in Headers */,
 				85526C370AB0A17E000302EA /* DOMNodeIterator.h in Headers */,
 				850B41C20AD9E7E700A6ED4F /* DOMNodeIteratorInternal.h in Headers */,
@@ -22749,6 +22802,7 @@
 				85E711D60AC5D5350053270F /* DOMRectInternal.h in Headers */,
 				855D358A0AD707310019AAC7 /* DOMRGBColor.h in Headers */,
 				BCD0FC4F0DBD720B00B2F630 /* DOMRGBColorInternal.h in Headers */,
+				2D9A246E15B9BD0000D34527 /* DOMSecurityPolicy.h in Headers */,
 				BC5A86850C33676000EEA649 /* DOMSelection.h in Headers */,
 				4ACBC0C412713CCA0094F9B2 /* DOMSettableTokenList.h in Headers */,
 				C544274B11A57E7A0063A749 /* DOMStringList.h in Headers */,
@@ -22862,8 +22916,6 @@
 				8502AB5A0AD438C000378540 /* DOMSVGFEImageElement.h in Headers */,
 				8502AB9B0AD4394E00378540 /* DOMSVGFEImageElementInternal.h in Headers */,
 				8502AB5C0AD438C000378540 /* DOMSVGFEMergeElement.h in Headers */,
-				2D9A247415B9C2E300D34527 /* DOMDOMSecurityPolicy.h in Headers */,
-				2D9A247515B9C2E300D34527 /* DOMDOMSecurityPolicyInternal.h in Headers */,
 				8502AB9C0AD4394E00378540 /* DOMSVGFEMergeElementInternal.h in Headers */,
 				8502AB5E0AD438C000378540 /* DOMSVGFEMergeNodeElement.h in Headers */,
 				8502AB9D0AD4394E00378540 /* DOMSVGFEMergeNodeElementInternal.h in Headers */,
@@ -23310,6 +23362,7 @@
 				9746AF2814F4DDE6003E7A70 /* GeolocationError.h in Headers */,
 				9746AF2914F4DDE6003E7A70 /* GeolocationPosition.h in Headers */,
 				9746AF2A14F4DDE6003E7A70 /* Geoposition.h in Headers */,
+				0720B0A114D3323500642957 /* GestureEvent.h in Headers */,
 				086BBD0F136039C2008B15D8 /* Glyph.h in Headers */,
 				B2C3DA6C0D006CD600EF6F26 /* GlyphBuffer.h in Headers */,
 				C5D4AA7A116BAFB60069CA93 /* GlyphMetricsMap.h in Headers */,
@@ -23330,7 +23383,6 @@
 				8482B7461198C35400BFB005 /* HashChangeEvent.h in Headers */,
 				A8748BE012CBF2DC001FBA41 /* HashTools.h in Headers */,
 				F55B3DC01251F12D003EF269 /* HiddenInputType.h in Headers */,
-				D630E2AC149BF344005B2F93 /* HistogramSupport.h in Headers */,
 				BC94D1540C275C8B006BC617 /* History.h in Headers */,
 				97DCE20210807C750057D394 /* HistoryController.h in Headers */,
 				51741D110B07259A00ED442C /* HistoryItem.h in Headers */,
@@ -23378,7 +23430,6 @@
 				977B386D122883E900B81FF8 /* HTMLEntityTable.h in Headers */,
 				A81369D4097374F600D74463 /* HTMLFieldSetElement.h in Headers */,
 				A8CFF7A60A156978000A4234 /* HTMLFontElement.h in Headers */,
-				2D9A246E15B9BD0000D34527 /* DOMSecurityPolicy.h in Headers */,
 				977B386F122883E900B81FF8 /* HTMLFormattingElementList.h in Headers */,
 				A8DF3FCE097FA0FC0052981B /* HTMLFormCollection.h in Headers */,
 				A81369CE097374F600D74463 /* HTMLFormControlElement.h in Headers */,
@@ -23518,6 +23569,8 @@
 				49E911C50EF86D47009D0CAF /* IdentityTransformOperation.h in Headers */,
 				C0C054CD1118C8E400CE2636 /* IDLParser.pm in Headers */,
 				C0C054CE1118C8E400CE2636 /* IDLStructure.pm in Headers */,
+				C3CF17A515B0063F00276D39 /* IdTargetObserver.h in Headers */,
+				C3CF17A715B0063F00276D39 /* IdTargetObserverRegistry.h in Headers */,
 				8AB4BC77126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h in Headers */,
 				B27535700B053814002CE64F /* Image.h in Headers */,
 				B2A10B920B3818BD00099AA4 /* ImageBuffer.h in Headers */,
@@ -23582,6 +23635,7 @@
 				7ACD88D414C08BD60084EDD2 /* InspectorIndexedDBAgent.h in Headers */,
 				20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */,
 				7AA51DD6148506A900AD2752 /* InspectorMemoryAgent.h in Headers */,
+				7C522D4C15B478B2009B7C95 /* InspectorOverlay.h in Headers */,
 				4F6FDD651341DEDD001F8EE3 /* InspectorPageAgent.h in Headers */,
 				9F0D6B2F121BFEBA006C0288 /* InspectorProfilerAgent.h in Headers */,
 				82AB1776125C826700C5069D /* InspectorResourceAgent.h in Headers */,
@@ -23864,6 +23918,7 @@
 				E44614190CD6826900FADA75 /* JSMediaError.h in Headers */,
 				BC3C39B70C0D3D8D005F4D7A /* JSMediaList.h in Headers */,
 				D3A94A47122DC40F00A37BBC /* JSMediaQueryList.h in Headers */,
+				FDBD480D159BC6870093EB4F /* JSMediaStreamAudioSourceNode.h in Headers */,
 				9FFE3EA611B5A4390037874E /* JSMemoryInfo.h in Headers */,
 				E107400E0E77BDC00033AF24 /* JSMessageChannel.h in Headers */,
 				75793EC90D0CE72D007FC0AC /* JSMessageEvent.h in Headers */,
@@ -23871,6 +23926,7 @@
 				41F584C7104652CB009CAA64 /* JSMessagePortCustom.h in Headers */,
 				898785B7122CA2A7003AABDA /* JSMetadata.h in Headers */,
 				898785B9122CA2A7003AABDA /* JSMetadataCallback.h in Headers */,
+				1059457A15B42A43004D37FD /* JSMicroDataItemValue.h in Headers */,
 				A86629D109DA2B48009633A5 /* JSMouseEvent.h in Headers */,
 				C6F0902914327D4F00685849 /* JSMutationCallback.h in Headers */,
 				65DF31FC09D1CC60000BE325 /* JSMutationEvent.h in Headers */,
@@ -23904,6 +23960,7 @@
 				598365DF1355F562001B185D /* JSPositionErrorCallback.h in Headers */,
 				65DF320009D1CC60000BE325 /* JSProcessingInstruction.h in Headers */,
 				E44613EE0CD681BB00FADA75 /* JSProgressEvent.h in Headers */,
+				1059459F15B42B1A004D37FD /* JSPropertyNodeList.h in Headers */,
 				B658FFA21522EF3A00DD5595 /* JSRadioNodeList.h in Headers */,
 				65DF320209D1CC60000BE325 /* JSRange.h in Headers */,
 				D23CA55D0AB0EAAE005108A5 /* JSRangeException.h in Headers */,
@@ -24165,7 +24222,7 @@
 				2917B5631473496C0052C9D0 /* LayerFlushSchedulerClient.h in Headers */,
 				A12538D413F9B60A00024754 /* LayoutRepainter.h in Headers */,
 				2D9066070BE141D400956998 /* LayoutState.h in Headers */,
-				D630E2AC149BF344005B2F97 /* LayoutTestSupport.h in Headers */,
+				D630E2AC149BF344005B2F93 /* LayoutTestSupport.h in Headers */,
 				BACF290113B2A0D500781F90 /* LayoutTypes.h in Headers */,
 				512DD8F50D91E6AF000F89EE /* LegacyWebArchive.h in Headers */,
 				BCE65BEB0EACDF16007E4533 /* Length.h in Headers */,
@@ -24191,6 +24248,7 @@
 				656D37320ADBA5DE00A4554D /* LoaderNSURLExtras.h in Headers */,
 				7EE6846912D26E3800E79415 /* LoaderRunLoopCF.h in Headers */,
 				06E81ED70AB5D5E900C87837 /* LocalCurrentGraphicsContext.h in Headers */,
+				F5973DE015CFB2030027F804 /* LocaleMac.h in Headers */,
 				7633A72613D8B33A008501B6 /* LocaleToScriptMapping.h in Headers */,
 				89878568122CA064003AABDA /* LocalFileSystem.h in Headers */,
 				A5732B0D136A16C4005C8D7C /* LocalizedDate.h in Headers */,
@@ -24236,9 +24294,11 @@
 				D3A94A39122DABAC00A37BBC /* MediaQueryList.h in Headers */,
 				D3A94A3B122DABAC00A37BBC /* MediaQueryListListener.h in Headers */,
 				D3AA10F4123A98AA0092152B /* MediaQueryMatcher.h in Headers */,
+				FD671A78159BB07000197559 /* MediaStreamAudioSourceNode.h in Headers */,
 				BCB16C180979C3BD00467741 /* MemoryCache.h in Headers */,
 				9FFE3E7B11B59C5D0037874E /* MemoryInfo.h in Headers */,
 				4F32BB1B14FA85E800F6C1A3 /* MemoryInstrumentation.h in Headers */,
+				4F8565EA1530356E00FAE776 /* MemoryInstrumentationImpl.h in Headers */,
 				6571DCC81385E6A400702DD0 /* MemoryPressureHandler.h in Headers */,
 				D630E2AC149BF344005B2F95 /* MemoryUsageSupport.h in Headers */,
 				93309DFA099E64920056E581 /* MergeIdenticalElementsCommand.h in Headers */,
@@ -24270,6 +24330,7 @@
 				C6F08FBD1430FE8F00685849 /* MutationRecord.h in Headers */,
 				A81872230977D3C0005826D9 /* NamedNodeMap.h in Headers */,
 				A818721E0977D3C0005826D9 /* NameNodeList.h in Headers */,
+				6B3480940EEF50D400AC1B41 /* NativeImagePtr.h in Headers */,
 				E10B9B6C0B747599003ED890 /* NativeXPathNSResolver.h in Headers */,
 				93CCF0270AF6C52900018E89 /* NavigationAction.h in Headers */,
 				979F43D41075E44A0000F83B /* NavigationScheduler.h in Headers */,
@@ -24309,6 +24370,7 @@
 				1A927FD41416A15B003A83C8 /* nptypes.h in Headers */,
 				93500F3213FDE3BE0099EC24 /* NSScrollerImpDetails.h in Headers */,
 				F55B3DC81251F12D003EF269 /* NumberInputType.h in Headers */,
+				F544F78915CFB2A800AF33A8 /* NumberLocalizer.h in Headers */,
 				1A569D120D7E2B82007C3983 /* objc_class.h in Headers */,
 				1A569D140D7E2B82007C3983 /* objc_header.h in Headers */,
 				1A569D150D7E2B82007C3983 /* objc_instance.h in Headers */,
@@ -24420,6 +24482,7 @@
 				E44613EC0CD681B500FADA75 /* ProgressEvent.h in Headers */,
 				A715E653134BBBEC00D8E713 /* ProgressShadowElement.h in Headers */,
 				1A2A68240B5BEDE70002A480 /* ProgressTracker.h in Headers */,
+				1059459915B42AA0004D37FD /* PropertyNodeList.h in Headers */,
 				E4BBED0F14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h in Headers */,
 				514C76750CE923A1007EF3CD /* ProtectionSpace.h in Headers */,
 				51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */,
@@ -25222,6 +25285,7 @@
 				31288E730E3005D6003619AE /* WebKitCSSKeyframeRule.h in Headers */,
 				31288E750E3005D6003619AE /* WebKitCSSKeyframesRule.h in Headers */,
 				498391590F1E776900C23782 /* WebKitCSSMatrix.h in Headers */,
+				A24BF77B15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.h in Headers */,
 				8AA61D00144D595B00F37350 /* WebKitCSSRegionRule.h in Headers */,
 				29CD61DE146D02890068E82A /* WebKitCSSShaderValue.h in Headers */,
 				0562F9471573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.h in Headers */,
@@ -25290,6 +25354,8 @@
 				0B9056F90F2685F30095FF6A /* WorkerThreadableLoader.h in Headers */,
 				97AABD2D14FA09D5007457AE /* WorkerThreadableWebSocketChannel.h in Headers */,
 				93309E24099E64920056E581 /* WrapContentsInDummySpanCommand.h in Headers */,
+				FDE6860315B0A96100BB480C /* WrapShapeFunctions.h in Headers */,
+				FDE6860415B0A96100BB480C /* WrapShapes.h in Headers */,
 				9BAF3B2412C1A39800014BF1 /* WritingDirection.h in Headers */,
 				6565820209D1508D000E61D7 /* XLinkNames.h in Headers */,
 				00D0464B13C4D14500326FCC /* XMLCharacterReferenceParser.h in Headers */,
@@ -25331,11 +25397,9 @@
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */,
 				FD537353137B651800008DCE /* ZeroPole.h in Headers */,
-				C3CF17A515B0063F00276D39 /* IdTargetObserver.h in Headers */,
-				C3CF17A715B0063F00276D39 /* IdTargetObserverRegistry.h in Headers */,
-				1059457A15B42A43004D37FD /* JSMicroDataItemValue.h in Headers */,
-				1059459915B42AA0004D37FD /* PropertyNodeList.h in Headers */,
-				1059459F15B42B1A004D37FD /* JSPropertyNodeList.h in Headers */,
+				A24BF77B15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.h in Headers */,
+				50D88CB615BDFDAA001809F4 /* CustomFilterProgramInfo.h in Headers */,
+				319FBD5F15D2F464009640A6 /* CachedImageClient.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -25694,8 +25758,6 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				FDE6860215B0A93B00BB480C /* WrapShapeFunctions.cpp in Sources */,
-				2D9A247315B9C2D100D34527 /* DOMDOMSecurityPolicy.mm in Sources */,
 				97BC69DA1505F076001B74AC /* AbstractDatabase.cpp in Sources */,
 				41E1B1D00FF5986900576B3B /* AbstractWorker.cpp in Sources */,
 				0F29C16E1300C2E2002D794E /* AccessibilityAllInOne.cpp in Sources */,
@@ -25729,6 +25791,7 @@
 				512DD8FB0D91E6AF000F89EE /* ArchiveResource.cpp in Sources */,
 				512DD8F70D91E6AF000F89EE /* ArchiveResourceCollection.cpp in Sources */,
 				BCFB2F76097A2E1A00BA703D /* Arena.cpp in Sources */,
+				49B3760C15C6C6840059131D /* ArrayValue.cpp in Sources */,
 				FD5686C913AC180200B69C68 /* AsyncAudioDecoder.cpp in Sources */,
 				E1CDE92015018ED000862CC5 /* AsyncFileStream.cpp in Sources */,
 				89D08D9F12228451001241DF /* AsyncFileSystem.cpp in Sources */,
@@ -25780,7 +25843,8 @@
 				B2C3DA230D006C1D00EF6F26 /* BidiContext.cpp in Sources */,
 				BCE7898B1120E8020060ECE5 /* BidiRun.cpp in Sources */,
 				938192030F87E1E600D5352A /* BinaryPropertyList.cpp in Sources */,
-				A622A8FC122C44A600A785B3 /* BindingSecurityBase.cpp in Sources */,
+				973AA3F915D0891B00E38A85 /* BindingSecurity.cpp in Sources */,
+				973AA3F415D088F000E38A85 /* BindingState.cpp in Sources */,
 				FD31608C12B026F700C1A359 /* Biquad.cpp in Sources */,
 				FD31602412B0267600C1A359 /* BiquadDSPKernel.cpp in Sources */,
 				FDC54F041399B0DA008D9117 /* BiquadFilterNode.cpp in Sources */,
@@ -25985,6 +26049,7 @@
 				59A8F1D411A69508001AC34A /* DeviceOrientationController.cpp in Sources */,
 				59D1C10411EB5DCF00B638C8 /* DeviceOrientationData.cpp in Sources */,
 				59A85EA2119D68D900DEF1EF /* DeviceOrientationEvent.cpp in Sources */,
+				CD37B39815C1B971006DC898 /* DiagnosticLoggingKeys.cpp in Sources */,
 				CECADFC6153778FF00E37068 /* DictationAlternative.cpp in Sources */,
 				CECADFC8153778FF00E37068 /* DictationCommand.cpp in Sources */,
 				312D67B11535691F00563D0D /* Dictionary.cpp in Sources */,
@@ -26044,6 +26109,7 @@
 				85089CDC0A98C42800A275AA /* DOMDocumentFragment.mm in Sources */,
 				85CA975D0A962E5400690CCF /* DOMDocumentType.mm in Sources */,
 				8518DCEA0A9CC80D0091B7A6 /* DOMDOMImplementation.mm in Sources */,
+				2D9A247315B9C2D100D34527 /* DOMDOMSecurityPolicy.mm in Sources */,
 				7694565C1214DB630007CBAE /* DOMDOMTokenList.mm in Sources */,
 				7AABA25914BC613300AA9A11 /* DOMEditor.cpp in Sources */,
 				85ACA9C10A9B5FA500671E90 /* DOMElement.mm in Sources */,
@@ -26136,7 +26202,6 @@
 				85C7F5C00AAFB7CD004014DD /* DOMMutationEvent.mm in Sources */,
 				8518DD790A9CF31B0091B7A6 /* DOMNamedNodeMap.mm in Sources */,
 				853BF4DC0ABB6B55008647BB /* DOMNode.mm in Sources */,
-				4F1442281339FD6200E0D6F8 /* DOMNodeHighlighter.cpp in Sources */,
 				85526C380AB0A17E000302EA /* DOMNodeIterator.mm in Sources */,
 				85ACAA8E0A9B759C00671E90 /* DOMNodeList.mm in Sources */,
 				85CA96EB0A9624E900690CCF /* DOMNotation.mm in Sources */,
@@ -26497,6 +26562,7 @@
 				9746AF2314F4DDE6003E7A70 /* Geolocation.cpp in Sources */,
 				052BFCE9128ABF1500FD338D /* GeolocationClientMock.cpp in Sources */,
 				9746AF2614F4DDE6003E7A70 /* GeolocationController.cpp in Sources */,
+				0720B0A014D3323500642956 /* GestureEvent.cpp in Sources */,
 				B2C3DA6D0D006CD600EF6F26 /* GlyphPageTreeNode.cpp in Sources */,
 				B2AFFC830D00A5C10030074D /* GlyphPageTreeNodeMac.cpp in Sources */,
 				BC53C6080DA56C570021EB5D /* Gradient.cpp in Sources */,
@@ -26683,6 +26749,8 @@
 				9712A60115004EDA0048AF10 /* IDBVersionChangeRequest.cpp in Sources */,
 				1A71D57B0F33819000F9CE4E /* IdentifierRep.cpp in Sources */,
 				5913A24113D49EBA00F5B05C /* IdentifiersFactory.cpp in Sources */,
+				C3CF17A415B0063F00276D39 /* IdTargetObserver.cpp in Sources */,
+				C3CF17A615B0063F00276D39 /* IdTargetObserverRegistry.cpp in Sources */,
 				B275356F0B053814002CE64F /* Image.cpp in Sources */,
 				43D2597713C816F400608559 /* ImageBuffer.cpp in Sources */,
 				B2A10B940B3818D700099AA4 /* ImageBufferCG.cpp in Sources */,
@@ -26740,6 +26808,7 @@
 				7ACD88D314C08BD60084EDD2 /* InspectorIndexedDBAgent.cpp in Sources */,
 				20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */,
 				7AA51DD5148506A900AD2752 /* InspectorMemoryAgent.cpp in Sources */,
+				7C522D4B15B477E8009B7C95 /* InspectorOverlay.cpp in Sources */,
 				4F6FDD641341DEDD001F8EE3 /* InspectorPageAgent.cpp in Sources */,
 				9F0D6B2E121BFEBA006C0288 /* InspectorProfilerAgent.cpp in Sources */,
 				82AB1775125C826700C5069D /* InspectorResourceAgent.cpp in Sources */,
@@ -26949,9 +27018,7 @@
 				46DA844D1224A0710060D006 /* JSFileWriter.cpp in Sources */,
 				893C47BB1238A0A9002B3D86 /* JSFileWriterCallback.cpp in Sources */,
 				49EECF02105070C400099FAB /* JSFloat32Array.cpp in Sources */,
-				49EECF7910508D9C00099FAB /* JSFloat32ArrayCustom.cpp in Sources */,
 				6EBC5EAF138B50F200A0CF8A /* JSFloat64Array.cpp in Sources */,
-				6EBC5D85138B4CE000A0CF8A /* JSFloat64ArrayCustom.cpp in Sources */,
 				FE80DA630E9C4703000D6F75 /* JSGeolocation.cpp in Sources */,
 				FE80D7AB0E9C1ED2000D6F75 /* JSGeolocationCustom.cpp in Sources */,
 				FE80DA650E9C4703000D6F75 /* JSGeoposition.cpp in Sources */,
@@ -27078,11 +27145,8 @@
 				7A0E771E10C00DB100A0276E /* JSInspectorFrontendHost.cpp in Sources */,
 				7A74ECBD101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp in Sources */,
 				49EECF06105070C400099FAB /* JSInt16Array.cpp in Sources */,
-				49EECF7B10508D9C00099FAB /* JSInt16ArrayCustom.cpp in Sources */,
 				49EECF04105070C400099FAB /* JSInt32Array.cpp in Sources */,
-				49EECF7A10508D9C00099FAB /* JSInt32ArrayCustom.cpp in Sources */,
 				49C7B9951042D2D30009D447 /* JSInt8Array.cpp in Sources */,
-				49EECF7810508D9C00099FAB /* JSInt8ArrayCustom.cpp in Sources */,
 				FDA15ECD12B03F61003A583A /* JSJavaScriptAudioNode.cpp in Sources */,
 				FDEAAAFE12B02F4900DCF33B /* JSJavaScriptAudioNodeCustom.cpp in Sources */,
 				1C5FAED10DCFD90100D58F78 /* JSJavaScriptCallFrame.cpp in Sources */,
@@ -27098,6 +27162,7 @@
 				BC3C39B60C0D3D8D005F4D7A /* JSMediaList.cpp in Sources */,
 				1464E06C135EC10600FDB00A /* JSMediaListCustom.cpp in Sources */,
 				D3A94A46122DC40F00A37BBC /* JSMediaQueryList.cpp in Sources */,
+				FDBD480C159BC6870093EB4F /* JSMediaStreamAudioSourceNode.cpp in Sources */,
 				9FFE3EA511B5A4390037874E /* JSMemoryInfo.cpp in Sources */,
 				9FDC8FF212FAB0060099AB1C /* JSMemoryInfoCustom.cpp in Sources */,
 				E107400D0E77BDC00033AF24 /* JSMessageChannel.cpp in Sources */,
@@ -27108,6 +27173,8 @@
 				E1ADED470E76B8DD004A1A5E /* JSMessagePortCustom.cpp in Sources */,
 				898785B6122CA2A7003AABDA /* JSMetadata.cpp in Sources */,
 				898785B8122CA2A7003AABDA /* JSMetadataCallback.cpp in Sources */,
+				1059457715B42A0D004D37FD /* JSMicroDataItemValue.cpp in Sources */,
+				1059457315B42953004D37FD /* JSMicroDataItemValueCustom.cpp in Sources */,
 				A86629D209DA2B48009633A5 /* JSMouseEvent.cpp in Sources */,
 				C6F0902814327D4F00685849 /* JSMutationCallback.cpp in Sources */,
 				C6F09185143A6C3B00685849 /* JSMutationCallbackCustom.cpp in Sources */,
@@ -27151,6 +27218,7 @@
 				65DF31FF09D1CC60000BE325 /* JSProcessingInstruction.cpp in Sources */,
 				E1AD12D61295D0BD00ACA989 /* JSProcessingInstructionCustom.cpp in Sources */,
 				E44613ED0CD681BA00FADA75 /* JSProgressEvent.cpp in Sources */,
+				1059459D15B42B0C004D37FD /* JSPropertyNodeList.cpp in Sources */,
 				B658FFA11522EF3A00DD5595 /* JSRadioNodeList.cpp in Sources */,
 				65DF320109D1CC60000BE325 /* JSRange.cpp in Sources */,
 				D23CA55F0AB0EAB6005108A5 /* JSRangeException.cpp in Sources */,
@@ -27362,17 +27430,12 @@
 				516BB7940CE91E6800512F79 /* JSTreeWalkerCustom.cpp in Sources */,
 				A86629D009DA2B48009633A5 /* JSUIEvent.cpp in Sources */,
 				49EECF0C105070C400099FAB /* JSUint16Array.cpp in Sources */,
-				49EECF7E10508D9C00099FAB /* JSUint16ArrayCustom.cpp in Sources */,
 				49EECF0A105070C400099FAB /* JSUint32Array.cpp in Sources */,
-				49EECF7D10508D9C00099FAB /* JSUint32ArrayCustom.cpp in Sources */,
 				49EECF08105070C400099FAB /* JSUint8Array.cpp in Sources */,
-				49EECF7C10508D9C00099FAB /* JSUint8ArrayCustom.cpp in Sources */,
 				91089D3314C33605005AFC49 /* JSUint8ClampedArray.cpp in Sources */,
-				91A3905B14C0F61100F67901 /* JSUint8ClampedArrayCustom.cpp in Sources */,
 				7B1EA0CE1576C5B50060177D /* JSUndoManager.cpp in Sources */,
 				15C77094100D3CA8005BA267 /* JSValidityState.cpp in Sources */,
 				FD82D7F713D4C8BD004E4372 /* JSWaveShaperNode.cpp in Sources */,
-				FD8E9BDF13D4CD2B0050DC72 /* JSWaveShaperNodeCustom.cpp in Sources */,
 				FDEA6246152102FC00479DF0 /* JSWaveTable.cpp in Sources */,
 				A7D20F62107F406900A80392 /* JSWebGLActiveInfo.cpp in Sources */,
 				49C7B9931042D2D30009D447 /* JSWebGLBuffer.cpp in Sources */,
@@ -27472,6 +27535,7 @@
 				656D37330ADBA5DE00A4554D /* LoaderNSURLExtras.mm in Sources */,
 				7EE6846812D26E3800E79415 /* LoaderRunLoopCF.cpp in Sources */,
 				06E81EEC0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm in Sources */,
+				F5973DE115CFB2030027F804 /* LocaleMac.mm in Sources */,
 				7633A72713D8B33A008501B6 /* LocaleToScriptMappingDefault.cpp in Sources */,
 				89878567122CA064003AABDA /* LocalFileSystem.cpp in Sources */,
 				A5732B0F136A1715005C8D7C /* LocalizedDateNone.cpp in Sources */,
@@ -27512,8 +27576,11 @@
 				D3A94A38122DABAC00A37BBC /* MediaQueryList.cpp in Sources */,
 				D340629B1253BC8C009E4259 /* MediaQueryListListener.cpp in Sources */,
 				D3AA10F3123A98AA0092152B /* MediaQueryMatcher.cpp in Sources */,
+				FD671A77159BB07000197559 /* MediaStreamAudioSourceNode.cpp in Sources */,
 				BCB16C170979C3BD00467741 /* MemoryCache.cpp in Sources */,
 				9FFE3E7A11B59C5D0037874E /* MemoryInfo.cpp in Sources */,
+				F3BFC9D315C177EC004244E5 /* MemoryInstrumentation.cpp in Sources */,
+				4F8565E91530356E00FAE776 /* MemoryInstrumentationImpl.cpp in Sources */,
 				657EDA081385CB97004E0645 /* MemoryPressureHandler.cpp in Sources */,
 				657EDA0B1385CBD8004E0645 /* MemoryPressureHandlerMac.mm in Sources */,
 				D6FDAEF3149C06190037B1E3 /* MemoryUsageSupport.cpp in Sources */,
@@ -27570,6 +27637,7 @@
 				1A569D0D0D7E2B82007C3983 /* npruntime.cpp in Sources */,
 				52F52E1114A0134F00ACC397 /* NSScrollerImpDetails.mm in Sources */,
 				F55B3DC71251F12D003EF269 /* NumberInputType.cpp in Sources */,
+				F544F78815CFB2A800AF33A8 /* NumberLocalizer.cpp in Sources */,
 				1A569D130D7E2B82007C3983 /* objc_class.mm in Sources */,
 				1A569D160D7E2B82007C3983 /* objc_instance.mm in Sources */,
 				1A569D180D7E2B82007C3983 /* objc_runtime.mm in Sources */,
@@ -27650,6 +27718,7 @@
 				E44613EB0CD681B400FADA75 /* ProgressEvent.cpp in Sources */,
 				A715E652134BBBEC00D8E713 /* ProgressShadowElement.cpp in Sources */,
 				1A2A68230B5BEDE70002A480 /* ProgressTracker.cpp in Sources */,
+				1059459715B42A8E004D37FD /* PropertyNodeList.cpp in Sources */,
 				E4BBED0E14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp in Sources */,
 				514C76740CE923A1007EF3CD /* ProtectionSpace.cpp in Sources */,
 				1AF8E13312565A4400230FF7 /* ProxyServer.cpp in Sources */,
@@ -27993,6 +28062,7 @@
 				F55B3DD31251F12D003EF269 /* SubmitInputType.cpp in Sources */,
 				93E227E40AF589AD00D48324 /* SubresourceLoader.cpp in Sources */,
 				7E37EF2E1339208800B29250 /* SubresourceLoaderCF.cpp in Sources */,
+				F343A70A15D3F56E0032D016 /* SubstituteData.cpp in Sources */,
 				93B2D8180F9920EE006AE6B2 /* SuddenTermination.mm in Sources */,
 				087558C513B4A57D00F49307 /* SurrogatePairAwareTextIterator.cpp in Sources */,
 				62C1217C11AB9E77003C462C /* SuspendableTimer.cpp in Sources */,
@@ -28299,6 +28369,7 @@
 				31288E720E3005D6003619AE /* WebKitCSSKeyframeRule.cpp in Sources */,
 				31288E740E3005D6003619AE /* WebKitCSSKeyframesRule.cpp in Sources */,
 				498391580F1E776900C23782 /* WebKitCSSMatrix.cpp in Sources */,
+				A24BF77C15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.cpp in Sources */,
 				8AA61CFF144D595B00F37350 /* WebKitCSSRegionRule.cpp in Sources */,
 				5038BC0714711CDB0095E0D1 /* WebKitCSSShaderValue.cpp in Sources */,
 				0562F9461573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.cpp in Sources */,
@@ -28357,6 +28428,8 @@
 				0B9056F80F2685F30095FF6A /* WorkerThreadableLoader.cpp in Sources */,
 				97AABD2C14FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp in Sources */,
 				93309E23099E64920056E581 /* WrapContentsInDummySpanCommand.cpp in Sources */,
+				FDE6860215B0A93B00BB480C /* WrapShapeFunctions.cpp in Sources */,
+				F553B89315BE26C000B134C9 /* WrapShapes.cpp in Sources */,
 				A833C7CC0A2CF07400D57664 /* XLinkNames.cpp in Sources */,
 				00D0464A13C4D14500326FCC /* XMLCharacterReferenceParser.cpp in Sources */,
 				00B9318713BA8DB30035A948 /* XMLDocumentParser.cpp in Sources */,
@@ -28397,14 +28470,7 @@
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				977E2E0E12F0FC9C00C13379 /* XSSAuditor.cpp in Sources */,
 				FD537352137B651800008DCE /* ZeroPole.cpp in Sources */,
-				C3CF17A415B0063F00276D39 /* IdTargetObserver.cpp in Sources */,
-				C3CF17A615B0063F00276D39 /* IdTargetObserverRegistry.cpp in Sources */,
-				F553B89315BE26C000B134C9 /* WrapShapes.cpp in Sources */,
-				1059457315B42953004D37FD /* JSMicroDataItemValueCustom.cpp in Sources */,
-				1059457715B42A0D004D37FD /* JSMicroDataItemValue.cpp in Sources */,
-				1059459715B42A8E004D37FD /* PropertyNodeList.cpp in Sources */,
-				1059459D15B42B0C004D37FD /* JSPropertyNodeList.cpp in Sources */,
-				CD37B39815C1B971006DC898 /* DiagnosticLoggingKeys.cpp in Sources */,
+				50D88CB515BDFDAA001809F4 /* CustomFilterProgramInfo.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebCore/accessibility/AXObjectCache.h b/Source/WebCore/accessibility/AXObjectCache.h
index b768b7dd8..603fce0c5 100644
--- a/Source/WebCore/accessibility/AXObjectCache.h
+++ b/Source/WebCore/accessibility/AXObjectCache.h
@@ -57,7 +57,7 @@ enum PostType { PostSynchronously, PostAsynchronously };
 class AXObjectCache {
     WTF_MAKE_NONCOPYABLE(AXObjectCache); WTF_MAKE_FAST_ALLOCATED;
 public:
-    AXObjectCache(const Document*);
+    explicit AXObjectCache(const Document*);
     ~AXObjectCache();
 
     static AccessibilityObject* focusedUIElementForPage(const Page*);
diff --git a/Source/WebCore/accessibility/AccessibilityARIAGrid.h b/Source/WebCore/accessibility/AccessibilityARIAGrid.h
index 063e18ba1..67e8804f3 100644
--- a/Source/WebCore/accessibility/AccessibilityARIAGrid.h
+++ b/Source/WebCore/accessibility/AccessibilityARIAGrid.h
@@ -40,7 +40,7 @@ class AccessibilityTableHeaderContainer;
 class AccessibilityARIAGrid : public AccessibilityTable {
     
 private:
-    AccessibilityARIAGrid(RenderObject*);
+    explicit AccessibilityARIAGrid(RenderObject*);
 public:
     static PassRefPtr<AccessibilityARIAGrid> create(RenderObject*);
     virtual ~AccessibilityARIAGrid();
diff --git a/Source/WebCore/accessibility/AccessibilityARIAGridCell.h b/Source/WebCore/accessibility/AccessibilityARIAGridCell.h
index 2923de896..53efa48ed 100644
--- a/Source/WebCore/accessibility/AccessibilityARIAGridCell.h
+++ b/Source/WebCore/accessibility/AccessibilityARIAGridCell.h
@@ -36,7 +36,7 @@ namespace WebCore {
 class AccessibilityARIAGridCell : public AccessibilityTableCell {
     
 private:
-    AccessibilityARIAGridCell(RenderObject*);
+    explicit AccessibilityARIAGridCell(RenderObject*);
 public:
     static PassRefPtr<AccessibilityARIAGridCell> create(RenderObject*);
     virtual ~AccessibilityARIAGridCell();
diff --git a/Source/WebCore/accessibility/AccessibilityARIAGridRow.h b/Source/WebCore/accessibility/AccessibilityARIAGridRow.h
index f89ea92ad..69af63bd9 100644
--- a/Source/WebCore/accessibility/AccessibilityARIAGridRow.h
+++ b/Source/WebCore/accessibility/AccessibilityARIAGridRow.h
@@ -36,7 +36,7 @@ namespace WebCore {
 class AccessibilityARIAGridRow : public AccessibilityTableRow {
     
 private:
-    AccessibilityARIAGridRow(RenderObject*);
+    explicit AccessibilityARIAGridRow(RenderObject*);
 public:
     static PassRefPtr<AccessibilityARIAGridRow> create(RenderObject*);
     virtual ~AccessibilityARIAGridRow();
diff --git a/Source/WebCore/accessibility/AccessibilityList.h b/Source/WebCore/accessibility/AccessibilityList.h
index 3cfde0bdf..1e07a3182 100644
--- a/Source/WebCore/accessibility/AccessibilityList.h
+++ b/Source/WebCore/accessibility/AccessibilityList.h
@@ -42,7 +42,7 @@ namespace WebCore {
 class AccessibilityList : public AccessibilityRenderObject {
     
 private:
-    AccessibilityList(RenderObject*);
+    explicit AccessibilityList(RenderObject*);
 public:
     static PassRefPtr<AccessibilityList> create(RenderObject*);
     virtual ~AccessibilityList();
diff --git a/Source/WebCore/accessibility/AccessibilityListBox.h b/Source/WebCore/accessibility/AccessibilityListBox.h
index e6113f24c..4f0009438 100644
--- a/Source/WebCore/accessibility/AccessibilityListBox.h
+++ b/Source/WebCore/accessibility/AccessibilityListBox.h
@@ -36,7 +36,7 @@ namespace WebCore {
 class AccessibilityListBox : public AccessibilityRenderObject {
 
 private:
-    AccessibilityListBox(RenderObject*);
+    explicit AccessibilityListBox(RenderObject*);
 public:
     static PassRefPtr<AccessibilityListBox> create(RenderObject*);
     virtual ~AccessibilityListBox();
diff --git a/Source/WebCore/accessibility/AccessibilityMediaControls.h b/Source/WebCore/accessibility/AccessibilityMediaControls.h
index 6f51b2c87..05c03ee05 100644
--- a/Source/WebCore/accessibility/AccessibilityMediaControls.h
+++ b/Source/WebCore/accessibility/AccessibilityMediaControls.h
@@ -51,7 +51,7 @@ public:
     virtual String helpText() const;
 
 protected:
-    AccessibilityMediaControl(RenderObject*);
+    explicit AccessibilityMediaControl(RenderObject*);
     MediaControlElementType controlType() const;
     String controlTypeName() const;
 };
@@ -70,7 +70,7 @@ public:
     const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
 private:
-    AccessibilityMediaTimeline(RenderObject*);
+    explicit AccessibilityMediaTimeline(RenderObject*);
 };
 
 
@@ -87,7 +87,7 @@ public:
     virtual String accessibilityDescription() const;
 
 private:
-    AccessibilityMediaControlsContainer(RenderObject*);
+    explicit AccessibilityMediaControlsContainer(RenderObject*);
     bool controllingVideoElement() const;
     const String elementTypeName() const;
 };
@@ -106,7 +106,7 @@ public:
     virtual String accessibilityDescription() const;
 
 private:
-    AccessibilityMediaTimeDisplay(RenderObject*);
+    explicit AccessibilityMediaTimeDisplay(RenderObject*);
 };
 
 
diff --git a/Source/WebCore/accessibility/AccessibilityMenuList.h b/Source/WebCore/accessibility/AccessibilityMenuList.h
index 281d73629..3ea8ffd88 100644
--- a/Source/WebCore/accessibility/AccessibilityMenuList.h
+++ b/Source/WebCore/accessibility/AccessibilityMenuList.h
@@ -45,7 +45,7 @@ public:
     void didUpdateActiveOption(int optionIndex);
 
 private:
-    AccessibilityMenuList(RenderMenuList*);
+    explicit AccessibilityMenuList(RenderMenuList*);
 
     virtual bool isMenuList() const { return true; }
     virtual AccessibilityRole roleValue() const { return PopUpButtonRole; }
diff --git a/Source/WebCore/accessibility/AccessibilityMockObject.h b/Source/WebCore/accessibility/AccessibilityMockObject.h
index c4d9dbbbc..e02da6b93 100644
--- a/Source/WebCore/accessibility/AccessibilityMockObject.h
+++ b/Source/WebCore/accessibility/AccessibilityMockObject.h
@@ -39,7 +39,8 @@ public:
     
     virtual AccessibilityObject* parentObject() const { return m_parent; }
     virtual void setParent(AccessibilityObject* parent) { m_parent = parent; };
-
+    virtual bool isEnabled() const { return true; }
+    
 protected:
     AccessibilityObject* m_parent;
 
diff --git a/Source/WebCore/accessibility/AccessibilityNodeObject.h b/Source/WebCore/accessibility/AccessibilityNodeObject.h
index 9082f8bbc..b0e1f1fa8 100644
--- a/Source/WebCore/accessibility/AccessibilityNodeObject.h
+++ b/Source/WebCore/accessibility/AccessibilityNodeObject.h
@@ -57,7 +57,7 @@ class Widget;
     
 class AccessibilityNodeObject : public AccessibilityObject {
 protected:
-    AccessibilityNodeObject(Node*);
+    explicit AccessibilityNodeObject(Node*);
 public:
     static PassRefPtr<AccessibilityNodeObject> create(Node*);
     virtual ~AccessibilityNodeObject();
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index 88b1f3909..264781a69 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -639,6 +639,8 @@ public:
     virtual String descriptionForMSAA() const { return String(); }
     virtual AccessibilityRole roleValueForMSAA() const { return roleValue(); }
 
+    virtual String passwordFieldValue() const { return String(); }
+
     // Used by an ARIA tree to get all its rows.
     void ariaTreeRows(AccessibilityChildrenVector&);
     // Used by an ARIA tree item to get all of its direct rows that it can disclose.
diff --git a/Source/WebCore/accessibility/AccessibilityProgressIndicator.h b/Source/WebCore/accessibility/AccessibilityProgressIndicator.h
index af8bc2086..d60bb2ca5 100644
--- a/Source/WebCore/accessibility/AccessibilityProgressIndicator.h
+++ b/Source/WebCore/accessibility/AccessibilityProgressIndicator.h
@@ -42,7 +42,7 @@ private:
     virtual float maxValueForRange() const;
     virtual float minValueForRange() const;
 
-    AccessibilityProgressIndicator(RenderProgress*);
+    explicit AccessibilityProgressIndicator(RenderProgress*);
 
     HTMLProgressElement* element() const;
     virtual bool accessibilityIsIgnored() const;
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index e06f9e8ac..3fff2fa42 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -1194,9 +1194,12 @@ float AccessibilityRenderObject::minValueForRange() const
 
 String AccessibilityRenderObject::stringValue() const
 {
-    if (!m_renderer || isPasswordField())
+    if (!m_renderer)
         return String();
 
+    if (isPasswordField())
+        return passwordFieldValue();
+
     RenderBoxModelObject* cssBox = renderBoxModelObject();
 
     if (ariaRoleAttribute() == StaticTextRole) {
@@ -1996,9 +1999,11 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     if (isWebArea() || m_renderer->isListMarker())
         return false;
     
-    // Using the help text to decide an element's visibility is not as definitive
-    // as previous checks, so this should remain as one of the last.
-    if (!helpText().isEmpty())
+    // Using the help text, title or accessibility description (so we
+    // check if there's some kind of accessible name for the element)
+    // to decide an element's visibility is not as definitive as
+    // previous checks, so this should remain as one of the last.
+    if (!helpText().isEmpty() || !title().isEmpty() || !accessibilityDescription().isEmpty())
         return false;
     
     // By default, objects should be ignored so that the AX hierarchy is not 
@@ -2039,9 +2044,12 @@ String AccessibilityRenderObject::text() const
     if (ariaRoleAttribute() == StaticTextRole)
         return ariaAccessibilityDescription();
     
-    if (!isTextControl() || isPasswordField())
+    if (!isTextControl())
         return String();
 
+    if (isPasswordField())
+        return passwordFieldValue();
+
     Node* node = m_renderer->node();
     if (!node)
         return String();
@@ -2060,8 +2068,12 @@ int AccessibilityRenderObject::textLength() const
     ASSERT(isTextControl());
     
     if (isPasswordField())
+#if PLATFORM(GTK)
+        return passwordFieldValue().length();
+#else
         return -1; // need to return something distinct from 0
-    
+#endif
+
     return text().length();
 }
 
@@ -2854,16 +2866,13 @@ PlainTextRange AccessibilityRenderObject::doAXRangeForIndex(unsigned index) cons
 // specified by the given character range.
 String AccessibilityRenderObject::doAXStringForRange(const PlainTextRange& range) const
 {
-    if (isPasswordField())
-        return String();
-    
     if (!range.length)
         return String();
     
     if (!isTextControl())
         return String();
     
-    String elementText = text();
+    String elementText = isPasswordField() ? passwordFieldValue() : text();
     if (range.start + range.length > elementText.length())
         return String();
     
@@ -3921,6 +3930,27 @@ AccessibilityRole AccessibilityRenderObject::roleValueForMSAA() const
     return m_roleForMSAA;
 }
 
+String AccessibilityRenderObject::passwordFieldValue() const
+{
+#if PLATFORM(GTK)
+    ASSERT(isPasswordField());
+
+    // Look for the RenderText object in the RenderObject tree for this input field.
+    RenderObject* renderer = node()->renderer();
+    while (renderer && !renderer->isText())
+        renderer = renderer->firstChild();
+
+    if (!renderer || !renderer->isText())
+        return String();
+
+    // Return the text that is actually being rendered in the input field.
+    return static_cast<RenderText*>(renderer)->textWithoutTranscoding();
+#else
+    // It seems only GTK is interested in this at the moment.
+    return String();
+#endif
+}
+
 ScrollableArea* AccessibilityRenderObject::getScrollableAreaIfScrollable() const
 {
     // If the parent is a scroll view, then this object isn't really scrollable, the parent ScrollView should handle the scrolling.
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.h b/Source/WebCore/accessibility/AccessibilityRenderObject.h
index 264e70b37..288a9422c 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.h
@@ -57,7 +57,7 @@ class Widget;
     
 class AccessibilityRenderObject : public AccessibilityNodeObject {
 protected:
-    AccessibilityRenderObject(RenderObject*);
+    explicit AccessibilityRenderObject(RenderObject*);
 public:
     static PassRefPtr<AccessibilityRenderObject> create(RenderObject*);
     virtual ~AccessibilityRenderObject();
@@ -257,6 +257,8 @@ public:
     virtual String descriptionForMSAA() const;
     virtual AccessibilityRole roleValueForMSAA() const;
 
+    virtual String passwordFieldValue() const;
+
 protected:
     RenderObject* m_renderer;
     
diff --git a/Source/WebCore/accessibility/AccessibilityScrollView.h b/Source/WebCore/accessibility/AccessibilityScrollView.h
index 912f53d2c..9953164df 100644
--- a/Source/WebCore/accessibility/AccessibilityScrollView.h
+++ b/Source/WebCore/accessibility/AccessibilityScrollView.h
@@ -45,7 +45,7 @@ protected:
     virtual void scrollTo(const IntPoint&) const;
     
 private:
-    AccessibilityScrollView(ScrollView*);
+    explicit AccessibilityScrollView(ScrollView*);
     
     virtual bool accessibilityIsIgnored() const;
     virtual bool isAccessibilityScrollView() const { return true; }
diff --git a/Source/WebCore/accessibility/AccessibilityScrollbar.h b/Source/WebCore/accessibility/AccessibilityScrollbar.h
index fc44fd267..840b797aa 100644
--- a/Source/WebCore/accessibility/AccessibilityScrollbar.h
+++ b/Source/WebCore/accessibility/AccessibilityScrollbar.h
@@ -42,7 +42,7 @@ public:
     Scrollbar* scrollbar() const { return m_scrollbar.get(); }
     
 private:
-    AccessibilityScrollbar(Scrollbar*);
+    explicit AccessibilityScrollbar(Scrollbar*);
 
     virtual bool accessibilityIsIgnored() const { return false; }
     virtual bool canSetValueAttribute() const { return true; }
diff --git a/Source/WebCore/accessibility/AccessibilitySlider.h b/Source/WebCore/accessibility/AccessibilitySlider.h
index 81fe918d7..94c431625 100644
--- a/Source/WebCore/accessibility/AccessibilitySlider.h
+++ b/Source/WebCore/accessibility/AccessibilitySlider.h
@@ -43,7 +43,7 @@ public:
     virtual ~AccessibilitySlider() { }
 
 protected:
-    AccessibilitySlider(RenderObject*);
+    explicit AccessibilitySlider(RenderObject*);
 
 private:
     HTMLInputElement* element() const;
diff --git a/Source/WebCore/accessibility/AccessibilityTable.h b/Source/WebCore/accessibility/AccessibilityTable.h
index 2ee1bc094..9f28f4122 100644
--- a/Source/WebCore/accessibility/AccessibilityTable.h
+++ b/Source/WebCore/accessibility/AccessibilityTable.h
@@ -45,7 +45,7 @@ class AccessibilityTableCell;
 class AccessibilityTable : public AccessibilityRenderObject {
 
 protected:
-    AccessibilityTable(RenderObject*);
+    explicit AccessibilityTable(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTable> create(RenderObject*);
     virtual ~AccessibilityTable();
diff --git a/Source/WebCore/accessibility/AccessibilityTableCell.h b/Source/WebCore/accessibility/AccessibilityTableCell.h
index e4a201ff7..043071557 100644
--- a/Source/WebCore/accessibility/AccessibilityTableCell.h
+++ b/Source/WebCore/accessibility/AccessibilityTableCell.h
@@ -36,7 +36,7 @@ namespace WebCore {
 class AccessibilityTableCell : public AccessibilityRenderObject {
     
 protected:
-    AccessibilityTableCell(RenderObject*);
+    explicit AccessibilityTableCell(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTableCell> create(RenderObject*);
     virtual ~AccessibilityTableCell();
diff --git a/Source/WebCore/accessibility/AccessibilityTableRow.h b/Source/WebCore/accessibility/AccessibilityTableRow.h
index 80bfbf67b..18c25accd 100644
--- a/Source/WebCore/accessibility/AccessibilityTableRow.h
+++ b/Source/WebCore/accessibility/AccessibilityTableRow.h
@@ -36,7 +36,7 @@ namespace WebCore {
 class AccessibilityTableRow : public AccessibilityRenderObject {
     
 protected:
-    AccessibilityTableRow(RenderObject*);
+    explicit AccessibilityTableRow(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTableRow> create(RenderObject*);
     virtual ~AccessibilityTableRow();
diff --git a/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp b/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
index 9b46b38b6..db8ae236a 100644
--- a/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
@@ -21,6 +21,7 @@
 #include "AXObjectCache.h"
 
 #include "AccessibilityObject.h"
+#include "AccessibilityRenderObject.h"
 #include "Document.h"
 #include "Element.h"
 #include <wtf/gobject/GOwnPtr.h>
@@ -158,12 +159,27 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* coreObject, AX
     }
 }
 
-static void emitTextChanged(AccessibilityObject* object, AXObjectCache::AXTextChange textChange, unsigned offset, const String& text)
+void AXObjectCache::nodeTextChangePlatformNotification(AccessibilityObject* object, AXTextChange textChange, unsigned offset, const String& text)
 {
-    AtkObject* wrapper = object->parentObjectUnignored()->wrapper();
+    if (!object || text.isEmpty())
+        return;
+
+    AccessibilityObject* parentObject = object->parentObjectUnignored();
+    if (!parentObject)
+        return;
+
+    AtkObject* wrapper = parentObject->wrapper();
     if (!wrapper || !ATK_IS_TEXT(wrapper))
         return;
 
+    Node* node = object->node();
+    if (!node)
+        return;
+
+    // Ensure document's layout is up-to-date before using TextIterator.
+    Document* document = node->document();
+    document->updateLayout();
+
     // Select the right signal to be emitted
     CString detail;
     switch (textChange) {
@@ -175,18 +191,23 @@ static void emitTextChanged(AccessibilityObject* object, AXObjectCache::AXTextCh
         break;
     }
 
-    if (!detail.isNull())
-        g_signal_emit_by_name(wrapper, detail.data(), offset, text.length(), text.utf8().data());
-}
-
-void AXObjectCache::nodeTextChangePlatformNotification(AccessibilityObject* object, AXTextChange textChange, unsigned offset, const String& text)
-{
-    if (!object || !object->isAccessibilityRenderObject() || text.isEmpty())
-        return;
+    String textToEmit = text;
+    unsigned offsetToEmit = offset;
+
+    // If the object we're emitting the signal from represents a
+    // password field, we will emit the masked text.
+    if (parentObject->isPasswordField()) {
+        String maskedText = parentObject->passwordFieldValue();
+        textToEmit = maskedText.substring(offset, text.length());
+    } else {
+        // Consider previous text objects that might be present for
+        // the current accessibility object to ensure we emit the
+        // right offset (e.g. multiline text areas).
+        RefPtr<Range> range = Range::create(document, node->parentNode(), 0, node, 0);
+        offsetToEmit = offset + TextIterator::rangeLength(range.get());
+    }
 
-    Node* node = object->node();
-    RefPtr<Range> range = Range::create(node->document(), node->parentNode(), 0, node, 0);
-    emitTextChanged(object, textChange, offset + TextIterator::rangeLength(range.get()), text);
+    g_signal_emit_by_name(wrapper, detail.data(), offsetToEmit, textToEmit.length(), textToEmit.utf8().data());
 }
 
 void AXObjectCache::frameLoadingEventPlatformNotification(AccessibilityObject* object, AXLoadingEvent loadingEvent)
diff --git a/Source/WebCore/bindings/generic/BindingSecurity.cpp b/Source/WebCore/bindings/generic/BindingSecurity.cpp
new file mode 100644
index 000000000..87f4a574d
--- /dev/null
+++ b/Source/WebCore/bindings/generic/BindingSecurity.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BindingSecurity.h"
+
+#include "BindingState.h"
+#include "DOMWindow.h"
+#include "Document.h"
+#include "Frame.h"
+#include "HTMLFrameElementBase.h"
+#include "HTMLParserIdioms.h"
+#include "SecurityOrigin.h"
+#include "Settings.h"
+
+namespace WebCore {
+
+static bool canAccessDocument(BindingState* state, Document* targetDocument, SecurityReportingOption reportingOption = ReportSecurityError)
+{
+    if (!targetDocument)
+        return false;
+
+    DOMWindow* active = activeDOMWindow(state);
+    if (!active)
+        return false;
+
+    // If the embedder executes JavaScript synchronously during the didCreateScriptContext callback,
+    // in some cases the active SecurityOrigin will not yet be copied to the DOMWindow. For example,
+    // Frame::setDocument can trigger didCreateScriptContext during ScriptController::updateDocument.
+    //
+    // FIXME: Remove this branch once we manage to delete DOMWindow::m_securityOrigin. Ideally, we'd
+    //        get the SecurityOrigin from the Document rather than the DOMWindow. In that case, there
+    //        shouldn't ever be a chance to execute script before the SecurityOrigin object is created.
+    if (!active->securityOrigin())
+        return false;
+
+    if (active->securityOrigin()->canAccess(targetDocument->securityOrigin()))
+        return true;
+
+    if (reportingOption == ReportSecurityError)
+        immediatelyReportUnsafeAccessTo(state, targetDocument);
+
+    return false;
+}
+
+bool BindingSecurity::shouldAllowAccessToFrame(BindingState* state, Frame* target, SecurityReportingOption reportingOption)
+{
+    return target && canAccessDocument(state, target->document(), reportingOption);
+}
+
+bool BindingSecurity::shouldAllowAccessToNode(BindingState* state, Node* target)
+{
+    return target && canAccessDocument(state, target->document());
+}
+
+bool BindingSecurity::allowSettingFrameSrcToJavascriptUrl(BindingState* state, HTMLFrameElementBase* frame, const String& value)
+{
+    return !protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(value)) || canAccessDocument(state, frame->contentDocument());
+}
+
+}
diff --git a/Source/WebCore/bindings/generic/BindingSecurity.h b/Source/WebCore/bindings/generic/BindingSecurity.h
index 7e5ff7de5..99d7f0097 100644
--- a/Source/WebCore/bindings/generic/BindingSecurity.h
+++ b/Source/WebCore/bindings/generic/BindingSecurity.h
@@ -31,120 +31,26 @@
 #ifndef BindingSecurity_h
 #define BindingSecurity_h
 
-#include "BindingSecurityBase.h"
-#include "DOMWindow.h"
-#include "Document.h"
-#include "Element.h"
-#include "Frame.h"
-#include "GenericBinding.h"
-#include "HTMLFrameElementBase.h"
-#include "HTMLNames.h"
-#include "HTMLParserIdioms.h"
-#include "ScriptController.h"
-#include "Settings.h"
+#include "BindingState.h"
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
-class DOMWindow;
+class HTMLFrameElementBase;
 class Node;
 
-// Security functions shared by various language bindings.
-template <class Binding>
-class BindingSecurity : public BindingSecurityBase {
-public:
-    // Check if the active execution context can access the target frame.
-    static bool canAccessFrame(State<Binding>*, Frame*, bool reportError);
-
-    // Check if it is safe to access the given node from the
-    // current security context.
-    static bool shouldAllowAccessToNode(State<Binding>*, Node* target);
-
-    static bool allowPopUp(State<Binding>*);
-    static bool allowSettingFrameSrcToJavascriptUrl(State<Binding>*, HTMLFrameElementBase*, const String& value);
-    static bool allowSettingSrcToJavascriptURL(State<Binding>*, Element*, const String& name, const String& value);
-
-private:
-    explicit BindingSecurity() {}
-    ~BindingSecurity();
-
-    // Check if the current DOMWindow's security context can access the target
-    // DOMWindow.  This function does not report errors, so most callers should
-    // use canAccessFrame instead.
-    static bool canAccessWindow(State<Binding>*, DOMWindow* target);
+enum SecurityReportingOption {
+    DoNotReportSecurityError,
+    ReportSecurityError,
 };
 
-// Implementations of templated methods must be in this file.
-
-template <class Binding>
-bool BindingSecurity<Binding>::canAccessWindow(State<Binding>* state,
-                                               DOMWindow* targetWindow)
-{
-    DOMWindow* activeWindow = state->activeWindow();
-    return canAccess(activeWindow, targetWindow);
-}
-
-template <class Binding>
-bool BindingSecurity<Binding>::canAccessFrame(State<Binding>* state,
-                                              Frame* target,
-                                              bool reportError)
-{
-    // The subject is detached from a frame, deny accesses.
-    if (!target)
-        return false;
-
-    if (!canAccessWindow(state, getDOMWindow(target))) {
-        if (reportError)
-            state->immediatelyReportUnsafeAccessTo(target);
-        return false;
-    }
-    return true;
-}
-
-template <class Binding>
-bool BindingSecurity<Binding>::shouldAllowAccessToNode(State<Binding>* state, Node* node)
-{
-    if (!node)
-        return false;
-
-    Frame* target = getFrame(node);
-
-    if (!target)
-        return false;
-
-    return canAccessFrame(state, target, true);
-}
-
-template <class Binding>
-bool BindingSecurity<Binding>::allowPopUp(State<Binding>* state)
-{
-    if (ScriptController::processingUserGesture())
-        return true;
-
-    Frame* frame = state->firstFrame();
-    ASSERT(frame);
-    Settings* settings = frame->settings();
-    return settings && settings->javaScriptCanOpenWindowsAutomatically();
-}
-
-template <class Binding>
-bool BindingSecurity<Binding>::allowSettingFrameSrcToJavascriptUrl(State<Binding>* state, HTMLFrameElementBase* frame, const String& value)
-{
-    if (protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(value))) {
-        Node* contentDoc = frame->contentDocument();
-        if (contentDoc && !shouldAllowAccessToNode(state, contentDoc))
-            return false;
-    }
-    return true;
-}
-
-template <class Binding>
-bool BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(State<Binding>* state, Element* element, const String& name, const String& value)
-{
-    if ((element->hasTagName(HTMLNames::iframeTag) || element->hasTagName(HTMLNames::frameTag)) && equalIgnoringCase(name, "src"))
-        return allowSettingFrameSrcToJavascriptUrl(state, static_cast<HTMLFrameElementBase*>(element), value);
-    return true;
-}
+class BindingSecurity {
+public:
+    static bool shouldAllowAccessToNode(BindingState*, Node*);
+    static bool shouldAllowAccessToFrame(BindingState*, Frame*, SecurityReportingOption = ReportSecurityError);
+    static bool allowSettingFrameSrcToJavascriptUrl(BindingState*, HTMLFrameElementBase*, const String& value);
+};
 
 }
 
-#endif // BindingSecurity_h
+#endif
diff --git a/Source/WebCore/bindings/generic/GenericBinding.h b/Source/WebCore/bindings/generic/GenericBinding.h
index 69d31fa0a..fd1181f9f 100644
--- a/Source/WebCore/bindings/generic/GenericBinding.h
+++ b/Source/WebCore/bindings/generic/GenericBinding.h
@@ -31,32 +31,15 @@
 #ifndef GenericBinding_h
 #define GenericBinding_h
 
+#include "BindingState.h"
 #include "Document.h"
 #include "Frame.h"
-#include "FrameLoader.h"
 
 namespace WebCore {
 
-// Used to instantiate binding templates for any methods shared among all
-// language bindings.
-class GenericBinding {};
-
-// Class to represent execution state for each language binding.
-template <class T>
-class State {};
-
-// Common notion of execution state for language bindings.
-template <>
-class State<GenericBinding> {
-    // Any methods shared across bindings can go here.
-};
-
-template <class Binding>
-KURL completeURL(State<Binding>* state, const String& relativeURL)
+inline KURL completeURL(BindingState* state, const String& relativeURL)
 {
-    // For historical reasons, we need to complete the URL using the
-    // dynamic frame.
-    Frame* frame = state->firstFrame();
+    Frame* frame = firstFrame(state);
     if (!frame)
         return KURL();
     return frame->document()->completeURL(relativeURL);
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index a22f44501..59ec0628d 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -188,6 +188,8 @@ bool RuntimeEnabledFeatures::isEncryptedMediaEnabled = false;
 
 #if ENABLE(SHADOW_DOM)
 bool RuntimeEnabledFeatures::isShadowDOMEnabled = false;
+
+bool RuntimeEnabledFeatures::isAuthorShadowDOMForAnyElementEnabled = false;
 #endif
 
 #if ENABLE(STYLE_SCOPED)
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 684c57d8b..c68c3a80e 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -188,6 +188,7 @@ public:
     static bool peerConnectionEnabled() { return isMediaStreamEnabled && isPeerConnectionEnabled; }
     static void setPeerConnectionEnabled(bool isEnabled) { isPeerConnectionEnabled = isEnabled; }
     static bool webkitPeerConnection00Enabled() { return peerConnectionEnabled(); }
+    static bool webkitRTCPeerConnectionEnabled() { return peerConnectionEnabled(); }
 #endif
 
 #if ENABLE(GAMEPAD)
@@ -218,6 +219,9 @@ public:
 #if ENABLE(SHADOW_DOM)
     static bool shadowDOMEnabled() { return isShadowDOMEnabled; }
     static void setShadowDOMEnabled(bool isEnabled) { isShadowDOMEnabled = isEnabled; }
+
+    static bool authorShadowDOMForAnyElementEnabled() { return isAuthorShadowDOMForAnyElementEnabled; }
+    static void setAuthorShadowDOMForAnyElementEnabled(bool isEnabled) { isAuthorShadowDOMForAnyElementEnabled = isEnabled; }
 #endif
 
 #if ENABLE(STYLE_SCOPED)
@@ -324,6 +328,8 @@ private:
 
 #if ENABLE(SHADOW_DOM)
     static bool isShadowDOMEnabled;
+
+    static bool isAuthorShadowDOMForAnyElementEnabled;
 #endif
 
 #if ENABLE(STYLE_SCOPED)
diff --git a/Source/WebCore/bindings/gobject/WebKitDOMCustom.cpp b/Source/WebCore/bindings/gobject/WebKitDOMCustom.cpp
index 652fd55c2..b7d9c56de 100644
--- a/Source/WebCore/bindings/gobject/WebKitDOMCustom.cpp
+++ b/Source/WebCore/bindings/gobject/WebKitDOMCustom.cpp
@@ -49,6 +49,18 @@ webkit_dom_blob_webkit_slice(WebKitDOMBlob* self, gint64 start, gint64 end, cons
     return webkit_dom_blob_slice(self, start, end, content_type);
 }
 
+gchar*
+webkit_dom_html_element_get_class_name(WebKitDOMHTMLElement* element)
+{
+    return webkit_dom_element_get_class_name(WEBKIT_DOM_ELEMENT(element));
+}
+
+void
+webkit_dom_html_element_set_class_name(WebKitDOMHTMLElement* element, const gchar* value)
+{
+    webkit_dom_element_set_class_name(WEBKIT_DOM_ELEMENT(element), value);
+}
+
 void
 webkit_dom_html_form_element_dispatch_form_change(WebKitDOMHTMLFormElement* self)
 {
diff --git a/Source/WebCore/bindings/gobject/WebKitDOMCustom.h b/Source/WebCore/bindings/gobject/WebKitDOMCustom.h
index 2b464e247..8fb50839c 100644
--- a/Source/WebCore/bindings/gobject/WebKitDOMCustom.h
+++ b/Source/WebCore/bindings/gobject/WebKitDOMCustom.h
@@ -30,6 +30,9 @@ WEBKIT_API gboolean webkit_dom_html_input_element_is_edited(WebKitDOMHTMLInputEl
 
 /* Compatibility */
 WEBKIT_API WebKitDOMBlob* webkit_dom_blob_webkit_slice(WebKitDOMBlob* self, gint64 start, gint64 end, const gchar* content_type);
+WEBKIT_API gchar* webkit_dom_html_element_get_class_name(WebKitDOMHTMLElement* element);
+WEBKIT_API void webkit_dom_html_element_set_class_name(WebKitDOMHTMLElement* element, const gchar* value);
+WEBKIT_API WebKitDOMDOMTokenList* webkit_dom_html_element_get_class_list(WebKitDOMHTMLElement* element);
 WEBKIT_API void webkit_dom_html_form_element_dispatch_form_change(WebKitDOMHTMLFormElement* self);
 WEBKIT_API void webkit_dom_html_form_element_dispatch_form_input(WebKitDOMHTMLFormElement* self);
 
diff --git a/Source/WebCore/bindings/js/ArrayValue.cpp b/Source/WebCore/bindings/js/ArrayValue.cpp
new file mode 100644
index 000000000..afa53bfeb
--- /dev/null
+++ b/Source/WebCore/bindings/js/ArrayValue.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ArrayValue.h"
+
+#include "Dictionary.h"
+#include <runtime/JSArray.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ArrayValue::ArrayValue()
+    : m_exec(0)
+{
+}
+
+ArrayValue::ArrayValue(JSC::ExecState* exec, JSC::JSValue value)
+    : m_exec(exec)
+{
+    if (!value.isUndefinedOrNull() && isJSArray(value))
+        m_value = value;
+}
+
+ArrayValue& ArrayValue::operator=(const ArrayValue& other)
+{
+    m_exec = other.m_exec;
+    m_value = other.m_value;
+    return *this;
+}
+
+bool ArrayValue::isUndefinedOrNull() const
+{
+    return m_value.isEmpty() || m_value.isUndefinedOrNull();
+}
+
+bool ArrayValue::length(size_t& length) const
+{
+    if (isUndefinedOrNull())
+        return false;
+
+    JSArray* array = asArray(m_value);
+    length = array->length();
+    return true;
+}
+
+bool ArrayValue::get(size_t index, Dictionary& value) const
+{
+    if (isUndefinedOrNull())
+        return false;
+
+    JSArray* array = asArray(m_value);
+    if (!array->canGetIndex(index))
+        return false;
+
+    JSValue indexedValue = array->getIndex(index);
+    if (indexedValue.isUndefinedOrNull() || !indexedValue.isObject())
+        return false;
+
+    value = Dictionary(m_exec, indexedValue);
+    return true;
+}
+
+} // namespace WebCore
diff --git a/Source/WebKit/chromium/public/platform/WebLayer.h b/Source/WebCore/bindings/js/ArrayValue.h
index 234c2fc4b..084f8c3cf 100644
--- a/Source/WebKit/chromium/public/platform/WebLayer.h
+++ b/Source/WebCore/bindings/js/ArrayValue.h
@@ -23,4 +23,32 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "../../../../Platform/chromium/public/WebLayer.h"
+#ifndef ArrayValue_h
+#define ArrayValue_h
+
+#include <interpreter/CallFrame.h>
+
+namespace WebCore {
+
+class Dictionary;
+
+class ArrayValue {
+public:
+    ArrayValue();
+    ArrayValue(JSC::ExecState*, JSC::JSValue);
+
+    ArrayValue& operator=(const ArrayValue&);
+
+    bool isUndefinedOrNull() const;
+
+    bool length(size_t&) const;
+    bool get(size_t index, Dictionary&) const;
+
+private:
+    JSC::ExecState* m_exec;
+    JSC::JSValue m_value;
+};
+
+}
+
+#endif // ArrayValue_h
diff --git a/Source/WebCore/bindings/generic/BindingSecurityBase.cpp b/Source/WebCore/bindings/js/BindingState.cpp
index 16a078579..72a2a8a13 100644
--- a/Source/WebCore/bindings/generic/BindingSecurityBase.cpp
+++ b/Source/WebCore/bindings/js/BindingState.cpp
@@ -1,10 +1,10 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -29,46 +29,27 @@
  */
 
 #include "config.h"
-#include "BindingSecurityBase.h"
+#include "BindingState.h"
 
-#include "DOMWindow.h"
-#include "Document.h"
-#include "Frame.h"
-#include "SecurityOrigin.h"
+#include "JSDOMWindowCustom.h"
+
+using namespace JSC;
 
 namespace WebCore {
 
-DOMWindow* BindingSecurityBase::getDOMWindow(Frame* frame)
+DOMWindow* activeDOMWindow(ExecState* exec)
 {
-    return frame->domWindow();
+    return asJSDOMWindow(exec->lexicalGlobalObject())->impl();
 }
 
-Frame* BindingSecurityBase::getFrame(Node* node)
+DOMWindow* firstDOMWindow(ExecState* exec)
 {
-    return node->document()->frame();
+    return asJSDOMWindow(exec->dynamicGlobalObject())->impl();
 }
 
-bool BindingSecurityBase::canAccess(DOMWindow* activeWindow, DOMWindow* targetWindow)
+void immediatelyReportUnsafeAccessTo(ExecState* exec, Document* target)
 {
-    ASSERT(targetWindow);
-    if (activeWindow == targetWindow)
-        return true;
-
-    if (!activeWindow)
-        return false;
-
-    SecurityOrigin* activeSecurityOrigin = activeWindow->securityOrigin();
-    SecurityOrigin* targetSecurityOrigin = targetWindow->securityOrigin();
-
-    // We have seen crashes were the security origin of the target has not been
-    // initialized. Defend against that.
-    if (!targetSecurityOrigin)
-        return false;
-
-    if (activeSecurityOrigin->canAccess(targetSecurityOrigin))
-        return true;
-
-    return false;
+    printErrorMessageForFrame(target->frame(), target->domWindow()->crossDomainAccessErrorMessage(activeDOMWindow(exec)));
 }
 
 }
diff --git a/Source/WebCore/bindings/generic/BindingSecurityBase.h b/Source/WebCore/bindings/js/BindingState.h
index cfa2e9997..de130fe2b 100644
--- a/Source/WebCore/bindings/generic/BindingSecurityBase.h
+++ b/Source/WebCore/bindings/js/BindingState.h
@@ -1,10 +1,10 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,25 +28,28 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef BindingSecurityBase_h
-#define BindingSecurityBase_h
+#ifndef BindingState_h
+#define BindingState_h
+
+#include <runtime/JSObject.h>
 
 namespace WebCore {
 
 class DOMWindow;
+class Document;
 class Frame;
-class Node;
-
-// Helper functions for BindingSecurity that depend on WebCore classes, and
-// thus should not be implemented in BindingSecurity.h, which contains template
-// method definitions.
-class BindingSecurityBase {
-protected:
-    static DOMWindow* getDOMWindow(Frame*);
-    static Frame* getFrame(Node*);
-    static bool canAccess(DOMWindow* active, DOMWindow* target);
-};
+
+typedef JSC::ExecState BindingState;
+
+DOMWindow* activeDOMWindow(BindingState*);
+DOMWindow* firstDOMWindow(BindingState*);
+
+// FIXME: Implement these functions.
+inline Frame* activeFrame(BindingState*) { return 0; }
+inline Frame* firstFrame(BindingState*) { return 0; }
+
+void immediatelyReportUnsafeAccessTo(BindingState*, Document* target);
 
 }
 
-#endif // BindingSecurityBase_h
+#endif
diff --git a/Source/WebCore/bindings/js/Dictionary.h b/Source/WebCore/bindings/js/Dictionary.h
index 37c3e8806..1cbd7d955 100644
--- a/Source/WebCore/bindings/js/Dictionary.h
+++ b/Source/WebCore/bindings/js/Dictionary.h
@@ -96,7 +96,9 @@ PassRefPtr<EventListener> Dictionary::getEventListener(const char* propertyName,
         return 0;
     if (eventListener.hasNoValue())
         return 0;
-    
+    if (!eventListener.isObject())
+        return 0;
+
     return JSEventListener::create(asObject(eventListener.jsValue()), asJSObject(target), true, currentWorld(m_dictionary.execState()));
 }
 
diff --git a/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h b/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h
index 8c6f42677..e02856482 100644
--- a/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h
+++ b/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h
@@ -41,23 +41,94 @@
 
 namespace WebCore {
 
-template <class T>
-JSC::JSValue setWebGLArrayHelper(JSC::ExecState* exec, T* impl, T* (*conversionFunc)(JSC::JSValue))
+template<class C, typename T>
+bool copyTypedArrayBuffer(C* target, ArrayBufferView* source, unsigned sourceLength, unsigned offset)
+{
+    ArrayBufferView::ViewType sourceType = source->getType();
+    ASSERT(sourceType != ArrayBufferView::TypeDataView);
+
+    if (target->getType() == sourceType) {
+        if (!target->set(static_cast<C*>(source), offset))
+            return false;
+        return true;
+    }
+
+    if (!target->checkInboundData(offset, sourceLength))
+        return false;
+
+    switch (sourceType) {
+    case ArrayBufferView::TypeInt8:
+        for (unsigned i = 0; i < sourceLength; ++i)
+            target->set(i + offset, (T)(static_cast<TypedArrayBase<signed char> *>(source)->item(i)));
+        break;
+    case ArrayBufferView::TypeUint8:
+    case ArrayBufferView::TypeUint8Clamped:
+        for (unsigned i = 0; i < sourceLength; ++i)
+            target->set(i + offset, (T)(static_cast<TypedArrayBase<unsigned char> *>(source)->item(i)));
+        break;
+    case ArrayBufferView::TypeInt16:
+        for (unsigned i = 0; i < sourceLength; ++i)
+            target->set(i + offset, (T)(static_cast<TypedArrayBase<signed short> *>(source)->item(i)));
+        break;
+    case ArrayBufferView::TypeUint16:
+        for (unsigned i = 0; i < sourceLength; ++i)
+            target->set(i + offset, (T)(static_cast<TypedArrayBase<unsigned short> *>(source)->item(i)));
+        break;
+    case ArrayBufferView::TypeInt32:
+        for (unsigned i = 0; i < sourceLength; ++i)
+            target->set(i + offset, (T)(static_cast<TypedArrayBase<int> *>(source)->item(i)));
+        break;
+    case ArrayBufferView::TypeUint32:
+        for (unsigned i = 0; i < sourceLength; ++i)
+            target->set(i + offset, (T)(static_cast<TypedArrayBase<unsigned int> *>(source)->item(i)));
+        break;
+    case ArrayBufferView::TypeFloat32:
+        for (unsigned i = 0; i < sourceLength; ++i)
+            target->set(i + offset, (T)(static_cast<TypedArrayBase<float> *>(source)->item(i)));
+        break;
+    case ArrayBufferView::TypeFloat64:
+        for (unsigned i = 0; i < sourceLength; ++i)
+            target->set(i + offset, (T)(static_cast<TypedArrayBase<double> *>(source)->item(i)));
+        break;
+    default:
+        break;
+    }
+
+    return true;
+}
+
+template <class C, typename T>
+bool setWebGLArrayWithTypedArrayArgument(JSC::ExecState* exec, C* impl)
+{
+    RefPtr<ArrayBufferView> array = toArrayBufferView(exec->argument(0));
+    if (!array)
+        return false;
+
+    ArrayBufferView::ViewType arrayType = array->getType();
+    if (arrayType == ArrayBufferView::TypeDataView)
+        return false;
+
+    unsigned offset = 0;
+    if (exec->argumentCount() == 2)
+        offset = exec->argument(1).toInt32(exec);
+
+    uint32_t length = asObject(exec->argument(0))->get(exec, JSC::Identifier(exec, "length")).toUInt32(exec);
+
+    if (!(copyTypedArrayBuffer<C, T>(impl, array.get(), length, offset)))
+        setDOMException(exec, INDEX_SIZE_ERR);
+
+    return true;
+}
+
+template<class C, typename T>
+JSC::JSValue setWebGLArrayHelper(JSC::ExecState* exec, C* impl)
 {
     if (exec->argumentCount() < 1)
         return JSC::throwSyntaxError(exec);
 
-    T* array = (*conversionFunc)(exec->argument(0));
-    if (array) {
-        // void set(in WebGL<T>Array array, [Optional] in unsigned long offset);
-        unsigned offset = 0;
-        if (exec->argumentCount() == 2)
-            offset = exec->argument(1).toInt32(exec);
-        if (!impl->set(array, offset))
-            setDOMException(exec, INDEX_SIZE_ERR);
-
+    if (setWebGLArrayWithTypedArrayArgument<C, T>(exec, impl))
+        // void set(in WebGL<>Array array, [Optional] in unsigned long offset);
         return JSC::jsUndefined();
-    }
 
     if (exec->argument(0).isObject()) {
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
@@ -66,9 +137,7 @@ JSC::JSValue setWebGLArrayHelper(JSC::ExecState* exec, T* impl, T* (*conversionF
         if (exec->argumentCount() == 2)
             offset = exec->argument(1).toInt32(exec);
         uint32_t length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
-        if (offset > impl->length()
-            || offset + length > impl->length()
-            || offset + length < offset)
+        if (!impl->checkInboundData(offset, length))
             setDOMException(exec, INDEX_SIZE_ERR);
         else {
             for (uint32_t i = 0; i < length; i++) {
@@ -105,49 +174,11 @@ PassRefPtr<C> constructArrayBufferViewWithTypedArrayArgument(JSC::ExecState* exe
         return array;
     }
 
-    if (array->getType() == sourceType) {
-        memcpy(array->baseAddress(), source->baseAddress(), length * sizeof(T));
+    if (!(copyTypedArrayBuffer<C, T>(array.get(), source.get(), length, 0))) {
+        setDOMException(exec, INDEX_SIZE_ERR);
         return array;
     }
 
-    switch (sourceType) {
-    case ArrayBufferView::TypeInt8:
-        for (unsigned i = 0; i < length; ++i)
-            array->set(i, (T)(static_cast<TypedArrayBase<signed char> *>(source.get())->item(i)));
-        break;
-    case ArrayBufferView::TypeUint8:
-    case ArrayBufferView::TypeUint8Clamped:
-        for (unsigned i = 0; i < length; ++i)
-            array->set(i, (T)(static_cast<TypedArrayBase<unsigned char> *>(source.get())->item(i)));
-        break;
-    case ArrayBufferView::TypeInt16:
-        for (unsigned i = 0; i < length; ++i)
-            array->set(i, (T)(static_cast<TypedArrayBase<signed short> *>(source.get())->item(i)));
-        break;
-    case ArrayBufferView::TypeUint16:
-        for (unsigned i = 0; i < length; ++i)
-            array->set(i, (T)(static_cast<TypedArrayBase<unsigned short> *>(source.get())->item(i)));
-        break;
-    case ArrayBufferView::TypeInt32:
-        for (unsigned i = 0; i < length; ++i)
-            array->set(i, (T)(static_cast<TypedArrayBase<int> *>(source.get())->item(i)));
-        break;
-    case ArrayBufferView::TypeUint32:
-        for (unsigned i = 0; i < length; ++i)
-            array->set(i, (T)(static_cast<TypedArrayBase<unsigned int> *>(source.get())->item(i)));
-        break;
-    case ArrayBufferView::TypeFloat32:
-        for (unsigned i = 0; i < length; ++i)
-            array->set(i, (T)(static_cast<TypedArrayBase<float> *>(source.get())->item(i)));
-        break;
-    case ArrayBufferView::TypeFloat64:
-        for (unsigned i = 0; i < length; ++i)
-            array->set(i, (T)(static_cast<TypedArrayBase<double> *>(source.get())->item(i)));
-        break;
-    default:
-        return 0;
-    }
-
     return array;
 }
 
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index 59b9fe604..49a1993f2 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -25,6 +25,8 @@
 
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
+#include "ArrayValue.cpp"
+#include "BindingState.cpp"
 #include "CallbackFunction.cpp"
 #include "DOMObjectHashTableMap.cpp"
 #include "DOMWrapperWorld.cpp"
@@ -80,8 +82,6 @@
 #include "JSEventListener.cpp"
 #include "JSEventTargetCustom.cpp"
 #include "JSExceptionBase.cpp"
-#include "JSFloat32ArrayCustom.cpp"
-#include "JSFloat64ArrayCustom.cpp"
 #include "JSGeolocationCustom.cpp"
 #include "JSHTMLAllCollectionCustom.cpp"
 #include "JSHTMLAppletElementCustom.cpp"
@@ -107,9 +107,6 @@
 #include "JSInjectedScriptHostCustom.cpp"
 #include "JSInjectedScriptManager.cpp"
 #include "JSInspectorFrontendHostCustom.cpp"
-#include "JSInt16ArrayCustom.cpp"
-#include "JSInt32ArrayCustom.cpp"
-#include "JSInt8ArrayCustom.cpp"
 #include "JSJavaScriptCallFrameCustom.cpp"
 #include "JSLazyEventListener.cpp"
 #include "JSLocationCustom.cpp"
@@ -152,10 +149,6 @@
 #include "JSTrackCustom.cpp"
 #include "JSTrackEventCustom.cpp"
 #include "JSTreeWalkerCustom.cpp"
-#include "JSUint16ArrayCustom.cpp"
-#include "JSUint32ArrayCustom.cpp"
-#include "JSUint8ArrayCustom.cpp"
-#include "JSUint8ClampedArrayCustom.cpp"
 #include "JSWebKitAnimationCustom.cpp"
 #include "JSWebKitAnimationListCustom.cpp"
 #include "JSWebKitCSSKeyframeRuleCustom.cpp"
@@ -176,7 +169,6 @@
 #include "ScriptCachedFrameData.cpp"
 #include "ScriptCallStackFactory.cpp"
 #include "ScriptController.cpp"
-#include "ScriptControllerWin.cpp"
 #include "ScriptDebugServer.cpp"
 #include "ScriptEventListener.cpp"
 #include "ScriptFunctionCall.cpp"
diff --git a/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index a897b6fbc..847bce4d6 100644
--- a/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -39,7 +39,7 @@ namespace WebCore {
 
 using namespace JSC;
 
-PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecState* exec, JSC::JSValue value)
+PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(ExecState* exec, JSValue value)
 {
     if (value.isUndefinedOrNull())
         return 0;
@@ -50,12 +50,12 @@ PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecSta
         return 0;
     }
 
-    return adoptRef(new JSCustomXPathNSResolver(resolverObject, asJSDOMWindow(exec->dynamicGlobalObject())));
+    return adoptRef(new JSCustomXPathNSResolver(exec, resolverObject, asJSDOMWindow(exec->dynamicGlobalObject())));
 }
 
-JSCustomXPathNSResolver::JSCustomXPathNSResolver(JSObject* customResolver, JSDOMWindow* globalObject)
-    : m_customResolver(customResolver)
-    , m_globalObject(globalObject)
+JSCustomXPathNSResolver::JSCustomXPathNSResolver(ExecState* exec, JSObject* customResolver, JSDOMWindow* globalObject)
+    : m_customResolver(exec->globalData(), customResolver)
+    , m_globalObject(exec->globalData(), globalObject)
 {
 }
 
@@ -75,13 +75,13 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     CallData callData;
     CallType callType = getCallData(function, callData);
     if (callType == CallTypeNone) {
-        callType = m_customResolver->methodTable()->getCallData(m_customResolver, callData);
+        callType = m_customResolver->methodTable()->getCallData(m_customResolver.get(), callData);
         if (callType == CallTypeNone) {
             // FIXME: Pass actual line number and source URL.
             m_globalObject->impl()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.");
             return String();
         }
-        function = m_customResolver;
+        function = m_customResolver.get();
     }
 
     RefPtr<JSCustomXPathNSResolver> selfProtector(this);
@@ -90,7 +90,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     args.append(jsString(exec, prefix));
 
     m_globalObject->globalData().timeoutChecker.start();
-    JSValue retval = JSMainThreadExecState::call(exec, function, callType, callData, m_customResolver, args);
+    JSValue retval = JSMainThreadExecState::call(exec, function, callType, callData, m_customResolver.get(), args);
     m_globalObject->globalData().timeoutChecker.stop();
 
     String result;
diff --git a/Source/WebCore/bindings/js/JSCustomXPathNSResolver.h b/Source/WebCore/bindings/js/JSCustomXPathNSResolver.h
index a58cb4946..753f41908 100644
--- a/Source/WebCore/bindings/js/JSCustomXPathNSResolver.h
+++ b/Source/WebCore/bindings/js/JSCustomXPathNSResolver.h
@@ -27,6 +27,8 @@
 #define JSCustomXPathNSResolver_h
 
 #include "XPathNSResolver.h"
+#include <heap/Strong.h>
+#include <heap/StrongInlines.h>
 #include <runtime/JSValue.h>
 #include <wtf/Forward.h>
 #include <wtf/RefPtr.h>
@@ -50,11 +52,11 @@ namespace WebCore {
         virtual String lookupNamespaceURI(const String& prefix);
 
     private:
-        JSCustomXPathNSResolver(JSC::JSObject*, JSDOMWindow*);
+        JSCustomXPathNSResolver(JSC::ExecState*, JSC::JSObject*, JSDOMWindow*);
 
-        // JSCustomXPathNSResolvers are always temporary, thus no need to GC protect the objects.
-        JSC::JSObject* m_customResolver;
-        JSDOMWindow* m_globalObject;
+        // JSCustomXPathNSResolvers are always temporary so using a Strong reference is safe here.
+        JSC::Strong<JSC::JSObject> m_customResolver;
+        JSC::Strong<JSDOMWindow> m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.cpp b/Source/WebCore/bindings/js/JSDOMBinding.cpp
index 31f25daf0..ba5c90ede 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/Source/WebCore/bindings/js/JSDOMBinding.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "JSDOMBinding.h"
 
+#include "BindingSecurity.h"
 #include "DOMObjectHashTableMap.h"
 #include "DOMStringList.h"
 #include "ExceptionCode.h"
@@ -114,7 +115,7 @@ AtomicStringImpl* findAtomicString(PropertyName propertyName)
     if (!impl)
         return 0;
     ASSERT(impl->existingHash());
-    return AtomicString::find(impl->characters(), impl->length(), impl->existingHash());
+    return AtomicString::find(impl);
 }
 
 String valueToStringWithNullCheck(ExecState* exec, JSValue value)
@@ -221,35 +222,24 @@ void setDOMException(ExecState* exec, ExceptionCode ec)
 
 #undef TRY_TO_CREATE_EXCEPTION
 
-DOMWindow* activeDOMWindow(ExecState* exec)
-{
-    return asJSDOMWindow(exec->lexicalGlobalObject())->impl();
-}
-
-DOMWindow* firstDOMWindow(ExecState* exec)
-{
-    return asJSDOMWindow(exec->dynamicGlobalObject())->impl();
-}
-
 bool shouldAllowAccessToNode(ExecState* exec, Node* node)
 {
-    return node && shouldAllowAccessToFrame(exec, node->document()->frame());
+    return BindingSecurity::shouldAllowAccessToNode(exec, node);
 }
 
 bool shouldAllowAccessToFrame(ExecState* exec, Frame* frame)
 {
-    if (!frame)
-        return false;
-    JSDOMWindow* window = toJSDOMWindow(frame, currentWorld(exec));
-    return window && window->allowsAccessFrom(exec);
+    return BindingSecurity::shouldAllowAccessToFrame(exec, frame);
 }
 
 bool shouldAllowAccessToFrame(ExecState* exec, Frame* frame, String& message)
 {
     if (!frame)
         return false;
-    JSDOMWindow* window = toJSDOMWindow(frame, currentWorld(exec));
-    return window && window->allowsAccessFrom(exec, message);
+    bool result = BindingSecurity::shouldAllowAccessToFrame(exec, frame, DoNotReportSecurityError);
+    // FIXME: The following line of code should move somewhere that it can be shared with immediatelyReportUnsafeAccessTo.
+    message = frame->domWindow()->crossDomainAccessErrorMessage(activeDOMWindow(exec));
+    return result;
 }
 
 void printErrorMessageForFrame(Frame* frame, const String& message)
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.h b/Source/WebCore/bindings/js/JSDOMBinding.h
index 67badd236..991d8c188 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.h
+++ b/Source/WebCore/bindings/js/JSDOMBinding.h
@@ -22,6 +22,7 @@
 #ifndef JSDOMBinding_h
 #define JSDOMBinding_h
 
+#include "BindingState.h"
 #include "CSSImportRule.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSStyleSheet.h"
@@ -409,12 +410,6 @@ enum ParameterDefaultPolicy {
     bool shouldAllowAccessToFrame(JSC::ExecState*, Frame*, String& message);
     // FIXME: Implement allowAccessToDOMWindow(JSC::ExecState*, DOMWindow*);
 
-    // FIXME: Remove these functions in favor of activeContext and
-    // firstContext, which return ScriptExecutionContext*. We prefer to use
-    // ScriptExecutionContext* as the context object in the bindings.
-    DOMWindow* activeDOMWindow(JSC::ExecState*);
-    DOMWindow* firstDOMWindow(JSC::ExecState*);
-
     void printErrorMessageForFrame(Frame*, const String& message);
     JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
diff --git a/Source/WebCore/bindings/js/JSDictionary.cpp b/Source/WebCore/bindings/js/JSDictionary.cpp
index 1f398820b..4957ba11d 100644
--- a/Source/WebCore/bindings/js/JSDictionary.cpp
+++ b/Source/WebCore/bindings/js/JSDictionary.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSDictionary.h"
 
+#include "ArrayValue.h"
 #include "Dictionary.h"
 #include "JSDOMWindow.h"
 #include "JSEventTarget.h"
@@ -33,8 +34,8 @@
 #include "JSNode.h"
 #include "JSStorage.h"
 #include "JSTrackCustom.h"
-#include "SerializedScriptValue.h"
 #include "ScriptValue.h"
+#include "SerializedScriptValue.h"
 #include <wtf/HashMap.h>
 #include <wtf/MathExtras.h>
 #include <wtf/text/AtomicString.h>
@@ -46,9 +47,9 @@ namespace WebCore {
 JSDictionary::GetPropertyResult JSDictionary::tryGetProperty(const char* propertyName, JSValue& finalResult) const
 {
     Identifier identifier(m_exec, propertyName);
-    PropertySlot slot(m_initializerObject);
+    PropertySlot slot(m_initializerObject.get());
 
-    if (!m_initializerObject->getPropertySlot(m_exec, identifier, slot))
+    if (!m_initializerObject.get()->getPropertySlot(m_exec, identifier, slot))
         return NoPropertyFound;
 
     if (m_exec->hadException())
@@ -185,6 +186,14 @@ void JSDictionary::convertValue(ExecState* exec, JSValue value, HashSet<AtomicSt
 }
 #endif
 
+void JSDictionary::convertValue(ExecState* exec, JSValue value, ArrayValue& result)
+{
+    if (value.isUndefinedOrNull())
+        return;
+
+    result = ArrayValue(exec, value);
+}
+
 bool JSDictionary::getWithUndefinedOrNullCheck(const String& propertyName, String& result) const
 {
     JSValue value;
diff --git a/Source/WebCore/bindings/js/JSDictionary.h b/Source/WebCore/bindings/js/JSDictionary.h
index 3e7ee55b2..5cadb1413 100644
--- a/Source/WebCore/bindings/js/JSDictionary.h
+++ b/Source/WebCore/bindings/js/JSDictionary.h
@@ -27,11 +27,14 @@
 #define JSDictionary_h
 
 #include "MessagePort.h"
+#include <heap/Strong.h>
+#include <heap/StrongInlines.h>
 #include <interpreter/CallFrame.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
+class ArrayValue;
 class Dictionary;
 class DOMWindow;
 class EventTarget;
@@ -45,7 +48,7 @@ class JSDictionary {
 public:
     JSDictionary(JSC::ExecState* exec, JSC::JSObject* initializerObject)
         : m_exec(exec)
-        , m_initializerObject(initializerObject)
+        , m_initializerObject(exec->globalData(), initializerObject)
     {
     }
 
@@ -61,7 +64,7 @@ public:
     bool getWithUndefinedOrNullCheck(const String& propertyName, String& value) const;
 
     JSC::ExecState* execState() const { return m_exec; }
-    JSC::JSObject* initializerObject() const { return m_initializerObject; }
+    JSC::JSObject* initializerObject() const { return m_initializerObject.get(); }
     bool isValid() const { return m_exec && m_initializerObject; }
 
 private:
@@ -105,9 +108,10 @@ private:
 #if ENABLE(MUTATION_OBSERVERS) || ENABLE(WEB_INTENTS)
     static void convertValue(JSC::ExecState*, JSC::JSValue, HashSet<AtomicString>& result);
 #endif
+    static void convertValue(JSC::ExecState*, JSC::JSValue, ArrayValue& result);
 
     JSC::ExecState* m_exec;
-    JSC::JSObject* m_initializerObject;
+    JSC::Strong<JSC::JSObject> m_initializerObject;
 };
 
 template <typename T, typename Result>
diff --git a/Source/WebCore/bindings/js/JSEventTargetCustom.cpp b/Source/WebCore/bindings/js/JSEventTargetCustom.cpp
index 66e157615..36c48f64a 100644
--- a/Source/WebCore/bindings/js/JSEventTargetCustom.cpp
+++ b/Source/WebCore/bindings/js/JSEventTargetCustom.cpp
@@ -73,6 +73,8 @@ EventTarget* toEventTarget(JSC::JSValue value)
     if (value.inherits(&JSDOMWindowShell::s_info))
         return jsCast<JSDOMWindowShell*>(asObject(value))->impl();
 
+    TRY_TO_UNWRAP_WITH_INTERFACE(EventTarget)
+    // FIXME: Remove this once all event targets extend EventTarget
     DOM_EVENT_TARGET_INTERFACES_FOR_EACH(TRY_TO_UNWRAP_WITH_INTERFACE)
     return 0;
 }
diff --git a/Source/WebCore/bindings/js/JSFloat32ArrayCustom.cpp b/Source/WebCore/bindings/js/JSFloat32ArrayCustom.cpp
deleted file mode 100644
index cade52e38..000000000
--- a/Source/WebCore/bindings/js/JSFloat32ArrayCustom.cpp
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "JSFloat32Array.h"
-
-#include "JSArrayBufferViewHelper.h"
-#include <wtf/Float32Array.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSFloat32Array::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<float>(value.toNumber(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Float32Array* object)
-{
-    return toJSArrayBufferView<JSFloat32Array>(exec, globalObject, object);
-}
-
-JSC::JSValue JSFloat32Array::set(JSC::ExecState* exec)
-{
-    return setWebGLArrayHelper(exec, impl(), toFloat32Array);
-}
-
-EncodedJSValue JSC_HOST_CALL JSFloat32ArrayConstructor::constructJSFloat32Array(ExecState* exec)
-{
-    JSFloat32ArrayConstructor* jsConstructor = jsCast<JSFloat32ArrayConstructor*>(exec->callee());
-    RefPtr<Float32Array> array = constructArrayBufferView<Float32Array, float>(exec);
-    if (!array.get())
-        // Exception has already been thrown.
-        return JSValue::encode(JSValue());
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), array.get())));
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSFloat64ArrayCustom.cpp b/Source/WebCore/bindings/js/JSFloat64ArrayCustom.cpp
deleted file mode 100644
index 15619e325..000000000
--- a/Source/WebCore/bindings/js/JSFloat64ArrayCustom.cpp
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "JSFloat64Array.h"
-
-#include "JSArrayBufferViewHelper.h"
-#include <wtf/Float64Array.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSFloat64Array::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, value.toNumber(exec));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Float64Array* object)
-{
-    return toJSArrayBufferView<JSFloat64Array>(exec, globalObject, object);
-}
-
-JSC::JSValue JSFloat64Array::set(JSC::ExecState* exec)
-{
-    return setWebGLArrayHelper(exec, impl(), toFloat64Array);
-}
-
-EncodedJSValue JSC_HOST_CALL JSFloat64ArrayConstructor::constructJSFloat64Array(ExecState* exec)
-{
-    JSFloat64ArrayConstructor* jsConstructor = jsCast<JSFloat64ArrayConstructor*>(exec->callee());
-    RefPtr<Float64Array> array = constructArrayBufferView<Float64Array, double>(exec);
-    if (!array.get())
-        // Exception has already been thrown.
-        return JSValue::encode(JSValue());
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), array.get())));
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp b/Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp
deleted file mode 100644
index bc77a6d2b..000000000
--- a/Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "JSInt16Array.h"
-
-#include "JSArrayBufferViewHelper.h"
-#include <wtf/Int16Array.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSInt16Array::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Int16Array* object)
-{
-    return toJSArrayBufferView<JSInt16Array>(exec, globalObject, object);
-}
-
-JSC::JSValue JSInt16Array::set(JSC::ExecState* exec)
-{
-    return setWebGLArrayHelper(exec, impl(), toInt16Array);
-}
-
-EncodedJSValue JSC_HOST_CALL JSInt16ArrayConstructor::constructJSInt16Array(ExecState* exec)
-{
-    JSInt16ArrayConstructor* jsConstructor = jsCast<JSInt16ArrayConstructor*>(exec->callee());
-    RefPtr<Int16Array> array = constructArrayBufferView<Int16Array, short>(exec);
-    if (!array.get())
-        // Exception has already been thrown.
-        return JSValue::encode(JSValue());
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), array.get())));
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSInt8ArrayCustom.cpp b/Source/WebCore/bindings/js/JSInt8ArrayCustom.cpp
deleted file mode 100644
index b6e15076f..000000000
--- a/Source/WebCore/bindings/js/JSInt8ArrayCustom.cpp
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "JSInt8Array.h"
-
-#include "JSArrayBufferViewHelper.h"
-#include <runtime/Error.h>
-#include <wtf/Int8Array.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSInt8Array::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Int8Array* object)
-{
-    return toJSArrayBufferView<JSInt8Array>(exec, globalObject, object);
-}
-
-JSC::JSValue JSInt8Array::set(JSC::ExecState* exec)
-{
-    return setWebGLArrayHelper(exec, impl(), toInt8Array);
-}
-
-EncodedJSValue JSC_HOST_CALL JSInt8ArrayConstructor::constructJSInt8Array(ExecState* exec)
-{
-    JSInt8ArrayConstructor* jsConstructor = jsCast<JSInt8ArrayConstructor*>(exec->callee());
-    RefPtr<Int8Array> array = constructArrayBufferView<Int8Array, signed char>(exec);
-    if (!array.get())
-        // Exception has already been thrown.
-        return JSValue::encode(JSValue());
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), array.get())));
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/Source/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index 23532649e..8f2645a48 100644
--- a/Source/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/Source/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -30,8 +30,7 @@
 
 #include "JSSVGElementInstance.h"
 
-#include "JSNode.h"
-#include "SVGElementInstance.h"
+#include "JSEventTarget.h"
 
 namespace WebCore {
 
@@ -41,7 +40,9 @@ void JSSVGElementInstance::visitChildren(JSC::JSCell* cell, JSC::SlotVisitor& vi
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     COMPILE_ASSERT(StructureFlags & JSC::OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
-    Base::visitChildren(thisObject, visitor);
+    // Skip JSEventTarget::visitChildren because event listener registration is
+    // forwarded to the corresponding element.
+    JSEventTarget::Base::visitChildren(thisObject, visitor);
     visitor.addOpaqueRoot(root(thisObject->impl()->correspondingElement()));
 }
 
diff --git a/Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp b/Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp
deleted file mode 100644
index 47b4402ba..000000000
--- a/Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "JSUint16Array.h"
-
-#include "JSArrayBufferViewHelper.h"
-#include <wtf/Uint16Array.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSUint16Array::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Uint16Array* object)
-{
-    return toJSArrayBufferView<JSUint16Array>(exec, globalObject, object);
-}
-
-JSC::JSValue JSUint16Array::set(JSC::ExecState* exec)
-{
-    return setWebGLArrayHelper(exec, impl(), toUint16Array);
-}
-
-EncodedJSValue JSC_HOST_CALL JSUint16ArrayConstructor::constructJSUint16Array(ExecState* exec)
-{
-    JSUint16ArrayConstructor* jsConstructor = jsCast<JSUint16ArrayConstructor*>(exec->callee());
-    RefPtr<Uint16Array> array = constructArrayBufferView<Uint16Array, unsigned short>(exec);
-    if (!array.get())
-        // Exception has already been thrown.
-        return JSValue::encode(JSValue());
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), array.get())));
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp b/Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp
deleted file mode 100644
index aa8b8267f..000000000
--- a/Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "JSUint32Array.h"
-
-#include "JSArrayBufferViewHelper.h"
-#include <wtf/Uint32Array.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSUint32Array::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<unsigned int>(value.toUInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Uint32Array* object)
-{
-    return toJSArrayBufferView<JSUint32Array>(exec, globalObject, object);
-}
-
-JSC::JSValue JSUint32Array::set(JSC::ExecState* exec)
-{
-    return setWebGLArrayHelper(exec, impl(), toUint32Array);
-}
-
-EncodedJSValue JSC_HOST_CALL JSUint32ArrayConstructor::constructJSUint32Array(ExecState* exec)
-{
-    JSUint32ArrayConstructor* jsConstructor = jsCast<JSUint32ArrayConstructor*>(exec->callee());
-    RefPtr<Uint32Array> array = constructArrayBufferView<Uint32Array, unsigned int>(exec);
-    if (!array.get())
-        // Exception has already been thrown.
-        return JSValue::encode(JSValue());
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), array.get())));
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp b/Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp
deleted file mode 100644
index 6a4fa1df5..000000000
--- a/Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "JSUint8Array.h"
-
-#include "JSArrayBufferViewHelper.h"
-#include <wtf/Uint8Array.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSUint8Array::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Uint8Array* object)
-{
-    return toJSArrayBufferView<JSUint8Array>(exec, globalObject, object);
-}
-
-JSC::JSValue JSUint8Array::set(JSC::ExecState* exec)
-{
-    return setWebGLArrayHelper(exec, impl(), toUint8Array);
-}
-
-EncodedJSValue JSC_HOST_CALL JSUint8ArrayConstructor::constructJSUint8Array(ExecState* exec)
-{
-    JSUint8ArrayConstructor* jsConstructor = jsCast<JSUint8ArrayConstructor*>(exec->callee());
-    RefPtr<Uint8Array> array = constructArrayBufferView<Uint8Array, unsigned char>(exec);
-    if (!array.get())
-        // Exception has already been thrown.
-        return JSValue::encode(JSValue());
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), array.get())));
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSUint8ClampedArrayCustom.cpp b/Source/WebCore/bindings/js/JSUint8ClampedArrayCustom.cpp
deleted file mode 100644
index 2d5ca785d..000000000
--- a/Source/WebCore/bindings/js/JSUint8ClampedArrayCustom.cpp
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSUint8ClampedArray.h"
-
-#include "JSArrayBufferViewHelper.h"
-#include <wtf/Uint8ClampedArray.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSUint8ClampedArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, value.toNumber(exec));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Uint8ClampedArray* object)
-{
-    return toJSArrayBufferView<JSUint8ClampedArray>(exec, globalObject, object);
-}
-
-JSC::JSValue JSUint8ClampedArray::set(JSC::ExecState* exec)
-{
-    return setWebGLArrayHelper(exec, impl(), toUint8ClampedArray);
-}
-
-EncodedJSValue JSC_HOST_CALL JSUint8ClampedArrayConstructor::constructJSUint8ClampedArray(ExecState* exec)
-{
-    JSUint8ClampedArrayConstructor* jsConstructor = jsCast<JSUint8ClampedArrayConstructor*>(exec->callee());
-    RefPtr<Uint8ClampedArray> array = constructArrayBufferView<Uint8ClampedArray, unsigned char>(exec);
-    if (!array.get())
-        // Exception has already been thrown.
-        return JSValue::encode(JSValue());
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), array.get())));
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSWebSocketCustom.cpp b/Source/WebCore/bindings/js/JSWebSocketCustom.cpp
index 49b822a62..c42b3cbdf 100644
--- a/Source/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/Source/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -37,6 +37,7 @@
 
 #include "ExceptionCode.h"
 #include "JSArrayBuffer.h"
+#include "JSArrayBufferView.h"
 #include "JSBlob.h"
 #include "JSEventListener.h"
 #include "KURL.h"
@@ -100,6 +101,8 @@ JSValue JSWebSocket::send(ExecState* exec)
     bool result;
     if (message.inherits(&JSArrayBuffer::s_info))
         result = impl()->send(toArrayBuffer(message), ec);
+    else if (message.inherits(&JSArrayBufferView::s_info))
+        result = impl()->send(toArrayBufferView(message), ec);
     else if (message.inherits(&JSBlob::s_info))
         result = impl()->send(toBlob(message), ec);
     else {
@@ -116,38 +119,6 @@ JSValue JSWebSocket::send(ExecState* exec)
     return jsBoolean(result);
 }
 
-JSValue JSWebSocket::close(ExecState* exec)
-{
-    // FIXME: We should implement [Clamp] for IDL binding code generator, and
-    // remove this custom method.
-    WebSocket* webSocket = static_cast<WebSocket*>(impl());
-    size_t argumentCount = exec->argumentCount();
-    int code = WebSocketChannel::CloseEventCodeNotSpecified;
-    String reason = "";
-    if (argumentCount >= 1) {
-        JSValue v = exec->argument(0);
-        double x = v.toNumber(exec);
-        double maxValue = static_cast<double>(std::numeric_limits<uint16_t>::max());
-        double minValue = static_cast<double>(std::numeric_limits<uint16_t>::min());
-        if (isnan(x))
-            x = 0.0;
-        else
-            x = clampTo(x, minValue, maxValue);
-        code = clampToInteger(x);
-        if (argumentCount >= 2) {
-            reason = ustringToString(exec->argument(1).toString(exec)->value(exec));
-            if (exec->hadException()) {
-                setDOMException(exec, SYNTAX_ERR);
-                return jsUndefined();
-            }
-        }
-    }
-    ExceptionCode ec = 0;
-    webSocket->close(code, reason, ec);
-    setDOMException(exec, ec);
-    return jsUndefined();
-}
-
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/bindings/js/ScriptController.cpp b/Source/WebCore/bindings/js/ScriptController.cpp
index 06c799640..7b0787201 100644
--- a/Source/WebCore/bindings/js/ScriptController.cpp
+++ b/Source/WebCore/bindings/js/ScriptController.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "ContentSecurityPolicy.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
@@ -34,6 +35,7 @@
 #include "NP_jsobject.h"
 #include "Page.h"
 #include "PageGroup.h"
+#include "PluginView.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "ScriptableDocumentParser.h"
@@ -215,6 +217,9 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
 
     windowShell->window()->updateDocument();
 
+    if (m_frame->document())
+        windowShell->window()->setEvalEnabled(m_frame->document()->contentSecurityPolicy()->allowEval(0, ContentSecurityPolicy::SuppressReport));   
+
     if (Page* page = m_frame->page()) {
         attachDebugger(windowShell, page->debugger());
         windowShell->window()->setProfileGroup(page->group().identifier());
@@ -237,13 +242,16 @@ void ScriptController::enableEval()
 {
     JSDOMWindowShell* windowShell = existingWindowShell(mainThreadNormalWorld());
     if (!windowShell)
-        return; // Eval is enabled by default.
+        return;
     windowShell->window()->setEvalEnabled(true);
 }
 
 void ScriptController::disableEval()
 {
-    windowShell(mainThreadNormalWorld())->window()->setEvalEnabled(false);
+    JSDOMWindowShell* windowShell = existingWindowShell(mainThreadNormalWorld());
+    if (!windowShell)
+        return;
+    windowShell->window()->setEvalEnabled(false);
 }
 
 bool ScriptController::processingUserGesture()
@@ -382,6 +390,16 @@ NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement
 
 #endif
 
+#if !PLATFORM(MAC) && !PLATFORM(QT)
+PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(Widget* widget)
+{
+    if (!widget->isPluginView())
+        return 0;
+
+    return static_cast<PluginView*>(widget)->bindingInstance();
+}
+#endif
+
 JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)
 {
     // Can't create JSObjects when JavaScript is disabled
diff --git a/Source/WebCore/bindings/js/ScriptControllerEfl.cpp b/Source/WebCore/bindings/js/ScriptControllerEfl.cpp
deleted file mode 100644
index fea172e39..000000000
--- a/Source/WebCore/bindings/js/ScriptControllerEfl.cpp
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
- * Copyright (C) 2007 Holger Hans Peter Freyther
- * Copyright (C) 2008 Collabora Ltd.  All rights reserved.
- * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
- * Copyright (C) 2009,2010 ProFUSION embedded systems
- * Copyright (C) 2009,2010 Samsung Electronics
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ScriptController.h"
-
-#include "PluginView.h"
-
-namespace WebCore {
-
-PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(Widget* widget)
-{
-    if (!widget->isPluginView())
-        return 0;
-
-    return static_cast<PluginView*>(widget)->bindingInstance();
-}
-
-}
diff --git a/Source/WebCore/bindings/js/ScriptControllerGtk.cpp b/Source/WebCore/bindings/js/ScriptControllerGtk.cpp
deleted file mode 100644
index 886f110f1..000000000
--- a/Source/WebCore/bindings/js/ScriptControllerGtk.cpp
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
- * Copyright (C) 2007 Holger Hans Peter Freyther
- * Copyright (C) 2008 Collabora Ltd.  All rights reserved.
- * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ScriptController.h"
-
-#include "BridgeJSC.h"
-#include "PluginView.h"
-#include "runtime_root.h"
-
-namespace WebCore {
-
-PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(Widget* widget)
-{
-    if (!widget->isPluginView())
-        return 0;
-
-    return static_cast<PluginView*>(widget)->bindingInstance();
-}
-
-}
diff --git a/Source/WebCore/bindings/js/ScriptControllerWx.cpp b/Source/WebCore/bindings/js/ScriptControllerWx.cpp
deleted file mode 100644
index 632f63c69..000000000
--- a/Source/WebCore/bindings/js/ScriptControllerWx.cpp
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Computer, Inc.  All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ScriptController.h"
-
-#include "BridgeJSC.h"
-#include "PluginView.h"
-#include "runtime_root.h"
-
-namespace WebCore {
-
-PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(Widget* widget)
-{
-    if (!widget->isPluginView())
-        return 0;
-
-    return static_cast<PluginView*>(widget)->bindingInstance();
-}
-
-}
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.cpp b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
index 9ace82d93..51152fa6c 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -75,20 +75,28 @@ String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBrea
     SourceIdToBreakpointsMap::iterator it = m_sourceIdToBreakpoints.find(sourceIDValue);
     if (it == m_sourceIdToBreakpoints.end())
         it = m_sourceIdToBreakpoints.set(sourceIDValue, LineToBreakpointMap()).iterator;
-    if (it->second.contains(scriptBreakpoint.lineNumber + 1))
-        return "";
-    it->second.set(scriptBreakpoint.lineNumber + 1, scriptBreakpoint);
+    LineToBreakpointMap::iterator breaksIt = it->second.find(scriptBreakpoint.lineNumber + 1);
+    if (breaksIt == it->second.end())
+        breaksIt = it->second.set(scriptBreakpoint.lineNumber + 1, BreakpointsInLine()).iterator;
+
+    BreakpointsInLine& breaksVector = breaksIt->second;
+    unsigned breaksCount = breaksVector.size();
+    for (unsigned i = 0; i < breaksCount; i++) {
+        if (breaksVector.at(i).columnNumber == scriptBreakpoint.columnNumber)
+            return "";
+    }
+    breaksVector.append(scriptBreakpoint);
+
     *actualLineNumber = scriptBreakpoint.lineNumber;
-    // FIXME(WK53003): implement setting breakpoints by line:column.
-    *actualColumnNumber = 0;
-    return sourceID + ":" + String::number(scriptBreakpoint.lineNumber);
+    *actualColumnNumber = scriptBreakpoint.columnNumber;
+    return sourceID + ":" + String::number(scriptBreakpoint.lineNumber) + ":" + String::number(scriptBreakpoint.columnNumber);
 }
 
 void ScriptDebugServer::removeBreakpoint(const String& breakpointId)
 {
     Vector<String> tokens;
     breakpointId.split(":", tokens);
-    if (tokens.size() != 2)
+    if (tokens.size() != 3)
         return;
     bool success;
     intptr_t sourceIDValue = tokens[0].toIntPtr(&success);
@@ -97,9 +105,63 @@ void ScriptDebugServer::removeBreakpoint(const String& breakpointId)
     unsigned lineNumber = tokens[1].toUInt(&success);
     if (!success)
         return;
+    unsigned columnNumber = tokens[2].toUInt(&success);
+    if (!success)
+        return;
+
     SourceIdToBreakpointsMap::iterator it = m_sourceIdToBreakpoints.find(sourceIDValue);
-    if (it != m_sourceIdToBreakpoints.end())
-        it->second.remove(lineNumber + 1);
+    if (it == m_sourceIdToBreakpoints.end())
+        return;
+    LineToBreakpointMap::iterator breaksIt = it->second.find(lineNumber + 1);
+    if (breaksIt == it->second.end())
+        return;
+
+    BreakpointsInLine& breaksVector = breaksIt->second;
+    unsigned breaksCount = breaksVector.size();
+    for (unsigned i = 0; i < breaksCount; i++) {
+        if (breaksVector.at(i).columnNumber == static_cast<int>(columnNumber)) {
+            breaksVector.remove(i);
+            break;
+        }
+    }
+}
+
+void ScriptDebugServer::updateCurrentStatementPosition(intptr_t sourceID, int line)
+{
+    if (line < 0)
+        return;
+
+    SourceProvider* source = reinterpret_cast<SourceProvider*>(sourceID);
+
+    if (m_currentSourceID != sourceID) {
+        String sourceCode = ustringToString(JSC::UString(const_cast<StringImpl*>(source->data())));
+        m_currentSourceCode.clear();
+        sourceCode.split("\n", true, m_currentSourceCode);
+        m_currentSourceID = sourceID;
+        m_currentStatementPosition.lineNumber = 0;
+        m_currentStatementPosition.columnNumber = 0;
+    }
+
+    if (line != m_currentStatementPosition.lineNumber) {
+        m_currentStatementPosition.lineNumber = line;
+        m_currentStatementPosition.columnNumber = 0;
+        return;
+    }
+
+    int startLine = source->startPosition().m_line.zeroBasedInt();
+    if ((m_currentStatementPosition.lineNumber - startLine - 1) >= static_cast<int>(m_currentSourceCode.size()))
+        return;
+    const String& codeInLine = m_currentSourceCode[m_currentStatementPosition.lineNumber - startLine - 1];
+    if (codeInLine.isEmpty())
+        return;
+    int nextColumn = codeInLine.find(";", m_currentStatementPosition.columnNumber);
+    if (nextColumn != -1) {
+        UChar c = codeInLine[nextColumn + 1];
+        if (c == ' ' || c == '\t')
+            nextColumn += 1;
+        m_currentStatementPosition.columnNumber = nextColumn + 1;
+    } else
+        m_currentStatementPosition.columnNumber = 0;
 }
 
 bool ScriptDebugServer::hasBreakpoint(intptr_t sourceID, const TextPosition& position) const
@@ -110,19 +172,37 @@ bool ScriptDebugServer::hasBreakpoint(intptr_t sourceID, const TextPosition& pos
     SourceIdToBreakpointsMap::const_iterator it = m_sourceIdToBreakpoints.find(sourceID);
     if (it == m_sourceIdToBreakpoints.end())
         return false;
-    int lineNumber = position.m_line.oneBasedInt();
-    if (lineNumber <= 0)
+
+    int lineNumber = position.m_line.zeroBasedInt();
+    int columnNumber = position.m_column.zeroBasedInt();
+    if (lineNumber < 0 || columnNumber < 0)
+        return false;
+
+    LineToBreakpointMap::const_iterator breaksIt = it->second.find(lineNumber + 1);
+    if (breaksIt == it->second.end())
         return false;
-    LineToBreakpointMap::const_iterator breakIt = it->second.find(lineNumber);
-    if (breakIt == it->second.end())
+
+    bool hit = false;
+    const BreakpointsInLine& breaksVector = breaksIt->second;
+    unsigned breaksCount = breaksVector.size();
+    unsigned i;
+    for (i = 0; i < breaksCount; i++) {
+        int breakColumn = breaksVector.at(i).columnNumber;
+        int breakLine = breaksVector.at(i).lineNumber;
+        if (lineNumber == breakLine && columnNumber == breakColumn) {
+            hit = true;
+            break;
+        }
+    }
+    if (!hit)
         return false;
 
     // An empty condition counts as no condition which is equivalent to "true".
-    if (breakIt->second.condition.isEmpty())
+    if (breaksVector.at(i).condition.isEmpty())
         return true;
 
     JSValue exception;
-    JSValue result = m_currentCallFrame->evaluate(stringToUString(breakIt->second.condition), exception);
+    JSValue result = m_currentCallFrame->evaluate(stringToUString(breaksVector.at(i).condition), exception);
     if (exception) {
         // An erroneous condition counts as "false".
         return false;
@@ -347,20 +427,20 @@ void ScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallback
     m_callingListeners = false;
 }
 
-void ScriptDebugServer::createCallFrameAndPauseIfNeeded(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::createCallFrameAndPauseIfNeeded(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
-    TextPosition textPosition(OrdinalNumber::fromOneBasedInt(lineNumber), OrdinalNumber::first());
+    TextPosition textPosition(OrdinalNumber::fromOneBasedInt(lineNumber), OrdinalNumber::fromZeroBasedInt(columnNumber));
     m_currentCallFrame = JavaScriptCallFrame::create(debuggerCallFrame, m_currentCallFrame, sourceID, textPosition);
     pauseIfNeeded(debuggerCallFrame.dynamicGlobalObject());
 }
 
-void ScriptDebugServer::updateCallFrameAndPauseIfNeeded(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::updateCallFrameAndPauseIfNeeded(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     ASSERT(m_currentCallFrame);
     if (!m_currentCallFrame)
         return;
 
-    TextPosition textPosition(OrdinalNumber::fromOneBasedInt(lineNumber), OrdinalNumber::first());
+    TextPosition textPosition(OrdinalNumber::fromOneBasedInt(lineNumber), OrdinalNumber::fromZeroBasedInt(columnNumber));
     m_currentCallFrame->update(debuggerCallFrame, sourceID, textPosition);
     pauseIfNeeded(debuggerCallFrame.dynamicGlobalObject());
 }
@@ -399,24 +479,24 @@ void ScriptDebugServer::pauseIfNeeded(JSGlobalObject* dynamicGlobalObject)
     m_paused = false;
 }
 
-void ScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (!m_paused)
-        createCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber);
+        createCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber, columnNumber);
 }
 
-void ScriptDebugServer::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (!m_paused)
-        updateCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber);
+        updateCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber, columnNumber);
 }
 
-void ScriptDebugServer::returnEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::returnEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (m_paused)
         return;
 
-    updateCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber);
+    updateCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber, columnNumber);
 
     // detach may have been called during pauseIfNeeded
     if (!m_currentCallFrame)
@@ -428,7 +508,7 @@ void ScriptDebugServer::returnEvent(const DebuggerCallFrame& debuggerCallFrame,
     m_currentCallFrame = m_currentCallFrame->caller();
 }
 
-void ScriptDebugServer::exception(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, bool hasHandler)
+void ScriptDebugServer::exception(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber, bool hasHandler)
 {
     if (m_paused)
         return;
@@ -436,21 +516,21 @@ void ScriptDebugServer::exception(const DebuggerCallFrame& debuggerCallFrame, in
     if (m_pauseOnExceptionsState == PauseOnAllExceptions || (m_pauseOnExceptionsState == PauseOnUncaughtExceptions && !hasHandler))
         m_pauseOnNextStatement = true;
 
-    updateCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber);
+    updateCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber, columnNumber);
 }
 
-void ScriptDebugServer::willExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::willExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (!m_paused)
-        createCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber);
+        createCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber, columnNumber);
 }
 
-void ScriptDebugServer::didExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::didExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (m_paused)
         return;
 
-    updateCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber);
+    updateCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber, columnNumber);
 
     // Treat stepping over the end of a program like stepping out.
     if (m_currentCallFrame == m_pauseOnCallFrame)
@@ -458,13 +538,13 @@ void ScriptDebugServer::didExecuteProgram(const DebuggerCallFrame& debuggerCallF
     m_currentCallFrame = m_currentCallFrame->caller();
 }
 
-void ScriptDebugServer::didReachBreakpoint(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void ScriptDebugServer::didReachBreakpoint(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (m_paused)
         return;
 
     m_pauseOnNextStatement = true;
-    updateCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber);
+    updateCallFrameAndPauseIfNeeded(debuggerCallFrame, sourceID, lineNumber, columnNumber);
 }
 
 void ScriptDebugServer::recompileAllJSFunctionsSoon()
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.h b/Source/WebCore/bindings/js/ScriptDebugServer.h
index 84fba5c67..935914c6b 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.h
@@ -123,22 +123,26 @@ protected:
     void dispatchDidParseSource(const ListenerSet& listeners, JSC::SourceProvider*, bool isContentScript);
     void dispatchFailedToParseSource(const ListenerSet& listeners, JSC::SourceProvider*, int errorLine, const String& errorMessage);
 
-    void createCallFrameAndPauseIfNeeded(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-    void updateCallFrameAndPauseIfNeeded(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
+    void createCallFrameAndPauseIfNeeded(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber);
+    void updateCallFrameAndPauseIfNeeded(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber);
     void pauseIfNeeded(JSC::JSGlobalObject* dynamicGlobalObject);
 
     virtual void detach(JSC::JSGlobalObject*);
 
     virtual void sourceParsed(JSC::ExecState*, JSC::SourceProvider*, int errorLine, const JSC::UString& errorMsg);
-    virtual void callEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-    virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int firstLine);
-    virtual void returnEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-    virtual void exception(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, bool hasHandler);
-    virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-    virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-    virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-
-    typedef HashMap<long, ScriptBreakpoint> LineToBreakpointMap;
+    virtual void callEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber);
+    virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int firstLine, int columnNumber);
+    virtual void returnEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber);
+    virtual void exception(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber, bool hasHandler);
+    virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno, int columnNumber);
+    virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno, int columnNumber);
+    virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno, int columnNumber);
+
+
+    void updateCurrentStatementPosition(intptr_t, int);
+
+    typedef Vector<ScriptBreakpoint> BreakpointsInLine;
+    typedef HashMap<long, BreakpointsInLine> LineToBreakpointMap;
     typedef HashMap<intptr_t, LineToBreakpointMap> SourceIdToBreakpointsMap;
 
     bool m_callingListeners;
@@ -151,6 +155,10 @@ protected:
     RefPtr<JavaScriptCallFrame> m_currentCallFrame;
     SourceIdToBreakpointsMap m_sourceIdToBreakpoints;
     Timer<ScriptDebugServer> m_recompileTimer;
+
+    Vector<String> m_currentSourceCode;
+    intptr_t m_currentSourceID;
+    ScriptBreakpoint m_currentStatementPosition;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/ScriptWrappable.h b/Source/WebCore/bindings/js/ScriptWrappable.h
index 3cb5d816c..cd0873aff 100644
--- a/Source/WebCore/bindings/js/ScriptWrappable.h
+++ b/Source/WebCore/bindings/js/ScriptWrappable.h
@@ -32,6 +32,7 @@
 #define ScriptWrappable_h
 
 #include "JSDOMWrapper.h"
+#include "MemoryInstrumentation.h"
 #include <heap/Weak.h>
 
 namespace WebCore {
@@ -56,7 +57,7 @@ public:
 
     void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo<ScriptWrappable> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
         info.addMember(m_wrapper);
     }
 
diff --git a/Source/WebCore/bindings/objc/PublicDOMInterfaces.h b/Source/WebCore/bindings/objc/PublicDOMInterfaces.h
index 45e167729..6ab45dfbf 100644
--- a/Source/WebCore/bindings/objc/PublicDOMInterfaces.h
+++ b/Source/WebCore/bindings/objc/PublicDOMInterfaces.h
@@ -174,6 +174,7 @@
 @interface DOMElement : DOMNode WEBKIT_VERSION_1_3
 @property(readonly, copy) NSString *tagName;
 @property(readonly, retain) DOMCSSStyleDeclaration *style;
+@property(copy) NSString *className;
 @property(readonly) int offsetLeft;
 @property(readonly) int offsetTop;
 @property(readonly) int offsetWidth;
@@ -472,7 +473,6 @@
 @property(copy) NSString *idName;
 @property(copy) NSString *lang;
 @property(copy) NSString *dir;
-@property(copy) NSString *className;
 @property(copy) NSString *innerHTML;
 @property(copy) NSString *innerText;
 @property(copy) NSString *outerHTML;
diff --git a/Source/WebCore/bindings/scripts/CodeGenerator.pm b/Source/WebCore/bindings/scripts/CodeGenerator.pm
index 748b4e51e..89bd7f816 100644
--- a/Source/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/Source/WebCore/bindings/scripts/CodeGenerator.pm
@@ -354,6 +354,23 @@ sub SkipIncludeHeader
     return 0;
 }
 
+sub IsArrayType
+{
+    my $object = shift;
+    my $type = shift;
+    # FIXME: Add proper support for T[], T[]?, sequence<T>.
+    return $type =~ m/\[\]$/;
+}
+
+sub IsConstructorTemplate
+{
+    my $object = shift;
+    my $dataNode = shift;
+    my $template = shift;
+
+    return $dataNode->extendedAttributes->{"ConstructorTemplate"} && $dataNode->extendedAttributes->{"ConstructorTemplate"} eq $template;
+}
+
 sub IsNumericType
 {
     my $object = shift;
@@ -409,6 +426,17 @@ sub IsSVGTypeWithWritablePropertiesNeedingTearOff
     return 0;
 }
 
+sub IsTypedArrayType
+{
+    my $object = shift;
+    my $type = shift;
+    return 1 if (($type eq "ArrayBuffer") or ($type eq "ArrayBufferView"));
+    return 1 if (($type eq "Uint8Array") or ($type eq "Uint8ClampedArray") or ($type eq "Uint16Array") or ($type eq "Uint32Array"));
+    return 1 if (($type eq "Int8Array") or ($type eq "Int16Array") or ($type eq "Int32Array"));
+    return 1 if (($type eq "Float32Array") or ($type eq "Float64Array"));
+    return 0;
+}
+
 sub GetSVGTypeNeedingTearOff
 {
     my $object = shift;
@@ -708,4 +736,22 @@ sub GetVisibleInterfaceName
     return $interfaceName ? $interfaceName : $dataNode->name;
 }
 
+sub IsStrictSubtype
+{
+    my $object = shift;
+    my $dataNode = shift;
+    my $interfaceName = shift;
+    my $found = 0;
+
+    $object->ForAllParents($dataNode, sub {
+        my $interface = shift;
+        if ($object->StripModule($interface->name) eq $interfaceName) {
+            $found = 1;
+        }
+        return "prune" if $found;
+    }, 0, 1);
+
+    return $found;
+}
+
 1;
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
index b82344910..4a3cc0110 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
@@ -224,6 +224,8 @@ sub SkipAttribute
 
     return 1 if $attribute->signature->type =~ /Constructor$/;
 
+    return 1 if $codeGenerator->IsTypedArrayType($attribute->signature->type);
+
     if ($codeGenerator->GetArrayType($attribute->signature->type)) {
         return 1;
     }
@@ -491,6 +493,7 @@ sub GenerateHeader
     if ($numFunctions > 0) {
         foreach my $function (@{$dataNode->functions}) {
             next if SkipFunction($function);
+            next if ($function->signature->name eq "set" and $dataNode->extendedAttributes->{"TypedArray"});
             my $functionName = $function->signature->extendedAttributes->{"ImplementedAs"} || $function->signature->name;
 
             my $returnType = GetCPPType($function->signature->type, 0);
@@ -812,6 +815,7 @@ sub GenerateImplementation
         foreach my $function (@{$dataNode->functions}) {
             # Treat CPPPureInterface as Custom as well, since the WebCore versions will take a script context as well
             next if SkipFunction($function) || $dataNode->extendedAttributes->{"CPPPureInterface"};
+            next if ($function->signature->name eq "set" and $dataNode->extendedAttributes->{"TypedArray"});
             AddIncludesForType($function->signature->type);
 
             my $functionName = $function->signature->name;
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
index e122fd4e8..c84087b19 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
@@ -179,6 +179,8 @@ sub SkipAttribute {
         return 1;
     }
 
+    return 1 if $codeGenerator->IsTypedArrayType($propType);
+
     $codeGenerator->AssertNotSequenceType($propType);
 
     if ($codeGenerator->GetArrayType($propType)) {
@@ -800,6 +802,8 @@ sub GenerateFunction {
         return;
     }
 
+    return if ($function->signature->name eq "set" and $parentNode->extendedAttributes->{"TypedArray"});
+
     my $functionSigName = $function->signature->name;
     my $functionSigType = $prefix eq "set_" ? "void" : $function->signature->type;
     my $functionName = "webkit_dom_" . $decamelize . "_" . $prefix . decamelize($functionSigName);
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index c3d9ad479..60d96ccf5 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -264,7 +264,7 @@ sub AddIncludesForType
         $includesRef->{"SerializedScriptValue.h"} = 1;
     } elsif ($isCallback) {
         $includesRef->{"JS${type}.h"} = 1;
-    } elsif (IsTypedArrayType($type)) {
+    } elsif ($codeGenerator->IsTypedArrayType($type)) {
         $includesRef->{"<wtf/${type}.h>"} = 1;
     } elsif ($codeGenerator->GetSequenceType($type)) {
     } else {
@@ -315,16 +315,6 @@ sub IsScriptProfileType
     return 0;
 }
 
-sub IsTypedArrayType
-{
-    my $type = shift;
-    return 1 if (($type eq "ArrayBuffer") or ($type eq "ArrayBufferView"));
-    return 1 if (($type eq "Uint8Array") or ($type eq "Uint8ClampedArray") or ($type eq "Uint16Array") or ($type eq "Uint32Array"));
-    return 1 if (($type eq "Int8Array") or ($type eq "Int16Array") or ($type eq "Int32Array"));
-    return 1 if (($type eq "Float32Array") or ($type eq "Float64Array"));
-    return 0;
-}
-
 sub AddTypedefForScriptProfileType
 {
     my $type = shift;
@@ -338,7 +328,7 @@ sub AddClassForwardIfNeeded
     my $implClassName = shift;
 
     # SVGAnimatedLength/Number/etc. are typedefs to SVGAnimatedTemplate, so don't use class forwards for them!
-    unless ($codeGenerator->IsSVGAnimatedType($implClassName) or IsScriptProfileType($implClassName) or IsTypedArrayType($implClassName)) {
+    unless ($codeGenerator->IsSVGAnimatedType($implClassName) or IsScriptProfileType($implClassName) or $codeGenerator->IsTypedArrayType($implClassName)) {
         push(@headerContent, "class $implClassName;\n\n");
     # ScriptProfile and ScriptProfileNode are typedefs to JSC::Profile and JSC::ProfileNode.
     } elsif (IsScriptProfileType($implClassName)) {
@@ -678,8 +668,7 @@ sub GenerateHeader
     my $hasRealParent = @{$dataNode->parents} > 0;
     my $hasParent = $hasLegacyParent || $hasRealParent;
     my $parentClassName = GetParentClassName($dataNode);
-    my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
-    my $needsMarkChildren = $dataNode->extendedAttributes->{"JSCustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
+    my $needsMarkChildren = $dataNode->extendedAttributes->{"JSCustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"} || $dataNode->name eq "EventTarget";
 
     # - Add default header template and header protection
     push(@headerContentHeader, GenerateHeaderContentHeader($dataNode));
@@ -706,7 +695,7 @@ sub GenerateHeader
     }
 
     if ($hasParent && $dataNode->extendedAttributes->{"JSGenerateToNativeObject"}) {
-        if (IsTypedArrayType($implClassName)) {
+        if ($codeGenerator->IsTypedArrayType($implClassName)) {
             $headerIncludes{"<wtf/$implClassName.h>"} = 1;
         } else {
             $headerIncludes{"$implClassName.h"} = 1;
@@ -740,7 +729,7 @@ sub GenerateHeader
     }
 
     AddClassForwardIfNeeded("JSDOMWindowShell") if $interfaceName eq "DOMWindow";
-    AddClassForwardIfNeeded("JSDictionary") if IsConstructorTemplate($dataNode, "Event");
+    AddClassForwardIfNeeded("JSDictionary") if $codeGenerator->IsConstructorTemplate($dataNode, "Event");
 
     # Class declaration
     push(@headerContent, "class $className : public $parentClassName {\n");
@@ -950,7 +939,7 @@ sub GenerateHeader
         push(@headerContent, "    }\n");
     }
 
-    if (IsTypedArrayType($implType) and ($implType ne "ArrayBufferView") and ($implType ne "ArrayBuffer")) {
+    if ($codeGenerator->IsTypedArrayType($implType) and ($implType ne "ArrayBufferView") and ($implType ne "ArrayBuffer")) {
         push(@headerContent, "    static const JSC::TypedArrayType TypedArrayStorageType = JSC::");
         push(@headerContent, "TypedArrayInt8") if $implType eq "Int8Array";
         push(@headerContent, "TypedArrayInt16") if $implType eq "Int16Array";
@@ -1275,7 +1264,7 @@ sub GenerateParametersCheckExpression
             # For Callbacks only checks if the value is null or object.
             push(@andExpression, "(${value}.isNull() || ${value}.isFunction())");
             $usedArguments{$parameterIndex} = 1;
-        } elsif (IsArrayType($type) || $codeGenerator->GetSequenceType($type)) {
+        } elsif ($codeGenerator->IsArrayType($type) || $codeGenerator->GetSequenceType($type)) {
             # FIXME: Add proper support for T[], T[]?, sequence<T>
             if ($parameter->isNullable) {
                 push(@andExpression, "(${value}.isNull() || (${value}.isObject() && isJSArray(${value})))");
@@ -1375,8 +1364,8 @@ sub GenerateImplementation
     my $hasParent = $hasLegacyParent || $hasRealParent;
     my $parentClassName = GetParentClassName($dataNode);
     my $visibleInterfaceName = $codeGenerator->GetVisibleInterfaceName($dataNode);
-    my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
-    my $needsMarkChildren = $dataNode->extendedAttributes->{"JSCustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
+    my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"} || $codeGenerator->IsStrictSubtype($dataNode, "EventTarget");
+    my $needsMarkChildren = $dataNode->extendedAttributes->{"JSCustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"} || $dataNode->name eq "EventTarget";
 
     # - Add default header template
     push(@implContentHeader, GenerateImplementationContentHeader($dataNode));
@@ -1666,7 +1655,7 @@ sub GenerateImplementation
         push(@implContent, "void ${className}::finishCreation(JSGlobalData& globalData)\n");
         push(@implContent, "{\n");
         push(@implContent, "    Base::finishCreation(globalData);\n");
-        if (IsTypedArrayType($implType) and ($implType ne "ArrayBufferView") and ($implType ne "ArrayBuffer")) {
+        if ($codeGenerator->IsTypedArrayType($implType) and ($implType ne "ArrayBufferView") and ($implType ne "ArrayBuffer")) {
             push(@implContent, "    TypedArrayDescriptor descriptor(&${className}::s_info, OBJECT_OFFSETOF(${className}, m_storage), OBJECT_OFFSETOF(${className}, m_storageLength));\n");
             push(@implContent, "    globalData.registerTypedArrayDescriptor(impl(), descriptor);\n");
             push(@implContent, "    m_storage = impl()->data();\n");
@@ -2213,6 +2202,13 @@ sub GenerateImplementation
                 if ($isCustom) {
                     push(@implContent, "    return JSValue::encode(castedThis->" . $functionImplementationName . "(exec));\n");
                 } else {
+                    if ($function->signature->name eq "set" and $dataNode->extendedAttributes->{"TypedArray"}) {
+                        my $viewType = $dataNode->extendedAttributes->{"TypedArray"};
+                        push(@implContent, "    return JSValue::encode(setWebGLArrayHelper<$implType, $viewType>(exec, castedThis->impl()));\n");
+                        push(@implContent, "}\n\n");
+                        next;
+                    }
+
                     push(@implContent, "    $implType* impl = static_cast<$implType*>(castedThis->impl());\n");
                     if ($svgPropertyType) {
                         push(@implContent, "    if (impl->isReadOnly()) {\n");
@@ -2268,7 +2264,7 @@ sub GenerateImplementation
             push(@implContent, "    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);\n");
             push(@implContent, "    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());\n");
             push(@implContent, "    Base::visitChildren(thisObject, visitor);\n");
-            if ($dataNode->extendedAttributes->{"EventTarget"}) {
+            if ($dataNode->extendedAttributes->{"EventTarget"} || $dataNode->name eq "EventTarget") {
                 push(@implContent, "    thisObject->impl()->visitJSEventListeners(visitor);\n");
             }
             if ($numCachedAttributes > 0) {
@@ -2322,7 +2318,7 @@ sub GenerateImplementation
         push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(thisObj, &s_info);\n");
         if (IndexGetterReturnsStrings($implClassName)) {
             $implIncludes{"KURL.h"} = 1;
-            push(@implContent, "    return jsStringOrNull(exec, thisObj->impl()->item(index));\n");
+            push(@implContent, "    return jsStringOrUndefined(exec, thisObj->impl()->item(index));\n");
         } else {
             push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->item(index));\n");
         }
@@ -2613,7 +2609,7 @@ sub GenerateParametersCheck
                 push(@$outputArray, "    double $nativeValue = exec->argument($argsIndex).toNumber(exec);\n");
                 push(@$outputArray, "    if (exec->hadException())\n");
                 push(@$outputArray, "        return JSValue::encode(jsUndefined());\n\n");
-                push(@$outputArray, "    if (!isnan(objArgsShortNativeValue))\n");
+                push(@$outputArray, "    if (!isnan($nativeValue))\n");
                 push(@$outputArray, "        $name = clampTo<$argType>($nativeValue);\n\n");
         } else {
             # If the "StrictTypeChecking" extended attribute is present, and the argument's type is an
@@ -3004,13 +3000,6 @@ sub IsNativeType
     return exists $nativeType{$type};
 }
 
-sub IsArrayType
-{
-    my $type = shift;
-    # FIXME: Add proper support for T[], T[]?, sequence<T>.
-    return $type =~ m/\[\]$/;
-}
-
 sub JSValueToNative
 {
     my $signature = shift;
@@ -3195,7 +3184,7 @@ sub NativeToJSValue
     } else {
         # Default, include header with same name.
         AddToImplIncludes("JS$type.h", $conditional);
-        if (IsTypedArrayType($type)) {
+        if ($codeGenerator->IsTypedArrayType($type)) {
             AddToImplIncludes("<wtf/$type.h>", $conditional) if not $codeGenerator->SkipIncludeHeader($type);
         } else {
             AddToImplIncludes("$type.h", $conditional) if not $codeGenerator->SkipIncludeHeader($type);
@@ -3547,7 +3536,7 @@ sub GenerateConstructorDeclaration
     }
     push(@$outputArray, "};\n\n");
 
-    if (IsConstructorTemplate($dataNode, "Event")) {
+    if ($codeGenerator->IsConstructorTemplate($dataNode, "Event")) {
         push(@$outputArray, "bool fill${interfaceName}Init(${interfaceName}Init&, JSDictionary&);\n\n");
     }
 
@@ -3596,7 +3585,7 @@ sub GenerateConstructorDefinition
     my $constructorClassName = $generatingNamedConstructor ? "${className}NamedConstructor" : "${className}Constructor";
     my $numberOfConstructorParameters = $dataNode->extendedAttributes->{"ConstructorParameters"};
     if (!defined $numberOfConstructorParameters) {
-        if (IsConstructorTemplate($dataNode, "Event")) {
+        if ($codeGenerator->IsConstructorTemplate($dataNode, "Event")) {
             $numberOfConstructorParameters = 2;
         } elsif ($dataNode->extendedAttributes->{"Constructor"}) {
             $numberOfConstructorParameters = @{$dataNode->constructor->parameters};
@@ -3658,7 +3647,7 @@ sub GenerateConstructorDefinition
     }
 
     if (IsConstructable($dataNode)) {
-        if (IsConstructorTemplate($dataNode, "Event")) {
+        if ($codeGenerator->IsConstructorTemplate($dataNode, "Event")) {
             $implIncludes{"JSDictionary.h"} = 1;
             $implIncludes{"<runtime/Error.h>"} = 1;
 
@@ -3722,6 +3711,30 @@ END
 }
 
 END
+        } elsif ($codeGenerator->IsConstructorTemplate($dataNode, "TypedArray")) {
+            $implIncludes{"JSArrayBufferViewHelper.h"} = 1;
+            my $viewType = $dataNode->extendedAttributes->{"TypedArray"};
+            push(@$outputArray, "EncodedJSValue JSC_HOST_CALL ${constructorClassName}::construct${className}(ExecState* exec)\n");
+            push(@$outputArray, "{\n");
+            push(@$outputArray, "    ${constructorClassName}* jsConstructor = jsCast<${constructorClassName}*>(exec->callee());\n");
+            push(@$outputArray, "    RefPtr<$interfaceName> array = constructArrayBufferView<$interfaceName, $viewType>(exec);\n");
+            push(@$outputArray, "    if (!array.get())\n");
+            push(@$outputArray, "        // Exception has already been thrown.\n");
+            push(@$outputArray, "        return JSValue::encode(JSValue());\n");
+            push(@$outputArray, "    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), array.get())));\n");
+            push(@$outputArray, "}\n\n");
+
+            push(@$outputArray, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, ${interfaceName}* object)\n");
+            push(@$outputArray, "{\n");
+            push(@$outputArray, "    return toJSArrayBufferView<${className}>(exec, globalObject, object);\n");
+            push(@$outputArray, "}\n\n");
+
+            if ($dataNode->extendedAttributes->{"CustomIndexedSetter"}) {
+                push(@$outputArray, "void ${className}::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)\n");
+                push(@$outputArray, "{\n");
+                push(@$outputArray, "    impl()->set(index, value.toNumber(exec));\n");
+                push(@$outputArray, "}\n\n");
+            }
         } elsif (!($dataNode->extendedAttributes->{"JSCustomConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"}) && (!$dataNode->extendedAttributes->{"NamedConstructor"} || $generatingNamedConstructor)) {
             push(@$outputArray, "EncodedJSValue JSC_HOST_CALL ${constructorClassName}::construct${className}(ExecState* exec)\n");
             push(@$outputArray, "{\n");
@@ -3801,12 +3814,4 @@ sub IsConstructable
     return $dataNode->extendedAttributes->{"CustomConstructor"} || $dataNode->extendedAttributes->{"JSCustomConstructor"} || $dataNode->extendedAttributes->{"Constructor"} || $dataNode->extendedAttributes->{"NamedConstructor"} || $dataNode->extendedAttributes->{"ConstructorTemplate"};
 }
 
-sub IsConstructorTemplate
-{
-    my $dataNode = shift;
-    my $template = shift;
-
-    return $dataNode->extendedAttributes->{"ConstructorTemplate"} && $dataNode->extendedAttributes->{"ConstructorTemplate"} eq $template;
-}
-
 1;
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index cbb211395..2a2f3800c 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -469,6 +469,7 @@ sub SkipAttribute
 
     $codeGenerator->AssertNotSequenceType($attribute->signature->type);
     return 1 if $codeGenerator->GetArrayType($attribute->signature->type);
+    return 1 if $codeGenerator->IsTypedArrayType($attribute->signature->type);
 
     # This is for DynamicsCompressorNode.idl
     if ($attribute->signature->name eq "release") {
@@ -881,6 +882,7 @@ sub GenerateHeader
     if ($numFunctions > 0) {
         foreach my $function (@{$dataNode->functions}) {
             next if SkipFunction($function);
+            next if ($function->signature->name eq "set" and $dataNode->extendedAttributes->{"TypedArray"});
             my $functionName = $function->signature->name;
 
             my $returnType = GetObjCType($function->signature->type);
@@ -1501,6 +1503,7 @@ sub GenerateImplementation
     if ($numFunctions > 0) {
         foreach my $function (@{$dataNode->functions}) {
             next if SkipFunction($function);
+            next if ($function->signature->name eq "set" and $dataNode->extendedAttributes->{"TypedArray"});
             AddIncludesForType($function->signature->type);
 
             my $functionName = $function->signature->name;
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 3a0f7d5aa..0a9d9d72f 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -141,7 +141,7 @@ sub AddIncludesForType
 
     # When we're finished with the one-file-per-class
     # reorganization, we won't need these special cases.
-    if (IsTypedArrayType($type)) {
+    if ($codeGenerator->IsTypedArrayType($type)) {
         AddToImplIncludes("wtf/${type}.h");
     }
     if (!$codeGenerator->IsPrimitiveType($type) and !$codeGenerator->IsStringType($type) and !$codeGenerator->SkipIncludeHeader($type) and $type ne "Date") {
@@ -289,8 +289,7 @@ sub GenerateHeader
     my $className = "V8$interfaceName";
     my $implClassName = $interfaceName;
 
-    # Copy contents of parent classes except the first parent or if it is
-    # EventTarget.
+    # Copy contents of parent classes except the first parent.
     $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode, \@allParents, 1);
     $codeGenerator->LinkOverloadedFunctions($dataNode);
 
@@ -299,7 +298,6 @@ sub GenerateHeader
     if (!$hasDependentLifetime) {
         foreach (@{$dataNode->parents}) {
             my $parent = $codeGenerator->StripModule($_);
-            next if $parent eq "EventTarget";
             $headerIncludes{"V8${parent}.h"} = 1;
         }
     }
@@ -339,7 +337,7 @@ sub GenerateHeader
 
     push(@headerContent, "\n");
     push(@headerContent, "class FloatRect;\n") if $svgPropertyType && $svgPropertyType eq "FloatRect";
-    push(@headerContent, "class Dictionary;\n") if IsConstructorTemplate($dataNode, "Event");
+    push(@headerContent, "class Dictionary;\n") if $codeGenerator->IsConstructorTemplate($dataNode, "Event");
 
     my $nativeType = GetNativeTypeForConversions($dataNode, $interfaceName);
     if ($dataNode->extendedAttributes->{"NamedConstructor"}) {
@@ -365,7 +363,6 @@ END
         my $separator = "";
         foreach (@{$dataNode->parents}) {
             my $parent = $codeGenerator->StripModule($_);
-            next if $parent eq "EventTarget";
             $headerIncludes{"V8${parent}.h"} = 1;
             push(@headerContent, "${separator}V8${parent}::hasDependentLifetime");
             $separator = " || ";
@@ -546,7 +543,7 @@ inline v8::Handle<v8::Value> toV8(PassRefPtr< ${nativeType} > impl, v8::Isolate*
 }
 END
 
-    if (IsConstructorTemplate($dataNode, "Event")) {
+    if ($codeGenerator->IsConstructorTemplate($dataNode, "Event")) {
         push(@headerContent, "\nbool fill${implClassName}Init(${implClassName}Init&, const Dictionary&);\n");
     }
 
@@ -566,14 +563,12 @@ sub GetInternalFields
     # We can't ask whether a parent type has a given extendedAttribute,
     # so special-case AbstractWorker and WorkerContext to include all sub-types.
     # Event listeners on DOM nodes are explicitly supported in the GC controller.
-    # FIXME: SVGElementInstance should probably have the EventTarget extended attribute, but doesn't.
     # FIXME: Simplify this when all EventTargets are subtypes of EventTarget.
     if (!IsNodeSubType($dataNode)
         && ($dataNode->extendedAttributes->{"EventTarget"}
             || $dataNode->extendedAttributes->{"IsWorkerContext"}
             || IsSubType($dataNode, "AbstractWorker")
-            || $name eq "SVGElementInstance"
-            || $name eq "EventTarget")) {
+            || IsSubType($dataNode, "EventTarget"))) {
         push(@customInternalFields, "eventListenerCacheIndex");
     }
 
@@ -589,7 +584,7 @@ sub GetHeaderClassInclude
     if ($className =~ /SVGPathSeg/) {
         $className =~ s/Abs|Rel//;
     }
-    return "wtf/${className}.h" if IsTypedArrayType($className);
+    return "wtf/${className}.h" if $codeGenerator->IsTypedArrayType($className);
     return "" if ($codeGenerator->SkipIncludeHeader($className));
     return "${className}.h";
 }
@@ -733,14 +728,6 @@ sub IsConstructable
     return $dataNode->extendedAttributes->{"CustomConstructor"} || $dataNode->extendedAttributes->{"V8CustomConstructor"} || $dataNode->extendedAttributes->{"Constructor"} || $dataNode->extendedAttributes->{"ConstructorTemplate"};
 }
 
-sub IsConstructorTemplate
-{
-    my $dataNode = shift;
-    my $template = shift;
-
-    return $dataNode->extendedAttributes->{"ConstructorTemplate"} && $dataNode->extendedAttributes->{"ConstructorTemplate"} eq $template;
-}
-
 sub GenerateDomainSafeFunctionGetter
 {
     my $function = shift;
@@ -756,6 +743,7 @@ sub GenerateDomainSafeFunctionGetter
 
     my $newTemplateString = GenerateNewFunctionTemplate($function, $implClassName, $signature);
 
+    AddToImplIncludes("Frame.h");
     push(@implContentDecls, <<END);
 static v8::Handle<v8::Value> ${funcName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
@@ -768,16 +756,43 @@ static v8::Handle<v8::Value> ${funcName}AttrGetter(v8::Local<v8::String> name, c
         return privateTemplate->GetFunction();
     }
     ${implClassName}* imp = ${className}::toNative(holder);
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), false)) {
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame(), DoNotReportSecurityError)) {
         static v8::Persistent<v8::FunctionTemplate> sharedTemplate = v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
         return sharedTemplate->GetFunction();
     }
+
+    v8::Local<v8::Value> hiddenValue = info.This()->GetHiddenValue(name);
+    if (!hiddenValue.IsEmpty())
+        return hiddenValue;
+
     return privateTemplate->GetFunction();
 }
 
 END
 }
 
+sub GenerateDomainSafeFunctionSetter
+{
+    my $implClassName = shift;
+    my $className = "V8" . $implClassName;
+
+    push(@implContentDecls, <<END);
+static void ${implClassName}DomainSafeFunctionSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.$implClassName._set");
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(${className}::GetTemplate(), info.This());
+    if (holder.IsEmpty())
+        return;
+    ${implClassName}* imp = ${className}::toNative(holder);
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame()))
+        return;
+
+    info.This()->SetHiddenValue(name, value);
+}
+
+END
+}
+
 sub GenerateConstructorGetter
 {
     my $dataNode = shift;
@@ -804,7 +819,7 @@ END
     return V8DOMWrapper::constructorForType(type, V8WorkerContext::toNative(info.Holder()));
 END
     } else {
-        push(@implContentDecls, "    return v8::Handle<v8::Value>();");
+        push(@implContentDecls, "    return v8Undefined();");
     }
 
     push(@implContentDecls, <<END);
@@ -866,7 +881,7 @@ END
             push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8${interfaceName}::GetTemplate(), info.This());
     if (holder.IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 END
         }
         push(@implContentDecls, <<END);
@@ -904,7 +919,7 @@ END
 
     # Generate security checks if necessary
     if ($attribute->signature->extendedAttributes->{"CheckSecurityForNode"}) {
-        push(@implContentDecls, "    if (!V8BindingSecurity::shouldAllowAccessToNode(V8BindingState::Only(), imp->" . $attribute->signature->name . "()))\n        return v8::Handle<v8::Value>(v8::Null(info.GetIsolate()));\n\n");
+        push(@implContentDecls, "    if (!BindingSecurity::shouldAllowAccessToNode(BindingState::instance(), imp->" . $attribute->signature->name . "()))\n        return v8::Handle<v8::Value>(v8::Null(info.GetIsolate()));\n\n");
     }
 
     my $useExceptions = 1 if @{$attribute->getterExceptions};
@@ -940,7 +955,7 @@ END
 
     if ($attribute->signature->type eq "EventListener" && $dataNode->name eq "DOMWindow") {
         push(@implContentDecls, "    if (!imp->document())\n");
-        push(@implContentDecls, "        return v8::Handle<v8::Value>();\n");
+        push(@implContentDecls, "        return v8Undefined();\n");
     }
 
     if ($useExceptions) {
@@ -990,11 +1005,12 @@ END
         # been created. If we don't find a wrapper, we create both a wrapper and a hidden reference.
         push(@implContentDecls, "    RefPtr<$returnType> result = ${getterString};\n");
         my $domMapFunction = GetDomMapFunction($dataNode, $interfaceName, "info.GetIsolate()");
-        push(@implContentDecls, "    v8::Handle<v8::Value> wrapper = result.get() ? ${domMapFunction}.get(result.get()) : v8::Handle<v8::Object>();\n");
+        push(@implContentDecls, "    v8::Handle<v8::Value> wrapper = result.get() ? ${domMapFunction}.get(result.get()) : v8Undefined();\n");
         push(@implContentDecls, "    if (wrapper.IsEmpty()) {\n");
         push(@implContentDecls, "        wrapper = toV8(result.get(), info.GetIsolate());\n");
         push(@implContentDecls, "        if (!wrapper.IsEmpty())\n");
         if ($dataNode->name eq "DOMWindow") {
+            AddToImplIncludes("Frame.h");
             push(@implContentDecls, "            V8DOMWrapper::setNamedHiddenWindowReference(imp->frame(), \"${attrName}\", wrapper);\n");
         } else {
             push(@implContentDecls, "            V8DOMWrapper::setNamedHiddenReference(info.Holder(), \"${attrName}\", wrapper);\n");
@@ -1091,9 +1107,10 @@ static void ${implClassName}ReplaceableAttrSetter(v8::Local<v8::String> name, v8
 END
 
     if ($implClassName eq "DOMWindow" || $dataNode->extendedAttributes->{"CheckSecurity"}) {
+        AddToImplIncludes("Frame.h");
         push(@implContentDecls, <<END);
     ${implClassName}* imp = V8${implClassName}::toNative(info.Holder());
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame()))
         return;
 END
     }
@@ -1112,8 +1129,6 @@ sub GenerateNormalAttrSetter
     my $implClassName = shift;
     my $interfaceName = shift;
 
-    AddToImplIncludes("V8BindingMacros.h");
-
     my $attrName = $attribute->signature->name;
     my $attrExt = $attribute->signature->extendedAttributes;
 
@@ -1312,7 +1327,7 @@ sub GenerateNewFunctionTemplate
     my $signature = shift;
 
     my $callback = GetFunctionTemplateCallbackName($function, $interfaceName);
-    return "v8::FunctionTemplate::New($callback, v8::Handle<v8::Value>(), $signature)";
+    return "v8::FunctionTemplate::New($callback, v8Undefined(), $signature)";
 }
 
 sub GenerateEventListenerCallback
@@ -1339,7 +1354,7 @@ END
     }
     push(@implContentDecls, <<END);
     }
-    return v8::Undefined();
+    return v8Undefined();
 }
 
 END
@@ -1367,7 +1382,7 @@ sub GenerateParametersCheckExpression
         } elsif ($parameter->extendedAttributes->{"Callback"}) {
             # For Callbacks only checks if the value is null or object.
             push(@andExpression, "(${value}->IsNull() || ${value}->IsFunction())");
-        } elsif (IsArrayType($type) || $codeGenerator->GetSequenceType($type)) {
+        } elsif ($codeGenerator->IsArrayType($type) || $codeGenerator->GetSequenceType($type)) {
             # FIXME: Add proper support for T[], T[]?, sequence<T>.
             if ($parameter->isNullable) {
                 push(@andExpression, "(${value}->IsNull() || ${value}->IsArray())");
@@ -1473,6 +1488,16 @@ END
 
     push(@implContentDecls, GenerateArgumentsCountCheck($function, $dataNode));
 
+    if ($name eq "set" and $dataNode->extendedAttributes->{"TypedArray"}) {
+        AddToImplIncludes("V8ArrayBufferViewCustom.h");
+        push(@implContentDecls, <<END);
+    return setWebGLArrayHelper<$implClassName, V8${implClassName}>(args);
+}
+
+END
+        return;
+    }
+
     my ($svgPropertyType, $svgListPropertyType, $svgNativeType) = GetSVGPropertyTypes($implClassName);
 
     if ($svgNativeType) {
@@ -1499,9 +1524,10 @@ END
         || $interfaceName eq "DOMWindow")
         && !$function->signature->extendedAttributes->{"DoNotCheckSecurity"}) {
         # We have not find real use cases yet.
+        AddToImplIncludes("Frame.h");
         push(@implContentDecls, <<END);
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
-        return v8::Handle<v8::Value>();
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame()))
+        return v8Undefined();
 END
     }
 
@@ -1524,7 +1550,7 @@ END
     }
 
     if ($function->signature->extendedAttributes->{"CheckSecurityForNode"}) {
-        push(@implContentDecls, "    if (!V8BindingSecurity::shouldAllowAccessToNode(V8BindingState::Only(), imp->" . $function->signature->name . "(ec)))\n");
+        push(@implContentDecls, "    if (!BindingSecurity::shouldAllowAccessToNode(BindingState::instance(), imp->" . $function->signature->name . "(ec)))\n");
         push(@implContentDecls, "        return v8::Handle<v8::Value>(v8::Null(args.GetIsolate()));\n");
 END
     }
@@ -1563,14 +1589,14 @@ sub GenerateCallWith
         } else {
             push(@$outputArray, $indent . "ScriptState* state = ScriptState::current();\n");
             push(@$outputArray, $indent . "if (!state)\n");
-            push(@$outputArray, $indent . "    return" . ($returnVoid ? "" : " v8::Undefined()") . ";\n");
+            push(@$outputArray, $indent . "    return" . ($returnVoid ? "" : " v8Undefined()") . ";\n");
             push(@callWithArgs, "state");
         }
     }
     if ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptExecutionContext")) {
         push(@$outputArray, $indent . "ScriptExecutionContext* scriptContext = getScriptExecutionContext();\n");
         push(@$outputArray, $indent . "if (!scriptContext)\n");
-        push(@$outputArray, $indent . "    return" . ($returnVoid ? "" : " v8::Undefined()") . ";\n");
+        push(@$outputArray, $indent . "    return" . ($returnVoid ? "" : " v8Undefined()") . ";\n");
         push(@callWithArgs, "scriptContext");
     }
     if ($function and $codeGenerator->ExtendedAttributeContains($callWith, "ScriptArguments")) {
@@ -1581,7 +1607,7 @@ sub GenerateCallWith
     if ($codeGenerator->ExtendedAttributeContains($callWith, "CallStack")) {
         push(@$outputArray, $indent . "RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());\n");
         push(@$outputArray, $indent . "if (!callStack)\n");
-        push(@$outputArray, $indent . "    return v8::Undefined();\n");
+        push(@$outputArray, $indent . "    return v8Undefined();\n");
         push(@callWithArgs, "callStack");
         AddToImplIncludes("ScriptCallStack.h");
         AddToImplIncludes("ScriptCallStackFactory.h");
@@ -1672,18 +1698,18 @@ sub GenerateParametersCheck
                 $parameterCheckString .= "    RefPtr<" . $parameter->type . "> $parameterName;\n";
                 $parameterCheckString .= "    if (args.Length() > $paramIndex && !args[$paramIndex]->IsNull() && !args[$paramIndex]->IsUndefined()) {\n";
                 $parameterCheckString .= "        if (!args[$paramIndex]->IsFunction())\n";
-                $parameterCheckString .= "            return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());\n";
+                $parameterCheckString .= "            return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());\n";
                 $parameterCheckString .= "        $parameterName = ${className}::create(args[$paramIndex], getScriptExecutionContext());\n";
                 $parameterCheckString .= "    }\n";
             } else {
                 $parameterCheckString .= "    if (args.Length() <= $paramIndex || !args[$paramIndex]->IsFunction())\n";
-                $parameterCheckString .= "        return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());\n";
+                $parameterCheckString .= "        return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());\n";
                 $parameterCheckString .= "    RefPtr<" . $parameter->type . "> $parameterName = ${className}::create(args[$paramIndex], getScriptExecutionContext());\n";
             }
         } elsif ($parameter->extendedAttributes->{"Clamp"}) {
                 my $nativeValue = "${parameterName}NativeValue";
                 my $paramType = $parameter->type;
-                $parameterCheckString .= "    $paramType $parameterName = 0\n";
+                $parameterCheckString .= "    $paramType $parameterName = 0;\n";
                 $parameterCheckString .= "    EXCEPTION_BLOCK(double, $nativeValue, args[$paramIndex]->NumberValue());\n";
                 $parameterCheckString .= "    if (!isnan($nativeValue))\n";
                 $parameterCheckString .= "        $parameterName = clampTo<$paramType>($nativeValue);\n";
@@ -1711,7 +1737,7 @@ sub GenerateParametersCheck
                 $parameterCheckString .= "    MessagePortArray messagePortArray$TransferListName;\n";
                 $parameterCheckString .= "    ArrayBufferArray arrayBufferArray$TransferListName;\n";
                 $parameterCheckString .= "    if (args.Length() > $transferListIndex) {\n";
-                $parameterCheckString .= "        if (!extractTransferables(args[$transferListIndex], messagePortArray$TransferListName, arrayBufferArray$TransferListName))\n";
+                $parameterCheckString .= "        if (!extractTransferables(args[$transferListIndex], messagePortArray$TransferListName, arrayBufferArray$TransferListName, args.GetIsolate()))\n";
                 $parameterCheckString .= "            return V8Proxy::throwTypeError(\"Could not extract transferables\");\n";
                 $parameterCheckString .= "    }\n";
                 $useTransferList = 1;
@@ -1723,7 +1749,7 @@ sub GenerateParametersCheck
                     $parameterCheckString .= "    $nativeType $parameterName = SerializedScriptValue::create(args[$paramIndex], &messagePortArray$TransferListName, &arrayBufferArray$TransferListName, ${parameterName}DidThrow, args.GetIsolate());\n";
             }
             $parameterCheckString .= "    if (${parameterName}DidThrow)\n";
-            $parameterCheckString .= "        return v8::Undefined();\n";
+            $parameterCheckString .= "        return v8Undefined();\n";
         } elsif (TypeCanFailConversion($parameter)) {
             $parameterCheckString .= "    $nativeType $parameterName = " .
                  JSValueToNative($parameter, "args[$paramIndex]", "args.GetIsolate()") . ";\n";
@@ -1735,7 +1761,6 @@ sub GenerateParametersCheck
             my $value = JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(args, $paramIndex, $parameterDefaultPolicy)", "args.GetIsolate()");
             $parameterCheckString .= "    " . ConvertToV8Parameter($parameter, $nativeType, $parameterName, $value) . "\n";
         } else {
-            AddToImplIncludes("V8BindingMacros.h");
             # If the "StrictTypeChecking" extended attribute is present, and the argument's type is an
             # interface type, then if the incoming value does not implement that interface, a TypeError
             # is thrown rather than silently passing NULL to the C++ code.
@@ -1855,13 +1880,13 @@ END
     push(@implContent, <<END);
 
     V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
-    V8DOMWrapper::setJSWrapperFor${DOMObject}(impl.release(), v8::Persistent<v8::Object>::New(wrapper), args.GetIsolate());
-    return args.Holder();
+    V8DOMWrapper::setJSWrapperFor${DOMObject}(impl.release(), wrapper, args.GetIsolate());
+    return wrapper;
 END
 
     if ($raisesExceptions) {
         push(@implContent, "  fail:\n");
-        push(@implContent, "    return throwError(ec, args.GetIsolate());\n");
+        push(@implContent, "    return V8Proxy::setDOMException(ec, args.GetIsolate());\n");
     }
 
     push(@implContent, "}\n");
@@ -1874,7 +1899,6 @@ sub GenerateEventConstructorCallback
     my $implClassName = shift;
 
     AddToImplIncludes("Dictionary.h");
-    AddToImplIncludes("V8BindingMacros.h");
     push(@implContent, <<END);
 v8::Handle<v8::Value> V8${implClassName}::constructorCallback(const v8::Arguments& args)
 {
@@ -1892,16 +1916,17 @@ v8::Handle<v8::Value> V8${implClassName}::constructorCallback(const v8::Argument
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, type, args[0]);
     ${implClassName}Init eventInit;
     if (args.Length() >= 2) {
-        EXCEPTION_BLOCK(Dictionary, options, args[1]);
+        EXCEPTION_BLOCK(Dictionary, options, Dictionary(args[1], args.GetIsolate()));
         if (!fill${implClassName}Init(eventInit, options))
-            return v8::Undefined();
+            return v8Undefined();
     }
 
     RefPtr<${implClassName}> event = ${implClassName}::create(type, eventInit);
 
-    V8DOMWrapper::setDOMWrapper(args.Holder(), &info, event.get());
-    V8DOMWrapper::setJSWrapperForDOMObject(event.release(), v8::Persistent<v8::Object>::New(args.Holder()), args.GetIsolate());
-    return args.Holder();
+    v8::Handle<v8::Object> wrapper = args.Holder();
+    V8DOMWrapper::setDOMWrapper(wrapper, &info, event.get());
+    V8DOMWrapper::setJSWrapperForDOMObject(event.release(), wrapper, args.GetIsolate());
+    return wrapper;
 }
 
 bool fill${implClassName}Init(${implClassName}Init& eventInit, const Dictionary& options)
@@ -1931,6 +1956,24 @@ END
 END
 }
 
+sub GenerateTypedArrayConstructorCallback
+{
+    my $dataNode = shift;
+    my $implClassName = shift;
+    my $viewType = GetTypeNameOfExternalTypedArray($dataNode);
+    my $type = $dataNode->extendedAttributes->{"TypedArray"};
+    AddToImplIncludes("V8ArrayBufferViewCustom.h");
+
+    push(@implContent, <<END);
+v8::Handle<v8::Value> V8${implClassName}::constructorCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.${implClassName}.Contructor");
+    return constructWebGLArray<$implClassName, V8${implClassName}, $type>(args, &info, $viewType);
+}
+
+END
+}
+
 sub GenerateNamedConstructorCallback
 {
     my $function = shift;
@@ -1964,6 +2007,7 @@ WrapperTypeInfo V8${implClassName}Constructor::info = { V8${implClassName}Constr
 END
     }
 
+    AddToImplIncludes("Frame.h");
     push(@implContent, <<END);
 static v8::Handle<v8::Value> V8${implClassName}ConstructorCallback(const v8::Arguments& args)
 {
@@ -1975,7 +2019,7 @@ static v8::Handle<v8::Value> V8${implClassName}ConstructorCallback(const v8::Arg
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
 
-    Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
+    Frame* frame = currentFrame(BindingState::instance());
     if (!frame)
         return V8Proxy::throwError(V8Proxy::ReferenceError, "${implClassName} constructor associated frame is unavailable", args.GetIsolate());
 
@@ -2030,13 +2074,13 @@ END
     push(@implContent, <<END);
 
     V8DOMWrapper::setDOMWrapper(wrapper, &V8${implClassName}Constructor::info, impl.get());
-    V8DOMWrapper::setJSWrapperFor${DOMObject}(impl.release(), v8::Persistent<v8::Object>::New(wrapper), args.GetIsolate());
-    return args.Holder();
+    V8DOMWrapper::setJSWrapperFor${DOMObject}(impl.release(), wrapper, args.GetIsolate());
+    return wrapper;
 END
 
     if ($raisesExceptions) {
         push(@implContent, "  fail:\n");
-        push(@implContent, "    return throwError(ec, args.GetIsolate());\n");
+        push(@implContent, "    return V8Proxy::setDOMException(ec, args.GetIsolate());\n");
     }
 
     push(@implContent, "}\n");
@@ -2247,25 +2291,14 @@ sub GenerateNonStandardFunction
 
     if ($attrExt->{"DoNotCheckSecurity"} &&
         ($dataNode->extendedAttributes->{"CheckSecurity"} || $interfaceName eq "DOMWindow")) {
-        # Mark the accessor as ReadOnly and set it on the proto object so
-        # it can be shadowed. This is really a hack to make it work.
-        # There are several sceneria to call into the accessor:
-        #   1) from the same domain: "window.open":
-        #      the accessor finds the DOM wrapper in the proto chain;
-        #   2) from the same domain: "window.__proto__.open":
-        #      the accessor will NOT find a DOM wrapper in the prototype chain
-        #   3) from another domain: "window.open":
-        #      the access find the DOM wrapper in the prototype chain
-        #   "window.__proto__.open" from another domain will fail when
-        #   accessing '__proto__'
-        #
-        # The solution is very hacky and fragile, it really needs to be replaced
-        # by a better solution.
-        $property_attributes .= " | v8::ReadOnly";
+        # Functions that are marked DoNotCheckSecurity are always readable but if they are changed
+        # and then accessed on a different domain we do not return the underlying value but instead
+        # return a new copy of the original function. This is achieved by storing the changed value
+        # as hidden property.
         push(@implContent, <<END);
 
     // $commentInfo
-    ${conditional}$template->SetAccessor(v8::String::New("$name"), ${interfaceName}V8Internal::${name}AttrGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>($property_attributes));
+    ${conditional}$template->SetAccessor(v8::String::New("$name"), ${interfaceName}V8Internal::${name}AttrGetter, ${interfaceName}V8Internal::${interfaceName}DomainSafeFunctionSetter, v8Undefined(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>($property_attributes));
 END
         return;
     }
@@ -2296,7 +2329,7 @@ END
     my $conditionalString = $codeGenerator->GenerateConditionalString($function->signature);
     push(@implContent, "#if ${conditionalString}\n") if $conditionalString;
 
-    push(@implContent, "    ${conditional}$template->Set(v8::String::New(\"$name\"), v8::FunctionTemplate::New($callback, v8::Handle<v8::Value>(), ${signature})$property_attributes);\n");
+    push(@implContent, "    ${conditional}$template->Set(v8::String::New(\"$name\"), v8::FunctionTemplate::New($callback, v8Undefined(), ${signature})$property_attributes);\n");
 
     push(@implContent, "#endif // ${conditionalString}\n") if $conditionalString;
 }
@@ -2352,7 +2385,7 @@ sub GenerateImplementationIndexer
             my $conversion = $indexer->extendedAttributes->{"TreatReturnedNullStringAs"};
             if ($conversion && $conversion eq "Null") {
                 push(@implContent, <<END);
-    setCollectionStringOrNullIndexedGetter<${interfaceName}>(desc);
+    setCollectionStringOrUndefinedIndexedGetter<${interfaceName}>(desc);
 END
             } else {
                 push(@implContent, <<END);
@@ -2474,17 +2507,6 @@ sub GenerateImplementationMasqueradesAsUndefined
     }
 }
 
-sub IsTypedArrayType
-{
-    my $type = shift;
-    return 1 if (($type eq "ArrayBuffer") or ($type eq "ArrayBufferView"));
-    return 1 if (($type eq "Uint8Array") or ($type eq "Uint8ClampedArray") or ($type eq "Uint16Array") or ($type eq "Uint32Array"));
-    return 1 if (($type eq "Int8Array") or ($type eq "Int16Array") or ($type eq "Int32Array"));
-    return 1 if (($type eq "Float32Array") or ($type eq "Float64Array"));
-    return 0;
-}
-
-
 sub GenerateImplementation
 {
     my $object = shift;
@@ -2497,11 +2519,11 @@ sub GenerateImplementation
     # - Add default header template
     push(@implFixedHeader, GenerateImplementationContentHeader($dataNode));
 
-    AddToImplIncludes("RuntimeEnabledFeatures.h");
+    AddToImplIncludes("BindingState.h");
     AddToImplIncludes("ContextFeatures.h");
+    AddToImplIncludes("RuntimeEnabledFeatures.h");
     AddToImplIncludes("V8Proxy.h");
     AddToImplIncludes("V8Binding.h");
-    AddToImplIncludes("V8BindingState.h");
     AddToImplIncludes("V8DOMWrapper.h");
     AddToImplIncludes("V8IsolatedContext.h");
 
@@ -2515,9 +2537,6 @@ sub GenerateImplementation
     my $parentClassTemplate = "";
     foreach (@{$dataNode->parents}) {
         my $parent = $codeGenerator->StripModule($_);
-        if ($parent eq "EventTarget") {
-            next;
-        }
         AddToImplIncludes("V8${parent}.h");
         $parentClass = "V8" . $parent;
         $parentClassTemplate = $parentClass . "::GetTemplate()";
@@ -2594,10 +2613,27 @@ sub GenerateImplementation
         GenerateVisitDOMWrapper($dataNode, $implClassName);
     }
 
+    if ($dataNode->extendedAttributes->{"TypedArray"}) {
+        my $viewType = GetTypeNameOfExternalTypedArray($dataNode);
+        push(@implContent, <<END);
+v8::Handle<v8::Value> toV8($implClassName* impl, v8::Isolate* isolate)
+{
+    if (!impl)
+        return v8NullWithCheck(isolate);
+    v8::Handle<v8::Object> wrapper = V8${implClassName}::wrap(impl, isolate);
+    if (!wrapper.IsEmpty())
+        wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), $viewType, impl->length());
+    return wrapper;
+}
+
+END
+    }
+
     my $indexer;
     my $namedPropertyGetter;
     my @enabledPerContextFunctions;
     my @normalFunctions;
+    my $needsDomainSafeFunctionSetter = 0;
     # Generate methods for functions.
     foreach my $function (@{$dataNode->functions}) {
         my $isCustom = $function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"V8Custom"};
@@ -2622,6 +2658,7 @@ sub GenerateImplementation
         if (($dataNode->extendedAttributes->{"CheckSecurity"} || ($interfaceName eq "DOMWindow")) && $function->signature->extendedAttributes->{"DoNotCheckSecurity"}) {
             if (!$isCustom || $function->{overloadIndex} == 1) {
                 GenerateDomainSafeFunctionGetter($function, $implClassName);
+                $needsDomainSafeFunctionSetter = 1;
             }
         }
 
@@ -2633,6 +2670,10 @@ sub GenerateImplementation
         }
     }
 
+    if ($needsDomainSafeFunctionSetter) {
+        GenerateDomainSafeFunctionSetter($implClassName);
+    }
+
     # Attributes
     my $attributes = $dataNode->attributes;
 
@@ -2658,7 +2699,7 @@ sub GenerateImplementation
     $attributes = \@normalAttributes;
     # Put the attributes that disallow shadowing on the shadow object.
     if (@disallowsShadowing) {
-        push(@implContent, "static const BatchedAttribute shadowAttrs[] = {\n");
+        push(@implContent, "static const V8DOMConfiguration::BatchedAttribute shadowAttrs[] = {\n");
         GenerateBatchedAttributeData($dataNode, \@disallowsShadowing);
         push(@implContent, "};\n\n");
     }
@@ -2666,7 +2707,7 @@ sub GenerateImplementation
     my $has_attributes = 0;
     if (@$attributes) {
         $has_attributes = 1;
-        push(@implContent, "static const BatchedAttribute ${interfaceName}Attrs[] = {\n");
+        push(@implContent, "static const V8DOMConfiguration::BatchedAttribute ${interfaceName}Attrs[] = {\n");
         GenerateBatchedAttributeData($dataNode, $attributes);
         push(@implContent, "};\n\n");
     }
@@ -2681,7 +2722,7 @@ sub GenerateImplementation
         next if !IsStandardFunction($dataNode, $function);
         if (!$has_callbacks) {
             $has_callbacks = 1;
-            push(@implContent, "static const BatchedCallback ${interfaceName}Callbacks[] = {\n");
+            push(@implContent, "static const V8DOMConfiguration::BatchedCallback ${interfaceName}Callbacks[] = {\n");
         }
         my $name = $function->signature->name;
         my $callback = GetFunctionTemplateCallbackName($function, $interfaceName);
@@ -2700,7 +2741,7 @@ END
     my @constantsEnabledAtRuntime;
     if (@{$dataNode->constants}) {
         $has_constants = 1;
-        push(@implContent, "static const BatchedConstant ${interfaceName}Consts[] = {\n");
+        push(@implContent, "static const V8DOMConfiguration::BatchedConstant ${interfaceName}Consts[] = {\n");
     }
     foreach my $constant (@{$dataNode->constants}) {
         my $name = $constant->name;
@@ -2738,8 +2779,10 @@ END
         GenerateNamedConstructorCallback($dataNode->constructor, $dataNode, $interfaceName);
     } elsif ($dataNode->extendedAttributes->{"Constructor"} && !($dataNode->extendedAttributes->{"V8CustomConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
         GenerateConstructorCallback($dataNode->constructor, $dataNode, $interfaceName);
-    } elsif (IsConstructorTemplate($dataNode, "Event")) {
+    } elsif ($codeGenerator->IsConstructorTemplate($dataNode, "Event")) {
         GenerateEventConstructorCallback($dataNode, $interfaceName);
+    } elsif ($codeGenerator->IsConstructorTemplate($dataNode, "TypedArray")) {
+        GenerateTypedArrayConstructorCallback($dataNode, $interfaceName);
     }
 
     my $access_check = "";
@@ -2753,7 +2796,7 @@ END
         push(@implContent, <<END);
 static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Persistent<v8::ObjectTemplate> templ)
 {
-    batchConfigureAttributes(templ, v8::Handle<v8::ObjectTemplate>(), shadowAttrs, WTF_ARRAY_LENGTH(shadowAttrs));
+    V8DOMConfiguration::batchConfigureAttributes(templ, v8::Handle<v8::ObjectTemplate>(), shadowAttrs, WTF_ARRAY_LENGTH(shadowAttrs));
 
     // Install a security handler with V8.
     templ->SetAccessCheckCallbacks(V8DOMWindow::namedSecurityCheck, V8DOMWindow::indexedSecurityCheck, v8::External::Wrap(&V8DOMWindow::info));
@@ -2779,12 +2822,12 @@ END
         my $enable_function = GetRuntimeEnableFunctionName($dataNode);
         push(@implContent, <<END);
     if (!${enable_function}())
-        defaultSignature = configureTemplate(desc, \"\", $parentClassTemplate, V8${interfaceName}::internalFieldCount, 0, 0, 0, 0);
+        defaultSignature = V8DOMConfiguration::configureTemplate(desc, \"\", $parentClassTemplate, V8${interfaceName}::internalFieldCount, 0, 0, 0, 0);
     else
 END
     }
     push(@implContent,  <<END);
-    defaultSignature = configureTemplate(desc, \"${visibleInterfaceName}\", $parentClassTemplate, V8${interfaceName}::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, \"${visibleInterfaceName}\", $parentClassTemplate, V8${interfaceName}::internalFieldCount,
 END
     # Set up our attributes if we have them
     if ($has_attributes) {
@@ -2835,10 +2878,10 @@ END
         my $conditionalString = $codeGenerator->GenerateConditionalString($runtime_attr->signature);
         push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
         push(@implContent, "    if (${enable_function}()) {\n");
-        push(@implContent, "        static const BatchedAttribute attrData =\\\n");
+        push(@implContent, "        static const V8DOMConfiguration::BatchedAttribute attrData =\\\n");
         GenerateSingleBatchedAttribute($interfaceName, $runtime_attr, ";", "    ");
         push(@implContent, <<END);
-        configureAttribute(instance, proto, attrData);
+        V8DOMConfiguration::configureAttribute(instance, proto, attrData);
     }
 END
         push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
@@ -2853,8 +2896,8 @@ END
         push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
         push(@implContent, "    if (${enable_function}()) {\n");
         push(@implContent, <<END);
-        static const BatchedConstant constData = {"${name}", static_cast<signed int>(${value})};
-        batchConfigureConstants(desc, proto, &constData, 1);
+        static const V8DOMConfiguration::BatchedConstant constData = {"${name}", static_cast<signed int>(${value})};
+        V8DOMConfiguration::batchConfigureConstants(desc, proto, &constData, 1);
 END
         push(@implContent, "    }\n");
         push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
@@ -2881,7 +2924,7 @@ END
 
     if ($has_constants) {
         push(@implContent, <<END);
-    batchConfigureConstants(desc, proto, ${interfaceName}Consts, WTF_ARRAY_LENGTH(${interfaceName}Consts));
+    V8DOMConfiguration::batchConfigureConstants(desc, proto, ${interfaceName}Consts, WTF_ARRAY_LENGTH(${interfaceName}Consts));
 END
     }
 
@@ -2908,9 +2951,9 @@ END
 
     // For security reasons, these functions are on the instance instead
     // of on the prototype object to ensure that they cannot be overwritten.
-    instance->SetAccessor(v8::String::New("reload"), V8Location::reloadAccessorGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
-    instance->SetAccessor(v8::String::New("replace"), V8Location::replaceAccessorGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
-    instance->SetAccessor(v8::String::New("assign"), V8Location::assignAccessorGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
+    instance->SetAccessor(v8::String::New("reload"), V8Location::reloadAccessorGetter, 0, v8Undefined(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
+    instance->SetAccessor(v8::String::New("replace"), V8Location::replaceAccessorGetter, 0, v8Undefined(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
+    instance->SetAccessor(v8::String::New("assign"), V8Location::assignAccessorGetter, 0, v8Undefined(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
 END
     }
 
@@ -2924,8 +2967,8 @@ END
 
 v8::Persistent<v8::FunctionTemplate> ${className}::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -2937,8 +2980,8 @@ v8::Persistent<v8::FunctionTemplate> ${className}::GetRawTemplate()
 
 v8::Persistent<v8::FunctionTemplate> ${className}::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -2972,10 +3015,10 @@ END
                 my $conditionalString = $codeGenerator->GenerateConditionalString($runtimeAttr->signature);
                 push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
                 push(@implContent, "    if (${enableFunction}(impl->document())) {\n");
-                push(@implContent, "        static const BatchedAttribute attrData =\\\n");
+                push(@implContent, "        static const V8DOMConfiguration::BatchedAttribute attrData =\\\n");
                 GenerateSingleBatchedAttribute($interfaceName, $runtimeAttr, ";", "    ");
                 push(@implContent, <<END);
-        configureAttribute(instance, proto, attrData);
+        V8DOMConfiguration::configureAttribute(instance, proto, attrData);
 END
                 push(@implContent, "    }\n");
                 push(@implContent, "#endif // ${conditionalString}\n") if $conditionalString;
@@ -2997,7 +3040,7 @@ END
                 my $name = $runtimeFunc->signature->name;
                 my $callback = GetFunctionTemplateCallbackName($runtimeFunc, $interfaceName);
                 push(@implContent, <<END);
-        proto->Set(v8::String::New("${name}"), v8::FunctionTemplate::New(${callback}, v8::Handle<v8::Value>(), defaultSignature)->GetFunction());
+        proto->Set(v8::String::New("${name}"), v8::FunctionTemplate::New(${callback}, v8Undefined(), defaultSignature)->GetFunction());
 END
                 push(@implContent, "    }\n");
                 push(@implContent, "#endif // ${conditionalString}\n") if $conditionalString;
@@ -3273,6 +3316,17 @@ END
     push(@implContent, "#endif // ${conditionalString}\n") if $conditionalString;
 }
 
+sub BaseInterfaceName
+{
+    my $dataNode = shift;
+
+    while (@{$dataNode->parents}) {
+        $dataNode = $codeGenerator->ParseInterface($codeGenerator->StripModule(@{$dataNode->parents}[0]), 1);
+    }
+
+    return $codeGenerator->StripModule($dataNode->name);
+}
+
 sub GenerateToV8Converters
 {
     my $dataNode = shift;
@@ -3284,6 +3338,7 @@ sub GenerateToV8Converters
     my $forceNewObjectInput = IsDOMNodeType($interfaceName) ? ", bool forceNewObject" : "";
     my $forceNewObjectCall = IsDOMNodeType($interfaceName) ? ", forceNewObject" : "";
     my $wrapSlowArgumentType = GetPassRefPtrType($nativeType);
+    my $baseType = BaseInterfaceName($dataNode);
 
     push(@implContent, <<END);
 
@@ -3291,13 +3346,19 @@ v8::Handle<v8::Object> ${className}::wrapSlow(${wrapSlowArgumentType} impl, v8::
 {
     v8::Handle<v8::Object> wrapper;
 END
+    if ($baseType ne $interfaceName) {
+        push(@implContent, <<END);
+    ASSERT(static_cast<void*>(static_cast<${baseType}*>(impl.get())) == static_cast<void*>(impl.get()));
+END
+    }
 
     my $proxyInit;
     if (IsNodeSubType($dataNode)) {
-        $proxyInit = "V8Proxy::retrieve(impl->document()->frame())";
+        AddToImplIncludes("Frame.h");
+        $proxyInit = "impl->document()->frame() ? impl->document()->frame()->script()->proxy() : 0";
         # DocumentType nodes are the only nodes that may have a NULL document.
         if ($interfaceName eq "DocumentType") {
-            $proxyInit = "impl->document() ? $proxyInit : 0";
+            $proxyInit = "impl->document() ? ($proxyInit) : 0";
         }
     } else {
         $proxyInit = "0";
@@ -3319,11 +3380,11 @@ END
     # for every sort of object. For now, we special-case cross-origin visible
     # objects (i.e., those with CheckSecurity).
     if (IsVisibleAcrossOrigins($dataNode)) {
+        AddToImplIncludes("Frame.h");
         push(@implContent, <<END);
     if (impl->frame()) {
-        proxy = V8Proxy::retrieve(impl->frame());
-        if (proxy)
-            proxy->windowShell()->initContextIfNeeded();
+        proxy = impl->frame()->script()->proxy();
+        proxy->windowShell()->initContextIfNeeded();
     }
 END
     }
@@ -3372,9 +3433,7 @@ END
     }
 
     push(@implContent, <<END);
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperFor${domMapName}(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
 END
@@ -3384,7 +3443,6 @@ END
 END
     }
     push(@implContent, <<END);
-    V8DOMWrapper::setJSWrapperFor${domMapName}(impl, wrapperHandle, isolate);
     return wrapper;
 }
 END
@@ -3629,6 +3687,8 @@ sub GetNativeType
     return "Range::CompareHow" if $type eq "CompareHow";
     return "DOMTimeStamp" if $type eq "DOMTimeStamp";
     return "unsigned" if $type eq "unsigned int";
+    # FIXME: When EventTarget is an interface and not a mixin, fix this so that
+    # EventTarget can be passed as a parameter.
     return "Node*" if $type eq "EventTarget" and $isParameter;
     return "double" if $type eq "Date";
     return "ScriptValue" if $type eq "DOMObject";
@@ -3728,7 +3788,7 @@ sub JSValueToNative
 
     if ($type eq "Dictionary") {
         AddToImplIncludes("Dictionary.h");
-        return $value;
+        return "Dictionary($value, $getIsolate)";
     }
 
     if ($type eq "DOMObject") {
@@ -3746,6 +3806,8 @@ sub JSValueToNative
     }
 
     # Default, assume autogenerated type conversion routines
+    # FIXME: When EventTarget is an interface and not a mixin, fix this to use
+    # V8EventTarget::HasInstance etc.
     if ($type eq "EventTarget") {
         AddToImplIncludes("V8Node.h");
 
@@ -3789,7 +3851,6 @@ sub GetV8HeaderName
     my $type = shift;
     return "V8Event.h" if $type eq "DOMTimeStamp";
     return "EventListener.h" if $type eq "EventListener";
-    return "EventTarget.h" if $type eq "EventTarget";
     return "SerializedScriptValue.h" if $type eq "SerializedScriptValue";
     return "ScriptValue.h" if $type eq "DOMObject";
     return "V8DOMStringList.h" if $type eq "DOMString[]";
@@ -3881,6 +3942,8 @@ my %non_wrapper_types = (
     'Date' => 1,
     'Dictionary' => 1,
     'EventListener' => 1,
+    # FIXME: When EventTarget is an interface and not a mixin, fix this so that
+    # EventTarget is treated as a wrapper type.
     'EventTarget' => 1,
     'IDBKey' => 1,
     'JSObject' => 1,
@@ -3907,11 +3970,22 @@ sub IsWrapperType
     return !($non_wrapper_types{$type});
 }
 
-sub IsArrayType
+sub GetTypeNameOfExternalTypedArray
 {
-    my $type = $codeGenerator->StripModule(shift);
-    # FIXME: Add proper support for T[], T[]?, sequence<T>.
-    return $type =~ m/\[\]$/;
+    my $dataNode = shift;
+    my $interfaceName = $dataNode->name;
+    my $viewType = $dataNode->extendedAttributes->{"TypedArray"};
+    return "v8::kExternalByteArray" if $viewType eq "signed char" and $interfaceName eq "Int8Array";
+    return "v8::kExternalPixelArray" if $viewType eq "unsigned char" and $interfaceName eq "Uint8ClampedArray";
+    return "v8::kExternalUnsignedByteArray" if $viewType eq "unsigned char" and $interfaceName eq "Uint8Array";
+    return "v8::kExternalShortArray" if $viewType eq "short" and $interfaceName eq "Int16Array";
+    return "v8::kExternalUnsignedShortArray" if $viewType eq "unsigned short" and $interfaceName eq "Uint16Array";
+    return "v8::kExternalIntArray" if $viewType eq "int" and $interfaceName eq "Int32Array";
+    return "v8::kExternalUnsignedIntArray" if $viewType eq "unsigned int" and $interfaceName eq "Uint32Array";
+    return "v8::kExternalFloatArray" if $viewType eq "float" and $interfaceName eq "Float32Array";
+    return "v8::kExternalDoubleArray" if $viewType eq "double" and $interfaceName eq "Float64Array";
+
+    die "TypedArray of unknown type is found";
 }
 
 sub IsDOMNodeType
@@ -3954,7 +4028,7 @@ sub NativeToJSValue
     my $type = GetTypeFromSignature($signature);
 
     return ($getIsolate ? "v8Boolean($value, $getIsolate)" : "v8Boolean($value)") if $type eq "boolean";
-    return "v8::Handle<v8::Value>()" if $type eq "void";     # equivalent to v8::Undefined()
+    return "v8Undefined()" if $type eq "void";     # equivalent to v8Undefined()
 
     # HTML5 says that unsigned reflected attributes should be in the range
     # [0, 2^31). When a value isn't in this range, a default value (or 0)
@@ -4121,7 +4195,6 @@ sub ConvertToV8Parameter
 
     die "Wrong native type passed: $nativeType" unless $nativeType =~ /^V8Parameter/;
     if ($signature->type eq "DOMString") {
-        AddToImplIncludes("V8BindingMacros.h");
         my $macro = "STRING_TO_V8PARAMETER_EXCEPTION_BLOCK";
         $macro .= "_$suffix" if $suffix;
         return "$macro($nativeType, $variableName, $value);"
diff --git a/Source/WebCore/bindings/scripts/IDLAttributes.txt b/Source/WebCore/bindings/scripts/IDLAttributes.txt
index d80522232..889e1075e 100644
--- a/Source/WebCore/bindings/scripts/IDLAttributes.txt
+++ b/Source/WebCore/bindings/scripts/IDLAttributes.txt
@@ -30,7 +30,7 @@ Conditional=*
 Constructor
 ConstructorParameters=*
 ConstructorRaisesException
-ConstructorTemplate=Event
+ConstructorTemplate=Event|TypedArray
 Custom
 CustomCall
 CustomConstructor
@@ -106,6 +106,7 @@ TransferList=*
 TreatNullAs=NullString
 TreatReturnedNullStringAs=False|Null|Undefined
 TreatUndefinedAs=NullString
+TypedArray=*
 URL
 V8Custom
 V8CustomConstructor
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
index 1b4663101..d79f56781 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
@@ -22,6 +22,7 @@
 #include "JSFloat64Array.h"
 
 #include "ExceptionCode.h"
+#include "JSArrayBufferViewHelper.h"
 #include "JSDOMBinding.h"
 #include "JSFloat32Array.h"
 #include "JSInt32Array.h"
@@ -78,6 +79,26 @@ bool JSFloat64ArrayConstructor::getOwnPropertyDescriptor(JSObject* object, ExecS
     return getStaticValueDescriptor<JSFloat64ArrayConstructor, JSDOMWrapper>(exec, &JSFloat64ArrayConstructorTable, jsCast<JSFloat64ArrayConstructor*>(object), propertyName, descriptor);
 }
 
+EncodedJSValue JSC_HOST_CALL JSFloat64ArrayConstructor::constructJSFloat64Array(ExecState* exec)
+{
+    JSFloat64ArrayConstructor* jsConstructor = jsCast<JSFloat64ArrayConstructor*>(exec->callee());
+    RefPtr<Float64Array> array = constructArrayBufferView<Float64Array, double>(exec);
+    if (!array.get())
+        // Exception has already been thrown.
+        return JSValue::encode(JSValue());
+    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), array.get())));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Float64Array* object)
+{
+    return toJSArrayBufferView<JSFloat64Array>(exec, globalObject, object);
+}
+
+void JSFloat64Array::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, value.toNumber(exec));
+}
+
 ConstructType JSFloat64ArrayConstructor::getConstructData(JSCell*, ConstructData& constructData)
 {
     constructData.native.function = constructJSFloat64Array;
@@ -89,10 +110,11 @@ ConstructType JSFloat64ArrayConstructor::getConstructData(JSCell*, ConstructData
 static const HashTableValue JSFloat64ArrayPrototypeTableValues[] =
 {
     { "foo", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsFloat64ArrayPrototypeFunctionFoo), (intptr_t)1, NoIntrinsic },
+    { "set", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsFloat64ArrayPrototypeFunctionSet), (intptr_t)0, NoIntrinsic },
     { 0, 0, 0, 0, NoIntrinsic }
 };
 
-static const HashTable JSFloat64ArrayPrototypeTable = { 2, 1, JSFloat64ArrayPrototypeTableValues, 0 };
+static const HashTable JSFloat64ArrayPrototypeTable = { 4, 3, JSFloat64ArrayPrototypeTableValues, 0 };
 static const HashTable* getJSFloat64ArrayPrototypeTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSFloat64ArrayPrototypeTable);
@@ -237,6 +259,16 @@ EncodedJSValue JSC_HOST_CALL jsFloat64ArrayPrototypeFunctionFoo(ExecState* exec)
     return JSValue::encode(result);
 }
 
+EncodedJSValue JSC_HOST_CALL jsFloat64ArrayPrototypeFunctionSet(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSFloat64Array::s_info))
+        return throwVMTypeError(exec);
+    JSFloat64Array* castedThis = jsCast<JSFloat64Array*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSFloat64Array::s_info);
+    return JSValue::encode(setWebGLArrayHelper<Float64Array, double>(exec, castedThis->impl()));
+}
+
 
 JSValue JSFloat64Array::getByIndex(ExecState*, unsigned index)
 {
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
index 06919d16b..eba20a333 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
@@ -126,6 +126,7 @@ protected:
 // Functions
 
 JSC::EncodedJSValue JSC_HOST_CALL jsFloat64ArrayPrototypeFunctionFoo(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsFloat64ArrayPrototypeFunctionSet(JSC::ExecState*);
 // Attributes
 
 JSC::JSValue jsFloat64ArrayConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index b1d6c6017..c7f790aeb 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -32,6 +32,7 @@
 #include "JSDOMStringList.h"
 #include "JSDocument.h"
 #include "JSEventListener.h"
+#include "JSFloat32Array.h"
 #include "JSSVGDocument.h"
 #include "JSSVGPoint.h"
 #include "JSScriptProfile.h"
@@ -56,6 +57,7 @@
 #include <runtime/Error.h>
 #include <runtime/JSArray.h>
 #include <runtime/JSString.h>
+#include <wtf/Float32Array.h>
 #include <wtf/GetPtr.h>
 
 #if ENABLE(Condition1)
@@ -100,6 +102,7 @@ static const HashTableValue JSTestObjTableValues[] =
     { "reflectedCustomIntegralAttr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjReflectedCustomIntegralAttr), (intptr_t)setJSTestObjReflectedCustomIntegralAttr, NoIntrinsic },
     { "reflectedCustomBooleanAttr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjReflectedCustomBooleanAttr), (intptr_t)setJSTestObjReflectedCustomBooleanAttr, NoIntrinsic },
     { "reflectedCustomURLAttr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjReflectedCustomURLAttr), (intptr_t)setJSTestObjReflectedCustomURLAttr, NoIntrinsic },
+    { "typedArrayAttr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjTypedArrayAttr), (intptr_t)setJSTestObjTypedArrayAttr, NoIntrinsic },
     { "attrWithGetterException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjAttrWithGetterException), (intptr_t)setJSTestObjAttrWithGetterException, NoIntrinsic },
     { "attrWithSetterException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjAttrWithSetterException), (intptr_t)setJSTestObjAttrWithSetterException, NoIntrinsic },
     { "stringAttrWithGetterException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjStringAttrWithGetterException), (intptr_t)setJSTestObjStringAttrWithGetterException, NoIntrinsic },
@@ -146,7 +149,7 @@ static const HashTableValue JSTestObjTableValues[] =
     { 0, 0, 0, 0, NoIntrinsic }
 };
 
-static const HashTable JSTestObjTable = { 140, 127, JSTestObjTableValues, 0 };
+static const HashTable JSTestObjTable = { 141, 127, JSTestObjTableValues, 0 };
 /* Hash table for constructor */
 
 static const HashTableValue JSTestObjConstructorTableValues[] =
@@ -620,6 +623,16 @@ JSValue jsTestObjReflectedCustomURLAttr(ExecState* exec, JSValue slotBase, Prope
 }
 
 
+JSValue jsTestObjTypedArrayAttr(ExecState* exec, JSValue slotBase, PropertyName)
+{
+    JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->typedArrayAttr()));
+    return result;
+}
+
+
 JSValue jsTestObjAttrWithGetterException(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
@@ -1122,6 +1135,15 @@ void setJSTestObjReflectedCustomURLAttr(ExecState* exec, JSObject* thisObject, J
 }
 
 
+void setJSTestObjTypedArrayAttr(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    JSTestObj* castedThis = jsCast<JSTestObj*>(thisObject);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    impl->setTypedArrayAttr(toFloat32Array(value));
+}
+
+
 void setJSTestObjAttrWithGetterException(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
@@ -2369,7 +2391,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionClassMethodWithClamp(Exec
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
-    if (!isnan(objArgsShortNativeValue))
+    if (!isnan(objArgsLongNativeValue))
         objArgsLong = clampTo<unsigned long>(objArgsLongNativeValue);
 
     impl->classMethodWithClamp(objArgsShort, objArgsLong);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
index 3a7e9cc27..ddcfe5d1a 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
@@ -261,6 +261,8 @@ JSC::JSValue jsTestObjReflectedCustomBooleanAttr(JSC::ExecState*, JSC::JSValue,
 void setJSTestObjReflectedCustomBooleanAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjReflectedCustomURLAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjReflectedCustomURLAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTestObjTypedArrayAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+void setJSTestObjTypedArrayAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjAttrWithGetterException(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjAttrWithGetterException(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjAttrWithSetterException(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
diff --git a/Source/WebCore/bindings/scripts/test/TestObj.idl b/Source/WebCore/bindings/scripts/test/TestObj.idl
index c8a7a02a9..2ca139a70 100644
--- a/Source/WebCore/bindings/scripts/test/TestObj.idl
+++ b/Source/WebCore/bindings/scripts/test/TestObj.idl
@@ -67,6 +67,9 @@ module test {
         attribute [Reflect=customContentBooleanAttr] boolean reflectedCustomBooleanAttr;
         attribute [Reflect=customContentURLAttr, URL] DOMString reflectedCustomURLAttr;
 
+        // TypedArray attribute
+        attribute Float32Array typedArrayAttr;
+
         // Methods
         void    voidMethod();
         void    voidMethodWithArgs(in long longArg, in DOMString strArg, in TestObj objArg);
diff --git a/Source/WebCore/bindings/scripts/test/TestTypedArray.idl b/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
index e816b3860..239680c55 100644
--- a/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
+++ b/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
@@ -26,15 +26,17 @@
 
 module html {
     interface [
-        CustomConstructor,
+        ConstructorTemplate=TypedArray,
         ConstructorParameters=123,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
         CustomToJSObject,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        TypedArray=double
     ] Float64Array : ArrayBufferView {
         Int32Array foo(in Float32Array array);
+        void set();
     };
 }
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
index d51c9faa6..7d4d75132 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
@@ -21,13 +21,13 @@
 #include "config.h"
 #include "V8Float64Array.h"
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8ArrayBufferView.h"
+#include "V8ArrayBufferViewCustom.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8Float32Array.h"
 #include "V8Int32Array.h"
@@ -59,16 +59,42 @@ static v8::Handle<v8::Value> fooCallback(const v8::Arguments& args)
     return toV8(imp->foo(array), args.GetIsolate());
 }
 
+static v8::Handle<v8::Value> setCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.Float64Array.set");
+    return setWebGLArrayHelper<Float64Array, V8Float64Array>(args);
+}
+
 } // namespace Float64ArrayV8Internal
 
+v8::Handle<v8::Value> toV8(Float64Array* impl, v8::Isolate* isolate)
+{
+    if (!impl)
+        return v8NullWithCheck(isolate);
+    v8::Handle<v8::Object> wrapper = V8Float64Array::wrap(impl, isolate);
+    if (!wrapper.IsEmpty())
+        wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), v8::kExternalDoubleArray, impl->length());
+    return wrapper;
+}
+
+static const V8DOMConfiguration::BatchedCallback Float64ArrayCallbacks[] = {
+    {"set", Float64ArrayV8Internal::setCallback},
+};
+
+v8::Handle<v8::Value> V8Float64Array::constructorCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.Float64Array.Contructor");
+    return constructWebGLArray<Float64Array, V8Float64Array, double>(args, &info, v8::kExternalDoubleArray);
+}
+
 static v8::Persistent<v8::FunctionTemplate> ConfigureV8Float64ArrayTemplate(v8::Persistent<v8::FunctionTemplate> desc)
 {
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "Float64Array", V8ArrayBufferView::GetTemplate(), V8Float64Array::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "Float64Array", V8ArrayBufferView::GetTemplate(), V8Float64Array::internalFieldCount,
         0, 0,
-        0, 0);
+        Float64ArrayCallbacks, WTF_ARRAY_LENGTH(Float64ArrayCallbacks));
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
     desc->SetCallHandler(V8Float64Array::constructorCallback);
     v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
@@ -81,7 +107,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8Float64ArrayTemplate(v8::
     const int fooArgc = 1;
     v8::Handle<v8::FunctionTemplate> fooArgv[fooArgc] = { V8Float32Array::GetRawTemplate() };
     v8::Handle<v8::Signature> fooSignature = v8::Signature::New(desc, fooArgc, fooArgv);
-    proto->Set(v8::String::New("foo"), v8::FunctionTemplate::New(Float64ArrayV8Internal::fooCallback, v8::Handle<v8::Value>(), fooSignature));
+    proto->Set(v8::String::New("foo"), v8::FunctionTemplate::New(Float64ArrayV8Internal::fooCallback, v8Undefined(), fooSignature));
 
     // Custom toString template
     desc->Set(getToStringName(), getToStringTemplate());
@@ -90,8 +116,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8Float64ArrayTemplate(v8::
 
 v8::Persistent<v8::FunctionTemplate> V8Float64Array::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -103,8 +129,8 @@ v8::Persistent<v8::FunctionTemplate> V8Float64Array::GetRawTemplate()
 
 v8::Persistent<v8::FunctionTemplate> V8Float64Array::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -124,16 +150,14 @@ bool V8Float64Array::HasInstance(v8::Handle<v8::Value> value)
 v8::Handle<v8::Object> V8Float64Array::wrapSlow(PassRefPtr<Float64Array> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
+    ASSERT(static_cast<void*>(static_cast<ArrayBufferView*>(impl.get())) == static_cast<void*>(impl.get()));
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
index 0a9b88ada..4f8b84535 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
@@ -21,12 +21,12 @@
 #include "config.h"
 #include "V8TestActiveDOMObject.h"
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
 #include "V8Node.h"
@@ -54,11 +54,11 @@ static v8::Handle<v8::Value> excitingFunctionCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
     TestActiveDOMObject* imp = V8TestActiveDOMObject::toNative(args.Holder());
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
-        return v8::Handle<v8::Value>();
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame()))
+        return v8Undefined();
     EXCEPTION_BLOCK(Node*, nextChild, V8Node::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->excitingFunction(nextChild);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> postMessageCallback(const v8::Arguments& args)
@@ -69,13 +69,13 @@ static v8::Handle<v8::Value> postMessageCallback(const v8::Arguments& args)
     TestActiveDOMObject* imp = V8TestActiveDOMObject::toNative(args.Holder());
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, message, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     imp->postMessage(message);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> postMessageAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.TestActiveDOMObject.postMessage._get");
-    static v8::Persistent<v8::FunctionTemplate> privateTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(TestActiveDOMObjectV8Internal::postMessageCallback, v8::Handle<v8::Value>(), v8::Signature::New(V8TestActiveDOMObject::GetRawTemplate())));
+    static v8::Persistent<v8::FunctionTemplate> privateTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(TestActiveDOMObjectV8Internal::postMessageCallback, v8Undefined(), v8::Signature::New(V8TestActiveDOMObject::GetRawTemplate())));
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8TestActiveDOMObject::GetTemplate(), info.This());
     if (holder.IsEmpty()) {
         // can only reach here by 'object.__proto__.func', and it should passed
@@ -83,16 +83,34 @@ static v8::Handle<v8::Value> postMessageAttrGetter(v8::Local<v8::String> name, c
         return privateTemplate->GetFunction();
     }
     TestActiveDOMObject* imp = V8TestActiveDOMObject::toNative(holder);
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), false)) {
-        static v8::Persistent<v8::FunctionTemplate> sharedTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(TestActiveDOMObjectV8Internal::postMessageCallback, v8::Handle<v8::Value>(), v8::Signature::New(V8TestActiveDOMObject::GetRawTemplate())));
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame(), DoNotReportSecurityError)) {
+        static v8::Persistent<v8::FunctionTemplate> sharedTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(TestActiveDOMObjectV8Internal::postMessageCallback, v8Undefined(), v8::Signature::New(V8TestActiveDOMObject::GetRawTemplate())));
         return sharedTemplate->GetFunction();
     }
+
+    v8::Local<v8::Value> hiddenValue = info.This()->GetHiddenValue(name);
+    if (!hiddenValue.IsEmpty())
+        return hiddenValue;
+
     return privateTemplate->GetFunction();
 }
 
+static void TestActiveDOMObjectDomainSafeFunctionSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestActiveDOMObject._set");
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8TestActiveDOMObject::GetTemplate(), info.This());
+    if (holder.IsEmpty())
+        return;
+    TestActiveDOMObject* imp = V8TestActiveDOMObject::toNative(holder);
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame()))
+        return;
+
+    info.This()->SetHiddenValue(name, value);
+}
+
 } // namespace TestActiveDOMObjectV8Internal
 
-static const BatchedAttribute TestActiveDOMObjectAttrs[] = {
+static const V8DOMConfiguration::BatchedAttribute TestActiveDOMObjectAttrs[] = {
     // Attribute 'excitingAttr' (Type: 'readonly attribute' ExtAttr: '')
     {"excitingAttr", TestActiveDOMObjectV8Internal::excitingAttrAttrGetter, 0, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
 };
@@ -102,7 +120,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestActiveDOMObjectTempla
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestActiveDOMObject", v8::Persistent<v8::FunctionTemplate>(), V8TestActiveDOMObject::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "TestActiveDOMObject", v8::Persistent<v8::FunctionTemplate>(), V8TestActiveDOMObject::internalFieldCount,
         TestActiveDOMObjectAttrs, WTF_ARRAY_LENGTH(TestActiveDOMObjectAttrs),
         0, 0);
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -116,10 +134,10 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestActiveDOMObjectTempla
     const int excitingFunctionArgc = 1;
     v8::Handle<v8::FunctionTemplate> excitingFunctionArgv[excitingFunctionArgc] = { V8Node::GetRawTemplate() };
     v8::Handle<v8::Signature> excitingFunctionSignature = v8::Signature::New(desc, excitingFunctionArgc, excitingFunctionArgv);
-    proto->Set(v8::String::New("excitingFunction"), v8::FunctionTemplate::New(TestActiveDOMObjectV8Internal::excitingFunctionCallback, v8::Handle<v8::Value>(), excitingFunctionSignature));
+    proto->Set(v8::String::New("excitingFunction"), v8::FunctionTemplate::New(TestActiveDOMObjectV8Internal::excitingFunctionCallback, v8Undefined(), excitingFunctionSignature));
 
     // Function 'postMessage' (ExtAttr: 'DoNotCheckSecurity')
-    proto->SetAccessor(v8::String::New("postMessage"), TestActiveDOMObjectV8Internal::postMessageAttrGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
+    proto->SetAccessor(v8::String::New("postMessage"), TestActiveDOMObjectV8Internal::postMessageAttrGetter, TestActiveDOMObjectV8Internal::TestActiveDOMObjectDomainSafeFunctionSetter, v8Undefined(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete));
 
     // Custom toString template
     desc->Set(getToStringName(), getToStringTemplate());
@@ -128,8 +146,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestActiveDOMObjectTempla
 
 v8::Persistent<v8::FunctionTemplate> V8TestActiveDOMObject::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -141,8 +159,8 @@ v8::Persistent<v8::FunctionTemplate> V8TestActiveDOMObject::GetRawTemplate()
 
 v8::Persistent<v8::FunctionTemplate> V8TestActiveDOMObject::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -164,9 +182,8 @@ v8::Handle<v8::Object> V8TestActiveDOMObject::wrapSlow(PassRefPtr<TestActiveDOMO
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     if (impl->frame()) {
-        proxy = V8Proxy::retrieve(impl->frame());
-        if (proxy)
-            proxy->windowShell()->initContextIfNeeded();
+        proxy = impl->frame()->script()->proxy();
+        proxy->windowShell()->initContextIfNeeded();
     }
 
     // Enter the node's context and create the wrapper in that context.
@@ -184,12 +201,9 @@ v8::Handle<v8::Object> V8TestActiveDOMObject::wrapSlow(PassRefPtr<TestActiveDOMO
         context->Exit();
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
index 180d6fd8c..fecc40c86 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
@@ -21,12 +21,11 @@
 #include "config.h"
 #include "V8TestCustomNamedGetter.h"
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
 #include "V8Proxy.h"
@@ -48,12 +47,12 @@ static v8::Handle<v8::Value> anotherFunctionCallback(const v8::Arguments& args)
     TestCustomNamedGetter* imp = V8TestCustomNamedGetter::toNative(args.Holder());
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     imp->anotherFunction(str);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 } // namespace TestCustomNamedGetterV8Internal
 
-static const BatchedCallback TestCustomNamedGetterCallbacks[] = {
+static const V8DOMConfiguration::BatchedCallback TestCustomNamedGetterCallbacks[] = {
     {"anotherFunction", TestCustomNamedGetterV8Internal::anotherFunctionCallback},
 };
 
@@ -62,7 +61,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestCustomNamedGetterTemp
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestCustomNamedGetter", v8::Persistent<v8::FunctionTemplate>(), V8TestCustomNamedGetter::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "TestCustomNamedGetter", v8::Persistent<v8::FunctionTemplate>(), V8TestCustomNamedGetter::internalFieldCount,
         0, 0,
         TestCustomNamedGetterCallbacks, WTF_ARRAY_LENGTH(TestCustomNamedGetterCallbacks));
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -80,8 +79,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestCustomNamedGetterTemp
 
 v8::Persistent<v8::FunctionTemplate> V8TestCustomNamedGetter::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -93,8 +92,8 @@ v8::Persistent<v8::FunctionTemplate> V8TestCustomNamedGetter::GetRawTemplate()
 
 v8::Persistent<v8::FunctionTemplate> V8TestCustomNamedGetter::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -118,12 +117,9 @@ v8::Handle<v8::Object> V8TestCustomNamedGetter::wrapSlow(PassRefPtr<TestCustomNa
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
index 8dda9252e..6e755a7cd 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
@@ -21,12 +21,11 @@
 #include "config.h"
 #include "V8TestEventConstructor.h"
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
 #include "Dictionary.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
 #include "V8Proxy.h"
@@ -56,7 +55,7 @@ static v8::Handle<v8::Value> attr2AttrGetter(v8::Local<v8::String> name, const v
 
 } // namespace TestEventConstructorV8Internal
 
-static const BatchedAttribute TestEventConstructorAttrs[] = {
+static const V8DOMConfiguration::BatchedAttribute TestEventConstructorAttrs[] = {
     // Attribute 'attr1' (Type: 'readonly attribute' ExtAttr: '')
     {"attr1", TestEventConstructorV8Internal::attr1AttrGetter, 0, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'attr2' (Type: 'readonly attribute' ExtAttr: 'InitializedByEventConstructor')
@@ -79,16 +78,17 @@ v8::Handle<v8::Value> V8TestEventConstructor::constructorCallback(const v8::Argu
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, type, args[0]);
     TestEventConstructorInit eventInit;
     if (args.Length() >= 2) {
-        EXCEPTION_BLOCK(Dictionary, options, args[1]);
+        EXCEPTION_BLOCK(Dictionary, options, Dictionary(args[1], args.GetIsolate()));
         if (!fillTestEventConstructorInit(eventInit, options))
-            return v8::Undefined();
+            return v8Undefined();
     }
 
     RefPtr<TestEventConstructor> event = TestEventConstructor::create(type, eventInit);
 
-    V8DOMWrapper::setDOMWrapper(args.Holder(), &info, event.get());
-    V8DOMWrapper::setJSWrapperForDOMObject(event.release(), v8::Persistent<v8::Object>::New(args.Holder()), args.GetIsolate());
-    return args.Holder();
+    v8::Handle<v8::Object> wrapper = args.Holder();
+    V8DOMWrapper::setDOMWrapper(wrapper, &info, event.get());
+    V8DOMWrapper::setJSWrapperForDOMObject(event.release(), wrapper, args.GetIsolate());
+    return wrapper;
 }
 
 bool fillTestEventConstructorInit(TestEventConstructorInit& eventInit, const Dictionary& options)
@@ -102,7 +102,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestEventConstructorTempl
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestEventConstructor", v8::Persistent<v8::FunctionTemplate>(), V8TestEventConstructor::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "TestEventConstructor", v8::Persistent<v8::FunctionTemplate>(), V8TestEventConstructor::internalFieldCount,
         TestEventConstructorAttrs, WTF_ARRAY_LENGTH(TestEventConstructorAttrs),
         0, 0);
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -116,8 +116,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestEventConstructorTempl
 
 v8::Persistent<v8::FunctionTemplate> V8TestEventConstructor::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -129,8 +129,8 @@ v8::Persistent<v8::FunctionTemplate> V8TestEventConstructor::GetRawTemplate()
 
 v8::Persistent<v8::FunctionTemplate> V8TestEventConstructor::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -154,12 +154,9 @@ v8::Handle<v8::Object> V8TestEventConstructor::wrapSlow(PassRefPtr<TestEventCons
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
index c5bdbeb4e..87eea8bf0 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
@@ -21,12 +21,11 @@
 #include "config.h"
 #include "V8TestEventTarget.h"
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8Collection.h"
 #include "V8DOMWrapper.h"
 #include "V8Event.h"
@@ -70,7 +69,7 @@ static v8::Handle<v8::Value> addEventListenerCallback(const v8::Arguments& args)
         V8TestEventTarget::toNative(args.Holder())->addEventListener(v8ValueToAtomicWebCoreString(args[0]), listener, args[2]->BooleanValue());
         createHiddenDependency(args.Holder(), args[1], V8TestEventTarget::eventListenerCacheIndex);
     }
-    return v8::Undefined();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> removeEventListenerCallback(const v8::Arguments& args)
@@ -81,7 +80,7 @@ static v8::Handle<v8::Value> removeEventListenerCallback(const v8::Arguments& ar
         V8TestEventTarget::toNative(args.Holder())->removeEventListener(v8ValueToAtomicWebCoreString(args[0]), listener.get(), args[2]->BooleanValue());
         removeHiddenDependency(args.Holder(), args[1], V8TestEventTarget::eventListenerCacheIndex);
     }
-    return v8::Undefined();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> dispatchEventCallback(const v8::Arguments& args)
@@ -104,7 +103,7 @@ static v8::Handle<v8::Value> dispatchEventCallback(const v8::Arguments& args)
 
 } // namespace TestEventTargetV8Internal
 
-static const BatchedCallback TestEventTargetCallbacks[] = {
+static const V8DOMConfiguration::BatchedCallback TestEventTargetCallbacks[] = {
     {"item", TestEventTargetV8Internal::itemCallback},
     {"addEventListener", TestEventTargetV8Internal::addEventListenerCallback},
     {"removeEventListener", TestEventTargetV8Internal::removeEventListenerCallback},
@@ -115,7 +114,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestEventTargetTemplate(v
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestEventTarget", v8::Persistent<v8::FunctionTemplate>(), V8TestEventTarget::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "TestEventTarget", v8::Persistent<v8::FunctionTemplate>(), V8TestEventTarget::internalFieldCount,
         0, 0,
         TestEventTargetCallbacks, WTF_ARRAY_LENGTH(TestEventTargetCallbacks));
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -132,7 +131,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestEventTargetTemplate(v
     const int dispatchEventArgc = 1;
     v8::Handle<v8::FunctionTemplate> dispatchEventArgv[dispatchEventArgc] = { V8Event::GetRawTemplate() };
     v8::Handle<v8::Signature> dispatchEventSignature = v8::Signature::New(desc, dispatchEventArgc, dispatchEventArgv);
-    proto->Set(v8::String::New("dispatchEvent"), v8::FunctionTemplate::New(TestEventTargetV8Internal::dispatchEventCallback, v8::Handle<v8::Value>(), dispatchEventSignature));
+    proto->Set(v8::String::New("dispatchEvent"), v8::FunctionTemplate::New(TestEventTargetV8Internal::dispatchEventCallback, v8Undefined(), dispatchEventSignature));
 
     // Custom toString template
     desc->Set(getToStringName(), getToStringTemplate());
@@ -141,8 +140,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestEventTargetTemplate(v
 
 v8::Persistent<v8::FunctionTemplate> V8TestEventTarget::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -154,8 +153,8 @@ v8::Persistent<v8::FunctionTemplate> V8TestEventTarget::GetRawTemplate()
 
 v8::Persistent<v8::FunctionTemplate> V8TestEventTarget::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -179,12 +178,9 @@ v8::Handle<v8::Object> V8TestEventTarget::wrapSlow(PassRefPtr<TestEventTarget> i
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp
index e2c8e96ec..9bb99ac3e 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp
@@ -21,10 +21,10 @@
 #include "config.h"
 #include "V8TestException.h"
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
 #include "V8Proxy.h"
@@ -47,7 +47,7 @@ static v8::Handle<v8::Value> nameAttrGetter(v8::Local<v8::String> name, const v8
 
 } // namespace TestExceptionV8Internal
 
-static const BatchedAttribute TestExceptionAttrs[] = {
+static const V8DOMConfiguration::BatchedAttribute TestExceptionAttrs[] = {
     // Attribute 'name' (Type: 'readonly attribute' ExtAttr: '')
     {"name", TestExceptionV8Internal::nameAttrGetter, 0, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
 };
@@ -57,7 +57,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestExceptionTemplate(v8:
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestException", v8::Persistent<v8::FunctionTemplate>(), V8TestException::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "TestException", v8::Persistent<v8::FunctionTemplate>(), V8TestException::internalFieldCount,
         TestExceptionAttrs, WTF_ARRAY_LENGTH(TestExceptionAttrs),
         0, 0);
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -70,8 +70,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestExceptionTemplate(v8:
 
 v8::Persistent<v8::FunctionTemplate> V8TestException::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -83,8 +83,8 @@ v8::Persistent<v8::FunctionTemplate> V8TestException::GetRawTemplate()
 
 v8::Persistent<v8::FunctionTemplate> V8TestException::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -108,12 +108,9 @@ v8::Handle<v8::Object> V8TestException::wrapSlow(PassRefPtr<TestException> impl,
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
index 1d7dcb534..47e422840 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
@@ -23,13 +23,12 @@
 
 #if ENABLE(Condition1) || ENABLE(Condition2)
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
 #include "RuntimeEnabledFeatures.h"
 #include "TestSupplemental.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
 #include "V8Node.h"
@@ -146,7 +145,7 @@ static v8::Handle<v8::Value> supplementalMethod1Callback(const v8::Arguments& ar
     INC_STATS("DOM.TestInterface.supplementalMethod1");
     TestInterface* imp = V8TestInterface::toNative(args.Holder());
     TestSupplemental::supplementalMethod1(imp);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 #endif // ENABLE(Condition11) || ENABLE(Condition12)
@@ -165,7 +164,7 @@ static v8::Handle<v8::Value> supplementalMethod2Callback(const v8::Arguments& ar
     EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined))) : 0);
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
-        return v8::Undefined();
+        return v8Undefined();
     RefPtr<TestObj> result = TestSupplemental::supplementalMethod2(scriptContext, imp, strArg, objArg, ec);
     if (UNLIKELY(ec))
         goto fail;
@@ -183,14 +182,14 @@ static v8::Handle<v8::Value> supplementalMethod4Callback(const v8::Arguments& ar
 {
     INC_STATS("DOM.TestInterface.supplementalMethod4");
     TestSupplemental::supplementalMethod4();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 #endif // ENABLE(Condition11) || ENABLE(Condition12)
 
 } // namespace TestInterfaceV8Internal
 
-static const BatchedAttribute TestInterfaceAttrs[] = {
+static const V8DOMConfiguration::BatchedAttribute TestInterfaceAttrs[] = {
 #if ENABLE(Condition11) || ENABLE(Condition12)
     // Attribute 'supplementalStaticReadOnlyAttr' (Type: 'readonly attribute' ExtAttr: 'Conditional ImplementedBy')
     {"supplementalStaticReadOnlyAttr", TestInterfaceV8Internal::supplementalStaticReadOnlyAttrAttrGetter, 0, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
@@ -217,7 +216,7 @@ static const BatchedAttribute TestInterfaceAttrs[] = {
 #endif // ENABLE(Condition11) || ENABLE(Condition12)
 };
 
-static const BatchedCallback TestInterfaceCallbacks[] = {
+static const V8DOMConfiguration::BatchedCallback TestInterfaceCallbacks[] = {
 #if ENABLE(Condition11) || ENABLE(Condition12)
     {"supplementalMethod1", TestInterfaceV8Internal::supplementalMethod1Callback},
 #endif
@@ -226,7 +225,7 @@ static const BatchedCallback TestInterfaceCallbacks[] = {
 #endif
 };
 
-static const BatchedConstant TestInterfaceConsts[] = {
+static const V8DOMConfiguration::BatchedConstant TestInterfaceConsts[] = {
 #if ENABLE(Condition11) || ENABLE(Condition12)
     {"SUPPLEMENTALCONSTANT1", static_cast<signed int>(1)},
 #endif
@@ -269,10 +268,10 @@ v8::Handle<v8::Value> V8TestInterface::constructorCallback(const v8::Arguments&
         goto fail;
 
     V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
-    V8DOMWrapper::setJSWrapperForActiveDOMObject(impl.release(), v8::Persistent<v8::Object>::New(wrapper), args.GetIsolate());
-    return args.Holder();
+    V8DOMWrapper::setJSWrapperForActiveDOMObject(impl.release(), wrapper, args.GetIsolate());
+    return wrapper;
   fail:
-    return throwError(ec, args.GetIsolate());
+    return V8Proxy::setDOMException(ec, args.GetIsolate());
 }
 
 static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestInterfaceTemplate(v8::Persistent<v8::FunctionTemplate> desc)
@@ -280,7 +279,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestInterfaceTemplate(v8:
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestInterface", v8::Persistent<v8::FunctionTemplate>(), V8TestInterface::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "TestInterface", v8::Persistent<v8::FunctionTemplate>(), V8TestInterface::internalFieldCount,
         TestInterfaceAttrs, WTF_ARRAY_LENGTH(TestInterfaceAttrs),
         TestInterfaceCallbacks, WTF_ARRAY_LENGTH(TestInterfaceCallbacks));
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -296,12 +295,12 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestInterfaceTemplate(v8:
     v8::Handle<v8::FunctionTemplate> supplementalMethod2Argv[supplementalMethod2Argc] = { v8::Handle<v8::FunctionTemplate>(), V8TestObj::GetRawTemplate() };
     v8::Handle<v8::Signature> supplementalMethod2Signature = v8::Signature::New(desc, supplementalMethod2Argc, supplementalMethod2Argv);
 #if ENABLE(Condition11) || ENABLE(Condition12)
-    proto->Set(v8::String::New("supplementalMethod2"), v8::FunctionTemplate::New(TestInterfaceV8Internal::supplementalMethod2Callback, v8::Handle<v8::Value>(), supplementalMethod2Signature));
+    proto->Set(v8::String::New("supplementalMethod2"), v8::FunctionTemplate::New(TestInterfaceV8Internal::supplementalMethod2Callback, v8Undefined(), supplementalMethod2Signature));
 #endif // ENABLE(Condition11) || ENABLE(Condition12)
 #if ENABLE(Condition11) || ENABLE(Condition12)
-    desc->Set(v8::String::New("supplementalMethod4"), v8::FunctionTemplate::New(TestInterfaceV8Internal::supplementalMethod4Callback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
+    desc->Set(v8::String::New("supplementalMethod4"), v8::FunctionTemplate::New(TestInterfaceV8Internal::supplementalMethod4Callback, v8Undefined(), v8::Local<v8::Signature>()));
 #endif // ENABLE(Condition11) || ENABLE(Condition12)
-    batchConfigureConstants(desc, proto, TestInterfaceConsts, WTF_ARRAY_LENGTH(TestInterfaceConsts));
+    V8DOMConfiguration::batchConfigureConstants(desc, proto, TestInterfaceConsts, WTF_ARRAY_LENGTH(TestInterfaceConsts));
 
     // Custom toString template
     desc->Set(getToStringName(), getToStringTemplate());
@@ -310,8 +309,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestInterfaceTemplate(v8:
 
 v8::Persistent<v8::FunctionTemplate> V8TestInterface::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -323,8 +322,8 @@ v8::Persistent<v8::FunctionTemplate> V8TestInterface::GetRawTemplate()
 
 v8::Persistent<v8::FunctionTemplate> V8TestInterface::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -352,12 +351,9 @@ v8::Handle<v8::Object> V8TestInterface::wrapSlow(PassRefPtr<TestInterface> impl,
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForActiveDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForActiveDOMObject(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
index 9c0c0d814..265f30879 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
@@ -21,13 +21,12 @@
 #include "config.h"
 #include "V8TestMediaQueryListListener.h"
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
 #include "MediaQueryListListener.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
 #include "V8Proxy.h"
@@ -49,12 +48,12 @@ static v8::Handle<v8::Value> methodCallback(const v8::Arguments& args)
     TestMediaQueryListListener* imp = V8TestMediaQueryListListener::toNative(args.Holder());
     EXCEPTION_BLOCK(RefPtr<MediaQueryListListener>, listener, MediaQueryListListener::create(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->method(listener);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 } // namespace TestMediaQueryListListenerV8Internal
 
-static const BatchedCallback TestMediaQueryListListenerCallbacks[] = {
+static const V8DOMConfiguration::BatchedCallback TestMediaQueryListListenerCallbacks[] = {
     {"method", TestMediaQueryListListenerV8Internal::methodCallback},
 };
 
@@ -63,7 +62,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestMediaQueryListListene
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestMediaQueryListListener", v8::Persistent<v8::FunctionTemplate>(), V8TestMediaQueryListListener::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "TestMediaQueryListListener", v8::Persistent<v8::FunctionTemplate>(), V8TestMediaQueryListListener::internalFieldCount,
         0, 0,
         TestMediaQueryListListenerCallbacks, WTF_ARRAY_LENGTH(TestMediaQueryListListenerCallbacks));
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -80,8 +79,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestMediaQueryListListene
 
 v8::Persistent<v8::FunctionTemplate> V8TestMediaQueryListListener::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -93,8 +92,8 @@ v8::Persistent<v8::FunctionTemplate> V8TestMediaQueryListListener::GetRawTemplat
 
 v8::Persistent<v8::FunctionTemplate> V8TestMediaQueryListListener::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -118,12 +117,9 @@ v8::Handle<v8::Object> V8TestMediaQueryListListener::wrapSlow(PassRefPtr<TestMed
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
index ad85cce22..6e7c6e26b 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
@@ -21,12 +21,12 @@
 #include "config.h"
 #include "V8TestNamedConstructor.h"
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
 #include "V8Proxy.h"
@@ -54,7 +54,7 @@ static v8::Handle<v8::Value> V8TestNamedConstructorConstructorCallback(const v8:
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
 
-    Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
+    Frame* frame = currentFrame(BindingState::instance());
     if (!frame)
         return V8Proxy::throwError(V8Proxy::ReferenceError, "TestNamedConstructor constructor associated frame is unavailable", args.GetIsolate());
 
@@ -78,10 +78,10 @@ static v8::Handle<v8::Value> V8TestNamedConstructorConstructorCallback(const v8:
         goto fail;
 
     V8DOMWrapper::setDOMWrapper(wrapper, &V8TestNamedConstructorConstructor::info, impl.get());
-    V8DOMWrapper::setJSWrapperForActiveDOMObject(impl.release(), v8::Persistent<v8::Object>::New(wrapper), args.GetIsolate());
-    return args.Holder();
+    V8DOMWrapper::setJSWrapperForActiveDOMObject(impl.release(), wrapper, args.GetIsolate());
+    return wrapper;
   fail:
-    return throwError(ec, args.GetIsolate());
+    return V8Proxy::setDOMException(ec, args.GetIsolate());
 }
 
 v8::Persistent<v8::FunctionTemplate> V8TestNamedConstructorConstructor::GetTemplate()
@@ -107,7 +107,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestNamedConstructorTempl
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestNamedConstructor", v8::Persistent<v8::FunctionTemplate>(), V8TestNamedConstructor::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "TestNamedConstructor", v8::Persistent<v8::FunctionTemplate>(), V8TestNamedConstructor::internalFieldCount,
         0, 0,
         0, 0);
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -120,8 +120,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestNamedConstructorTempl
 
 v8::Persistent<v8::FunctionTemplate> V8TestNamedConstructor::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -133,8 +133,8 @@ v8::Persistent<v8::FunctionTemplate> V8TestNamedConstructor::GetRawTemplate()
 
 v8::Persistent<v8::FunctionTemplate> V8TestNamedConstructor::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -162,12 +162,9 @@ v8::Handle<v8::Object> V8TestNamedConstructor::wrapSlow(PassRefPtr<TestNamedCons
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForActiveDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForActiveDOMObject(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
index ce37e002f..d58508910 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
@@ -21,10 +21,11 @@
 #include "config.h"
 #include "V8TestNode.h"
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
+#include "Frame.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
 #include "V8Node.h"
@@ -55,8 +56,8 @@ v8::Handle<v8::Value> V8TestNode::constructorCallback(const v8::Arguments& args)
     v8::Handle<v8::Object> wrapper = args.Holder();
 
     V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
-    V8DOMWrapper::setJSWrapperForDOMNode(impl.release(), v8::Persistent<v8::Object>::New(wrapper), args.GetIsolate());
-    return args.Holder();
+    V8DOMWrapper::setJSWrapperForDOMNode(impl.release(), wrapper, args.GetIsolate());
+    return wrapper;
 }
 
 static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestNodeTemplate(v8::Persistent<v8::FunctionTemplate> desc)
@@ -64,7 +65,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestNodeTemplate(v8::Pers
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestNode", V8Node::GetTemplate(), V8TestNode::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "TestNode", V8Node::GetTemplate(), V8TestNode::internalFieldCount,
         0, 0,
         0, 0);
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -78,8 +79,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestNodeTemplate(v8::Pers
 
 v8::Persistent<v8::FunctionTemplate> V8TestNode::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -91,8 +92,8 @@ v8::Persistent<v8::FunctionTemplate> V8TestNode::GetRawTemplate()
 
 v8::Persistent<v8::FunctionTemplate> V8TestNode::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -112,7 +113,8 @@ bool V8TestNode::HasInstance(v8::Handle<v8::Value> value)
 v8::Handle<v8::Object> V8TestNode::wrapSlow(PassRefPtr<TestNode> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = V8Proxy::retrieve(impl->document()->frame());
+    ASSERT(static_cast<void*>(static_cast<Node*>(impl.get())) == static_cast<void*>(impl.get()));
+    V8Proxy* proxy = impl->document()->frame() ? impl->document()->frame()->script()->proxy() : 0;
 
     // Enter the node's context and create the wrapper in that context.
     v8::Handle<v8::Context> context;
@@ -129,13 +131,10 @@ v8::Handle<v8::Object> V8TestNode::wrapSlow(PassRefPtr<TestNode> impl, v8::Isola
         context->Exit();
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMNode(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
     wrapperHandle.SetWrapperClassId(v8DOMSubtreeClassId);
-    V8DOMWrapper::setJSWrapperForDOMNode(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 1f0773d81..b3d775e81 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "V8TestObj.h"
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
 #include "DOMStringList.h"
 #include "Dictionary.h"
@@ -37,11 +38,10 @@
 #include "ScriptProfile.h"
 #include "SerializedScriptValue.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8DOMStringList.h"
 #include "V8DOMWrapper.h"
 #include "V8Document.h"
+#include "V8Float32Array.h"
 #include "V8IsolatedContext.h"
 #include "V8Proxy.h"
 #include "V8SVGDocument.h"
@@ -56,6 +56,7 @@
 #include "V8c.h"
 #include "V8d.h"
 #include "V8e.h"
+#include <wtf/Float32Array.h>
 #include <wtf/GetPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -100,7 +101,7 @@ static v8::Handle<v8::Value> readOnlyTestObjAttrAttrGetter(v8::Local<v8::String>
     INC_STATS("DOM.TestObj.readOnlyTestObjAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
     RefPtr<TestObj> result = imp->readOnlyTestObjAttr();
-    v8::Handle<v8::Value> wrapper = result.get() ? getDOMObjectMap(info.GetIsolate()).get(result.get()) : v8::Handle<v8::Object>();
+    v8::Handle<v8::Value> wrapper = result.get() ? getDOMObjectMap(info.GetIsolate()).get(result.get()) : v8Undefined();
     if (wrapper.IsEmpty()) {
         wrapper = toV8(result.get(), info.GetIsolate());
         if (!wrapper.IsEmpty())
@@ -417,6 +418,22 @@ static void reflectedCustomURLAttrAttrSetter(v8::Local<v8::String> name, v8::Loc
     return;
 }
 
+static v8::Handle<v8::Value> typedArrayAttrAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.typedArrayAttr._get");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    return toV8(imp->typedArrayAttr(), info.GetIsolate());
+}
+
+static void typedArrayAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.typedArrayAttr._set");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    Float32Array* v = V8Float32Array::HasInstance(value) ? V8Float32Array::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    imp->setTypedArrayAttr(WTF::getPtr(v));
+    return;
+}
+
 static v8::Handle<v8::Value> attrWithGetterExceptionAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.TestObj.attrWithGetterException._get");
@@ -507,7 +524,7 @@ static v8::Handle<v8::Value> withScriptStateAttributeAttrGetter(v8::Local<v8::St
     TestObj* imp = V8TestObj::toNative(info.Holder());
     ScriptState* state = ScriptState::current();
     if (!state)
-        return v8::Undefined();
+        return v8Undefined();
     return v8Integer(imp->withScriptStateAttribute(state), info.GetIsolate());
 }
 
@@ -531,7 +548,7 @@ static v8::Handle<v8::Value> withScriptExecutionContextAttributeAttrGetter(v8::L
     TestObj* imp = V8TestObj::toNative(info.Holder());
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
-        return v8::Undefined();
+        return v8Undefined();
     return toV8(imp->withScriptExecutionContextAttribute(scriptContext), info.GetIsolate());
 }
 
@@ -554,7 +571,7 @@ static v8::Handle<v8::Value> withScriptStateAttributeRaisesAttrGetter(v8::Local<
     ExceptionCode ec = 0;
     ScriptState* state = ScriptState::current();
     if (!state)
-        return v8::Undefined();
+        return v8Undefined();
     RefPtr<TestObj> v = imp->withScriptStateAttributeRaises(state, ec);
     if (UNLIKELY(ec))
         return V8Proxy::setDOMException(ec, info.GetIsolate());
@@ -587,7 +604,7 @@ static v8::Handle<v8::Value> withScriptExecutionContextAttributeRaisesAttrGetter
     ExceptionCode ec = 0;
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
-        return v8::Undefined();
+        return v8Undefined();
     RefPtr<TestObj> v = imp->withScriptExecutionContextAttributeRaises(scriptContext, ec);
     if (UNLIKELY(ec))
         return V8Proxy::setDOMException(ec, info.GetIsolate());
@@ -615,10 +632,10 @@ static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateAttributeAt
     TestObj* imp = V8TestObj::toNative(info.Holder());
     ScriptState* state = ScriptState::current();
     if (!state)
-        return v8::Undefined();
+        return v8Undefined();
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
-        return v8::Undefined();
+        return v8Undefined();
     return toV8(imp->withScriptExecutionContextAndScriptStateAttribute(state, scriptContext), info.GetIsolate());
 }
 
@@ -646,10 +663,10 @@ static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateAttributeRa
     ExceptionCode ec = 0;
     ScriptState* state = ScriptState::current();
     if (!state)
-        return v8::Undefined();
+        return v8Undefined();
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
-        return v8::Undefined();
+        return v8Undefined();
     RefPtr<TestObj> v = imp->withScriptExecutionContextAndScriptStateAttributeRaises(state, scriptContext, ec);
     if (UNLIKELY(ec))
         return V8Proxy::setDOMException(ec, info.GetIsolate());
@@ -684,10 +701,10 @@ static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateWithSpacesA
     TestObj* imp = V8TestObj::toNative(info.Holder());
     ScriptState* state = ScriptState::current();
     if (!state)
-        return v8::Undefined();
+        return v8Undefined();
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
-        return v8::Undefined();
+        return v8Undefined();
     return toV8(imp->withScriptExecutionContextAndScriptStateWithSpacesAttribute(state, scriptContext), info.GetIsolate());
 }
 
@@ -714,7 +731,7 @@ static v8::Handle<v8::Value> withScriptArgumentsAndCallStackAttributeAttrGetter(
     TestObj* imp = V8TestObj::toNative(info.Holder());
     RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
     if (!callStack)
-        return v8::Undefined();
+        return v8Undefined();
     return toV8(imp->withScriptArgumentsAndCallStackAttribute(callStack), info.GetIsolate());
 }
 
@@ -725,7 +742,7 @@ static void withScriptArgumentsAndCallStackAttributeAttrSetter(v8::Local<v8::Str
     TestObj* v = V8TestObj::HasInstance(value) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
     RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
     if (!callStack)
-        return v8::Undefined();
+        return v8Undefined();
     imp->setWithScriptArgumentsAndCallStackAttribute(callStack, WTF::getPtr(v));
     return;
 }
@@ -807,7 +824,7 @@ static v8::Handle<v8::Value> cachedAttribute1AttrGetter(v8::Local<v8::String> na
     INC_STATS("DOM.TestObj.cachedAttribute1._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
     RefPtr<any> result = imp->cachedAttribute1();
-    v8::Handle<v8::Value> wrapper = result.get() ? getDOMObjectMap(info.GetIsolate()).get(result.get()) : v8::Handle<v8::Object>();
+    v8::Handle<v8::Value> wrapper = result.get() ? getDOMObjectMap(info.GetIsolate()).get(result.get()) : v8Undefined();
     if (wrapper.IsEmpty()) {
         wrapper = toV8(result.get(), info.GetIsolate());
         if (!wrapper.IsEmpty())
@@ -821,7 +838,7 @@ static v8::Handle<v8::Value> cachedAttribute2AttrGetter(v8::Local<v8::String> na
     INC_STATS("DOM.TestObj.cachedAttribute2._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
     RefPtr<any> result = imp->cachedAttribute2();
-    v8::Handle<v8::Value> wrapper = result.get() ? getDOMObjectMap(info.GetIsolate()).get(result.get()) : v8::Handle<v8::Object>();
+    v8::Handle<v8::Value> wrapper = result.get() ? getDOMObjectMap(info.GetIsolate()).get(result.get()) : v8Undefined();
     if (wrapper.IsEmpty()) {
         wrapper = toV8(result.get(), info.GetIsolate());
         if (!wrapper.IsEmpty())
@@ -930,7 +947,7 @@ static v8::Handle<v8::Value> contentDocumentAttrGetter(v8::Local<v8::String> nam
 {
     INC_STATS("DOM.TestObj.contentDocument._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    if (!V8BindingSecurity::shouldAllowAccessToNode(V8BindingState::Only(), imp->contentDocument()))
+    if (!BindingSecurity::shouldAllowAccessToNode(BindingState::instance(), imp->contentDocument()))
         return v8::Handle<v8::Value>(v8::Null(info.GetIsolate()));
 
     return toV8(imp->contentDocument(), info.GetIsolate());
@@ -1043,7 +1060,7 @@ static v8::Handle<v8::Value> TestObjConstructorGetter(v8::Local<v8::String> name
     v8::Handle<v8::Value> data = info.Data();
     ASSERT(data->IsExternal() || data->IsNumber());
     WrapperTypeInfo* type = WrapperTypeInfo::unwrap(data);
-    return v8::Handle<v8::Value>();}
+    return v8Undefined();}
 
 static void TestObjReplaceableAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
@@ -1056,7 +1073,7 @@ static v8::Handle<v8::Value> voidMethodCallback(const v8::Arguments& args)
     INC_STATS("DOM.TestObj.voidMethod");
     TestObj* imp = V8TestObj::toNative(args.Holder());
     imp->voidMethod();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> voidMethodWithArgsCallback(const v8::Arguments& args)
@@ -1069,7 +1086,7 @@ static v8::Handle<v8::Value> voidMethodWithArgsCallback(const v8::Arguments& arg
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
     EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined))) : 0);
     imp->voidMethodWithArgs(Arg, strArg, objArg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> MethodCallback(const v8::Arguments& args)
@@ -1118,7 +1135,7 @@ static v8::Handle<v8::Value> methodWithSequenceArgCallback(const v8::Arguments&
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(Vector<ScriptProfile>, sequenceArg, toNativeArray<ScriptProfile>(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->methodWithSequenceArg(sequenceArg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> methodReturningSequenceCallback(const v8::Arguments& args)
@@ -1159,9 +1176,9 @@ static v8::Handle<v8::Value> serializedValueCallback(const v8::Arguments& args)
     bool serializedArgDidThrow = false;
     RefPtr<SerializedScriptValue> serializedArg = SerializedScriptValue::create(args[0], 0, 0, serializedArgDidThrow, args.GetIsolate());
     if (serializedArgDidThrow)
-        return v8::Undefined();
+        return v8Undefined();
     imp->serializedValue(serializedArg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> idbKeyCallback(const v8::Arguments& args)
@@ -1172,7 +1189,7 @@ static v8::Handle<v8::Value> idbKeyCallback(const v8::Arguments& args)
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(RefPtr<IDBKey>, key, createIDBKeyFromValue(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->idbKey(key.get());
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> optionsObjectCallback(const v8::Arguments& args)
@@ -1181,18 +1198,18 @@ static v8::Handle<v8::Value> optionsObjectCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(Dictionary, oo, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    EXCEPTION_BLOCK(Dictionary, oo, Dictionary(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined), args.GetIsolate()));
     if (!oo.isUndefinedOrNull() && !oo.isObject())
         return V8Proxy::throwTypeError("Not an object.", args.GetIsolate());
     if (args.Length() <= 1) {
         imp->optionsObject(oo);
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
-    EXCEPTION_BLOCK(Dictionary, ooo, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
+    EXCEPTION_BLOCK(Dictionary, ooo, Dictionary(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined), args.GetIsolate()));
     if (!ooo.isUndefinedOrNull() && !ooo.isObject())
         return V8Proxy::throwTypeError("Not an object.", args.GetIsolate());
     imp->optionsObject(oo, ooo);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> methodWithExceptionCallback(const v8::Arguments& args)
@@ -1204,7 +1221,7 @@ static v8::Handle<v8::Value> methodWithExceptionCallback(const v8::Arguments& ar
     imp->methodWithException(ec);
     if (UNLIKELY(ec))
         goto fail;
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
     }
     fail:
     return V8Proxy::setDOMException(ec, args.GetIsolate());
@@ -1218,7 +1235,7 @@ static v8::Handle<v8::Value> addEventListenerCallback(const v8::Arguments& args)
         V8TestObj::toNative(args.Holder())->addEventListener(v8ValueToAtomicWebCoreString(args[0]), listener, args[2]->BooleanValue());
         createHiddenDependency(args.Holder(), args[1], V8TestObj::eventListenerCacheIndex);
     }
-    return v8::Undefined();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> removeEventListenerCallback(const v8::Arguments& args)
@@ -1229,7 +1246,7 @@ static v8::Handle<v8::Value> removeEventListenerCallback(const v8::Arguments& ar
         V8TestObj::toNative(args.Holder())->removeEventListener(v8ValueToAtomicWebCoreString(args[0]), listener.get(), args[2]->BooleanValue());
         removeHiddenDependency(args.Holder(), args[1], V8TestObj::eventListenerCacheIndex);
     }
-    return v8::Undefined();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> withScriptStateVoidCallback(const v8::Arguments& args)
@@ -1240,7 +1257,7 @@ static v8::Handle<v8::Value> withScriptStateVoidCallback(const v8::Arguments& ar
     imp->withScriptStateVoid(&state);
     if (state.hadException())
         return throwError(state.exception(), args.GetIsolate());
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> withScriptStateObjCallback(const v8::Arguments& args)
@@ -1266,7 +1283,7 @@ static v8::Handle<v8::Value> withScriptStateVoidExceptionCallback(const v8::Argu
         goto fail;
     if (state.hadException())
         return throwError(state.exception(), args.GetIsolate());
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
     }
     fail:
     return V8Proxy::setDOMException(ec, args.GetIsolate());
@@ -1296,9 +1313,9 @@ static v8::Handle<v8::Value> withScriptExecutionContextCallback(const v8::Argume
     TestObj* imp = V8TestObj::toNative(args.Holder());
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
-        return v8::Undefined();
+        return v8Undefined();
     imp->withScriptExecutionContext(scriptContext);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateCallback(const v8::Arguments& args)
@@ -1308,11 +1325,11 @@ static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateCallback(co
     EmptyScriptState state;
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
-        return v8::Undefined();
+        return v8Undefined();
     imp->withScriptExecutionContextAndScriptState(&state, scriptContext);
     if (state.hadException())
         return throwError(state.exception(), args.GetIsolate());
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateObjExceptionCallback(const v8::Arguments& args)
@@ -1324,7 +1341,7 @@ static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateObjExceptio
     EmptyScriptState state;
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
-        return v8::Undefined();
+        return v8Undefined();
     RefPtr<TestObj> result = imp->withScriptExecutionContextAndScriptStateObjException(&state, scriptContext, ec);
     if (UNLIKELY(ec))
         goto fail;
@@ -1343,7 +1360,7 @@ static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateWithSpacesC
     EmptyScriptState state;
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
-        return v8::Undefined();
+        return v8Undefined();
     RefPtr<TestObj> result = imp->withScriptExecutionContextAndScriptStateWithSpaces(&state, scriptContext);
     if (state.hadException())
         return throwError(state.exception(), args.GetIsolate());
@@ -1357,9 +1374,9 @@ static v8::Handle<v8::Value> withScriptArgumentsAndCallStackCallback(const v8::A
     RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 0));
     RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
     if (!callStack)
-        return v8::Undefined();
+        return v8Undefined();
     imp->withScriptArgumentsAndCallStack(scriptArguments, callStack);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> methodWithOptionalArgCallback(const v8::Arguments& args)
@@ -1368,11 +1385,11 @@ static v8::Handle<v8::Value> methodWithOptionalArgCallback(const v8::Arguments&
     TestObj* imp = V8TestObj::toNative(args.Holder());
     if (args.Length() <= 0) {
         imp->methodWithOptionalArg();
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     EXCEPTION_BLOCK(int, opt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->methodWithOptionalArg(opt);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> methodWithNonOptionalArgAndOptionalArgCallback(const v8::Arguments& args)
@@ -1384,11 +1401,11 @@ static v8::Handle<v8::Value> methodWithNonOptionalArgAndOptionalArgCallback(cons
     EXCEPTION_BLOCK(int, nonOpt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     if (args.Length() <= 1) {
         imp->methodWithNonOptionalArgAndOptionalArg(nonOpt);
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     EXCEPTION_BLOCK(int, opt, toInt32(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)));
     imp->methodWithNonOptionalArgAndOptionalArg(nonOpt, opt);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> methodWithNonOptionalArgAndTwoOptionalArgsCallback(const v8::Arguments& args)
@@ -1400,16 +1417,16 @@ static v8::Handle<v8::Value> methodWithNonOptionalArgAndTwoOptionalArgsCallback(
     EXCEPTION_BLOCK(int, nonOpt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     if (args.Length() <= 1) {
         imp->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt);
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     EXCEPTION_BLOCK(int, opt1, toInt32(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)));
     if (args.Length() <= 2) {
         imp->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1);
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     EXCEPTION_BLOCK(int, opt2, toInt32(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)));
     imp->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1, opt2);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> methodWithOptionalStringCallback(const v8::Arguments& args)
@@ -1418,11 +1435,11 @@ static v8::Handle<v8::Value> methodWithOptionalStringCallback(const v8::Argument
     TestObj* imp = V8TestObj::toNative(args.Holder());
     if (args.Length() <= 0) {
         imp->methodWithOptionalString();
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     imp->methodWithOptionalString(str);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> methodWithOptionalStringIsUndefinedCallback(const v8::Arguments& args)
@@ -1431,7 +1448,7 @@ static v8::Handle<v8::Value> methodWithOptionalStringIsUndefinedCallback(const v
     TestObj* imp = V8TestObj::toNative(args.Holder());
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     imp->methodWithOptionalStringIsUndefined(str);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> methodWithOptionalStringIsNullStringCallback(const v8::Arguments& args)
@@ -1440,7 +1457,7 @@ static v8::Handle<v8::Value> methodWithOptionalStringIsNullStringCallback(const
     TestObj* imp = V8TestObj::toNative(args.Holder());
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsNullString));
     imp->methodWithOptionalStringIsNullString(str);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> methodWithCallbackArgCallback(const v8::Arguments& args)
@@ -1450,10 +1467,10 @@ static v8::Handle<v8::Value> methodWithCallbackArgCallback(const v8::Arguments&
         return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
     TestObj* imp = V8TestObj::toNative(args.Holder());
     if (args.Length() <= 0 || !args[0]->IsFunction())
-        return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+        return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
     RefPtr<TestCallback> callback = V8TestCallback::create(args[0], getScriptExecutionContext());
     imp->methodWithCallbackArg(callback);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> methodWithNonCallbackArgAndCallbackArgCallback(const v8::Arguments& args)
@@ -1464,10 +1481,10 @@ static v8::Handle<v8::Value> methodWithNonCallbackArgAndCallbackArgCallback(cons
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(int, nonCallback, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     if (args.Length() <= 1 || !args[1]->IsFunction())
-        return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+        return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
     RefPtr<TestCallback> callback = V8TestCallback::create(args[1], getScriptExecutionContext());
     imp->methodWithNonCallbackArgAndCallbackArg(nonCallback, callback);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> methodWithCallbackAndOptionalArgCallback(const v8::Arguments& args)
@@ -1477,11 +1494,11 @@ static v8::Handle<v8::Value> methodWithCallbackAndOptionalArgCallback(const v8::
     RefPtr<TestCallback> callback;
     if (args.Length() > 0 && !args[0]->IsNull() && !args[0]->IsUndefined()) {
         if (!args[0]->IsFunction())
-            return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+            return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
         callback = V8TestCallback::create(args[0], getScriptExecutionContext());
     }
     imp->methodWithCallbackAndOptionalArg(callback);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 #if ENABLE(Condition1)
@@ -1502,7 +1519,7 @@ static v8::Handle<v8::Value> conditionalMethod2Callback(const v8::Arguments& arg
     INC_STATS("DOM.TestObj.conditionalMethod2");
     TestObj* imp = V8TestObj::toNative(args.Holder());
     imp->conditionalMethod2();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 #endif // ENABLE(Condition1) && ENABLE(Condition2)
@@ -1514,7 +1531,7 @@ static v8::Handle<v8::Value> conditionalMethod3Callback(const v8::Arguments& arg
     INC_STATS("DOM.TestObj.conditionalMethod3");
     TestObj* imp = V8TestObj::toNative(args.Holder());
     imp->conditionalMethod3();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 #endif // ENABLE(Condition1) || ENABLE(Condition2)
@@ -1528,7 +1545,7 @@ static v8::Handle<v8::Value> overloadedMethod1Callback(const v8::Arguments& args
     EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
     imp->overloadedMethod(objArg, strArg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> overloadedMethod2Callback(const v8::Arguments& args)
@@ -1540,11 +1557,11 @@ static v8::Handle<v8::Value> overloadedMethod2Callback(const v8::Arguments& args
     EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     if (args.Length() <= 1) {
         imp->overloadedMethod(objArg);
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     EXCEPTION_BLOCK(long long, Arg, toInt64(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)));
     imp->overloadedMethod(objArg, Arg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> overloadedMethod3Callback(const v8::Arguments& args)
@@ -1555,7 +1572,7 @@ static v8::Handle<v8::Value> overloadedMethod3Callback(const v8::Arguments& args
     TestObj* imp = V8TestObj::toNative(args.Holder());
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     imp->overloadedMethod(strArg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> overloadedMethod4Callback(const v8::Arguments& args)
@@ -1566,7 +1583,7 @@ static v8::Handle<v8::Value> overloadedMethod4Callback(const v8::Arguments& args
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(long long, Arg, toInt64(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->overloadedMethod(Arg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> overloadedMethod5Callback(const v8::Arguments& args)
@@ -1576,10 +1593,10 @@ static v8::Handle<v8::Value> overloadedMethod5Callback(const v8::Arguments& args
         return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
     TestObj* imp = V8TestObj::toNative(args.Holder());
     if (args.Length() <= 0 || !args[0]->IsFunction())
-        return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+        return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
     RefPtr<TestCallback> callback = V8TestCallback::create(args[0], getScriptExecutionContext());
     imp->overloadedMethod(callback);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> overloadedMethod6Callback(const v8::Arguments& args)
@@ -1590,7 +1607,7 @@ static v8::Handle<v8::Value> overloadedMethod6Callback(const v8::Arguments& args
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(RefPtr<DOMStringList>, listArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->overloadedMethod(listArg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> overloadedMethod7Callback(const v8::Arguments& args)
@@ -1601,7 +1618,7 @@ static v8::Handle<v8::Value> overloadedMethod7Callback(const v8::Arguments& args
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(RefPtr<DOMStringList>, arrayArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->overloadedMethod(arrayArg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> overloadedMethod8Callback(const v8::Arguments& args)
@@ -1612,7 +1629,7 @@ static v8::Handle<v8::Value> overloadedMethod8Callback(const v8::Arguments& args
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->overloadedMethod(objArg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> overloadedMethod9Callback(const v8::Arguments& args)
@@ -1623,7 +1640,7 @@ static v8::Handle<v8::Value> overloadedMethod9Callback(const v8::Arguments& args
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(RefPtr<DOMStringList>, arrayArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->overloadedMethod(arrayArg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> overloadedMethod10Callback(const v8::Arguments& args)
@@ -1634,7 +1651,7 @@ static v8::Handle<v8::Value> overloadedMethod10Callback(const v8::Arguments& arg
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(Vector<unsigned long>, arrayArg, toNativeArray<unsigned long>(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->overloadedMethod(arrayArg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> overloadedMethodCallback(const v8::Arguments& args)
@@ -1667,7 +1684,7 @@ static v8::Handle<v8::Value> classMethodCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.classMethod");
     TestObj::classMethod();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> classMethodWithOptionalCallback(const v8::Arguments& args)
@@ -1689,7 +1706,7 @@ static v8::Handle<v8::Value> overloadedMethod11Callback(const v8::Arguments& arg
         return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
     EXCEPTION_BLOCK(int, arg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     TestObj::overloadedMethod1(arg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 #endif // ENABLE(Condition1)
@@ -1703,7 +1720,7 @@ static v8::Handle<v8::Value> overloadedMethod12Callback(const v8::Arguments& arg
         return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, type, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     TestObj::overloadedMethod1(type);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 #endif // ENABLE(Condition1)
@@ -1728,16 +1745,16 @@ static v8::Handle<v8::Value> classMethodWithClampCallback(const v8::Arguments& a
     if (args.Length() < 2)
         return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    unsigned short objArgsShort = 0
+    unsigned short objArgsShort = 0;
     EXCEPTION_BLOCK(double, objArgsShortNativeValue, args[0]->NumberValue());
     if (!isnan(objArgsShortNativeValue))
         objArgsShort = clampTo<unsigned short>(objArgsShortNativeValue);
-    unsigned long objArgsLong = 0
+    unsigned long objArgsLong = 0;
     EXCEPTION_BLOCK(double, objArgsLongNativeValue, args[1]->NumberValue());
     if (!isnan(objArgsLongNativeValue))
         objArgsLong = clampTo<unsigned long>(objArgsLongNativeValue);
     imp->classMethodWithClamp(objArgsShort, objArgsLong);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> enabledAtRuntimeMethod1Callback(const v8::Arguments& args)
@@ -1748,7 +1765,7 @@ static v8::Handle<v8::Value> enabledAtRuntimeMethod1Callback(const v8::Arguments
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(long long, Arg, toInt64(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->enabledAtRuntimeMethod1(Arg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> enabledAtRuntimeMethod2Callback(const v8::Arguments& args)
@@ -1759,7 +1776,7 @@ static v8::Handle<v8::Value> enabledAtRuntimeMethod2Callback(const v8::Arguments
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(long long, Arg, toInt64(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->enabledAtRuntimeMethod2(Arg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> enabledPerContextMethod1Callback(const v8::Arguments& args)
@@ -1770,7 +1787,7 @@ static v8::Handle<v8::Value> enabledPerContextMethod1Callback(const v8::Argument
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(long long, Arg, toInt64(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->enabledPerContextMethod1(Arg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> enabledPerContextMethod2Callback(const v8::Arguments& args)
@@ -1781,7 +1798,7 @@ static v8::Handle<v8::Value> enabledPerContextMethod2Callback(const v8::Argument
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(long long, Arg, toInt64(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->enabledPerContextMethod2(Arg);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> stringArrayFunctionCallback(const v8::Arguments& args)
@@ -1808,7 +1825,7 @@ static v8::Handle<v8::Value> getSVGDocumentCallback(const v8::Arguments& args)
     TestObj* imp = V8TestObj::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    if (!V8BindingSecurity::shouldAllowAccessToNode(V8BindingState::Only(), imp->getSVGDocument(ec)))
+    if (!BindingSecurity::shouldAllowAccessToNode(BindingState::instance(), imp->getSVGDocument(ec)))
         return v8::Handle<v8::Value>(v8::Null(args.GetIsolate()));
     RefPtr<SVGDocument> result = imp->getSVGDocument(ec);
     if (UNLIKELY(ec))
@@ -1827,7 +1844,7 @@ static v8::Handle<v8::Value> convert1Callback(const v8::Arguments& args)
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(a*, , V8a::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8a::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert1();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> convert2Callback(const v8::Arguments& args)
@@ -1838,7 +1855,7 @@ static v8::Handle<v8::Value> convert2Callback(const v8::Arguments& args)
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(b*, , V8b::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8b::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert2();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> convert3Callback(const v8::Arguments& args)
@@ -1849,7 +1866,7 @@ static v8::Handle<v8::Value> convert3Callback(const v8::Arguments& args)
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(c*, , V8c::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8c::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert3();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> convert4Callback(const v8::Arguments& args)
@@ -1860,7 +1877,7 @@ static v8::Handle<v8::Value> convert4Callback(const v8::Arguments& args)
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(d*, , V8d::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8d::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert4();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> convert5Callback(const v8::Arguments& args)
@@ -1871,7 +1888,7 @@ static v8::Handle<v8::Value> convert5Callback(const v8::Arguments& args)
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(e*, , V8e::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8e::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert5();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> mutablePointFunctionCallback(const v8::Arguments& args)
@@ -1893,7 +1910,7 @@ static v8::Handle<v8::Value> orangeCallback(const v8::Arguments& args)
     INC_STATS("DOM.TestObj.orange");
     TestObj* imp = V8TestObj::toNative(args.Holder());
     imp->banana();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> strictFunctionCallback(const v8::Arguments& args)
@@ -1918,7 +1935,7 @@ static v8::Handle<v8::Value> strictFunctionCallback(const v8::Arguments& args)
 
 } // namespace TestObjV8Internal
 
-static const BatchedAttribute TestObjAttrs[] = {
+static const V8DOMConfiguration::BatchedAttribute TestObjAttrs[] = {
     // Attribute 'readOnlyLongAttr' (Type: 'readonly attribute' ExtAttr: '')
     {"readOnlyLongAttr", TestObjV8Internal::readOnlyLongAttrAttrGetter, 0, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'readOnlyStringAttr' (Type: 'readonly attribute' ExtAttr: '')
@@ -1967,6 +1984,8 @@ static const BatchedAttribute TestObjAttrs[] = {
     {"reflectedCustomBooleanAttr", TestObjV8Internal::reflectedCustomBooleanAttrAttrGetter, TestObjV8Internal::reflectedCustomBooleanAttrAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'reflectedCustomURLAttr' (Type: 'attribute' ExtAttr: 'URL Reflect')
     {"reflectedCustomURLAttr", TestObjV8Internal::reflectedCustomURLAttrAttrGetter, TestObjV8Internal::reflectedCustomURLAttrAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+    // Attribute 'typedArrayAttr' (Type: 'attribute' ExtAttr: '')
+    {"typedArrayAttr", TestObjV8Internal::typedArrayAttrAttrGetter, TestObjV8Internal::typedArrayAttrAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'attrWithGetterException' (Type: 'attribute' ExtAttr: '')
     {"attrWithGetterException", TestObjV8Internal::attrWithGetterExceptionAttrGetter, TestObjV8Internal::attrWithGetterExceptionAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'attrWithSetterException' (Type: 'attribute' ExtAttr: '')
@@ -2045,7 +2064,7 @@ static const BatchedAttribute TestObjAttrs[] = {
     {"replaceableAttribute", TestObjV8Internal::replaceableAttributeAttrGetter, TestObjV8Internal::TestObjReplaceableAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
 };
 
-static const BatchedCallback TestObjCallbacks[] = {
+static const V8DOMConfiguration::BatchedCallback TestObjCallbacks[] = {
     {"voidMethod", TestObjV8Internal::voidMethodCallback},
     {"Method", TestObjV8Internal::MethodCallback},
     {"objMethod", TestObjV8Internal::objMethodCallback},
@@ -2095,7 +2114,7 @@ static const BatchedCallback TestObjCallbacks[] = {
     {"strictFunction", TestObjV8Internal::strictFunctionCallback},
 };
 
-static const BatchedConstant TestObjConsts[] = {
+static const V8DOMConfiguration::BatchedConstant TestObjConsts[] = {
 #if ENABLE(Condition1)
     {"CONDITIONAL_CONST", static_cast<signed int>(0)},
 #endif
@@ -2142,15 +2161,15 @@ v8::Handle<v8::Value> V8TestObj::constructorCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
     if (args.Length() <= 0 || !args[0]->IsFunction())
-        return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+        return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
     RefPtr<TestCallback> testCallback = V8TestCallback::create(args[0], getScriptExecutionContext());
 
     RefPtr<TestObj> impl = TestObj::create(testCallback);
     v8::Handle<v8::Object> wrapper = args.Holder();
 
     V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
-    V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), v8::Persistent<v8::Object>::New(wrapper), args.GetIsolate());
-    return args.Holder();
+    V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), wrapper, args.GetIsolate());
+    return wrapper;
 }
 
 static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestObjTemplate(v8::Persistent<v8::FunctionTemplate> desc)
@@ -2158,7 +2177,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestObjTemplate(v8::Persi
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestObject", v8::Persistent<v8::FunctionTemplate>(), V8TestObj::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "TestObject", v8::Persistent<v8::FunctionTemplate>(), V8TestObj::internalFieldCount,
         TestObjAttrs, WTF_ARRAY_LENGTH(TestObjAttrs),
         TestObjCallbacks, WTF_ARRAY_LENGTH(TestObjCallbacks));
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -2169,88 +2188,88 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestObjTemplate(v8::Persi
     UNUSED_PARAM(proto); // In some cases, it will not be used.
     
     if (RuntimeEnabledFeatures::enabledAtRuntimeAttr1Enabled()) {
-        static const BatchedAttribute attrData =\
+        static const V8DOMConfiguration::BatchedAttribute attrData =\
         // Attribute 'enabledAtRuntimeAttr1' (Type: 'attribute' ExtAttr: 'V8EnabledAtRuntime')
         {"enabledAtRuntimeAttr1", TestObjV8Internal::enabledAtRuntimeAttr1AttrGetter, TestObjV8Internal::enabledAtRuntimeAttr1AttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */};
-        configureAttribute(instance, proto, attrData);
+        V8DOMConfiguration::configureAttribute(instance, proto, attrData);
     }
     if (RuntimeEnabledFeatures::featureNameEnabled()) {
-        static const BatchedAttribute attrData =\
+        static const V8DOMConfiguration::BatchedAttribute attrData =\
         // Attribute 'enabledAtRuntimeAttr2' (Type: 'attribute' ExtAttr: 'V8EnabledAtRuntime')
         {"enabledAtRuntimeAttr2", TestObjV8Internal::enabledAtRuntimeAttr2AttrGetter, TestObjV8Internal::enabledAtRuntimeAttr2AttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */};
-        configureAttribute(instance, proto, attrData);
+        V8DOMConfiguration::configureAttribute(instance, proto, attrData);
     }
 
     // Custom Signature 'voidMethodWithArgs'
     const int voidMethodWithArgsArgc = 3;
     v8::Handle<v8::FunctionTemplate> voidMethodWithArgsArgv[voidMethodWithArgsArgc] = { v8::Handle<v8::FunctionTemplate>(), v8::Handle<v8::FunctionTemplate>(), V8TestObj::GetRawTemplate() };
     v8::Handle<v8::Signature> voidMethodWithArgsSignature = v8::Signature::New(desc, voidMethodWithArgsArgc, voidMethodWithArgsArgv);
-    proto->Set(v8::String::New("voidMethodWithArgs"), v8::FunctionTemplate::New(TestObjV8Internal::voidMethodWithArgsCallback, v8::Handle<v8::Value>(), voidMethodWithArgsSignature));
+    proto->Set(v8::String::New("voidMethodWithArgs"), v8::FunctionTemplate::New(TestObjV8Internal::voidMethodWithArgsCallback, v8Undefined(), voidMethodWithArgsSignature));
 
     // Custom Signature 'MethodWithArgs'
     const int MethodWithArgsArgc = 3;
     v8::Handle<v8::FunctionTemplate> MethodWithArgsArgv[MethodWithArgsArgc] = { v8::Handle<v8::FunctionTemplate>(), v8::Handle<v8::FunctionTemplate>(), V8TestObj::GetRawTemplate() };
     v8::Handle<v8::Signature> MethodWithArgsSignature = v8::Signature::New(desc, MethodWithArgsArgc, MethodWithArgsArgv);
-    proto->Set(v8::String::New("MethodWithArgs"), v8::FunctionTemplate::New(TestObjV8Internal::MethodWithArgsCallback, v8::Handle<v8::Value>(), MethodWithArgsSignature));
+    proto->Set(v8::String::New("MethodWithArgs"), v8::FunctionTemplate::New(TestObjV8Internal::MethodWithArgsCallback, v8Undefined(), MethodWithArgsSignature));
 
     // Custom Signature 'objMethodWithArgs'
     const int objMethodWithArgsArgc = 3;
     v8::Handle<v8::FunctionTemplate> objMethodWithArgsArgv[objMethodWithArgsArgc] = { v8::Handle<v8::FunctionTemplate>(), v8::Handle<v8::FunctionTemplate>(), V8TestObj::GetRawTemplate() };
     v8::Handle<v8::Signature> objMethodWithArgsSignature = v8::Signature::New(desc, objMethodWithArgsArgc, objMethodWithArgsArgv);
-    proto->Set(v8::String::New("objMethodWithArgs"), v8::FunctionTemplate::New(TestObjV8Internal::objMethodWithArgsCallback, v8::Handle<v8::Value>(), objMethodWithArgsSignature));
+    proto->Set(v8::String::New("objMethodWithArgs"), v8::FunctionTemplate::New(TestObjV8Internal::objMethodWithArgsCallback, v8Undefined(), objMethodWithArgsSignature));
 
     // Custom Signature 'methodWithSequenceArg'
     const int methodWithSequenceArgArgc = 1;
     v8::Handle<v8::FunctionTemplate> methodWithSequenceArgArgv[methodWithSequenceArgArgc] = { V8sequence<ScriptProfile>::GetRawTemplate() };
     v8::Handle<v8::Signature> methodWithSequenceArgSignature = v8::Signature::New(desc, methodWithSequenceArgArgc, methodWithSequenceArgArgv);
-    proto->Set(v8::String::New("methodWithSequenceArg"), v8::FunctionTemplate::New(TestObjV8Internal::methodWithSequenceArgCallback, v8::Handle<v8::Value>(), methodWithSequenceArgSignature));
+    proto->Set(v8::String::New("methodWithSequenceArg"), v8::FunctionTemplate::New(TestObjV8Internal::methodWithSequenceArgCallback, v8Undefined(), methodWithSequenceArgSignature));
 
     // Custom Signature 'methodThatRequiresAllArgsAndThrows'
     const int methodThatRequiresAllArgsAndThrowsArgc = 2;
     v8::Handle<v8::FunctionTemplate> methodThatRequiresAllArgsAndThrowsArgv[methodThatRequiresAllArgsAndThrowsArgc] = { v8::Handle<v8::FunctionTemplate>(), V8TestObj::GetRawTemplate() };
     v8::Handle<v8::Signature> methodThatRequiresAllArgsAndThrowsSignature = v8::Signature::New(desc, methodThatRequiresAllArgsAndThrowsArgc, methodThatRequiresAllArgsAndThrowsArgv);
-    proto->Set(v8::String::New("methodThatRequiresAllArgsAndThrows"), v8::FunctionTemplate::New(TestObjV8Internal::methodThatRequiresAllArgsAndThrowsCallback, v8::Handle<v8::Value>(), methodThatRequiresAllArgsAndThrowsSignature));
-    desc->Set(v8::String::New("classMethod"), v8::FunctionTemplate::New(TestObjV8Internal::classMethodCallback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
-    desc->Set(v8::String::New("classMethodWithOptional"), v8::FunctionTemplate::New(TestObjV8Internal::classMethodWithOptionalCallback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
-    desc->Set(v8::String::New("classMethod2"), v8::FunctionTemplate::New(V8TestObj::classMethod2Callback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
+    proto->Set(v8::String::New("methodThatRequiresAllArgsAndThrows"), v8::FunctionTemplate::New(TestObjV8Internal::methodThatRequiresAllArgsAndThrowsCallback, v8Undefined(), methodThatRequiresAllArgsAndThrowsSignature));
+    desc->Set(v8::String::New("classMethod"), v8::FunctionTemplate::New(TestObjV8Internal::classMethodCallback, v8Undefined(), v8::Local<v8::Signature>()));
+    desc->Set(v8::String::New("classMethodWithOptional"), v8::FunctionTemplate::New(TestObjV8Internal::classMethodWithOptionalCallback, v8Undefined(), v8::Local<v8::Signature>()));
+    desc->Set(v8::String::New("classMethod2"), v8::FunctionTemplate::New(V8TestObj::classMethod2Callback, v8Undefined(), v8::Local<v8::Signature>()));
 #if ENABLE(Condition1)
-    desc->Set(v8::String::New("overloadedMethod1"), v8::FunctionTemplate::New(TestObjV8Internal::overloadedMethod1Callback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
+    desc->Set(v8::String::New("overloadedMethod1"), v8::FunctionTemplate::New(TestObjV8Internal::overloadedMethod1Callback, v8Undefined(), v8::Local<v8::Signature>()));
 #endif // ENABLE(Condition1)
     if (RuntimeEnabledFeatures::enabledAtRuntimeMethod1Enabled())
-        proto->Set(v8::String::New("enabledAtRuntimeMethod1"), v8::FunctionTemplate::New(TestObjV8Internal::enabledAtRuntimeMethod1Callback, v8::Handle<v8::Value>(), defaultSignature));
+        proto->Set(v8::String::New("enabledAtRuntimeMethod1"), v8::FunctionTemplate::New(TestObjV8Internal::enabledAtRuntimeMethod1Callback, v8Undefined(), defaultSignature));
     if (RuntimeEnabledFeatures::featureNameEnabled())
-        proto->Set(v8::String::New("enabledAtRuntimeMethod2"), v8::FunctionTemplate::New(TestObjV8Internal::enabledAtRuntimeMethod2Callback, v8::Handle<v8::Value>(), defaultSignature));
+        proto->Set(v8::String::New("enabledAtRuntimeMethod2"), v8::FunctionTemplate::New(TestObjV8Internal::enabledAtRuntimeMethod2Callback, v8Undefined(), defaultSignature));
 
     // Custom Signature 'convert1'
     const int convert1Argc = 1;
     v8::Handle<v8::FunctionTemplate> convert1Argv[convert1Argc] = { V8a::GetRawTemplate() };
     v8::Handle<v8::Signature> convert1Signature = v8::Signature::New(desc, convert1Argc, convert1Argv);
-    proto->Set(v8::String::New("convert1"), v8::FunctionTemplate::New(TestObjV8Internal::convert1Callback, v8::Handle<v8::Value>(), convert1Signature));
+    proto->Set(v8::String::New("convert1"), v8::FunctionTemplate::New(TestObjV8Internal::convert1Callback, v8Undefined(), convert1Signature));
 
     // Custom Signature 'convert2'
     const int convert2Argc = 1;
     v8::Handle<v8::FunctionTemplate> convert2Argv[convert2Argc] = { V8b::GetRawTemplate() };
     v8::Handle<v8::Signature> convert2Signature = v8::Signature::New(desc, convert2Argc, convert2Argv);
-    proto->Set(v8::String::New("convert2"), v8::FunctionTemplate::New(TestObjV8Internal::convert2Callback, v8::Handle<v8::Value>(), convert2Signature));
+    proto->Set(v8::String::New("convert2"), v8::FunctionTemplate::New(TestObjV8Internal::convert2Callback, v8Undefined(), convert2Signature));
 
     // Custom Signature 'convert3'
     const int convert3Argc = 1;
     v8::Handle<v8::FunctionTemplate> convert3Argv[convert3Argc] = { V8c::GetRawTemplate() };
     v8::Handle<v8::Signature> convert3Signature = v8::Signature::New(desc, convert3Argc, convert3Argv);
-    proto->Set(v8::String::New("convert3"), v8::FunctionTemplate::New(TestObjV8Internal::convert3Callback, v8::Handle<v8::Value>(), convert3Signature));
+    proto->Set(v8::String::New("convert3"), v8::FunctionTemplate::New(TestObjV8Internal::convert3Callback, v8Undefined(), convert3Signature));
 
     // Custom Signature 'convert4'
     const int convert4Argc = 1;
     v8::Handle<v8::FunctionTemplate> convert4Argv[convert4Argc] = { V8d::GetRawTemplate() };
     v8::Handle<v8::Signature> convert4Signature = v8::Signature::New(desc, convert4Argc, convert4Argv);
-    proto->Set(v8::String::New("convert4"), v8::FunctionTemplate::New(TestObjV8Internal::convert4Callback, v8::Handle<v8::Value>(), convert4Signature));
+    proto->Set(v8::String::New("convert4"), v8::FunctionTemplate::New(TestObjV8Internal::convert4Callback, v8Undefined(), convert4Signature));
 
     // Custom Signature 'convert5'
     const int convert5Argc = 1;
     v8::Handle<v8::FunctionTemplate> convert5Argv[convert5Argc] = { V8e::GetRawTemplate() };
     v8::Handle<v8::Signature> convert5Signature = v8::Signature::New(desc, convert5Argc, convert5Argv);
-    proto->Set(v8::String::New("convert5"), v8::FunctionTemplate::New(TestObjV8Internal::convert5Callback, v8::Handle<v8::Value>(), convert5Signature));
-    batchConfigureConstants(desc, proto, TestObjConsts, WTF_ARRAY_LENGTH(TestObjConsts));
+    proto->Set(v8::String::New("convert5"), v8::FunctionTemplate::New(TestObjV8Internal::convert5Callback, v8Undefined(), convert5Signature));
+    V8DOMConfiguration::batchConfigureConstants(desc, proto, TestObjConsts, WTF_ARRAY_LENGTH(TestObjConsts));
 
     // Custom toString template
     desc->Set(getToStringName(), getToStringTemplate());
@@ -2259,8 +2278,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestObjTemplate(v8::Persi
 
 v8::Persistent<v8::FunctionTemplate> V8TestObj::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -2272,8 +2291,8 @@ v8::Persistent<v8::FunctionTemplate> V8TestObj::GetRawTemplate()
 
 v8::Persistent<v8::FunctionTemplate> V8TestObj::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -2295,24 +2314,24 @@ void V8TestObj::installPerContextProperties(v8::Handle<v8::Object> instance, Tes
     // When building QtWebkit with V8 this variable is unused when none of the features are enabled.
     UNUSED_PARAM(proto);
     if (ContextFeatures::enabledPerContextAttr1Enabled(impl->document())) {
-        static const BatchedAttribute attrData =\
+        static const V8DOMConfiguration::BatchedAttribute attrData =\
         // Attribute 'enabledPerContextAttr1' (Type: 'attribute' ExtAttr: 'V8EnabledPerContext')
         {"enabledPerContextAttr1", TestObjV8Internal::enabledPerContextAttr1AttrGetter, TestObjV8Internal::enabledPerContextAttr1AttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */};
-        configureAttribute(instance, proto, attrData);
+        V8DOMConfiguration::configureAttribute(instance, proto, attrData);
     }
     if (ContextFeatures::featureNameEnabled(impl->document())) {
-        static const BatchedAttribute attrData =\
+        static const V8DOMConfiguration::BatchedAttribute attrData =\
         // Attribute 'enabledPerContextAttr2' (Type: 'attribute' ExtAttr: 'V8EnabledPerContext')
         {"enabledPerContextAttr2", TestObjV8Internal::enabledPerContextAttr2AttrGetter, TestObjV8Internal::enabledPerContextAttr2AttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */};
-        configureAttribute(instance, proto, attrData);
+        V8DOMConfiguration::configureAttribute(instance, proto, attrData);
     }
     v8::Local<v8::Signature> defaultSignature = v8::Signature::New(GetTemplate());
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
     if (ContextFeatures::enabledPerContextMethod1Enabled(impl->document())) {
-        proto->Set(v8::String::New("enabledPerContextMethod1"), v8::FunctionTemplate::New(TestObjV8Internal::enabledPerContextMethod1Callback, v8::Handle<v8::Value>(), defaultSignature)->GetFunction());
+        proto->Set(v8::String::New("enabledPerContextMethod1"), v8::FunctionTemplate::New(TestObjV8Internal::enabledPerContextMethod1Callback, v8Undefined(), defaultSignature)->GetFunction());
     }
     if (ContextFeatures::featureNameEnabled(impl->document())) {
-        proto->Set(v8::String::New("enabledPerContextMethod2"), v8::FunctionTemplate::New(TestObjV8Internal::enabledPerContextMethod2Callback, v8::Handle<v8::Value>(), defaultSignature)->GetFunction());
+        proto->Set(v8::String::New("enabledPerContextMethod2"), v8::FunctionTemplate::New(TestObjV8Internal::enabledPerContextMethod2Callback, v8Undefined(), defaultSignature)->GetFunction());
     }
 }
 
@@ -2324,12 +2343,9 @@ v8::Handle<v8::Object> V8TestObj::wrapSlow(PassRefPtr<TestObj> impl, v8::Isolate
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
     installPerContextProperties(wrapper, impl.get());
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index 3b0f2f67d..a61c8aeca 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -23,14 +23,13 @@
 
 #if ENABLE(Condition1) || ENABLE(Condition2)
 
+#include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
 #include "MessagePort.h"
 #include "RuntimeEnabledFeatures.h"
 #include "SerializedScriptValue.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
 #include "V8MessagePort.h"
@@ -130,19 +129,19 @@ static v8::Handle<v8::Value> acceptTransferListCallback(const v8::Arguments& arg
     MessagePortArray messagePortArrayTransferList;
     ArrayBufferArray arrayBufferArrayTransferList;
     if (args.Length() > 1) {
-        if (!extractTransferables(args[1], messagePortArrayTransferList, arrayBufferArrayTransferList))
+        if (!extractTransferables(args[1], messagePortArrayTransferList, arrayBufferArrayTransferList, args.GetIsolate()))
             return V8Proxy::throwTypeError("Could not extract transferables");
     }
     bool dataDidThrow = false;
     RefPtr<SerializedScriptValue> data = SerializedScriptValue::create(args[0], &messagePortArrayTransferList, &arrayBufferArrayTransferList, dataDidThrow, args.GetIsolate());
     if (dataDidThrow)
-        return v8::Undefined();
+        return v8Undefined();
     if (args.Length() <= 1) {
         imp->acceptTransferList(data);
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     imp->acceptTransferList(data, messagePortArrayTransferList);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 static v8::Handle<v8::Value> multiTransferListCallback(const v8::Arguments& args)
@@ -151,47 +150,47 @@ static v8::Handle<v8::Value> multiTransferListCallback(const v8::Arguments& args
     TestSerializedScriptValueInterface* imp = V8TestSerializedScriptValueInterface::toNative(args.Holder());
     if (args.Length() <= 0) {
         imp->multiTransferList();
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     MessagePortArray messagePortArrayTx;
     ArrayBufferArray arrayBufferArrayTx;
     if (args.Length() > 1) {
-        if (!extractTransferables(args[1], messagePortArrayTx, arrayBufferArrayTx))
+        if (!extractTransferables(args[1], messagePortArrayTx, arrayBufferArrayTx, args.GetIsolate()))
             return V8Proxy::throwTypeError("Could not extract transferables");
     }
     bool firstDidThrow = false;
     RefPtr<SerializedScriptValue> first = SerializedScriptValue::create(args[0], &messagePortArrayTx, &arrayBufferArrayTx, firstDidThrow, args.GetIsolate());
     if (firstDidThrow)
-        return v8::Undefined();
+        return v8Undefined();
     if (args.Length() <= 1) {
         imp->multiTransferList(first);
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     if (args.Length() <= 2) {
         imp->multiTransferList(first, messagePortArrayTx);
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     MessagePortArray messagePortArrayTxx;
     ArrayBufferArray arrayBufferArrayTxx;
     if (args.Length() > 3) {
-        if (!extractTransferables(args[3], messagePortArrayTxx, arrayBufferArrayTxx))
+        if (!extractTransferables(args[3], messagePortArrayTxx, arrayBufferArrayTxx, args.GetIsolate()))
             return V8Proxy::throwTypeError("Could not extract transferables");
     }
     bool secondDidThrow = false;
     RefPtr<SerializedScriptValue> second = SerializedScriptValue::create(args[2], &messagePortArrayTxx, &arrayBufferArrayTxx, secondDidThrow, args.GetIsolate());
     if (secondDidThrow)
-        return v8::Undefined();
+        return v8Undefined();
     if (args.Length() <= 3) {
         imp->multiTransferList(first, messagePortArrayTx, second);
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     imp->multiTransferList(first, messagePortArrayTx, second, messagePortArrayTxx);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 } // namespace TestSerializedScriptValueInterfaceV8Internal
 
-static const BatchedAttribute TestSerializedScriptValueInterfaceAttrs[] = {
+static const V8DOMConfiguration::BatchedAttribute TestSerializedScriptValueInterfaceAttrs[] = {
     // Attribute 'value' (Type: 'attribute' ExtAttr: '')
     {"value", TestSerializedScriptValueInterfaceV8Internal::valueAttrGetter, TestSerializedScriptValueInterfaceV8Internal::valueAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'readonlyValue' (Type: 'readonly attribute' ExtAttr: '')
@@ -204,7 +203,7 @@ static const BatchedAttribute TestSerializedScriptValueInterfaceAttrs[] = {
     {"cachedReadonlyValue", TestSerializedScriptValueInterfaceV8Internal::cachedReadonlyValueAttrGetter, 0, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
 };
 
-static const BatchedCallback TestSerializedScriptValueInterfaceCallbacks[] = {
+static const V8DOMConfiguration::BatchedCallback TestSerializedScriptValueInterfaceCallbacks[] = {
     {"acceptTransferList", TestSerializedScriptValueInterfaceV8Internal::acceptTransferListCallback},
     {"multiTransferList", TestSerializedScriptValueInterfaceV8Internal::multiTransferListCallback},
 };
@@ -224,20 +223,20 @@ v8::Handle<v8::Value> V8TestSerializedScriptValueInterface::constructorCallback(
     MessagePortArray messagePortArrayTransferList;
     ArrayBufferArray arrayBufferArrayTransferList;
     if (args.Length() > 2) {
-        if (!extractTransferables(args[2], messagePortArrayTransferList, arrayBufferArrayTransferList))
+        if (!extractTransferables(args[2], messagePortArrayTransferList, arrayBufferArrayTransferList, args.GetIsolate()))
             return V8Proxy::throwTypeError("Could not extract transferables");
     }
     bool dataDidThrow = false;
     RefPtr<SerializedScriptValue> data = SerializedScriptValue::create(args[1], &messagePortArrayTransferList, &arrayBufferArrayTransferList, dataDidThrow, args.GetIsolate());
     if (dataDidThrow)
-        return v8::Undefined();
+        return v8Undefined();
 
     RefPtr<TestSerializedScriptValueInterface> impl = TestSerializedScriptValueInterface::create(hello, data, messagePortArrayTransferList);
     v8::Handle<v8::Object> wrapper = args.Holder();
 
     V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
-    V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), v8::Persistent<v8::Object>::New(wrapper), args.GetIsolate());
-    return args.Holder();
+    V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), wrapper, args.GetIsolate());
+    return wrapper;
 }
 
 static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestSerializedScriptValueInterfaceTemplate(v8::Persistent<v8::FunctionTemplate> desc)
@@ -245,7 +244,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestSerializedScriptValue
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestSerializedScriptValueInterface", v8::Persistent<v8::FunctionTemplate>(), V8TestSerializedScriptValueInterface::internalFieldCount,
+    defaultSignature = V8DOMConfiguration::configureTemplate(desc, "TestSerializedScriptValueInterface", v8::Persistent<v8::FunctionTemplate>(), V8TestSerializedScriptValueInterface::internalFieldCount,
         TestSerializedScriptValueInterfaceAttrs, WTF_ARRAY_LENGTH(TestSerializedScriptValueInterfaceAttrs),
         TestSerializedScriptValueInterfaceCallbacks, WTF_ARRAY_LENGTH(TestSerializedScriptValueInterfaceCallbacks));
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -263,8 +262,8 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestSerializedScriptValue
 
 v8::Persistent<v8::FunctionTemplate> V8TestSerializedScriptValueInterface::GetRawTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->rawTemplateMap().find(&info);
     if (result != data->rawTemplateMap().end())
         return result->second;
 
@@ -276,8 +275,8 @@ v8::Persistent<v8::FunctionTemplate> V8TestSerializedScriptValueInterface::GetRa
 
 v8::Persistent<v8::FunctionTemplate> V8TestSerializedScriptValueInterface::GetTemplate()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    V8BindingPerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    V8PerIsolateData::TemplateMap::iterator result = data->templateMap().find(&info);
     if (result != data->templateMap().end())
         return result->second;
 
@@ -301,12 +300,9 @@ v8::Handle<v8::Object> V8TestSerializedScriptValueInterface::wrapSlow(PassRefPtr
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
-
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapperHandle, isolate);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/v8/ArrayValue.cpp b/Source/WebCore/bindings/v8/ArrayValue.cpp
new file mode 100644
index 000000000..540f5e1ae
--- /dev/null
+++ b/Source/WebCore/bindings/v8/ArrayValue.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ArrayValue.h"
+
+#include "Dictionary.h"
+#include "V8Binding.h"
+
+namespace WebCore {
+
+ArrayValue& ArrayValue::operator=(const ArrayValue& other)
+{
+    m_array = other.m_array;
+    m_isolate = other.m_isolate;
+    return *this;
+}
+
+bool ArrayValue::isUndefinedOrNull() const
+{
+    return m_array.IsEmpty() || WebCore::isUndefinedOrNull(m_array);
+}
+
+bool ArrayValue::length(size_t& length) const
+{
+    if (isUndefinedOrNull())
+        return false;
+
+    length = m_array->Length();
+    return true;
+}
+
+bool ArrayValue::get(size_t index, Dictionary& value) const
+{
+    if (isUndefinedOrNull())
+        return false;
+
+    if (index >= m_array->Length())
+        return false;
+
+    v8::Local<v8::Value> indexedValue = m_array->Get(v8UnsignedInteger(index));
+    if (indexedValue.IsEmpty() || !indexedValue->IsObject())
+        return false;
+
+    ASSERT(m_isolate);
+    ASSERT(m_isolate == v8::Isolate::GetCurrent());
+    value = Dictionary(indexedValue, m_isolate);
+    return true;
+}
+
+} // namespace WebCore
diff --git a/Source/Platform/chromium/public/WebCompositorSolidColorQuad.h b/Source/WebCore/bindings/v8/ArrayValue.h
index f31210e35..dc9cf6977 100644
--- a/Source/Platform/chromium/public/WebCompositorSolidColorQuad.h
+++ b/Source/WebCore/bindings/v8/ArrayValue.h
@@ -23,38 +23,43 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCompositorSolidColorQuad_h
-#define WebCompositorSolidColorQuad_h
+#ifndef ArrayValue_h
+#define ArrayValue_h
 
-#include "SkColor.h"
-#include "WebCompositorQuad.h"
-#if WEBKIT_IMPLEMENTATION
-#include <wtf/PassOwnPtr.h>
-#endif
+#include <v8.h>
 
-namespace WebKit {
+namespace WebCore {
 
-#pragma pack(push, 4)
+class Dictionary;
 
-class WebCompositorSolidColorQuad : public WebCompositorQuad {
+class ArrayValue {
 public:
-#if WEBKIT_IMPLEMENTATION
-    static PassOwnPtr<WebCompositorSolidColorQuad> create(const WebCompositorSharedQuadState*, const WebCore::IntRect&, SkColor);
-#endif
+    ArrayValue() : m_isolate(0) { }
+    explicit ArrayValue(const v8::Local<v8::Array>& array, v8::Isolate* isolate)
+        : m_array(array)
+        , m_isolate(isolate)
+    {
+        ASSERT(m_isolate);
+    }
+    ~ArrayValue() { }
 
-    SkColor color() const { return m_color; };
+    ArrayValue& operator=(const ArrayValue&);
+
+    bool isUndefinedOrNull() const;
+
+    bool length(size_t&) const;
+    bool get(size_t index, Dictionary&) const;
 
-    static const WebCompositorSolidColorQuad* materialCast(const WebCompositorQuad*);
 private:
-#if WEBKIT_IMPLEMENTATION
-    WebCompositorSolidColorQuad(const WebCompositorSharedQuadState*, const WebCore::IntRect&, SkColor);
-#endif
+    // This object can only be used safely when stack allocated because of v8::Local.
+    static void* operator new(size_t);
+    static void* operator new[](size_t);
+    static void operator delete(void *);
 
-    SkColor m_color;
+    v8::Local<v8::Array> m_array;
+    v8::Isolate* m_isolate;
 };
 
-#pragma pack(pop)
-
 }
 
-#endif
+#endif // ArrayValue_h
diff --git a/Source/WebCore/bindings/v8/specialization/V8BindingState.cpp b/Source/WebCore/bindings/v8/BindingState.cpp
index 6152f492c..8809e4d4f 100644
--- a/Source/WebCore/bindings/v8/specialization/V8BindingState.cpp
+++ b/Source/WebCore/bindings/v8/BindingState.cpp
@@ -29,7 +29,7 @@
  */
 
 #include "config.h"
-#include "V8BindingState.h"
+#include "BindingState.h"
 
 #include "Frame.h"
 #include "ScriptController.h"
@@ -38,50 +38,60 @@
 
 namespace WebCore {
 
-State<V8Binding>* State<V8Binding>::Only()
+BindingState* BindingState::instance()
 {
-    DEFINE_STATIC_LOCAL(State, globalV8BindingState, ());
-    return &globalV8BindingState;
+    DEFINE_STATIC_LOCAL(BindingState, bindingStateForV8, ());
+    return &bindingStateForV8;
 }
 
-DOMWindow* State<V8Binding>::activeWindow()
+static v8::Handle<v8::Context> activeContext()
 {
-    v8::Local<v8::Context> activeContext = v8::Context::GetCalling();
-    if (activeContext.IsEmpty()) {
-        // There is a single activation record on the stack, so that must
-        // be the activeContext.
-        activeContext = v8::Context::GetCurrent();
-    }
-    return V8Proxy::retrieveWindow(activeContext);
+    v8::Handle<v8::Context> context = v8::Context::GetCalling();
+    if (!context.IsEmpty())
+        return context;
+    // Unfortunately, when processing script from a plug-in, we might not
+    // have a calling context. In those cases, we fall back to the
+    // entered context.
+    return v8::Context::GetEntered();
 }
 
-DOMWindow* State<V8Binding>::firstWindow()
+DOMWindow* activeDOMWindow(BindingState*)
+{
+    return V8Proxy::retrieveWindow(activeContext());
+}
+
+DOMWindow* firstDOMWindow(BindingState*)
 {
     return V8Proxy::retrieveWindow(v8::Context::GetEntered());
 }
 
-Frame* State<V8Binding>::activeFrame()
+Frame* activeFrame(BindingState*)
 {
-    Frame* frame = V8Proxy::retrieveFrameForCallingContext();
-    if (!frame) {
-        // Unfortunately, when processing script from a plug-in, we might not
-        // have a calling context.  In those cases, we fall back to the
-        // entered context for security checks.
-        // FIXME: We need a better API for retrieving frames that abstracts
-        //        away this concern.
-        frame = V8Proxy::retrieveFrameForEnteredContext();
-    }
-    return frame;
+    v8::Handle<v8::Context> context = activeContext();
+    if (context.IsEmpty())
+        return 0;
+    return V8Proxy::retrieveFrame(context);
 }
 
-Frame* State<V8Binding>::firstFrame()
+Frame* firstFrame(BindingState*)
 {
-    return V8Proxy::retrieveFrameForEnteredContext();
+    v8::Handle<v8::Context> context = v8::Context::GetEntered();
+    if (context.IsEmpty())
+        return 0;
+    return V8Proxy::retrieveFrame(context);
 }
 
-void State<V8Binding>::immediatelyReportUnsafeAccessTo(Frame* target)
+Frame* currentFrame(BindingState*)
 {
-    V8Proxy::reportUnsafeAccessTo(target);
+    v8::Handle<v8::Context> context = v8::Context::GetCurrent();
+    if (context.IsEmpty())
+        return 0;
+    return V8Proxy::retrieveFrame(context);
 }
 
-} // namespace WebCore
+void immediatelyReportUnsafeAccessTo(BindingState*, Document* targetDocument)
+{
+    V8Proxy::reportUnsafeAccessTo(targetDocument);
+}
+
+}
diff --git a/Source/WebCore/bindings/v8/specialization/V8BindingState.h b/Source/WebCore/bindings/v8/BindingState.h
index 3cda15f49..d354be263 100644
--- a/Source/WebCore/bindings/v8/specialization/V8BindingState.h
+++ b/Source/WebCore/bindings/v8/BindingState.h
@@ -28,40 +28,34 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8BindingState_h
-#define V8BindingState_h
-
-#include "GenericBinding.h"
-#include "V8Binding.h"
+#ifndef BindingState_h
+#define BindingState_h
 
 namespace WebCore {
 
+class DOMWindow;
+class Document;
 class Frame;
 
-// Singleton implementation of State<V8Binding>.  Uses V8's global data
-// structures to return information about relevant execution state.
-template <>
-class State<V8Binding> : public State<GenericBinding> {
+class BindingState {
 public:
-    // Singleton
-    static State* Only();
-
-    // Reports an error message (without delay) if the security check fails.
-    static void immediatelyReportUnsafeAccessTo(Frame*);
+    // Currently, V8 uses a singleton for it's state.
+    // FIXME: Should we use v8::Isolate as the BindingState?
+    static BindingState* instance();
+};
 
-    DOMWindow* activeWindow();
-    DOMWindow* firstWindow();
+DOMWindow* activeDOMWindow(BindingState*);
+DOMWindow* firstDOMWindow(BindingState*);
 
-    Frame* activeFrame();
-    Frame* firstFrame();
+Frame* activeFrame(BindingState*);
+Frame* firstFrame(BindingState*);
 
-private:
-    explicit State() {}
-    ~State();
-};
+// FIXME: When implementing this function for JSC, we need to understand if there
+// are any subtle differences between the currentFrame and the lexicalGlobalObject.
+Frame* currentFrame(BindingState*);
 
-typedef State<V8Binding> V8BindingState;
+void immediatelyReportUnsafeAccessTo(BindingState*, Document* targetDocument);
 
 }
 
-#endif // V8BindingState_h
+#endif
diff --git a/Source/WebCore/bindings/v8/DOMData.cpp b/Source/WebCore/bindings/v8/DOMData.cpp
index 9c84b5386..1a63c2f2b 100644
--- a/Source/WebCore/bindings/v8/DOMData.cpp
+++ b/Source/WebCore/bindings/v8/DOMData.cpp
@@ -40,7 +40,7 @@ namespace WebCore {
 DOMDataStore& DOMData::getCurrentStore(v8::Isolate* isolate)
 {
     DEFINE_STATIC_LOCAL(StaticDOMDataStore, defaultStore, ());
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current(isolate);
+    V8PerIsolateData* data = V8PerIsolateData::current(isolate);
     if (UNLIKELY(data->domDataStore() != 0))
         return *data->domDataStore();
     V8IsolatedContext* context = V8IsolatedContext::getEntered();
diff --git a/Source/WebCore/bindings/v8/DOMDataStore.cpp b/Source/WebCore/bindings/v8/DOMDataStore.cpp
index 7fb8b042d..227619e78 100644
--- a/Source/WebCore/bindings/v8/DOMDataStore.cpp
+++ b/Source/WebCore/bindings/v8/DOMDataStore.cpp
@@ -99,7 +99,7 @@ DOMDataStore::~DOMDataStore()
 
 DOMDataList& DOMDataStore::allStores()
 {
-    return V8BindingPerIsolateData::current()->allStores();
+    return V8PerIsolateData::current()->allStores();
 }
 
 void* DOMDataStore::getDOMWrapperMap(DOMWrapperMapType type)
@@ -121,7 +121,7 @@ void* DOMDataStore::getDOMWrapperMap(DOMWrapperMapType type)
 
 void DOMDataStore::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<DOMDataStore> info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
     info.addInstrumentedMember(m_domNodeMap);
     info.addInstrumentedMember(m_activeDomNodeMap);
     info.addInstrumentedMember(m_domObjectMap);
diff --git a/Source/WebCore/bindings/v8/DateExtension.cpp b/Source/WebCore/bindings/v8/DateExtension.cpp
index 8d34cb8b5..b58afec39 100644
--- a/Source/WebCore/bindings/v8/DateExtension.cpp
+++ b/Source/WebCore/bindings/v8/DateExtension.cpp
@@ -76,7 +76,7 @@ DateExtension* DateExtension::get()
 
 void DateExtension::setAllowSleep(bool allow)
 {
-    v8::Local<v8::Value> result = V8Proxy::currentContext()->Global()->Get(v8::String::New("Date"));
+    v8::Local<v8::Value> result = v8::Context::GetCurrent()->Global()->Get(v8::String::New("Date"));
     if (result.IsEmpty() || !result->IsObject())
         return;
 
diff --git a/Source/WebCore/bindings/v8/Dictionary.cpp b/Source/WebCore/bindings/v8/Dictionary.cpp
index 7d692e78e..2625fa5b9 100644
--- a/Source/WebCore/bindings/v8/Dictionary.cpp
+++ b/Source/WebCore/bindings/v8/Dictionary.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "Dictionary.h"
 
+#include "ArrayValue.h"
 #include "DOMStringList.h"
 #include "V8Binding.h"
 #include "V8DOMWindow.h"
@@ -60,12 +61,15 @@
 namespace WebCore {
 
 Dictionary::Dictionary()
+    : m_isolate(0)
 {
 }
 
-Dictionary::Dictionary(const v8::Local<v8::Value>& options)
+Dictionary::Dictionary(const v8::Local<v8::Value>& options, v8::Isolate* isolate)
     : m_options(options)
+    , m_isolate(isolate)
 {
+    ASSERT(m_isolate);
 }
 
 Dictionary::~Dictionary()
@@ -75,6 +79,7 @@ Dictionary::~Dictionary()
 Dictionary& Dictionary::operator=(const Dictionary& optionsObject)
 {
     m_options = optionsObject.m_options;
+    m_isolate = optionsObject.m_isolate;
     return *this;
 }
 
@@ -262,7 +267,9 @@ bool Dictionary::get(const String& key, MessagePortArray& value) const
     if (!getKey(key, v8Value))
         return false;
 
-    return getMessagePortArray(v8Value, value);
+    ASSERT(m_isolate);
+    ASSERT(m_isolate == v8::Isolate::GetCurrent());
+    return getMessagePortArray(v8Value, value, m_isolate);
 }
 
 bool Dictionary::get(const String& key, HashSet<AtomicString>& value) const
@@ -418,8 +425,11 @@ bool Dictionary::get(const String& key, Dictionary& value) const
     if (!getKey(key, v8Value))
         return false;
 
-    if (v8Value->IsObject())
-        value = Dictionary(v8Value);
+    if (v8Value->IsObject()) {
+        ASSERT(m_isolate);
+        ASSERT(m_isolate == v8::Isolate::GetCurrent());
+        value = Dictionary(v8Value, m_isolate);
+    }
 
     return true;
 }
@@ -442,6 +452,21 @@ bool Dictionary::get(const String& key, Vector<String>& value) const
     return true;
 }
 
+bool Dictionary::get(const String& key, ArrayValue& value) const
+{
+    v8::Local<v8::Value> v8Value;
+    if (!getKey(key, v8Value))
+        return false;
+
+    if (!v8Value->IsArray())
+        return false;
+
+    ASSERT(m_isolate);
+    ASSERT(m_isolate == v8::Isolate::GetCurrent());
+    value = ArrayValue(v8::Local<v8::Array>::Cast(v8Value), m_isolate);
+    return true;
+}
+
 bool Dictionary::getOwnPropertiesAsStringHashMap(WTF::HashMap<String, String>& hashMap) const
 {
     if (!isObject())
diff --git a/Source/WebCore/bindings/v8/Dictionary.h b/Source/WebCore/bindings/v8/Dictionary.h
index f153ea9c8..8373c7b28 100644
--- a/Source/WebCore/bindings/v8/Dictionary.h
+++ b/Source/WebCore/bindings/v8/Dictionary.h
@@ -38,6 +38,7 @@
 
 namespace WebCore {
 
+class ArrayValue;
 class DOMWindow;
 class IDBKeyRange;
 class MediaKeyError;
@@ -51,7 +52,7 @@ class TrackBase;
 class Dictionary {
 public:
     Dictionary();
-    Dictionary(const v8::Local<v8::Value>& options);
+    Dictionary(const v8::Local<v8::Value>& options, v8::Isolate*);
     ~Dictionary();
 
     Dictionary& operator=(const Dictionary&);
@@ -86,6 +87,8 @@ public:
     bool get(const String&, HashSet<AtomicString>&) const;
     bool get(const String&, Dictionary&) const;
     bool get(const String&, Vector<String>&) const;
+    bool get(const String&, ArrayValue&) const;
+
     bool getOwnPropertiesAsStringHashMap(WTF::HashMap<String, String>&) const;
 
     bool getWithUndefinedOrNullCheck(const String&, String&) const;
@@ -101,6 +104,7 @@ private:
     static void operator delete(void *);
 
     v8::Local<v8::Value> m_options;
+    v8::Isolate* m_isolate;
 };
 
 }
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
index 22f8315b2..cc1eafb04 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -126,7 +126,7 @@ v8::Handle<v8::Value> getNthValueOnKeyPath(v8::Handle<v8::Value>& rootValue, con
     ASSERT(index <= keyPathElements.size());
     for (size_t i = 0; i < index; ++i) {
         if (!get(currentValue, keyPathElements[i]))
-            return v8::Handle<v8::Value>();
+            return v8Undefined();
     }
 
     return currentValue;
@@ -143,7 +143,7 @@ v8::Handle<v8::Value> ensureNthValueOnKeyPath(v8::Handle<v8::Value>& rootValue,
         if (!get(currentValue, keyPathElement)) {
             v8::Handle<v8::Object> object = v8::Object::New();
             if (!set(parentValue, keyPathElement, object))
-                return v8::Handle<v8::Value>();
+                return v8Undefined();
             currentValue = object;
         }
     }
diff --git a/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
index 1200d123c..ebcf76714 100644
--- a/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
+++ b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
@@ -104,7 +104,7 @@ class ChunkedTable {
 
     void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo<ChunkedTable> info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
         for (Chunk* chunk = m_chunks; chunk; chunk = chunk->m_previous)
             info.addMember(chunk);
     }
@@ -186,7 +186,7 @@ public:
 
     virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const OVERRIDE
     {
-        MemoryClassInfo<IntrusiveDOMWrapperMap> info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
         info.addInstrumentedMember(m_table);
     }
 
diff --git a/Source/WebCore/bindings/v8/NPV8Object.cpp b/Source/WebCore/bindings/v8/NPV8Object.cpp
index a3790da00..d0892bd65 100644
--- a/Source/WebCore/bindings/v8/NPV8Object.cpp
+++ b/Source/WebCore/bindings/v8/NPV8Object.cpp
@@ -38,7 +38,6 @@
 #include "UserGestureIndicator.h"
 #include "V8Binding.h"
 #include "V8GCController.h"
-#include "V8Helpers.h"
 #include "V8NPUtils.h"
 #include "V8Proxy.h"
 #include "WrapperTypeInfo.h"
diff --git a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
index 03e7c57b2..6ccb0f0b2 100755
--- a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
@@ -78,9 +78,6 @@ PageScriptDebugServer::PageScriptDebugServer()
 
 void PageScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
 {
-    V8Proxy* proxy = V8Proxy::retrieve(page->mainFrame());
-    if (!proxy)
-        return;
     ScriptController* scriptController = page->mainFrame()->script();
     if (!scriptController->canExecuteScripts(NotAboutToExecuteScript))
         return;
@@ -96,7 +93,7 @@ void PageScriptDebugServer::addListener(ScriptDebugListener* listener, Page* pag
     }
     m_listenersMap.set(page, listener);
 
-    V8DOMWindowShell* shell = proxy->windowShell();
+    V8DOMWindowShell* shell = scriptController->windowShell();
     if (!shell->isContextInitialized())
         return;
     v8::Handle<v8::Context> context = shell->context();
diff --git a/Source/WebCore/bindings/v8/ScheduledAction.cpp b/Source/WebCore/bindings/v8/ScheduledAction.cpp
index c4060476b..e71f02629 100644
--- a/Source/WebCore/bindings/v8/ScheduledAction.cpp
+++ b/Source/WebCore/bindings/v8/ScheduledAction.cpp
@@ -32,6 +32,7 @@
 #include "ScheduledAction.h"
 
 #include "Document.h"
+#include "Frame.h"
 #include "ScriptExecutionContext.h"
 #include "ScriptSourceCode.h"
 
@@ -99,11 +100,9 @@ void ScheduledAction::execute(ScriptExecutionContext* context)
         Frame* frame = static_cast<Document*>(context)->frame();
         if (!frame)
             return;
-        ScriptController* scriptController = frame->script();
-        if (!scriptController->canExecuteScripts(AboutToExecuteScript))
+        if (!frame->script()->canExecuteScripts(AboutToExecuteScript))
             return;
-        V8Proxy* proxy = V8Proxy::retrieve(frame);
-        execute(proxy);
+        execute(frame->script()->proxy());
     }
 #if ENABLE(WORKERS)
     else {
@@ -123,7 +122,7 @@ void ScheduledAction::execute(V8Proxy* proxy)
         return; // JS may not be enabled.
 
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("ScheduledAction::execute", this, 0);
+    TRACE_EVENT0("v8", "ScheduledAction::execute");
 #endif
 
     v8::Context::Scope scope(v8Context);
diff --git a/Source/WebCore/bindings/v8/ScriptController.cpp b/Source/WebCore/bindings/v8/ScriptController.cpp
index 14c050a76..a71380217 100644
--- a/Source/WebCore/bindings/v8/ScriptController.cpp
+++ b/Source/WebCore/bindings/v8/ScriptController.cpp
@@ -32,7 +32,7 @@
 #include "config.h"
 #include "ScriptController.h"
 
-#include "PlatformSupport.h"
+#include "BindingState.h"
 #include "Document.h"
 #include "ScriptCallStack.h"
 #include "ScriptCallStackFactory.h"
@@ -49,13 +49,12 @@
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
 #include "NPV8Object.h"
+#include "PlatformSupport.h"
 #include "ScriptSourceCode.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "UserGestureIndicator.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8DOMWindow.h"
 #include "V8Event.h"
 #include "V8HiddenPropertyName.h"
@@ -87,17 +86,17 @@ void ScriptController::setFlags(const char* string, int length)
 
 Frame* ScriptController::retrieveFrameForEnteredContext()
 {
-    return V8Proxy::retrieveFrameForEnteredContext();
+    return firstFrame(BindingState::instance());
 }
 
 Frame* ScriptController::retrieveFrameForCurrentContext()
 {
-    return V8Proxy::retrieveFrameForCurrentContext();
+    return currentFrame(BindingState::instance());
 }
 
 bool ScriptController::canAccessFromCurrentOrigin(Frame *frame)
 {
-    return !v8::Context::InContext() || V8BindingSecurity::canAccessFrame(V8BindingState::Only(), frame, true);
+    return !v8::Context::InContext() || BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), frame);
 }
 
 ScriptController::ScriptController(Frame* frame)
@@ -182,7 +181,11 @@ void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<Sc
 
 void ScriptController::setIsolatedWorldSecurityOrigin(int worldID, PassRefPtr<SecurityOrigin> securityOrigin)
 {
-    m_proxy->setIsolatedWorldSecurityOrigin(worldID, securityOrigin);
+    ASSERT(worldID);
+    m_proxy->isolatedWorldSecurityOrigins().set(worldID, securityOrigin);
+    IsolatedWorldMap::iterator iter = m_proxy->isolatedWorlds().find(worldID);
+    if (iter != m_proxy->isolatedWorlds().end())
+        iter->second->setSecurityOrigin(securityOrigin);
 }
 
 // Evaluate a script file in the environment of this proxy.
@@ -274,8 +277,6 @@ bool ScriptController::haveInterpreter() const
 
 void ScriptController::enableEval()
 {
-    // We don't call initContextIfNeeded because contexts have eval enabled by default.
-
     v8::HandleScope handleScope;
     v8::Handle<v8::Context> v8Context = proxy()->windowShell()->context();
     if (v8Context.IsEmpty())
@@ -286,9 +287,6 @@ void ScriptController::enableEval()
 
 void ScriptController::disableEval()
 {
-    if (!proxy()->windowShell()->initContextIfNeeded())
-        return;
-
     v8::HandleScope handleScope;
     v8::Handle<v8::Context> v8Context = proxy()->windowShell()->context();
     if (v8Context.IsEmpty())
@@ -444,7 +442,17 @@ void ScriptController::setCaptureCallStackForUncaughtExceptions(bool value)
 
 void ScriptController::collectIsolatedContexts(Vector<std::pair<ScriptState*, SecurityOrigin*> >& result)
 {
-    m_proxy->collectIsolatedContexts(result);
+    v8::HandleScope handleScope;
+    for (IsolatedWorldMap::iterator it = m_proxy->isolatedWorlds().begin(); it != m_proxy->isolatedWorlds().end(); ++it) {
+        V8IsolatedContext* isolatedContext = it->second;
+        if (!isolatedContext->securityOrigin())
+            continue;
+        v8::Handle<v8::Context> v8Context = isolatedContext->context();
+        if (v8Context.IsEmpty())
+            continue;
+        ScriptState* scriptState = ScriptState::forContext(v8::Local<v8::Context>::New(v8Context));
+        result.append(std::pair<ScriptState*, SecurityOrigin*>(scriptState, isolatedContext->securityOrigin()));
+    }
 }
 #endif
 
diff --git a/Source/WebCore/bindings/v8/ScriptController.h b/Source/WebCore/bindings/v8/ScriptController.h
index 622e833b5..b3c22aca8 100644
--- a/Source/WebCore/bindings/v8/ScriptController.h
+++ b/Source/WebCore/bindings/v8/ScriptController.h
@@ -65,6 +65,7 @@ public:
     // FIXME: V8Proxy should either be folded into ScriptController
     // or this accessor should be made JSProxy*
     V8Proxy* proxy() { return m_proxy.get(); }
+    V8DOMWindowShell* windowShell() { return m_proxy->windowShell(); }
 
     ScriptValue executeScript(const ScriptSourceCode&);
     ScriptValue executeScript(const String& script, bool forceUserGesture = false);
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
index 2c82510b1..77d68d017 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -89,7 +89,7 @@ String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBrea
         return "";
     *actualLineNumber = args->Get(v8::String::New("lineNumber"))->Int32Value();
     *actualColumnNumber = args->Get(v8::String::New("columnNumber"))->Int32Value();
-    return v8StringToWebCoreString(breakpointId->ToString());
+    return v8ValueToWebCoreString(breakpointId->ToString());
 }
 
 void ScriptDebugServer::removeBreakpoint(const String& breakpointId)
@@ -137,7 +137,7 @@ ScriptDebugServer::PauseOnExceptionsState ScriptDebugServer::pauseOnExceptionsSt
     v8::HandleScope scope;
     v8::Context::Scope contextScope(v8::Debug::GetDebugContext());
 
-    v8::Handle<v8::Value> argv[] = { v8::Handle<v8::Value>() };
+    v8::Handle<v8::Value> argv[] = { v8Undefined() };
     v8::Handle<v8::Value> result = callDebuggerMethod("pauseOnExceptionsState", 0, argv);
     return static_cast<ScriptDebugServer::PauseOnExceptionsState>(result->Int32Value());
 }
@@ -363,7 +363,7 @@ void ScriptDebugServer::handleV8DebugEvent(const v8::Debug::EventDetails& eventD
                 v8::Handle<v8::Object> eventData = eventDetails.GetEventData();
                 v8::Handle<v8::Value> exceptionGetterValue = eventData->Get(v8::String::New("exception"));
                 ASSERT(!exceptionGetterValue.IsEmpty() && exceptionGetterValue->IsFunction());
-                v8::Handle<v8::Value> argv[] = { v8::Handle<v8::Value>() };
+                v8::Handle<v8::Value> argv[] = { v8Undefined() };
                 V8RecursionScope::MicrotaskSuppression scope;
                 exception = v8::Handle<v8::Function>::Cast(exceptionGetterValue)->Call(eventData, 0, argv);
             }
diff --git a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
index 37dd85e55..fc13a7e93 100644
--- a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
+++ b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
@@ -40,16 +40,16 @@
 
 namespace WebCore {
 
-static GCEventData& isolateGCEventData()
+static GCEventData* isolateGCEventData()
 {
-    V8BindingPerIsolateData* isolateData = V8BindingPerIsolateData::current();
+    V8PerIsolateData* isolateData = V8PerIsolateData::current();
     ASSERT(isolateData);
     return isolateData->gcEventData();
 }
 
 void ScriptGCEvent::addEventListener(ScriptGCEventListener* eventListener)
 {
-    GCEventData::GCEventListeners& listeners = isolateGCEventData().listeners();
+    GCEventData::GCEventListeners& listeners = isolateGCEventData()->listeners();
     if (listeners.isEmpty()) {
         v8::V8::AddGCPrologueCallback(ScriptGCEvent::gcPrologueCallback);
         v8::V8::AddGCEpilogueCallback(ScriptGCEvent::gcEpilogueCallback);
@@ -60,7 +60,7 @@ void ScriptGCEvent::addEventListener(ScriptGCEventListener* eventListener)
 void ScriptGCEvent::removeEventListener(ScriptGCEventListener* eventListener)
 {
     ASSERT(eventListener);
-    GCEventData::GCEventListeners& listeners = isolateGCEventData().listeners();
+    GCEventData::GCEventListeners& listeners = isolateGCEventData()->listeners();
     ASSERT(!listeners.isEmpty());
     size_t i = listeners.find(eventListener);
     ASSERT(i != notFound);
@@ -89,23 +89,23 @@ size_t ScriptGCEvent::getUsedHeapSize()
 
 void ScriptGCEvent::gcPrologueCallback(v8::GCType type, v8::GCCallbackFlags flags)
 {
-    GCEventData& gcEventData = isolateGCEventData();
-    gcEventData.startTime = WTF::monotonicallyIncreasingTime();
-    gcEventData.usedHeapSize = getUsedHeapSize();
+    GCEventData* gcEventData = isolateGCEventData();
+    gcEventData->startTime = WTF::monotonicallyIncreasingTime();
+    gcEventData->usedHeapSize = getUsedHeapSize();
 }
 
 void ScriptGCEvent::gcEpilogueCallback(v8::GCType type, v8::GCCallbackFlags flags)
 {
-    GCEventData& gcEventData = isolateGCEventData();
-    if (!gcEventData.usedHeapSize)
+    GCEventData* gcEventData = isolateGCEventData();
+    if (!gcEventData->usedHeapSize)
         return;
     double endTime = WTF::monotonicallyIncreasingTime();
     size_t usedHeapSize = getUsedHeapSize();
-    size_t collectedBytes = usedHeapSize > gcEventData.usedHeapSize ? 0 : gcEventData.usedHeapSize - usedHeapSize;
-    GCEventData::GCEventListeners& listeners = gcEventData.listeners();
+    size_t collectedBytes = usedHeapSize > gcEventData->usedHeapSize ? 0 : gcEventData->usedHeapSize - usedHeapSize;
+    GCEventData::GCEventListeners& listeners = gcEventData->listeners();
     for (GCEventData::GCEventListeners::iterator i = listeners.begin(); i != listeners.end(); ++i)
-        (*i)->didGC(gcEventData.startTime, endTime, collectedBytes);
-    gcEventData.clear();
+        (*i)->didGC(gcEventData->startTime, endTime, collectedBytes);
+    gcEventData->clear();
 }
     
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index a268f39ae..9858ce325 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -195,7 +195,7 @@ void ScriptProfiler::visitNodeWrappers(NodeWrapperVisitor* visitor)
 
 void ScriptProfiler::visitExternalStrings(ExternalStringVisitor* visitor)
 {
-    V8BindingPerIsolateData::current()->visitExternalStrings(visitor);
+    V8PerIsolateData::current()->visitExternalStrings(visitor);
 }
 
 void ScriptProfiler::visitExternalArrays(ExternalArrayVisitor* visitor)
@@ -222,8 +222,8 @@ void ScriptProfiler::visitExternalArrays(ExternalArrayVisitor* visitor)
 
 void ScriptProfiler::collectBindingMemoryInfo(MemoryInstrumentation* instrumentation)
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    instrumentation->addInstrumentedMember(data);
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    instrumentation->addRootObject(data);
 }
 
 size_t ScriptProfiler::profilerSnapshotsSize()
diff --git a/Source/WebCore/bindings/v8/ScriptWrappable.h b/Source/WebCore/bindings/v8/ScriptWrappable.h
index ef2f7619f..d32b9b8c2 100644
--- a/Source/WebCore/bindings/v8/ScriptWrappable.h
+++ b/Source/WebCore/bindings/v8/ScriptWrappable.h
@@ -31,6 +31,7 @@
 #ifndef ScriptWrappable_h
 #define ScriptWrappable_h
 
+#include "MemoryInstrumentation.h"
 #include <v8.h>
 
 namespace WebCore {
@@ -54,7 +55,7 @@ public:
 
     void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo<ScriptWrappable> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
         info.addMember(m_wrapper);
     }
 
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
index 9f1e3298f..a27532c7f 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -730,7 +730,7 @@ private:
     class ErrorState : public StateBase {
     public:
         ErrorState()
-            : StateBase(v8::Handle<v8::Value>(), 0)
+            : StateBase(v8Undefined(), 0)
         {
         }
 
@@ -2221,7 +2221,7 @@ PassOwnPtr<SerializedScriptValue::ArrayBufferContentsArray> SerializedScriptValu
 {
     for (size_t i = 0; i < arrayBuffers.size(); i++) {
         if (arrayBuffers[i]->isNeutered()) {
-            throwError(INVALID_STATE_ERR, isolate);
+            V8Proxy::setDOMException(INVALID_STATE_ERR, isolate);
             didThrow = true;
             return nullptr;
         }
@@ -2239,7 +2239,7 @@ PassOwnPtr<SerializedScriptValue::ArrayBufferContentsArray> SerializedScriptValu
 
         bool result = arrayBuffers[i]->transfer(contents->at(i), neuteredViews);
         if (!result) {
-            throwError(INVALID_STATE_ERR, isolate);
+            V8Proxy::setDOMException(INVALID_STATE_ERR, isolate);
             didThrow = true;
             return nullptr;
         }
@@ -2277,11 +2277,11 @@ SerializedScriptValue::SerializedScriptValue(v8::Handle<v8::Value> value,
         // If there was an input error, throw a new exception outside
         // of the TryCatch scope.
         didThrow = true;
-        throwError(DATA_CLONE_ERR, isolate);
+        V8Proxy::setDOMException(DATA_CLONE_ERR, isolate);
         return;
     case Serializer::InvalidStateError:
         didThrow = true;
-        throwError(INVALID_STATE_ERR, isolate);
+        V8Proxy::setDOMException(INVALID_STATE_ERR, isolate);
         return;
     case Serializer::JSFailure:
         // If there was a JS failure (but no exception), there's not
diff --git a/Source/WebCore/bindings/v8/StaticDOMDataStore.cpp b/Source/WebCore/bindings/v8/StaticDOMDataStore.cpp
index 996c9c87c..4ced6a23e 100644
--- a/Source/WebCore/bindings/v8/StaticDOMDataStore.cpp
+++ b/Source/WebCore/bindings/v8/StaticDOMDataStore.cpp
@@ -45,12 +45,12 @@ StaticDOMDataStore::StaticDOMDataStore()
     m_activeDomNodeMap = &m_staticActiveDomNodeMap;
     m_domObjectMap = &m_staticDomObjectMap;
     m_activeDomObjectMap = &m_staticActiveDomObjectMap;
-    V8BindingPerIsolateData::current()->registerDOMDataStore(this);
+    V8PerIsolateData::current()->registerDOMDataStore(this);
 }
 
 StaticDOMDataStore::~StaticDOMDataStore()
 {
-    V8BindingPerIsolateData::current()->unregisterDOMDataStore(this);
+    V8PerIsolateData::current()->unregisterDOMDataStore(this);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8Binding.cpp b/Source/WebCore/bindings/v8/V8Binding.cpp
index b1142271b..a5e95a87b 100644
--- a/Source/WebCore/bindings/v8/V8Binding.cpp
+++ b/Source/WebCore/bindings/v8/V8Binding.cpp
@@ -52,145 +52,8 @@
 
 namespace WebCore {
 
-
-V8BindingPerIsolateData::V8BindingPerIsolateData(v8::Isolate* isolate)
-    : m_domDataStore(0)
-    , m_constructorMode(ConstructorMode::CreateNewObject)
-    , m_recursionLevel(0)
-#ifndef NDEBUG
-    , m_internalScriptRecursionLevel(0)
-#endif
-    , m_lowMemoryNotificationHint(false)
-{
-}
-
-V8BindingPerIsolateData::~V8BindingPerIsolateData()
-{
-}
-
-V8BindingPerIsolateData* V8BindingPerIsolateData::create(v8::Isolate* isolate)
-{
-    ASSERT(isolate);
-    ASSERT(!isolate->GetData());
-    V8BindingPerIsolateData* data = new V8BindingPerIsolateData(isolate);
-    isolate->SetData(data);
-    return data;
-}
-
-void V8BindingPerIsolateData::ensureInitialized(v8::Isolate* isolate) 
-{
-    ASSERT(isolate);
-    if (!isolate->GetData()) 
-        create(isolate);
-}
-
-void V8BindingPerIsolateData::dispose(v8::Isolate* isolate)
-{
-    void* data = isolate->GetData();
-    delete static_cast<V8BindingPerIsolateData*>(data);
-    isolate->SetData(0);
-}
-
-void V8BindingPerIsolateData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
-{
-    MemoryClassInfo<V8BindingPerIsolateData> info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
-    info.addHashMap(m_rawTemplates);
-    info.addHashMap(m_templates);
-    info.addInstrumentedMember(m_stringCache);
-    info.addVector(m_domDataList);
-
-    for (size_t i = 0; i < m_domDataList.size(); i++)
-        info.addInstrumentedMember(m_domDataList[i]);
-}
-
-// WebCoreStringResource is a helper class for v8ExternalString. It is used
-// to manage the life-cycle of the underlying buffer of the external string.
-class WebCoreStringResource : public v8::String::ExternalStringResource {
-public:
-    explicit WebCoreStringResource(const String& string)
-        : m_plainString(string)
-    {
-#ifndef NDEBUG
-        m_threadId = WTF::currentThread();
-#endif
-        ASSERT(!string.isNull());
-        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * string.length());
-    }
-
-    explicit WebCoreStringResource(const AtomicString& string)
-        : m_plainString(string.string())
-        , m_atomicString(string)
-    {
-#ifndef NDEBUG
-        m_threadId = WTF::currentThread();
-#endif
-        ASSERT(!string.isNull());
-        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * string.length());
-    }
-
-    virtual ~WebCoreStringResource()
-    {
-#ifndef NDEBUG
-        ASSERT(m_threadId == WTF::currentThread());
-#endif
-        int reducedExternalMemory = -2 * m_plainString.length();
-        if (m_plainString.impl() != m_atomicString.impl() && !m_atomicString.isNull())
-            reducedExternalMemory *= 2;
-        v8::V8::AdjustAmountOfExternalAllocatedMemory(reducedExternalMemory);
-    }
-
-    virtual const uint16_t* data() const
-    {
-        return reinterpret_cast<const uint16_t*>(m_plainString.impl()->characters());
-    }
-
-    virtual size_t length() const { return m_plainString.impl()->length(); }
-
-    String webcoreString() { return m_plainString; }
-
-    AtomicString atomicString()
-    {
-#ifndef NDEBUG
-        ASSERT(m_threadId == WTF::currentThread());
-#endif
-        if (m_atomicString.isNull()) {
-            m_atomicString = AtomicString(m_plainString);
-            ASSERT(!m_atomicString.isNull());
-            if (m_plainString.impl() != m_atomicString.impl())
-                v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * m_atomicString.length());
-        }
-        return m_atomicString;
-    }
-
-    void visitStrings(ExternalStringVisitor* visitor)
-    {
-        visitor->visitJSExternalString(m_plainString.impl());
-        if (m_plainString.impl() != m_atomicString.impl() && !m_atomicString.isNull())
-            visitor->visitJSExternalString(m_atomicString.impl());
-    }
-
-    static WebCoreStringResource* toStringResource(v8::Handle<v8::String> v8String)
-    {
-        return static_cast<WebCoreStringResource*>(v8String->GetExternalStringResource());
-    }
-
-private:
-    // A shallow copy of the string. Keeps the string buffer alive until the V8 engine garbage collects it.
-    String m_plainString;
-    // If this string is atomic or has been made atomic earlier the
-    // atomic string is held here. In the case where the string starts
-    // off non-atomic and becomes atomic later it is necessary to keep
-    // the original string alive because v8 may keep derived pointers
-    // into that string.
-    AtomicString m_atomicString;
-
-#ifndef NDEBUG
-    WTF::ThreadIdentifier m_threadId;
-#endif
-};
-
 #if ENABLE(INSPECTOR)
-void V8BindingPerIsolateData::visitExternalStrings(ExternalStringVisitor* visitor)
+void V8PerIsolateData::visitExternalStrings(ExternalStringVisitor* visitor)
 {
     v8::HandleScope handleScope;
     class VisitorImpl : public v8::ExternalResourceVisitor {
@@ -210,17 +73,46 @@ void V8BindingPerIsolateData::visitExternalStrings(ExternalStringVisitor* visito
 }
 #endif
 
+static String v8NonStringValueToWebCoreString(v8::Handle<v8::Value> object)
+{
+    ASSERT(!object->IsString());
+    if (object->IsInt32())
+        return int32ToWebCoreString(object->Int32Value());
+
+    v8::TryCatch block;
+    v8::Handle<v8::String> v8String = object->ToString();
+    // Handle the case where an exception is thrown as part of invoking toString on the object.
+    if (block.HasCaught()) {
+        throwError(block.Exception());
+        return StringImpl::empty();
+    }
+    // This path is unexpected. However there is hypothesis that it
+    // might be combination of v8 and v8 bindings bugs. For now
+    // just bailout as we'll crash if attempt to convert empty handle into a string.
+    if (v8String.IsEmpty()) {
+        ASSERT_NOT_REACHED();
+        return StringImpl::empty();
+    }
+    return v8StringToWebCoreString<String>(v8String, DoNotExternalize);
+}
+
+static AtomicString v8NonStringValueToAtomicWebCoreString(v8::Handle<v8::Value> object)
+{
+    ASSERT(!object->IsString());
+    return AtomicString(v8NonStringValueToWebCoreString(object));
+}
+
 String v8ValueToWebCoreString(v8::Handle<v8::Value> value)
 {
     if (value->IsString())
-        return v8StringToWebCoreString(v8::Handle<v8::String>::Cast(value));
+        return v8StringToWebCoreString<String>(v8::Handle<v8::String>::Cast(value), Externalize);
     return v8NonStringValueToWebCoreString(value);
 }
 
 AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> value)
 {
     if (value->IsString())
-        return v8StringToAtomicWebCoreString(v8::Handle<v8::String>::Cast(value));
+        return v8StringToWebCoreString<AtomicString>(v8::Handle<v8::String>::Cast(value), Externalize);
     return v8NonStringValueToAtomicWebCoreString(value);
 }
 
@@ -417,117 +309,6 @@ String int32ToWebCoreString(int value)
     return String::number(value);
 }
 
-String v8NonStringValueToWebCoreString(v8::Handle<v8::Value> object)
-{
-    ASSERT(!object->IsString());
-    if (object->IsInt32())
-        return int32ToWebCoreString(object->Int32Value());
-
-    v8::TryCatch block;
-    v8::Handle<v8::String> v8String = object->ToString();
-    // Handle the case where an exception is thrown as part of invoking toString on the object.
-    if (block.HasCaught()) {
-        throwError(block.Exception());
-        return StringImpl::empty();
-    }
-    // This path is unexpected.  However there is hypothesis that it
-    // might be combination of v8 and v8 bindings bugs.  For now
-    // just bailout as we'll crash if attempt to convert empty handle into a string.
-    if (v8String.IsEmpty()) {
-        ASSERT_NOT_REACHED();
-        return StringImpl::empty();
-    }
-    return v8StringToWebCoreString<String>(v8String, DoNotExternalize);
-}
-
-AtomicString v8NonStringValueToAtomicWebCoreString(v8::Handle<v8::Value> object)
-{
-    ASSERT(!object->IsString());
-    return AtomicString(v8NonStringValueToWebCoreString(object));
-}
-
-static v8::Local<v8::String> makeExternalString(const String& string)
-{
-    WebCoreStringResource* stringResource = new WebCoreStringResource(string);
-    v8::Local<v8::String> newString = v8::String::NewExternal(stringResource);
-    if (newString.IsEmpty())
-        delete stringResource;
-
-    return newString;
-}
-
-static void cachedStringCallback(v8::Persistent<v8::Value> wrapper, void* parameter)
-{
-    StringImpl* stringImpl = static_cast<StringImpl*>(parameter);
-    V8BindingPerIsolateData::current()->stringCache()->remove(stringImpl);
-    wrapper.Dispose();
-    stringImpl->deref();
-}
-
-void StringCache::remove(StringImpl* stringImpl) 
-{
-    ASSERT(m_stringCache.contains(stringImpl));
-    m_stringCache.remove(stringImpl);
-    // Make sure that already disposed m_lastV8String is not used in
-    // StringCache::v8ExternalString().
-    if (m_lastStringImpl.get() == stringImpl)
-        m_lastStringImpl = 0;
-}
-
-v8::Local<v8::String> StringCache::v8ExternalStringSlow(StringImpl* stringImpl, v8::Isolate* isolate)
-{
-    if (!stringImpl->length())
-        return isolate ? v8::String::Empty(isolate) : v8::String::Empty();
-
-    v8::String* cachedV8String = m_stringCache.get(stringImpl);
-    if (cachedV8String) {
-        v8::Persistent<v8::String> handle(cachedV8String);
-        if (!handle.IsNearDeath() && !handle.IsEmpty()) {
-            m_lastStringImpl = stringImpl;
-            m_lastV8String = handle;
-            return v8::Local<v8::String>::New(handle);
-        }
-    }
-
-    v8::Local<v8::String> newString = makeExternalString(String(stringImpl));
-    if (newString.IsEmpty())
-        return newString;
-
-    v8::Persistent<v8::String> wrapper = v8::Persistent<v8::String>::New(newString);
-    if (wrapper.IsEmpty())
-        return newString;
-
-    stringImpl->ref();
-    wrapper.MarkIndependent();
-    wrapper.MakeWeak(stringImpl, cachedStringCallback);
-    m_stringCache.set(stringImpl, *wrapper);
-
-    m_lastStringImpl = stringImpl;
-    m_lastV8String = wrapper;
-
-    return newString;
-}
-
-void IntegerCache::createSmallIntegers()
-{
-    ASSERT(!m_initialized);
-    // We initialize m_smallIntegers not in a constructor but in v8Integer(),
-    // because Integer::New() requires a HandleScope. At the point where
-    // IntegerCache is constructed, a HandleScope might not exist.
-    for (int value = 0; value < numberOfCachedSmallIntegers; value++)
-        m_smallIntegers[value] = v8::Persistent<v8::Integer>::New(v8::Integer::New(value));
-    m_initialized = true;
-}
-
-IntegerCache::~IntegerCache()
-{
-    if (m_initialized) {
-        for (int value = 0; value < numberOfCachedSmallIntegers; value++)
-            m_smallIntegers[value].Dispose();
-        m_initialized = false;
-    }
-}
-
 v8::Persistent<v8::FunctionTemplate> createRawTemplate()
 {
     v8::HandleScope scope;
@@ -535,35 +316,9 @@ v8::Persistent<v8::FunctionTemplate> createRawTemplate()
     return v8::Persistent<v8::FunctionTemplate>::New(result);
 }        
 
-v8::Local<v8::Signature> configureTemplate(v8::Persistent<v8::FunctionTemplate> desc,
-                                           const char *interfaceName,
-                                           v8::Persistent<v8::FunctionTemplate> parentClass,
-                                           int fieldCount,
-                                           const BatchedAttribute* attributes, 
-                                           size_t attributeCount,
-                                           const BatchedCallback* callbacks,
-                                           size_t callbackCount)
-{
-    desc->SetClassName(v8::String::New(interfaceName));
-    v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
-    instance->SetInternalFieldCount(fieldCount);
-    if (!parentClass.IsEmpty())
-        desc->Inherit(parentClass);
-    if (attributeCount)
-        batchConfigureAttributes(instance, desc->PrototypeTemplate(),
-                                 attributes, attributeCount);
-    v8::Local<v8::Signature> defaultSignature = v8::Signature::New(desc);
-    if (callbackCount)
-        batchConfigureCallbacks(desc->PrototypeTemplate(),
-                                defaultSignature,
-                                static_cast<v8::PropertyAttribute>(v8::DontDelete),
-                                callbacks, callbackCount);
-    return defaultSignature;
-}
-
 v8::Persistent<v8::String> getToStringName()
 {
-    v8::Persistent<v8::String>& toStringName = V8BindingPerIsolateData::current()->toStringName();
+    v8::Persistent<v8::String>& toStringName = V8PerIsolateData::current()->toStringName();
     if (toStringName.IsEmpty())
         toStringName = v8::Persistent<v8::String>::New(v8::String::New("toString"));
     return *toStringName;
@@ -588,7 +343,7 @@ static v8::Handle<v8::Value> constructorToString(const v8::Arguments& args)
 
 v8::Persistent<v8::FunctionTemplate> getToStringTemplate()
 {
-    v8::Persistent<v8::FunctionTemplate>& toStringTemplate = V8BindingPerIsolateData::current()->toStringTemplate();
+    v8::Persistent<v8::FunctionTemplate>& toStringTemplate = V8PerIsolateData::current()->toStringTemplate();
     if (toStringTemplate.IsEmpty())
         toStringTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(constructorToString));
     return toStringTemplate;
@@ -596,7 +351,7 @@ v8::Persistent<v8::FunctionTemplate> getToStringTemplate()
 
 void StringCache::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<StringCache> info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
     info.addHashMap(m_stringCache);
 }
     
diff --git a/Source/WebCore/bindings/v8/V8Binding.h b/Source/WebCore/bindings/v8/V8Binding.h
index 25f5a54e1..ca3afb649 100644
--- a/Source/WebCore/bindings/v8/V8Binding.h
+++ b/Source/WebCore/bindings/v8/V8Binding.h
@@ -33,15 +33,20 @@
 
 #include "BindingSecurity.h"
 #include "DOMDataStore.h"
+#include "Document.h"
 #include "PlatformString.h"
+#include "V8BindingHelpers.h"
 #include "V8BindingMacros.h"
+#include "V8DOMConfiguration.h"
 #include "V8DOMWrapper.h"
 #include "V8GCController.h"
 #include "V8HiddenPropertyName.h"
+#include "V8PerIsolateData.h"
+#include "V8Proxy.h"
+#include "V8ValueCache.h"
 #include <wtf/MathExtras.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/text/AtomicString.h>
-
 #include <v8.h>
 
 namespace WebCore {
@@ -51,80 +56,6 @@ namespace WebCore {
     class EventTarget;
     class ExternalStringVisitor;
     class MemoryObjectInfo;
-
-    // FIXME: Remove V8Binding.
-    class V8Binding {
-    };
-    typedef BindingSecurity<V8Binding> V8BindingSecurity;
-
-    class StringCache {
-    public:
-        StringCache() { }
-
-        v8::Local<v8::String> v8ExternalString(StringImpl* stringImpl, v8::Isolate* isolate)
-        {
-            if (m_lastStringImpl.get() == stringImpl) {
-                ASSERT(!m_lastV8String.IsNearDeath());
-                ASSERT(!m_lastV8String.IsEmpty());
-                return v8::Local<v8::String>::New(m_lastV8String);
-            }
-
-            return v8ExternalStringSlow(stringImpl, isolate);
-        }
-
-        void clearOnGC() 
-        {
-            m_lastStringImpl = 0;
-            m_lastV8String.Clear();
-        }
-
-        void remove(StringImpl*);
-
-        void reportMemoryUsage(MemoryObjectInfo*) const;
-
-    private:
-        v8::Local<v8::String> v8ExternalStringSlow(StringImpl*, v8::Isolate*);
-
-        HashMap<StringImpl*, v8::String*> m_stringCache;
-        v8::Persistent<v8::String> m_lastV8String;
-        // Note: RefPtr is a must as we cache by StringImpl* equality, not identity
-        // hence lastStringImpl might be not a key of the cache (in sense of identity)
-        // and hence it's not refed on addition.
-        RefPtr<StringImpl> m_lastStringImpl;
-    };
-
-    const int numberOfCachedSmallIntegers = 64;
-
-    class IntegerCache {
-    public:
-        IntegerCache() : m_initialized(false) { };
-        ~IntegerCache();
-
-        v8::Handle<v8::Integer> v8Integer(int value)
-        {
-            if (!m_initialized)
-                createSmallIntegers();
-            if (0 <= value && value < numberOfCachedSmallIntegers)
-                return m_smallIntegers[value];
-            return v8::Integer::New(value);
-        }
-
-        v8::Handle<v8::Integer> v8UnsignedInteger(unsigned value)
-        {
-            if (!m_initialized)
-                createSmallIntegers();
-            if (value < static_cast<unsigned>(numberOfCachedSmallIntegers))
-                return m_smallIntegers[value];
-            return v8::Integer::NewFromUnsigned(value);
-        }
-
-    private:
-        void createSmallIntegers();
-
-        v8::Persistent<v8::Integer> m_smallIntegers[numberOfCachedSmallIntegers];
-        bool m_initialized;
-    };
-
     class ScriptGCEventListener;
 
     class GCEventData {
@@ -139,6 +70,7 @@ namespace WebCore {
         }
         GCEventListeners& listeners() { return m_listeners; }
 
+        // FIXME: Make these members private.
         double startTime;
         size_t usedHeapSize;
 
@@ -146,120 +78,6 @@ namespace WebCore {
         GCEventListeners m_listeners;
     };
 
-    class ConstructorMode;
-
-#ifndef NDEBUG
-    typedef HashMap<v8::Value*, GlobalHandleInfo*> GlobalHandleMap;
-#endif
-
-    class V8BindingPerIsolateData {
-    public:
-        static V8BindingPerIsolateData* create(v8::Isolate*);
-        static void ensureInitialized(v8::Isolate*);
-        static V8BindingPerIsolateData* current(v8::Isolate* isolate = 0)
-        {
-            if (UNLIKELY(!isolate))
-                isolate = v8::Isolate::GetCurrent();
-            ASSERT(isolate->GetData());
-            return static_cast<V8BindingPerIsolateData*>(isolate->GetData()); 
-        }
-        static void dispose(v8::Isolate*);
-
-        typedef HashMap<WrapperTypeInfo*, v8::Persistent<v8::FunctionTemplate> > TemplateMap;
-
-        TemplateMap& rawTemplateMap() { return m_rawTemplates; }
-        TemplateMap& templateMap() { return m_templates; }
-        v8::Persistent<v8::String>& toStringName() { return m_toStringName; }
-        v8::Persistent<v8::FunctionTemplate>& toStringTemplate() { return m_toStringTemplate; }
-
-        v8::Persistent<v8::FunctionTemplate>& lazyEventListenerToStringTemplate()
-        {
-            return m_lazyEventListenerToStringTemplate;
-        }
-
-        StringCache* stringCache() { return &m_stringCache; }
-        IntegerCache* integerCache() { return &m_integerCache; }
-
-#if ENABLE(INSPECTOR)
-        void visitExternalStrings(ExternalStringVisitor*);
-#endif
-        DOMDataList& allStores() { return m_domDataList; }
-
-        V8HiddenPropertyName* hiddenPropertyName() { return &m_hiddenPropertyName; }
-        v8::Persistent<v8::Context>& auxiliaryContext() { return m_auxiliaryContext; }
-
-        void registerDOMDataStore(DOMDataStore* domDataStore) 
-        {
-            m_domDataList.append(domDataStore);
-        }
-
-        void unregisterDOMDataStore(DOMDataStore* domDataStore)
-        {
-            ASSERT(m_domDataList.find(domDataStore));
-            m_domDataList.remove(m_domDataList.find(domDataStore));
-        }
-
-
-        DOMDataStore* domDataStore() { return m_domDataStore; }
-        // DOMDataStore is owned outside V8BindingPerIsolateData.
-        void setDOMDataStore(DOMDataStore* store) { m_domDataStore = store; }
-
-        int recursionLevel() const { return m_recursionLevel; }
-        int incrementRecursionLevel() { return ++m_recursionLevel; }
-        int decrementRecursionLevel() { return --m_recursionLevel; }
-
-#ifndef NDEBUG
-        GlobalHandleMap& globalHandleMap() { return m_globalHandleMap; }
-
-        int internalScriptRecursionLevel() const { return m_internalScriptRecursionLevel; }
-        int incrementInternalScriptRecursionLevel() { return ++m_internalScriptRecursionLevel; }
-        int decrementInternalScriptRecursionLevel() { return --m_internalScriptRecursionLevel; }
-#endif
-
-        GCEventData& gcEventData() { return m_gcEventData; }
-
-        void reportMemoryUsage(MemoryObjectInfo*) const;
-
-        // Gives the system a hint that we should send a low memory
-        // notification upon the next close or navigation event,
-        // because some expensive objects have been allocated that we
-        // want to take every opportunity to collect.
-        void setLowMemoryNotificationHint() { m_lowMemoryNotificationHint = true; }
-        void clearLowMemoryNotificationHint() { m_lowMemoryNotificationHint = false; }
-        bool isLowMemoryNotificationHint() const { return m_lowMemoryNotificationHint; }
-
-    private:
-        explicit V8BindingPerIsolateData(v8::Isolate*);
-        ~V8BindingPerIsolateData();
-
-        TemplateMap m_rawTemplates;
-        TemplateMap m_templates;
-        v8::Persistent<v8::String> m_toStringName;
-        v8::Persistent<v8::FunctionTemplate> m_toStringTemplate;
-        v8::Persistent<v8::FunctionTemplate> m_lazyEventListenerToStringTemplate;
-        StringCache m_stringCache;
-        IntegerCache m_integerCache;
-
-        DOMDataList m_domDataList;
-        DOMDataStore* m_domDataStore;
-
-        V8HiddenPropertyName m_hiddenPropertyName;
-        v8::Persistent<v8::Context> m_auxiliaryContext;
-
-        bool m_constructorMode;
-        friend class ConstructorMode;
-
-        int m_recursionLevel;
-
-#ifndef NDEBUG
-        GlobalHandleMap m_globalHandleMap;
-        int m_internalScriptRecursionLevel;
-#endif
-        GCEventData m_gcEventData;
-
-        bool m_lowMemoryNotificationHint;
-    };
-
     class ConstructorMode {
     public:
         enum Mode {
@@ -269,32 +87,23 @@ namespace WebCore {
 
         ConstructorMode()
         {
-            V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
+            V8PerIsolateData* data = V8PerIsolateData::current();
             m_previous = data->m_constructorMode;
             data->m_constructorMode = WrapExistingObject;
         }
 
         ~ConstructorMode()
         {
-            V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
+            V8PerIsolateData* data = V8PerIsolateData::current();
             data->m_constructorMode = m_previous;
         }
 
-        static bool current() { return V8BindingPerIsolateData::current()->m_constructorMode; }
+        static bool current() { return V8PerIsolateData::current()->m_constructorMode; }
 
     private:
         bool m_previous;
     };
 
-
-    enum ExternalMode {
-        Externalize,
-        DoNotExternalize
-    };
-
-    template <typename StringType>
-    StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode external);
-
     // Since v8::Null(isolate) crashes if we pass a null isolate,
     // we need to use v8NullWithCheck(isolate) if an isolate can be null.
     //
@@ -304,23 +113,21 @@ namespace WebCore {
         return isolate ? v8::Null(isolate) : v8::Null();
     }
 
+    enum ExternalMode {
+        Externalize,
+        DoNotExternalize
+    };
+
+    template <typename StringType>
+    StringType v8StringToWebCoreString(v8::Handle<v8::String>, ExternalMode);
+
     // Convert v8 types to a WTF::String. If the V8 string is not already
     // an external string then it is transformed into an external string at this
     // point to avoid repeated conversions.
-    inline String v8StringToWebCoreString(v8::Handle<v8::String> v8String)
-    {
-        return v8StringToWebCoreString<String>(v8String, Externalize);
-    }
-    String v8NonStringValueToWebCoreString(v8::Handle<v8::Value>);
-    String v8ValueToWebCoreString(v8::Handle<v8::Value> value);
+    String v8ValueToWebCoreString(v8::Handle<v8::Value>);
 
-    // Convert v8 types to a WTF::AtomicString.
-    inline AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String> v8String)
-    {
-        return v8StringToWebCoreString<AtomicString>(v8String, Externalize);
-    }
-    AtomicString v8NonStringValueToAtomicWebCoreString(v8::Handle<v8::Value>);
-    AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> value);
+    // Convert a V8 value to a WTF::AtomicString.
+    AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value>);
 
     // Return a V8 external string that shares the underlying buffer with the given
     // WebCore string. The reference counting mechanism is used to keep the
@@ -331,7 +138,7 @@ namespace WebCore {
         if (!stringImpl)
             return isolate ? v8::String::Empty(isolate) : v8::String::Empty();
 
-        V8BindingPerIsolateData* data = V8BindingPerIsolateData::current(isolate);
+        V8PerIsolateData* data = V8PerIsolateData::current(isolate);
         return data->stringCache()->v8ExternalString(stringImpl, isolate);
     }
 
@@ -343,16 +150,21 @@ namespace WebCore {
 
     inline v8::Handle<v8::Integer> v8Integer(int value, v8::Isolate* isolate = 0)
     {
-        V8BindingPerIsolateData* data = V8BindingPerIsolateData::current(isolate);
+        V8PerIsolateData* data = V8PerIsolateData::current(isolate);
         return data->integerCache()->v8Integer(value);
     }
 
     inline v8::Handle<v8::Integer> v8UnsignedInteger(unsigned value, v8::Isolate* isolate = 0)
     {
-        V8BindingPerIsolateData* data = V8BindingPerIsolateData::current(isolate);
+        V8PerIsolateData* data = V8PerIsolateData::current(isolate);
         return data->integerCache()->v8UnsignedInteger(value);
     }
 
+    inline v8::Handle<v8::Value> v8Undefined()
+    {
+        return v8::Handle<v8::Value>();
+    }
+
     template <class T>
     struct V8ValueTraits {
         static inline v8::Handle<v8::Value> arrayV8Value(const T& value, v8::Isolate* isolate)
@@ -456,7 +268,7 @@ namespace WebCore {
     {
         if (!value->IsObject()) {
             V8Proxy::throwTypeError();
-            return v8::Local<v8::Value>();
+            return v8Undefined();
         }
 
         v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(value));
@@ -466,7 +278,7 @@ namespace WebCore {
 
         if (lengthValue->IsUndefined() || lengthValue->IsNull()) {
             V8Proxy::throwTypeError();
-            return v8::Local<v8::Value>();
+            return v8Undefined();
         }
 
         EXCEPTION_BLOCK(uint32_t, sequenceLength, lengthValue->Int32Value());
@@ -612,18 +424,6 @@ namespace WebCore {
 
     v8::Persistent<v8::FunctionTemplate> createRawTemplate();
 
-    struct BatchedAttribute;
-    struct BatchedCallback;
-
-    v8::Local<v8::Signature> configureTemplate(v8::Persistent<v8::FunctionTemplate>,
-                                               const char* interfaceName,
-                                               v8::Persistent<v8::FunctionTemplate> parentClass,
-                                               int fieldCount,
-                                               const BatchedAttribute*,
-                                               size_t attributeCount,
-                                               const BatchedCallback*,
-                                               size_t callbackCount);
-
     v8::Persistent<v8::String> getToStringName();
     v8::Persistent<v8::FunctionTemplate> getToStringTemplate();
 
@@ -727,11 +527,6 @@ namespace WebCore {
         return V8ParameterBase::prepareBase();
     }
 
-    enum ParameterDefaultPolicy {
-        DefaultIsUndefined,
-        DefaultIsNullString
-    };
-
 } // namespace WebCore
 
 #endif // V8Binding_h
diff --git a/Source/WebCore/bindings/v8/V8Helpers.cpp b/Source/WebCore/bindings/v8/V8BindingHelpers.cpp
index 755b0b44f..eeb1a934c 100644
--- a/Source/WebCore/bindings/v8/V8Helpers.cpp
+++ b/Source/WebCore/bindings/v8/V8BindingHelpers.cpp
@@ -29,7 +29,7 @@
 */
 
 #include "config.h"
-#include "V8Helpers.h"
+#include "V8BindingHelpers.h"
 
 #include "DOMWindow.h"
 #include "Frame.h"
@@ -51,7 +51,9 @@ V8Proxy* toV8Proxy(NPObject* npObject)
 {
     V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
     Frame* frame = object->rootObject->frame();
-    return V8Proxy::retrieve(frame);
+    if (!frame)
+        return 0;
+    return frame->script()->proxy();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8Helpers.h b/Source/WebCore/bindings/v8/V8BindingHelpers.h
index 43d765ad1..af5380cf8 100644
--- a/Source/WebCore/bindings/v8/V8Helpers.h
+++ b/Source/WebCore/bindings/v8/V8BindingHelpers.h
@@ -28,19 +28,20 @@
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 
-#ifndef V8Helpers_h
-#define V8Helpers_h
+#ifndef V8BindingHelpers_h
+#define V8BindingHelpers_h
 
 #include "npruntime_internal.h"
 #include <v8.h>
 
 namespace WebCore {
-    class V8Proxy;
 
-    v8::Local<v8::Context> toV8Context(NPP, NPObject*);
+class V8Proxy;
 
-    V8Proxy* toV8Proxy(NPObject*);
+v8::Local<v8::Context> toV8Context(NPP, NPObject*);
+
+V8Proxy* toV8Proxy(NPObject*);
 
 } // namespace WebCore
 
-#endif // V8Helpers_h
+#endif // V8BindingHelpers_h
diff --git a/Source/WebCore/bindings/v8/custom/V8BindingMacros.h b/Source/WebCore/bindings/v8/V8BindingMacros.h
index ce5170647..0e3802244 100644
--- a/Source/WebCore/bindings/v8/custom/V8BindingMacros.h
+++ b/Source/WebCore/bindings/v8/V8BindingMacros.h
@@ -28,6 +28,16 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#ifndef V8BindingMacros_h
+#define V8BindingMacros_h
+
+namespace WebCore {
+
+enum ParameterDefaultPolicy {
+    DefaultIsUndefined,
+    DefaultIsNullString
+};
+
 #define EXCEPTION_BLOCK(type, var, value) \
     type var;                             \
     {                                     \
@@ -49,3 +59,7 @@
 
 #define MAYBE_MISSING_PARAMETER(args, index, policy) \
     (((policy) == DefaultIsNullString && (index) >= (args).Length()) ? (v8::Local<v8::Value>()) : ((args)[(index)]))
+
+} // namespace WebCore
+
+#endif // V8BindingMacros_h
diff --git a/Source/WebCore/bindings/v8/V8Collection.h b/Source/WebCore/bindings/v8/V8Collection.h
index d8cdc81cc..ae542592a 100644
--- a/Source/WebCore/bindings/v8/V8Collection.h
+++ b/Source/WebCore/bindings/v8/V8Collection.h
@@ -45,7 +45,7 @@ namespace WebCore {
 template<class T> static v8::Handle<v8::Value> getV8Object(T* implementation, v8::Isolate* isolate)
 {
     if (!implementation)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     return toV8(implementation, isolate);
 }
 
@@ -74,9 +74,9 @@ template<class Collection, class ItemType> static v8::Handle<v8::Value> getNamed
 template<class Collection, class ItemType> static v8::Handle<v8::Value> collectionNamedPropertyGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     if (!info.Holder()->GetRealNamedPropertyInPrototypeChain(name).IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     if (info.Holder()->HasRealNamedCallbackProperty(name))
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     return getNamedPropertyOfCollection<Collection, ItemType>(name, info.Holder(), info.GetIsolate());
 }
@@ -129,13 +129,13 @@ template<class Collection> static v8::Handle<v8::Array> collectionIndexedPropert
 
 
 // A template for indexed getters on collections of strings that should return null if the resulting string is a null string.
-template<class Collection> static v8::Handle<v8::Value> collectionStringOrNullIndexedPropertyGetter(uint32_t index, const v8::AccessorInfo& info)
+template<class Collection> static v8::Handle<v8::Value> collectionStringOrUndefinedIndexedPropertyGetter(uint32_t index, const v8::AccessorInfo& info)
 {
     // FIXME: assert that object must be a collection type
     ASSERT(V8DOMWrapper::maybeDOMWrapper(info.Holder()));
     Collection* collection = toNativeCollection<Collection>(info.Holder());
     String result = collection->item(index);
-    return v8StringOrNull(result, info.GetIsolate());
+    return v8StringOrUndefined(result, info.GetIsolate());
 }
 
 
@@ -164,9 +164,9 @@ template<class Collection, class ItemType> static void setCollectionNamedGetter(
 }
 
 // Add indexed getter returning a string or null to a function template for a collection.
-template<class Collection> static void setCollectionStringOrNullIndexedGetter(v8::Handle<v8::FunctionTemplate> desc)
+template<class Collection> static void setCollectionStringOrUndefinedIndexedGetter(v8::Handle<v8::FunctionTemplate> desc)
 {
-    desc->InstanceTemplate()->SetIndexedPropertyHandler(collectionStringOrNullIndexedPropertyGetter<Collection>, 0, 0, 0, collectionIndexedPropertyEnumerator<Collection>);
+    desc->InstanceTemplate()->SetIndexedPropertyHandler(collectionStringOrUndefinedIndexedPropertyGetter<Collection>, 0, 0, 0, collectionIndexedPropertyEnumerator<Collection>);
 }
 
 
diff --git a/Source/WebCore/bindings/v8/V8DOMConfiguration.cpp b/Source/WebCore/bindings/v8/V8DOMConfiguration.cpp
new file mode 100644
index 000000000..6f0854f88
--- /dev/null
+++ b/Source/WebCore/bindings/v8/V8DOMConfiguration.cpp
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8DOMConfiguration.h"
+
+#include "V8Binding.h"
+
+namespace WebCore {
+
+void V8DOMConfiguration::batchConfigureAttributes(v8::Handle<v8::ObjectTemplate> instance, 
+                                                  v8::Handle<v8::ObjectTemplate> prototype, 
+                                                  const BatchedAttribute* attributes, 
+                                                  size_t attributeCount)
+{
+    for (size_t i = 0; i < attributeCount; ++i)
+        configureAttribute(instance, prototype, attributes[i]);
+}
+
+void V8DOMConfiguration::batchConfigureConstants(v8::Handle<v8::FunctionTemplate> functionDescriptor,
+                                                 v8::Handle<v8::ObjectTemplate> prototype,
+                                                 const BatchedConstant* constants,
+                                                 size_t constantCount)
+{
+    for (size_t i = 0; i < constantCount; ++i) {
+        const BatchedConstant* constant = &constants[i];
+        functionDescriptor->Set(v8::String::New(constant->name), v8Integer(constant->value), v8::ReadOnly);
+        prototype->Set(v8::String::New(constant->name), v8Integer(constant->value), v8::ReadOnly);
+    }
+}
+
+void V8DOMConfiguration::batchConfigureCallbacks(v8::Handle<v8::ObjectTemplate> prototype, 
+                                                 v8::Handle<v8::Signature> signature, 
+                                                 v8::PropertyAttribute attributes,
+                                                 const BatchedCallback* callbacks,
+                                                 size_t callbackCount)
+{
+    for (size_t i = 0; i < callbackCount; ++i)
+        prototype->Set(v8::String::New(callbacks[i].name), v8::FunctionTemplate::New(callbacks[i].callback, v8Undefined(), signature), attributes);
+}
+
+v8::Local<v8::Signature> V8DOMConfiguration::configureTemplate(v8::Persistent<v8::FunctionTemplate> functionDescriptor,
+                                                               const char* interfaceName,
+                                                               v8::Persistent<v8::FunctionTemplate> parentClass,
+                                                               size_t fieldCount,
+                                                               const BatchedAttribute* attributes, 
+                                                               size_t attributeCount,
+                                                               const BatchedCallback* callbacks,
+                                                               size_t callbackCount)
+{
+    functionDescriptor->SetClassName(v8::String::New(interfaceName));
+    v8::Local<v8::ObjectTemplate> instance = functionDescriptor->InstanceTemplate();
+    instance->SetInternalFieldCount(fieldCount);
+    if (!parentClass.IsEmpty())
+        functionDescriptor->Inherit(parentClass);
+    if (attributeCount)
+        batchConfigureAttributes(instance, functionDescriptor->PrototypeTemplate(), attributes, attributeCount);
+    v8::Local<v8::Signature> defaultSignature = v8::Signature::New(functionDescriptor);
+    if (callbackCount)
+        batchConfigureCallbacks(functionDescriptor->PrototypeTemplate(), defaultSignature, static_cast<v8::PropertyAttribute>(v8::DontDelete), callbacks, callbackCount);
+    return defaultSignature;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8DOMConfiguration.h b/Source/WebCore/bindings/v8/V8DOMConfiguration.h
new file mode 100644
index 000000000..c37e697fe
--- /dev/null
+++ b/Source/WebCore/bindings/v8/V8DOMConfiguration.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef V8DOMConfiguration_h
+#define V8DOMConfiguration_h
+
+#include "V8DOMWrapper.h"
+#include <v8.h>
+
+namespace WebCore {
+
+class V8DOMConfiguration {
+public:
+    // The following Batch structs and methods are used for setting multiple
+    // properties on an ObjectTemplate, used from the generated bindings
+    // initialization (ConfigureXXXTemplate). This greatly reduces the binary
+    // size by moving from code driven setup to data table driven setup.
+
+    // BatchedAttribute translates into calls to SetAccessor() on either the
+    // instance or the prototype ObjectTemplate, based on |onPrototype|.
+    struct BatchedAttribute {
+        const char* const name;
+        v8::AccessorGetter getter;
+        v8::AccessorSetter setter;
+        WrapperTypeInfo* data;
+        v8::AccessControl settings;
+        v8::PropertyAttribute attribute;
+        bool onPrototype;
+    };
+
+    static void batchConfigureAttributes(v8::Handle<v8::ObjectTemplate>,
+                                         v8::Handle<v8::ObjectTemplate>,
+                                         const BatchedAttribute*,
+                                         size_t attributeCount);
+
+    template<class ObjectOrTemplate>
+    static inline void configureAttribute(v8::Handle<ObjectOrTemplate> instance,
+                                          v8::Handle<ObjectOrTemplate> prototype,
+                                          const BatchedAttribute& attribute)
+    {
+        (attribute.onPrototype ? prototype : instance)->SetAccessor(v8::String::New(attribute.name),
+                                                                    attribute.getter,
+                                                                    attribute.setter,
+                                                                    v8::External::Wrap(attribute.data),
+                                                                    attribute.settings,
+                                                                    attribute.attribute);
+    }
+
+    // BatchedConstant translates into calls to Set() for setting up an object's
+    // constants. It sets the constant on both the FunctionTemplate and the
+    // ObjectTemplate. PropertyAttributes is always ReadOnly.
+    struct BatchedConstant {
+        const char* const name;
+        int value;
+    };
+
+    static void batchConfigureConstants(v8::Handle<v8::FunctionTemplate>,
+                                        v8::Handle<v8::ObjectTemplate>,
+                                        const BatchedConstant*,
+                                        size_t constantCount);
+
+    // BatchedCallback translates into calls to Set() on the prototype ObjectTemplate.
+    struct BatchedCallback {
+        const char* const name;
+        v8::InvocationCallback callback;
+    };
+
+    static void batchConfigureCallbacks(v8::Handle<v8::ObjectTemplate>, 
+                                        v8::Handle<v8::Signature>,
+                                        v8::PropertyAttribute,
+                                        const BatchedCallback*, 
+                                        size_t callbackCount);
+
+    static v8::Local<v8::Signature> configureTemplate(v8::Persistent<v8::FunctionTemplate>,
+                                                      const char* interfaceName,
+                                                      v8::Persistent<v8::FunctionTemplate> parentClass,
+                                                      size_t fieldCount,
+                                                      const BatchedAttribute*,
+                                                      size_t attributeCount,
+                                                      const BatchedCallback*,
+                                                      size_t callbackCount);
+};
+
+} // namespace WebCore
+
+#endif // V8DOMConfiguration_h
diff --git a/Source/WebCore/bindings/v8/V8DOMMap.cpp b/Source/WebCore/bindings/v8/V8DOMMap.cpp
index 0b10cb0c6..dd18d63b0 100644
--- a/Source/WebCore/bindings/v8/V8DOMMap.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMMap.cpp
@@ -42,12 +42,12 @@ namespace WebCore {
 DOMDataStoreHandle::DOMDataStoreHandle()
     : m_store(adoptPtr(new ScopedDOMDataStore()))
 {
-    V8BindingPerIsolateData::current()->registerDOMDataStore(m_store.get());
+    V8PerIsolateData::current()->registerDOMDataStore(m_store.get());
 }
 
 DOMDataStoreHandle::~DOMDataStoreHandle()
 {
-    V8BindingPerIsolateData::current()->unregisterDOMDataStore(m_store.get());
+    V8PerIsolateData::current()->unregisterDOMDataStore(m_store.get());
 }
 
 DOMNodeMapping& getDOMNodeMap(v8::Isolate* isolate)
diff --git a/Source/WebCore/bindings/v8/V8DOMMap.h b/Source/WebCore/bindings/v8/V8DOMMap.h
index 4de35585d..bf0e603c3 100644
--- a/Source/WebCore/bindings/v8/V8DOMMap.h
+++ b/Source/WebCore/bindings/v8/V8DOMMap.h
@@ -136,7 +136,7 @@ namespace WebCore {
 
         virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const OVERRIDE
         {
-            MemoryClassInfo<WeakReferenceMap<KeyType, ValueType> > info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
+            MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
             info.addHashMap(m_map);
         }
 
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index 056239b4f..7f7903112 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -31,7 +31,8 @@
 #include "config.h"
 #include "V8DOMWindowShell.h"
 
-#include "PlatformSupport.h"
+#include "BindingState.h"
+#include "ContentSecurityPolicy.h"
 #include "DateExtension.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
@@ -39,6 +40,7 @@
 #include "MemoryUsageSupport.h"
 #include "Page.h"
 #include "PageGroup.h"
+#include "PlatformSupport.h"
 #include "RuntimeEnabledFeatures.h"
 #include "SafeAllocation.h"
 #include "ScriptCallStack.h"
@@ -48,8 +50,6 @@
 #include "StorageNamespace.h"
 #include "StylePropertySet.h"
 #include "V8Binding.h"
-#include "V8BindingPerContextData.h"
-#include "V8BindingState.h"
 #include "V8Collection.h"
 #include "V8DOMMap.h"
 #include "V8DOMWindow.h"
@@ -59,6 +59,7 @@
 #include "V8HiddenPropertyName.h"
 #include "V8History.h"
 #include "V8Location.h"
+#include "V8PerContextData.h"
 #include "V8Proxy.h"
 #include "WorkerContextExecutionProxy.h"
 
@@ -104,7 +105,7 @@ static void reportFatalErrorInV8(const char* location, const char* message)
 static void v8UncaughtExceptionHandler(v8::Handle<v8::Message> message, v8::Handle<v8::Value> data)
 {
     // Use the frame where JavaScript is called from.
-    Frame* frame = V8Proxy::retrieveFrameForEnteredContext();
+    Frame* frame = firstFrame(BindingState::instance());
     if (!frame)
         return;
 
@@ -152,7 +153,7 @@ static void reportUnsafeJavaScriptAccess(v8::Local<v8::Object> host, v8::AccessT
 {
     Frame* target = getTargetFrame(host, data);
     if (target)
-        V8Proxy::reportUnsafeAccessTo(target);
+        V8Proxy::reportUnsafeAccessTo(target->document());
 }
 
 PassRefPtr<V8DOMWindowShell> V8DOMWindowShell::create(Frame* frame)
@@ -298,7 +299,11 @@ bool V8DOMWindowShell::initContextIfNeeded()
 #if ENABLE(JAVASCRIPT_DEBUGGER)
         ScriptProfiler::initialize();
 #endif
-        V8BindingPerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
+        V8PerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
+
+        // FIXME: Remove the following 2 lines when V8 default has changed.
+        const char es5ReadonlyFlag[] = "--es5_readonly";
+        v8::V8::SetFlagsFromString(es5ReadonlyFlag, sizeof(es5ReadonlyFlag));
 
         isV8Initialized = true;
     }
@@ -323,7 +328,7 @@ bool V8DOMWindowShell::initContextIfNeeded()
 #endif
     }
 
-    m_perContextData = V8BindingPerContextData::create(m_context);
+    m_perContextData = V8PerContextData::create(m_context);
     if (!m_perContextData->init()) {
         disposeContextHandles();
         return false;
@@ -338,6 +343,9 @@ bool V8DOMWindowShell::initContextIfNeeded()
 
     setSecurityToken();
 
+    if (m_frame->document())
+        v8Context->AllowCodeGenerationFromStrings(m_frame->document()->contentSecurityPolicy()->allowEval(0, ContentSecurityPolicy::SuppressReport));
+
     m_frame->loader()->client()->didCreateScriptContext(m_context, 0, 0);
 
     // FIXME: This is wrong. We should actually do this for the proper world once
@@ -362,13 +370,12 @@ v8::Persistent<v8::Context> V8DOMWindowShell::createNewContext(v8::Handle<v8::Ob
         return result;
 
     // Used to avoid sleep calls in unload handlers.
-    if (!V8Proxy::registeredExtensionWithV8(DateExtension::get()))
-        V8Proxy::registerExtension(DateExtension::get());
+    V8Proxy::registerExtensionIfNeeded(DateExtension::get());
 
 #if ENABLE(JAVASCRIPT_I18N_API)
     // Enables experimental i18n API in V8.
-    if (RuntimeEnabledFeatures::javaScriptI18NAPIEnabled() && !V8Proxy::registeredExtensionWithV8(v8_i18n::Extension::get()))
-        V8Proxy::registerExtension(v8_i18n::Extension::get());
+    if (RuntimeEnabledFeatures::javaScriptI18NAPIEnabled())
+        V8Proxy::registerExtensionIfNeeded(v8_i18n::Extension::get());
 #endif
 
     // Dynamically tell v8 about our extensions now.
@@ -413,7 +420,7 @@ bool V8DOMWindowShell::installDOMWindow(v8::Handle<v8::Context> context, DOMWind
     // Wrap the window.
     V8DOMWrapper::setDOMWrapper(jsWindow, &V8DOMWindow::info, window);
     V8DOMWrapper::setDOMWrapper(v8::Handle<v8::Object>::Cast(jsWindow->GetPrototype()), &V8DOMWindow::info, window);
-    V8DOMWrapper::setJSWrapperForDOMObject(PassRefPtr<DOMWindow>(window), v8::Persistent<v8::Object>::New(jsWindow));
+    V8DOMWrapper::setJSWrapperForDOMObject(PassRefPtr<DOMWindow>(window), jsWindow);
 
     // Insert the window instance as the prototype of the shadow object.
     v8::Handle<v8::Object> v8RealGlobal = v8::Handle<v8::Object>::Cast(context->Global()->GetPrototype());
@@ -549,7 +556,7 @@ void V8DOMWindowShell::updateDocument()
 v8::Handle<v8::Value> getter(v8::Local<v8::String> property, const v8::AccessorInfo& info)
 {
     // FIXME(antonm): consider passing AtomicStringImpl directly.
-    AtomicString name = v8StringToAtomicWebCoreString(property);
+    AtomicString name = v8ValueToAtomicWebCoreString(property);
     HTMLDocument* htmlDocument = V8HTMLDocument::toNative(info.Holder());
     ASSERT(htmlDocument);
     v8::Handle<v8::Value> result = V8HTMLDocument::GetNamedProperty(htmlDocument, name, info.GetIsolate());
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.h b/Source/WebCore/bindings/v8/V8DOMWindowShell.h
index 0676f1450..b25bbfc48 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.h
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.h
@@ -31,7 +31,7 @@
 #ifndef V8DOMWindowShell_h
 #define V8DOMWindowShell_h
 
-#include "V8BindingPerContextData.h"
+#include "V8PerContextData.h"
 #include "WrapperTypeInfo.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -78,7 +78,7 @@ public:
 
     void destroyGlobal();
 
-    V8BindingPerContextData* perContextData() { return m_perContextData.get(); }
+    V8PerContextData* perContextData() { return m_perContextData.get(); }
 
 private:
     V8DOMWindowShell(Frame*);
@@ -97,7 +97,7 @@ private:
 
     Frame* m_frame;
 
-    OwnPtr<V8BindingPerContextData> m_perContextData;
+    OwnPtr<V8PerContextData> m_perContextData;
 
     v8::Persistent<v8::Context> m_context;
     v8::Persistent<v8::Object> m_global;
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
index f595fe4f8..922c96a8a 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -35,12 +35,12 @@
 #include "DocumentLoader.h"
 #include "EventTargetHeaders.h"
 #include "EventTargetInterfaces.h"
+#include "Frame.h"
 #include "FrameLoaderClient.h"
 #include "SafeAllocation.h"
 #include "StylePropertySet.h"
 #include "V8AbstractEventListener.h"
 #include "V8Binding.h"
-#include "V8BindingPerContextData.h"
 #include "V8Collection.h"
 #include "V8EventListener.h"
 #include "V8EventListenerList.h"
@@ -51,6 +51,7 @@
 #include "V8NamedNodeMap.h"
 #include "V8NodeFilterCondition.h"
 #include "V8NodeList.h"
+#include "V8PerContextData.h"
 #include "V8Proxy.h"
 #include "V8StyleSheet.h"
 #include "V8WorkerContextEventListener.h"
@@ -70,18 +71,22 @@
 
 namespace WebCore {
 
-void V8DOMWrapper::setJSWrapperForDOMNode(PassRefPtr<Node> node, v8::Persistent<v8::Object> wrapper, v8::Isolate* isolate)
+v8::Persistent<v8::Object> V8DOMWrapper::setJSWrapperForDOMNode(PassRefPtr<Node> node, v8::Handle<v8::Object> wrapper, v8::Isolate* isolate)
 {
-    ASSERT(maybeDOMWrapper(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+    ASSERT(maybeDOMWrapper(wrapperHandle));
     ASSERT(!node->isActiveNode());
-    getDOMNodeMap(isolate).set(node.leakRef(), wrapper);
+    getDOMNodeMap(isolate).set(node.leakRef(), wrapperHandle);
+    return wrapperHandle;
 }
 
-void V8DOMWrapper::setJSWrapperForActiveDOMNode(PassRefPtr<Node> node, v8::Persistent<v8::Object> wrapper, v8::Isolate* isolate)
+v8::Persistent<v8::Object> V8DOMWrapper::setJSWrapperForActiveDOMNode(PassRefPtr<Node> node, v8::Handle<v8::Object> wrapper, v8::Isolate* isolate)
 {
-    ASSERT(maybeDOMWrapper(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+    ASSERT(maybeDOMWrapper(wrapperHandle));
     ASSERT(node->isActiveNode());
-    getActiveDOMNodeMap(isolate).set(node.leakRef(), wrapper);
+    getActiveDOMNodeMap(isolate).set(node.leakRef(), wrapperHandle);
+    return wrapperHandle;
 }
 
 v8::Local<v8::Function> V8DOMWrapper::constructorForType(WrapperTypeInfo* type, DOMWindow* window)
@@ -90,7 +95,7 @@ v8::Local<v8::Function> V8DOMWrapper::constructorForType(WrapperTypeInfo* type,
     if (!frame)
         return v8::Local<v8::Function>();
 
-    if (V8BindingPerContextData* contextData = V8Proxy::retrievePerContextData(frame))
+    if (V8PerContextData* contextData = V8Proxy::retrievePerContextData(frame))
         return contextData->constructorForType(type);
 
     return v8::Local<v8::Function>();
@@ -105,14 +110,14 @@ v8::Local<v8::Function> V8DOMWrapper::constructorForType(WrapperTypeInfo* type,
 }
 #endif
 
-V8BindingPerContextData* V8DOMWrapper::perContextData(V8Proxy* proxy)
+V8PerContextData* V8DOMWrapper::perContextData(V8Proxy* proxy)
 {
     V8DOMWindowShell* shell = proxy->windowShell();
     return shell ? shell->perContextData() : 0;
 }
 
 #if ENABLE(WORKERS)
-V8BindingPerContextData* V8DOMWrapper::perContextData(WorkerContext*)
+V8PerContextData* V8DOMWrapper::perContextData(WorkerContext*)
 {
     WorkerScriptController* controller = WorkerScriptController::controllerForContext();
     WorkerContextExecutionProxy* proxy = controller ? controller->proxy() : 0;
@@ -166,7 +171,7 @@ v8::Local<v8::Object> V8DOMWrapper::instantiateV8Object(V8Proxy* proxy, WrapperT
 #if ENABLE(WORKERS)
     WorkerContext* workerContext = 0;
 #endif
-    V8BindingPerContextData* contextData = 0;
+    V8PerContextData* contextData = 0;
     V8IsolatedContext* isolatedContext;
     if (UNLIKELY(!!(isolatedContext = V8IsolatedContext::getEntered()))) {
         contextData = isolatedContext->perContextData();
@@ -177,7 +182,7 @@ v8::Local<v8::Object> V8DOMWrapper::instantiateV8Object(V8Proxy* proxy, WrapperT
             if (isWrapperOfType(globalPrototype, &V8DOMWindow::info)) {
                 Frame* frame = V8DOMWindow::toNative(globalPrototype)->frame();
                 if (frame && frame->script()->canExecuteScripts(NotAboutToExecuteScript))
-                    proxy = V8Proxy::retrieve(frame);
+                    proxy = frame->script()->proxy();
             }
 #if ENABLE(WORKERS)
             else if (isWrapperOfType(globalPrototype, &V8WorkerContext::info))
@@ -268,7 +273,7 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* ta
     DOM_EVENT_TARGET_INTERFACES_FOR_EACH(TRY_TO_WRAP_WITH_INTERFACE)
 
     ASSERT_NOT_REACHED();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.h b/Source/WebCore/bindings/v8/V8DOMWrapper.h
index d0048c4af..d9e8059e4 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.h
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.h
@@ -52,7 +52,7 @@ namespace WebCore {
     class EventTarget;
     class Frame;
     class Node;
-    class V8BindingPerContextData;
+    class V8PerContextData;
     class V8Proxy;
     class WorkerContext;
     class XPathResolver;
@@ -104,10 +104,12 @@ namespace WebCore {
         static v8::Local<v8::Function> constructorForType(WrapperTypeInfo*, WorkerContext*);
 #endif
 
-        template<typename T> static void setJSWrapperForDOMObject(PassRefPtr<T>, v8::Persistent<v8::Object>, v8::Isolate* = 0);
-        template<typename T> static void setJSWrapperForActiveDOMObject(PassRefPtr<T>, v8::Persistent<v8::Object>, v8::Isolate* = 0);
-        static void setJSWrapperForDOMNode(PassRefPtr<Node>, v8::Persistent<v8::Object>, v8::Isolate* = 0);
-        static void setJSWrapperForActiveDOMNode(PassRefPtr<Node>, v8::Persistent<v8::Object>, v8::Isolate* = 0);
+        template<typename T>
+        static v8::Persistent<v8::Object> setJSWrapperForDOMObject(PassRefPtr<T>, v8::Handle<v8::Object>, v8::Isolate* = 0);
+        template<typename T>
+        static v8::Persistent<v8::Object> setJSWrapperForActiveDOMObject(PassRefPtr<T>, v8::Handle<v8::Object>, v8::Isolate* = 0);
+        static v8::Persistent<v8::Object> setJSWrapperForDOMNode(PassRefPtr<Node>, v8::Handle<v8::Object>, v8::Isolate* = 0);
+        static v8::Persistent<v8::Object> setJSWrapperForActiveDOMNode(PassRefPtr<Node>, v8::Handle<v8::Object>, v8::Isolate* = 0);
 
         static bool isValidDOMObject(v8::Handle<v8::Value>);
 
@@ -146,26 +148,30 @@ namespace WebCore {
             return domNodeMap.get(node);
         }
     private:
-        static V8BindingPerContextData* perContextData(V8Proxy*);
+        static V8PerContextData* perContextData(V8Proxy*);
 #if ENABLE(WORKERS)
-        static V8BindingPerContextData* perContextData(WorkerContext*);
+        static V8PerContextData* perContextData(WorkerContext*);
 #endif
     };
 
     template<typename T>
-    void V8DOMWrapper::setJSWrapperForDOMObject(PassRefPtr<T> object, v8::Persistent<v8::Object> wrapper, v8::Isolate* isolate)
+    v8::Persistent<v8::Object> V8DOMWrapper::setJSWrapperForDOMObject(PassRefPtr<T> object, v8::Handle<v8::Object> wrapper, v8::Isolate* isolate)
     {
-        ASSERT(maybeDOMWrapper(wrapper));
-        ASSERT(!domWrapperType(wrapper)->toActiveDOMObjectFunction);
-        getDOMObjectMap(isolate).set(object.leakRef(), wrapper);
+        v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+        ASSERT(maybeDOMWrapper(wrapperHandle));
+        ASSERT(!domWrapperType(wrapperHandle)->toActiveDOMObjectFunction);
+        getDOMObjectMap(isolate).set(object.leakRef(), wrapperHandle);
+        return wrapperHandle;
     }
 
     template<typename T>
-    void V8DOMWrapper::setJSWrapperForActiveDOMObject(PassRefPtr<T> object, v8::Persistent<v8::Object> wrapper, v8::Isolate* isolate)
+    v8::Persistent<v8::Object> V8DOMWrapper::setJSWrapperForActiveDOMObject(PassRefPtr<T> object, v8::Handle<v8::Object> wrapper, v8::Isolate* isolate)
     {
-        ASSERT(maybeDOMWrapper(wrapper));
-        ASSERT(domWrapperType(wrapper)->toActiveDOMObjectFunction);
-        getActiveDOMObjectMap(isolate).set(object.leakRef(), wrapper);
+        v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+        ASSERT(maybeDOMWrapper(wrapperHandle));
+        ASSERT(domWrapperType(wrapperHandle)->toActiveDOMObjectFunction);
+        getActiveDOMObjectMap(isolate).set(object.leakRef(), wrapperHandle);
+        return wrapperHandle;
     }
 }
 
diff --git a/Source/WebCore/bindings/v8/V8EventListener.cpp b/Source/WebCore/bindings/v8/V8EventListener.cpp
index b04f1695a..3d6ff74e3 100644
--- a/Source/WebCore/bindings/v8/V8EventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8EventListener.cpp
@@ -79,13 +79,21 @@ v8::Local<v8::Value> V8EventListener::callListenerFunction(ScriptExecutionContex
 
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
 
-    if (V8Proxy* proxy = V8Proxy::retrieve(context)) {
-        Frame* frame = static_cast<Document*>(context)->frame();
-        if (frame->script()->canExecuteScripts(AboutToExecuteScript))
-            return proxy->callFunction(handlerFunction, receiver, 1, parameters);
-    }
+    // FIXME: Can |context| be 0 here?
+    if (!context)
+        return v8::Local<v8::Value>();
+
+    if (!context->isDocument())
+        return v8::Local<v8::Value>();
+
+    Frame* frame = static_cast<Document*>(context)->frame();
+    if (!frame)
+        return v8::Local<v8::Value>();
+
+    if (!frame->script()->canExecuteScripts(AboutToExecuteScript))
+        return v8::Local<v8::Value>();
 
-    return v8::Local<v8::Value>();
+    return frame->script()->proxy()->callFunction(handlerFunction, receiver, 1, parameters);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8GCController.cpp b/Source/WebCore/bindings/v8/V8GCController.cpp
index 65182a7ec..4c3d57428 100644
--- a/Source/WebCore/bindings/v8/V8GCController.cpp
+++ b/Source/WebCore/bindings/v8/V8GCController.cpp
@@ -89,7 +89,7 @@ namespace WebCore {
 
 static GlobalHandleMap& currentGlobalHandleMap()
 {
-    return V8BindingPerIsolateData::current()->globalHandleMap();
+    return V8PerIsolateData::current()->globalHandleMap();
 }
 
 // The function is the place to set the break point to inspect
@@ -418,7 +418,7 @@ void V8GCController::gcPrologue()
     grouperVisitor.applyGrouping();
 
     // Clean single element cache for string conversions.
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
+    V8PerIsolateData* data = V8PerIsolateData::current();
     data->stringCache()->clearOnGC();
 }
 
diff --git a/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp b/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp
index 901fa5e44..fdddafbae 100644
--- a/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp
+++ b/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp
@@ -46,7 +46,7 @@ namespace WebCore {
 #define V8_DEFINE_HIDDEN_PROPERTY(name) \
 v8::Handle<v8::String> V8HiddenPropertyName::name() \
 { \
-    V8HiddenPropertyName* hiddenPropertyName = V8BindingPerIsolateData::current()->hiddenPropertyName(); \
+    V8HiddenPropertyName* hiddenPropertyName = V8PerIsolateData::current()->hiddenPropertyName(); \
     if (hiddenPropertyName->m_##name.IsEmpty()) { \
         hiddenPropertyName->m_##name = createString(V8_HIDDEN_PROPERTY_PREFIX V8_AS_STRING(name)); \
     } \
diff --git a/Source/WebCore/bindings/v8/V8IsolatedContext.cpp b/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
index 6cf654328..a60013995 100644
--- a/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
+++ b/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
@@ -36,8 +36,8 @@
 #include "FrameLoaderClient.h"
 #include "InspectorInstrumentation.h"
 #include "SecurityOrigin.h"
-#include "V8BindingPerContextData.h"
 #include "V8DOMWindow.h"
+#include "V8PerContextData.h"
 #include "V8Proxy.h"
 #include <wtf/StringExtras.h>
 
@@ -87,7 +87,7 @@ V8IsolatedContext::V8IsolatedContext(V8Proxy* proxy, int extensionGroup, int wor
 
     getGlobalObject(m_context->get())->SetPointerInInternalField(V8DOMWindow::enteredIsolatedWorldIndex, this);
 
-    m_perContextData = V8BindingPerContextData::create(m_context->get());
+    m_perContextData = V8PerContextData::create(m_context->get());
     m_perContextData->init();
 
     // FIXME: This will go away once we have a windowShell for the isolated world.
diff --git a/Source/WebCore/bindings/v8/V8IsolatedContext.h b/Source/WebCore/bindings/v8/V8IsolatedContext.h
index 9bfe8b10b..ecd3f6e27 100644
--- a/Source/WebCore/bindings/v8/V8IsolatedContext.h
+++ b/Source/WebCore/bindings/v8/V8IsolatedContext.h
@@ -40,7 +40,7 @@
 namespace WebCore {
 
 class SecurityOrigin;
-class V8BindingPerContextData;
+class V8PerContextData;
 class V8Proxy;
 
 // V8IsolatedContext
@@ -97,7 +97,7 @@ public:
     SecurityOrigin* securityOrigin() const { return m_securityOrigin.get(); }
     void setSecurityOrigin(PassRefPtr<SecurityOrigin>);
 
-    V8BindingPerContextData* perContextData() { return m_perContextData.get(); }
+    V8PerContextData* perContextData() { return m_perContextData.get(); }
 
 private:
     static v8::Handle<v8::Object> getGlobalObject(v8::Handle<v8::Context> context)
@@ -121,7 +121,7 @@ private:
 
     Frame* m_frame;
 
-    OwnPtr<V8BindingPerContextData> m_perContextData;
+    OwnPtr<V8PerContextData> m_perContextData;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
index eb0522f27..9f5e41c5b 100644
--- a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -86,13 +86,21 @@ v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(ScriptExecutionCo
 
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
 
-    if (V8Proxy* proxy = V8Proxy::retrieve(context)) {
-        Frame* frame = static_cast<Document*>(context)->frame();
-        if (frame->script()->canExecuteScripts(AboutToExecuteScript))
-            return proxy->callFunction(handlerFunction, receiver, 1, parameters);
-    }
+    // FIXME: Can |context| be 0 here?
+    if (!context)
+        return v8::Local<v8::Value>();
+
+    if (!context->isDocument())
+        return v8::Local<v8::Value>();
+
+    Frame* frame = static_cast<Document*>(context)->frame();
+    if (!frame)
+        return v8::Local<v8::Value>();
+
+    if (!frame->script()->canExecuteScripts(AboutToExecuteScript))
+        return v8::Local<v8::Value>();
 
-    return v8::Local<v8::Value>();
+    return frame->script()->proxy()->callFunction(handlerFunction, receiver, 1, parameters);
 }
 
 static v8::Handle<v8::Value> V8LazyEventListenerToString(const v8::Arguments& args)
@@ -110,15 +118,13 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
 
     v8::HandleScope handleScope;
 
-    V8Proxy* proxy = V8Proxy::retrieve(context);
-    if (!proxy)
-        return;
     ASSERT(context->isDocument());
-    if (!static_cast<Document*>(context)->frame()->script()->canExecuteScripts(NotAboutToExecuteScript))
+    Frame* frame = static_cast<Document*>(context)->frame();
+    ASSERT(frame);
+    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
         return;
-
     // Use the outer scope to hold context.
-    v8::Local<v8::Context> v8Context = worldContext().adjustedContext(proxy);
+    v8::Local<v8::Context> v8Context = worldContext().adjustedContext(frame->script()->proxy());
     // Bail out if we cannot get the context.
     if (v8Context.IsEmpty())
         return;
@@ -207,7 +213,7 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
     // other use. That fails miserably if the actual wrapper source is
     // returned.
     v8::Persistent<v8::FunctionTemplate>& toStringTemplate =
-        V8BindingPerIsolateData::current()->lazyEventListenerToStringTemplate();
+        V8PerIsolateData::current()->lazyEventListenerToStringTemplate();
     if (toStringTemplate.IsEmpty())
         toStringTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8LazyEventListenerToString));
     v8::Local<v8::Function> toStringFunction;
diff --git a/Source/WebCore/bindings/v8/V8NPObject.cpp b/Source/WebCore/bindings/v8/V8NPObject.cpp
index d480e3e69..3fee790f4 100644
--- a/Source/WebCore/bindings/v8/V8NPObject.cpp
+++ b/Source/WebCore/bindings/v8/V8NPObject.cpp
@@ -40,7 +40,6 @@
 #include "V8HTMLAppletElement.h"
 #include "V8HTMLEmbedElement.h"
 #include "V8HTMLObjectElement.h"
-#include "V8Helpers.h"
 #include "V8NPUtils.h"
 #include "V8Proxy.h"
 #include "npruntime_impl.h"
@@ -200,7 +199,7 @@ static v8::Handle<v8::Value> npObjectGetProperty(v8::Local<v8::Object> self, NPI
         NPVariant result;
         VOID_TO_NPVARIANT(result);
         if (!npObject->_class->getProperty(npObject, identifier, &result))
-            return v8::Handle<v8::Value>();
+            return v8Undefined();
 
         v8::Handle<v8::Value> returnValue;
         if (_NPN_IsAlive(npObject))
@@ -234,7 +233,7 @@ static v8::Handle<v8::Value> npObjectGetProperty(v8::Local<v8::Object> self, NPI
         return v8Function;
     }
 
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 v8::Handle<v8::Value> npObjectNamedPropertyGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
@@ -289,7 +288,7 @@ static v8::Handle<v8::Value> npObjectSetProperty(v8::Local<v8::Object> self, NPI
         if (success)
             return value; // Intercept the call.
     }
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 
diff --git a/Source/WebCore/bindings/v8/V8NPUtils.cpp b/Source/WebCore/bindings/v8/V8NPUtils.cpp
index 89b12e836..5a626d9ce 100644
--- a/Source/WebCore/bindings/v8/V8NPUtils.cpp
+++ b/Source/WebCore/bindings/v8/V8NPUtils.cpp
@@ -69,7 +69,7 @@ void convertV8ObjectToNPVariant(v8::Local<v8::Value> object, NPObject* owner, NP
         str->WriteUtf8(utf8Chars, length, 0, v8::String::HINT_MANY_WRITES_EXPECTED);
         STRINGN_TO_NPVARIANT(utf8Chars, length-1, *result);
     } else if (object->IsObject()) {
-        DOMWindow* window = V8Proxy::retrieveWindow(V8Proxy::currentContext());
+        DOMWindow* window = V8Proxy::retrieveWindow(v8::Context::GetCurrent());
         NPObject* npobject = npCreateV8ScriptObject(0, v8::Handle<v8::Object>::Cast(object), window);
         if (npobject)
             _NPN_RegisterObject(npobject, owner);
diff --git a/Source/WebCore/bindings/v8/V8BindingPerContextData.cpp b/Source/WebCore/bindings/v8/V8PerContextData.cpp
index ffcaf4cac..b2d750a7a 100644
--- a/Source/WebCore/bindings/v8/V8BindingPerContextData.cpp
+++ b/Source/WebCore/bindings/v8/V8PerContextData.cpp
@@ -29,13 +29,13 @@
  */
 
 #include "config.h"
-#include "V8BindingPerContextData.h"
+#include "V8PerContextData.h"
 
 #include "SafeAllocation.h"
 
 namespace WebCore {
 
-void V8BindingPerContextData::dispose()
+void V8PerContextData::dispose()
 {
     {
         WrapperBoilerplateMap::iterator it = m_wrapperBoilerplates.begin();
@@ -71,7 +71,7 @@ void V8BindingPerContextData::dispose()
     m_##name##Prototype.set(prototypeValue); \
 }
 
-bool V8BindingPerContextData::init()
+bool V8PerContextData::init()
 {
     v8::Handle<v8::String> prototypeString = v8::String::NewSymbol("prototype");
     if (prototypeString.IsEmpty())
@@ -85,7 +85,7 @@ bool V8BindingPerContextData::init()
 
 #undef V8_STORE_PRIMORDIAL
 
-v8::Local<v8::Object> V8BindingPerContextData::createWrapperFromCacheSlowCase(WrapperTypeInfo* type)
+v8::Local<v8::Object> V8PerContextData::createWrapperFromCacheSlowCase(WrapperTypeInfo* type)
 {
     ASSERT(!m_errorPrototype.get().IsEmpty());
     ASSERT(!m_objectPrototype.get().IsEmpty());
@@ -100,7 +100,7 @@ v8::Local<v8::Object> V8BindingPerContextData::createWrapperFromCacheSlowCase(Wr
     return v8::Local<v8::Object>();
 }
 
-v8::Local<v8::Function> V8BindingPerContextData::constructorForTypeSlowCase(WrapperTypeInfo* type)
+v8::Local<v8::Function> V8PerContextData::constructorForTypeSlowCase(WrapperTypeInfo* type)
 {
     ASSERT(!m_errorPrototype.get().IsEmpty());
     ASSERT(!m_objectPrototype.get().IsEmpty());
@@ -117,7 +117,7 @@ v8::Local<v8::Function> V8BindingPerContextData::constructorForTypeSlowCase(Wrap
 
     if (type->wrapperTypePrototype == WrapperTypeErrorPrototype) {
         v8::Local<v8::Value> prototypeValue = function->Get(v8::String::NewSymbol("prototype"));
-        if (prototypeValue->IsObject())
+        if (!prototypeValue.IsEmpty() && prototypeValue->IsObject())
             v8::Local<v8::Object>::Cast(prototypeValue)->SetPrototype(m_errorPrototype.get());
     }
 
diff --git a/Source/WebCore/bindings/v8/V8BindingPerContextData.h b/Source/WebCore/bindings/v8/V8PerContextData.h
index 5e9354b12..c8cd6a5c6 100644
--- a/Source/WebCore/bindings/v8/V8BindingPerContextData.h
+++ b/Source/WebCore/bindings/v8/V8PerContextData.h
@@ -28,8 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8BindingPerContextData_h
-#define V8BindingPerContextData_h
+#ifndef V8PerContextData_h
+#define V8PerContextData_h
 
 #include "OwnHandle.h"
 #include "WrapperTypeInfo.h"
@@ -39,14 +39,14 @@
 
 namespace WebCore {
 
-class V8BindingPerContextData {
+class V8PerContextData {
 public:
-    static PassOwnPtr<V8BindingPerContextData> create(v8::Handle<v8::Context> context)
+    static PassOwnPtr<V8PerContextData> create(v8::Handle<v8::Context> context)
     {
-        return adoptPtr(new V8BindingPerContextData(context));
+        return adoptPtr(new V8PerContextData(context));
     }
 
-    ~V8BindingPerContextData()
+    ~V8PerContextData()
     {
         dispose();
     }
@@ -71,7 +71,7 @@ public:
     }
 
 private:
-    explicit V8BindingPerContextData(v8::Handle<v8::Context> context)
+    explicit V8PerContextData(v8::Handle<v8::Context> context)
         : m_context(context)
     {
     }
@@ -96,4 +96,4 @@ private:
 
 } // namespace WebCore
 
-#endif // V8BindingPerContextData_h
+#endif // V8PerContextData_h
diff --git a/Source/WebCore/bindings/v8/V8PerIsolateData.cpp b/Source/WebCore/bindings/v8/V8PerIsolateData.cpp
new file mode 100644
index 000000000..b57026a66
--- /dev/null
+++ b/Source/WebCore/bindings/v8/V8PerIsolateData.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8PerIsolateData.h"
+
+#include "V8Binding.h"
+
+namespace WebCore {
+
+V8PerIsolateData::V8PerIsolateData(v8::Isolate* isolate)
+    : m_stringCache(adoptPtr(new StringCache()))
+    , m_integerCache(adoptPtr(new IntegerCache()))
+    , m_domDataStore(0)
+    , m_hiddenPropertyName(adoptPtr(new V8HiddenPropertyName()))
+    , m_constructorMode(ConstructorMode::CreateNewObject)
+    , m_recursionLevel(0)
+#ifndef NDEBUG
+    , m_internalScriptRecursionLevel(0)
+#endif
+    , m_gcEventData(adoptPtr(new GCEventData()))
+    , m_shouldCollectGarbageSoon(false)
+{
+}
+
+V8PerIsolateData::~V8PerIsolateData()
+{
+}
+
+V8PerIsolateData* V8PerIsolateData::create(v8::Isolate* isolate)
+{
+    ASSERT(isolate);
+    ASSERT(!isolate->GetData());
+    V8PerIsolateData* data = new V8PerIsolateData(isolate);
+    isolate->SetData(data);
+    return data;
+}
+
+void V8PerIsolateData::ensureInitialized(v8::Isolate* isolate) 
+{
+    ASSERT(isolate);
+    if (!isolate->GetData()) 
+        create(isolate);
+}
+
+void V8PerIsolateData::dispose(v8::Isolate* isolate)
+{
+    void* data = isolate->GetData();
+    delete static_cast<V8PerIsolateData*>(data);
+    isolate->SetData(0);
+}
+
+void V8PerIsolateData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Binding);
+    info.addHashMap(m_rawTemplates);
+    info.addHashMap(m_templates);
+    info.addInstrumentedMember(m_stringCache);
+    info.addVector(m_domDataList);
+
+    for (size_t i = 0; i < m_domDataList.size(); i++)
+        info.addInstrumentedMember(m_domDataList[i]);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8PerIsolateData.h b/Source/WebCore/bindings/v8/V8PerIsolateData.h
new file mode 100644
index 000000000..72da77e42
--- /dev/null
+++ b/Source/WebCore/bindings/v8/V8PerIsolateData.h
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef V8PerIsolateData_h
+#define V8PerIsolateData_h
+
+#include <v8.h>
+#include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class DOMDataStore;
+class GCEventData;
+class IntegerCache;
+class MemoryObjectInfo;
+class StringCache;
+class V8HiddenPropertyName;
+struct WrapperTypeInfo;
+
+#if ENABLE(INSPECTOR)
+class ExternalStringVisitor;
+#endif
+
+typedef WTF::Vector<DOMDataStore*> DOMDataList;
+
+#ifndef NDEBUG
+class GlobalHandleInfo;
+typedef HashMap<v8::Value*, GlobalHandleInfo*> GlobalHandleMap;
+#endif
+
+class V8PerIsolateData {
+public:
+    static V8PerIsolateData* create(v8::Isolate*);
+    static void ensureInitialized(v8::Isolate*);
+    static V8PerIsolateData* current(v8::Isolate* isolate = 0)
+    {
+        if (UNLIKELY(!isolate))
+            isolate = v8::Isolate::GetCurrent();
+        ASSERT(isolate->GetData());
+        return static_cast<V8PerIsolateData*>(isolate->GetData()); 
+    }
+    static void dispose(v8::Isolate*);
+
+    typedef HashMap<WrapperTypeInfo*, v8::Persistent<v8::FunctionTemplate> > TemplateMap;
+
+    TemplateMap& rawTemplateMap() { return m_rawTemplates; }
+    TemplateMap& templateMap() { return m_templates; }
+    v8::Persistent<v8::String>& toStringName() { return m_toStringName; }
+    v8::Persistent<v8::FunctionTemplate>& toStringTemplate() { return m_toStringTemplate; }
+
+    v8::Persistent<v8::FunctionTemplate>& lazyEventListenerToStringTemplate()
+    {
+        return m_lazyEventListenerToStringTemplate;
+    }
+
+    StringCache* stringCache() { return m_stringCache.get(); }
+    IntegerCache* integerCache() { return m_integerCache.get(); }
+
+#if ENABLE(INSPECTOR)
+    void visitExternalStrings(ExternalStringVisitor*);
+#endif
+    DOMDataList& allStores() { return m_domDataList; }
+
+    V8HiddenPropertyName* hiddenPropertyName() { return m_hiddenPropertyName.get(); }
+    v8::Persistent<v8::Context>& auxiliaryContext() { return m_auxiliaryContext; }
+
+    void registerDOMDataStore(DOMDataStore* domDataStore) 
+    {
+        m_domDataList.append(domDataStore);
+    }
+
+    void unregisterDOMDataStore(DOMDataStore* domDataStore)
+    {
+        ASSERT(m_domDataList.find(domDataStore));
+        m_domDataList.remove(m_domDataList.find(domDataStore));
+    }
+
+    // DOMDataStore is owned outside V8PerIsolateData.
+    DOMDataStore* domDataStore() { return m_domDataStore; }
+    void setDOMDataStore(DOMDataStore* store) { m_domDataStore = store; }
+
+    int recursionLevel() const { return m_recursionLevel; }
+    int incrementRecursionLevel() { return ++m_recursionLevel; }
+    int decrementRecursionLevel() { return --m_recursionLevel; }
+
+#ifndef NDEBUG
+    GlobalHandleMap& globalHandleMap() { return m_globalHandleMap; }
+
+    int internalScriptRecursionLevel() const { return m_internalScriptRecursionLevel; }
+    int incrementInternalScriptRecursionLevel() { return ++m_internalScriptRecursionLevel; }
+    int decrementInternalScriptRecursionLevel() { return --m_internalScriptRecursionLevel; }
+#endif
+
+    GCEventData* gcEventData() { return m_gcEventData.get(); }
+
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
+    // Gives the system a hint that we should request garbage collection
+    // upon the next close or navigation event, because some expensive
+    // objects have been allocated that we want to take every opportunity
+    // to collect.
+    void setShouldCollectGarbageSoon() { m_shouldCollectGarbageSoon = true; }
+    void clearShouldCollectGarbageSoon() { m_shouldCollectGarbageSoon = false; }
+    bool shouldCollectGarbageSoon() const { return m_shouldCollectGarbageSoon; }
+
+private:
+    explicit V8PerIsolateData(v8::Isolate*);
+    ~V8PerIsolateData();
+
+    TemplateMap m_rawTemplates;
+    TemplateMap m_templates;
+    v8::Persistent<v8::String> m_toStringName;
+    v8::Persistent<v8::FunctionTemplate> m_toStringTemplate;
+    v8::Persistent<v8::FunctionTemplate> m_lazyEventListenerToStringTemplate;
+    OwnPtr<StringCache> m_stringCache;
+    OwnPtr<IntegerCache> m_integerCache;
+
+    DOMDataList m_domDataList;
+    DOMDataStore* m_domDataStore;
+
+    OwnPtr<V8HiddenPropertyName> m_hiddenPropertyName;
+    v8::Persistent<v8::Context> m_auxiliaryContext;
+
+    bool m_constructorMode;
+    friend class ConstructorMode;
+
+    int m_recursionLevel;
+
+#ifndef NDEBUG
+    GlobalHandleMap m_globalHandleMap;
+    int m_internalScriptRecursionLevel;
+#endif
+    OwnPtr<GCEventData> m_gcEventData;
+    bool m_shouldCollectGarbageSoon;
+};
+
+} // namespace WebCore
+
+#endif // V8PerIsolateData_h
diff --git a/Source/WebCore/bindings/v8/V8Proxy.cpp b/Source/WebCore/bindings/v8/V8Proxy.cpp
index 081f75f81..683292812 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.cpp
+++ b/Source/WebCore/bindings/v8/V8Proxy.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "V8Proxy.h"
 
+#include "BindingState.h"
 #include "CachedMetadata.h"
 #include "DateExtension.h"
 #include "Document.h"
@@ -49,7 +50,6 @@
 #include "Settings.h"
 #include "StylePropertySet.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8Collection.h"
 #include "V8DOMCoreException.h"
 #include "V8DOMMap.h"
@@ -78,60 +78,13 @@
 
 namespace WebCore {
 
-static V8Extensions& staticExtensionsList()
+void V8Proxy::reportUnsafeAccessTo(Document* targetDocument)
 {
-    DEFINE_STATIC_LOCAL(V8Extensions, extensions, ());
-    return extensions;
-}
-
-void batchConfigureAttributes(v8::Handle<v8::ObjectTemplate> instance, 
-                              v8::Handle<v8::ObjectTemplate> proto, 
-                              const BatchedAttribute* attributes, 
-                              size_t attributeCount)
-{
-    for (size_t i = 0; i < attributeCount; ++i)
-        configureAttribute(instance, proto, attributes[i]);
-}
-
-void batchConfigureCallbacks(v8::Handle<v8::ObjectTemplate> proto, 
-                             v8::Handle<v8::Signature> signature, 
-                             v8::PropertyAttribute attributes,
-                             const BatchedCallback* callbacks,
-                             size_t callbackCount)
-{
-    for (size_t i = 0; i < callbackCount; ++i) {
-        proto->Set(v8::String::New(callbacks[i].name),
-                   v8::FunctionTemplate::New(callbacks[i].callback, 
-                                             v8::Handle<v8::Value>(),
-                                             signature),
-                   attributes);
-    }
-}
-
-void batchConfigureConstants(v8::Handle<v8::FunctionTemplate> functionDescriptor,
-                             v8::Handle<v8::ObjectTemplate> proto,
-                             const BatchedConstant* constants,
-                             size_t constantCount)
-{
-    for (size_t i = 0; i < constantCount; ++i) {
-        const BatchedConstant* constant = &constants[i];
-        functionDescriptor->Set(v8::String::New(constant->name), v8Integer(constant->value), v8::ReadOnly);
-        proto->Set(v8::String::New(constant->name), v8Integer(constant->value), v8::ReadOnly);
-    }
-}
-
-typedef HashMap<Node*, v8::Object*> DOMNodeMap;
-typedef HashMap<void*, v8::Object*> DOMObjectMap;
-typedef HashMap<int, v8::FunctionTemplate*> FunctionTemplateMap;
-
-void V8Proxy::reportUnsafeAccessTo(Frame* target)
-{
-    ASSERT(target);
-    Document* targetDocument = target->document();
     if (!targetDocument)
         return;
 
-    Frame* source = V8Proxy::retrieveFrameForEnteredContext();
+    // FIXME: We should pass both the active and target documents in as arguments.
+    Frame* source = firstFrame(BindingState::instance());
     if (!source)
         return;
 
@@ -197,23 +150,18 @@ bool V8Proxy::handleOutOfMemory()
 
     // Warning, error, disable JS for this frame?
     Frame* frame = V8Proxy::retrieveFrame(context);
+    if (!frame)
+        return true;
 
-    V8Proxy* proxy = V8Proxy::retrieve(frame);
-    if (proxy) {
-        // Clean m_context, and event handlers.
-        proxy->clearForClose();
-
-        proxy->windowShell()->destroyGlobal();
-    }
+    frame->script()->proxy()->clearForClose();
+    frame->script()->windowShell()->destroyGlobal();
 
 #if PLATFORM(CHROMIUM)
     PlatformSupport::notifyJSOutOfMemory(frame);
 #endif
 
-    // Disable JS.
-    Settings* settings = frame->settings();
-    ASSERT(settings);
-    settings->setScriptEnabled(false);
+    if (Settings* settings = frame->settings())
+        settings->setScriptEnabled(false);
 
     return true;
 }
@@ -270,16 +218,6 @@ v8::Local<v8::Array> V8Proxy::evaluateInIsolatedWorld(int worldID, const Vector<
     return handleScope.Close(results);
 }
 
-void V8Proxy::setIsolatedWorldSecurityOrigin(int worldID, PassRefPtr<SecurityOrigin> prpSecurityOriginIn)
-{
-    ASSERT(worldID);
-    RefPtr<SecurityOrigin> securityOrigin = prpSecurityOriginIn;
-    m_isolatedWorldSecurityOrigins.set(worldID, securityOrigin);
-    IsolatedWorldMap::iterator iter = m_isolatedWorlds.find(worldID);
-    if (iter != m_isolatedWorlds.end())
-        iter->second->setSecurityOrigin(securityOrigin);
-}
-
 PassOwnPtr<v8::ScriptData> V8Proxy::precompileScript(v8::Handle<v8::String> code, CachedScript* cachedScript)
 {
     // A pseudo-randomly chosen ID used to store and retrieve V8 ScriptData from
@@ -490,63 +428,12 @@ Frame* V8Proxy::retrieveFrame(v8::Handle<v8::Context> context)
     return 0;
 }
 
-Frame* V8Proxy::retrieveFrameForEnteredContext()
-{
-    v8::Handle<v8::Context> context = v8::Context::GetEntered();
-    if (context.IsEmpty())
-        return 0;
-    return retrieveFrame(context);
-}
-
-Frame* V8Proxy::retrieveFrameForCurrentContext()
-{
-    v8::Handle<v8::Context> context = v8::Context::GetCurrent();
-    if (context.IsEmpty())
-        return 0;
-    return retrieveFrame(context);
-}
-
-DOMWindow* V8Proxy::retrieveWindowForCallingContext()
-{
-    v8::Handle<v8::Context> context = v8::Context::GetCalling();
-    if (context.IsEmpty())
-        return 0;
-    return retrieveWindow(context);
-}
-
-Frame* V8Proxy::retrieveFrameForCallingContext()
-{
-    v8::Handle<v8::Context> context = v8::Context::GetCalling();
-    if (context.IsEmpty())
-        return 0;
-    return retrieveFrame(context);
-}
-
-V8Proxy* V8Proxy::retrieve()
-{
-    DOMWindow* window = retrieveWindow(currentContext());
-    ASSERT(window);
-    return retrieve(window->frame());
-}
-
-V8Proxy* V8Proxy::retrieve(Frame* frame)
-{
-    return frame ? frame->script()->proxy() : 0;
-}
-
-V8Proxy* V8Proxy::retrieve(ScriptExecutionContext* context)
-{
-    if (!context || !context->isDocument())
-        return 0;
-    return retrieve(static_cast<Document*>(context)->frame());
-}
-
-V8BindingPerContextData* V8Proxy::retrievePerContextData(Frame* frame)
+V8PerContextData* V8Proxy::retrievePerContextData(Frame* frame)
 {
     V8IsolatedContext* isolatedContext;
     if (UNLIKELY(!!(isolatedContext = V8IsolatedContext::getEntered())))
         return isolatedContext->perContextData();
-    return V8Proxy::retrieve(frame)->windowShell()->perContextData();
+    return frame->script()->windowShell()->perContextData();
 }
 
 void V8Proxy::resetIsolatedWorlds()
@@ -561,10 +448,12 @@ void V8Proxy::resetIsolatedWorlds()
 
 void V8Proxy::hintForGCIfNecessary()
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
-    if (data->isLowMemoryNotificationHint()) {
-        data->clearLowMemoryNotificationHint();
-        v8::V8::LowMemoryNotification();
+    V8PerIsolateData* data = V8PerIsolateData::current();
+    if (data->shouldCollectGarbageSoon()) {
+        const int longIdlePauseInMs = 1000;
+        data->clearShouldCollectGarbageSoon();
+        v8::V8::ContextDisposedNotification();
+        v8::V8::IdleNotification(longIdlePauseInMs);
     }
 }
 
@@ -601,8 +490,8 @@ static void DOMExceptionStackSetter(v8::Local<v8::String> name, v8::Local<v8::Va
 
 v8::Handle<v8::Value> V8Proxy::setDOMException(int ec, v8::Isolate* isolate)
 {
-    if (ec <= 0)
-        return v8::Handle<v8::Value>();
+    if (ec <= 0 || v8::V8::IsExecutionTerminating())
+        return v8Undefined();
 
     if (ec == NATIVE_TYPE_ERR) {
         const char* message = 0;
@@ -617,7 +506,7 @@ v8::Handle<v8::Value> V8Proxy::setDOMException(int ec, v8::Isolate* isolate)
     }
 
     if (exception.IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     // Attach an Error object to the DOMException. This is then lazily used to get the stack value.
     v8::Handle<v8::Value> error = v8::Exception::Error(v8String(description.description, isolate));
@@ -645,7 +534,7 @@ v8::Handle<v8::Value> V8Proxy::throwError(ErrorType type, const char* message, v
         return v8::ThrowException(v8::Exception::Error(v8String(message, isolate)));
     default:
         ASSERT_NOT_REACHED();
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
 }
 
@@ -715,16 +604,10 @@ bool V8Proxy::matchesCurrentContext()
 
 v8::Local<v8::Context> V8Proxy::mainWorldContext(Frame* frame)
 {
-    V8Proxy* proxy = retrieve(frame);
-    if (!proxy)
+    if (!frame)
         return v8::Local<v8::Context>();
 
-    return proxy->mainWorldContext();
-}
-
-v8::Local<v8::Context> V8Proxy::currentContext()
-{
-    return v8::Context::GetCurrent();
+    return frame->script()->proxy()->mainWorldContext();
 }
 
 v8::Handle<v8::Value> V8Proxy::checkNewLegal(const v8::Arguments& args)
@@ -735,33 +618,21 @@ v8::Handle<v8::Value> V8Proxy::checkNewLegal(const v8::Arguments& args)
     return args.This();
 }
 
-void V8Proxy::registerExtensionWithV8(v8::Extension* extension)
+V8Extensions& V8Proxy::extensions()
 {
-    // If the extension exists in our list, it was already registered with V8.
-    if (!registeredExtensionWithV8(extension))
-        v8::RegisterExtension(extension);
+    DEFINE_STATIC_LOCAL(V8Extensions, extensions, ());
+    return extensions;
 }
 
-bool V8Proxy::registeredExtensionWithV8(v8::Extension* extension)
+void V8Proxy::registerExtensionIfNeeded(v8::Extension* extension)
 {
     const V8Extensions& registeredExtensions = extensions();
     for (size_t i = 0; i < registeredExtensions.size(); ++i) {
         if (registeredExtensions[i] == extension)
-            return true;
+            return;
     }
-
-    return false;
-}
-
-void V8Proxy::registerExtension(v8::Extension* extension)
-{
-    registerExtensionWithV8(extension);
-    staticExtensionsList().append(extension);
-}
-
-const V8Extensions& V8Proxy::extensions()
-{
-    return staticExtensionsList();
+    v8::RegisterExtension(extension);
+    extensions().append(extension);
 }
 
 bool V8Proxy::setContextDebugId(int debugId)
@@ -795,26 +666,11 @@ int V8Proxy::contextDebugId(v8::Handle<v8::Context> context)
     return atoi(comma + 1);
 }
 
-void V8Proxy::collectIsolatedContexts(Vector<std::pair<ScriptState*, SecurityOrigin*> >& result)
-{
-    v8::HandleScope handleScope;
-    for (IsolatedWorldMap::iterator it = m_isolatedWorlds.begin(); it != m_isolatedWorlds.end(); ++it) {
-        V8IsolatedContext* isolatedContext = it->second;
-        if (!isolatedContext->securityOrigin())
-            continue;
-        v8::Handle<v8::Context> v8Context = isolatedContext->context();
-        if (v8Context.IsEmpty())
-            continue;
-        ScriptState* scriptState = ScriptState::forContext(v8::Local<v8::Context>::New(v8Context));
-        result.append(std::pair<ScriptState*, SecurityOrigin*>(scriptState, isolatedContext->securityOrigin()));
-    }
-}
-
 v8::Local<v8::Context> toV8Context(ScriptExecutionContext* context, const WorldContextHandle& worldContext)
 {
     if (context->isDocument()) {
-        if (V8Proxy* proxy = V8Proxy::retrieve(context))
-            return worldContext.adjustedContext(proxy);
+        if (Frame* frame = static_cast<Document*>(context)->frame())
+            return worldContext.adjustedContext(frame->script()->proxy());
 #if ENABLE(WORKERS)
     } else if (context->isWorkerContext()) {
         if (WorkerContextExecutionProxy* proxy = static_cast<WorkerContext*>(context)->script()->proxy())
diff --git a/Source/WebCore/bindings/v8/V8Proxy.h b/Source/WebCore/bindings/v8/V8Proxy.h
index 7d40077ec..d2e6ded31 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.h
+++ b/Source/WebCore/bindings/v8/V8Proxy.h
@@ -42,6 +42,7 @@
 #include "WrapperTypeInfo.h"
 #include <v8.h>
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h> // so generated bindings don't have to
 #include <wtf/Vector.h>
 #include <wtf/text/TextPosition.h>
@@ -61,67 +62,26 @@ namespace WebCore {
     class ScriptExecutionContext;
     class ScriptSourceCode;
     class SecurityOrigin;
-    class V8BindingPerContextData;
+    class V8PerContextData;
     class V8EventListener;
     class V8IsolatedContext;
     class WorldContextHandle;
 
-    // The following Batch structs and methods are used for setting multiple
-    // properties on an ObjectTemplate, used from the generated bindings
-    // initialization (ConfigureXXXTemplate). This greatly reduces the binary
-    // size by moving from code driven setup to data table driven setup.
-
-    // BatchedAttribute translates into calls to SetAccessor() on either the
-    // instance or the prototype ObjectTemplate, based on |onProto|.
-    struct BatchedAttribute {
-        const char* const name;
-        v8::AccessorGetter getter;
-        v8::AccessorSetter setter;
-        WrapperTypeInfo* data;
-        v8::AccessControl settings;
-        v8::PropertyAttribute attribute;
-        bool onProto;
-    };
-
-    void batchConfigureAttributes(v8::Handle<v8::ObjectTemplate>, v8::Handle<v8::ObjectTemplate>, const BatchedAttribute*, size_t attributeCount);
-
-    template<class ObjectOrTemplate>
-    inline void configureAttribute(v8::Handle<ObjectOrTemplate> instance, v8::Handle<ObjectOrTemplate> proto, const BatchedAttribute& attribute)
-    {
-        (attribute.onProto ? proto : instance)->SetAccessor(v8::String::New(attribute.name),
-            attribute.getter,
-            attribute.setter,
-            v8::External::Wrap(attribute.data),
-            attribute.settings,
-            attribute.attribute);
-    }
-
-    // BatchedConstant translates into calls to Set() for setting up an object's
-    // constants. It sets the constant on both the FunctionTemplate and the
-    // ObjectTemplate. PropertyAttributes is always ReadOnly.
-    struct BatchedConstant {
-        const char* const name;
-        int value;
-    };
-
-    void batchConfigureConstants(v8::Handle<v8::FunctionTemplate>, v8::Handle<v8::ObjectTemplate>, const BatchedConstant*, size_t constantCount);
-
-    struct BatchedCallback {
-        const char* const name;
-        v8::InvocationCallback callback;
-    };
-
-    void batchConfigureCallbacks(v8::Handle<v8::ObjectTemplate>, 
-                                 v8::Handle<v8::Signature>,
-                                 v8::PropertyAttribute,
-                                 const BatchedCallback*, 
-                                 size_t callbackCount);
-
     const int kMaxRecursionDepth = 22;
 
     // The list of extensions that are registered for use with V8.
     typedef WTF::Vector<v8::Extension*> V8Extensions;
 
+    // Note: although the pointer is raw, the instance is kept alive by a strong
+    // reference to the v8 context it contains, which is not made weak until we
+    // call world->destroy().
+    //
+    // FIXME: We want to eventually be holding window shells instead of the
+    //        IsolatedContext directly.
+    typedef HashMap<int, V8IsolatedContext*> IsolatedWorldMap;
+
+    typedef HashMap<int, RefPtr<SecurityOrigin> > IsolatedWorldSecurityOriginMap;
+
     class V8Proxy {
     public:
         // The types of javascript errors that can be thrown.
@@ -150,8 +110,6 @@ namespace WebCore {
         // constructors.
         v8::Local<v8::Array> evaluateInIsolatedWorld(int worldID, const Vector<ScriptSourceCode>& sources, int extensionGroup);
 
-        void setIsolatedWorldSecurityOrigin(int worldID, PassRefPtr<SecurityOrigin>);
-
         // Evaluate a script file in the current execution environment.
         // The caller must hold an execution context.
         // If cannot evalute the script, it returns an error.
@@ -172,57 +130,16 @@ namespace WebCore {
         // Returns the window object associated with a context.
         static DOMWindow* retrieveWindow(v8::Handle<v8::Context>);
 
-        // Returns V8Proxy object of the currently executing context.
-        static V8Proxy* retrieve();
-        // Returns V8Proxy object associated with a frame.
-        static V8Proxy* retrieve(Frame*);
-        // Returns V8Proxy object associated with a script execution context.
-        static V8Proxy* retrieve(ScriptExecutionContext*);
-
         // Returns the frame object of the window object associated with
         // a context.
         static Frame* retrieveFrame(v8::Handle<v8::Context>);
 
-        static V8BindingPerContextData* retrievePerContextData(Frame*);
-
-        // The three functions below retrieve WebFrame instances relating the
-        // currently executing JavaScript. Since JavaScript can make function calls
-        // across frames, though, we need to be more precise.
-        //
-        // For example, imagine that a JS function in frame A calls a function in
-        // frame B, which calls native code, which wants to know what the 'active'
-        // frame is.
-        //
-        // The 'entered context' is the context where execution first entered the
-        // script engine; the context that is at the bottom of the JS function stack.
-        // RetrieveFrameForEnteredContext() would return Frame A in our example.
-        // This frame is often referred to as the "dynamic global object."
-        //
-        // The 'current context' is the context the JS engine is currently inside of;
-        // the context that is at the top of the JS function stack.
-        // RetrieveFrameForCurrentContext() would return Frame B in our example.
-        // This frame is often referred to as the "lexical global object."
-        //
-        // Finally, the 'calling context' is the context one below the current
-        // context on the JS function stack. For example, if function f calls
-        // function g, then the calling context will be the context associated with
-        // f. This context is commonly used by DOM security checks because they want
-        // to know who called them.
-        //
-        // If you are unsure which of these functions to use, ask abarth.
-        //
-        // NOTE: These cannot be declared as inline function, because VS complains at
-        // linking time.
-        static Frame* retrieveFrameForEnteredContext();
-        static Frame* retrieveFrameForCurrentContext();
-        static DOMWindow* retrieveWindowForCallingContext();
-        static Frame* retrieveFrameForCallingContext();
+        static V8PerContextData* retrievePerContextData(Frame*);
 
         // Returns V8 Context of a frame. If none exists, creates
         // a new context. It is potentially slow and consumes memory.
         static v8::Local<v8::Context> context(Frame*);
         static v8::Local<v8::Context> mainWorldContext(Frame*);
-        static v8::Local<v8::Context> currentContext();
 
         // If the current context causes out of memory, JavaScript setting
         // is disabled and it returns true.
@@ -253,20 +170,20 @@ namespace WebCore {
 
         bool setContextDebugId(int id);
         static int contextDebugId(v8::Handle<v8::Context>);
-        void collectIsolatedContexts(Vector<std::pair<ScriptState*, SecurityOrigin*> >&);
 
         // Registers a v8 extension to be available on webpages. Will only
         // affect v8 contexts initialized after this call. Takes ownership of
         // the v8::Extension object passed.
-        static void registerExtension(v8::Extension*);
+        static void registerExtensionIfNeeded(v8::Extension*);
+        static V8Extensions& extensions();
 
-        static void registerExtensionWithV8(v8::Extension*);
-        static bool registeredExtensionWithV8(v8::Extension*);
+        static void reportUnsafeAccessTo(Document* targetDocument);
 
-        static const V8Extensions& extensions();
+        // FIXME: Move m_isolatedWorlds to ScriptController and remove this getter.
+        IsolatedWorldMap& isolatedWorlds() { return m_isolatedWorlds; }
 
-        // Report an unsafe attempt to access the given frame on the console.
-        static void reportUnsafeAccessTo(Frame* target);
+        // FIXME: Move m_isolatedWorldSecurityOrigins to ScriptController and remove this getter.
+        IsolatedWorldSecurityOriginMap& isolatedWorldSecurityOrigins() { return m_isolatedWorldSecurityOrigins; }
 
     private:
         void resetIsolatedWorlds();
@@ -275,20 +192,6 @@ namespace WebCore {
 
         PassOwnPtr<v8::ScriptData> precompileScript(v8::Handle<v8::String>, CachedScript*);
 
-        static const char* rangeExceptionName(int exceptionCode);
-        static const char* eventExceptionName(int exceptionCode);
-        static const char* xmlHttpRequestExceptionName(int exceptionCode);
-        static const char* domExceptionName(int exceptionCode);
-        static const char* xpathExceptionName(int exceptionCode);
-
-#if ENABLE(SVG)
-        static const char* svgExceptionName(int exceptionCode);
-#endif
-
-#if ENABLE(SQL_DATABASE)
-        static const char* sqlExceptionName(int exceptionCode);
-#endif
-
         Frame* m_frame;
 
         // For the moment, we have one of these.  Soon we will have one per DOMWrapperWorld.
@@ -300,40 +203,19 @@ namespace WebCore {
         // The isolated worlds we are tracking for this frame. We hold them alive
         // here so that they can be used again by future calls to
         // evaluateInIsolatedWorld().
-        //
-        // Note: although the pointer is raw, the instance is kept alive by a strong
-        // reference to the v8 context it contains, which is not made weak until we
-        // call world->destroy().
-        //
-        // FIXME: We want to eventually be holding window shells instead of the
-        //        IsolatedContext directly.
-        typedef HashMap<int, V8IsolatedContext*> IsolatedWorldMap;
         IsolatedWorldMap m_isolatedWorlds;
         
-        typedef HashMap<int, RefPtr<SecurityOrigin> > IsolatedWorldSecurityOriginMap;
         IsolatedWorldSecurityOriginMap m_isolatedWorldSecurityOrigins;
     };
 
     v8::Local<v8::Context> toV8Context(ScriptExecutionContext*, const WorldContextHandle& worldContext);
 
-    inline v8::Handle<v8::Primitive> throwError(ExceptionCode ec, v8::Isolate* isolate = 0)
-    {
-        if (!v8::V8::IsExecutionTerminating())
-            V8Proxy::setDOMException(ec, isolate);
-        return v8::Undefined();
-    }
-
     inline v8::Handle<v8::Primitive> throwError(v8::Local<v8::Value> exception, v8::Isolate* isolate = 0)
     {
         if (!v8::V8::IsExecutionTerminating())
             v8::ThrowException(exception);
         return v8::Undefined();
     }
-
-    enum IndependentMode {
-        MarkIndependent,
-        DoNotMarkIndependent
-    };
 }
 
 #endif // V8Proxy_h
diff --git a/Source/WebCore/bindings/v8/V8RecursionScope.h b/Source/WebCore/bindings/v8/V8RecursionScope.h
index 0e776e1ea..6e5f53f1d 100644
--- a/Source/WebCore/bindings/v8/V8RecursionScope.h
+++ b/Source/WebCore/bindings/v8/V8RecursionScope.h
@@ -60,24 +60,24 @@ public:
     explicit V8RecursionScope(ScriptExecutionContext* context)
         : m_isDocumentContext(context && context->isDocument())
     {
-        V8BindingPerIsolateData::current()->incrementRecursionLevel();
+        V8PerIsolateData::current()->incrementRecursionLevel();
     }
 
     ~V8RecursionScope()
     {
-        if (!V8BindingPerIsolateData::current()->decrementRecursionLevel())
+        if (!V8PerIsolateData::current()->decrementRecursionLevel())
             didLeaveScriptContext();
     }
 
     static int recursionLevel()
     {
-        return V8BindingPerIsolateData::current()->recursionLevel();
+        return V8PerIsolateData::current()->recursionLevel();
     }
 
 #ifndef NDEBUG
     static bool properlyUsed()
     {
-        return recursionLevel() > 0 || V8BindingPerIsolateData::current()->internalScriptRecursionLevel() > 0;
+        return recursionLevel() > 0 || V8PerIsolateData::current()->internalScriptRecursionLevel() > 0;
     }
 #endif
 
@@ -86,14 +86,14 @@ public:
         MicrotaskSuppression()
         {
 #ifndef NDEBUG
-            V8BindingPerIsolateData::current()->incrementInternalScriptRecursionLevel();
+            V8PerIsolateData::current()->incrementInternalScriptRecursionLevel();
 #endif
         }
 
         ~MicrotaskSuppression()
         {
 #ifndef NDEBUG
-            V8BindingPerIsolateData::current()->decrementInternalScriptRecursionLevel();
+            V8PerIsolateData::current()->decrementInternalScriptRecursionLevel();
 #endif
         }
     };
diff --git a/Source/WebCore/bindings/v8/V8Utilities.cpp b/Source/WebCore/bindings/v8/V8Utilities.cpp
index 57d130a7c..0f48b5876 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.cpp
+++ b/Source/WebCore/bindings/v8/V8Utilities.cpp
@@ -31,24 +31,23 @@
 #include "config.h"
 #include "V8Utilities.h"
 
-#include <wtf/ArrayBuffer.h>
+#include "BindingState.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "GenericBinding.h"
 #include "MessagePort.h"
 #include "ScriptExecutionContext.h"
 #include "ScriptState.h"
 #include "V8ArrayBuffer.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8MessagePort.h"
 #include "V8Proxy.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
-
-#include <wtf/Assertions.h>
-
 #include <v8.h>
+#include <wtf/ArrayBuffer.h>
+#include <wtf/Assertions.h>
 
 namespace WebCore {
 
@@ -64,7 +63,7 @@ V8AuxiliaryContext::~V8AuxiliaryContext()
 
 v8::Persistent<v8::Context>& V8AuxiliaryContext::auxiliaryContext()
 {
-    v8::Persistent<v8::Context>& context = V8BindingPerIsolateData::current()->auxiliaryContext();
+    v8::Persistent<v8::Context>& context = V8PerIsolateData::current()->auxiliaryContext();
     if (context.IsEmpty())
         context = v8::Context::New();
     return context;
@@ -84,7 +83,7 @@ void createHiddenDependency(v8::Handle<v8::Object> object, v8::Local<v8::Value>
     cacheArray->Set(v8Integer(cacheArray->Length()), value);
 }
 
-bool extractTransferables(v8::Local<v8::Value> value, MessagePortArray& ports, ArrayBufferArray& arrayBuffers)
+bool extractTransferables(v8::Local<v8::Value> value, MessagePortArray& ports, ArrayBufferArray& arrayBuffers, v8::Isolate* isolate)
 {
     if (isUndefinedOrNull(value)) {
         ports.resize(0);
@@ -108,7 +107,7 @@ bool extractTransferables(v8::Local<v8::Value> value, MessagePortArray& ports, A
         v8::Local<v8::Value> transferrable = transferrables->Get(i);
         // Validation of non-null objects, per HTML5 spec 10.3.3.
         if (isUndefinedOrNull(transferrable)) {
-            throwError(DATA_CLONE_ERR);
+            V8Proxy::setDOMException(DATA_CLONE_ERR, isolate);
             return false;
         }
         // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
@@ -124,10 +123,10 @@ bool extractTransferables(v8::Local<v8::Value> value, MessagePortArray& ports, A
     return true;
 }
 
-bool getMessagePortArray(v8::Local<v8::Value> value, MessagePortArray& ports)
+bool getMessagePortArray(v8::Local<v8::Value> value, MessagePortArray& ports, v8::Isolate* isolate)
 {
     ArrayBufferArray arrayBuffers;
-    bool result = extractTransferables(value, ports, arrayBuffers);
+    bool result = extractTransferables(value, ports, arrayBuffers, isolate);
     if (!result)
         return false;
     if (arrayBuffers.size() > 0) {
@@ -171,12 +170,12 @@ void transferHiddenDependency(v8::Handle<v8::Object> object,
 
 Frame* callingOrEnteredFrame()
 {
-    return V8BindingState::Only()->activeFrame();
+    return activeFrame(BindingState::instance());
 }
 
 KURL completeURL(const String& relativeURL)
 {
-    return completeURL(V8BindingState::Only(), relativeURL);
+    return completeURL(BindingState::instance(), relativeURL);
 }
 
 ScriptExecutionContext* getScriptExecutionContext()
@@ -186,15 +185,15 @@ ScriptExecutionContext* getScriptExecutionContext()
         return controller->workerContext();
 #endif
 
-    if (Frame* frame = V8Proxy::retrieveFrameForCurrentContext())
+    if (Frame* frame = currentFrame(BindingState::instance()))
         return frame->document()->scriptExecutionContext();
 
     return 0;
 }
 
-void throwTypeMismatchException(v8::Isolate* isolate)
+void setTypeMismatchException(v8::Isolate* isolate)
 {
-    V8Proxy::throwError(V8Proxy::GeneralError, "TYPE_MISMATCH_ERR: DOM Exception 17", isolate);
+    V8Proxy::setDOMException(TYPE_MISMATCH_ERR, isolate);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8Utilities.h b/Source/WebCore/bindings/v8/V8Utilities.h
index 4c110909f..75f4e86da 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.h
+++ b/Source/WebCore/bindings/v8/V8Utilities.h
@@ -60,7 +60,7 @@ namespace WebCore {
 
     ScriptExecutionContext* getScriptExecutionContext();
 
-    void throwTypeMismatchException(v8::Isolate*);
+    void setTypeMismatchException(v8::Isolate*);
 
     enum CallbackAllowedValueFlag {
         CallbackAllowUndefined = 1,
@@ -85,8 +85,8 @@ namespace WebCore {
     // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 
     // of the HTML5 spec and generates exceptions as appropriate.
     // Returns true if the array was filled, or false if the passed value was not of an appropriate type.
-    bool extractTransferables(v8::Local<v8::Value>, MessagePortArray&, ArrayBufferArray&); 
-    bool getMessagePortArray(v8::Local<v8::Value>, MessagePortArray&);
+    bool extractTransferables(v8::Local<v8::Value>, MessagePortArray&, ArrayBufferArray&, v8::Isolate*); 
+    bool getMessagePortArray(v8::Local<v8::Value>, MessagePortArray&, v8::Isolate*);
 
     // 'FunctionOnly' is assumed for the created callback.
     template <typename V8CallbackType>
@@ -102,7 +102,7 @@ namespace WebCore {
 
         if (!value->IsFunction()) {
             succeeded = false;
-            throwTypeMismatchException(isolate);
+            setTypeMismatchException(isolate);
             return 0;
         }
 
diff --git a/Source/WebCore/bindings/v8/V8ValueCache.cpp b/Source/WebCore/bindings/v8/V8ValueCache.cpp
new file mode 100644
index 000000000..7de431893
--- /dev/null
+++ b/Source/WebCore/bindings/v8/V8ValueCache.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8ValueCache.h"
+
+#include "BindingVisitors.h"
+#include "V8Binding.h"
+
+namespace WebCore {
+
+static v8::Local<v8::String> makeExternalString(const String& string)
+{
+    WebCoreStringResource* stringResource = new WebCoreStringResource(string);
+    v8::Local<v8::String> newString = v8::String::NewExternal(stringResource);
+    if (newString.IsEmpty())
+        delete stringResource;
+
+    return newString;
+}
+
+static void cachedStringCallback(v8::Persistent<v8::Value> wrapper, void* parameter)
+{
+    StringImpl* stringImpl = static_cast<StringImpl*>(parameter);
+    V8PerIsolateData::current()->stringCache()->remove(stringImpl);
+    wrapper.Dispose();
+    stringImpl->deref();
+}
+
+void StringCache::remove(StringImpl* stringImpl) 
+{
+    ASSERT(m_stringCache.contains(stringImpl));
+    m_stringCache.remove(stringImpl);
+    // Make sure that already disposed m_lastV8String is not used in
+    // StringCache::v8ExternalString().
+    if (m_lastStringImpl.get() == stringImpl) {
+        m_lastStringImpl = 0;
+        m_lastV8String.Clear();
+    }
+}
+
+v8::Local<v8::String> StringCache::v8ExternalStringSlow(StringImpl* stringImpl, v8::Isolate* isolate)
+{
+    if (!stringImpl->length())
+        return isolate ? v8::String::Empty(isolate) : v8::String::Empty();
+
+    v8::String* cachedV8String = m_stringCache.get(stringImpl);
+    if (cachedV8String) {
+        v8::Persistent<v8::String> handle(cachedV8String);
+        if (!handle.IsNearDeath() && !handle.IsEmpty()) {
+            m_lastStringImpl = stringImpl;
+            m_lastV8String = handle;
+            return v8::Local<v8::String>::New(handle);
+        }
+    }
+
+    v8::Local<v8::String> newString = makeExternalString(String(stringImpl));
+    if (newString.IsEmpty())
+        return newString;
+
+    v8::Persistent<v8::String> wrapper = v8::Persistent<v8::String>::New(newString);
+    if (wrapper.IsEmpty())
+        return newString;
+
+    stringImpl->ref();
+    wrapper.MarkIndependent();
+    wrapper.MakeWeak(stringImpl, cachedStringCallback);
+    m_stringCache.set(stringImpl, *wrapper);
+
+    m_lastStringImpl = stringImpl;
+    m_lastV8String = wrapper;
+
+    return newString;
+}
+
+void WebCoreStringResource::visitStrings(ExternalStringVisitor* visitor)
+{
+    visitor->visitJSExternalString(m_plainString.impl());
+    if (m_plainString.impl() != m_atomicString.impl() && !m_atomicString.isNull())
+        visitor->visitJSExternalString(m_atomicString.impl());
+}
+
+void IntegerCache::createSmallIntegers()
+{
+    ASSERT(!m_initialized);
+    // We initialize m_smallIntegers not in a constructor but in v8Integer(),
+    // because Integer::New() requires a HandleScope. At the point where
+    // IntegerCache is constructed, a HandleScope might not exist.
+    for (int value = 0; value < numberOfCachedSmallIntegers; value++)
+        m_smallIntegers[value] = v8::Persistent<v8::Integer>::New(v8::Integer::New(value));
+    m_initialized = true;
+}
+
+IntegerCache::~IntegerCache()
+{
+    if (m_initialized) {
+        for (int value = 0; value < numberOfCachedSmallIntegers; value++)
+            m_smallIntegers[value].Dispose();
+        m_initialized = false;
+    }
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8ValueCache.h b/Source/WebCore/bindings/v8/V8ValueCache.h
new file mode 100644
index 000000000..8154ddf53
--- /dev/null
+++ b/Source/WebCore/bindings/v8/V8ValueCache.h
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef V8ValueCache_h
+#define V8ValueCache_h
+
+#include <v8.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/AtomicString.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class ExternalStringVisitor;
+class MemoryObjectInfo;
+
+class StringCache {
+public:
+    StringCache() { }
+
+    v8::Local<v8::String> v8ExternalString(StringImpl* stringImpl, v8::Isolate* isolate)
+    {
+        if (m_lastStringImpl.get() == stringImpl) {
+            ASSERT(!m_lastV8String.IsNearDeath());
+            ASSERT(!m_lastV8String.IsEmpty());
+            return v8::Local<v8::String>::New(m_lastV8String);
+        }
+
+        return v8ExternalStringSlow(stringImpl, isolate);
+    }
+
+    void clearOnGC() 
+    {
+        m_lastStringImpl = 0;
+        m_lastV8String.Clear();
+    }
+
+    void remove(StringImpl*);
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
+private:
+    v8::Local<v8::String> v8ExternalStringSlow(StringImpl*, v8::Isolate*);
+
+    HashMap<StringImpl*, v8::String*> m_stringCache;
+    v8::Persistent<v8::String> m_lastV8String;
+    // Note: RefPtr is a must as we cache by StringImpl* equality, not identity
+    // hence lastStringImpl might be not a key of the cache (in sense of identity)
+    // and hence it's not refed on addition.
+    RefPtr<StringImpl> m_lastStringImpl;
+};
+
+const int numberOfCachedSmallIntegers = 64;
+
+// WebCoreStringResource is a helper class for v8ExternalString. It is used
+// to manage the life-cycle of the underlying buffer of the external string.
+class WebCoreStringResource : public v8::String::ExternalStringResource {
+public:
+    explicit WebCoreStringResource(const String& string)
+        : m_plainString(string)
+    {
+#ifndef NDEBUG
+        m_threadId = WTF::currentThread();
+#endif
+        ASSERT(!string.isNull());
+        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * string.length());
+    }
+
+    explicit WebCoreStringResource(const AtomicString& string)
+        : m_plainString(string.string())
+        , m_atomicString(string)
+    {
+#ifndef NDEBUG
+        m_threadId = WTF::currentThread();
+#endif
+        ASSERT(!string.isNull());
+        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * string.length());
+    }
+
+    virtual ~WebCoreStringResource()
+    {
+#ifndef NDEBUG
+        ASSERT(m_threadId == WTF::currentThread());
+#endif
+        int reducedExternalMemory = -2 * m_plainString.length();
+        if (m_plainString.impl() != m_atomicString.impl() && !m_atomicString.isNull())
+            reducedExternalMemory *= 2;
+        v8::V8::AdjustAmountOfExternalAllocatedMemory(reducedExternalMemory);
+    }
+
+    virtual const uint16_t* data() const
+    {
+        return reinterpret_cast<const uint16_t*>(m_plainString.impl()->characters());
+    }
+
+    virtual size_t length() const { return m_plainString.impl()->length(); }
+
+    String webcoreString() { return m_plainString; }
+
+    AtomicString atomicString()
+    {
+#ifndef NDEBUG
+        ASSERT(m_threadId == WTF::currentThread());
+#endif
+        if (m_atomicString.isNull()) {
+            m_atomicString = AtomicString(m_plainString);
+            ASSERT(!m_atomicString.isNull());
+            if (m_plainString.impl() != m_atomicString.impl())
+                v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * m_atomicString.length());
+        }
+        return m_atomicString;
+    }
+
+    void visitStrings(ExternalStringVisitor*);
+
+    static WebCoreStringResource* toStringResource(v8::Handle<v8::String> v8String)
+    {
+        return static_cast<WebCoreStringResource*>(v8String->GetExternalStringResource());
+    }
+
+private:
+    // A shallow copy of the string. Keeps the string buffer alive until the V8 engine garbage collects it.
+    String m_plainString;
+    // If this string is atomic or has been made atomic earlier the
+    // atomic string is held here. In the case where the string starts
+    // off non-atomic and becomes atomic later it is necessary to keep
+    // the original string alive because v8 may keep derived pointers
+    // into that string.
+    AtomicString m_atomicString;
+
+#ifndef NDEBUG
+    WTF::ThreadIdentifier m_threadId;
+#endif
+};
+
+class IntegerCache {
+public:
+     IntegerCache() : m_initialized(false) { };
+    ~IntegerCache();
+
+    v8::Handle<v8::Integer> v8Integer(int value)
+    {
+        if (!m_initialized)
+            createSmallIntegers();
+        if (0 <= value && value < numberOfCachedSmallIntegers)
+            return m_smallIntegers[value];
+        return v8::Integer::New(value);
+    }
+
+    v8::Handle<v8::Integer> v8UnsignedInteger(unsigned value)
+    {
+        if (!m_initialized)
+            createSmallIntegers();
+        if (value < static_cast<unsigned>(numberOfCachedSmallIntegers))
+            return m_smallIntegers[value];
+        return v8::Integer::NewFromUnsigned(value);
+    }
+
+private:
+    void createSmallIntegers();
+
+    v8::Persistent<v8::Integer> m_smallIntegers[numberOfCachedSmallIntegers];
+    bool m_initialized;
+};
+    
+} // namespace WebCore
+
+#endif // V8ValueCache_h
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index 1f4848bad..752aaa7a2 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -42,10 +42,10 @@
 #include "SharedWorker.h"
 #include "SharedWorkerContext.h"
 #include "V8Binding.h"
-#include "V8BindingPerContextData.h"
 #include "V8DOMMap.h"
 #include "V8DOMWindowShell.h"
 #include "V8DedicatedWorkerContext.h"
+#include "V8PerContextData.h"
 #include "V8Proxy.h"
 #include "V8RecursionScope.h"
 #include "V8SharedWorkerContext.h"
@@ -122,12 +122,16 @@ void WorkerContextExecutionProxy::initIsolate()
     v8::V8::SetGlobalGCPrologueCallback(&V8GCController::gcPrologue);
     v8::V8::SetGlobalGCEpilogueCallback(&V8GCController::gcEpilogue);
 
+    // FIXME: Remove the following 2 lines when V8 default has changed.
+    const char es5ReadonlyFlag[] = "--es5_readonly";
+    v8::V8::SetFlagsFromString(es5ReadonlyFlag, sizeof(es5ReadonlyFlag));
+
     v8::ResourceConstraints resource_constraints;
     uint32_t here;
     resource_constraints.set_stack_limit(&here - kWorkerMaxStackSize / sizeof(uint32_t*));
     v8::SetResourceConstraints(&resource_constraints);
 
-    V8BindingPerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
+    V8PerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
 }
 
 bool WorkerContextExecutionProxy::initContextIfNeeded()
@@ -153,7 +157,7 @@ bool WorkerContextExecutionProxy::initContextIfNeeded()
 
     v8::Context::Scope scope(context);
 
-    m_perContextData = V8BindingPerContextData::create(m_context);
+    m_perContextData = V8PerContextData::create(m_context);
     if (!m_perContextData->init()) {
         dispose();
         return false;
@@ -179,7 +183,7 @@ bool WorkerContextExecutionProxy::initContextIfNeeded()
     // Wrap the object.
     V8DOMWrapper::setDOMWrapper(jsWorkerContext, contextType, m_workerContext);
 
-    V8DOMWrapper::setJSWrapperForDOMObject(PassRefPtr<WorkerContext>(m_workerContext), v8::Persistent<v8::Object>::New(jsWorkerContext));
+    V8DOMWrapper::setJSWrapperForDOMObject(PassRefPtr<WorkerContext>(m_workerContext), jsWorkerContext);
 
     // Insert the object instance as the prototype of the shadow object.
     v8::Handle<v8::Object> globalObject = v8::Handle<v8::Object>::Cast(m_context->Global()->GetPrototype());
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
index 0df5a3ae7..5bc28128c 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
@@ -44,7 +44,7 @@ namespace WebCore {
 
     class Event;
     class EventTarget;
-    class V8BindingPerContextData;
+    class V8PerContextData;
     class WorkerContext;
     struct WrapperTypeInfo;
 
@@ -74,7 +74,7 @@ namespace WebCore {
         // Returns a local handle of the context.
         v8::Local<v8::Context> context() { return v8::Local<v8::Context>::New(m_context); }
 
-        V8BindingPerContextData* perContextData() { return m_perContextData.get(); }
+        V8PerContextData* perContextData() { return m_perContextData.get(); }
 
     private:
         void initIsolate();
@@ -93,7 +93,7 @@ namespace WebCore {
 
         Vector<Event*> m_events;
 
-        OwnPtr<V8BindingPerContextData> m_perContextData;
+        OwnPtr<V8PerContextData> m_perContextData;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.cpp b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
index 79c8810fb..d67895129 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
@@ -60,7 +60,7 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
     , m_executionForbidden(false)
     , m_executionScheduledToTerminate(false)
 {
-    V8BindingPerIsolateData* data = V8BindingPerIsolateData::create(m_isolate);
+    V8PerIsolateData* data = V8PerIsolateData::create(m_isolate);
     data->allStores().append(&m_DOMDataStore);
     data->setDOMDataStore(&m_DOMDataStore);
     m_isolate->Enter();
@@ -77,7 +77,7 @@ WorkerScriptController::~WorkerScriptController()
     WebKit::Platform::current()->didStopWorkerRunLoop(WebKit::WebWorkerRunLoop(&m_workerContext->thread()->runLoop()));
 #endif
     m_proxy.clear();
-    V8BindingPerIsolateData::dispose(m_isolate);
+    V8PerIsolateData::dispose(m_isolate);
     m_isolate->Exit();
     m_isolate->Dispose();
 }
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
index 15546e6d6..3c25ad8c5 100755
--- a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
@@ -72,7 +72,7 @@ void WorkerScriptDebugServer::addListener(ScriptDebugListener* listener)
         return;
 
     v8::Handle<v8::Function> getScriptsFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("getWorkerScripts")));
-    v8::Handle<v8::Value> argv[] = { v8::Handle<v8::Value>() };
+    v8::Handle<v8::Value> argv[] = { v8Undefined() };
     v8::Handle<v8::Value> value = getScriptsFunction->Call(m_debuggerScript.get(), 0, argv);
     if (value.IsEmpty())
         return;
diff --git a/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
index 3196dd89a..e71825d70 100644
--- a/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
@@ -72,9 +72,10 @@ v8::Handle<v8::Value> V8ArrayBuffer::constructorCallback(const v8::Arguments& ar
     if (!buffer.get())
         return V8Proxy::throwError(V8Proxy::RangeError, "ArrayBuffer size is not a small enough positive integer.", args.GetIsolate());
     // Transform the holder into a wrapper object for the array.
-    V8DOMWrapper::setDOMWrapper(args.Holder(), &info, buffer.get());
-    V8DOMWrapper::setJSWrapperForDOMObject(buffer.release(), v8::Persistent<v8::Object>::New(args.Holder()));
-    return args.Holder();
+    v8::Handle<v8::Object> wrapper = args.Holder();
+    V8DOMWrapper::setDOMWrapper(wrapper, &info, buffer.get());
+    V8DOMWrapper::setJSWrapperForDOMObject(buffer.release(), wrapper);
+    return wrapper;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h b/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
index e4ac3544b..277c978d0 100644
--- a/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
+++ b/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
@@ -44,6 +44,18 @@ namespace WebCore {
 // Returns true if it succeeded, otherwise returns false.
 bool copyElements(v8::Handle<v8::Object> destArray, v8::Handle<v8::Object> srcArray, uint32_t length, uint32_t offset, v8::Isolate*);
 
+template<class ArrayClass>
+v8::Handle<v8::Value> wrapArrayBufferView(const v8::Arguments& args, WrapperTypeInfo* type, ArrayClass array, v8::ExternalArrayType arrayType, bool hasIndexer)
+{
+    // Transform the holder into a wrapper object for the array.
+    V8DOMWrapper::setDOMWrapper(args.Holder(), type, array.get());
+    if (hasIndexer)
+        args.Holder()->SetIndexedPropertiesToExternalArrayData(array.get()->baseAddress(), arrayType, array.get()->length());
+    v8::Handle<v8::Object> wrapper = args.Holder();
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(array.release(), wrapper);
+    wrapperHandle.MarkIndependent();
+    return wrapper;
+}
 
 // Template function used by the ArrayBufferView*Constructor callbacks.
 template<class ArrayClass, class ElementType>
@@ -73,18 +85,14 @@ v8::Handle<v8::Value> constructWebGLArrayWithArrayBufferArgument(const v8::Argum
     RefPtr<ArrayClass> array = ArrayClass::create(buf, offset, length);
     if (!array)
         return V8Proxy::setDOMException(INDEX_SIZE_ERR, args.GetIsolate());
-    // Transform the holder into a wrapper object for the array.
-    V8DOMWrapper::setDOMWrapper(args.Holder(), type, array.get());
-    if (hasIndexer)
-        args.Holder()->SetIndexedPropertiesToExternalArrayData(array.get()->baseAddress(), arrayType, array.get()->length());
-    v8::Persistent<v8::Object> wrapper = v8::Persistent<v8::Object>::New(args.Holder());
-    wrapper.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForDOMObject(array.release(), wrapper);
-    return args.Holder();
+
+    return wrapArrayBufferView(args, type, array, arrayType, hasIndexer);
 }
 
+static const char* notSmallEnoughSize = "ArrayBufferView size is not a small enough positive integer.";
+
 // Template function used by the ArrayBufferView*Constructor callbacks.
-template<class ArrayClass, class ElementType>
+template<class ArrayClass, class JavaScriptWrapperArrayType, class ElementType>
 v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperTypeInfo* type, v8::ExternalArrayType arrayType)
 {
     if (!args.IsConstructCall())
@@ -104,15 +112,10 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
         // construct an empty view to avoid crashes when fetching the
         // length.
         RefPtr<ArrayClass> array = ArrayClass::create(0);
-        // Transform the holder into a wrapper object for the array.
-        V8DOMWrapper::setDOMWrapper(args.Holder(), type, array.get());
         // Do not call SetIndexedPropertiesToExternalArrayData on this
         // object. Not only is there no point from a performance
         // perspective, but doing so causes errors in the subset() case.
-        v8::Persistent<v8::Object> wrapper = v8::Persistent<v8::Object>::New(args.Holder());
-        wrapper.MarkIndependent();
-        V8DOMWrapper::setJSWrapperForDOMObject(array.release(), wrapper);
-        return args.Holder();
+        return wrapArrayBufferView(args, type, array, arrayType, false);
     }
 
     // Supported constructors:
@@ -134,6 +137,20 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
     if (V8ArrayBuffer::HasInstance(args[0]))
       return constructWebGLArrayWithArrayBufferArgument<ArrayClass, ElementType>(args, type, arrayType, true);
 
+    // See whether the first argument is the same type as impl. In that case,
+    // we can simply memcpy data from source to impl.
+    if (JavaScriptWrapperArrayType::HasInstance(args[0])) {
+        ArrayClass* source = JavaScriptWrapperArrayType::toNative(args[0]->ToObject());
+        uint32_t length = source->length();
+        RefPtr<ArrayClass> array = ArrayClass::createUninitialized(length);
+        if (!array.get())
+            return V8Proxy::throwError(V8Proxy::RangeError, notSmallEnoughSize, args.GetIsolate());
+
+        memcpy(array->baseAddress(), source->baseAddress(), length * sizeof(ElementType));
+
+        return wrapArrayBufferView(args, type, array, arrayType, true);
+    }
+
     uint32_t len = 0;
     v8::Handle<v8::Object> srcArray;
     bool doInstantiation = false;
@@ -154,10 +171,15 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
     }
 
     RefPtr<ArrayClass> array;
-    if (doInstantiation)
-        array = ArrayClass::create(len);
+    if (doInstantiation) {
+        if (srcArray.IsEmpty())
+            array = ArrayClass::create(len);
+        else
+            array = ArrayClass::createUninitialized(len);
+    }
+
     if (!array.get())
-        return V8Proxy::throwError(V8Proxy::RangeError, "ArrayBufferView size is not a small enough positive integer.", args.GetIsolate());
+        return V8Proxy::throwError(V8Proxy::RangeError, notSmallEnoughSize, args.GetIsolate());
 
 
     // Transform the holder into a wrapper object for the array.
@@ -172,10 +194,10 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
         }
     }
 
-    v8::Persistent<v8::Object> wrapper = v8::Persistent<v8::Object>::New(args.Holder());
-    wrapper.MarkIndependent();
-    V8DOMWrapper::setJSWrapperForDOMObject(array.release(), wrapper);
-    return args.Holder();
+    v8::Handle<v8::Object> wrapper = args.Holder();
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(array.release(), wrapper);
+    wrapperHandle.MarkIndependent();
+    return wrapper;
 }
 
 template <class CPlusPlusArrayType, class JavaScriptWrapperArrayType>
diff --git a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
index 9ce2e1af4..2ee81eb27 100644
--- a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
@@ -28,14 +28,15 @@
 
 #include "V8AudioContext.h"
 
-#include <wtf/ArrayBuffer.h>
 #include "AudioBuffer.h"
 #include "AudioContext.h"
+#include "BindingState.h"
 #include "Frame.h"
 #include "V8ArrayBuffer.h"
 #include "V8AudioBuffer.h"
 #include "V8Binding.h"
 #include "V8Proxy.h"
+#include <wtf/ArrayBuffer.h>
 
 namespace WebCore {
 
@@ -49,7 +50,7 @@ v8::Handle<v8::Value> V8AudioContext::constructorCallback(const v8::Arguments& a
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
 
-    Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
+    Frame* frame = currentFrame(BindingState::instance());
     if (!frame)
         return V8Proxy::throwError(V8Proxy::ReferenceError, "AudioContext constructor associated frame is unavailable", args.GetIsolate());
 
@@ -64,7 +65,7 @@ v8::Handle<v8::Value> V8AudioContext::constructorCallback(const v8::Arguments& a
         ExceptionCode ec = 0;
         audioContext = AudioContext::create(document, ec);
         if (ec)
-            return throwError(ec, args.GetIsolate());
+            return V8Proxy::setDOMException(ec, args.GetIsolate());
         if (!audioContext.get())
             return V8Proxy::throwError(V8Proxy::SyntaxError, "audio resources unavailable for AudioContext construction", args.GetIsolate());
     } else {
@@ -90,7 +91,7 @@ v8::Handle<v8::Value> V8AudioContext::constructorCallback(const v8::Arguments& a
         ExceptionCode ec = 0;
         audioContext = AudioContext::createOfflineContext(document, numberOfChannels, numberOfFrames, sampleRate, ec);
         if (ec)
-            return throwError(ec, args.GetIsolate());
+            return V8Proxy::setDOMException(ec, args.GetIsolate());
     }
 
     if (!audioContext.get())
diff --git a/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp b/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp
index bac3b0f20..df01e7634 100644
--- a/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp
@@ -35,7 +35,6 @@
 #include "V8ArrayBuffer.h"
 #include "V8ArrayBufferView.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8Blob.h"
 #include "V8File.h"
 #include "V8Proxy.h"
@@ -87,7 +86,7 @@ v8::Handle<v8::Value> V8Blob::constructorCallback(const v8::Arguments& args)
         if (!args[1]->IsObject())
             return V8Proxy::throwTypeError("Second argument of the constructor is not of type Object", args.GetIsolate());
 
-        Dictionary dictionary(args[1]);
+        EXCEPTION_BLOCK(Dictionary, dictionary, Dictionary(args[1], args.GetIsolate()));
 
         v8::TryCatch tryCatchEndings;
         bool containsEndings = dictionary.get("endings", endings);
diff --git a/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
index af2375f7c..03d452378 100644
--- a/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
@@ -195,14 +195,14 @@ v8::Handle<v8::Value> V8CSSStyleDeclaration::namedPropertyGetter(v8::Local<v8::S
     INC_STATS("DOM.CSSStyleDeclaration.NamedPropertyGetter");
     // First look for API defined attributes on the style declaration object.
     if (info.Holder()->HasRealNamedCallbackProperty(name))
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     // Search the style declaration.
     CSSPropertyInfo* propInfo = cssPropertyInfo(name);
 
     // Do not handle non-property names.
     if (!propInfo)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     CSSStyleDeclaration* imp = V8CSSStyleDeclaration::toNative(info.Holder());
     RefPtr<CSSValue> cssValue = imp->getPropertyCSSValueInternal(static_cast<CSSPropertyID>(propInfo->propID));
@@ -228,7 +228,7 @@ v8::Handle<v8::Value> V8CSSStyleDeclaration::namedPropertySetter(v8::Local<v8::S
     CSSStyleDeclaration* imp = V8CSSStyleDeclaration::toNative(info.Holder());
     CSSPropertyInfo* propInfo = cssPropertyInfo(name);
     if (!propInfo)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     String propertyValue = toWebCoreStringWithNullCheck(value);
     if (propInfo->hadPixelOrPosPrefix)
@@ -238,7 +238,7 @@ v8::Handle<v8::Value> V8CSSStyleDeclaration::namedPropertySetter(v8::Local<v8::S
     imp->setPropertyInternal(static_cast<CSSPropertyID>(propInfo->propID), propertyValue, false, ec);
 
     if (ec)
-        throwError(ec, info.GetIsolate());
+        V8Proxy::setDOMException(ec, info.GetIsolate());
 
     return value;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
index e7e0ee7e0..d8a9b1ff2 100644
--- a/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
@@ -37,7 +37,6 @@
 #include "ScriptCallStack.h"
 #include "ScriptCallStackFactory.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8MemoryInfo.h"
 #include "V8Proxy.h"
 
@@ -50,7 +49,7 @@ v8::Handle<v8::Value> V8Console::traceCallback(const v8::Arguments& args)
     RefPtr<ScriptCallStack> callStack(createScriptCallStack(ScriptCallStack::maxCallStackSizeToCapture));
     RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 0));
     imp->trace(scriptArguments.release(), callStack);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 v8::Handle<v8::Value> V8Console::assertCallback(const v8::Arguments& args)
@@ -61,7 +60,7 @@ v8::Handle<v8::Value> V8Console::assertCallback(const v8::Arguments& args)
     bool condition = args[0]->BooleanValue();
     RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 1));
     imp->assertCondition(scriptArguments.release(), callStack, condition);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -74,7 +73,7 @@ v8::Handle<v8::Value> V8Console::profileCallback(const v8::Arguments& args)
         return v8::Undefined();
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<WithUndefinedOrNullCheck>, title, args[0]);
     imp->profile(title, ScriptState::current(), callStack);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 v8::Handle<v8::Value> V8Console::profileEndCallback(const v8::Arguments& args)
@@ -86,7 +85,7 @@ v8::Handle<v8::Value> V8Console::profileEndCallback(const v8::Arguments& args)
         return v8::Undefined();
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<WithUndefinedOrNullCheck>, title, args[0]);
     imp->profileEnd(title, ScriptState::current(), callStack);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 #endif
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
index 8f75c0e57..ec202cce4 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
@@ -55,9 +55,10 @@ v8::Handle<v8::Value> V8DOMFormData::constructorCallback(const v8::Arguments& ar
         form = V8HTMLFormElement::toNative(args[0]->ToObject());
     RefPtr<DOMFormData> domFormData = DOMFormData::create(form);
 
-    V8DOMWrapper::setDOMWrapper(args.Holder(), &info, domFormData.get());
-    V8DOMWrapper::setJSWrapperForDOMObject(domFormData.release(), v8::Persistent<v8::Object>::New(args.Holder()));
-    return args.Holder();
+    v8::Handle<v8::Object> wrapper = args.Holder();
+    V8DOMWrapper::setDOMWrapper(wrapper, &info, domFormData.get());
+    V8DOMWrapper::setJSWrapperForDOMObject(domFormData.release(), wrapper);
+    return wrapper;
 }
 
 v8::Handle<v8::Value> V8DOMFormData::appendCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
index 5d43d4070..119282229 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
@@ -42,7 +42,7 @@ v8::Handle<v8::Integer> V8DOMStringMap::namedPropertyQuery(v8::Local<v8::String>
 {
     INC_STATS("DOM.DOMStringMap.NamedPropertyQuery");
     if (V8DOMStringMap::toNative(info.Holder())->contains(toWebCoreString(name)))
-        return v8Integer(v8::None, info.GetIsolate());
+        return v8Integer(0, info.GetIsolate());
     return v8::Handle<v8::Integer>();
 }
 
@@ -51,7 +51,7 @@ v8::Handle<v8::Value> V8DOMStringMap::namedPropertyGetter(v8::Local<v8::String>
     INC_STATS("DOM.DOMStringMap.NamedPropertyGetter");
     String value = V8DOMStringMap::toNative(info.Holder())->item(toWebCoreString(name));
     if (value.isNull())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     return v8StringOrUndefined(value, info.GetIsolate());
 }
 
@@ -80,7 +80,7 @@ v8::Handle<v8::Value> V8DOMStringMap::namedPropertySetter(v8::Local<v8::String>
     ExceptionCode ec = 0;
     V8DOMStringMap::toNative(info.Holder())->setItem(toWebCoreString(name), toWebCoreString(value), ec);
     if (ec)
-        return throwError(ec, info.GetIsolate());
+        return V8Proxy::setDOMException(ec, info.GetIsolate());
     return value;
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index 0dcc29952..3fe880a78 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -31,7 +31,7 @@
 #include "config.h"
 #include "V8DOMWindow.h"
 
-#include <wtf/ArrayBuffer.h>
+#include "BindingState.h"
 #include "Chrome.h"
 #include "ContentSecurityPolicy.h"
 #include "DOMTimer.h"
@@ -56,8 +56,6 @@
 #include "SharedWorkerRepository.h"
 #include "Storage.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
-#include "V8BindingState.h"
 #include "V8EventListener.h"
 #include "V8GCForContextDispose.h"
 #include "V8HiddenPropertyName.h"
@@ -66,6 +64,7 @@
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WindowFeatures.h"
+#include <wtf/ArrayBuffer.h>
 
 namespace WebCore {
 
@@ -107,7 +106,7 @@ v8::Handle<v8::Value> WindowSetTimeoutImpl(const v8::Arguments& args, bool singl
     if (argumentCount >= 2)
         timeout = args[1]->Int32Value();
 
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame()))
         return v8::Undefined();
 
     int id;
@@ -152,7 +151,7 @@ v8::Handle<v8::Value> V8DOMWindow::eventAccessorGetter(v8::Local<v8::String> nam
         return v8::Undefined();
 
     Frame* frame = V8DOMWindow::toNative(holder)->frame();
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), frame, true))
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), frame))
         return v8::Undefined();
 
     v8::Local<v8::Context> context = V8Proxy::context(frame);
@@ -173,7 +172,7 @@ void V8DOMWindow::eventAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::
         return;
 
     Frame* frame = V8DOMWindow::toNative(holder)->frame();
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), frame, true))
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), frame))
         return;
 
     v8::Local<v8::Context> context = V8Proxy::context(frame);
@@ -187,25 +186,25 @@ void V8DOMWindow::eventAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::
 void V8DOMWindow::locationAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     DOMWindow* imp = V8DOMWindow::toNative(info.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
-    DOMWindow* activeWindow = state->activeWindow();
-    if (!activeWindow)
+    DOMWindow* active = activeDOMWindow(state);
+    if (!active)
       return;
 
-    DOMWindow* firstWindow = state->firstWindow();
-    if (!firstWindow)
+    DOMWindow* first = firstDOMWindow(state);
+    if (!first)
       return;
 
     if (Location* location = imp->location())
-        location->setHref(toWebCoreString(value), activeWindow, firstWindow);
+        location->setHref(toWebCoreString(value), active, first);
 }
 
 void V8DOMWindow::openerAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     DOMWindow* imp = V8DOMWindow::toNative(info.Holder());
 
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame()))
         return;
 
     // Opener can be shadowed if it is in the same domain.
@@ -234,7 +233,7 @@ v8::Handle<v8::Value> V8DOMWindow::addEventListenerCallback(const v8::Arguments&
 
     DOMWindow* imp = V8DOMWindow::toNative(args.Holder());
 
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame()))
         return v8::Undefined();
 
     Document* doc = imp->document();
@@ -243,8 +242,7 @@ v8::Handle<v8::Value> V8DOMWindow::addEventListenerCallback(const v8::Arguments&
         return v8::Undefined();
 
     // FIXME: Check if there is not enough arguments
-    V8Proxy* proxy = V8Proxy::retrieve(imp->frame());
-    if (!proxy)
+    if (!imp->frame())
         return v8::Undefined();
 
     RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(args[1], false, ListenerFindOrCreate);
@@ -267,7 +265,7 @@ v8::Handle<v8::Value> V8DOMWindow::removeEventListenerCallback(const v8::Argumen
 
     DOMWindow* imp = V8DOMWindow::toNative(args.Holder());
 
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame()))
         return v8::Undefined();
 
     Document* doc = imp->document();
@@ -275,8 +273,7 @@ v8::Handle<v8::Value> V8DOMWindow::removeEventListenerCallback(const v8::Argumen
     if (!doc)
         return v8::Undefined();
 
-    V8Proxy* proxy = V8Proxy::retrieve(imp->frame());
-    if (!proxy)
+    if (!imp->frame())
         return v8::Undefined();
 
     RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(args[1], false, ListenerFindOnly);
@@ -302,7 +299,7 @@ static v8::Handle<v8::Value> handlePostMessageCallback(const v8::Arguments& args
     // None of these need to be RefPtr because args and context are guaranteed
     // to hold on to them.
     DOMWindow* window = V8DOMWindow::toNative(args.Holder());
-    DOMWindow* source = V8Proxy::retrieveWindowForCallingContext();
+    DOMWindow* source = activeDOMWindow(BindingState::instance());
 
     // If called directly by WebCore we don't have a calling context.
     if (!source)
@@ -326,7 +323,7 @@ static v8::Handle<v8::Value> handlePostMessageCallback(const v8::Arguments& args
                 targetOriginArgIndex = 2;
                 transferablesArgIndex = 1;
             }
-            if (!extractTransferables(args[transferablesArgIndex], portArray, arrayBufferArray))
+            if (!extractTransferables(args[transferablesArgIndex], portArray, arrayBufferArray, args.GetIsolate()))
                 return v8::Undefined();
         } 
         targetOrigin = toWebCoreStringWithNullOrUndefinedCheck(args[targetOriginArgIndex]);
@@ -348,7 +345,7 @@ static v8::Handle<v8::Value> handlePostMessageCallback(const v8::Arguments& args
 
     ExceptionCode ec = 0;
     window->postMessage(message.release(), &portArray, targetOrigin, source, ec);
-    return throwError(ec, args.GetIsolate());
+    return V8Proxy::setDOMException(ec, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8DOMWindow::postMessageCallback(const v8::Arguments& args)
@@ -434,8 +431,8 @@ v8::Handle<v8::Value> V8DOMWindow::showModalDialogCallback(const v8::Arguments&
 {
     INC_STATS("DOM.DOMWindow.showModalDialog()");
     DOMWindow* impl = V8DOMWindow::toNative(args.Holder());
-    V8BindingState* state = V8BindingState::Only();
-    if (!V8BindingSecurity::canAccessFrame(state, impl->frame(), true))
+    BindingState* state = BindingState::instance();
+    if (!BindingSecurity::shouldAllowAccessToFrame(state, impl->frame()))
         return v8::Undefined();
 
     // FIXME: Handle exceptions properly.
@@ -443,9 +440,7 @@ v8::Handle<v8::Value> V8DOMWindow::showModalDialogCallback(const v8::Arguments&
     DialogHandler handler(args[1]);
     String dialogFeaturesString = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
 
-    DOMWindow* activeWindow = state->activeWindow();
-    DOMWindow* firstWindow = state->firstWindow();
-    impl->showModalDialog(urlString, dialogFeaturesString, activeWindow, firstWindow, setUpDialog, &handler);
+    impl->showModalDialog(urlString, dialogFeaturesString, activeDOMWindow(state), firstDOMWindow(state), setUpDialog, &handler);
 
     return handler.returnValue();
 }
@@ -454,8 +449,8 @@ v8::Handle<v8::Value> V8DOMWindow::openCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.DOMWindow.open()");
     DOMWindow* impl = V8DOMWindow::toNative(args.Holder());
-    V8BindingState* state = V8BindingState::Only();
-    if (!V8BindingSecurity::canAccessFrame(state, impl->frame(), true))
+    BindingState* state = BindingState::instance();
+    if (!BindingSecurity::shouldAllowAccessToFrame(state, impl->frame()))
         return v8::Undefined();
 
     // FIXME: Handle exceptions properly.
@@ -463,9 +458,7 @@ v8::Handle<v8::Value> V8DOMWindow::openCallback(const v8::Arguments& args)
     AtomicString frameName = (args[1]->IsUndefined() || args[1]->IsNull()) ? "_blank" : AtomicString(toWebCoreString(args[1]));
     String windowFeaturesString = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
 
-    DOMWindow* activeWindow = state->activeWindow();
-    DOMWindow* firstWindow = state->firstWindow();
-    RefPtr<DOMWindow> openedWindow = impl->open(urlString, frameName, windowFeaturesString, activeWindow, firstWindow);
+    RefPtr<DOMWindow> openedWindow = impl->open(urlString, frameName, windowFeaturesString, activeDOMWindow(state), firstDOMWindow(state));
     if (!openedWindow)
         return v8::Undefined();
 
@@ -478,17 +471,17 @@ v8::Handle<v8::Value> V8DOMWindow::indexedPropertyGetter(uint32_t index, const v
 
     DOMWindow* window = V8DOMWindow::toNative(info.Holder());
     if (!window)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     Frame* frame = window->frame();
     if (!frame)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     Frame* child = frame->tree()->scopedChild(index);
     if (child)
         return toV8(child->domWindow(), info.GetIsolate());
 
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 
@@ -498,22 +491,22 @@ v8::Handle<v8::Value> V8DOMWindow::namedPropertyGetter(v8::Local<v8::String> nam
 
     DOMWindow* window = V8DOMWindow::toNative(info.Holder());
     if (!window)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     Frame* frame = window->frame();
     // window is detached from a frame.
     if (!frame)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     // Search sub-frames.
-    AtomicString propName = v8StringToAtomicWebCoreString(name);
+    AtomicString propName = v8ValueToAtomicWebCoreString(name);
     Frame* child = frame->tree()->scopedChild(propName);
     if (child)
         return toV8(child->domWindow(), info.GetIsolate());
 
     // Search IDL functions defined in the prototype
     if (!info.Holder()->GetRealNamedProperty(name).IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     // Search named items in the document.
     Document* doc = frame->document();
@@ -529,7 +522,7 @@ v8::Handle<v8::Value> V8DOMWindow::namedPropertyGetter(v8::Local<v8::String> nam
         }
     }
 
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 
@@ -576,7 +569,7 @@ bool V8DOMWindow::namedSecurityCheck(v8::Local<v8::Object> host, v8::Local<v8::V
             return true;
     }
 
-    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), target, false);
+    return BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), target, DoNotReportSecurityError);
 }
 
 bool V8DOMWindow::indexedSecurityCheck(v8::Local<v8::Object> host, uint32_t index, v8::AccessType type, v8::Local<v8::Value>)
@@ -601,7 +594,7 @@ bool V8DOMWindow::indexedSecurityCheck(v8::Local<v8::Object> host, uint32_t inde
     if (type == v8::ACCESS_GET && childFrame && !host->HasRealIndexedProperty(index))
         return true;
 
-    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), target, false);
+    return BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), target, DoNotReportSecurityError);
 }
 
 v8::Handle<v8::Value> toV8(DOMWindow* window, v8::Isolate* isolate)
@@ -612,7 +605,7 @@ v8::Handle<v8::Value> toV8(DOMWindow* window, v8::Isolate* isolate)
     // of the frame.
     Frame* frame = window->frame();
     if (!frame)
-        return v8::Handle<v8::Object>();
+        return v8Undefined();
 
     // Special case: Because of evaluateInIsolatedWorld() one DOMWindow can have
     // multiple contexts and multiple global objects associated with it. When
@@ -630,7 +623,7 @@ v8::Handle<v8::Value> toV8(DOMWindow* window, v8::Isolate* isolate)
     // Otherwise, return the global object associated with this frame.
     v8::Handle<v8::Context> context = V8Proxy::context(frame);
     if (context.IsEmpty())
-        return v8::Handle<v8::Object>();
+        return v8Undefined();
 
     v8::Handle<v8::Object> global = context->Global();
     ASSERT(!global.IsEmpty());
diff --git a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
index bddba9aa0..037d4b357 100755
--- a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
@@ -28,7 +28,6 @@
 
 #include "V8ArrayBufferViewCustom.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8DataView.h"
 #include "V8Proxy.h"
 
@@ -48,9 +47,10 @@ v8::Handle<v8::Value> V8DataView::constructorCallback(const v8::Arguments& args)
         // see constructWebGLArray -- we don't seem to be able to distingish between
         // 'new DataView()' and the call used to construct the cached DataView object.
         RefPtr<DataView> dataView = DataView::create(0);
-        V8DOMWrapper::setDOMWrapper(args.Holder(), &info, dataView.get());
-        V8DOMWrapper::setJSWrapperForDOMObject(dataView.release(), v8::Persistent<v8::Object>::New(args.Holder()));
-        return args.Holder();
+        v8::Handle<v8::Object> wrapper = args.Holder();
+        V8DOMWrapper::setDOMWrapper(wrapper, &info, dataView.get());
+        V8DOMWrapper::setJSWrapperForDOMObject(dataView.release(), wrapper);
+        return wrapper;
     }
     if (args[0]->IsNull() || !V8ArrayBuffer::HasInstance(args[0]))
         return V8Proxy::throwTypeError(0, args.GetIsolate());
@@ -107,7 +107,7 @@ v8::Handle<v8::Value> V8DataView::setInt8Callback(const v8::Arguments& args)
     imp->setInt8(byteOffset, static_cast<int8_t>(value), ec);
     if (UNLIKELY(ec))
         return V8Proxy::setDOMException(ec, args.GetIsolate());
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 v8::Handle<v8::Value> V8DataView::setUint8Callback(const v8::Arguments& args)
@@ -123,7 +123,7 @@ v8::Handle<v8::Value> V8DataView::setUint8Callback(const v8::Arguments& args)
     imp->setUint8(byteOffset, static_cast<uint8_t>(value), ec);
     if (UNLIKELY(ec))
         return V8Proxy::setDOMException(ec, args.GetIsolate());
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
index 76d16a4cd..c3334fc8f 100644
--- a/Source/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
@@ -49,7 +49,7 @@ static v8::Handle<v8::Value> handlePostMessageCallback(const v8::Arguments& args
     MessagePortArray ports;
     ArrayBufferArray arrayBuffers;
     if (args.Length() > 1) {
-        if (!extractTransferables(args[1], ports, arrayBuffers))
+        if (!extractTransferables(args[1], ports, arrayBuffers, args.GetIsolate()))
             return v8::Undefined();
     }
     bool didThrow = false;
@@ -63,7 +63,7 @@ static v8::Handle<v8::Value> handlePostMessageCallback(const v8::Arguments& args
         return v8::Undefined();
     ExceptionCode ec = 0;
     workerContext->postMessage(message.release(), &ports, ec);
-    return throwError(ec, args.GetIsolate());
+    return V8Proxy::setDOMException(ec, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8DedicatedWorkerContext::postMessageCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8DeviceMotionEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DeviceMotionEventCustom.cpp
index e3e290161..610a34bdc 100644
--- a/Source/WebCore/bindings/v8/custom/V8DeviceMotionEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DeviceMotionEventCustom.cpp
@@ -30,7 +30,6 @@
 
 #include "DeviceMotionData.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8Proxy.h"
 
 #include <v8.h>
@@ -176,7 +175,7 @@ v8::Handle<v8::Value> V8DeviceMotionEvent::initDeviceMotionEventCallback(const v
     double interval = args[6]->NumberValue();
     RefPtr<DeviceMotionData> deviceMotionData = DeviceMotionData::create(acceleration, accelerationIncludingGravity, rotationRate, intervalProvided, interval);
     imp->initDeviceMotionEvent(type, bubbles, cancelable, deviceMotionData.get());
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp
index bbdc3fce8..128302439 100644
--- a/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp
@@ -30,7 +30,6 @@
 
 #include "DeviceOrientationData.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8Proxy.h"
 
 #include <v8.h>
@@ -95,7 +94,7 @@ v8::Handle<v8::Value> V8DeviceOrientationEvent::initDeviceOrientationEventCallba
     bool absolute = args[6]->BooleanValue();
     RefPtr<DeviceOrientationData> orientation = DeviceOrientationData::create(alphaProvided, alpha, betaProvided, beta, gammaProvided, gamma, absoluteProvided, absolute);
     imp->initDeviceOrientationEvent(type, bubbles, cancelable, orientation.get());
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp
index 6fe52424f..c76f3205d 100644
--- a/Source/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp
@@ -36,7 +36,6 @@
 #include "DirectoryEntry.h"
 #include "ExceptionCode.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8EntryCallback.h"
 #include "V8ErrorCallback.h"
 #include "V8Proxy.h"
@@ -56,7 +55,7 @@ v8::Handle<v8::Value> V8DirectoryEntry::getDirectoryCallback(const v8::Arguments
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<WithUndefinedOrNullCheck>, path, args[0]);
     if (args.Length() <= 1) {
         imp->getDirectory(path);
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     RefPtr<WebKitFlags> flags;
     if (!isUndefinedOrNull(args[1]) && args[1]->IsObject()) {
@@ -76,17 +75,17 @@ v8::Handle<v8::Value> V8DirectoryEntry::getDirectoryCallback(const v8::Arguments
     RefPtr<EntryCallback> successCallback;
     if (args.Length() > 2 && !args[2]->IsNull() && !args[2]->IsUndefined()) {
         if (!args[2]->IsObject())
-            return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+            return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
         successCallback = V8EntryCallback::create(args[2], getScriptExecutionContext());
     }
     RefPtr<ErrorCallback> errorCallback;
     if (args.Length() > 3 && !args[3]->IsNull() && !args[3]->IsUndefined()) {
         if (!args[3]->IsObject())
-            return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+            return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
         errorCallback = V8ErrorCallback::create(args[3], getScriptExecutionContext());
     }
     imp->getDirectory(path, flags, successCallback, errorCallback);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 v8::Handle<v8::Value> V8DirectoryEntry::getFileCallback(const v8::Arguments& args)
@@ -100,7 +99,7 @@ v8::Handle<v8::Value> V8DirectoryEntry::getFileCallback(const v8::Arguments& arg
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<WithUndefinedOrNullCheck>, path, args[0]);
     if (args.Length() <= 1) {
         imp->getFile(path);
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     }
     RefPtr<WebKitFlags> flags;
     if (!isUndefinedOrNull(args[1]) && args[1]->IsObject()) {
@@ -120,17 +119,17 @@ v8::Handle<v8::Value> V8DirectoryEntry::getFileCallback(const v8::Arguments& arg
     RefPtr<EntryCallback> successCallback;
     if (args.Length() > 2 && !args[2]->IsNull() && !args[2]->IsUndefined()) {
         if (!args[2]->IsObject())
-            return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+            return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
         successCallback = V8EntryCallback::create(args[2], getScriptExecutionContext());
     }
     RefPtr<ErrorCallback> errorCallback;
     if (args.Length() > 3 && !args[3]->IsNull() && !args[3]->IsUndefined()) {
         if (!args[3]->IsObject())
-            return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+            return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
         errorCallback = V8ErrorCallback::create(args[3], getScriptExecutionContext());
     }
     imp->getFile(path, flags, successCallback, errorCallback);
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp
index 713b80f30..646c29d23 100644
--- a/Source/WebCore/bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp
@@ -36,7 +36,6 @@
 #include "DirectoryEntrySync.h"
 #include "ExceptionCode.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8EntryCallback.h"
 #include "V8ErrorCallback.h"
 #include "V8FileEntrySync.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
index 42d77fcbb..15907a52f 100644
--- a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
@@ -34,6 +34,7 @@
 #include "CanvasRenderingContext.h"
 #include "Document.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
 #include "Node.h"
 #include "TouchList.h"
 #include "XPathNSResolver.h"
@@ -77,7 +78,7 @@ v8::Handle<v8::Value> V8Document::evaluateCallback(const v8::Arguments& args)
 
     RefPtr<XPathNSResolver> resolver = V8DOMWrapper::getXPathNSResolver(args[2]);
     if (!resolver && !args[2]->IsNull() && !args[2]->IsUndefined())
-        return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+        return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
 
     int type = toInt32(args[3]);
     RefPtr<XPathResult> inResult;
@@ -90,7 +91,7 @@ v8::Handle<v8::Value> V8Document::evaluateCallback(const v8::Arguments& args)
         return throwError(exceptionCatcher.Exception(), args.GetIsolate());
 
     if (ec)
-        return throwError(ec, args.GetIsolate());
+        return V8Proxy::setDOMException(ec, args.GetIsolate());
 
     return toV8(result.release(), args.GetIsolate());
 }
@@ -131,8 +132,8 @@ v8::Handle<v8::Value> toV8(Document* impl, v8::Isolate* isolate, bool forceNewOb
     if (wrapper.IsEmpty())
         return wrapper;
     if (!V8IsolatedContext::getEntered()) {
-        if (V8Proxy* proxy = V8Proxy::retrieve(impl->frame()))
-            proxy->windowShell()->updateDocumentWrapper(wrapper);
+        if (Frame* frame = impl->frame())
+            frame->script()->windowShell()->updateDocumentWrapper(wrapper);
     }
     return wrapper;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8DocumentLocationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DocumentLocationCustom.cpp
index 4ebb78384..b2d81e84c 100644
--- a/Source/WebCore/bindings/v8/custom/V8DocumentLocationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DocumentLocationCustom.cpp
@@ -24,11 +24,11 @@
 #include "config.h"
 #include "V8Document.h"
 
+#include "BindingState.h"
 #include "DOMWindow.h"
 #include "Frame.h"
 #include "Location.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8Location.h"
 #include "V8Proxy.h"
 
@@ -50,19 +50,19 @@ void V8Document::locationAccessorSetter(v8::Local<v8::String> name, v8::Local<v8
     if (!document->frame())
         return;
 
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
-    DOMWindow* activeWindow = state->activeWindow();
-    if (!activeWindow)
-      return;
+    DOMWindow* active = activeDOMWindow(state);
+    if (!active)
+        return;
 
-    DOMWindow* firstWindow = state->firstWindow();
-    if (!firstWindow)
-      return;
+    DOMWindow* first = firstDOMWindow(state);
+    if (!first)
+        return;
 
     DOMWindow* window = document->frame()->domWindow();
     if (Location* location = window->location())
-        location->setHref(toWebCoreString(value), activeWindow, firstWindow);
+        location->setHref(toWebCoreString(value), active, first);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8EntryCustom.cpp b/Source/WebCore/bindings/v8/custom/V8EntryCustom.cpp
index e6cd8234c..a6179c2e5 100644
--- a/Source/WebCore/bindings/v8/custom/V8EntryCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8EntryCustom.cpp
@@ -33,9 +33,9 @@
 
 #if ENABLE(FILE_SYSTEM)
 
+#include "BindingState.h"
 #include "V8Attr.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8DirectoryEntry.h"
 #include "V8Entry.h"
 #include "V8FileEntry.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8EntrySyncCustom.cpp b/Source/WebCore/bindings/v8/custom/V8EntrySyncCustom.cpp
index 129af7a6b..c89e48979 100644
--- a/Source/WebCore/bindings/v8/custom/V8EntrySyncCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8EntrySyncCustom.cpp
@@ -33,9 +33,9 @@
 
 #if ENABLE(FILE_SYSTEM)
 
+#include "BindingState.h"
 #include "V8Attr.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8DirectoryEntrySync.h"
 #include "V8EntrySync.h"
 #include "V8FileEntrySync.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8Float64ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Float64ArrayCustom.cpp
deleted file mode 100644
index 889bd323b..000000000
--- a/Source/WebCore/bindings/v8/custom/V8Float64ArrayCustom.cpp
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "V8Float64Array.h"
-
-#include "V8ArrayBuffer.h"
-#include "V8ArrayBufferViewCustom.h"
-#include "V8Binding.h"
-#include "V8Proxy.h"
-
-#include <wtf/ArrayBuffer.h>
-#include <wtf/Float64Array.h>
-
-namespace WebCore {
-
-v8::Handle<v8::Value> V8Float64Array::constructorCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Float64Array.Contructor");
-
-    return constructWebGLArray<Float64Array, double>(args, &info, v8::kExternalDoubleArray);
-}
-
-v8::Handle<v8::Value> V8Float64Array::setCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Float64Array.set()");
-    return setWebGLArrayHelper<Float64Array, V8Float64Array>(args);
-}
-
-v8::Handle<v8::Value> toV8(Float64Array* impl, v8::Isolate* isolate)
-{
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8Float64Array::wrap(impl, isolate);
-    if (!wrapper.IsEmpty())
-        wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), v8::kExternalDoubleArray, impl->length());
-    return wrapper;
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
index c97a612d7..532e257ac 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
@@ -47,7 +47,7 @@ static v8::Handle<v8::Value> getNamedItems(HTMLAllCollection* collection, Atomic
     collection->namedItems(name, namedItems);
 
     if (!namedItems.size())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     if (namedItems.size() == 1)
         return toV8(namedItems.at(0).release(), isolate);
@@ -76,12 +76,12 @@ v8::Handle<v8::Value> V8HTMLAllCollection::namedPropertyGetter(v8::Local<v8::Str
     INC_STATS("DOM.HTMLAllCollection.NamedPropertyGetter");
 
     if (!info.Holder()->GetRealNamedPropertyInPrototypeChain(name).IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     if (info.Holder()->HasRealNamedCallbackProperty(name))
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     HTMLAllCollection* imp = V8HTMLAllCollection::toNative(info.Holder());
-    return getNamedItems(imp, v8StringToAtomicWebCoreString(name), info.GetIsolate());
+    return getNamedItems(imp, v8ValueToAtomicWebCoreString(name), info.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8HTMLAllCollection::itemCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index 110ae9b86..942602d06 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -87,16 +87,16 @@ v8::Handle<v8::Value> V8HTMLCanvasElement::getContextCallback(const v8::Argument
     if (!result)
         return v8::Null(args.GetIsolate());
 
-    // Both 2D and 3D canvas contexts can hold on to lots of GPU resources, and we
-    // want to take an opportunity to get rid of them as soon as possible when we
-    // navigate away from pages using them.
-    V8BindingPerIsolateData* perIsolateData = V8BindingPerIsolateData::current(args.GetIsolate());
-    perIsolateData->setLowMemoryNotificationHint();
-
     if (result->is2d())
         return toV8(static_cast<CanvasRenderingContext2D*>(result), args.GetIsolate());
 #if ENABLE(WEBGL)
     else if (result->is3d()) {
+        // 3D canvas contexts can hold on to lots of GPU resources, and we want to take an
+        // opportunity to get rid of them as soon as possible when we navigate away from pages using
+        // them.
+        V8PerIsolateData* perIsolateData = V8PerIsolateData::current(args.GetIsolate());
+        perIsolateData->setShouldCollectGarbageSoon();
+
         v8::Handle<v8::Value> v8Result = toV8(static_cast<WebGLRenderingContext*>(result), args.GetIsolate());
         if (InspectorInstrumentation::hasFrontends()) {
             ScriptState* scriptState = ScriptState::forContext(v8::Context::GetCurrent());
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
index 910747bed..3802bb3ec 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
@@ -49,7 +49,7 @@ static v8::Handle<v8::Value> getNamedItems(HTMLCollection* collection, AtomicStr
     collection->namedItems(name, namedItems);
 
     if (!namedItems.size())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     if (namedItems.size() == 1)
         return toV8(namedItems.at(0).release(), isolate);
@@ -65,12 +65,12 @@ v8::Handle<v8::Value> V8HTMLCollection::namedPropertyGetter(v8::Local<v8::String
     INC_STATS("DOM.HTMLCollection.NamedPropertyGetter");
 
     if (!info.Holder()->GetRealNamedPropertyInPrototypeChain(name).IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     if (info.Holder()->HasRealNamedCallbackProperty(name))
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     HTMLCollection* imp = V8HTMLCollection::toNative(info.Holder());
-    return getNamedItems(imp, v8StringToAtomicWebCoreString(name), info.GetIsolate());
+    return getNamedItems(imp, v8ValueToAtomicWebCoreString(name), info.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8HTMLCollection::namedItemCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
index 31efd0ce2..0d421f96d 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "V8HTMLDocument.h"
 
+#include "BindingState.h"
 #include "Frame.h"
 #include "HTMLAllCollection.h"
 #include "HTMLDocument.h"
@@ -45,6 +46,7 @@
 #include "V8Node.h"
 #include "V8Proxy.h"
 #include "V8RecursionScope.h"
+#include <wtf/text/StringBuilder.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/StdLibExtras.h>
@@ -82,11 +84,11 @@ v8::Local<v8::Object> V8HTMLDocument::WrapInShadowObject(v8::Local<v8::Object> w
 v8::Handle<v8::Value> V8HTMLDocument::GetNamedProperty(HTMLDocument* htmlDocument, const AtomicString& key, v8::Isolate* isolate)
 {
     if (!htmlDocument->hasNamedItem(key.impl()) && !htmlDocument->hasExtraNamedItem(key.impl()))
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     RefPtr<HTMLCollection> items = htmlDocument->documentNamedItems(key);
     if (items->isEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     if (items->hasExactlyOneItem()) {
         Node* node = items->item(0);
@@ -108,17 +110,17 @@ v8::Handle<v8::Value> V8HTMLDocument::GetNamedProperty(HTMLDocument* htmlDocumen
 //   document.write() --> document.write("")
 static String writeHelperGetString(const v8::Arguments& args)
 {
-    String str = "";
+    StringBuilder builder;
     for (int i = 0; i < args.Length(); ++i)
-        str += toWebCoreString(args[i]);
-    return str;
+        builder.append(toWebCoreString(args[i]));
+    return builder.toString();
 }
 
 v8::Handle<v8::Value> V8HTMLDocument::writeCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.HTMLDocument.write()");
     HTMLDocument* htmlDocument = V8HTMLDocument::toNative(args.Holder());
-    Frame* frame = V8Proxy::retrieveFrameForCallingContext();
+    Frame* frame = activeFrame(BindingState::instance());
     htmlDocument->write(writeHelperGetString(args), frame ? frame->document() : NULL);
     return v8::Undefined();
 }
@@ -127,7 +129,7 @@ v8::Handle<v8::Value> V8HTMLDocument::writelnCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.HTMLDocument.writeln()");
     HTMLDocument* htmlDocument = V8HTMLDocument::toNative(args.Holder());
-    Frame* frame = V8Proxy::retrieveFrameForCallingContext();
+    Frame* frame = activeFrame(BindingState::instance());
     htmlDocument->writeln(writeHelperGetString(args), frame ? frame->document() : NULL);
     return v8::Undefined();
 }
@@ -155,16 +157,11 @@ v8::Handle<v8::Value> V8HTMLDocument::openCallback(const v8::Arguments& args)
             for (int i = 0; i < args.Length(); i++)
                 params[i] = args[i];
 
-            V8Proxy* proxy = V8Proxy::retrieve(frame.get());
-            if (!proxy)
-                return v8::Undefined();
-
-            v8::Local<v8::Value> result = proxy->callFunction(v8::Local<v8::Function>::Cast(function), global, args.Length(), params.get());
-            return result;
+            return frame->script()->proxy()->callFunction(v8::Local<v8::Function>::Cast(function), global, args.Length(), params.get());
         }
     }
 
-    Frame* frame = V8Proxy::retrieveFrameForCallingContext();
+    Frame* frame = activeFrame(BindingState::instance());
     htmlDocument->open(frame ? frame->document() : NULL);
     // Return the document.
     return args.Holder();
@@ -192,8 +189,8 @@ v8::Handle<v8::Value> toV8(HTMLDocument* impl, v8::Isolate* isolate, bool forceN
     if (wrapper.IsEmpty())
         return wrapper;
     if (!V8IsolatedContext::getEntered()) {
-        if (V8Proxy* proxy = V8Proxy::retrieve(impl->frame()))
-            proxy->windowShell()->updateDocumentWrapper(wrapper);
+        if (Frame* frame = impl->frame())
+            frame->script()->windowShell()->updateDocumentWrapper(wrapper);
     }
     return wrapper;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp
index 4e6292db7..bec020d95 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp
@@ -48,7 +48,7 @@ v8::Handle<v8::Value> V8HTMLFormElement::indexedPropertyGetter(uint32_t index, c
 
     RefPtr<Node> formElement = form->elements()->item(index);
     if (!formElement)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     return toV8(formElement.release(), info.GetIsolate());
 }
 
@@ -56,7 +56,7 @@ v8::Handle<v8::Value> V8HTMLFormElement::namedPropertyGetter(v8::Local<v8::Strin
 {
     INC_STATS("DOM.HTMLFormElement.NamedPropertyGetter");
     HTMLFormElement* imp = V8HTMLFormElement::toNative(info.Holder());
-    AtomicString v = v8StringToAtomicWebCoreString(name);
+    AtomicString v = v8ValueToAtomicWebCoreString(name);
 
     // Call getNamedElements twice, first time check if it has a value
     // and let HTMLFormElement update its cache.
@@ -65,7 +65,7 @@ v8::Handle<v8::Value> V8HTMLFormElement::namedPropertyGetter(v8::Local<v8::Strin
         Vector<RefPtr<Node> > elements;
         imp->getNamedElements(v, elements);
         if (elements.isEmpty())
-            return v8::Handle<v8::Value>();
+            return v8Undefined();
     }
 
     // Second call may return different results from the first call,
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
index 35818af6d..649cb35a6 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
@@ -31,10 +31,10 @@
 #include "config.h"
 #include "V8HTMLFrameElement.h"
 
+#include "BindingState.h"
 #include "HTMLFrameElement.h"
 #include "HTMLNames.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
@@ -46,7 +46,7 @@ void V8HTMLFrameElement::locationAccessorSetter(v8::Local<v8::String> name, v8::
     HTMLFrameElement* frame = V8HTMLFrameElement::toNative(info.Holder());
     String locationValue = toWebCoreStringWithNullCheck(value);
 
-    if (!V8BindingSecurity::allowSettingFrameSrcToJavascriptUrl(V8BindingState::Only(), frame, locationValue))
+    if (!BindingSecurity::allowSettingFrameSrcToJavascriptUrl(BindingState::instance(), frame, locationValue))
         return;
 
     frame->setLocation(locationValue);
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp
index 137f91bbf..519e015f7 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp
@@ -49,7 +49,7 @@ v8::Handle<v8::Value> V8HTMLFrameSetElement::namedPropertyGetter(v8::Local<v8::S
 {
     INC_STATS("DOM.HTMLFrameSetElement.NamedPropertyGetter");
     HTMLFrameSetElement* imp = V8HTMLFrameSetElement::toNative(info.Holder());
-    Node* frameNode = imp->children()->namedItem(v8StringToAtomicWebCoreString(name));
+    Node* frameNode = imp->children()->namedItem(v8ValueToAtomicWebCoreString(name));
     if (frameNode && frameNode->hasTagName(HTMLNames::frameTag)) {
         Document* doc = static_cast<HTMLFrameElement*>(frameNode)->contentDocument();
         if (!doc)
@@ -57,7 +57,7 @@ v8::Handle<v8::Value> V8HTMLFrameSetElement::namedPropertyGetter(v8::Local<v8::S
         if (Frame* frame = doc->frame())
             return toV8(frame->domWindow(), info.GetIsolate());
     }
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
index 723a0b5b4..c06d77a7e 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
@@ -31,15 +31,15 @@
 #include "config.h"
 #include "V8HTMLImageElementConstructor.h"
 
-#include "HTMLImageElement.h"
+#include "BindingState.h"
 #include "Document.h"
 #include "Frame.h"
+#include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "V8Binding.h"
 #include "V8Document.h"
 #include "V8HTMLImageElement.h"
 #include "V8Proxy.h"
-
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -56,7 +56,7 @@ static v8::Handle<v8::Value> v8HTMLImageElementConstructorCallback(const v8::Arg
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
 
-    Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
+    Frame* frame = currentFrame(BindingState::instance());
     if (!frame)
         return V8Proxy::throwError(V8Proxy::ReferenceError, "Image constructor associated frame is unavailable", args.GetIsolate());
 
@@ -85,9 +85,10 @@ static v8::Handle<v8::Value> v8HTMLImageElementConstructorCallback(const v8::Arg
     }
 
     RefPtr<HTMLImageElement> image = HTMLImageElement::createForJSConstructor(document, optionalWidth, optionalHeight);
-    V8DOMWrapper::setDOMWrapper(args.Holder(), &V8HTMLImageElementConstructor::info, image.get());
-    V8DOMWrapper::setJSWrapperForDOMNode(image.release(), v8::Persistent<v8::Object>::New(args.Holder()));
-    return args.Holder();
+    v8::Handle<v8::Object> wrapper = args.Holder();
+    V8DOMWrapper::setDOMWrapper(wrapper, &V8HTMLImageElementConstructor::info, image.get());
+    V8DOMWrapper::setJSWrapperForDOMNode(image.release(), wrapper);
+    return wrapper;
 }
 
 v8::Persistent<v8::FunctionTemplate> V8HTMLImageElementConstructor::GetTemplate()
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
index 61efa44f2..9030b512d 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
@@ -119,7 +119,7 @@ v8::Handle<v8::Value> V8HTMLOptionsCollection::indexedPropertyGetter(uint32_t in
 
     RefPtr<Node> result = collection->item(index);
     if (!result)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     return toV8(result.release(), info.GetIsolate());
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp
index 4b14f207e..406632574 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp
@@ -50,11 +50,11 @@ static v8::Handle<v8::Value> npObjectNamedGetter(v8::Local<v8::String> name, con
     HTMLPlugInElement* imp = C::toNative(info.Holder());
     ScriptInstance scriptInstance = imp->getInstance();
     if (!scriptInstance)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     v8::Local<v8::Object> instance = v8::Local<v8::Object>::New(scriptInstance->instance());
     if (instance.IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     return npObjectGetNamedProperty(instance, name, info);
 }
@@ -65,11 +65,11 @@ static v8::Handle<v8::Value> npObjectNamedSetter(v8::Local<v8::String> name, v8:
     HTMLPlugInElement* imp = C::toNative(info.Holder());
     ScriptInstance scriptInstance = imp->getInstance();
     if (!scriptInstance)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     v8::Local<v8::Object> instance = v8::Local<v8::Object>::New(scriptInstance->instance());
     if (instance.IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     return npObjectSetNamedProperty(instance, name, value, info);
 }
@@ -135,11 +135,11 @@ v8::Handle<v8::Value> npObjectIndexedGetter(uint32_t index, const v8::AccessorIn
     HTMLPlugInElement* imp = C::toNative(info.Holder());
     ScriptInstance scriptInstance = imp->getInstance();
     if (!scriptInstance)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     v8::Local<v8::Object> instance = v8::Local<v8::Object>::New(scriptInstance->instance());
     if (instance.IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     return npObjectGetIndexedProperty(instance, index, info);
 }
@@ -151,11 +151,11 @@ v8::Handle<v8::Value> npObjectIndexedSetter(uint32_t index, v8::Local<v8::Value>
     HTMLPlugInElement* imp = C::toNative(info.Holder());
     ScriptInstance scriptInstance = imp->getInstance();
     if (!scriptInstance)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     v8::Local<v8::Object> instance = v8::Local<v8::Object>::New(scriptInstance->instance());
     if (instance.IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     return npObjectSetIndexedProperty(instance, index, value, info);
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLSelectElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLSelectElementCustom.cpp
index 015be3a0c..71473c56c 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLSelectElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLSelectElementCustom.cpp
@@ -51,7 +51,7 @@ v8::Handle<v8::Value> V8HTMLSelectElement::indexedPropertyGetter(uint32_t index,
     ASSERT(V8DOMWrapper::maybeDOMWrapper(info.Holder()));
     RefPtr<Node> result = V8HTMLSelectElement::toNative(info.Holder())->item(index);
     if (!result)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     return toV8(result.release(), info.GetIsolate());
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
index bccda0c9e..6f4cd687a 100644
--- a/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
@@ -31,11 +31,11 @@
 #include "config.h"
 #include "V8History.h"
 
+#include "BindingState.h"
 #include "ExceptionCode.h"
 #include "History.h"
 #include "SerializedScriptValue.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8DOMWindow.h"
 #include "V8HiddenPropertyName.h"
 #include "V8Proxy.h"
@@ -81,7 +81,7 @@ v8::Handle<v8::Value> V8History::pushStateCallback(const v8::Arguments& args)
     History* history = V8History::toNative(args.Holder());
     history->stateObjectAdded(historyState.release(), title, url, History::StateObjectPush, ec);
     args.Holder()->DeleteHiddenValue(V8HiddenPropertyName::state());
-    return throwError(ec, args.GetIsolate());
+    return V8Proxy::setDOMException(ec, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8History::replaceStateCallback(const v8::Arguments& args)
@@ -106,21 +106,19 @@ v8::Handle<v8::Value> V8History::replaceStateCallback(const v8::Arguments& args)
     History* history = V8History::toNative(args.Holder());
     history->stateObjectAdded(historyState.release(), title, url, History::StateObjectReplace, ec);
     args.Holder()->DeleteHiddenValue(V8HiddenPropertyName::state());
-    return throwError(ec, args.GetIsolate());
+    return V8Proxy::setDOMException(ec, args.GetIsolate());
 }
 
 bool V8History::indexedSecurityCheck(v8::Local<v8::Object> host, uint32_t index, v8::AccessType type, v8::Local<v8::Value>)
 {
-    // Only allow same origin access.
     History* history = V8History::toNative(host);
-    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), history->frame(), false);
+    return BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), history->frame(), DoNotReportSecurityError);
 }
 
 bool V8History::namedSecurityCheck(v8::Local<v8::Object> host, v8::Local<v8::Value> key, v8::AccessType type, v8::Local<v8::Value>)
 {
-    // Only allow same origin access.
     History* history = V8History::toNative(host);
-    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), history->frame(), false);
+    return BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), history->frame(), DoNotReportSecurityError);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 67e8d2d57..f7794ae95 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -32,6 +32,7 @@
 #if ENABLE(INSPECTOR)
 #include "V8InjectedScriptHost.h"
 
+#include "BindingState.h"
 #include "Database.h"
 #include "InjectedScript.h"
 #include "InjectedScriptHost.h"
@@ -40,7 +41,6 @@
 #include "ScriptDebugServer.h"
 #include "ScriptValue.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8Database.h"
 #include "V8Float32Array.h"
 #include "V8Float64Array.h"
@@ -205,7 +205,7 @@ static v8::Handle<v8::Array> getJSListenerFunctions(Document* document, const Ev
         V8AbstractEventListener* v8Listener = static_cast<V8AbstractEventListener*>(listener.get());
         v8::Local<v8::Context> context = toV8Context(document, v8Listener->worldContext());
         // Hide listeners from other contexts.
-        if (context != V8Proxy::currentContext())
+        if (context != v8::Context::GetCurrent())
             continue;
         v8::Local<v8::Object> function = v8Listener->getListenerObject(document);
         v8::Local<v8::Object> listenerEntry = v8::Object::New();
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
index 4c103d20d..fbd8d3ad9 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
@@ -32,12 +32,12 @@
 #if ENABLE(INSPECTOR)
 #include "InjectedScriptManager.h"
 
+#include "BindingState.h"
 #include "DOMWindow.h"
 #include "InjectedScriptHost.h"
 #include "SafeAllocation.h"
 #include "ScriptObject.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8DOMWindow.h"
 #include "V8InjectedScriptHost.h"
 #include "V8RecursionScope.h"
@@ -123,7 +123,7 @@ bool InjectedScriptManager::canAccessInspectedWindow(ScriptState* scriptState)
     Frame* frame = V8DOMWindow::toNative(holder)->frame();
 
     v8::Context::Scope contextScope(context);
-    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), frame, false);
+    return BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), frame, DoNotReportSecurityError);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp
index 79d4d24fd..164e691cc 100644
--- a/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp
@@ -34,7 +34,6 @@
 #include "SerializedScriptValue.h"
 
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8DOMWrapper.h"
 #include "V8Intent.h"
 #include "V8MessagePort.h"
@@ -57,15 +56,15 @@ v8::Handle<v8::Value> V8Intent::constructorCallback(const v8::Arguments& args)
     if (args.Length() == 1) {
         // Use the dictionary constructor. This block will return if the
         // argument isn't a valid Dictionary.
-        EXCEPTION_BLOCK(Dictionary, options, args[0]);
+        EXCEPTION_BLOCK(Dictionary, options, Dictionary(args[0], args.GetIsolate()));
         ExceptionCode ec = 0;
         RefPtr<Intent> impl = Intent::create(ScriptState::current(), options, ec);
         if (ec)
-            return throwError(ec, args.GetIsolate());
+            return V8Proxy::setDOMException(ec, args.GetIsolate());
 
         v8::Handle<v8::Object> wrapper = args.Holder();
         V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
-        V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), v8::Persistent<v8::Object>::New(wrapper));
+        V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), wrapper);
         return wrapper;
     }
 
@@ -75,21 +74,21 @@ v8::Handle<v8::Value> V8Intent::constructorCallback(const v8::Arguments& args)
     MessagePortArray messagePortArrayTransferList;
     ArrayBufferArray arrayBufferArrayTransferList;
     if (args.Length() > 3) {
-        if (!extractTransferables(args[3], messagePortArrayTransferList, arrayBufferArrayTransferList))
+        if (!extractTransferables(args[3], messagePortArrayTransferList, arrayBufferArrayTransferList, args.GetIsolate()))
             return V8Proxy::throwTypeError("Could not extract transferables", args.GetIsolate());
     }
     bool dataDidThrow = false;
     RefPtr<SerializedScriptValue> data = SerializedScriptValue::create(args[2], &messagePortArrayTransferList, &arrayBufferArrayTransferList, dataDidThrow);
     if (dataDidThrow)
-        return throwError(DATA_CLONE_ERR, args.GetIsolate());
+        return V8Proxy::setDOMException(DATA_CLONE_ERR, args.GetIsolate());
 
     RefPtr<Intent> impl = Intent::create(action, type, data, messagePortArrayTransferList, ec);
     if (ec)
-        return throwError(ec, args.GetIsolate());
+        return V8Proxy::setDOMException(ec, args.GetIsolate());
 
     v8::Handle<v8::Object> wrapper = args.Holder();
     V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
-    V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), v8::Persistent<v8::Object>::New(wrapper));
+    V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), wrapper);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8LocationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8LocationCustom.cpp
index 3506a04a4..5192563d7 100644
--- a/Source/WebCore/bindings/v8/custom/V8LocationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8LocationCustom.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "V8Location.h"
 
+#include "BindingState.h"
 #include "Document.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -38,7 +39,6 @@
 #include "Location.h"
 #include "PlatformString.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8DOMWindow.h"
 #include "V8EventListener.h"
 #include "V8Utilities.h"
@@ -50,85 +50,85 @@ void V8Location::hashAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Va
 {
     INC_STATS("DOM.Location.hash._set");
     Location* impl = V8Location::toNative(info.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
     // FIXME: Handle exceptions correctly.
     String hash = toWebCoreString(value);
 
-    impl->setHash(hash, state->activeWindow(), state->firstWindow());
+    impl->setHash(hash, activeDOMWindow(state), firstDOMWindow(state));
 }
 
 void V8Location::hostAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Location.host._set");
     Location* impl = V8Location::toNative(info.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
     // FIXME: Handle exceptions correctly.
     String host = toWebCoreString(value);
 
-    impl->setHost(host, state->activeWindow(), state->firstWindow());
+    impl->setHost(host, activeDOMWindow(state), firstDOMWindow(state));
 }
 
 void V8Location::hostnameAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Location.hostname._set");
     Location* impl = V8Location::toNative(info.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
     // FIXME: Handle exceptions correctly.
     String hostname = toWebCoreString(value);
 
-    impl->setHostname(hostname, state->activeWindow(), state->firstWindow());
+    impl->setHostname(hostname, activeDOMWindow(state), firstDOMWindow(state));
 }
 
 void V8Location::hrefAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Location.href._set");
     Location* impl = V8Location::toNative(info.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
     // FIXME: Handle exceptions correctly.
     String href = toWebCoreString(value);
 
-    impl->setHref(href, state->activeWindow(), state->firstWindow());
+    impl->setHref(href, activeDOMWindow(state), firstDOMWindow(state));
 }
 
 void V8Location::pathnameAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Location.pathname._set");
     Location* impl = V8Location::toNative(info.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
     // FIXME: Handle exceptions correctly.
     String pathname = toWebCoreString(value);
 
-    impl->setPathname(pathname, state->activeWindow(), state->firstWindow());
+    impl->setPathname(pathname, activeDOMWindow(state), firstDOMWindow(state));
 }
 
 void V8Location::portAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Location.port._set");
     Location* impl = V8Location::toNative(info.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
     // FIXME: Handle exceptions correctly.
     String port = toWebCoreString(value);
 
-    impl->setPort(port, state->activeWindow(), state->firstWindow());
+    impl->setPort(port, activeDOMWindow(state), firstDOMWindow(state));
 }
 
 void V8Location::protocolAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Location.protocol._set");
     Location* impl = V8Location::toNative(info.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
     // FIXME: Handle exceptions correctly.
     String protocol = toWebCoreString(value);
 
     ExceptionCode ec = 0;
-    impl->setProtocol(protocol, state->activeWindow(), state->firstWindow(), ec);
+    impl->setProtocol(protocol, activeDOMWindow(state), firstDOMWindow(state), ec);
     if (UNLIKELY(ec))
         V8Proxy::setDOMException(ec, info.GetIsolate());
 }
@@ -137,18 +137,18 @@ void V8Location::searchAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::
 {
     INC_STATS("DOM.Location.search._set");
     Location* impl = V8Location::toNative(info.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
     // FIXME: Handle exceptions correctly.
     String search = toWebCoreString(value);
 
-    impl->setSearch(search, state->activeWindow(), state->firstWindow());
+    impl->setSearch(search, activeDOMWindow(state), firstDOMWindow(state));
 }
 
 v8::Handle<v8::Value> V8Location::reloadAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Location.reload._get");
-    static v8::Persistent<v8::FunctionTemplate> privateTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::reloadCallback, v8::Handle<v8::Value>(), v8::Signature::New(V8Location::GetRawTemplate())));
+    static v8::Persistent<v8::FunctionTemplate> privateTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::reloadCallback, v8Undefined(), v8::Signature::New(V8Location::GetRawTemplate())));
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8Location::GetTemplate(), info.This());
     if (holder.IsEmpty()) {
         // can only reach here by 'object.__proto__.func', and it should passed
@@ -156,8 +156,8 @@ v8::Handle<v8::Value> V8Location::reloadAccessorGetter(v8::Local<v8::String> nam
         return privateTemplate->GetFunction();
     }
     Location* imp = V8Location::toNative(holder);
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), false)) {
-        static v8::Persistent<v8::FunctionTemplate> sharedTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::reloadCallback, v8::Handle<v8::Value>(), v8::Signature::New(V8Location::GetRawTemplate())));
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame(), DoNotReportSecurityError)) {
+        static v8::Persistent<v8::FunctionTemplate> sharedTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::reloadCallback, v8Undefined(), v8::Signature::New(V8Location::GetRawTemplate())));
         return sharedTemplate->GetFunction();
     }
     return privateTemplate->GetFunction();
@@ -166,7 +166,7 @@ v8::Handle<v8::Value> V8Location::reloadAccessorGetter(v8::Local<v8::String> nam
 v8::Handle<v8::Value> V8Location::replaceAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Location.replace._get");
-    static v8::Persistent<v8::FunctionTemplate> privateTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::replaceCallback, v8::Handle<v8::Value>(), v8::Signature::New(V8Location::GetRawTemplate())));
+    static v8::Persistent<v8::FunctionTemplate> privateTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::replaceCallback, v8Undefined(), v8::Signature::New(V8Location::GetRawTemplate())));
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8Location::GetTemplate(), info.This());
     if (holder.IsEmpty()) {
         // can only reach here by 'object.__proto__.func', and it should passed
@@ -174,8 +174,8 @@ v8::Handle<v8::Value> V8Location::replaceAccessorGetter(v8::Local<v8::String> na
         return privateTemplate->GetFunction();
     }
     Location* imp = V8Location::toNative(holder);
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), false)) {
-        static v8::Persistent<v8::FunctionTemplate> sharedTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::replaceCallback, v8::Handle<v8::Value>(), v8::Signature::New(V8Location::GetRawTemplate())));
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame(), DoNotReportSecurityError)) {
+        static v8::Persistent<v8::FunctionTemplate> sharedTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::replaceCallback, v8Undefined(), v8::Signature::New(V8Location::GetRawTemplate())));
         return sharedTemplate->GetFunction();
     }
     return privateTemplate->GetFunction();
@@ -185,7 +185,7 @@ v8::Handle<v8::Value> V8Location::assignAccessorGetter(v8::Local<v8::String> nam
 {
     INC_STATS("DOM.Location.assign._get");
     static v8::Persistent<v8::FunctionTemplate> privateTemplate =
-        v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::assignCallback, v8::Handle<v8::Value>(), v8::Signature::New(V8Location::GetRawTemplate())));
+        v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::assignCallback, v8Undefined(), v8::Signature::New(V8Location::GetRawTemplate())));
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8Location::GetTemplate(), info.This());
     if (holder.IsEmpty()) {
         // can only reach here by 'object.__proto__.func', and it should passed
@@ -193,8 +193,8 @@ v8::Handle<v8::Value> V8Location::assignAccessorGetter(v8::Local<v8::String> nam
         return privateTemplate->GetFunction();
     }
     Location* imp = V8Location::toNative(holder);
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), false)) {
-        static v8::Persistent<v8::FunctionTemplate> sharedTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::assignCallback, v8::Handle<v8::Value>(), v8::Signature::New(V8Location::GetRawTemplate())));
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame(), DoNotReportSecurityError)) {
+        static v8::Persistent<v8::FunctionTemplate> sharedTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8Location::assignCallback, v8Undefined(), v8::Signature::New(V8Location::GetRawTemplate())));
         return sharedTemplate->GetFunction();
     }
     return privateTemplate->GetFunction();
@@ -204,9 +204,9 @@ v8::Handle<v8::Value> V8Location::reloadCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.Location.reload");
     Location* impl = V8Location::toNative(args.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
-    impl->reload(state->activeWindow());
+    impl->reload(activeDOMWindow(state));
     return v8::Undefined();
 }
 
@@ -214,12 +214,12 @@ v8::Handle<v8::Value> V8Location::replaceCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.Location.replace");
     Location* impl = V8Location::toNative(args.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
     // FIXME: Handle exceptions correctly.
     String urlString = toWebCoreString(args[0]);
 
-    impl->replace(urlString, state->activeWindow(), state->firstWindow());
+    impl->replace(urlString, activeDOMWindow(state), firstDOMWindow(state));
     return v8::Undefined();
 }
 
@@ -227,12 +227,12 @@ v8::Handle<v8::Value> V8Location::assignCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.Location.assign");
     Location* impl = V8Location::toNative(args.Holder());
-    State<V8Binding>* state = V8BindingState::Only();
+    BindingState* state = BindingState::instance();
 
     // FIXME: Handle exceptions correctly.
     String urlString = toWebCoreString(args[0]);
 
-    impl->assign(urlString, state->activeWindow(), state->firstWindow());
+    impl->assign(urlString, activeDOMWindow(state), firstDOMWindow(state));
     return v8::Undefined();
 }
 
@@ -251,7 +251,7 @@ v8::Handle<v8::Value> V8Location::toStringCallback(const v8::Arguments& args)
     INC_STATS("DOM.Location.toString");
     v8::Handle<v8::Object> holder = args.Holder();
     Location* imp = V8Location::toNative(holder);
-    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
+    if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame()))
         return v8::Undefined();
     String result = imp->href();
     return v8String(result, args.GetIsolate());
@@ -261,14 +261,14 @@ bool V8Location::indexedSecurityCheck(v8::Local<v8::Object> host, uint32_t index
 {
     // Only allow same origin access
     Location* imp =  V8Location::toNative(host);
-    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), false);
+    return BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame(), DoNotReportSecurityError);
 }
 
 bool V8Location::namedSecurityCheck(v8::Local<v8::Object> host, v8::Local<v8::Value> key, v8::AccessType type, v8::Local<v8::Value>)
 {
     // Only allow same origin access
     Location* imp = V8Location::toNative(host);
-    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), false);
+    return BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), imp->frame(), DoNotReportSecurityError);
 }
 
 v8::Handle<v8::Value> toV8(Location* impl, v8::Isolate* isolate)
diff --git a/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
index 019a0309e..70131dcc3 100644
--- a/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
@@ -75,7 +75,7 @@ v8::Handle<v8::Value> V8MessageChannel::constructorCallback(const v8::Arguments&
 
     // Setup the standard wrapper object internal fields.
     V8DOMWrapper::setDOMWrapper(messageChannel, &info, obj.get());
-    V8DOMWrapper::setJSWrapperForDOMObject(obj.release(), v8::Persistent<v8::Object>::New(messageChannel));
+    V8DOMWrapper::setJSWrapperForDOMObject(obj.release(), messageChannel);
     return messageChannel;
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
index 3d8e8e18e..6afd87231 100644
--- a/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
@@ -128,7 +128,7 @@ v8::Handle<v8::Value> V8MessageEvent::initMessageEventCallback(const v8::Argumen
 
     if (!isUndefinedOrNull(args[7])) {
         portArray = adoptPtr(new MessagePortArray);
-        if (!getMessagePortArray(args[7], *portArray))
+        if (!getMessagePortArray(args[7], *portArray, args.GetIsolate()))
             return v8::Undefined();
     }
     event->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg, originArg, lastEventIdArg, sourceArg, portArray.release());
diff --git a/Source/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
index 523cb7c64..aa94c339b 100644
--- a/Source/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
@@ -48,7 +48,7 @@ static v8::Handle<v8::Value> handlePostMessageCallback(const v8::Arguments& args
     MessagePortArray portArray;
     ArrayBufferArray arrayBufferArray;
     if (args.Length() > 1) {
-        if (!extractTransferables(args[1], portArray, arrayBufferArray))
+        if (!extractTransferables(args[1], portArray, arrayBufferArray, args.GetIsolate()))
             return v8::Undefined();
     }
     bool didThrow = false;
@@ -62,7 +62,7 @@ static v8::Handle<v8::Value> handlePostMessageCallback(const v8::Arguments& args
         return v8::Undefined();
     ExceptionCode ec = 0;
     messagePort->postMessage(message.release(), &portArray, ec);
-    return throwError(ec, args.GetIsolate());
+    return V8Proxy::setDOMException(ec, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8MessagePort::postMessageCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp
index a43d6e91d..66e88f641 100644
--- a/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp
@@ -34,9 +34,9 @@
 
 #include "V8MutationObserver.h"
 
+#include "ExceptionCode.h"
 #include "MutationObserver.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8DOMWrapper.h"
 #include "V8MutationCallback.h"
 #include "V8Proxy.h"
@@ -59,7 +59,7 @@ v8::Handle<v8::Value> V8MutationObserver::constructorCallback(const v8::Argument
 
     v8::Local<v8::Value> arg = args[0];
     if (!arg->IsObject())
-        return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+        return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
 
     ScriptExecutionContext* context = getScriptExecutionContext();
     if (!context)
@@ -68,9 +68,10 @@ v8::Handle<v8::Value> V8MutationObserver::constructorCallback(const v8::Argument
     RefPtr<MutationCallback> callback = V8MutationCallback::create(arg, context);
     RefPtr<MutationObserver> observer = MutationObserver::create(callback.release());
 
-    V8DOMWrapper::setDOMWrapper(args.Holder(), &info, observer.get());
-    V8DOMWrapper::setJSWrapperForDOMObject(observer.release(), v8::Persistent<v8::Object>::New(args.Holder()));
-    return args.Holder();
+    v8::Handle<v8::Object> wrapper = args.Holder();
+    V8DOMWrapper::setDOMWrapper(wrapper, &info, observer.get());
+    V8DOMWrapper::setJSWrapperForDOMObject(observer.release(), wrapper);
+    return wrapper;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
index d2e348334..6bd2a05b1 100644
--- a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
@@ -31,10 +31,10 @@
 #include "config.h"
 #include "V8NamedNodeMap.h"
 
+#include "BindingState.h"
 #include "NamedNodeMap.h"
 #include "V8Attr.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8Element.h"
 #include "V8Node.h"
 #include "V8Proxy.h"
@@ -49,7 +49,7 @@ v8::Handle<v8::Value> V8NamedNodeMap::indexedPropertyGetter(uint32_t index, cons
     NamedNodeMap* imp = V8NamedNodeMap::toNative(info.Holder());
     RefPtr<Node> result = imp->item(index);
     if (!result)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     return toV8(result.release(), info.GetIsolate());
 }
@@ -59,14 +59,14 @@ v8::Handle<v8::Value> V8NamedNodeMap::namedPropertyGetter(v8::Local<v8::String>
     INC_STATS("DOM.NamedNodeMap.NamedPropertyGetter");
 
     if (!info.Holder()->GetRealNamedPropertyInPrototypeChain(name).IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     if (info.Holder()->HasRealNamedCallbackProperty(name))
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     NamedNodeMap* imp = V8NamedNodeMap::toNative(info.Holder());
     RefPtr<Node> result = imp->getNamedItem(toWebCoreString(name));
     if (!result)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     return toV8(result.release(), info.GetIsolate());
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
index 24ccc07b1..ce2dfa313 100644
--- a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
@@ -31,14 +31,13 @@
 #include "config.h"
 #include "Node.h"
 
+#include "BindingState.h"
 #include "Document.h"
 #include "EventListener.h"
 #include "ShadowRoot.h"
-
 #include "V8AbstractEventListener.h"
 #include "V8Attr.h"
 #include "V8Binding.h"
-#include "V8BindingState.h"
 #include "V8CDATASection.h"
 #include "V8Comment.h"
 #include "V8Document.h"
@@ -54,13 +53,12 @@
 #include "V8ProcessingInstruction.h"
 #include "V8Proxy.h"
 #include "V8Text.h"
+#include <wtf/RefPtr.h>
 
 #if ENABLE(SVG)
 #include "V8SVGElement.h"
 #endif
 
-#include <wtf/RefPtr.h>
-
 namespace WebCore {
 
 // This function is customized to take advantage of the optional 4th argument: shouldLazyAttach
diff --git a/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
index 9e1be9ade..681fe49d1 100644
--- a/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
@@ -55,7 +55,7 @@ v8::Handle<v8::Value> V8NodeList::namedPropertyGetter(v8::Local<v8::String> name
 
     RefPtr<Node> result = list->itemWithName(key);
     if (!result)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     return toV8(result.release(), info.GetIsolate());
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
index e5b1ecdd7..1890f1e34 100644
--- a/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
@@ -57,7 +57,7 @@ v8::Handle<v8::Value> V8NotificationCenter::createHTMLNotificationCallback(const
     RefPtr<Notification> notification = notificationCenter->createHTMLNotification(url, ec);
 
     if (ec)
-        return throwError(ec, args.GetIsolate());
+        return V8Proxy::setDOMException(ec, args.GetIsolate());
 
     notification->ref();
     return toV8(notification.get(), args.GetIsolate());
@@ -72,7 +72,7 @@ v8::Handle<v8::Value> V8NotificationCenter::createNotificationCallback(const v8:
     RefPtr<Notification> notification = notificationCenter->createNotification(toWebCoreString(args[0]), toWebCoreString(args[1]), toWebCoreString(args[2]), ec);
 
     if (ec)
-        return throwError(ec, args.GetIsolate());
+        return V8Proxy::setDOMException(ec, args.GetIsolate());
 
     notification->ref();
     return toV8(notification.get(), args.GetIsolate());
@@ -86,11 +86,11 @@ v8::Handle<v8::Value> V8NotificationCenter::requestPermissionCallback(const v8::
 
     // Make sure that script execution context is valid.
     if (!context)
-        return throwError(INVALID_STATE_ERR, args.GetIsolate());
+        return V8Proxy::setDOMException(INVALID_STATE_ERR, args.GetIsolate());
 
     // Requesting permission is only valid from a page context.
     if (context->isWorkerContext())
-        return throwError(NOT_SUPPORTED_ERR, args.GetIsolate());
+        return V8Proxy::setDOMException(NOT_SUPPORTED_ERR, args.GetIsolate());
 
     RefPtr<V8CustomVoidCallback> callback;
     if (args.Length() > 0) {
diff --git a/Source/WebCore/bindings/v8/custom/V8PerformanceCustom.cpp b/Source/WebCore/bindings/v8/custom/V8PerformanceCustom.cpp
index 61fa6d37f..101d6449b 100644
--- a/Source/WebCore/bindings/v8/custom/V8PerformanceCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8PerformanceCustom.cpp
@@ -36,7 +36,6 @@
 
 #include "Performance.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8MemoryInfo.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
index e79f937d6..bbc931406 100644
--- a/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
@@ -38,7 +38,6 @@
 #include "ExceptionCode.h"
 #include "SQLValue.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8SQLStatementCallback.h"
 #include "V8SQLStatementErrorCallback.h"
 #include "V8Proxy.h"
@@ -53,7 +52,7 @@ v8::Handle<v8::Value> V8SQLTransaction::executeSqlCallback(const v8::Arguments&
     INC_STATS("DOM.SQLTransaction.executeSql()");
 
     if (args.Length() == 0)
-        return throwError(SYNTAX_ERR, args.GetIsolate());
+        return V8Proxy::setDOMException(SYNTAX_ERR, args.GetIsolate());
 
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, statement, args[0]);
 
@@ -61,7 +60,7 @@ v8::Handle<v8::Value> V8SQLTransaction::executeSqlCallback(const v8::Arguments&
 
     if (args.Length() > 1 && !isUndefinedOrNull(args[1])) {
         if (!args[1]->IsObject())
-            return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+            return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
 
         uint32_t sqlArgsLength = 0;
         v8::Local<v8::Object> sqlArgsObject = args[1]->ToObject();
@@ -97,14 +96,14 @@ v8::Handle<v8::Value> V8SQLTransaction::executeSqlCallback(const v8::Arguments&
     RefPtr<SQLStatementCallback> callback;
     if (args.Length() > 2 && !isUndefinedOrNull(args[2])) {
         if (!args[2]->IsObject())
-            return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+            return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
         callback = V8SQLStatementCallback::create(args[2], scriptExecutionContext);
     }
 
     RefPtr<SQLStatementErrorCallback> errorCallback;
     if (args.Length() > 3 && !isUndefinedOrNull(args[3])) {
         if (!args[3]->IsObject())
-            return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+            return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
         errorCallback = V8SQLStatementErrorCallback::create(args[3], scriptExecutionContext);
     }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
index 622937d6a..37eb64ac8 100644
--- a/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
@@ -39,7 +39,6 @@
 #include "SQLResultSet.h"
 #include "SQLValue.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8Proxy.h"
 #include "V8SQLResultSet.h"
 #include <wtf/Vector.h>
@@ -53,7 +52,7 @@ v8::Handle<v8::Value> V8SQLTransactionSync::executeSqlCallback(const v8::Argumen
     INC_STATS("DOM.SQLTransactionSync.executeSql()");
 
     if (!args.Length())
-        return throwError(SYNTAX_ERR, args.GetIsolate());
+        return V8Proxy::setDOMException(SYNTAX_ERR, args.GetIsolate());
 
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, statement, args[0]);
 
@@ -61,7 +60,7 @@ v8::Handle<v8::Value> V8SQLTransactionSync::executeSqlCallback(const v8::Argumen
 
     if (args.Length() > 1 && !isUndefinedOrNull(args[1])) {
         if (!args[1]->IsObject())
-            return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
+            return V8Proxy::setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
 
         uint32_t sqlArgsLength = 0;
         v8::Local<v8::Object> sqlArgsObject = args[1]->ToObject();
diff --git a/Source/WebCore/bindings/v8/custom/V8SVGDocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SVGDocumentCustom.cpp
index 6db61bf01..fa9925bda 100644
--- a/Source/WebCore/bindings/v8/custom/V8SVGDocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SVGDocumentCustom.cpp
@@ -33,6 +33,7 @@
 #if ENABLE(SVG)
 #include "V8SVGDocument.h"
 
+#include "Frame.h"
 #include "V8IsolatedContext.h"
 #include "V8Proxy.h"
 
@@ -46,8 +47,8 @@ v8::Handle<v8::Value> toV8(SVGDocument* impl, v8::Isolate* isolate, bool forceNe
     if (wrapper.IsEmpty())
         return wrapper;
     if (!V8IsolatedContext::getEntered()) {
-        if (V8Proxy* proxy = V8Proxy::retrieve(impl->frame()))
-            proxy->windowShell()->updateDocumentWrapper(wrapper);
+        if (Frame* frame = impl->frame())
+            frame->script()->windowShell()->updateDocumentWrapper(wrapper);
     }
     return wrapper;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8SVGLengthCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SVGLengthCustom.cpp
index 292bc0ddc..a8aa0a22e 100644
--- a/Source/WebCore/bindings/v8/custom/V8SVGLengthCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SVGLengthCustom.cpp
@@ -37,7 +37,6 @@
 #include "SVGLengthContext.h"
 #include "SVGPropertyTearOff.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 
 namespace WebCore {
 
@@ -97,7 +96,7 @@ v8::Handle<v8::Value> V8SVGLength::convertToSpecifiedUnitsCallback(const v8::Arg
         return V8Proxy::setDOMException(ec, args.GetIsolate());
 
     wrapper->commitChange();
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8ScriptProfileCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ScriptProfileCustom.cpp
index 841f2a83f..226a85ad3 100644
--- a/Source/WebCore/bindings/v8/custom/V8ScriptProfileCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ScriptProfileCustom.cpp
@@ -48,12 +48,12 @@ v8::Handle<v8::Value> toV8(ScriptProfile* impl, v8::Isolate* isolate)
     v8::Local<v8::Function> function = V8ScriptProfile::GetTemplate()->GetFunction();
     if (function.IsEmpty()) {
         // Return if allocation failed.
-        return v8::Local<v8::Object>();
+        return v8Undefined();
     }
     v8::Local<v8::Object> instance = SafeAllocation::newInstance(function);
     if (instance.IsEmpty()) {
         // Avoid setting the wrapper if allocation failed.
-        return v8::Local<v8::Object>();
+        return v8Undefined();
     }
     impl->ref();
     V8DOMWrapper::setDOMWrapper(instance, &V8ScriptProfile::info, impl);
diff --git a/Source/WebCore/bindings/v8/custom/V8ScriptProfileNodeCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ScriptProfileNodeCustom.cpp
index eadb5e6f6..f295ae04e 100644
--- a/Source/WebCore/bindings/v8/custom/V8ScriptProfileNodeCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ScriptProfileNodeCustom.cpp
@@ -55,7 +55,7 @@ v8::Handle<v8::Value> toV8(ScriptProfileNode* impl, v8::Isolate* isolate)
     v8::Local<v8::Function> function = V8ScriptProfileNode::GetTemplate()->GetFunction();
     if (function.IsEmpty()) {
         // Return if allocation failed.
-        return v8::Local<v8::Object>();
+        return v8Undefined();
     }
     v8::Local<v8::Object> instance = SafeAllocation::newInstance(function);
     if (instance.IsEmpty()) {
diff --git a/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp b/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
index 89396a30c..b79cdbdb8 100644
--- a/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
@@ -61,7 +61,7 @@ static v8::Handle<v8::Value> storageGetter(v8::Local<v8::String> v8Name, const v
     if (name != "length" && storage->contains(name))
         return v8String(storage->getItem(name), info.GetIsolate());
 
-    return v8::Handle<v8::Value>();
+    return v8Undefined();
 }
 
 v8::Handle<v8::Value> V8Storage::indexedPropertyGetter(uint32_t index, const v8::AccessorInfo& info)
@@ -75,7 +75,7 @@ v8::Handle<v8::Value> V8Storage::namedPropertyGetter(v8::Local<v8::String> name,
 {
     INC_STATS("DOM.Storage.NamedPropertyGetter");
     if (!info.Holder()->GetRealNamedPropertyInPrototypeChain(name).IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
     return storageGetter(name, info);
 }
 
@@ -103,12 +103,12 @@ static v8::Handle<v8::Value> storageSetter(v8::Local<v8::String> v8Name, v8::Loc
         return v8Value;
 
     if (!info.Holder()->GetRealNamedPropertyInPrototypeChain(v8Name).IsEmpty())
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     ExceptionCode ec = 0;
     storage->setItem(name, value, ec);
     if (ec)
-        return throwError(ec, info.GetIsolate());
+        return V8Proxy::setDOMException(ec, info.GetIsolate());
 
     return v8Value;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp b/Source/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
index 879449043..c4e82bb08 100644
--- a/Source/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
@@ -44,13 +44,13 @@ v8::Handle<v8::Value> V8StyleSheetList::namedPropertyGetter(v8::Local<v8::String
     INC_STATS("DOM.StyleSheetList.NamedPropertyGetter");
 
     if (info.Holder()->HasRealNamedProperty(name))
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     // Search style sheet.
     StyleSheetList* imp = V8StyleSheetList::toNative(info.Holder());
     HTMLStyleElement* item = imp->getNamedItem(toWebCoreString(name));
     if (!item)
-        return v8::Handle<v8::Value>();
+        return v8Undefined();
 
     return toV8(item->sheet(), info.GetIsolate());
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp
deleted file mode 100644
index 0b5af2059..000000000
--- a/Source/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include <wtf/ArrayBuffer.h>
-#include <wtf/Uint16Array.h>
-
-#include "V8Binding.h"
-#include "V8ArrayBuffer.h"
-#include "V8ArrayBufferViewCustom.h"
-#include "V8Uint16Array.h"
-#include "V8Proxy.h"
-
-namespace WebCore {
-
-v8::Handle<v8::Value> V8Uint16Array::constructorCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Uint16Array.Contructor");
-
-    return constructWebGLArray<Uint16Array, unsigned short>(args, &info, v8::kExternalUnsignedShortArray);
-}
-
-v8::Handle<v8::Value> V8Uint16Array::setCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Uint16Array.set()");
-    return setWebGLArrayHelper<Uint16Array, V8Uint16Array>(args);
-}
-
-v8::Handle<v8::Value> toV8(Uint16Array* impl, v8::Isolate* isolate)
-{
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8Uint16Array::wrap(impl, isolate);
-    if (!wrapper.IsEmpty())
-        wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), v8::kExternalUnsignedShortArray, impl->length());
-    return wrapper;
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp
deleted file mode 100644
index a6eb2d449..000000000
--- a/Source/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include <wtf/ArrayBuffer.h>
-#include <wtf/Uint32Array.h>
-
-#include "V8Binding.h"
-#include "V8ArrayBuffer.h"
-#include "V8ArrayBufferViewCustom.h"
-#include "V8Uint32Array.h"
-#include "V8Proxy.h"
-
-namespace WebCore {
-
-v8::Handle<v8::Value> V8Uint32Array::constructorCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Uint32Array.Contructor");
-
-    return constructWebGLArray<Uint32Array, unsigned int>(args, &info, v8::kExternalUnsignedIntArray);
-}
-
-v8::Handle<v8::Value> V8Uint32Array::setCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Uint32Array.set()");
-    return setWebGLArrayHelper<Uint32Array, V8Uint32Array>(args);
-}
-
-v8::Handle<v8::Value> toV8(Uint32Array* impl, v8::Isolate* isolate)
-{
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8Uint32Array::wrap(impl, isolate);
-    if (!wrapper.IsEmpty())
-        wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), v8::kExternalUnsignedIntArray, impl->length());
-    return wrapper;
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp
deleted file mode 100644
index 3cf926cbb..000000000
--- a/Source/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include <wtf/ArrayBuffer.h>
-#include <wtf/Uint8Array.h>
-
-#include "V8Binding.h"
-#include "V8ArrayBuffer.h"
-#include "V8ArrayBufferViewCustom.h"
-#include "V8Uint8Array.h"
-#include "V8Proxy.h"
-
-namespace WebCore {
-
-v8::Handle<v8::Value> V8Uint8Array::constructorCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Uint8Array.Contructor");
-
-    return constructWebGLArray<Uint8Array, unsigned char>(args, &info, v8::kExternalUnsignedByteArray);
-}
-
-v8::Handle<v8::Value> V8Uint8Array::setCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Uint8Array.set()");
-    return setWebGLArrayHelper<Uint8Array, V8Uint8Array>(args);
-}
-
-v8::Handle<v8::Value> toV8(Uint8Array* impl, v8::Isolate* isolate)
-{
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8Uint8Array::wrap(impl, isolate);
-    if (!wrapper.IsEmpty())
-        wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), v8::kExternalUnsignedByteArray, impl->length());
-    return wrapper;
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp
deleted file mode 100644
index 59d2d09c3..000000000
--- a/Source/WebCore/bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS
- * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE
- * INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <wtf/ArrayBuffer.h>
-#include <wtf/Uint8ClampedArray.h>
-
-#include "V8ArrayBuffer.h"
-#include "V8ArrayBufferViewCustom.h"
-#include "V8Binding.h"
-#include "V8Proxy.h"
-#include "V8Uint8ClampedArray.h"
-
-namespace WebCore {
-
-v8::Handle<v8::Value> V8Uint8ClampedArray::constructorCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Uint8ClampedArray.Contructor");
-
-    return constructWebGLArray<Uint8ClampedArray, unsigned char>(args, &info, v8::kExternalPixelArray);
-}
-
-v8::Handle<v8::Value> V8Uint8ClampedArray::setCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Uint8ClampedArray.set()");
-    return setWebGLArrayHelper<Uint8ClampedArray, V8Uint8ClampedArray>(args);
-}
-
-v8::Handle<v8::Value> toV8(Uint8ClampedArray* impl, v8::Isolate* isolate)
-{
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8Uint8ClampedArray::wrap(impl, isolate);
-    if (!wrapper.IsEmpty())
-        wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), v8::kExternalPixelArray, impl->length());
-    return wrapper;
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index 5904ec2fa..35a62db3c 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -38,7 +38,6 @@
 #include "NotImplemented.h"
 #include "V8ArrayBufferView.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8EXTTextureFilterAnisotropic.h"
 #include "V8Float32Array.h"
 #include "V8HTMLCanvasElement.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp
index c0949ae7c..fcbf49d5a 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp
@@ -27,7 +27,6 @@
 #include "V8WebKitAnimation.h"
 
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8Proxy.h"
 #include "WebKitAnimation.h"
 
diff --git a/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
index b6f9f0745..c84452c7c 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
@@ -65,9 +65,10 @@ v8::Handle<v8::Value> V8WebKitPoint::constructorCallback(const v8::Arguments& ar
         }
     }
     RefPtr<WebKitPoint> point = WebKitPoint::create(x, y);
-    V8DOMWrapper::setDOMWrapper(args.Holder(), &info, point.get());
-    V8DOMWrapper::setJSWrapperForDOMObject(point.release(), v8::Persistent<v8::Object>::New(args.Holder()));
-    return args.Holder();
+    v8::Handle<v8::Object> wrapper = args.Holder();
+    V8DOMWrapper::setDOMWrapper(wrapper, &info, point.get());
+    V8DOMWrapper::setJSWrapperForDOMObject(point.release(), wrapper);
+    return wrapper;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
index f0109c7e1..1f09a8860 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
@@ -38,6 +38,7 @@
 #include "Frame.h"
 #include "Settings.h"
 #include "V8ArrayBuffer.h"
+#include "V8ArrayBufferView.h"
 #include "V8Binding.h"
 #include "V8Blob.h"
 #include "V8Proxy.h"
@@ -105,11 +106,12 @@ v8::Handle<v8::Value> V8WebSocket::constructorCallback(const v8::Arguments& args
         }
     }
     if (ec)
-        return throwError(ec, args.GetIsolate());
+        return V8Proxy::setDOMException(ec, args.GetIsolate());
 
-    V8DOMWrapper::setDOMWrapper(args.Holder(), &info, webSocket.get());
-    V8DOMWrapper::setJSWrapperForActiveDOMObject(webSocket.release(), v8::Persistent<v8::Object>::New(args.Holder()));
-    return args.Holder();
+    v8::Handle<v8::Object> wrapper = args.Holder();
+    V8DOMWrapper::setDOMWrapper(wrapper, &info, webSocket.get());
+    V8DOMWrapper::setJSWrapperForActiveDOMObject(webSocket.release(), wrapper);
+    return wrapper;
 }
 
 v8::Handle<v8::Value> V8WebSocket::sendCallback(const v8::Arguments& args)
@@ -127,6 +129,10 @@ v8::Handle<v8::Value> V8WebSocket::sendCallback(const v8::Arguments& args)
         ArrayBuffer* arrayBuffer = V8ArrayBuffer::toNative(v8::Handle<v8::Object>::Cast(message));
         ASSERT(arrayBuffer);
         result = webSocket->send(arrayBuffer, ec);
+    } else if (V8ArrayBufferView::HasInstance(message)) {
+        ArrayBufferView* arrayBufferView = V8ArrayBufferView::toNative(v8::Handle<v8::Object>::Cast(message));
+        ASSERT(arrayBufferView);
+        result = webSocket->send(arrayBufferView, ec);
     } else if (V8Blob::HasInstance(message)) {
         Blob* blob = V8Blob::toNative(v8::Handle<v8::Object>::Cast(message));
         ASSERT(blob);
@@ -139,43 +145,11 @@ v8::Handle<v8::Value> V8WebSocket::sendCallback(const v8::Arguments& args)
         result = webSocket->send(toWebCoreString(stringMessage), ec);
     }
     if (ec)
-        return throwError(ec, args.GetIsolate());
+        return V8Proxy::setDOMException(ec, args.GetIsolate());
 
     return v8Boolean(result, args.GetIsolate());
 }
 
-v8::Handle<v8::Value> V8WebSocket::closeCallback(const v8::Arguments& args)
-{
-    // FIXME: We should implement [Clamp] for IDL binding code generator, and
-    // remove this custom method.
-    WebSocket* webSocket = toNative(args.Holder());
-    int argumentCount = args.Length();
-    int code = WebSocketChannel::CloseEventCodeNotSpecified;
-    String reason = "";
-    if (argumentCount >= 1) {
-        double x = args[0]->NumberValue();
-        double maxValue = static_cast<double>(std::numeric_limits<uint16_t>::max());
-        double minValue = static_cast<double>(std::numeric_limits<uint16_t>::min());
-        if (isnan(x))
-            x = 0.0;
-        else
-            x = clampTo(x, minValue, maxValue);
-        code = clampToInteger(x);
-        if (argumentCount >= 2) {
-            v8::TryCatch tryCatch;
-            v8::Handle<v8::String> reasonValue = args[1]->ToString();
-            if (tryCatch.HasCaught())
-                return throwError(tryCatch.Exception(), args.GetIsolate());
-            reason = toWebCoreString(reasonValue);
-        }
-    }
-    ExceptionCode ec = 0;
-    webSocket->close(code, reason, ec);
-    if (ec)
-        return throwError(ec, args.GetIsolate());
-    return v8::Undefined();
-}
-
 }  // namespace WebCore
 
 #endif  // ENABLE(WEB_SOCKETS)
diff --git a/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
index 7e27f6c05..1f7da07a4 100644
--- a/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -37,7 +37,6 @@
 #include "ExceptionCode.h"
 #include "ScheduledAction.h"
 #include "V8Binding.h"
-#include "V8BindingMacros.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "V8WorkerContextEventListener.h"
@@ -107,7 +106,7 @@ v8::Handle<v8::Value> V8WorkerContext::importScriptsCallback(const v8::Arguments
     workerContext->importScripts(urls, ec);
 
     if (ec)
-        return throwError(ec, args.GetIsolate());
+        return V8Proxy::setDOMException(ec, args.GetIsolate());
 
     return v8::Undefined();
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8WorkerCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
index f44bf67b1..07ff2d042 100644
--- a/Source/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
@@ -54,7 +54,7 @@ static v8::Handle<v8::Value> handlePostMessageCallback(const v8::Arguments& args
     MessagePortArray ports;
     ArrayBufferArray arrayBuffers;
     if (args.Length() > 1) {
-        if (!extractTransferables(args[1], ports, arrayBuffers))
+        if (!extractTransferables(args[1], ports, arrayBuffers, args.GetIsolate()))
             return v8::Undefined();
     }
     bool didThrow = false;
@@ -68,7 +68,7 @@ static v8::Handle<v8::Value> handlePostMessageCallback(const v8::Arguments& args
         return v8::Undefined();
     ExceptionCode ec = 0;
     worker->postMessage(message.release(), &ports, ec);
-    return throwError(ec, args.GetIsolate());
+    return V8Proxy::setDOMException(ec, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8Worker::postMessageCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
index 8ea9ebc4b..9e87209b2 100644
--- a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
@@ -63,9 +63,10 @@ v8::Handle<v8::Value> V8XMLHttpRequest::constructorCallback(const v8::Arguments&
     if (V8IsolatedContext* isolatedContext = V8IsolatedContext::getEntered())
         securityOrigin = isolatedContext->securityOrigin();
     RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(context, securityOrigin);
-    V8DOMWrapper::setDOMWrapper(args.Holder(), &info, xmlHttpRequest.get());
-    V8DOMWrapper::setJSWrapperForActiveDOMObject(xmlHttpRequest.release(), v8::Persistent<v8::Object>::New(args.Holder()));
-    return args.Holder();
+    v8::Handle<v8::Object> wrapper = args.Holder();
+    V8DOMWrapper::setDOMWrapper(wrapper, &info, xmlHttpRequest.get());
+    V8DOMWrapper::setJSWrapperForActiveDOMObject(xmlHttpRequest.release(), wrapper);
+    return wrapper;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index 5e64fc2d3..4bb57004c 100644
--- a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -57,7 +57,7 @@ v8::Handle<v8::Value> V8XMLHttpRequest::responseTextAccessorGetter(v8::Local<v8:
     ExceptionCode ec = 0;
     const String& text = xmlHttpRequest->responseText(ec);
     if (ec)
-        return throwError(ec, info.GetIsolate());
+        return V8Proxy::setDOMException(ec, info.GetIsolate());
     return v8String(text, info.GetIsolate());
 }
 
@@ -143,7 +143,7 @@ v8::Handle<v8::Value> V8XMLHttpRequest::openCallback(const v8::Arguments& args)
         xmlHttpRequest->open(method, url, ec);
 
     if (ec)
-        return throwError(ec, args.GetIsolate());
+        return V8Proxy::setDOMException(ec, args.GetIsolate());
 
     return v8::Undefined();
 }
@@ -200,7 +200,7 @@ v8::Handle<v8::Value> V8XMLHttpRequest::sendCallback(const v8::Arguments& args)
     }
 
     if (ec)
-        return throwError(ec, args.GetIsolate());
+        return V8Proxy::setDOMException(ec, args.GetIsolate());
 
     return v8::Undefined();
 }
diff --git a/Source/WebCore/bridge/qt/qt_class.cpp b/Source/WebCore/bridge/qt/qt_class.cpp
index 00cd1c49a..ee22a6861 100644
--- a/Source/WebCore/bridge/qt/qt_class.cpp
+++ b/Source/WebCore/bridge/qt/qt_class.cpp
@@ -99,16 +99,7 @@ JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, PropertyName id
         if (m.access() == QMetaMethod::Private)
             continue;
 
-#if !HAVE(QT5)
-        int iter = 0;
-        const char* signature = m.signature();
-        while (signature[iter] && signature[iter] != '(')
-            ++iter;
-
-        if (normal == QByteArray::fromRawData(signature, iter)) {
-#else
         if (normal == m.name()) {
-#endif
             QtRuntimeMetaMethod* val = QtRuntimeMetaMethod::create(exec, ustring, static_cast<QtInstance*>(inst), index, normal, false);
             qtinst->m_methods.insert(name, val);
             return val;
diff --git a/Source/WebCore/bridge/qt/qt_instance.cpp b/Source/WebCore/bridge/qt/qt_instance.cpp
index 6b5e6a75a..7852512d3 100644
--- a/Source/WebCore/bridge/qt/qt_instance.cpp
+++ b/Source/WebCore/bridge/qt/qt_instance.cpp
@@ -44,9 +44,6 @@ namespace Bindings {
 typedef QMultiHash<void*, QtInstance*> QObjectInstanceMap;
 static QObjectInstanceMap cachedInstances;
 
-// Used for implementing '__qt_sender__'.
-Q_GLOBAL_STATIC(QtInstance::QtSenderStack, senderStack)
-
 // Derived RuntimeObject
 class QtRuntimeObject : public RuntimeObject {
 public:
@@ -223,12 +220,8 @@ void QtInstance::getPropertyNames(ExecState* exec, PropertyNameArray& array)
         for (i = 0; i < methodCount; i++) {
             QMetaMethod method = meta->method(i);
             if (method.access() != QMetaMethod::Private) {
-#if HAVE(QT5)
                 QByteArray sig = method.methodSignature();
                 array.add(Identifier(exec, UString(sig.constData(), sig.length())));
-#else
-                array.add(Identifier(exec, method.signature()));
-#endif
             }
         }
     }
@@ -275,7 +268,6 @@ JSValue QtInstance::stringValue(ExecState* exec) const
             // Check to see how much we can call it
             if (m.access() != QMetaMethod::Private
                 && m.methodType() != QMetaMethod::Signal
-#if HAVE(QT5)
                 && m.parameterCount() == 0
                 && m.returnType() != QMetaType::Void) {
                 QVariant ret(m.returnType(), (void*)0);
@@ -286,20 +278,6 @@ JSValue QtInstance::stringValue(ExecState* exec) const
                     if (ret.isValid() && ret.canConvert(QVariant::String)) {
                         buf = ret.toString().toLatin1().constData(); // ### Latin 1? Ascii?
                         useDefault = false;
-#else
-                && m.parameterTypes().isEmpty()) {
-                const char* retsig = m.typeName();
-                if (retsig && *retsig) {
-                    QVariant ret(QMetaType::type(retsig), (void*)0);
-                    void * qargs[1];
-                    qargs[0] = ret.data();
-
-                    if (QMetaObject::metacall(obj, QMetaObject::InvokeMetaMethod, index, qargs) < 0) {
-                        if (ret.isValid() && ret.canConvert(QVariant::String)) {
-                            buf = ret.toString().toLatin1().constData(); // ### Latin 1? Ascii?
-                            useDefault = false;
-                        }
-#endif
                     }
                 }
             }
@@ -333,11 +311,6 @@ JSValue QtInstance::valueOf(ExecState* exec) const
     return stringValue(exec);
 }
 
-QtInstance::QtSenderStack* QtInstance::qtSenderStack()
-{
-    return senderStack();
-}
-
 // In qt_runtime.cpp
 JSValue convertQVariantToValue(ExecState*, PassRefPtr<RootObject> root, const QVariant& variant);
 QVariant convertValueToQVariant(ExecState*, JSValue, QMetaType::Type hint, int *distance);
@@ -389,11 +362,7 @@ void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValue
     if (obj) {
         QMetaType::Type argtype = QMetaType::Void;
         if (m_type == MetaProperty)
-#if HAVE(QT5)
             argtype = (QMetaType::Type) m_property.userType();
-#else
-            argtype = (QMetaType::Type) QMetaType::type(m_property.typeName());
-#endif
 
         // dynamic properties just get any QVariant
         QVariant val = convertValueToQVariant(exec, aValue, argtype, 0);
diff --git a/Source/WebCore/bridge/qt/qt_instance.h b/Source/WebCore/bridge/qt/qt_instance.h
index 110cb1b8b..cc42aedc6 100644
--- a/Source/WebCore/bridge/qt/qt_instance.h
+++ b/Source/WebCore/bridge/qt/qt_instance.h
@@ -22,7 +22,6 @@
 
 #include "BridgeJSC.h"
 #include <QPointer>
-#include <QStack>
 #include "Weak.h"
 #include "runtime_root.h"
 #include <qhash.h>
@@ -76,18 +75,6 @@ public:
 
     static QtInstance* getInstance(JSObject*);
 
-    class QtSenderStack {
-    public:
-        QObject* top() const { return m_stack.isEmpty() ? 0 : m_stack.top(); }
-        void push(QObject* object) { m_stack.push(object); }
-        void pop() { Q_ASSERT(!m_stack.isEmpty()); m_stack.pop(); }
-    private:
-        QStack<QObject*> m_stack;
-    };
-
-    // Used to implement '__qt_sender__'.
-    static QtSenderStack* qtSenderStack();
-
 private:
 
     class QtWeakObjectReference {
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index 61025ea30..951a7598e 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -40,8 +40,6 @@
 #include "JSUint8ClampedArray.h"
 #include "ObjectPrototype.h"
 #include "PropertyNameArray.h"
-#include "RegExpConstructor.h"
-#include "RegExpObject.h"
 #include "qdatetime.h"
 #include "qdebug.h"
 #include "qmetaobject.h"
@@ -101,7 +99,6 @@ typedef enum {
     Boolean,
     String,
     Date,
-    RegExp,
     Array,
     QObj,
     Object,
@@ -114,7 +111,7 @@ typedef enum {
 QDebug operator<<(QDebug dbg, const JSRealType &c)
 {
      const char *map[] = { "Variant", "Number", "Boolean", "String", "Date",
-         "RegExp", "Array", "RTObject", "Object", "Null", "RTArray"};
+         "Array", "RTObject", "Object", "Null", "RTArray"};
 
      dbg.nospace() << "JSType(" << ((int)c) << ", " <<  map[c] << ")";
 
@@ -122,6 +119,17 @@ QDebug operator<<(QDebug dbg, const JSRealType &c)
 }
 #endif
 
+void setException(JSContextRef context, JSValueRef* exception, const QString& text)
+{
+    if (!exception)
+        return;
+
+    JSStringRef errorStr = JSStringCreateWithUTF8CString(text.toUtf8());
+    JSValueRef errorVal[] = { JSValueMakeString(context, errorStr) };
+    *exception = JSObjectMakeError(context, 1, errorVal, 0);
+    JSStringRelease(errorStr);
+}
+
 struct RuntimeConversion {
     ConvertToJSValueFunction toJSValueFunc;
     ConvertToVariantFunction toVariantFunc;
@@ -163,8 +171,6 @@ static JSRealType valueRealType(ExecState* exec, JSValue val)
             return Array;
         else if (object->inherits(&DateInstance::s_info))
             return Date;
-        else if (object->inherits(&RegExpObject::s_info))
-            return RegExp;
         else if (object->inherits(&RuntimeObject::s_info))
             return QObj;
         return Object;
@@ -247,9 +253,6 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
             case Date:
                 hint = QMetaType::QDateTime;
                 break;
-            case RegExp:
-                hint = QMetaType::QRegExp;
-                break;
             case Object:
                 if (object->inherits(&NumberObject::s_info))
                     hint = QMetaType::Double;
@@ -573,43 +576,6 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
             }
             break;
 
-        case QMetaType::QRegExp:
-            if (type == RegExp) {
-/*
-                RegExpObject *re = static_cast<RegExpObject*>(object);
-*/
-                // Attempt to convert.. a bit risky
-                UString ustring = value.toString(exec)->value(exec);
-                QString qstring = QString((const QChar*)ustring.impl()->characters(), ustring.length());
-
-                // this is of the form '/xxxxxx/i'
-                int firstSlash = qstring.indexOf(QLatin1Char('/'));
-                int lastSlash = qstring.lastIndexOf(QLatin1Char('/'));
-                if (firstSlash >=0 && lastSlash > firstSlash) {
-                    QRegExp realRe;
-
-                    realRe.setPattern(qstring.mid(firstSlash + 1, lastSlash - firstSlash - 1));
-
-                    if (qstring.mid(lastSlash + 1).contains(QLatin1Char('i')))
-                        realRe.setCaseSensitivity(Qt::CaseInsensitive);
-
-                    ret = QVariant::fromValue(realRe);
-                    dist = 0;
-                } else {
-                    qConvDebug() << "couldn't parse a JS regexp";
-                }
-            } else if (type == String) {
-                UString ustring = value.toString(exec)->value(exec);
-                QString qstring = QString((const QChar*)ustring.impl()->characters(), ustring.length());
-
-                QRegExp re(qstring);
-                if (re.isValid()) {
-                    ret = QVariant::fromValue(re);
-                    dist = 10;
-                }
-            }
-            break;
-
         case QMetaType::QObjectStar:
             if (type == QObj) {
                 QtInstance* qtinst = QtInstance::getInstance(object);
@@ -841,20 +807,6 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         type == QMetaType::Double)
         return jsNumber(variant.toDouble());
 
-    if (type == QMetaType::QRegExp) {
-        QRegExp re = variant.value<QRegExp>();
-
-        if (re.isValid()) {
-            UString pattern((UChar*)re.pattern().utf16(), re.pattern().length());
-            RegExpFlags flags = (re.caseSensitivity() == Qt::CaseInsensitive) ? FlagIgnoreCase : NoFlags;
-
-            JSC::RegExp* regExp = JSC::RegExp::create(exec->globalData(), pattern, flags);
-            if (regExp->isValid())
-                return RegExpObject::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regExp);
-            return jsNull();
-        }
-    }
-
     if (type == QMetaType::QDateTime ||
         type == QMetaType::QDate ||
         type == QMetaType::QTime) {
@@ -1141,13 +1093,15 @@ static int indexOfMetaEnum(const QMetaObject *meta, const QByteArray &str)
 
 // Helper function for resolving methods
 // Largely based on code in QtScript for compatibility reasons
-static int findMethodIndex(ExecState* exec,
+static int findMethodIndex(JSContextRef context,
                            const QMetaObject* meta,
                            const QByteArray& signature,
+                           int argumentCount,
+                           const JSValueRef arguments[],
                            bool allowPrivate,
                            QVarLengthArray<QVariant, 10> &vars,
                            void** vvars,
-                           JSObject **pError)
+                           JSValueRef* exception)
 {
     QList<int> matchingIndices;
 
@@ -1169,7 +1123,6 @@ static int findMethodIndex(ExecState* exec,
     }
 
     int chosenIndex = -1;
-    *pError = 0;
     QVector<QtMethodMatchType> chosenTypes;
 
     QVarLengthArray<QVariant, 10> args;
@@ -1228,7 +1181,7 @@ static int findMethodIndex(ExecState* exec,
         }
 
         // If the native method requires more arguments than what was passed from JavaScript
-        if (exec->argumentCount() + 1 < static_cast<unsigned>(types.count())) {
+        if (argumentCount + 1 < static_cast<unsigned>(types.count())) {
             qMatchDebug() << "Match:too few args for" << method.methodSignature();
             tooFewArgs.append(index);
             continue;
@@ -1253,10 +1206,10 @@ static int findMethodIndex(ExecState* exec,
         bool converted = true;
         int matchDistance = 0;
         for (unsigned i = 0; converted && i + 1 < static_cast<unsigned>(types.count()); ++i) {
-            JSValue arg = i < exec->argumentCount() ? exec->argument(i) : jsUndefined();
+            JSValueRef arg = i < argumentCount ? arguments[i] : JSValueMakeUndefined(context);
 
             int argdistance = -1;
-            QVariant v = convertValueToQVariant(exec, arg, types.at(i+1).typeId(), &argdistance);
+            QVariant v = convertValueToQVariant(toJS(context), toJS(toJS(context), arg), types.at(i+1).typeId(), &argdistance);
             if (argdistance >= 0) {
                 matchDistance += argdistance;
                 args[i+1] = v;
@@ -1269,25 +1222,23 @@ static int findMethodIndex(ExecState* exec,
         qMatchDebug() << "Match: " << method.methodSignature() << (converted ? "converted":"failed to convert") << "distance " << matchDistance;
 
         if (converted) {
-            if ((exec->argumentCount() + 1 == static_cast<unsigned>(types.count()))
+            if ((argumentCount + 1 == static_cast<unsigned>(types.count()))
                 && (matchDistance == 0)) {
                 // perfect match, use this one
                 chosenIndex = index;
                 break;
-            } else {
-                QtMethodMatchData currentMatch(matchDistance, index, types, args);
-                if (candidates.isEmpty()) {
+            }
+            QtMethodMatchData currentMatch(matchDistance, index, types, args);
+            if (candidates.isEmpty())
+                candidates.append(currentMatch);
+            else {
+                QtMethodMatchData bestMatchSoFar = candidates.at(0);
+                if ((args.count() > bestMatchSoFar.args.count())
+                    || ((args.count() == bestMatchSoFar.args.count())
+                    && (matchDistance <= bestMatchSoFar.matchDistance)))
+                    candidates.prepend(currentMatch);
+                else
                     candidates.append(currentMatch);
-                } else {
-                    QtMethodMatchData bestMatchSoFar = candidates.at(0);
-                    if ((args.count() > bestMatchSoFar.args.count())
-                        || ((args.count() == bestMatchSoFar.args.count())
-                            && (matchDistance <= bestMatchSoFar.matchDistance))) {
-                        candidates.prepend(currentMatch);
-                    } else {
-                        candidates.append(currentMatch);
-                    }
-                }
             }
         } else {
             conversionFailed.append(index);
@@ -1308,7 +1259,7 @@ static int findMethodIndex(ExecState* exec,
                 QMetaMethod mtd = meta->method(conversionFailed.at(i));
                 message += QString::fromLatin1("    %0").arg(QString::fromLatin1(mtd.methodSignature()));
             }
-            *pError = throwError(exec, createTypeError(exec, message.toLatin1().constData()));
+            setException(context, exception, message);
         } else if (!unresolved.isEmpty()) {
             QtMethodMatchData argsInstance = unresolved.first();
             int unresolvedIndex = argsInstance.firstUnresolvedIndex();
@@ -1317,7 +1268,7 @@ static int findMethodIndex(ExecState* exec,
             QString message = QString::fromLatin1("cannot call %0(): unknown type `%1'")
                 .arg(QString::fromLatin1(signature))
                 .arg(QLatin1String(unresolvedType.name()));
-            *pError = throwError(exec, createTypeError(exec, message.toLatin1().constData()));
+            setException(context, exception, message);
         } else {
             QString message = QString::fromLatin1("too few arguments in call to %0(); candidates are\n")
                               .arg(QString::fromLatin1(signature));
@@ -1327,7 +1278,7 @@ static int findMethodIndex(ExecState* exec,
                 QMetaMethod mtd = meta->method(tooFewArgs.at(i));
                 message += QString::fromLatin1("    %0").arg(QString::fromLatin1(mtd.methodSignature()));
             }
-            *pError = throwError(exec, createSyntaxError(exec, message.toLatin1().constData()));
+            setException(context, exception, message);
         }
     }
 
@@ -1349,7 +1300,7 @@ static int findMethodIndex(ExecState* exec,
                     message += QString::fromLatin1("    %0").arg(QString::fromLatin1(mtd.methodSignature()));
                 }
             }
-            *pError = throwError(exec, createTypeError(exec, message.toLatin1().constData()));
+            setException(context, exception, message);
         } else {
             chosenIndex = bestMatch.index;
             args = bestMatch.args;
@@ -1424,21 +1375,26 @@ EncodedJSValue QtRuntimeMetaMethod::call(ExecState* exec)
 
     QObject *obj = d->m_instance->getObject();
     if (obj) {
+        const int argumentCount = static_cast<int>(exec->argumentCount());
+        Vector<JSValueRef, 10> args(argumentCount);
+        for (int i = 0; i < argumentCount; ++i)
+            args[i] = toRef(exec, exec->argument(i));
+
         QVarLengthArray<QVariant, 10> vargs;
         void *qargs[11];
 
         int methodIndex;
-        JSObject* errorObj = 0;
-        if ((methodIndex = findMethodIndex(exec, obj->metaObject(), d->m_signature, d->m_allowPrivate, vargs, (void **)qargs, &errorObj)) != -1) {
+        JSValueRef exception = 0;
+        if ((methodIndex = findMethodIndex(toRef(exec), obj->metaObject(), d->m_signature, argumentCount, args.data(), d->m_allowPrivate, vargs, (void **)qargs, &exception)) != -1) {
             if (QMetaObject::metacall(obj, QMetaObject::InvokeMetaMethod, methodIndex, qargs) >= 0)
                 return JSValue::encode(jsUndefined());
 
-            if (vargs[0].isValid())
+            if (vargs.size() > 0 && vargs[0].isValid())
                 return JSValue::encode(convertQVariantToValue(exec, d->m_instance->rootObject(), vargs[0]));
         }
 
-        if (errorObj)
-            return JSValue::encode(errorObj);
+        if (exception)
+            return throwVMError(exec, toJS(exec, exception));
     } else {
         return throwVMError(exec, createError(exec, "cannot call function of deleted QObject"));
     }
@@ -1746,7 +1702,8 @@ QtConnectionObject::QtConnectionObject(JSContextRef context, PassRefPtr<QtInstan
     , m_receiver(receiver)
     , m_receiverFunction(receiverFunction)
 {
-    JSValueProtect(m_context, m_receiver);
+    if (m_receiver)
+        JSValueProtect(m_context, m_receiver);
     JSValueProtect(m_context, m_receiverFunction);
 }
 
@@ -1756,7 +1713,8 @@ QtConnectionObject::~QtConnectionObject()
     // which is its QObject parent.
     QtRuntimeConnectionMethod::connections.remove(m_originalSender, this);
 
-    JSValueUnprotect(m_context, m_receiver);
+    if (m_receiver)
+        JSValueUnprotect(m_context, m_receiver);
     JSValueUnprotect(m_context, m_receiverFunction);
 }
 
@@ -1847,13 +1805,6 @@ int QtConnectionObject::qt_metacall(QMetaObject::Call _c, int _id, void **_a)
 }
 // End of moc-generated code
 
-static bool isJavaScriptFunction(JSObjectRef object)
-{
-    CallData callData;
-    JSObject* jsObject = toJS(object);
-    return jsObject->methodTable()->getCallData(jsObject, callData) == CallTypeJS;
-}
-
 void QtConnectionObject::execute(void** argv)
 {
     QObject* sender = m_senderInstance->getObject();
@@ -1882,14 +1833,7 @@ void QtConnectionObject::execute(void** argv)
         args[i] = ::toRef(exec, convertQVariantToValue(exec, rootObject, QVariant(argType, argv[i+1])));
     }
 
-    const bool updateQtSender = isJavaScriptFunction(m_receiverFunction);
-    if (updateQtSender)
-        QtInstance::qtSenderStack()->push(QObject::sender());
-
     JSObjectCallAsFunction(m_context, m_receiverFunction, m_receiver, argc, args.data(), 0);
-
-    if (updateQtSender)
-        QtInstance::qtSenderStack()->pop();
 }
 
 bool QtConnectionObject::match(JSContextRef context, QObject* sender, int signalIndex, JSObjectRef receiver, JSObjectRef receiverFunction)
@@ -1897,7 +1841,7 @@ bool QtConnectionObject::match(JSContextRef context, QObject* sender, int signal
     if (sender != m_originalSender || signalIndex != m_signalIndex)
         return false;
     JSValueRef* ignoredException = 0;
-    const bool receiverMatch = (!receiver && !m_receiver) || JSValueIsEqual(context, receiver, m_receiver, ignoredException);
+    const bool receiverMatch = (!receiver && !m_receiver) || (receiver && m_receiver && JSValueIsEqual(context, receiver, m_receiver, ignoredException));
     return receiverMatch && JSValueIsEqual(context, receiverFunction, m_receiverFunction, ignoredException);
 }
 
diff --git a/Source/WebCore/bridge/qt/qt_runtime.h b/Source/WebCore/bridge/qt/qt_runtime.h
index ac2cf2e01..b2fd66d43 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.h
+++ b/Source/WebCore/bridge/qt/qt_runtime.h
@@ -238,21 +238,11 @@ private:
 // with the appropriate signal of 'sender'. When execute() is called, it will call JS 'receiverFunction'.
 class QtConnectionObject : public QObject
 {
-#if HAVE(QT5)
     Q_OBJECT_FAKE
-#endif
 public:
     QtConnectionObject(JSContextRef, PassRefPtr<QtInstance> senderInstance, int signalIndex, JSObjectRef receiver, JSObjectRef receiverFunction);
     ~QtConnectionObject();
 
-#if !HAVE(QT5)
-    // Explicitly define these because want a custom qt_metacall(), so we can't use Q_OBJECT macro.
-    static const QMetaObject staticMetaObject;
-    virtual const QMetaObject *metaObject() const;
-    virtual void *qt_metacast(const char *);
-    virtual int qt_metacall(QMetaObject::Call, int, void **argv);
-#endif
-
     void execute(void **argv);
 
     bool match(JSContextRef, QObject* sender, int signalIndex, JSObjectRef thisObject, JSObjectRef funcObject);
@@ -281,6 +271,8 @@ void registerCustomType(int qtMetaTypeId, ConvertToVariantFunction, ConvertToJSV
 QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance);
 JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant);
 
+void setException(JSContextRef, JSValueRef* exception, const QString& text);
+
 } // namespace Bindings
 } // namespace JSC
 
diff --git a/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp b/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp
deleted file mode 100644
index e9e6f5afd..000000000
--- a/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp
+++ /dev/null
@@ -1,1931 +0,0 @@
-/*
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
-
-#include "config.h"
-#include "qt_runtime.h"
-
-#include "APICast.h"
-#include "BooleanObject.h"
-#include "DateInstance.h"
-#include "DatePrototype.h"
-#include "FunctionPrototype.h"
-#include "Interpreter.h"
-#include "JSArray.h"
-#include "JSContextRefPrivate.h"
-#include "JSDocument.h"
-#include "JSDOMBinding.h"
-#include "JSDOMWindow.h"
-#include <JSFunction.h>
-#include "JSGlobalObject.h"
-#include "JSHTMLElement.h"
-#include "JSLock.h"
-#include "JSObject.h"
-#include "JSRetainPtr.h"
-#include "JSUint8ClampedArray.h"
-#include "ObjectPrototype.h"
-#include "PropertyNameArray.h"
-#include "RegExpConstructor.h"
-#include "RegExpObject.h"
-#include "qdatetime.h"
-#include "qdebug.h"
-#include "qmetaobject.h"
-#include "qmetatype.h"
-#include "qobject.h"
-#include "qstringlist.h"
-#include "qt_instance.h"
-#include "qt_pixmapruntime.h"
-#include "qvarlengtharray.h"
-
-#include <wtf/DateMath.h>
-
-#include <limits.h>
-#include <runtime/Error.h>
-#include <runtime_array.h>
-#include <runtime_object.h>
-
-// QtScript has these
-Q_DECLARE_METATYPE(QObjectList);
-Q_DECLARE_METATYPE(QList<int>);
-Q_DECLARE_METATYPE(QVariant);
-
-using namespace WebCore;
-
-namespace JSC {
-namespace Bindings {
-
-// Debugging
-//#define QTWK_RUNTIME_CONVERSION_DEBUG
-//#define QTWK_RUNTIME_MATCH_DEBUG
-
-class QWKNoDebug
-{
-public:
-    inline QWKNoDebug(){}
-    inline ~QWKNoDebug(){}
-
-    template<typename T>
-    inline QWKNoDebug &operator<<(const T &) { return *this; }
-};
-
-#ifdef QTWK_RUNTIME_CONVERSION_DEBUG
-#define qConvDebug() qDebug()
-#else
-#define qConvDebug() QWKNoDebug()
-#endif
-
-#ifdef QTWK_RUNTIME_MATCH_DEBUG
-#define qMatchDebug() qDebug()
-#else
-#define qMatchDebug() QWKNoDebug()
-#endif
-
-typedef enum {
-    Variant = 0,
-    Number,
-    Boolean,
-    String,
-    Date,
-    RegExp,
-    Array,
-    QObj,
-    Object,
-    Null,
-    RTArray,
-    JSUint8ClampedArrayType
-} JSRealType;
-
-#if defined(QTWK_RUNTIME_CONVERSION_DEBUG) || defined(QTWK_RUNTIME_MATCH_DEBUG)
-QDebug operator<<(QDebug dbg, const JSRealType &c)
-{
-     const char *map[] = { "Variant", "Number", "Boolean", "String", "Date",
-         "RegExp", "Array", "RTObject", "Object", "Null", "RTArray"};
-
-     dbg.nospace() << "JSType(" << ((int)c) << ", " <<  map[c] << ")";
-
-     return dbg.space();
-}
-#endif
-
-struct RuntimeConversion {
-    ConvertToJSValueFunction toJSValueFunc;
-    ConvertToVariantFunction toVariantFunc;
-};
-
-typedef QHash<int, RuntimeConversion> RuntimeConversionTable;
-Q_GLOBAL_STATIC(RuntimeConversionTable, customRuntimeConversions)
-
-void registerCustomType(int qtMetaTypeId, ConvertToVariantFunction toVariantFunc, ConvertToJSValueFunction toJSValueFunc)
-{
-    RuntimeConversion conversion;
-    conversion.toJSValueFunc = toJSValueFunc;
-    conversion.toVariantFunc = toVariantFunc;
-    customRuntimeConversions()->insert(qtMetaTypeId, conversion);
-}
-
-static bool isJSUint8ClampedArray(JSValue val)
-{
-    return val.isCell() && val.inherits(&JSUint8ClampedArray::s_info);
-}
-
-static JSRealType valueRealType(ExecState* exec, JSValue val)
-{
-    if (val.isNumber())
-        return Number;
-    else if (val.isString())
-        return String;
-    else if (val.isBoolean())
-        return Boolean;
-    else if (val.isNull())
-        return Null;
-    else if (isJSUint8ClampedArray(val))
-        return JSUint8ClampedArrayType;
-    else if (val.isObject()) {
-        JSObject *object = val.toObject(exec);
-        if (object->inherits(&RuntimeArray::s_info))  // RuntimeArray 'inherits' from Array, but not in C++
-            return RTArray;
-        else if (object->inherits(&JSArray::s_info))
-            return Array;
-        else if (object->inherits(&DateInstance::s_info))
-            return Date;
-        else if (object->inherits(&RegExpObject::s_info))
-            return RegExp;
-        else if (object->inherits(&RuntimeObject::s_info))
-            return QObj;
-        return Object;
-    }
-
-    return String; // I don't know.
-}
-
-QVariant convertValueToQVariant(ExecState*, JSValue, QMetaType::Type, int*, HashSet<JSObject*>*, int);
-
-static QVariantMap convertValueToQVariantMap(ExecState* exec, JSObject* object, HashSet<JSObject*>* visitedObjects, int recursionLimit)
-{
-    Q_ASSERT(!exec->hadException());
-
-    PropertyNameArray properties(exec);
-    object->methodTable()->getPropertyNames(object, exec, properties, ExcludeDontEnumProperties);
-    PropertyNameArray::const_iterator it = properties.begin();
-    QVariantMap result;
-    int objdist = 0;
-
-    while (it != properties.end()) {
-        if (object->propertyIsEnumerable(exec, *it)) {
-            JSValue val = object->get(exec, *it);
-            if (exec->hadException())
-                exec->clearException();
-            else {
-                QVariant v = convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects, recursionLimit);
-                if (objdist >= 0) {
-                    UString ustring = (*it).ustring();
-                    QString id = QString((const QChar*)ustring.impl()->characters(), ustring.length());
-                    result.insert(id, v);
-                }
-            }
-        }
-        ++it;
-    }
-    return result;
-}
-
-QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance, HashSet<JSObject*>* visitedObjects, int recursionLimit)
-{
-    --recursionLimit;
-
-    if (!value || !recursionLimit)
-        return QVariant();
-
-    JSObject* object = 0;
-    if (value.isObject()) {
-        object = value.toObject(exec);
-        if (visitedObjects->contains(object))
-            return QVariant();
-
-        visitedObjects->add(object);
-    }
-
-    // check magic pointer values before dereferencing value
-    if (value == jsNaN()
-        || (value == jsUndefined()
-            && hint != QMetaType::QString
-            && hint != (QMetaType::Type) qMetaTypeId<QVariant>())) {
-        if (distance)
-            *distance = -1;
-        return QVariant();
-    }
-
-    JSLockHolder lock(exec);
-    JSRealType type = valueRealType(exec, value);
-    if (hint == QMetaType::Void) {
-        switch(type) {
-            case Number:
-                hint = QMetaType::Double;
-                break;
-            case Boolean:
-                hint = QMetaType::Bool;
-                break;
-            case String:
-            default:
-                hint = QMetaType::QString;
-                break;
-            case Date:
-                hint = QMetaType::QDateTime;
-                break;
-            case RegExp:
-                hint = QMetaType::QRegExp;
-                break;
-            case Object:
-                if (object->inherits(&NumberObject::s_info))
-                    hint = QMetaType::Double;
-                else if (object->inherits(&BooleanObject::s_info))
-                    hint = QMetaType::Bool;
-                else
-                    hint = QMetaType::QVariantMap;
-                break;
-            case QObj:
-                hint = QMetaType::QObjectStar;
-                break;
-            case JSUint8ClampedArrayType:
-                hint = QMetaType::QByteArray;
-                break;
-            case Array:
-            case RTArray:
-                hint = QMetaType::QVariantList;
-                break;
-        }
-    }
-
-    qConvDebug() << "convertValueToQVariant: jstype is " << type << ", hint is" << hint;
-
-    if (value == jsNull()
-        && hint != QMetaType::QObjectStar
-        && hint != QMetaType::VoidStar
-        && hint != QMetaType::QString
-        && hint != (QMetaType::Type) qMetaTypeId<QVariant>()) {
-        if (distance)
-            *distance = -1;
-        return QVariant();
-    }
-
-    QVariant ret;
-    int dist = -1;
-    switch (hint) {
-        case QMetaType::Bool:
-            if (type == Object && object->inherits(&BooleanObject::s_info))
-                ret = QVariant(asBooleanObject(value)->internalValue().toBoolean());
-            else
-                ret = QVariant(value.toBoolean());
-            if (type == Boolean)
-                dist = 0;
-            else
-                dist = 10;
-            break;
-
-        case QMetaType::Int:
-        case QMetaType::UInt:
-        case QMetaType::Long:
-        case QMetaType::ULong:
-        case QMetaType::LongLong:
-        case QMetaType::ULongLong:
-        case QMetaType::Short:
-        case QMetaType::UShort:
-        case QMetaType::Float:
-        case QMetaType::Double:
-            ret = QVariant(value.toNumber(exec));
-            ret.convert((QVariant::Type)hint);
-            if (type == Number) {
-                switch (hint) {
-                case QMetaType::Double:
-                    dist = 0;
-                    break;
-                case QMetaType::Float:
-                    dist = 1;
-                    break;
-                case QMetaType::LongLong:
-                case QMetaType::ULongLong:
-                    dist = 2;
-                    break;
-                case QMetaType::Long:
-                case QMetaType::ULong:
-                    dist = 3;
-                    break;
-                case QMetaType::Int:
-                case QMetaType::UInt:
-                    dist = 4;
-                    break;
-                case QMetaType::Short:
-                case QMetaType::UShort:
-                    dist = 5;
-                    break;
-                    break;
-                default:
-                    dist = 10;
-                    break;
-                }
-            } else {
-                dist = 10;
-            }
-            break;
-
-        case QMetaType::QChar:
-            if (type == Number || type == Boolean) {
-                ret = QVariant(QChar((ushort)value.toNumber(exec)));
-                if (type == Boolean)
-                    dist = 3;
-                else
-                    dist = 6;
-            } else {
-                UString str = value.toString(exec)->value(exec);
-                ret = QVariant(QChar(str.length() ? *(const ushort*)str.impl()->characters() : 0));
-                if (type == String)
-                    dist = 3;
-                else
-                    dist = 10;
-            }
-            break;
-
-        case QMetaType::QString: {
-            if (value.isUndefinedOrNull()) {
-                if (distance)
-                    *distance = 1;
-                return QString();
-            } else {
-                UString ustring = value.toString(exec)->value(exec);
-                ret = QVariant(QString((const QChar*)ustring.impl()->characters(), ustring.length()));
-                if (type == String)
-                    dist = 0;
-                else
-                    dist = 10;
-            }
-            break;
-        }
-
-        case QMetaType::QVariantMap:
-            if (type == Object || type == Array || type == RTArray) {
-                ret = QVariant(convertValueToQVariantMap(exec, object, visitedObjects, recursionLimit));
-                // Those types can still have perfect matches, e.g. 'bool' if value is a Boolean Object.
-                dist = 1;
-            }
-            break;
-
-        case QMetaType::QVariantList:
-            if (type == RTArray) {
-                RuntimeArray* rtarray = static_cast<RuntimeArray*>(object);
-
-                QVariantList result;
-                int len = rtarray->getLength();
-                int objdist = 0;
-                qConvDebug() << "converting a " << len << " length Array";
-                for (int i = 0; i < len; ++i) {
-                    JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
-                    result.append(convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects, recursionLimit));
-                    if (objdist == -1) {
-                        qConvDebug() << "Failed converting element at index " << i;
-                        break; // Failed converting a list entry, so fail the array
-                    }
-                }
-                if (objdist != -1) {
-                    dist = 5;
-                    ret = QVariant(result);
-                }
-            } else if (type == Array) {
-                JSArray* array = static_cast<JSArray*>(object);
-
-                QVariantList result;
-                int len = array->length();
-                int objdist = 0;
-                qConvDebug() << "converting a " << len << " length Array";
-                for (int i = 0; i < len; ++i) {
-                    JSValue val = array->get(exec, i);
-                    result.append(convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects, recursionLimit));
-                    if (objdist == -1) {
-                        qConvDebug() << "Failed converting element at index " << i;
-                        break; // Failed converting a list entry, so fail the array
-                    }
-                }
-                if (objdist != -1) {
-                    dist = 5;
-                    ret = QVariant(result);
-                }
-            } else {
-                // Make a single length array
-                int objdist;
-                qConvDebug() << "making a single length variantlist";
-                QVariant var = convertValueToQVariant(exec, value, QMetaType::Void, &objdist, visitedObjects, recursionLimit);
-                if (objdist != -1) {
-                    QVariantList result;
-                    result << var;
-                    ret = QVariant(result);
-                    dist = 10;
-                } else {
-                    qConvDebug() << "failed making single length varlist";
-                }
-            }
-            break;
-
-        case QMetaType::QStringList: {
-            if (type == RTArray) {
-                RuntimeArray* rtarray = static_cast<RuntimeArray*>(object);
-
-                QStringList result;
-                int len = rtarray->getLength();
-                for (int i = 0; i < len; ++i) {
-                    JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
-                    UString ustring = val.toString(exec)->value(exec);
-                    QString qstring = QString((const QChar*)ustring.impl()->characters(), ustring.length());
-
-                    result.append(qstring);
-                }
-                dist = 5;
-                ret = QVariant(result);
-            } else if (type == Array) {
-                JSArray* array = static_cast<JSArray*>(object);
-
-                QStringList result;
-                int len = array->length();
-                for (int i = 0; i < len; ++i) {
-                    JSValue val = array->get(exec, i);
-                    UString ustring = val.toString(exec)->value(exec);
-                    QString qstring = QString((const QChar*)ustring.impl()->characters(), ustring.length());
-
-                    result.append(qstring);
-                }
-                dist = 5;
-                ret = QVariant(result);
-            } else {
-                // Make a single length array
-                UString ustring = value.toString(exec)->value(exec);
-                QString qstring = QString((const QChar*)ustring.impl()->characters(), ustring.length());
-                QStringList result;
-                result.append(qstring);
-                ret = QVariant(result);
-                dist = 10;
-            }
-            break;
-        }
-
-        case QMetaType::QByteArray: {
-            if (type == JSUint8ClampedArrayType) {
-                WTF::Uint8ClampedArray* arr = toUint8ClampedArray(value);
-                ret = QVariant(QByteArray(reinterpret_cast<const char*>(arr->data()), arr->length()));
-                dist = 0;
-            } else {
-                UString ustring = value.toString(exec)->value(exec);
-                ret = QVariant(QString((const QChar*)ustring.impl()->characters(), ustring.length()).toLatin1());
-                if (type == String)
-                    dist = 5;
-                else
-                    dist = 10;
-            }
-            break;
-        }
-
-        case QMetaType::QDateTime:
-        case QMetaType::QDate:
-        case QMetaType::QTime:
-            if (type == Date) {
-                DateInstance* date = static_cast<DateInstance*>(object);
-                GregorianDateTime gdt;
-                msToGregorianDateTime(exec, date->internalNumber(), true, gdt);
-                if (hint == QMetaType::QDateTime) {
-                    ret = QDateTime(QDate(gdt.year(), gdt.month() + 1, gdt.monthDay()), QTime(gdt.hour(), gdt.minute(), gdt.second()), Qt::UTC);
-                    dist = 0;
-                } else if (hint == QMetaType::QDate) {
-                    ret = QDate(gdt.year(), gdt.month() + 1, gdt.monthDay());
-                    dist = 1;
-                } else {
-                    ret = QTime(gdt.hour(), gdt.minute(), gdt.second());
-                    dist = 2;
-                }
-            } else if (type == Number) {
-                double b = value.toNumber(exec);
-                GregorianDateTime gdt;
-                msToGregorianDateTime(exec, b, true, gdt);
-                if (hint == QMetaType::QDateTime) {
-                    ret = QDateTime(QDate(gdt.year(), gdt.month() + 1, gdt.monthDay()), QTime(gdt.hour(), gdt.minute(), gdt.second()), Qt::UTC);
-                    dist = 6;
-                } else if (hint == QMetaType::QDate) {
-                    ret = QDate(gdt.year(), gdt.month() + 1, gdt.monthDay());
-                    dist = 8;
-                } else {
-                    ret = QTime(gdt.hour(), gdt.minute(), gdt.second());
-                    dist = 10;
-                }
-#ifndef QT_NO_DATESTRING
-            } else if (type == String) {
-                UString ustring = value.toString(exec)->value(exec);
-                QString qstring = QString((const QChar*)ustring.impl()->characters(), ustring.length());
-
-                if (hint == QMetaType::QDateTime) {
-                    QDateTime dt = QDateTime::fromString(qstring, Qt::ISODate);
-                    if (!dt.isValid())
-                        dt = QDateTime::fromString(qstring, Qt::TextDate);
-                    if (!dt.isValid())
-                        dt = QDateTime::fromString(qstring, Qt::SystemLocaleDate);
-                    if (!dt.isValid())
-                        dt = QDateTime::fromString(qstring, Qt::LocaleDate);
-                    if (dt.isValid()) {
-                        ret = dt;
-                        dist = 2;
-                    }
-                } else if (hint == QMetaType::QDate) {
-                    QDate dt = QDate::fromString(qstring, Qt::ISODate);
-                    if (!dt.isValid())
-                        dt = QDate::fromString(qstring, Qt::TextDate);
-                    if (!dt.isValid())
-                        dt = QDate::fromString(qstring, Qt::SystemLocaleDate);
-                    if (!dt.isValid())
-                        dt = QDate::fromString(qstring, Qt::LocaleDate);
-                    if (dt.isValid()) {
-                        ret = dt;
-                        dist = 3;
-                    }
-                } else {
-                    QTime dt = QTime::fromString(qstring, Qt::ISODate);
-                    if (!dt.isValid())
-                        dt = QTime::fromString(qstring, Qt::TextDate);
-                    if (!dt.isValid())
-                        dt = QTime::fromString(qstring, Qt::SystemLocaleDate);
-                    if (!dt.isValid())
-                        dt = QTime::fromString(qstring, Qt::LocaleDate);
-                    if (dt.isValid()) {
-                        ret = dt;
-                        dist = 3;
-                    }
-                }
-#endif // QT_NO_DATESTRING
-            }
-            break;
-
-        case QMetaType::QRegExp:
-            if (type == RegExp) {
-/*
-                RegExpObject *re = static_cast<RegExpObject*>(object);
-*/
-                // Attempt to convert.. a bit risky
-                UString ustring = value.toString(exec)->value(exec);
-                QString qstring = QString((const QChar*)ustring.impl()->characters(), ustring.length());
-
-                // this is of the form '/xxxxxx/i'
-                int firstSlash = qstring.indexOf(QLatin1Char('/'));
-                int lastSlash = qstring.lastIndexOf(QLatin1Char('/'));
-                if (firstSlash >=0 && lastSlash > firstSlash) {
-                    QRegExp realRe;
-
-                    realRe.setPattern(qstring.mid(firstSlash + 1, lastSlash - firstSlash - 1));
-
-                    if (qstring.mid(lastSlash + 1).contains(QLatin1Char('i')))
-                        realRe.setCaseSensitivity(Qt::CaseInsensitive);
-
-                    ret = QVariant::fromValue(realRe);
-                    dist = 0;
-                } else {
-                    qConvDebug() << "couldn't parse a JS regexp";
-                }
-            } else if (type == String) {
-                UString ustring = value.toString(exec)->value(exec);
-                QString qstring = QString((const QChar*)ustring.impl()->characters(), ustring.length());
-
-                QRegExp re(qstring);
-                if (re.isValid()) {
-                    ret = QVariant::fromValue(re);
-                    dist = 10;
-                }
-            }
-            break;
-
-        case QMetaType::QObjectStar:
-            if (type == QObj) {
-                QtInstance* qtinst = QtInstance::getInstance(object);
-                if (qtinst) {
-                    if (qtinst->getObject()) {
-                        qConvDebug() << "found instance, with object:" << (void*) qtinst->getObject();
-                        ret = QVariant::fromValue(qtinst->getObject());
-                        qConvDebug() << ret;
-                        dist = 0;
-                    } else {
-                        qConvDebug() << "can't convert deleted qobject";
-                    }
-                } else {
-                    qConvDebug() << "wasn't a qtinstance";
-                }
-            } else if (type == Null) {
-                QObject* nullobj = 0;
-                ret = QVariant::fromValue(nullobj);
-                dist = 0;
-            } else {
-                qConvDebug() << "previous type was not an object:" << type;
-            }
-            break;
-
-        case QMetaType::VoidStar:
-            if (type == QObj) {
-                QtInstance* qtinst = QtInstance::getInstance(object);
-                if (qtinst) {
-                    if (qtinst->getObject()) {
-                        qConvDebug() << "found instance, with object:" << (void*) qtinst->getObject();
-                        ret = QVariant::fromValue((void *)qtinst->getObject());
-                        qConvDebug() << ret;
-                        dist = 0;
-                    } else {
-                        qConvDebug() << "can't convert deleted qobject";
-                    }
-                } else {
-                    qConvDebug() << "wasn't a qtinstance";
-                }
-            } else if (type == Null) {
-                ret = QVariant::fromValue((void*)0);
-                dist = 0;
-            } else if (type == Number) {
-                // I don't think that converting a double to a pointer is a wise
-                // move.  Except maybe 0.
-                qConvDebug() << "got number for void * - not converting, seems unsafe:" << value.toNumber(exec);
-            } else {
-                qConvDebug() << "void* - unhandled type" << type;
-            }
-            break;
-
-        default:
-            // Non const type ids
-            if (hint == (QMetaType::Type) qMetaTypeId<QObjectList>())
-            {
-                if (type == RTArray) {
-                    RuntimeArray* rtarray = static_cast<RuntimeArray*>(object);
-
-                    QObjectList result;
-                    int len = rtarray->getLength();
-                    for (int i = 0; i < len; ++i) {
-                        JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
-                        int itemdist = -1;
-                        QVariant item = convertValueToQVariant(exec, val, QMetaType::QObjectStar, &itemdist, visitedObjects, recursionLimit);
-                        if (itemdist >= 0)
-                            result.append(item.value<QObject*>());
-                        else
-                            break;
-                    }
-                    // If we didn't fail conversion
-                    if (result.count() == len) {
-                        dist = 5;
-                        ret = QVariant::fromValue(result);
-                    }
-                } else if (type == Array) {
-                    JSObject* object = value.toObject(exec);
-                    JSArray* array = static_cast<JSArray *>(object);
-                    QObjectList result;
-                    int len = array->length();
-                    for (int i = 0; i < len; ++i) {
-                        JSValue val = array->get(exec, i);
-                        int itemdist = -1;
-                        QVariant item = convertValueToQVariant(exec, val, QMetaType::QObjectStar, &itemdist, visitedObjects, recursionLimit);
-                        if (itemdist >= 0)
-                            result.append(item.value<QObject*>());
-                        else
-                            break;
-                    }
-                    // If we didn't fail conversion
-                    if (result.count() == len) {
-                        dist = 5;
-                        ret = QVariant::fromValue(result);
-                    }
-                } else {
-                    // Make a single length array
-                    QObjectList result;
-                    int itemdist = -1;
-                    QVariant item = convertValueToQVariant(exec, value, QMetaType::QObjectStar, &itemdist, visitedObjects, recursionLimit);
-                    if (itemdist >= 0) {
-                        result.append(item.value<QObject*>());
-                        dist = 10;
-                        ret = QVariant::fromValue(result);
-                    }
-                }
-                break;
-            } else if (hint == (QMetaType::Type) qMetaTypeId<QList<int> >()) {
-                if (type == RTArray) {
-                    RuntimeArray* rtarray = static_cast<RuntimeArray*>(object);
-
-                    QList<int> result;
-                    int len = rtarray->getLength();
-                    for (int i = 0; i < len; ++i) {
-                        JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
-                        int itemdist = -1;
-                        QVariant item = convertValueToQVariant(exec, val, QMetaType::Int, &itemdist, visitedObjects, recursionLimit);
-                        if (itemdist >= 0)
-                            result.append(item.value<int>());
-                        else
-                            break;
-                    }
-                    // If we didn't fail conversion
-                    if (result.count() == len) {
-                        dist = 5;
-                        ret = QVariant::fromValue(result);
-                    }
-                } else if (type == Array) {
-                    JSArray* array = static_cast<JSArray *>(object);
-
-                    QList<int> result;
-                    int len = array->length();
-                    for (int i = 0; i < len; ++i) {
-                        JSValue val = array->get(exec, i);
-                        int itemdist = -1;
-                        QVariant item = convertValueToQVariant(exec, val, QMetaType::Int, &itemdist, visitedObjects, recursionLimit);
-                        if (itemdist >= 0)
-                            result.append(item.value<int>());
-                        else
-                            break;
-                    }
-                    // If we didn't fail conversion
-                    if (result.count() == len) {
-                        dist = 5;
-                        ret = QVariant::fromValue(result);
-                    }
-                } else {
-                    // Make a single length array
-                    QList<int> result;
-                    int itemdist = -1;
-                    QVariant item = convertValueToQVariant(exec, value, QMetaType::Int, &itemdist, visitedObjects, recursionLimit);
-                    if (itemdist >= 0) {
-                        result.append(item.value<int>());
-                        dist = 10;
-                        ret = QVariant::fromValue(result);
-                    }
-                }
-                break;
-            } else if (QtPixmapInstance::canHandle(static_cast<QMetaType::Type>(hint))) {
-                ret = QtPixmapInstance::variantFromObject(object, static_cast<QMetaType::Type>(hint));
-            } else if (customRuntimeConversions()->contains(hint)) {
-                ret = customRuntimeConversions()->value(hint).toVariantFunc(object, &dist, visitedObjects);
-                if (dist == 0)
-                    break;
-            } else if (hint == (QMetaType::Type) qMetaTypeId<QVariant>()) {
-                if (value.isUndefinedOrNull()) {
-                    if (distance)
-                        *distance = 1;
-                    return QVariant();
-                } else {
-                    if (type == Object) {
-                        // Since we haven't really visited this object yet, we remove it
-                        visitedObjects->remove(object);
-                    }
-
-                    // And then recurse with the autodetect flag
-                    ret = convertValueToQVariant(exec, value, QMetaType::Void, distance, visitedObjects, recursionLimit);
-                    dist = 10;
-                }
-                break;
-            }
-
-            dist = 10;
-            break;
-    }
-
-    if (!ret.isValid())
-        dist = -1;
-    if (distance)
-        *distance = dist;
-
-    return ret;
-}
-
-QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance)
-{
-    const int recursionLimit = 200;
-    HashSet<JSObject*> visitedObjects;
-    return convertValueToQVariant(exec, value, hint, distance, &visitedObjects, recursionLimit);
-}
-
-JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant)
-{
-    // Variants with QObject * can be isNull but not a null pointer
-    // An empty QString variant is also null
-    QMetaType::Type type = (QMetaType::Type) variant.userType();
-
-    qConvDebug() << "convertQVariantToValue: metatype:" << type << ", isnull: " << variant.isNull();
-    if (variant.isNull() &&
-        type != QMetaType::QObjectStar &&
-        type != QMetaType::VoidStar &&
-        type != QMetaType::QWidgetStar &&
-        type != QMetaType::QString) {
-        return jsNull();
-    }
-
-    JSLockHolder lock(exec);
-
-    if (type == QMetaType::Bool)
-        return jsBoolean(variant.toBool());
-
-    if (type == QMetaType::Int ||
-        type == QMetaType::UInt ||
-        type == QMetaType::Long ||
-        type == QMetaType::ULong ||
-        type == QMetaType::LongLong ||
-        type == QMetaType::ULongLong ||
-        type == QMetaType::Short ||
-        type == QMetaType::UShort ||
-        type == QMetaType::Float ||
-        type == QMetaType::Double)
-        return jsNumber(variant.toDouble());
-
-    if (type == QMetaType::QRegExp) {
-        QRegExp re = variant.value<QRegExp>();
-
-        if (re.isValid()) {
-            UString pattern((UChar*)re.pattern().utf16(), re.pattern().length());
-            RegExpFlags flags = (re.caseSensitivity() == Qt::CaseInsensitive) ? FlagIgnoreCase : NoFlags;
-
-            JSC::RegExp* regExp = JSC::RegExp::create(exec->globalData(), pattern, flags);
-            if (regExp->isValid())
-                return RegExpObject::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regExp);
-            return jsNull();
-        }
-    }
-
-    if (type == QMetaType::QDateTime ||
-        type == QMetaType::QDate ||
-        type == QMetaType::QTime) {
-
-        QDate date = QDate::currentDate();
-        QTime time(0,0,0); // midnight
-
-        if (type == QMetaType::QDate)
-            date = variant.value<QDate>();
-        else if (type == QMetaType::QTime)
-            time = variant.value<QTime>();
-        else {
-            QDateTime dt = variant.value<QDateTime>().toLocalTime();
-            date = dt.date();
-            time = dt.time();
-        }
-
-        // Dates specified this way are in local time (we convert DateTimes above)
-        GregorianDateTime dt;
-        dt.setYear(date.year());
-        dt.setMonth(date.month() - 1);
-        dt.setMonthDay(date.day());
-        dt.setHour(time.hour());
-        dt.setMinute(time.minute());
-        dt.setSecond(time.second());
-        dt.setIsDST(-1);
-        double ms = gregorianDateTimeToMS(exec, dt, time.msec(), /*inputIsUTC*/ false);
-
-        return DateInstance::create(exec, exec->lexicalGlobalObject()->dateStructure(), trunc(ms));
-    }
-
-    if (type == QMetaType::QByteArray) {
-        QByteArray qtByteArray = variant.value<QByteArray>();
-        WTF::RefPtr<WTF::Uint8ClampedArray> wtfByteArray = WTF::Uint8ClampedArray::createUninitialized(qtByteArray.length());
-        memcpy(wtfByteArray->data(), qtByteArray.constData(), qtByteArray.length());
-        return toJS(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), wtfByteArray.get());
-    }
-
-    if (type == QMetaType::QObjectStar || type == QMetaType::QWidgetStar) {
-        QObject* obj = variant.value<QObject*>();
-        if (!obj)
-            return jsNull();
-        return QtInstance::getQtInstance(obj, root, QtInstance::QtOwnership)->createRuntimeObject(exec);
-    }
-
-    if (QtPixmapInstance::canHandle(static_cast<QMetaType::Type>(variant.type())))
-        return QtPixmapInstance::createPixmapRuntimeObject(exec, root, variant);
-
-    if (customRuntimeConversions()->contains(type)) {
-        if (!root->globalObject()->inherits(&JSDOMWindow::s_info))
-            return jsUndefined();
-
-        Document* document = (static_cast<JSDOMWindow*>(root->globalObject()))->impl()->document();
-        if (!document)
-            return jsUndefined();
-        return customRuntimeConversions()->value(type).toJSValueFunc(exec, toJSDOMGlobalObject(document, exec), variant);
-    }
-
-    if (type == QMetaType::QVariantMap) {
-        // create a new object, and stuff properties into it
-        JSObject* ret = constructEmptyObject(exec);
-        QVariantMap map = variant.value<QVariantMap>();
-        QVariantMap::const_iterator i = map.constBegin();
-        while (i != map.constEnd()) {
-            QString s = i.key();
-            JSValue val = convertQVariantToValue(exec, root.get(), i.value());
-            if (val) {
-                PutPropertySlot slot;
-                ret->methodTable()->put(ret, exec, Identifier(&exec->globalData(), reinterpret_cast_ptr<const UChar *>(s.constData()), s.length()), val, slot);
-                // ### error case?
-            }
-            ++i;
-        }
-
-        return ret;
-    }
-
-    // List types
-    if (type == QMetaType::QVariantList) {
-        QVariantList vl = variant.toList();
-        qConvDebug() << "got a " << vl.count() << " length list:" << vl;
-        return RuntimeArray::create(exec, new QtArray<QVariant>(vl, QMetaType::Void, root));
-    } else if (type == QMetaType::QStringList) {
-        QStringList sl = variant.value<QStringList>();
-        return RuntimeArray::create(exec, new QtArray<QString>(sl, QMetaType::QString, root));
-    } else if (type == (QMetaType::Type) qMetaTypeId<QObjectList>()) {
-        QObjectList ol= variant.value<QObjectList>();
-        return RuntimeArray::create(exec, new QtArray<QObject*>(ol, QMetaType::QObjectStar, root));
-    } else if (type == (QMetaType::Type)qMetaTypeId<QList<int> >()) {
-        QList<int> il= variant.value<QList<int> >();
-        return RuntimeArray::create(exec, new QtArray<int>(il, QMetaType::Int, root));
-    }
-
-    if (type == (QMetaType::Type)qMetaTypeId<QVariant>()) {
-        QVariant real = variant.value<QVariant>();
-        qConvDebug() << "real variant is:" << real;
-        return convertQVariantToValue(exec, root, real);
-    }
-
-    qConvDebug() << "fallback path for" << variant << variant.userType();
-
-    QString string = variant.toString();
-    UString ustring((UChar*)string.utf16(), string.length());
-    return jsString(exec, ustring);
-}
-
-// ===============
-
-// Qt-like macros
-#define QW_D(Class) Class##Data* d = d_func()
-#define QW_DS(Class,Instance) Class##Data* d = Instance->d_func()
-
-const ClassInfo QtRuntimeMethod::s_info = { "QtRuntimeMethod", &InternalFunction::s_info, 0, 0, CREATE_METHOD_TABLE(QtRuntimeMethod) };
-
-QtRuntimeMethod::QtRuntimeMethod(QtRuntimeMethodData* dd, ExecState* exec, Structure* structure, const UString& identifier)
-    : InternalFunction(exec->lexicalGlobalObject(), structure)
-    , d_ptr(dd)
-{
-}
-
-void QtRuntimeMethod::finishCreation(ExecState* exec, const UString& identifier, PassRefPtr<QtInstance> instance)
-{
-    Base::finishCreation(exec->globalData(), identifier);
-    QW_D(QtRuntimeMethod);
-    d->m_instance = instance;
-    d->m_finalizer = PassWeak<QtRuntimeMethod>(this, d);
-}
-
-QtRuntimeMethod::~QtRuntimeMethod()
-{
-    delete d_ptr;
-}
-
-void QtRuntimeMethod::destroy(JSCell* cell)
-{
-    static_cast<QtRuntimeMethod*>(cell)->QtRuntimeMethod::~QtRuntimeMethod();
-}
-
-// ===============
-
-QtRuntimeMethodData::~QtRuntimeMethodData()
-{
-}
-
-void QtRuntimeMethodData::finalize(Handle<Unknown>, void*)
-{
-    m_instance->removeUnusedMethods();
-}
-
-QtRuntimeMetaMethodData::~QtRuntimeMetaMethodData()
-{
-
-}
-
-QtRuntimeConnectionMethodData::~QtRuntimeConnectionMethodData()
-{
-
-}
-
-// ===============
-
-// Type conversion metadata (from QtScript originally)
-class QtMethodMatchType
-{
-public:
-    enum Kind {
-        Invalid,
-        Variant,
-        MetaType,
-        Unresolved,
-        MetaEnum
-    };
-
-
-    QtMethodMatchType()
-        : m_kind(Invalid) { }
-
-    Kind kind() const
-    { return m_kind; }
-
-    QMetaType::Type typeId() const;
-
-    bool isValid() const
-    { return (m_kind != Invalid); }
-
-    bool isVariant() const
-    { return (m_kind == Variant); }
-
-    bool isMetaType() const
-    { return (m_kind == MetaType); }
-
-    bool isUnresolved() const
-    { return (m_kind == Unresolved); }
-
-    bool isMetaEnum() const
-    { return (m_kind == MetaEnum); }
-
-    QByteArray name() const;
-
-    int enumeratorIndex() const
-    { Q_ASSERT(isMetaEnum()); return m_typeId; }
-
-    static QtMethodMatchType variant()
-    { return QtMethodMatchType(Variant); }
-
-    static QtMethodMatchType metaType(int typeId, const QByteArray &name)
-    { return QtMethodMatchType(MetaType, typeId, name); }
-
-    static QtMethodMatchType metaEnum(int enumIndex, const QByteArray &name)
-    { return QtMethodMatchType(MetaEnum, enumIndex, name); }
-
-    static QtMethodMatchType unresolved(const QByteArray &name)
-    { return QtMethodMatchType(Unresolved, /*typeId=*/0, name); }
-
-private:
-    QtMethodMatchType(Kind kind, int typeId = 0, const QByteArray &name = QByteArray())
-        : m_kind(kind), m_typeId(typeId), m_name(name) { }
-
-    Kind m_kind;
-    int m_typeId;
-    QByteArray m_name;
-};
-
-QMetaType::Type QtMethodMatchType::typeId() const
-{
-    if (isVariant())
-        return (QMetaType::Type) QMetaType::type("QVariant");
-    return (QMetaType::Type) (isMetaEnum() ? QMetaType::Int : m_typeId);
-}
-
-QByteArray QtMethodMatchType::name() const
-{
-    if (!m_name.isEmpty())
-        return m_name;
-    else if (m_kind == Variant)
-        return "QVariant";
-    return QByteArray();
-}
-
-struct QtMethodMatchData
-{
-    int matchDistance;
-    int index;
-    QVector<QtMethodMatchType> types;
-    QVarLengthArray<QVariant, 10> args;
-
-    QtMethodMatchData(int dist, int idx, QVector<QtMethodMatchType> typs,
-                                const QVarLengthArray<QVariant, 10> &as)
-        : matchDistance(dist), index(idx), types(typs), args(as) { }
-    QtMethodMatchData()
-        : index(-1) { }
-
-    bool isValid() const
-    { return (index != -1); }
-
-    int firstUnresolvedIndex() const
-    {
-        for (int i=0; i < types.count(); i++) {
-            if (types.at(i).isUnresolved())
-                return i;
-        }
-        return -1;
-    }
-};
-
-static int indexOfMetaEnum(const QMetaObject *meta, const QByteArray &str)
-{
-    QByteArray scope;
-    QByteArray name;
-    int scopeIdx = str.indexOf("::");
-    if (scopeIdx != -1) {
-        scope = str.left(scopeIdx);
-        name = str.mid(scopeIdx + 2);
-    } else {
-        name = str;
-    }
-    for (int i = meta->enumeratorCount() - 1; i >= 0; --i) {
-        QMetaEnum m = meta->enumerator(i);
-        if ((m.name() == name)/* && (scope.isEmpty() || (m.scope() == scope))*/)
-            return i;
-    }
-    return -1;
-}
-
-// Helper function for resolving methods
-// Largely based on code in QtScript for compatibility reasons
-static int findMethodIndex(ExecState* exec,
-                           const QMetaObject* meta,
-                           const QByteArray& signature,
-                           bool allowPrivate,
-                           QVarLengthArray<QVariant, 10> &vars,
-                           void** vvars,
-                           JSObject **pError)
-{
-    QList<int> matchingIndices;
-
-    bool overloads = !signature.contains('(');
-
-    int count = meta->methodCount();
-    for (int i = count - 1; i >= 0; --i) {
-        const QMetaMethod m = meta->method(i);
-
-        // Don't choose private methods
-        if (m.access() == QMetaMethod::Private && !allowPrivate)
-            continue;
-
-        // try and find all matching named methods
-        if (m.signature() == signature)
-            matchingIndices.append(i);
-        else if (overloads) {
-            QByteArray rawsignature = m.signature();
-            rawsignature.truncate(rawsignature.indexOf('('));
-            if (rawsignature == signature)
-                matchingIndices.append(i);
-        }
-    }
-
-    int chosenIndex = -1;
-    *pError = 0;
-    QVector<QtMethodMatchType> chosenTypes;
-
-    QVarLengthArray<QVariant, 10> args;
-    QVector<QtMethodMatchData> candidates;
-    QVector<QtMethodMatchData> unresolved;
-    QVector<int> tooFewArgs;
-    QVector<int> conversionFailed;
-
-    foreach(int index, matchingIndices) {
-        QMetaMethod method = meta->method(index);
-
-        QVector<QtMethodMatchType> types;
-        bool unresolvedTypes = false;
-
-        // resolve return type
-        QByteArray returnTypeName = method.typeName();
-        int rtype = QMetaType::type(returnTypeName);
-        if ((rtype == 0) && !returnTypeName.isEmpty()) {
-            if (returnTypeName == "QVariant") {
-                types.append(QtMethodMatchType::variant());
-            } else if (returnTypeName.endsWith('*')) {
-                types.append(QtMethodMatchType::metaType(QMetaType::VoidStar, returnTypeName));
-            } else {
-                int enumIndex = indexOfMetaEnum(meta, returnTypeName);
-                if (enumIndex != -1)
-                    types.append(QtMethodMatchType::metaEnum(enumIndex, returnTypeName));
-                else {
-                    unresolvedTypes = true;
-                    types.append(QtMethodMatchType::unresolved(returnTypeName));
-                }
-            }
-        } else {
-            if (returnTypeName == "QVariant")
-                types.append(QtMethodMatchType::variant());
-            else
-                types.append(QtMethodMatchType::metaType(rtype, returnTypeName));
-        }
-
-        // resolve argument types
-        QList<QByteArray> parameterTypeNames = method.parameterTypes();
-        for (int i = 0; i < parameterTypeNames.count(); ++i) {
-            QByteArray argTypeName = parameterTypeNames.at(i);
-            int atype = QMetaType::type(argTypeName);
-            if (atype == 0) {
-                if (argTypeName == "QVariant") {
-                    types.append(QtMethodMatchType::variant());
-                } else {
-                    int enumIndex = indexOfMetaEnum(meta, argTypeName);
-                    if (enumIndex != -1)
-                        types.append(QtMethodMatchType::metaEnum(enumIndex, argTypeName));
-                    else {
-                        unresolvedTypes = true;
-                        types.append(QtMethodMatchType::unresolved(argTypeName));
-                    }
-                }
-            } else {
-                if (argTypeName == "QVariant")
-                    types.append(QtMethodMatchType::variant());
-                else
-                    types.append(QtMethodMatchType::metaType(atype, argTypeName));
-            }
-        }
-
-        // If the native method requires more arguments than what was passed from JavaScript
-        if (exec->argumentCount() + 1 < static_cast<unsigned>(types.count())) {
-            qMatchDebug() << "Match:too few args for" << method.signature();
-            tooFewArgs.append(index);
-            continue;
-        }
-
-        if (unresolvedTypes) {
-            qMatchDebug() << "Match:unresolved arg types for" << method.signature();
-            // remember it so we can give an error message later, if necessary
-            unresolved.append(QtMethodMatchData(/*matchDistance=*/INT_MAX, index,
-                                                   types, QVarLengthArray<QVariant, 10>()));
-            continue;
-        }
-
-        // Now convert arguments
-        if (args.count() != types.count())
-            args.resize(types.count());
-
-        QtMethodMatchType retType = types[0];
-        args[0] = QVariant(retType.typeId(), (void *)0); // the return value
-
-        bool converted = true;
-        int matchDistance = 0;
-        for (unsigned i = 0; converted && i + 1 < static_cast<unsigned>(types.count()); ++i) {
-            JSValue arg = i < exec->argumentCount() ? exec->argument(i) : jsUndefined();
-
-            int argdistance = -1;
-            QVariant v = convertValueToQVariant(exec, arg, types.at(i+1).typeId(), &argdistance);
-            if (argdistance >= 0) {
-                matchDistance += argdistance;
-                args[i+1] = v;
-            } else {
-                qMatchDebug() << "failed to convert argument " << i << "type" << types.at(i+1).typeId() << QMetaType::typeName(types.at(i+1).typeId());
-                converted = false;
-            }
-        }
-
-        qMatchDebug() << "Match: " << method.signature() << (converted ? "converted":"failed to convert") << "distance " << matchDistance;
-
-        if (converted) {
-            if ((exec->argumentCount() + 1 == static_cast<unsigned>(types.count()))
-                && (matchDistance == 0)) {
-                // perfect match, use this one
-                chosenIndex = index;
-                break;
-            } else {
-                QtMethodMatchData currentMatch(matchDistance, index, types, args);
-                if (candidates.isEmpty()) {
-                    candidates.append(currentMatch);
-                } else {
-                    QtMethodMatchData bestMatchSoFar = candidates.at(0);
-                    if ((args.count() > bestMatchSoFar.args.count())
-                        || ((args.count() == bestMatchSoFar.args.count())
-                            && (matchDistance <= bestMatchSoFar.matchDistance))) {
-                        candidates.prepend(currentMatch);
-                    } else {
-                        candidates.append(currentMatch);
-                    }
-                }
-            }
-        } else {
-            conversionFailed.append(index);
-        }
-
-        if (!overloads)
-            break;
-    }
-
-    if (chosenIndex == -1 && candidates.count() == 0) {
-        // No valid functions at all - format an error message
-        if (!conversionFailed.isEmpty()) {
-            QString message = QString::fromLatin1("incompatible type of argument(s) in call to %0(); candidates were\n")
-                              .arg(QLatin1String(signature));
-            for (int i = 0; i < conversionFailed.size(); ++i) {
-                if (i > 0)
-                    message += QLatin1String("\n");
-                QMetaMethod mtd = meta->method(conversionFailed.at(i));
-                message += QString::fromLatin1("    %0").arg(QString::fromLatin1(mtd.signature()));
-            }
-            *pError = throwError(exec, createTypeError(exec, message.toLatin1().constData()));
-        } else if (!unresolved.isEmpty()) {
-            QtMethodMatchData argsInstance = unresolved.first();
-            int unresolvedIndex = argsInstance.firstUnresolvedIndex();
-            Q_ASSERT(unresolvedIndex != -1);
-            QtMethodMatchType unresolvedType = argsInstance.types.at(unresolvedIndex);
-            QString message = QString::fromLatin1("cannot call %0(): unknown type `%1'")
-                .arg(QString::fromLatin1(signature))
-                .arg(QLatin1String(unresolvedType.name()));
-            *pError = throwError(exec, createTypeError(exec, message.toLatin1().constData()));
-        } else {
-            QString message = QString::fromLatin1("too few arguments in call to %0(); candidates are\n")
-                              .arg(QLatin1String(signature));
-            for (int i = 0; i < tooFewArgs.size(); ++i) {
-                if (i > 0)
-                    message += QLatin1String("\n");
-                QMetaMethod mtd = meta->method(tooFewArgs.at(i));
-                message += QString::fromLatin1("    %0").arg(QString::fromLatin1(mtd.signature()));
-            }
-            *pError = throwError(exec, createSyntaxError(exec, message.toLatin1().constData()));
-        }
-    }
-
-    if (chosenIndex == -1 && candidates.count() > 0) {
-        QtMethodMatchData bestMatch = candidates.at(0);
-        if ((candidates.size() > 1)
-            && (bestMatch.args.count() == candidates.at(1).args.count())
-            && (bestMatch.matchDistance == candidates.at(1).matchDistance)) {
-            // ambiguous call
-            QString message = QString::fromLatin1("ambiguous call of overloaded function %0(); candidates were\n")
-                                .arg(QLatin1String(signature));
-            for (int i = 0; i < candidates.size(); ++i) {
-                // Only candidate for overload if argument count and match distance is same as best match
-                if (candidates.at(i).args.count() == bestMatch.args.count()
-                    || candidates.at(i).matchDistance == bestMatch.matchDistance) {
-                    if (i > 0)
-                        message += QLatin1String("\n");
-                    QMetaMethod mtd = meta->method(candidates.at(i).index);
-                    message += QString::fromLatin1("    %0").arg(QString::fromLatin1(mtd.signature()));
-                }
-            }
-            *pError = throwError(exec, createTypeError(exec, message.toLatin1().constData()));
-        } else {
-            chosenIndex = bestMatch.index;
-            args = bestMatch.args;
-        }
-    }
-
-    if (chosenIndex != -1) {
-        /* Copy the stuff over */
-        int i;
-        vars.resize(args.count());
-        for (i=0; i < args.count(); i++) {
-            vars[i] = args[i];
-            vvars[i] = vars[i].data();
-        }
-    }
-
-    return chosenIndex;
-}
-
-// Signals are not fuzzy matched as much as methods
-static int findSignalIndex(const QMetaObject* meta, int initialIndex, QByteArray signature)
-{
-    int index = initialIndex;
-    QMetaMethod method = meta->method(index);
-    bool overloads = !signature.contains('(');
-    if (overloads && (method.attributes() & QMetaMethod::Cloned)) {
-        // find the most general method
-        do {
-            method = meta->method(--index);
-        } while (method.attributes() & QMetaMethod::Cloned);
-    }
-    return index;
-}
-
-const ClassInfo QtRuntimeMetaMethod::s_info = { "QtRuntimeMethod", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(QtRuntimeMetaMethod) };
-
-QtRuntimeMetaMethod::QtRuntimeMetaMethod(ExecState* exec, Structure* structure, const UString& identifier)
-    : QtRuntimeMethod (new QtRuntimeMetaMethodData(), exec, structure, identifier)
-{
-}
-
-void QtRuntimeMetaMethod::finishCreation(ExecState* exec, const UString& identifier, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature, bool allowPrivate)
-{
-    Base::finishCreation(exec, identifier, instance);
-    QW_D(QtRuntimeMetaMethod);
-    d->m_signature = signature;
-    d->m_index = index;
-    d->m_allowPrivate = allowPrivate;
-}
-
-void QtRuntimeMetaMethod::visitChildren(JSCell* cell, SlotVisitor& visitor)
-{
-    QtRuntimeMetaMethod* thisObject = jsCast<QtRuntimeMetaMethod*>(cell);
-    QtRuntimeMethod::visitChildren(thisObject, visitor);
-    QtRuntimeMetaMethodData* d = thisObject->d_func();
-    if (d->m_connect)
-        visitor.append(&d->m_connect);
-    if (d->m_disconnect)
-        visitor.append(&d->m_disconnect);
-}
-
-EncodedJSValue QtRuntimeMetaMethod::call(ExecState* exec)
-{
-    QtRuntimeMetaMethodData* d = static_cast<QtRuntimeMetaMethod *>(exec->callee())->d_func();
-
-    // We're limited to 10 args
-    if (exec->argumentCount() > 10)
-        return JSValue::encode(jsUndefined());
-
-    // We have to pick a method that matches..
-    JSLockHolder lock(exec);
-
-    QObject *obj = d->m_instance->getObject();
-    if (obj) {
-        QVarLengthArray<QVariant, 10> vargs;
-        void *qargs[11];
-
-        int methodIndex;
-        JSObject* errorObj = 0;
-        if ((methodIndex = findMethodIndex(exec, obj->metaObject(), d->m_signature, d->m_allowPrivate, vargs, (void **)qargs, &errorObj)) != -1) {
-            if (QMetaObject::metacall(obj, QMetaObject::InvokeMetaMethod, methodIndex, qargs) >= 0)
-                return JSValue::encode(jsUndefined());
-
-            if (vargs[0].isValid())
-                return JSValue::encode(convertQVariantToValue(exec, d->m_instance->rootObject(), vargs[0]));
-        }
-
-        if (errorObj)
-            return JSValue::encode(errorObj);
-    } else {
-        return throwVMError(exec, createError(exec, "cannot call function of deleted QObject"));
-    }
-
-    // void functions return undefined
-    return JSValue::encode(jsUndefined());
-}
-
-CallType QtRuntimeMetaMethod::getCallData(JSCell*, CallData& callData)
-{
-    callData.native.function = call;
-    return CallTypeHost;
-}
-
-bool QtRuntimeMetaMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    QtRuntimeMetaMethod* thisObject = jsCast<QtRuntimeMetaMethod*>(cell);
-    if (propertyName == Identifier(exec, "connect")) {
-        slot.setCustom(thisObject, thisObject->connectGetter);
-        return true;
-    }
-    if (propertyName == Identifier(exec, "disconnect")) {
-        slot.setCustom(thisObject, thisObject->disconnectGetter);
-        return true;
-    }
-    if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(thisObject, thisObject->lengthGetter);
-        return true;
-    }
-
-    return QtRuntimeMethod::getOwnPropertySlot(thisObject, exec, propertyName, slot);
-}
-
-bool QtRuntimeMetaMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
-{
-    QtRuntimeMetaMethod* thisObject = jsCast<QtRuntimeMetaMethod*>(object);
-    if (propertyName == Identifier(exec, "connect")) {
-        PropertySlot slot;
-        slot.setCustom(thisObject, connectGetter);
-        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
-        return true;
-    }
-
-    if (propertyName == Identifier(exec, "disconnect")) {
-        PropertySlot slot;
-        slot.setCustom(thisObject, disconnectGetter);
-        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
-        return true;
-    }
-
-    if (propertyName == exec->propertyNames().length) {
-        PropertySlot slot;
-        slot.setCustom(thisObject, lengthGetter);
-        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
-        return true;
-    }
-
-    return QtRuntimeMethod::getOwnPropertyDescriptor(thisObject, exec, propertyName, descriptor);
-}
-
-void QtRuntimeMetaMethod::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
-{
-    if (mode == IncludeDontEnumProperties) {
-        propertyNames.add(Identifier(exec, "connect"));
-        propertyNames.add(Identifier(exec, "disconnect"));
-        propertyNames.add(exec->propertyNames().length);
-    }
-
-    QtRuntimeMethod::getOwnPropertyNames(object, exec, propertyNames, mode);
-}
-
-JSValue QtRuntimeMetaMethod::lengthGetter(ExecState*, JSValue, PropertyName)
-{
-    // QtScript always returns 0
-    return jsNumber(0);
-}
-
-JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, JSValue slotBase, PropertyName ident)
-{
-    QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slotBase));
-    QW_DS(QtRuntimeMetaMethod, thisObj);
-
-    if (!d->m_connect)
-        d->m_connect.set(exec->globalData(), thisObj, QtRuntimeConnectionMethod::create(exec, ident.publicName(), true, d->m_instance, d->m_index, d->m_signature));
-    return d->m_connect.get();
-}
-
-JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, JSValue slotBase, PropertyName ident)
-{
-    QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slotBase));
-    QW_DS(QtRuntimeMetaMethod, thisObj);
-
-    if (!d->m_disconnect)
-        d->m_disconnect.set(exec->globalData(), thisObj, QtRuntimeConnectionMethod::create(exec, ident.publicName(), false, d->m_instance, d->m_index, d->m_signature));
-    return d->m_disconnect.get();
-}
-
-// ===============
-
-QMultiMap<QObject*, QtConnectionObject*> QtRuntimeConnectionMethod::connections;
-
-const ClassInfo QtRuntimeConnectionMethod::s_info = { "QtRuntimeMethod", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(QtRuntimeConnectionMethod) };
-
-QtRuntimeConnectionMethod::QtRuntimeConnectionMethod(ExecState* exec, Structure* structure, const UString& identifier)
-    : QtRuntimeMethod (new QtRuntimeConnectionMethodData(), exec, structure, identifier)
-{
-}
-
-void QtRuntimeConnectionMethod::finishCreation(ExecState* exec, const UString& identifier, bool isConnect, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature)
-{
-    Base::finishCreation(exec, identifier, instance);
-    QW_D(QtRuntimeConnectionMethod);
-
-    d->m_signature = signature;
-    d->m_index = index;
-    d->m_isConnect = isConnect;
-}
-
-EncodedJSValue QtRuntimeConnectionMethod::call(ExecState* exec)
-{
-    QtRuntimeConnectionMethodData* d = static_cast<QtRuntimeConnectionMethod *>(exec->callee())->d_func();
-
-    JSLockHolder lock(exec);
-
-    QObject* sender = d->m_instance->getObject();
-
-    if (sender) {
-
-        JSObject* thisObject = exec->lexicalGlobalObject()->methodTable()->toThisObject(exec->lexicalGlobalObject(), exec);
-        JSObject* funcObject = 0;
-
-        // QtScript checks signalness first, arguments second
-        int signalIndex = -1;
-
-        // Make sure the initial index is a signal
-        QMetaMethod m = sender->metaObject()->method(d->m_index);
-        if (m.methodType() == QMetaMethod::Signal)
-            signalIndex = findSignalIndex(sender->metaObject(), d->m_index, d->m_signature);
-
-        if (signalIndex != -1) {
-            if (exec->argumentCount() == 1) {
-                funcObject = exec->argument(0).toObject(exec);
-                CallData callData;
-                if (funcObject->methodTable()->getCallData(funcObject, callData) == CallTypeNone) {
-                    if (d->m_isConnect)
-                        return throwVMError(exec, createTypeError(exec, "QtMetaMethod.connect: target is not a function"));
-                    else
-                        return throwVMError(exec, createTypeError(exec, "QtMetaMethod.disconnect: target is not a function"));
-                }
-            } else if (exec->argumentCount() >= 2) {
-                if (exec->argument(0).isObject()) {
-                    thisObject = exec->argument(0).toObject(exec);
-
-                    // Get the actual function to call
-                    JSObject *asObj = exec->argument(1).toObject(exec);
-                    CallData callData;
-                    if (asObj->methodTable()->getCallData(asObj, callData) != CallTypeNone) {
-                        // Function version
-                        funcObject = asObj;
-                    } else {
-                        // Convert it to a string
-                        UString funcName = exec->argument(1).toString(exec)->value(exec);
-                        Identifier funcIdent(exec, funcName);
-
-                        // ### DropAllLocks
-                        // This is resolved at this point in QtScript
-                        JSValue val = thisObject->get(exec, funcIdent);
-                        JSObject* asFuncObj = val.toObject(exec);
-
-                        if (asFuncObj->methodTable()->getCallData(asFuncObj, callData) != CallTypeNone) {
-                            funcObject = asFuncObj;
-                        } else {
-                            if (d->m_isConnect)
-                                return throwVMError(exec, createTypeError(exec, "QtMetaMethod.connect: target is not a function"));
-                            else
-                                return throwVMError(exec, createTypeError(exec, "QtMetaMethod.disconnect: target is not a function"));
-                        }
-                    }
-                } else {
-                    if (d->m_isConnect)
-                        return throwVMError(exec, createTypeError(exec, "QtMetaMethod.connect: thisObject is not an object"));
-                    else
-                        return throwVMError(exec, createTypeError(exec, "QtMetaMethod.disconnect: thisObject is not an object"));
-                }
-            } else {
-                if (d->m_isConnect)
-                    return throwVMError(exec, createError(exec, "QtMetaMethod.connect: no arguments given"));
-                else
-                    return throwVMError(exec, createError(exec, "QtMetaMethod.disconnect: no arguments given"));
-            }
-
-            if (d->m_isConnect) {
-                // to connect, we need:
-                //  target object [from ctor]
-                //  target signal index etc. [from ctor]
-                //  receiver function [from arguments]
-                //  receiver this object [from arguments]
-
-                QtConnectionObject* conn = QtConnectionObject::createWithInternalJSC(exec, d->m_instance, signalIndex, thisObject, funcObject);
-                bool ok = QMetaObject::connect(sender, signalIndex, conn, conn->metaObject()->methodOffset());
-                if (!ok) {
-                    delete conn;
-                    QString msg = QString(QLatin1String("QtMetaMethod.connect: failed to connect to %1::%2()"))
-                            .arg(QLatin1String(sender->metaObject()->className()))
-                            .arg(QLatin1String(d->m_signature));
-                    return throwVMError(exec, createError(exec, msg.toLatin1().constData()));
-                }
-                else {
-                    // Store connection
-                    connections.insert(sender, conn);
-                }
-            } else {
-                // Now to find our previous connection object. Hmm.
-                QList<QtConnectionObject*> conns = connections.values(sender);
-                bool ret = false;
-
-                JSContextRef context = ::toRef(exec);
-                JSObjectRef receiver = ::toRef(thisObject);
-                JSObjectRef receiverFunction = ::toRef(funcObject);
-
-                foreach(QtConnectionObject* conn, conns) {
-                    // Is this the right connection?
-                    if (conn->match(context, sender, signalIndex, receiver, receiverFunction)) {
-                        // Yep, disconnect it
-                        QMetaObject::disconnect(sender, signalIndex, conn, conn->metaObject()->methodOffset());
-                        delete conn; // this will also remove it from the map
-                        ret = true;
-                        break;
-                    }
-                }
-
-                if (!ret) {
-                    QString msg = QString(QLatin1String("QtMetaMethod.disconnect: failed to disconnect from %1::%2()"))
-                            .arg(QLatin1String(sender->metaObject()->className()))
-                            .arg(QLatin1String(d->m_signature));
-                    return throwVMError(exec, createError(exec, msg.toLatin1().constData()));
-                }
-            }
-        } else {
-            QString msg = QString(QLatin1String("QtMetaMethod.%1: %2::%3() is not a signal"))
-                    .arg(QLatin1String(d->m_isConnect ? "connect": "disconnect"))
-                    .arg(QLatin1String(sender->metaObject()->className()))
-                    .arg(QLatin1String(d->m_signature));
-            return throwVMError(exec, createTypeError(exec, msg.toLatin1().constData()));
-        }
-    } else {
-        return throwVMError(exec, createError(exec, "cannot call function of deleted QObject"));
-    }
-
-    return JSValue::encode(jsUndefined());
-}
-
-CallType QtRuntimeConnectionMethod::getCallData(JSCell*, CallData& callData)
-{
-    callData.native.function = call;
-    return CallTypeHost;
-}
-
-bool QtRuntimeConnectionMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    QtRuntimeConnectionMethod* thisObject = jsCast<QtRuntimeConnectionMethod*>(cell);
-    if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(thisObject, thisObject->lengthGetter);
-        return true;
-    }
-
-    return QtRuntimeMethod::getOwnPropertySlot(thisObject, exec, propertyName, slot);
-}
-
-bool QtRuntimeConnectionMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
-{
-    QtRuntimeConnectionMethod* thisObject = jsCast<QtRuntimeConnectionMethod*>(object);
-    if (propertyName == exec->propertyNames().length) {
-        PropertySlot slot;
-        slot.setCustom(thisObject, lengthGetter);
-        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
-        return true;
-    }
-
-    return QtRuntimeMethod::getOwnPropertyDescriptor(thisObject, exec, propertyName, descriptor);
-}
-
-void QtRuntimeConnectionMethod::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
-{
-    if (mode == IncludeDontEnumProperties)
-        propertyNames.add(exec->propertyNames().length);
-
-    QtRuntimeMethod::getOwnPropertyNames(object, exec, propertyNames, mode);
-}
-
-JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState*, JSValue, PropertyName)
-{
-    // we have one formal argument, and one optional
-    return jsNumber(1);
-}
-
-// ===============
-
-QtConnectionObject::QtConnectionObject(JSContextRef context, PassRefPtr<QtInstance> senderInstance, int signalIndex, JSObjectRef receiver, JSObjectRef receiverFunction)
-    : QObject(senderInstance->getObject())
-    , m_context(JSContextGetGlobalContext(context))
-    , m_senderInstance(senderInstance)
-    , m_originalSender(m_senderInstance->getObject())
-    , m_signalIndex(signalIndex)
-    , m_receiver(receiver)
-    , m_receiverFunction(receiverFunction)
-{
-    JSValueProtect(m_context, m_receiver);
-    JSValueProtect(m_context, m_receiverFunction);
-}
-
-QtConnectionObject::~QtConnectionObject()
-{
-    // We can safely use m_originalSender because connection object will never outlive the sender,
-    // which is its QObject parent.
-    QtRuntimeConnectionMethod::connections.remove(m_originalSender, this);
-
-    JSValueUnprotect(m_context, m_receiver);
-    JSValueUnprotect(m_context, m_receiverFunction);
-}
-
-static const uint qt_meta_data_QtConnectionObject[] = {
-
- // content:
-       1,       // revision
-       0,       // classname
-       0,    0, // classinfo
-       1,   10, // methods
-       0,    0, // properties
-       0,    0, // enums/sets
-
- // slots: signature, parameters, type, tag, flags
-      28,   27,   27,   27, 0x0a,
-
-       0        // eod
-};
-
-static const char qt_meta_stringdata_QtConnectionObject[] = {
-    "JSC::Bindings::QtConnectionObject\0\0execute()\0"
-};
-
-const QMetaObject QtConnectionObject::staticMetaObject = {
-    { &QObject::staticMetaObject, qt_meta_stringdata_QtConnectionObject,
-      qt_meta_data_QtConnectionObject, 0 }
-};
-
-const QMetaObject *QtConnectionObject::metaObject() const
-{
-    return &staticMetaObject;
-}
-
-void *QtConnectionObject::qt_metacast(const char *_clname)
-{
-    if (!_clname) return 0;
-    if (!strcmp(_clname, qt_meta_stringdata_QtConnectionObject))
-        return static_cast<void*>(const_cast<QtConnectionObject*>(this));
-    return QObject::qt_metacast(_clname);
-}
-
-// This is what moc would generate except by the fact that we pass all arguments to our execute() slot.
-int QtConnectionObject::qt_metacall(QMetaObject::Call _c, int _id, void **_a)
-{
-    _id = QObject::qt_metacall(_c, _id, _a);
-    if (_id < 0)
-        return _id;
-    if (_c == QMetaObject::InvokeMetaMethod) {
-        switch (_id) {
-        case 0: execute(_a); break;
-        }
-        _id -= 1;
-    }
-    return _id;
-}
-
-static bool isJavaScriptFunction(JSObjectRef object)
-{
-    CallData callData;
-    JSObject* jsObject = toJS(object);
-    return jsObject->methodTable()->getCallData(jsObject, callData) == CallTypeJS;
-}
-
-void QtConnectionObject::execute(void** argv)
-{
-    QObject* sender = m_senderInstance->getObject();
-    if (!sender) {
-        qWarning() << "sender deleted, cannot deliver signal";
-        return;
-    }
-
-    ASSERT(sender == m_originalSender);
-
-    const QMetaObject* meta = sender->metaObject();
-    const QMetaMethod method = meta->method(m_signalIndex);
-
-    QList<QByteArray> parameterTypes = method.parameterTypes();
-
-    JSValueRef* ignoredException = 0;
-    JSRetainPtr<JSStringRef> lengthProperty(JSStringCreateWithUTF8CString("length"));
-    int receiverLength = int(JSValueToNumber(m_context, JSObjectGetProperty(m_context, m_receiverFunction, lengthProperty.get(), ignoredException), ignoredException));
-    int argc = qMax(parameterTypes.count(), receiverLength);
-    WTF::Vector<JSValueRef> args(argc);
-
-    // TODO: remove once conversion functions use JSC API.
-    ExecState* exec = ::toJS(m_context);
-    RefPtr<RootObject> rootObject = m_senderInstance->rootObject();
-
-    for (int i = 0; i < argc; i++) {
-        int argType = QMetaType::type(parameterTypes.at(i));
-        args[i] = ::toRef(exec, convertQVariantToValue(exec, rootObject, QVariant(argType, argv[i+1])));
-    }
-
-    const bool updateQtSender = isJavaScriptFunction(m_receiverFunction);
-    if (updateQtSender)
-        QtInstance::qtSenderStack()->push(QObject::sender());
-
-    JSObjectCallAsFunction(m_context, m_receiverFunction, m_receiver, argc, args.data(), 0);
-
-    if (updateQtSender)
-        QtInstance::qtSenderStack()->pop();
-}
-
-bool QtConnectionObject::match(JSContextRef context, QObject* sender, int signalIndex, JSObjectRef receiver, JSObjectRef receiverFunction)
-{
-    if (sender != m_originalSender || signalIndex != m_signalIndex)
-        return false;
-    JSValueRef* ignoredException = 0;
-    const bool receiverMatch = (!receiver && !m_receiver) || JSValueIsEqual(context, receiver, m_receiver, ignoredException);
-    return receiverMatch && JSValueIsEqual(context, receiverFunction, m_receiverFunction, ignoredException);
-}
-
-QtConnectionObject* QtConnectionObject::createWithInternalJSC(ExecState* exec, PassRefPtr<QtInstance> senderInstance, int signalIndex, JSObject* receiver, JSObject* receiverFunction)
-{
-    return new QtConnectionObject(::toRef(exec), senderInstance, signalIndex, ::toRef(receiver), ::toRef(receiverFunction));
-}
-
-// ===============
-
-template <typename T> QtArray<T>::QtArray(QList<T> list, QMetaType::Type type, PassRefPtr<RootObject> rootObject)
-    : Array(rootObject)
-    , m_list(list)
-    , m_type(type)
-{
-    m_length = m_list.count();
-}
-
-template <typename T> QtArray<T>::~QtArray ()
-{
-}
-
-template <typename T> RootObject* QtArray<T>::rootObject() const
-{
-    return m_rootObject && m_rootObject->isValid() ? m_rootObject.get() : 0;
-}
-
-template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
-{
-    // QtScript sets the value, but doesn't forward it to the original source
-    // (e.g. if you do 'object.intList[5] = 6', the object is not updated, but the
-    // copy of the list is).
-    int dist = -1;
-    QVariant val = convertValueToQVariant(exec, aValue, m_type, &dist);
-
-    if (dist >= 0) {
-        m_list[index] = val.value<T>();
-    }
-}
-
-
-template <typename T> JSValue QtArray<T>::valueAt(ExecState *exec, unsigned int index) const
-{
-    if (index < m_length) {
-        T val = m_list.at(index);
-        return convertQVariantToValue(exec, rootObject(), QVariant::fromValue(val));
-    }
-
-    return jsUndefined();
-}
-
-// ===============
-
-} }
diff --git a/Source/WebCore/css/CSSAspectRatioValue.cpp b/Source/WebCore/css/CSSAspectRatioValue.cpp
index 18b0ded67..5897f5111 100644
--- a/Source/WebCore/css/CSSAspectRatioValue.cpp
+++ b/Source/WebCore/css/CSSAspectRatioValue.cpp
@@ -29,6 +29,7 @@
 #include "config.h"
 #include "CSSAspectRatioValue.h"
 
+#include "MemoryInstrumentation.h"
 #include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
@@ -42,4 +43,9 @@ String CSSAspectRatioValue::customCssText() const
     return result.toString();
 }
 
+void CSSAspectRatioValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+}
+
 }
diff --git a/Source/WebCore/css/CSSAspectRatioValue.h b/Source/WebCore/css/CSSAspectRatioValue.h
index 2f6b426d8..5cc339249 100644
--- a/Source/WebCore/css/CSSAspectRatioValue.h
+++ b/Source/WebCore/css/CSSAspectRatioValue.h
@@ -46,6 +46,8 @@ public:
     float numeratorValue() const { return m_numeratorValue; }
     float denominatorValue() const { return m_denominatorValue; }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSAspectRatioValue(float numeratorValue, float denominatorValue)
         : CSSValue(AspectRatioClass)
diff --git a/Source/WebCore/css/CSSBorderImageSliceValue.cpp b/Source/WebCore/css/CSSBorderImageSliceValue.cpp
index 04ef2d366..551df1f60 100644
--- a/Source/WebCore/css/CSSBorderImageSliceValue.cpp
+++ b/Source/WebCore/css/CSSBorderImageSliceValue.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "CSSBorderImageSliceValue.h"
 
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 #include "Rect.h"
 
@@ -49,4 +50,10 @@ String CSSBorderImageSliceValue::customCssText() const
     return text;
 }
 
+void CSSBorderImageSliceValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_slices);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSBorderImageSliceValue.h b/Source/WebCore/css/CSSBorderImageSliceValue.h
index d8230f474..488b4a41d 100644
--- a/Source/WebCore/css/CSSBorderImageSliceValue.h
+++ b/Source/WebCore/css/CSSBorderImageSliceValue.h
@@ -45,6 +45,8 @@ public:
 
     Quad* slices() { return m_slices ? m_slices->getQuadValue() : 0; }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
     // These four values are used to make "cuts" in the border image. They can be numbers
     // or percentages.
     RefPtr<CSSPrimitiveValue> m_slices;
diff --git a/Source/WebCore/css/CSSCalculationValue.cpp b/Source/WebCore/css/CSSCalculationValue.cpp
index 54247e035..5a10c5985 100755
--- a/Source/WebCore/css/CSSCalculationValue.cpp
+++ b/Source/WebCore/css/CSSCalculationValue.cpp
@@ -33,6 +33,7 @@
 
 #include "CSSValueList.h"
 #include "Length.h"
+#include "MemoryInstrumentation.h"
 #include "StyleResolver.h"
 
 #include <wtf/OwnPtr.h>
@@ -86,6 +87,11 @@ String CSSCalcValue::customCssText() const
         result.append(')');
     return result.toString(); 
 }
+
+void CSSCalcValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+}
     
 double CSSCalcValue::clampToPermittedRange(double value) const
 {
@@ -175,6 +181,12 @@ public:
         }
         return 0;        
     }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const OVERRIDE
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+        info.addInstrumentedMember(m_value);
+    }
     
 private:
     explicit CSSCalcPrimitiveValue(CSSPrimitiveValue* value, bool isInteger)
@@ -260,6 +272,13 @@ public:
         return evaluate(leftValue, rightValue);
     }
 
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const OVERRIDE
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+        info.addInstrumentedMember(m_leftSide);
+        info.addInstrumentedMember(m_rightSide);
+    }
+
     virtual String customCssText() const
     {
         StringBuilder result;
diff --git a/Source/WebCore/css/CSSCalculationValue.h b/Source/WebCore/css/CSSCalculationValue.h
index 57a249f89..b25f7b31a 100755
--- a/Source/WebCore/css/CSSCalculationValue.h
+++ b/Source/WebCore/css/CSSCalculationValue.h
@@ -64,6 +64,8 @@ public:
     virtual double doubleValue() const = 0;
     virtual double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier = 1.0, bool computingFontSize = false) const = 0;
     virtual String customCssText() const = 0;
+
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const = 0;
     
     CalculationCategory category() const { return m_category; }    
     bool isInteger() const { return m_isInteger; }
@@ -95,6 +97,8 @@ public:
     double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier = 1.0, bool computingFontSize = false) const;
         
     String customCssText() const;
+
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
     
 private:    
     CSSCalcValue(PassRefPtr<CSSCalcExpressionNode> expression, CalculationPermittedValueRange range)
diff --git a/Source/WebCore/css/CSSCanvasValue.cpp b/Source/WebCore/css/CSSCanvasValue.cpp
index 783ceef82..4925b3938 100644
--- a/Source/WebCore/css/CSSCanvasValue.cpp
+++ b/Source/WebCore/css/CSSCanvasValue.cpp
@@ -27,6 +27,7 @@
 #include "CSSCanvasValue.h"
 
 #include "ImageBuffer.h"
+#include "MemoryInstrumentation.h"
 #include "RenderObject.h"
 
 namespace WebCore {
@@ -92,4 +93,12 @@ PassRefPtr<Image> CSSCanvasValue::image(RenderObject* renderer, const IntSize& /
     return elt->copiedImage();
 }
 
+void CSSCanvasValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSImageGeneratorValue::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addMember(m_name);
+    info.addInstrumentedMember(m_element);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSCanvasValue.h b/Source/WebCore/css/CSSCanvasValue.h
index 159e61956..13fb58741 100644
--- a/Source/WebCore/css/CSSCanvasValue.h
+++ b/Source/WebCore/css/CSSCanvasValue.h
@@ -47,6 +47,8 @@ public:
     bool isPending() const { return false; }
     void loadSubimages(CachedResourceLoader*) { }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSCanvasValue(const String& name)
         : CSSImageGeneratorValue(CanvasClass)
diff --git a/Source/WebCore/css/CSSCharsetRule.cpp b/Source/WebCore/css/CSSCharsetRule.cpp
index b7a77ac52..b7d201c86 100644
--- a/Source/WebCore/css/CSSCharsetRule.cpp
+++ b/Source/WebCore/css/CSSCharsetRule.cpp
@@ -21,6 +21,8 @@
 #include "config.h"
 #include "CSSCharsetRule.h"
 
+#include "MemoryInstrumentation.h"
+
 namespace WebCore {
 
 CSSCharsetRule::CSSCharsetRule(CSSStyleSheet* parent, const String& encoding)
@@ -34,4 +36,11 @@ String CSSCharsetRule::cssText() const
     return "@charset \"" + m_encoding + "\";";
 }
 
+void CSSCharsetRule::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSRule::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addMember(m_encoding);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSCharsetRule.h b/Source/WebCore/css/CSSCharsetRule.h
index d08efa7df..0dad47c9e 100644
--- a/Source/WebCore/css/CSSCharsetRule.h
+++ b/Source/WebCore/css/CSSCharsetRule.h
@@ -39,6 +39,8 @@ public:
 
     String cssText() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSCharsetRule(CSSStyleSheet* parent, const String& encoding);
 
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index ae248ed09..7a050682d 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -46,6 +46,7 @@
 #include "FontFeatureSettings.h"
 #include "FontFeatureValue.h"
 #include "FontValue.h"
+#include "MemoryInstrumentation.h"
 #include "Pair.h"
 #include "Rect.h"
 #include "RenderBox.h"
@@ -67,6 +68,7 @@
 #include "CustomFilterNumberParameter.h"
 #include "CustomFilterOperation.h"
 #include "CustomFilterParameter.h"
+#include "WebKitCSSMixFunctionValue.h"
 #endif
 
 #if ENABLE(CSS_FILTERS)
@@ -74,7 +76,7 @@
 #include "WebKitCSSFilterValue.h"
 #endif
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 #include "DashboardRegion.h"
 #endif
 
@@ -174,6 +176,7 @@ static const CSSPropertyID computedProperties[] = {
     CSSPropertyTabSize,
     CSSPropertyTextAlign,
     CSSPropertyTextDecoration,
+    CSSPropertyWebkitTextDecorationLine,
     CSSPropertyTextIndent,
     CSSPropertyTextRendering,
     CSSPropertyTextShadow,
@@ -340,6 +343,9 @@ static const CSSPropertyID computedProperties[] = {
     CSSPropertyWebkitRegionBreakBefore,
     CSSPropertyWebkitRegionBreakInside,
 #endif
+#if ENABLE(WIDGET_REGION)
+    CSSPropertyWebkitWidgetRegion,
+#endif
 #if ENABLE(CSS_EXCLUSIONS)
     CSSPropertyWebkitWrapFlow,
     CSSPropertyWebkitWrapMargin,
@@ -874,10 +880,19 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::valueForFilter(RenderStyle* st
                 shadersList->append(program->vertexShader()->cssValue());
             else
                 shadersList->append(cssValuePool().createIdentifierValue(CSSValueNone));
-            if (program->fragmentShader())
+
+            const CustomFilterProgramMixSettings mixSettings = program->mixSettings();
+            if (mixSettings.enabled) {
+                RefPtr<WebKitCSSMixFunctionValue> mixFunction = WebKitCSSMixFunctionValue::create();
+                mixFunction->append(program->fragmentShader()->cssValue());
+                mixFunction->append(cssValuePool().createValue(mixSettings.blendMode));
+                mixFunction->append(cssValuePool().createValue(mixSettings.compositeOperator));
+                shadersList->append(mixFunction.release());
+            } else if (program->fragmentShader())
                 shadersList->append(program->fragmentShader()->cssValue());
             else
                 shadersList->append(cssValuePool().createIdentifierValue(CSSValueNone));
+
             filterValue->append(shadersList.release());
             
             RefPtr<CSSValueList> meshParameters = CSSValueList::createSpaceSeparated();
@@ -1176,6 +1191,7 @@ static PassRefPtr<CSSValue> renderUnicodeBidiFlagsToCSSValue(EUnicodeBidi unicod
 
 static PassRefPtr<CSSValue> renderTextDecorationFlagsToCSSValue(int textDecoration)
 {
+    // Blink value is ignored.
     RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
     if (textDecoration & UNDERLINE)
         list->append(cssValuePool().createIdentifierValue(CSSValueUnderline));
@@ -1183,8 +1199,6 @@ static PassRefPtr<CSSValue> renderTextDecorationFlagsToCSSValue(int textDecorati
         list->append(cssValuePool().createIdentifierValue(CSSValueOverline));
     if (textDecoration & LINE_THROUGH)
         list->append(cssValuePool().createIdentifierValue(CSSValueLineThrough));
-    if (textDecoration & BLINK)
-        list->append(cssValuePool().createIdentifierValue(CSSValueBlink));
 
     if (!list->length())
         return cssValuePool().createIdentifierValue(CSSValueNone);
@@ -1689,7 +1703,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(CSSPropert
         case CSSPropertyWebkitJustifyContent:
             return cssValuePool().createValue(style->justifyContent());
         case CSSPropertyWebkitOrder:
-            return cssValuePool().createValue(style->order());
+            return cssValuePool().createValue(style->order(), CSSPrimitiveValue::CSS_NUMBER);
 #endif
         case CSSPropertyFloat:
             return cssValuePool().createValue(style->floating());
@@ -1934,6 +1948,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(CSSPropert
         case CSSPropertyTextAlign:
             return cssValuePool().createValue(style->textAlign());
         case CSSPropertyTextDecoration:
+        case CSSPropertyWebkitTextDecorationLine:
             return renderTextDecorationFlagsToCSSValue(style->textDecoration());
         case CSSPropertyWebkitTextDecorationsInEffect:
             return renderTextDecorationFlagsToCSSValue(style->textDecorationsInEffect());
@@ -2072,8 +2087,13 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(CSSPropert
             if (style->boxSizing() == CONTENT_BOX)
                 return cssValuePool().createIdentifierValue(CSSValueContentBox);
             return cssValuePool().createIdentifierValue(CSSValueBorderBox);
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 #if ENABLE(DASHBOARD_SUPPORT)
         case CSSPropertyWebkitDashboardRegion:
+#endif
+#if ENABLE(WIDGET_REGION)
+        case CSSPropertyWebkitWidgetRegion:
+#endif
         {
             const Vector<StyleDashboardRegion>& regions = style->dashboardRegions();
             unsigned count = regions.size();
@@ -2676,6 +2696,12 @@ PassRefPtr<StylePropertySet> CSSComputedStyleDeclaration::copyPropertiesInSet(co
     return StylePropertySet::create(list.data(), list.size());
 }
 
+void CSSComputedStyleDeclaration::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_node);
+}
+
 CSSRule* CSSComputedStyleDeclaration::parentRule() const
 {
     return 0;
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.h b/Source/WebCore/css/CSSComputedStyleDeclaration.h
index a236a7d21..10d01590a 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.h
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.h
@@ -72,6 +72,8 @@ public:
 
     PassRefPtr<StylePropertySet> copyPropertiesInSet(const CSSPropertyID* set, unsigned length) const;
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 private:
     CSSComputedStyleDeclaration(PassRefPtr<Node>, bool allowVisitedStyle, const String&);
 
diff --git a/Source/WebCore/css/CSSCrossfadeValue.cpp b/Source/WebCore/css/CSSCrossfadeValue.cpp
index 4ff08afca..5ed7da18d 100644
--- a/Source/WebCore/css/CSSCrossfadeValue.cpp
+++ b/Source/WebCore/css/CSSCrossfadeValue.cpp
@@ -31,6 +31,7 @@
 #include "CachedResourceLoader.h"
 #include "CrossfadeGeneratedImage.h"
 #include "ImageBuffer.h"
+#include "MemoryInstrumentation.h"
 #include "RenderObject.h"
 #include "StyleCachedImage.h"
 #include "StyleGeneratedImage.h"
@@ -134,6 +135,19 @@ void CSSCrossfadeValue::loadSubimages(CachedResourceLoader* cachedResourceLoader
     m_crossfadeSubimageObserver.setReady(true);
 }
 
+void CSSCrossfadeValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSImageGeneratorValue::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_fromValue);
+    info.addInstrumentedMember(m_toValue);
+    info.addInstrumentedMember(m_percentageValue);
+    // FIXME: add instrumentation for
+    // m_cachedFromImage
+    // m_cachedToImage
+    // m_generatedImage
+}
+
 PassRefPtr<Image> CSSCrossfadeValue::image(RenderObject* renderer, const IntSize& size)
 {
     if (size.isEmpty())
@@ -172,4 +186,13 @@ void CSSCrossfadeValue::CrossfadeSubimageObserverProxy::imageChanged(CachedImage
         m_ownerValue->crossfadeChanged(*rect);
 }
 
+bool CSSCrossfadeValue::hasFailedOrCanceledSubresources() const
+{
+    if (m_cachedFromImage && m_cachedFromImage->loadFailedOrCanceled())
+        return true;
+    if (m_cachedToImage && m_cachedToImage->loadFailedOrCanceled())
+        return true;
+    return false;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSCrossfadeValue.h b/Source/WebCore/css/CSSCrossfadeValue.h
index fb4c2e0d7..cb07abc3b 100644
--- a/Source/WebCore/css/CSSCrossfadeValue.h
+++ b/Source/WebCore/css/CSSCrossfadeValue.h
@@ -27,6 +27,7 @@
 #define CSSCrossfadeValue_h
 
 #include "CachedImage.h"
+#include "CachedImageClient.h"
 #include "CachedResourceHandle.h"
 #include "CSSImageGeneratorValue.h"
 #include "CSSPrimitiveValue.h"
@@ -61,6 +62,10 @@ public:
 
     void setPercentage(PassRefPtr<CSSPrimitiveValue> percentageValue) { m_percentageValue = percentageValue; }
 
+    bool hasFailedOrCanceledSubresources() const;
+
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSCrossfadeValue(PassRefPtr<CSSValue> fromValue, PassRefPtr<CSSValue> toValue)
         : CSSImageGeneratorValue(CrossfadeClass)
diff --git a/Source/WebCore/css/CSSCursorImageValue.cpp b/Source/WebCore/css/CSSCursorImageValue.cpp
index f8506848f..35038fcd3 100644
--- a/Source/WebCore/css/CSSCursorImageValue.cpp
+++ b/Source/WebCore/css/CSSCursorImageValue.cpp
@@ -23,6 +23,7 @@
 #include "CSSCursorImageValue.h"
 
 #include "CachedResourceLoader.h"
+#include "MemoryInstrumentation.h"
 #include "TreeScope.h"
 #include "PlatformString.h"
 #include <wtf/MathExtras.h>
@@ -132,4 +133,13 @@ void CSSCursorImageValue::removeReferencedElement(SVGElement* element)
 }
 #endif
 
+void CSSCursorImageValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSImageValue::reportDescendantMemoryUsage(memoryObjectInfo);
+#if ENABLE(SVG)
+    info.addInstrumentedHashSet(m_referencedElements);
+#endif
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSCursorImageValue.h b/Source/WebCore/css/CSSCursorImageValue.h
index cb26919e4..dc8d1ff4c 100644
--- a/Source/WebCore/css/CSSCursorImageValue.h
+++ b/Source/WebCore/css/CSSCursorImageValue.h
@@ -48,6 +48,8 @@ public:
     void removeReferencedElement(SVGElement*);
 #endif
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSCursorImageValue(const String& url, const IntPoint& hotSpot);
 
diff --git a/Source/WebCore/css/CSSFontFaceRule.cpp b/Source/WebCore/css/CSSFontFaceRule.cpp
index bcc8639ed..e85a6e44c 100644
--- a/Source/WebCore/css/CSSFontFaceRule.cpp
+++ b/Source/WebCore/css/CSSFontFaceRule.cpp
@@ -22,6 +22,7 @@
 #include "config.h"
 #include "CSSFontFaceRule.h"
 
+#include "MemoryInstrumentation.h"
 #include "StylePropertySet.h"
 #include "StyleRule.h"
 
@@ -63,4 +64,12 @@ void CSSFontFaceRule::reattach(StyleRuleFontFace* rule)
         m_propertiesCSSOMWrapper->reattach(m_fontFaceRule->mutableProperties());
 }
 
+void CSSFontFaceRule::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSRule::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_fontFaceRule);
+    info.addInstrumentedMember(m_propertiesCSSOMWrapper);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSFontFaceRule.h b/Source/WebCore/css/CSSFontFaceRule.h
index 6414c872c..f67362bb4 100644
--- a/Source/WebCore/css/CSSFontFaceRule.h
+++ b/Source/WebCore/css/CSSFontFaceRule.h
@@ -45,6 +45,8 @@ public:
 
     void reattach(StyleRuleFontFace*);
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSFontFaceRule(StyleRuleFontFace*, CSSStyleSheet* parent);
 
diff --git a/Source/WebCore/css/CSSFontFaceSrcValue.cpp b/Source/WebCore/css/CSSFontFaceSrcValue.cpp
index 79ae0e741..a00115db1 100644
--- a/Source/WebCore/css/CSSFontFaceSrcValue.cpp
+++ b/Source/WebCore/css/CSSFontFaceSrcValue.cpp
@@ -29,7 +29,9 @@
 #include "CachedResourceLoader.h"
 #include "Document.h"
 #include "FontCustomPlatformData.h"
+#include "MemoryInstrumentation.h"
 #include "Node.h"
+#include "SVGFontFaceElement.h"
 #include "StyleSheetContents.h"
 
 namespace WebCore {
@@ -79,6 +81,13 @@ void CSSFontFaceSrcValue::addSubresourceStyleURLs(ListHashSet<KURL>& urls, const
         addSubresourceURL(urls, styleSheet->completeURL(m_resource));
 }
 
+bool CSSFontFaceSrcValue::hasFailedOrCanceledSubresources() const
+{
+    if (!m_cachedFont)
+        return false;
+    return m_cachedFont->loadFailedOrCanceled();
+}
+
 CachedFont* CSSFontFaceSrcValue::cachedFont(Document* document)
 {
     if (!m_cachedFont) {
@@ -88,5 +97,16 @@ CachedFont* CSSFontFaceSrcValue::cachedFont(Document* document)
     return m_cachedFont.get();
 }
 
+void CSSFontFaceSrcValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_resource);
+    info.addMember(m_format);
+    // FIXME: add m_cachedFont when MemoryCache is instrumented.
+#if ENABLE(SVG_FONTS)
+    info.addInstrumentedMember(m_svgFontFaceElement);
+#endif
+}
+
 }
 
diff --git a/Source/WebCore/css/CSSFontFaceSrcValue.h b/Source/WebCore/css/CSSFontFaceSrcValue.h
index 94607fed0..4444c8606 100644
--- a/Source/WebCore/css/CSSFontFaceSrcValue.h
+++ b/Source/WebCore/css/CSSFontFaceSrcValue.h
@@ -67,8 +67,12 @@ public:
 
     void addSubresourceStyleURLs(ListHashSet<KURL>&, const StyleSheetContents*) const;
 
+    bool hasFailedOrCanceledSubresources() const;
+
     CachedFont* cachedFont(Document*);
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSFontFaceSrcValue(const String& resource, bool local)
         : CSSValue(FontFaceSrcClass)
diff --git a/Source/WebCore/css/CSSFontSelector.cpp b/Source/WebCore/css/CSSFontSelector.cpp
index 0a9a3a078..cc5ffa06c 100644
--- a/Source/WebCore/css/CSSFontSelector.cpp
+++ b/Source/WebCore/css/CSSFontSelector.cpp
@@ -578,6 +578,9 @@ void CSSFontSelector::beginLoadTimerFired(Timer<WebCore::CSSFontSelector>*)
     Vector<CachedResourceHandle<CachedFont> > fontsToBeginLoading;
     fontsToBeginLoading.swap(m_fontsToBeginLoading);
 
+    // CSSFontSelector could get deleted via beginLoadIfNeeded() or loadDone() unless protected.
+    RefPtr<CSSFontSelector> protect(this);
+
     CachedResourceLoader* cachedResourceLoader = m_document->cachedResourceLoader();
     for (size_t i = 0; i < fontsToBeginLoading.size(); ++i) {
         fontsToBeginLoading[i]->beginLoadIfNeeded(cachedResourceLoader);
diff --git a/Source/WebCore/css/CSSFunctionValue.cpp b/Source/WebCore/css/CSSFunctionValue.cpp
index 522ad9fd1..628a989ba 100644
--- a/Source/WebCore/css/CSSFunctionValue.cpp
+++ b/Source/WebCore/css/CSSFunctionValue.cpp
@@ -28,6 +28,7 @@
 
 #include "CSSParserValues.h"
 #include "CSSValueList.h"
+#include "MemoryInstrumentation.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
@@ -49,4 +50,11 @@ String CSSFunctionValue::customCssText() const
     return result;
 }
 
+void CSSFunctionValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_name);
+    info.addInstrumentedMember(m_args);
+}
+
 }
diff --git a/Source/WebCore/css/CSSFunctionValue.h b/Source/WebCore/css/CSSFunctionValue.h
index a35a1b17b..6b7fbc65e 100644
--- a/Source/WebCore/css/CSSFunctionValue.h
+++ b/Source/WebCore/css/CSSFunctionValue.h
@@ -42,6 +42,8 @@ public:
 
     String customCssText() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     explicit CSSFunctionValue(CSSParserFunction*);
 
diff --git a/Source/WebCore/css/CSSGradientValue.cpp b/Source/WebCore/css/CSSGradientValue.cpp
index 3f1979fee..c7daacc87 100644
--- a/Source/WebCore/css/CSSGradientValue.cpp
+++ b/Source/WebCore/css/CSSGradientValue.cpp
@@ -33,6 +33,7 @@
 #include "Image.h"
 #include "IntSize.h"
 #include "IntSizeHash.h"
+#include "MemoryInstrumentation.h"
 #include "NodeRenderStyle.h"
 #include "PlatformString.h"
 #include "RenderObject.h"
@@ -42,6 +43,13 @@ using namespace std;
 
 namespace WebCore {
 
+void CSSGradientColorStop::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_position);
+    info.addInstrumentedMember(m_color);
+}
+
 PassRefPtr<Image> CSSGradientValue::image(RenderObject* renderer, const IntSize& size)
 {
     if (size.isEmpty())
@@ -452,6 +460,17 @@ bool CSSGradientValue::isCacheable() const
     return true;
 }
 
+void CSSGradientValue::reportBaseClassMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSImageGeneratorValue::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_firstX);
+    info.addInstrumentedMember(m_firstY);
+    info.addInstrumentedMember(m_secondX);
+    info.addInstrumentedMember(m_secondY);
+    info.addInstrumentedVector(m_stops);
+}
+
 String CSSLinearGradientValue::customCssText() const
 {
     String result;
@@ -594,6 +613,13 @@ PassRefPtr<Gradient> CSSLinearGradientValue::createGradient(RenderObject* render
     return gradient.release();
 }
 
+void CSSLinearGradientValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSGradientValue::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_angle);
+}
+
 String CSSRadialGradientValue::customCssText() const
 {
     String result;
@@ -891,4 +917,16 @@ PassRefPtr<Gradient> CSSRadialGradientValue::createGradient(RenderObject* render
     return gradient.release();
 }
 
+void CSSRadialGradientValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSGradientValue::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_firstRadius);
+    info.addInstrumentedMember(m_secondRadius);
+    info.addInstrumentedMember(m_shape);
+    info.addInstrumentedMember(m_sizingBehavior);
+    info.addInstrumentedMember(m_endHorizontalSize);
+    info.addInstrumentedMember(m_endVerticalSize);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSGradientValue.h b/Source/WebCore/css/CSSGradientValue.h
index 0c7ef7764..882cc628f 100644
--- a/Source/WebCore/css/CSSGradientValue.h
+++ b/Source/WebCore/css/CSSGradientValue.h
@@ -45,6 +45,7 @@ struct CSSGradientColorStop {
     RefPtr<CSSPrimitiveValue> m_color;
     Color m_resolvedColor;
     bool m_colorIsDerivedFromElement;
+    void reportMemoryUsage(MemoryObjectInfo*) const;
 };
 
 class CSSGradientValue : public CSSImageGeneratorValue {
@@ -105,6 +106,8 @@ protected:
 
     bool isCacheable() const;
 
+    void reportBaseClassMemoryUsage(MemoryObjectInfo*) const;
+
     // Points. Some of these may be null for linear gradients.
     RefPtr<CSSPrimitiveValue> m_firstX;
     RefPtr<CSSPrimitiveValue> m_firstY;
@@ -139,6 +142,8 @@ public:
         return adoptRef(new CSSLinearGradientValue(*this));
     }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSLinearGradientValue(CSSGradientRepeat repeat, bool deprecatedType = false)
         : CSSGradientValue(LinearGradientClass, repeat, deprecatedType)
@@ -180,6 +185,8 @@ public:
     // Create the gradient for a given size.
     PassRefPtr<Gradient> createGradient(RenderObject*, const IntSize&);
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSRadialGradientValue(CSSGradientRepeat repeat, bool deprecatedType = false)
         : CSSGradientValue(RadialGradientClass, repeat, deprecatedType)
diff --git a/Source/WebCore/css/CSSGrammar.y b/Source/WebCore/css/CSSGrammar.y
index c7c10b541..29fab4ffe 100644
--- a/Source/WebCore/css/CSSGrammar.y
+++ b/Source/WebCore/css/CSSGrammar.y
@@ -53,14 +53,13 @@ using namespace HTMLNames;
 #define YYMAXDEPTH 10000
 #define YYDEBUG 0
 
-// FIXME: Replace with %parse-param { CSSParser* parser } once we can depend on bison 2.x
-#define YYPARSE_PARAM parser
-#define YYLEX_PARAM parser
-
 %}
 
 %pure_parser
 
+%parse-param { CSSParser* parser }
+%lex-param { CSSParser* parser }
+
 %union {
     bool boolean;
     char character;
@@ -71,7 +70,7 @@ using namespace HTMLNames;
     StyleRuleBase* rule;
     Vector<RefPtr<StyleRuleBase> >* ruleList;
     CSSParserSelector* selector;
-    Vector<OwnPtr<CSSParserSelector> >* selectorList;
+    CSSSelectorVector* selectorList;
     CSSSelector::MarginBoxType marginBox;
     CSSSelector::Relation relation;
     MediaQuerySet* mediaList;
@@ -89,14 +88,14 @@ using namespace HTMLNames;
 
 %{
 
-static inline int cssyyerror(const char*)
+static inline int cssyyerror(void*, const char*)
 {
     return 1;
 }
 
-static int cssyylex(YYSTYPE* yylval, void* parser)
+static int cssyylex(YYSTYPE* yylval, CSSParser* parser)
 {
-    return static_cast<CSSParser*>(parser)->lex(yylval);
+    return parser->lex(yylval);
 }
 
 %}
@@ -314,13 +313,13 @@ stylesheet:
 
 webkit_rule:
     WEBKIT_RULE_SYM '{' maybe_space valid_rule maybe_space '}' {
-        static_cast<CSSParser*>(parser)->m_rule = $4;
+        parser->m_rule = $4;
     }
 ;
 
 webkit_keyframe_rule:
     WEBKIT_KEYFRAME_RULE_SYM '{' maybe_space keyframe_rule maybe_space '}' {
-        static_cast<CSSParser*>(parser)->m_keyframe = $4;
+        parser->m_keyframe = $4;
     }
 ;
 
@@ -332,30 +331,27 @@ webkit_decls:
 
 webkit_value:
     WEBKIT_VALUE_SYM '{' maybe_space expr '}' {
-        CSSParser* p = static_cast<CSSParser*>(parser);
         if ($4) {
-            p->m_valueList = p->sinkFloatingValueList($4);
-            int oldParsedProperties = p->m_parsedProperties.size();
-            if (!p->parseValue(p->m_id, p->m_important))
-                p->rollbackLastProperties(p->m_parsedProperties.size() - oldParsedProperties);
-            p->m_valueList = nullptr;
+            parser->m_valueList = parser->sinkFloatingValueList($4);
+            int oldParsedProperties = parser->m_parsedProperties->size();
+            if (!parser->parseValue(parser->m_id, parser->m_important))
+                parser->rollbackLastProperties(parser->m_parsedProperties->size() - oldParsedProperties);
+            parser->m_valueList = nullptr;
         }
     }
 ;
 
 webkit_mediaquery:
      WEBKIT_MEDIAQUERY_SYM WHITESPACE maybe_space media_query '}' {
-         CSSParser* p = static_cast<CSSParser*>(parser);
-         p->m_mediaQuery = p->sinkFloatingMediaQuery($4);
+         parser->m_mediaQuery = parser->sinkFloatingMediaQuery($4);
      }
 ;
 
 webkit_selector:
     WEBKIT_SELECTOR_SYM '{' maybe_space selector_list '}' {
         if ($4) {
-            CSSParser* p = static_cast<CSSParser*>(parser);
-            if (p->m_selectorListForParseSelector)
-                p->m_selectorListForParseSelector->adoptSelectorVector(*$4);
+            if (parser->m_selectorListForParseSelector)
+                parser->m_selectorListForParseSelector->adoptSelectorVector(*$4);
         }
     }
 ;
@@ -384,11 +380,10 @@ closing_brace:
 
 charset:
   CHARSET_SYM maybe_space STRING maybe_space ';' {
-     CSSParser* p = static_cast<CSSParser*>(parser);
-     if (p->m_styleSheet)
-         p->m_styleSheet->parserSetEncodingFromCharsetRule($3);
-     if (p->isExtractingSourceData() && p->m_currentRuleDataStack->isEmpty() && p->m_ruleSourceDataResult)
-         p->addNewRuleToSourceTree(CSSRuleSourceData::createUnknown());
+     if (parser->m_styleSheet)
+         parser->m_styleSheet->parserSetEncodingFromCharsetRule($3);
+     if (parser->isExtractingSourceData() && parser->m_currentRuleDataStack->isEmpty() && parser->m_ruleSourceDataResult)
+         parser->addNewRuleToSourceTree(CSSRuleSourceData::createUnknown());
      $$ = 0;
   }
   | CHARSET_SYM error invalid_block {
@@ -410,9 +405,8 @@ ignored_charset:
 rule_list:
    /* empty */
  | rule_list rule maybe_sgml {
-     CSSParser* p = static_cast<CSSParser*>(parser);
-     if ($2 && p->m_styleSheet)
-         p->m_styleSheet->parserAppendRule($2);
+     if ($2 && parser->m_styleSheet)
+         parser->m_styleSheet->parserAppendRule($2);
  }
  ;
 
@@ -429,7 +423,7 @@ valid_rule:
 
 rule:
     valid_rule {
-        static_cast<CSSParser*>(parser)->m_hadSyntacticallyValidCSSRule = true;
+        parser->m_hadSyntacticallyValidCSSRule = true;
     }
   | ignored_charset
   | invalid_rule
@@ -442,7 +436,7 @@ block_rule_list:
       $$ = $1;
       if ($2) {
           if (!$$)
-              $$ = static_cast<CSSParser*>(parser)->createRuleList();
+              $$ = parser->createRuleList();
           $$->append($2);
       }
   }
@@ -466,42 +460,41 @@ block_rule:
 
 at_import_header_end_maybe_space:
     maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markRuleHeaderEnd();
-        p->markRuleBodyStart();
+        parser->markRuleHeaderEnd();
+        parser->markRuleBodyStart();
     }
     ;
 
 before_import_rule:
     /* empty */ {
-        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::IMPORT_RULE);
+        parser->markRuleHeaderStart(CSSRuleSourceData::IMPORT_RULE);
     }
     ;
 
 import:
     before_import_rule IMPORT_SYM at_import_header_end_maybe_space string_or_uri maybe_space maybe_media_list ';' {
-        $$ = static_cast<CSSParser*>(parser)->createImportRule($4, $6);
+        $$ = parser->createImportRule($4, $6);
     }
   | before_import_rule IMPORT_SYM at_import_header_end_maybe_space string_or_uri maybe_space maybe_media_list TOKEN_EOF {
-        $$ = static_cast<CSSParser*>(parser)->createImportRule($4, $6);
+        $$ = parser->createImportRule($4, $6);
     }
   | before_import_rule IMPORT_SYM at_import_header_end_maybe_space string_or_uri maybe_space maybe_media_list invalid_block {
         $$ = 0;
-        static_cast<CSSParser*>(parser)->popRuleData();
+        parser->popRuleData();
     }
   | before_import_rule IMPORT_SYM error ';' {
         $$ = 0;
-        static_cast<CSSParser*>(parser)->popRuleData();
+        parser->popRuleData();
     }
   | before_import_rule IMPORT_SYM error invalid_block {
         $$ = 0;
-        static_cast<CSSParser*>(parser)->popRuleData();
+        parser->popRuleData();
     }
   ;
 
 namespace:
 NAMESPACE_SYM maybe_space maybe_ns_prefix string_or_uri maybe_space ';' {
-    static_cast<CSSParser*>(parser)->addNamespace($3, $4);
+    parser->addNamespace($3, $4);
     $$ = 0;
 }
 | NAMESPACE_SYM maybe_space maybe_ns_prefix string_or_uri maybe_space invalid_block {
@@ -543,25 +536,24 @@ maybe_media_value:
 media_query_exp:
     '(' maybe_space media_feature maybe_space maybe_media_value ')' maybe_space {
         $3.lower();
-        $$ = static_cast<CSSParser*>(parser)->createFloatingMediaQueryExp($3, $5);
+        $$ = parser->createFloatingMediaQueryExp($3, $5);
     }
     ;
 
 media_query_exp_list:
     media_query_exp {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingMediaQueryExpList();
-        $$->append(p->sinkFloatingMediaQueryExp($1));
+        $$ = parser->createFloatingMediaQueryExpList();
+        $$->append(parser->sinkFloatingMediaQueryExp($1));
     }
     | media_query_exp_list maybe_space MEDIA_AND maybe_space media_query_exp {
         $$ = $1;
-        $$->append(static_cast<CSSParser*>(parser)->sinkFloatingMediaQueryExp($5));
+        $$->append(parser->sinkFloatingMediaQueryExp($5));
     }
     ;
 
 maybe_and_media_query_exp_list:
     /*empty*/ {
-        $$ = static_cast<CSSParser*>(parser)->createFloatingMediaQueryExpList();
+        $$ = parser->createFloatingMediaQueryExpList();
     }
     | MEDIA_AND maybe_space media_query_exp_list {
         $$ = $3;
@@ -582,37 +574,33 @@ maybe_media_restrictor:
 
 media_query:
     media_query_exp_list {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingMediaQuery(p->sinkFloatingMediaQueryExpList($1));
+        $$ = parser->createFloatingMediaQuery(parser->sinkFloatingMediaQueryExpList($1));
     }
     |
     maybe_media_restrictor maybe_space medium maybe_and_media_query_exp_list {
-        CSSParser* p = static_cast<CSSParser*>(parser);
         $3.lower();
-        $$ = p->createFloatingMediaQuery($1, $3, p->sinkFloatingMediaQueryExpList($4));
+        $$ = parser->createFloatingMediaQuery($1, $3, parser->sinkFloatingMediaQueryExpList($4));
     }
     ;
 
 maybe_media_list:
      /* empty */ {
-        $$ = static_cast<CSSParser*>(parser)->createMediaQuerySet();
+        $$ = parser->createMediaQuerySet();
      }
      | media_list
      ;
 
 media_list:
     media_query {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createMediaQuerySet();
-        $$->addMediaQuery(p->sinkFloatingMediaQuery($1));
-        p->updateLastMediaLine($$);
+        $$ = parser->createMediaQuerySet();
+        $$->addMediaQuery(parser->sinkFloatingMediaQuery($1));
+        parser->updateLastMediaLine($$);
     }
     | media_list ',' maybe_space media_query {
         $$ = $1;
         if ($$) {
-            CSSParser* p = static_cast<CSSParser*>(parser);
-            $$->addMediaQuery(p->sinkFloatingMediaQuery($4));
-            p->updateLastMediaLine($$);
+            $$->addMediaQuery(parser->sinkFloatingMediaQuery($4));
+            parser->updateLastMediaLine($$);
         }
     }
     | media_list error {
@@ -622,32 +610,32 @@ media_list:
 
 at_rule_body_start:
     /* empty */ {
-        static_cast<CSSParser*>(parser)->markRuleBodyStart();
+        parser->markRuleBodyStart();
     }
     ;
 
 before_media_rule:
     /* empty */ {
-        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::MEDIA_RULE);
+        parser->markRuleHeaderStart(CSSRuleSourceData::MEDIA_RULE);
     }
     ;
 
 at_rule_header_end_maybe_space:
     maybe_space {
-        static_cast<CSSParser*>(parser)->markRuleHeaderEnd();
+        parser->markRuleHeaderEnd();
     }
     ;
 
 media:
     before_media_rule MEDIA_SYM maybe_space media_list at_rule_header_end '{' at_rule_body_start maybe_space block_rule_list save_block {
-        $$ = static_cast<CSSParser*>(parser)->createMediaRule($4, $9);
+        $$ = parser->createMediaRule($4, $9);
     }
     | before_media_rule MEDIA_SYM at_rule_header_end_maybe_space '{' at_rule_body_start maybe_space block_rule_list save_block {
-        $$ = static_cast<CSSParser*>(parser)->createMediaRule(0, $7);
+        $$ = parser->createMediaRule(0, $7);
     }
     | before_media_rule MEDIA_SYM at_rule_header_end_maybe_space ';' {
         $$ = 0;
-        static_cast<CSSParser*>(parser)->popRuleData();
+        parser->popRuleData();
     }
     ;
 
@@ -659,13 +647,13 @@ medium:
 
 before_keyframes_rule:
     /* empty */ {
-        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::KEYFRAMES_RULE);
+        parser->markRuleHeaderStart(CSSRuleSourceData::KEYFRAMES_RULE);
     }
     ;
 
 keyframes:
     before_keyframes_rule WEBKIT_KEYFRAMES_SYM maybe_space keyframe_name at_rule_header_end_maybe_space '{' at_rule_body_start maybe_space keyframes_rule closing_brace {
-        $$ = static_cast<CSSParser*>(parser)->createKeyframesRule($4, static_cast<CSSParser*>(parser)->sinkFloatingKeyframeVector($9));
+        $$ = parser->createKeyframesRule($4, parser->sinkFloatingKeyframeVector($9));
     }
     ;
   
@@ -675,7 +663,7 @@ keyframe_name:
     ;
 
 keyframes_rule:
-    /* empty */ { $$ = static_cast<CSSParser*>(parser)->createFloatingKeyframeVector(); }
+    /* empty */ { $$ = parser->createFloatingKeyframeVector(); }
     | keyframes_rule keyframe_rule maybe_space {
         $$ = $1;
         if ($2)
@@ -685,21 +673,19 @@ keyframes_rule:
 
 keyframe_rule:
     key_list maybe_space '{' maybe_space declaration_list '}' {
-        $$ = static_cast<CSSParser*>(parser)->createKeyframe($1);
+        $$ = parser->createKeyframe($1);
     }
     ;
 
 key_list:
     key {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingValueList();
-        $$->addValue(p->sinkFloatingValue($1));
+        $$ = parser->createFloatingValueList();
+        $$->addValue(parser->sinkFloatingValue($1));
     }
     | key_list maybe_space ',' maybe_space key {
-        CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = $1;
         if ($$)
-            $$->addValue(p->sinkFloatingValue($5));
+            $$->addValue(parser->sinkFloatingValue($5));
     }
     ;
 
@@ -719,46 +705,43 @@ key:
 
 before_page_rule:
     /* empty */ {
-        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::PAGE_RULE);
+        parser->markRuleHeaderStart(CSSRuleSourceData::PAGE_RULE);
     }
     ;
 
 page:
     before_page_rule PAGE_SYM maybe_space page_selector at_rule_header_end_maybe_space
     '{' at_rule_body_start maybe_space_before_declaration declarations_and_margins closing_brace {
-        CSSParser* p = static_cast<CSSParser*>(parser);
         if ($4)
-            $$ = p->createPageRule(p->sinkFloatingSelector($4));
+            $$ = parser->createPageRule(parser->sinkFloatingSelector($4));
         else {
             // Clear properties in the invalid @page rule.
-            p->clearProperties();
+            parser->clearProperties();
             // Also clear margin at-rules here once we fully implement margin at-rules parsing.
             $$ = 0;
-            static_cast<CSSParser*>(parser)->popRuleData();
+            parser->popRuleData();
         }
     }
     | before_page_rule PAGE_SYM error invalid_block {
-      static_cast<CSSParser*>(parser)->popRuleData();
+      parser->popRuleData();
       $$ = 0;
     }
     | before_page_rule PAGE_SYM error ';' {
-      static_cast<CSSParser*>(parser)->popRuleData();
+      parser->popRuleData();
       $$ = 0;
     }
     ;
 
 page_selector:
     IDENT {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingSelector();
-        $$->setTag(QualifiedName(nullAtom, $1, p->m_defaultNamespace));
+        $$ = parser->createFloatingSelector();
+        $$->setTag(QualifiedName(nullAtom, $1, parser->m_defaultNamespace));
         $$->setForPage();
     }
     | IDENT pseudo_page {
-        CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = $2;
         if ($$) {
-            $$->setTag(QualifiedName(nullAtom, $1, p->m_defaultNamespace));
+            $$->setTag(QualifiedName(nullAtom, $1, parser->m_defaultNamespace));
             $$->setForPage();
         }
     }
@@ -768,8 +751,7 @@ page_selector:
             $$->setForPage();
     }
     | /* empty */ {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingSelector();
+        $$ = parser->createFloatingSelector();
         $$->setForPage();
     }
     ;
@@ -781,9 +763,9 @@ declarations_and_margins:
 
 margin_box:
     margin_sym {
-        static_cast<CSSParser*>(parser)->startDeclarationsForMarginBox();
+        parser->startDeclarationsForMarginBox();
     } maybe_space '{' maybe_space declaration_list closing_brace {
-        $$ = static_cast<CSSParser*>(parser)->createMarginAtRule($1);
+        $$ = parser->createMarginAtRule($1);
     }
     ;
 
@@ -840,42 +822,50 @@ margin_sym :
 
 before_font_face_rule:
     /* empty */ {
-        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::FONT_FACE_RULE);
+        parser->markRuleHeaderStart(CSSRuleSourceData::FONT_FACE_RULE);
     }
     ;
 
 font_face:
     before_font_face_rule FONT_FACE_SYM at_rule_header_end_maybe_space
     '{' at_rule_body_start maybe_space_before_declaration declaration_list closing_brace {
-        $$ = static_cast<CSSParser*>(parser)->createFontFaceRule();
+        $$ = parser->createFontFaceRule();
     }
     | before_font_face_rule FONT_FACE_SYM error invalid_block {
       $$ = 0;
-      static_cast<CSSParser*>(parser)->popRuleData();
+      parser->popRuleData();
     }
     | before_font_face_rule FONT_FACE_SYM error ';' {
       $$ = 0;
-      static_cast<CSSParser*>(parser)->popRuleData();
+      parser->popRuleData();
     }
 ;
 
 region_selector:
     selector_list {
         if ($1) {
-            static_cast<CSSParser*>(parser)->setReusableRegionSelectorVector($1);
-            $$ = static_cast<CSSParser*>(parser)->reusableRegionSelectorVector();
+            parser->setReusableRegionSelectorVector($1);
+            $$ = parser->reusableRegionSelectorVector();
         }
         else
             $$ = 0;
     }
 ;
 
+before_region_rule:
+    /* empty */ {
+        parser->markRuleHeaderStart(CSSRuleSourceData::REGION_RULE);
+    }
+    ;
+
 region:
-    WEBKIT_REGION_RULE_SYM WHITESPACE region_selector '{' maybe_space block_rule_list save_block {
-        if ($3)
-            $$ = static_cast<CSSParser*>(parser)->createRegionRule($3, $6);
-        else
+    before_region_rule WEBKIT_REGION_RULE_SYM WHITESPACE region_selector at_rule_header_end '{' at_rule_body_start maybe_space block_rule_list save_block {
+        if ($4)
+            $$ = parser->createRegionRule($4, $9);
+        else {
             $$ = 0;
+            parser->popRuleData();
+        }
     }
 ;
 
@@ -897,45 +887,42 @@ unary_operator:
 
 maybe_space_before_declaration:
     maybe_space {
-        static_cast<CSSParser*>(parser)->markPropertyStart();
+        parser->markPropertyStart();
     }
   ;
 
 before_selector_list:
     /* empty */ {
-        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::STYLE_RULE);
+        parser->markRuleHeaderStart(CSSRuleSourceData::STYLE_RULE);
     }
   ;
 
 at_rule_header_end:
     /* empty */ {
-        static_cast<CSSParser*>(parser)->markRuleHeaderEnd();
+        parser->markRuleHeaderEnd();
     }
   ;
 
 ruleset:
-    before_selector_list selector_list at_rule_header_end '{' maybe_space_before_declaration declaration_list closing_brace {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createStyleRule($2);
+    before_selector_list selector_list at_rule_header_end '{' at_rule_body_start maybe_space_before_declaration declaration_list closing_brace {
+        $$ = parser->createStyleRule($2);
     }
   ;
 
 selector_list:
     selector %prec UNIMPORTANT_TOK {
         if ($1) {
-            CSSParser* p = static_cast<CSSParser*>(parser);
-            $$ = p->reusableSelectorVector();
+            $$ = parser->selectorVector();
             $$->shrink(0);
-            $$->append(p->sinkFloatingSelector($1));
-            p->updateLastSelectorLineAndPosition();
+            $$->append(parser->sinkFloatingSelector($1));
+            parser->updateLastSelectorLineAndPosition();
         }
     }
     | selector_list ',' maybe_space selector %prec UNIMPORTANT_TOK {
         if ($1 && $4) {
-            CSSParser* p = static_cast<CSSParser*>(parser);
             $$ = $1;
-            $$->append(p->sinkFloatingSelector($4));
-            p->updateLastSelectorLineAndPosition();
+            $$->append(parser->sinkFloatingSelector($4));
+            parser->updateLastSelectorLineAndPosition();
         } else
             $$ = 0;
     }
@@ -964,12 +951,11 @@ selector:
         if (!$1)
             $$ = 0;
         else if ($$) {
-            CSSParser* p = static_cast<CSSParser*>(parser);
             CSSParserSelector* end = $$;
             while (end->tagHistory())
                 end = end->tagHistory();
             end->setRelation(CSSSelector::Descendant);
-            end->setTagHistory(p->sinkFloatingSelector($1));
+            end->setTagHistory(parser->sinkFloatingSelector($1));
         }
     }
     | selector combinator simple_selector {
@@ -977,12 +963,11 @@ selector:
         if (!$1)
             $$ = 0;
         else if ($$) {
-            CSSParser* p = static_cast<CSSParser*>(parser);
             CSSParserSelector* end = $$;
             while (end->tagHistory())
                 end = end->tagHistory();
             end->setRelation($2);
-            end->setTagHistory(p->sinkFloatingSelector($1));
+            end->setTagHistory(parser->sinkFloatingSelector($1));
         }
     }
     | selector error {
@@ -998,51 +983,47 @@ namespace_selector:
     
 simple_selector:
     element_name {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingSelector();
-        $$->setTag(QualifiedName(nullAtom, $1, p->m_defaultNamespace));
+        $$ = parser->createFloatingSelector();
+        $$->setTag(QualifiedName(nullAtom, $1, parser->m_defaultNamespace));
     }
     | element_name specifier_list {
         $$ = $2;
         if ($$)
-            static_cast<CSSParser*>(parser)->updateSpecifiersWithElementName(nullAtom, $1, $$);
+            parser->updateSpecifiersWithElementName(nullAtom, $1, $$);
     }
     | specifier_list {
         $$ = $1;
         if ($$)
-            static_cast<CSSParser*>(parser)->updateSpecifiersWithElementName(nullAtom, starAtom, $$);
+            parser->updateSpecifiersWithElementName(nullAtom, starAtom, $$);
     }
     | namespace_selector element_name {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingSelector();
-        $$->setTag(p->determineNameInNamespace($1, $2));
+        $$ = parser->createFloatingSelector();
+        $$->setTag(parser->determineNameInNamespace($1, $2));
     }
     | namespace_selector element_name specifier_list {
         $$ = $3;
         if ($$)
-            static_cast<CSSParser*>(parser)->updateSpecifiersWithElementName($1, $2, $$);
+            parser->updateSpecifiersWithElementName($1, $2, $$);
     }
     | namespace_selector specifier_list {
         $$ = $2;
         if ($$)
-            static_cast<CSSParser*>(parser)->updateSpecifiersWithElementName($1, starAtom, $$);
+            parser->updateSpecifiersWithElementName($1, starAtom, $$);
     }
   ;
 
 simple_selector_list:
     simple_selector %prec UNIMPORTANT_TOK {
         if ($1) {
-            CSSParser* p = static_cast<CSSParser*>(parser);
-            $$ = p->createFloatingSelectorVector();
-            $$->append(p->sinkFloatingSelector($1));
+            $$ = parser->createFloatingSelectorVector();
+            $$->append(parser->sinkFloatingSelector($1));
         } else
             $$ = 0;
     }
     | simple_selector_list maybe_space ',' maybe_space simple_selector %prec UNIMPORTANT_TOK {
         if ($1 && $5) {
-            CSSParser* p = static_cast<CSSParser*>(parser);
             $$ = $1;
-            $$->append(p->sinkFloatingSelector($5));
+            $$->append(parser->sinkFloatingSelector($5));
         } else
             $$ = 0;
     }
@@ -1054,8 +1035,7 @@ simple_selector_list:
 element_name:
     IDENT {
         CSSParserString& str = $1;
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        if (p->m_context.isHTMLDocument)
+        if (parser->m_context.isHTMLDocument)
             str.lower();
         $$ = str;
     }
@@ -1074,7 +1054,7 @@ specifier_list:
         if (!$2)
             $$ = 0;
         else if ($1)
-            $$ = static_cast<CSSParser*>(parser)->updateSpecifiers($1, $2);
+            $$ = parser->updateSpecifiers($1, $2);
     }
     | specifier_list error {
         $$ = 0;
@@ -1083,10 +1063,9 @@ specifier_list:
 
 specifier:
     IDSEL {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingSelector();
+        $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::Id);
-        if (p->m_context.mode == CSSQuirksMode)
+        if (parser->m_context.mode == CSSQuirksMode)
             $1.lower();
         $$->setValue($1);
     }
@@ -1094,10 +1073,9 @@ specifier:
         if ($1.characters[0] >= '0' && $1.characters[0] <= '9') {
             $$ = 0;
         } else {
-            CSSParser* p = static_cast<CSSParser*>(parser);
-            $$ = p->createFloatingSelector();
+            $$ = parser->createFloatingSelector();
             $$->setMatch(CSSSelector::Id);
-            if (p->m_context.mode == CSSQuirksMode)
+            if (parser->m_context.mode == CSSQuirksMode)
                 $1.lower();
             $$->setValue($1);
         }
@@ -1109,10 +1087,9 @@ specifier:
 
 class:
     '.' IDENT {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingSelector();
+        $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::Class);
-        if (p->m_context.mode == CSSQuirksMode)
+        if (parser->m_context.mode == CSSQuirksMode)
             $2.lower();
         $$->setValue($2);
     }
@@ -1121,8 +1098,7 @@ class:
 attr_name:
     IDENT maybe_space {
         CSSParserString& str = $1;
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        if (p->m_context.isHTMLDocument)
+        if (parser->m_context.isHTMLDocument)
             str.lower();
         $$ = str;
     }
@@ -1130,26 +1106,24 @@ attr_name:
 
 attrib:
     '[' maybe_space attr_name ']' {
-        $$ = static_cast<CSSParser*>(parser)->createFloatingSelector();
+        $$ = parser->createFloatingSelector();
         $$->setAttribute(QualifiedName(nullAtom, $3, nullAtom));
         $$->setMatch(CSSSelector::Set);
     }
     | '[' maybe_space attr_name match maybe_space ident_or_string maybe_space ']' {
-        $$ = static_cast<CSSParser*>(parser)->createFloatingSelector();
+        $$ = parser->createFloatingSelector();
         $$->setAttribute(QualifiedName(nullAtom, $3, nullAtom));
         $$->setMatch((CSSSelector::Match)$4);
         $$->setValue($6);
     }
     | '[' maybe_space namespace_selector attr_name ']' {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingSelector();
-        $$->setAttribute(p->determineNameInNamespace($3, $4));
+        $$ = parser->createFloatingSelector();
+        $$->setAttribute(parser->determineNameInNamespace($3, $4));
         $$->setMatch(CSSSelector::Set);
     }
     | '[' maybe_space namespace_selector attr_name match maybe_space ident_or_string maybe_space ']' {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingSelector();
-        $$->setAttribute(p->determineNameInNamespace($3, $4));
+        $$ = parser->createFloatingSelector();
+        $$->setAttribute(parser->determineNameInNamespace($3, $4));
         $$->setMatch((CSSSelector::Match)$5);
         $$->setValue($7);
     }
@@ -1183,7 +1157,7 @@ ident_or_string:
 
 pseudo_page:
     ':' IDENT {
-        $$ = static_cast<CSSParser*>(parser)->createFloatingSelector();
+        $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PagePseudoClass);
         $2.lower();
         $$->setValue($2);
@@ -1194,7 +1168,7 @@ pseudo_page:
 
 pseudo:
     ':' IDENT {
-        $$ = static_cast<CSSParser*>(parser)->createFloatingSelector();
+        $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoClass);
         $2.lower();
         $$->setValue($2);
@@ -1203,7 +1177,7 @@ pseudo:
             $$ = 0;
     }
     | ':' ':' IDENT {
-        $$ = static_cast<CSSParser*>(parser)->createFloatingSelector();
+        $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoElement);
         $3.lower();
         $$->setValue($3);
@@ -1217,10 +1191,9 @@ pseudo:
     // related discussion with respect to :not.
     | ':' ANYFUNCTION maybe_space simple_selector_list maybe_space ')' {
         if ($4) {
-            CSSParser *p = static_cast<CSSParser*>(parser);
-            $$ = p->createFloatingSelector();
+            $$ = parser->createFloatingSelector();
             $$->setMatch(CSSSelector::PseudoClass);
-            $$->adoptSelectorVector(*p->sinkFloatingSelectorVector($4));
+            $$->adoptSelectorVector(*parser->sinkFloatingSelectorVector($4));
             $2.lower();
             $$->setValue($2);
             CSSSelector::PseudoType type = $$->pseudoType();
@@ -1231,8 +1204,7 @@ pseudo:
     }
     // used by :nth-*(ax+b)
     | ':' FUNCTION maybe_space NTH maybe_space ')' {
-        CSSParser *p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingSelector();
+        $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoClass);
         $$->setArgument($4);
         $$->setValue($2);
@@ -1242,8 +1214,7 @@ pseudo:
     }
     // used by :nth-*
     | ':' FUNCTION maybe_space maybe_unary_operator INTEGER maybe_space ')' {
-        CSSParser *p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingSelector();
+        $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoClass);
         $$->setArgument(String::number($4 * $5));
         $$->setValue($2);
@@ -1253,8 +1224,7 @@ pseudo:
     }
     // used by :nth-*(odd/even) and :lang
     | ':' FUNCTION maybe_space IDENT maybe_space ')' {
-        CSSParser *p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingSelector();
+        $$ = parser->createFloatingSelector();
         $$->setMatch(CSSSelector::PseudoClass);
         $$->setArgument($4);
         $2.lower();
@@ -1275,12 +1245,11 @@ pseudo:
         if (!$4 || !$4->isSimple())
             $$ = 0;
         else {
-            CSSParser* p = static_cast<CSSParser*>(parser);
-            $$ = p->createFloatingSelector();
+            $$ = parser->createFloatingSelector();
             $$->setMatch(CSSSelector::PseudoClass);
 
-            Vector<OwnPtr<CSSParserSelector> > selectorVector;
-            selectorVector.append(p->sinkFloatingSelector($4));
+            CSSSelectorVector selectorVector;
+            selectorVector.append(parser->sinkFloatingSelector($4));
             $$->adoptSelectorVector(selectorVector);
 
             $2.lower();
@@ -1317,8 +1286,7 @@ declaration_list:
 
 decl_list:
     declaration ';' maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markPropertyStart();
+        parser->markPropertyStart();
         $$ = $1;
     }
     | declaration invalid_block_list maybe_space {
@@ -1328,28 +1296,24 @@ decl_list:
         $$ = false;
     }
     | error ';' maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markPropertyStart();
+        parser->markPropertyStart();
         $$ = false;
     }
     | error invalid_block_list error ';' maybe_space {
         $$ = false;
     }
     | decl_list declaration ';' maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markPropertyStart();
+        parser->markPropertyStart();
         $$ = $1;
         if ($2)
             $$ = $2;
     }
     | decl_list error ';' maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markPropertyStart();
+        parser->markPropertyStart();
         $$ = $1;
     }
     | decl_list error invalid_block_list error ';' maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markPropertyStart();
+        parser->markPropertyStart();
         $$ = $1;
     }
     ;
@@ -1357,10 +1321,9 @@ decl_list:
 declaration:
     VAR_DEFINITION ':' maybe_space expr prio {
 #if ENABLE(CSS_VARIABLES)
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->storeVariableDeclaration($1, p->sinkFloatingValueList($4), $5);
+        parser->storeVariableDeclaration($1, parser->sinkFloatingValueList($4), $5);
         $$ = true;
-        p->markPropertyEnd($5, true);
+        parser->markPropertyEnd($5, true);
 #else
         $$ = false;
 #endif
@@ -1368,19 +1331,18 @@ declaration:
     |
     property ':' maybe_space expr prio {
         $$ = false;
-        CSSParser* p = static_cast<CSSParser*>(parser);
         bool isPropertyParsed = false;
         if ($1 && $4) {
-            p->m_valueList = p->sinkFloatingValueList($4);
-            int oldParsedProperties = p->m_parsedProperties.size();
-            $$ = p->parseValue(static_cast<CSSPropertyID>($1), $5);
+            parser->m_valueList = parser->sinkFloatingValueList($4);
+            int oldParsedProperties = parser->m_parsedProperties->size();
+            $$ = parser->parseValue(static_cast<CSSPropertyID>($1), $5);
             if (!$$)
-                p->rollbackLastProperties(p->m_parsedProperties.size() - oldParsedProperties);
+                parser->rollbackLastProperties(parser->m_parsedProperties->size() - oldParsedProperties);
             else
                 isPropertyParsed = true;
-            p->m_valueList = nullptr;
+            parser->m_valueList = nullptr;
         }
-        p->markPropertyEnd($5, isPropertyParsed);
+        parser->markPropertyEnd($5, isPropertyParsed);
     }
     |
     property error {
@@ -1391,15 +1353,13 @@ declaration:
         /* The default movable type template has letter-spacing: .none;  Handle this by looking for
         error tokens at the start of an expr, recover the expr and then treat as an error, cleaning
         up and deleting the shifted expr.  */
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markPropertyEnd(false, false);
+        parser->markPropertyEnd(false, false);
         $$ = false;
     }
     |
     property ':' maybe_space expr prio error {
         /* When we encounter something like p {color: red !important fail;} we should drop the declaration */
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markPropertyEnd(false, false);
+        parser->markPropertyEnd(false, false);
         $$ = false;
     }
     |
@@ -1410,15 +1370,13 @@ declaration:
     |
     property ':' maybe_space {
         /* div { font-family: } Just reduce away this property with no value. */
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markPropertyEnd(false, false);
+        parser->markPropertyEnd(false, false);
         $$ = false;
     }
     |
     property ':' maybe_space error {
         /* if we come across rules with invalid values like this case: p { weight: *; }, just discard the rule */
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markPropertyEnd(false, false);
+        parser->markPropertyEnd(false, false);
         $$ = false;
     }
     |
@@ -1441,12 +1399,10 @@ prio:
 
 expr:
     term {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingValueList();
-        $$->addValue(p->sinkFloatingValue($1));
+        $$ = parser->createFloatingValueList();
+        $$->addValue(parser->sinkFloatingValue($1));
     }
     | expr operator term {
-        CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = $1;
         if ($$) {
             if ($2) {
@@ -1456,7 +1412,7 @@ expr:
                 v.iValue = $2;
                 $$->addValue(v);
             }
-            $$->addValue(p->sinkFloatingValue($3));
+            $$->addValue(parser->sinkFloatingValue($3));
         }
     }
     | expr invalid_block_list {
@@ -1545,9 +1501,8 @@ unary_term:
       $$.id = 0;
       $$.fValue = $1;
       $$.unit = CSSPrimitiveValue::CSS_REMS;
-      CSSParser* p = static_cast<CSSParser*>(parser);
-      if (p->m_styleSheet)
-          p->m_styleSheet->parserSetUsesRemUnits(true);
+      if (parser->m_styleSheet)
+          parser->m_styleSheet->parserSetUsesRemUnits(true);
   }
   | VW maybe_space { $$.id = 0; $$.fValue = $1; $$.unit = CSSPrimitiveValue::CSS_VW; }
   | VH maybe_space { $$.id = 0; $$.fValue = $1; $$.unit = CSSPrimitiveValue::CSS_VH; }
@@ -1559,36 +1514,32 @@ unary_term:
 
 function:
     FUNCTION maybe_space expr ')' maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        CSSParserFunction* f = p->createFloatingFunction();
+        CSSParserFunction* f = parser->createFloatingFunction();
         f->name = $1;
-        f->args = p->sinkFloatingValueList($3);
+        f->args = parser->sinkFloatingValueList($3);
         $$.id = 0;
         $$.unit = CSSParserValue::Function;
         $$.function = f;
     } |
     FUNCTION maybe_space expr TOKEN_EOF {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        CSSParserFunction* f = p->createFloatingFunction();
+        CSSParserFunction* f = parser->createFloatingFunction();
         f->name = $1;
-        f->args = p->sinkFloatingValueList($3);
+        f->args = parser->sinkFloatingValueList($3);
         $$.id = 0;
         $$.unit = CSSParserValue::Function;
         $$.function = f;
     } |
     FUNCTION maybe_space ')' maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        CSSParserFunction* f = p->createFloatingFunction();
+        CSSParserFunction* f = parser->createFloatingFunction();
         f->name = $1;
-        CSSParserValueList* valueList = p->createFloatingValueList();
-        f->args = p->sinkFloatingValueList(valueList);
+        CSSParserValueList* valueList = parser->createFloatingValueList();
+        f->args = parser->sinkFloatingValueList(valueList);
         $$.id = 0;
         $$.unit = CSSParserValue::Function;
         $$.function = f;
     } |
     FUNCTION maybe_space error {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        CSSParserFunction* f = p->createFloatingFunction();
+        CSSParserFunction* f = parser->createFloatingFunction();
         f->name = $1;
         f->args = nullptr;
         $$.id = 0;
@@ -1634,12 +1585,10 @@ calc_func_paren_expr:
 
 calc_func_expr:
     calc_func_term maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        $$ = p->createFloatingValueList();
-        $$->addValue(p->sinkFloatingValue($1));
+        $$ = parser->createFloatingValueList();
+        $$->addValue(parser->sinkFloatingValue($1));
     }
     | calc_func_expr calc_func_operator calc_func_term {
-        CSSParser* p = static_cast<CSSParser*>(parser);
         if ($1 && $2) {
             $$ = $1;
             CSSParserValue v;
@@ -1647,7 +1596,7 @@ calc_func_expr:
             v.unit = CSSParserValue::Operator;
             v.iValue = $2;
             $$->addValue(v);
-            $$->addValue(p->sinkFloatingValue($3));
+            $$->addValue(parser->sinkFloatingValue($3));
         } else
             $$ = 0;
 
@@ -1690,10 +1639,9 @@ calc_func_expr_list:
 
 calc_function:
     CALCFUNCTION maybe_space calc_func_expr ')' maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        CSSParserFunction* f = p->createFloatingFunction();
+        CSSParserFunction* f = parser->createFloatingFunction();
         f->name = $1;
-        f->args = p->sinkFloatingValueList($3);
+        f->args = parser->sinkFloatingValueList($3);
         $$.id = 0;
         $$.unit = CSSParserValue::Function;
         $$.function = f;
@@ -1715,10 +1663,9 @@ min_or_max:
 
 min_or_max_function:
     min_or_max maybe_space calc_func_expr_list ')' maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        CSSParserFunction* f = p->createFloatingFunction();
+        CSSParserFunction* f = parser->createFloatingFunction();
         f->name = $1;
-        f->args = p->sinkFloatingValueList($3);
+        f->args = parser->sinkFloatingValueList($3);
         $$.id = 0;
         $$.unit = CSSParserValue::Function;
         $$.function = f;
@@ -1768,10 +1715,10 @@ invalid_rule:
 
 invalid_block:
     '{' error invalid_block_list error closing_brace {
-        static_cast<CSSParser*>(parser)->invalidBlockHit();
+        parser->invalidBlockHit();
     }
   | '{' error closing_brace {
-        static_cast<CSSParser*>(parser)->invalidBlockHit();
+        parser->invalidBlockHit();
     }
     ;
 
diff --git a/Source/WebCore/css/CSSImageGeneratorValue.cpp b/Source/WebCore/css/CSSImageGeneratorValue.cpp
index 9be446bd0..63040f3be 100644
--- a/Source/WebCore/css/CSSImageGeneratorValue.cpp
+++ b/Source/WebCore/css/CSSImageGeneratorValue.cpp
@@ -30,6 +30,7 @@
 #include "CSSCrossfadeValue.h"
 #include "CSSGradientValue.h"
 #include "Image.h"
+#include "MemoryInstrumentation.h"
 #include "RenderObject.h"
 #include <wtf/text/WTFString.h>
 
@@ -108,6 +109,14 @@ void CSSImageGeneratorValue::putImage(const IntSize& size, PassRefPtr<Image> ima
     m_images.add(size, image);
 }
 
+void CSSImageGeneratorValue::reportBaseClassMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addHashCountedSet(m_sizes);
+    info.addHashMap(m_clients);
+    info.addHashMap(m_images); // FIXME: instrument Image
+}
+
 PassRefPtr<Image> CSSImageGeneratorValue::image(RenderObject* renderer, const IntSize& size)
 {
     switch (classType()) {
diff --git a/Source/WebCore/css/CSSImageGeneratorValue.h b/Source/WebCore/css/CSSImageGeneratorValue.h
index b3d84eab2..cdf405a1c 100644
--- a/Source/WebCore/css/CSSImageGeneratorValue.h
+++ b/Source/WebCore/css/CSSImageGeneratorValue.h
@@ -73,6 +73,8 @@ protected:
     void putImage(const IntSize&, PassRefPtr<Image>);
     const RenderObjectSizeCountMap& clients() const { return m_clients; }
 
+    void reportBaseClassMemoryUsage(MemoryObjectInfo*) const;
+
     HashCountedSet<IntSize> m_sizes; // A count of how many times a given image size is in use.
     RenderObjectSizeCountMap m_clients; // A map from RenderObjects (with entry count) to image sizes.
     HashMap<IntSize, RefPtr<Image> > m_images; // A cache of Image objects by image size.
diff --git a/Source/WebCore/css/CSSImageSetValue.cpp b/Source/WebCore/css/CSSImageSetValue.cpp
index 0f48d010a..c3163f55c 100644
--- a/Source/WebCore/css/CSSImageSetValue.cpp
+++ b/Source/WebCore/css/CSSImageSetValue.cpp
@@ -30,8 +30,10 @@
 
 #include "CSSImageValue.h"
 #include "CSSPrimitiveValue.h"
+#include "CachedImage.h"
 #include "CachedResourceLoader.h"
 #include "Document.h"
+#include "MemoryInstrumentation.h"
 #include "Page.h"
 #include "StyleCachedImageSet.h"
 #include "StylePendingImage.h"
@@ -139,6 +141,16 @@ String CSSImageSetValue::customCssText() const
     return "-webkit-image-set(" + CSSValueList::customCssText() + ")";
 }
 
+bool CSSImageSetValue::hasFailedOrCanceledSubresources() const
+{
+    if (!m_imageSet || !m_imageSet->isCachedImageSet())
+        return false;
+    CachedResource* cachedResource = static_cast<StyleCachedImageSet*>(m_imageSet.get())->cachedImage();
+    if (!cachedResource)
+        return true;
+    return cachedResource->loadFailedOrCanceled();
+}
+
 CSSImageSetValue::CSSImageSetValue(const CSSImageSetValue& cloneFrom)
     : CSSValueList(cloneFrom)
     , m_accessedBestFitImage(false)
@@ -152,6 +164,19 @@ PassRefPtr<CSSImageSetValue> CSSImageSetValue::cloneForCSSOM() const
     return adoptRef(new CSSImageSetValue(*this));
 }
 
+void CSSImageSetValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSValueList::reportDescendantMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedVector(m_imagesInSet);
+}
+
+void CSSImageSetValue::ImageWithScale::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(imageURL);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(CSS_IMAGE_SET)
diff --git a/Source/WebCore/css/CSSImageSetValue.h b/Source/WebCore/css/CSSImageSetValue.h
index 404d3f9ee..a791d1ea1 100644
--- a/Source/WebCore/css/CSSImageSetValue.h
+++ b/Source/WebCore/css/CSSImageSetValue.h
@@ -58,10 +58,15 @@ public:
     struct ImageWithScale {
         String imageURL;
         float scaleFactor;
+        void reportMemoryUsage(MemoryObjectInfo*) const;
     };
 
+    bool hasFailedOrCanceledSubresources() const;
+
     PassRefPtr<CSSImageSetValue> cloneForCSSOM() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
     ImageWithScale bestImageForScaleFactor();
 
diff --git a/Source/WebCore/css/CSSImageValue.cpp b/Source/WebCore/css/CSSImageValue.cpp
index 61964630c..542192d5d 100644
--- a/Source/WebCore/css/CSSImageValue.cpp
+++ b/Source/WebCore/css/CSSImageValue.cpp
@@ -24,10 +24,11 @@
 #include "CSSCursorImageValue.h"
 #include "CSSParser.h"
 #include "CSSValueKeywords.h"
-#include "Document.h"
-#include "MemoryCache.h"
 #include "CachedImage.h"
 #include "CachedResourceLoader.h"
+#include "Document.h"
+#include "MemoryCache.h"
+#include "MemoryInstrumentation.h"
 #include "StyleCachedImage.h"
 #include "StylePendingImage.h"
 
@@ -102,6 +103,16 @@ void CSSImageValue::clearCachedImage()
     m_accessedImage = false;
 }
 
+bool CSSImageValue::hasFailedOrCanceledSubresources() const
+{
+    if (!m_image || !m_image->isCachedImage())
+        return false;
+    CachedResource* cachedResource = static_cast<StyleCachedImage*>(m_image.get())->cachedImage();
+    if (!cachedResource)
+        return true;
+    return cachedResource->loadFailedOrCanceled();
+}
+
 String CSSImageValue::customCssText() const
 {
     return "url(" + quoteCSSURLIfNeeded(m_url) + ")";
@@ -115,4 +126,11 @@ PassRefPtr<CSSValue> CSSImageValue::cloneForCSSOM() const
     return uriValue.release();
 }
 
+void CSSImageValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_url);
+    // No need to report m_image as it is counted as part of RenderArena.
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSImageValue.h b/Source/WebCore/css/CSSImageValue.h
index 5b2ce4760..8c82f2c67 100644
--- a/Source/WebCore/css/CSSImageValue.h
+++ b/Source/WebCore/css/CSSImageValue.h
@@ -46,6 +46,10 @@ public:
 
     PassRefPtr<CSSValue> cloneForCSSOM() const;
 
+    bool hasFailedOrCanceledSubresources() const;
+
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
     CSSImageValue(ClassType, const String& url);
 
diff --git a/Source/WebCore/css/CSSImportRule.cpp b/Source/WebCore/css/CSSImportRule.cpp
index fa10a287c..f7e711ba2 100644
--- a/Source/WebCore/css/CSSImportRule.cpp
+++ b/Source/WebCore/css/CSSImportRule.cpp
@@ -27,6 +27,7 @@
 #include "CachedResourceLoader.h"
 #include "Document.h"
 #include "MediaList.h"
+#include "MemoryInstrumentation.h"
 #include "SecurityOrigin.h"
 #include "StyleRuleImport.h"
 #include "StyleSheetContents.h"
@@ -76,6 +77,15 @@ String CSSImportRule::cssText() const
     return result.toString();
 }
 
+void CSSImportRule::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSRule::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_importRule);
+    info.addInstrumentedMember(m_mediaCSSOMWrapper);
+    info.addInstrumentedMember(m_styleSheetCSSOMWrapper);
+}
+
 CSSStyleSheet* CSSImportRule::styleSheet() const
 { 
     if (!m_importRule->styleSheet())
diff --git a/Source/WebCore/css/CSSImportRule.h b/Source/WebCore/css/CSSImportRule.h
index 9ee306611..c835f7dd5 100644
--- a/Source/WebCore/css/CSSImportRule.h
+++ b/Source/WebCore/css/CSSImportRule.h
@@ -43,6 +43,8 @@ public:
     
     String cssText() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSImportRule(StyleRuleImport*, CSSStyleSheet*);
 
diff --git a/Source/WebCore/css/CSSInheritedValue.cpp b/Source/WebCore/css/CSSInheritedValue.cpp
index 8c4be6d4b..f7a426de6 100644
--- a/Source/WebCore/css/CSSInheritedValue.cpp
+++ b/Source/WebCore/css/CSSInheritedValue.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "CSSInheritedValue.h"
 
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 
 namespace WebCore {
@@ -30,4 +31,9 @@ String CSSInheritedValue::customCssText() const
     return "inherit";
 }
 
+void CSSInheritedValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSInheritedValue.h b/Source/WebCore/css/CSSInheritedValue.h
index 5aa906367..68c001f53 100644
--- a/Source/WebCore/css/CSSInheritedValue.h
+++ b/Source/WebCore/css/CSSInheritedValue.h
@@ -35,6 +35,8 @@ public:
 
     String customCssText() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSInheritedValue()
         : CSSValue(InheritedClass)
diff --git a/Source/WebCore/css/CSSInitialValue.cpp b/Source/WebCore/css/CSSInitialValue.cpp
index 8de3f3182..775fe0f80 100644
--- a/Source/WebCore/css/CSSInitialValue.cpp
+++ b/Source/WebCore/css/CSSInitialValue.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "CSSInitialValue.h"
 
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 
 namespace WebCore {
@@ -30,4 +31,9 @@ String CSSInitialValue::customCssText() const
     return "initial";
 }
 
+void CSSInitialValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSInitialValue.h b/Source/WebCore/css/CSSInitialValue.h
index dd86d8424..d523343d3 100644
--- a/Source/WebCore/css/CSSInitialValue.h
+++ b/Source/WebCore/css/CSSInitialValue.h
@@ -41,6 +41,8 @@ public:
 
     bool isImplicit() const { return m_isImplicit; }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSInitialValue(bool implicit)
         : CSSValue(InitialClass)
diff --git a/Source/WebCore/css/CSSLineBoxContainValue.cpp b/Source/WebCore/css/CSSLineBoxContainValue.cpp
index 53132eb19..85f385d71 100644
--- a/Source/WebCore/css/CSSLineBoxContainValue.cpp
+++ b/Source/WebCore/css/CSSLineBoxContainValue.cpp
@@ -27,6 +27,7 @@
 #include "CSSLineBoxContainValue.h"
 
 #include "CSSPrimitiveValue.h"
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 
 namespace WebCore {
@@ -72,4 +73,9 @@ String CSSLineBoxContainValue::customCssText() const
     return text;
 }
 
+void CSSLineBoxContainValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+}
+
 }
diff --git a/Source/WebCore/css/CSSLineBoxContainValue.h b/Source/WebCore/css/CSSLineBoxContainValue.h
index ddc0c60f3..eeb6470c8 100644
--- a/Source/WebCore/css/CSSLineBoxContainValue.h
+++ b/Source/WebCore/css/CSSLineBoxContainValue.h
@@ -50,6 +50,8 @@ public:
 
     LineBoxContain value() const { return m_value; }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     LineBoxContain m_value;
 
diff --git a/Source/WebCore/css/CSSMediaRule.cpp b/Source/WebCore/css/CSSMediaRule.cpp
index 55bbaa5fd..278670f41 100644
--- a/Source/WebCore/css/CSSMediaRule.cpp
+++ b/Source/WebCore/css/CSSMediaRule.cpp
@@ -27,6 +27,7 @@
 #include "CSSRuleList.h"
 #include "CSSStyleSheet.h"
 #include "ExceptionCode.h"
+#include "MemoryInstrumentation.h"
 #include "StyleRule.h"
 #include <wtf/text/StringBuilder.h>
 
@@ -174,4 +175,13 @@ void CSSMediaRule::reattach(StyleRuleMedia* rule)
     }
 }
 
+void CSSMediaRule::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSRule::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_mediaCSSOMWrapper);
+    info.addInstrumentedVector(m_childRuleCSSOMWrappers);
+    info.addInstrumentedMember(m_ruleListCSSOMWrapper);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSMediaRule.h b/Source/WebCore/css/CSSMediaRule.h
index fda23cae2..69faf1a50 100644
--- a/Source/WebCore/css/CSSMediaRule.h
+++ b/Source/WebCore/css/CSSMediaRule.h
@@ -52,6 +52,8 @@ public:
 
     void reattach(StyleRuleMedia*);
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSMediaRule(StyleRuleMedia*, CSSStyleSheet*);
     
diff --git a/Source/WebCore/css/CSSPageRule.cpp b/Source/WebCore/css/CSSPageRule.cpp
index 42859aa2a..f5e63276d 100644
--- a/Source/WebCore/css/CSSPageRule.cpp
+++ b/Source/WebCore/css/CSSPageRule.cpp
@@ -95,4 +95,12 @@ void CSSPageRule::reattach(StyleRulePage* rule)
         m_propertiesCSSOMWrapper->reattach(m_pageRule->mutableProperties());
 }
 
+void CSSPageRule::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSRule::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_pageRule);
+    info.addInstrumentedMember(m_propertiesCSSOMWrapper);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSPageRule.h b/Source/WebCore/css/CSSPageRule.h
index 163900cd1..aed4df4ae 100644
--- a/Source/WebCore/css/CSSPageRule.h
+++ b/Source/WebCore/css/CSSPageRule.h
@@ -48,6 +48,8 @@ public:
 
     void reattach(StyleRulePage*);
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSPageRule(StyleRulePage*, CSSStyleSheet*);
     
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index c3ff2ab57..aa08c18e7 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -101,10 +101,11 @@
 #endif
 
 #if ENABLE(CSS_SHADERS)
+#include "WebKitCSSMixFunctionValue.h"
 #include "WebKitCSSShaderValue.h"
 #endif
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 #include "DashboardRegion.h"
 #endif
 
@@ -114,7 +115,7 @@
 extern int cssyydebug;
 #endif
 
-extern int cssyyparse(void* parser);
+extern int cssyyparse(WebCore::CSSParser*);
 
 using namespace std;
 using namespace WTF;
@@ -243,6 +244,7 @@ CSSParser::CSSParser(const CSSParserContext& context)
     , m_important(false)
     , m_id(CSSPropertyInvalid)
     , m_styleSheet(0)
+    , m_parsedProperties(adoptPtr(new ParsedPropertyVector))
     , m_selectorListForParseSelector(0)
     , m_numParsedPropertiesBeforeMarginBox(INVALID_NUM_PARSED_PROPERTIES)
     , m_inParseShorthand(0)
@@ -262,6 +264,7 @@ CSSParser::CSSParser(const CSSParserContext& context)
     , m_lastSelectorLineNumber(0)
     , m_allowImportRules(true)
     , m_allowNamespaceDeclarations(true)
+    , m_selectorVector(adoptPtr(new CSSSelectorVector))
 {
 #if YYDEBUG > 0
     cssyydebug = 1;
@@ -833,8 +836,8 @@ static inline bool isValidKeywordPropertyAndValue(CSSPropertyID propertyId, int
         if (valueID == CSSValueReadOnly || valueID == CSSValueReadWrite || valueID == CSSValueReadWritePlaintextOnly)
             return true;
         break;
-    case CSSPropertyWebkitUserSelect: // auto | none | text
-        if (valueID == CSSValueAuto || valueID == CSSValueNone || valueID == CSSValueText)
+    case CSSPropertyWebkitUserSelect: // auto | none | text | all
+        if (valueID == CSSValueAuto || valueID == CSSValueNone || valueID == CSSValueText || valueID == CSSValueAll)
             return true;
         break;
 #if ENABLE(CSS_EXCLUSIONS)
@@ -1151,9 +1154,9 @@ bool CSSParser::parseValue(StylePropertySet* declaration, CSSPropertyID property
     bool ok = false;
     if (m_hasFontFaceOnlyValues)
         deleteFontFaceOnlyValues();
-    if (!m_parsedProperties.isEmpty()) {
+    if (!m_parsedProperties->isEmpty()) {
         ok = true;
-        declaration->addParsedProperties(m_parsedProperties);
+        declaration->addParsedProperties(*m_parsedProperties);
         clearProperties();
     }
 
@@ -1174,7 +1177,7 @@ bool CSSParser::parseColor(RGBA32& color, const String& string, bool strict)
     if (!parser.parseColor(string))
         return false;
 
-    CSSValue* value = parser.m_parsedProperties.first().value();
+    CSSValue* value = parser.m_parsedProperties->first().value();
     if (!value->isPrimitiveValue())
         return false;
 
@@ -1192,7 +1195,7 @@ bool CSSParser::parseColor(const String& string)
     cssyyparse(this);
     m_rule = 0;
 
-    return !m_parsedProperties.isEmpty() && m_parsedProperties.first().id() == CSSPropertyColor;
+    return !m_parsedProperties->isEmpty() && m_parsedProperties->first().id() == CSSPropertyColor;
 }
 
 bool CSSParser::parseSystemColor(RGBA32& color, const String& string, Document* document)
@@ -1242,9 +1245,9 @@ bool CSSParser::parseDeclaration(StylePropertySet* declaration, const String& st
     bool ok = false;
     if (m_hasFontFaceOnlyValues)
         deleteFontFaceOnlyValues();
-    if (!m_parsedProperties.isEmpty()) {
+    if (!m_parsedProperties->isEmpty()) {
         ok = true;
-        declaration->addParsedProperties(m_parsedProperties);
+        declaration->addParsedProperties(*m_parsedProperties);
         clearProperties();
     }
 
@@ -1281,14 +1284,14 @@ PassOwnPtr<MediaQuery> CSSParser::parseMediaQuery(const String& string)
 }
 
 #if ENABLE(CSS_VARIABLES)
-static inline void filterProperties(bool important, const CSSParser::ParsedPropertyVector& input, Vector<CSSProperty, 256>& output, size_t& unusedEntries, BitArray<numCSSProperties>& seenProperties, HashSet<AtomicString>& seenVariables)
+static inline void filterProperties(bool important, const CSSParser::ParsedPropertyVector* input, Vector<CSSProperty, 256>& output, size_t& unusedEntries, BitArray<numCSSProperties>& seenProperties, HashSet<AtomicString>& seenVariables)
 #else
-static inline void filterProperties(bool important, const CSSParser::ParsedPropertyVector& input, Vector<CSSProperty, 256>& output, size_t& unusedEntries, BitArray<numCSSProperties>& seenProperties)
+static inline void filterProperties(bool important, const CSSParser::ParsedPropertyVector* input, Vector<CSSProperty, 256>& output, size_t& unusedEntries, BitArray<numCSSProperties>& seenProperties)
 #endif
 {
     // Add properties in reverse order so that highest priority definitions are reached first. Duplicate definitions can then be ignored when found.
-    for (int i = input.size() - 1; i >= 0; --i) {
-        const CSSProperty& property = input[i];
+    for (int i = input->size() - 1; i >= 0; --i) {
+        const CSSProperty& property = input->at(i);
         if (property.isImportant() != important)
             continue;
 #if ENABLE(CSS_VARIABLES)
@@ -1312,17 +1315,17 @@ static inline void filterProperties(bool important, const CSSParser::ParsedPrope
 PassRefPtr<StylePropertySet> CSSParser::createStylePropertySet()
 {
     BitArray<numCSSProperties> seenProperties;
-    size_t unusedEntries = m_parsedProperties.size();
+    size_t unusedEntries = m_parsedProperties->size();
     Vector<CSSProperty, 256> results(unusedEntries);
 
     // Important properties have higher priority, so add them first. Duplicate definitions can then be ignored when found.
 #if ENABLE(CSS_VARIABLES)
     HashSet<AtomicString> seenVariables;
-    filterProperties(true, m_parsedProperties, results, unusedEntries, seenProperties, seenVariables);
-    filterProperties(false, m_parsedProperties, results, unusedEntries, seenProperties, seenVariables);
+    filterProperties(true, m_parsedProperties.get(), results, unusedEntries, seenProperties, seenVariables);
+    filterProperties(false, m_parsedProperties.get(), results, unusedEntries, seenProperties, seenVariables);
 #else
-    filterProperties(true, m_parsedProperties, results, unusedEntries, seenProperties);
-    filterProperties(false, m_parsedProperties, results, unusedEntries, seenProperties);
+    filterProperties(true, m_parsedProperties.get(), results, unusedEntries, seenProperties);
+    filterProperties(false, m_parsedProperties.get(), results, unusedEntries, seenProperties);
 #endif
     if (unusedEntries)
         results.remove(0, unusedEntries);
@@ -1332,19 +1335,19 @@ PassRefPtr<StylePropertySet> CSSParser::createStylePropertySet()
 
 void CSSParser::addProperty(CSSPropertyID propId, PassRefPtr<CSSValue> value, bool important, bool implicit)
 {
-    m_parsedProperties.append(CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand || implicit));
+    m_parsedProperties->append(CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand || implicit));
 }
 
 void CSSParser::rollbackLastProperties(int num)
 {
     ASSERT(num >= 0);
-    ASSERT(m_parsedProperties.size() >= static_cast<unsigned>(num));
-    m_parsedProperties.shrink(m_parsedProperties.size() - num);
+    ASSERT(m_parsedProperties->size() >= static_cast<unsigned>(num));
+    m_parsedProperties->shrink(m_parsedProperties->size() - num);
 }
 
 void CSSParser::clearProperties()
 {
-    m_parsedProperties.clear();
+    m_parsedProperties->clear();
     m_numParsedPropertiesBeforeMarginBox = INVALID_NUM_PARSED_PROPERTIES;
     m_hasFontFaceOnlyValues = false;
 }
@@ -1638,6 +1641,10 @@ inline PassRefPtr<CSSPrimitiveValue> CSSParser::parseValidPrimitive(int identifi
     if (value->unit >= CSSPrimitiveValue::CSS_DPPX && value->unit <= CSSPrimitiveValue::CSS_DPCM)
         return createPrimitiveNumericValue(value);
 #endif
+#if ENABLE(CSS_VARIABLES)
+    if (value->unit == CSSPrimitiveValue::CSS_VARIABLE_NAME)
+        return CSSPrimitiveValue::create(value->string, CSSPrimitiveValue::CSS_VARIABLE_NAME);
+#endif
     if (value->unit >= CSSParserValue::Q_EMS)
         return CSSPrimitiveValue::createAllowingMarginQuirk(value->fValue, CSSPrimitiveValue::CSS_EMS);
     if (isCalculation(value))
@@ -1756,7 +1763,7 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
         ShorthandScope scope(this, propId);
         if (num != 1 || !parseValue(CSSPropertyOverflowX, important))
             return false;
-        CSSValue* value = m_parsedProperties.last().value();
+        CSSValue* value = m_parsedProperties->last().value();
         addProperty(CSSPropertyOverflowY, value, important);
         return true;
     }
@@ -1779,7 +1786,7 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
             ShorthandScope scope(this, CSSPropertyBorderSpacing);
             if (!parseValue(CSSPropertyWebkitBorderHorizontalSpacing, important))
                 return false;
-            CSSValue* value = m_parsedProperties.last().value();
+            CSSValue* value = m_parsedProperties->last().value();
             addProperty(CSSPropertyWebkitBorderVerticalSpacing, value, important);
             return true;
         }
@@ -2095,31 +2102,11 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
     case CSSPropertyTextDecoration:
     case CSSPropertyWebkitTextDecorationsInEffect:
         // none | [ underline || overline || line-through || blink ] | inherit
-        if (id == CSSValueNone) {
-            validPrimitive = true;
-        } else {
-            RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-            bool isValid = true;
-            while (isValid && value) {
-                switch (value->id) {
-                case CSSValueBlink:
-                    break;
-                case CSSValueUnderline:
-                case CSSValueOverline:
-                case CSSValueLineThrough:
-                    list->append(cssValuePool().createIdentifierValue(value->id));
-                    break;
-                default:
-                    isValid = false;
-                }
-                value = m_valueList->next();
-            }
-            if (list->length() && isValid) {
-                parsedValue = list.release();
-                m_valueList->next();
-            }
-        }
-        break;
+        return parseTextDecoration(propId, important);
+
+    case CSSPropertyWebkitTextDecorationLine:
+        // none | [ underline || overline || line-through ] | inherit
+        return parseTextDecoration(propId, important);
 
     case CSSPropertyZoom:          // normal | reset | document | <number> | <percentage> | inherit
         if (id == CSSValueNormal || id == CSSValueReset || id == CSSValueDocument)
@@ -2291,7 +2278,12 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
         validPrimitive = validUnit(value, FNumber | FNonNeg);
         break;
     case CSSPropertyWebkitOrder:
-        validPrimitive = validUnit(value, FNumber);
+        if (validUnit(value, FInteger, CSSStrictMode)) {
+            // We restrict the smallest value to int min + 2 because we use int min and int min + 1 as special values in a hash set.
+            parsedValue = cssValuePool().createValue(max(static_cast<double>(std::numeric_limits<int>::min() + 2), value->fValue),
+                                                             static_cast<CSSPrimitiveValue::UnitTypes>(value->unit));
+            m_valueList->next();
+        }
         break;
 #endif
     case CSSPropertyWebkitMarquee:
@@ -2328,9 +2320,9 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
         if (id == CSSValueNone)
             validPrimitive = true;
         else {
-            PassRefPtr<CSSValue> val = parseTransform();
-            if (val) {
-                addProperty(propId, val, important);
+            RefPtr<CSSValue> transformValue = parseTransform(m_valueList.get());
+            if (transformValue) {
+                addProperty(propId, transformValue.release(), important);
                 return true;
             }
             return false;
@@ -2421,7 +2413,7 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
             ShorthandScope scope(this, CSSPropertyWebkitMarginCollapse);
             if (!parseValue(webkitMarginCollapseShorthand().properties()[0], important))
                 return false;
-            CSSValue* value = m_parsedProperties.last().value();
+            CSSValue* value = m_parsedProperties->last().value();
             addProperty(webkitMarginCollapseShorthand().properties()[1], value, important);
             return true;
         }
@@ -2525,8 +2517,13 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
             validPrimitive = true;
         break;
 
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 #if ENABLE(DASHBOARD_SUPPORT)
     case CSSPropertyWebkitDashboardRegion: // <dashboard-region> | <dashboard-region>
+#endif
+#if ENABLE(WIDGET_REGION)
+    case CSSPropertyWebkitWidgetRegion:
+#endif
         if (value->unit == CSSParserValue::Function || id == CSSValueNone)
             return parseDashboardRegions(propId, important);
         break;
@@ -3015,6 +3012,10 @@ bool CSSParser::cssVariablesEnabled() const
 
 void CSSParser::storeVariableDeclaration(const CSSParserString& name, PassOwnPtr<CSSParserValueList> value, bool important)
 {
+    // When CSSGrammar.y encounters an invalid declaration it passes null for the CSSParserValueList, just bail.
+    if (!value)
+        return;
+    
     ASSERT(name.length > 12);
     AtomicString variableName = String(name.characters + 12, name.length - 12);
 
@@ -3245,7 +3246,7 @@ bool CSSParser::parse4Values(CSSPropertyID propId, const CSSPropertyID *properti
         case 1: {
             if (!parseValue(properties[0], important))
                 return false;
-            CSSValue *value = m_parsedProperties.last().value();
+            CSSValue* value = m_parsedProperties->last().value();
             ImplicitScope implicitScope(this, PropertyImplicit);
             addProperty(properties[1], value, important);
             addProperty(properties[2], value, important);
@@ -3255,17 +3256,17 @@ bool CSSParser::parse4Values(CSSPropertyID propId, const CSSPropertyID *properti
         case 2: {
             if (!parseValue(properties[0], important) || !parseValue(properties[1], important))
                 return false;
-            CSSValue *value = m_parsedProperties[m_parsedProperties.size() - 2].value();
+            CSSValue* value = m_parsedProperties->at(m_parsedProperties->size() - 2).value();
             ImplicitScope implicitScope(this, PropertyImplicit);
             addProperty(properties[2], value, important);
-            value = m_parsedProperties[m_parsedProperties.size() - 2].value();
+            value = m_parsedProperties->at(m_parsedProperties->size() - 2).value();
             addProperty(properties[3], value, important);
             break;
         }
         case 3: {
             if (!parseValue(properties[0], important) || !parseValue(properties[1], important) || !parseValue(properties[2], important))
                 return false;
-            CSSValue *value = m_parsedProperties[m_parsedProperties.size() - 2].value();
+            CSSValue* value = m_parsedProperties->at(m_parsedProperties->size() - 2).value();
             ImplicitScope implicitScope(this, PropertyImplicit);
             addProperty(properties[3], value, important);
             break;
@@ -3841,7 +3842,7 @@ bool CSSParser::parseFillProperty(CSSPropertyID propId, CSSPropertyID& propId1,
                 }
                 case CSSPropertyWebkitBackgroundComposite:
                 case CSSPropertyWebkitMaskComposite:
-                    if ((val->id >= CSSValueClear && val->id <= CSSValuePlusLighter) || val->id == CSSValueHighlight) {
+                    if (val->id >= CSSValueClear && val->id <= CSSValuePlusLighter) {
                         currValue = cssValuePool().createIdentifierValue(val->id);
                         m_valueList->next();
                     }
@@ -4215,7 +4216,7 @@ bool CSSParser::parseGridTrackList(CSSPropertyID propId, bool important)
 }
 
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 
 #define DASHBOARD_REGION_NUM_PARAMETERS  6
 #define DASHBOARD_REGION_SHORT_NUM_PARAMETERS  2
@@ -4261,14 +4262,39 @@ bool CSSParser::parseDashboardRegions(CSSPropertyID propId, bool important)
             break;
         }
 
-        // Commas count as values, so allow:
+        // Commas count as values, so allow (function name is dashboard-region for DASHBOARD_SUPPORT feature):
         // dashboard-region(label, type, t, r, b, l) or dashboard-region(label type t r b l)
         // dashboard-region(label, type, t, r, b, l) or dashboard-region(label type t r b l)
         // also allow
         // dashboard-region(label, type) or dashboard-region(label type)
         // dashboard-region(label, type) or dashboard-region(label type)
         CSSParserValueList* args = value->function->args.get();
-        if (!equalIgnoringCase(value->function->name, "dashboard-region(") || !args) {
+        if (!args) {
+            valid = false;
+            break;
+        }
+        bool validFunctionName = false;
+#if ENABLE(DASHBOARD_SUPPORT)
+        static const char* const dashboardRegionFunctionName = "dashboard-region(";
+        if (equalIgnoringCase(value->function->name, dashboardRegionFunctionName)) {
+            validFunctionName = true;
+#if ENABLE(DASHBOARD_SUPPORT) && ENABLE(WIDGET_REGION)
+            // Keep track of function name when both features are enabled. 
+            region->m_cssFunctionName = dashboardRegionFunctionName;
+#endif
+        }
+#endif
+#if ENABLE(WIDGET_REGION)
+        static const char* const widgetRegionFunctionName = "region(";
+        if (equalIgnoringCase(value->function->name, widgetRegionFunctionName)) {
+            validFunctionName = true;
+#if ENABLE(DASHBOARD_SUPPORT) && ENABLE(WIDGET_REGION)
+            // Keep track of function name when both features are enabled. 
+            region->m_cssFunctionName = widgetRegionFunctionName;
+#endif
+        }
+#endif
+        if (!validFunctionName) {
             valid = false;
             break;
         }
@@ -4354,7 +4380,7 @@ bool CSSParser::parseDashboardRegions(CSSPropertyID propId, bool important)
     return valid;
 }
 
-#endif /* ENABLE(DASHBOARD_SUPPORT) */
+#endif /* ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION) */
 
 PassRefPtr<CSSValue> CSSParser::parseCounterContent(CSSParserValueList* args, bool counters)
 {
@@ -4810,7 +4836,7 @@ PassRefPtr<CSSValueList> CSSParser::parseFontFamily()
     bool inFamily = false;
 
     while (value) {
-        if (value->id == CSSValueInitial || value->id == CSSValueInherit)
+        if (value->id == CSSValueInitial || value->id == CSSValueInherit || value->id == CSSValueDefault)
             return 0;
         CSSParserValue* nextValue = m_valueList->next();
         bool nextValBreaksFont = !nextValue ||
@@ -6105,6 +6131,7 @@ bool CSSParser::parseBorderImageRepeat(RefPtr<CSSValue>& result)
             // We need to rewind the value list, so that when its advanced we'll
             // end up back at this value.
             m_valueList->previous();
+            secondValue = firstValue;
         }
     } else
         secondValue = firstValue;
@@ -7239,15 +7266,15 @@ private:
     CSSParser::Units m_unit;
 };
 
-PassRefPtr<CSSValueList> CSSParser::parseTransform()
+PassRefPtr<CSSValueList> CSSParser::parseTransform(CSSParserValueList* valueList)
 {
-    if (!m_valueList)
+    if (!valueList)
         return 0;
 
     // The transform is a list of functional primitives that specify transform operations.
     // We collect a list of WebKitCSSTransformValues, where each value specifies a single operation.
     RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-    for (CSSParserValue* value = m_valueList->current(); value; value = m_valueList->next()) {
+    for (CSSParserValue* value = valueList->current(); value; value = valueList->next()) {
         if (value->unit != CSSParserValue::Function || !value->function)
             return 0;
 
@@ -7310,6 +7337,19 @@ PassRefPtr<CSSValueList> CSSParser::parseTransform()
     return list.release();
 }
 
+bool CSSParser::isBlendMode(int ident)
+{
+    return (ident >= CSSValueMultiply && ident <= CSSValueLuminosity)
+        || ident == CSSValueNormal
+        || ident == CSSValueOverlay;
+}
+
+bool CSSParser::isCompositeOperator(int ident)
+{
+    // FIXME: Add CSSValueDestination and CSSValueLighter when the Compositing spec updates.
+    return ident >= CSSValueClear && ident <= CSSValueXor;
+}
+
 #if ENABLE(CSS_FILTERS)
 
 static void filterInfoForName(const CSSParserString& name, WebKitCSSFilterValue::FilterOperationType& filterType, unsigned& maximumArgumentCount)
@@ -7353,6 +7393,53 @@ static bool acceptCommaOperator(CSSParserValueList* argsList)
     return true;
 }
 
+PassRefPtr<WebKitCSSMixFunctionValue> CSSParser::parseMixFunction(CSSParserValue* value)
+{
+    ASSERT(value->unit == CSSParserValue::Function && value->function);
+
+    if (!equalIgnoringCase(value->function->name, "mix("))
+        return 0;
+
+    CSSParserValueList* argsList = value->function->args.get();
+    unsigned numArgs = argsList->size();
+    if (numArgs < 1 || numArgs > 3)
+        return 0;
+    
+    RefPtr<WebKitCSSMixFunctionValue> mixFunction = WebKitCSSMixFunctionValue::create();
+
+    bool hasBlendMode = false;
+    bool hasAlphaCompositing = false;
+    CSSParserValue* arg;
+    while ((arg = argsList->current())) {
+        RefPtr<CSSValue> value;
+
+        unsigned argNumber = argsList->currentIndex();
+        if (!argNumber) {
+            if (arg->unit == CSSPrimitiveValue::CSS_URI) {
+                KURL shaderURL = completeURL(arg->string);
+                value = WebKitCSSShaderValue::create(shaderURL.string());
+            }
+        } else if (argNumber == 1 || argNumber == 2) {
+            if (!hasBlendMode && isBlendMode(arg->id)) {
+                hasBlendMode = true;
+                value = cssValuePool().createIdentifierValue(arg->id);
+            } else if (!hasAlphaCompositing && isCompositeOperator(arg->id)) {
+                hasAlphaCompositing = true;
+                value = cssValuePool().createIdentifierValue(arg->id);
+            }
+        }
+
+        if (!value)
+            return 0;
+
+        mixFunction->append(value.release());
+
+        arg = argsList->next();
+    }
+
+    return mixFunction;
+}
+
 PassRefPtr<WebKitCSSFilterValue> CSSParser::parseCustomFilter(CSSParserValue* value)
 {
     CSSParserValueList* argsList = value->function->args.get();
@@ -7364,7 +7451,13 @@ PassRefPtr<WebKitCSSFilterValue> CSSParser::parseCustomFilter(CSSParserValue* va
     // Custom filter syntax:
     //
     // vertexShader:    <uri> | none
-    // fragmentShader:  <uri> | none
+    // fragmentShader:  <uri> | none | mix(<uri> [ <blend-mode> || <alpha-compositing> ]?)
+    //
+    // blend-mode: normal | multiply | screen | overlay | darken | lighten | color-dodge |
+    //             color-burn | hard-light | soft-light | difference | exclusion | hue |
+    //             saturation | color | luminosity
+    // alpha-compositing: clear | src | dst | src-over | dst-over | src-in | dst-in |
+    //                    src-out | dst-out | src-atop | dst-atop | xor | plus
     //
     // box: filter-box | border-box | padding-box | content-box
     // vertexMesh:  +<integer>{1,2}[wsp<box>][wsp'detached']
@@ -7398,7 +7491,12 @@ PassRefPtr<WebKitCSSFilterValue> CSSParser::parseCustomFilter(CSSParserValue* va
             KURL shaderURL = completeURL(arg->string);
             value = WebKitCSSShaderValue::create(shaderURL.string());
             hadAtLeastOneCustomShader = true;
+        } else if (argsList->currentIndex() == 1 && arg->unit == CSSParserValue::Function) {
+            if (!(value = parseMixFunction(arg)))
+                return 0;
+            hadAtLeastOneCustomShader = true;
         }
+
         if (!value)
             break;
         shadersList->append(value.release());
@@ -7448,7 +7546,7 @@ PassRefPtr<WebKitCSSFilterValue> CSSParser::parseCustomFilter(CSSParserValue* va
     RefPtr<CSSValueList> paramList = CSSValueList::createCommaSeparated();
     
     while ((arg = argsList->current())) {
-        if (arg->id || arg->unit != CSSPrimitiveValue::CSS_IDENT)
+        if (arg->unit != CSSPrimitiveValue::CSS_IDENT)
             return 0;
 
         RefPtr<CSSValueList> parameter = CSSValueList::createSpaceSeparated();
@@ -7672,7 +7770,7 @@ bool CSSParser::parseFlowThread(const String& flowName)
 
     m_rule = 0;
 
-    return ((m_parsedProperties.size() == 1) && (m_parsedProperties.first().id() == CSSPropertyWebkitFlowInto));
+    return ((m_parsedProperties->size() == 1) && (m_parsedProperties->first().id() == CSSPropertyWebkitFlowInto));
 }
 
 // none | <ident>
@@ -7816,6 +7914,56 @@ bool CSSParser::parsePerspectiveOrigin(CSSPropertyID propId, CSSPropertyID& prop
     return value;
 }
 
+void CSSParser::addTextDecorationProperty(CSSPropertyID propId, PassRefPtr<CSSValue> value, bool important)
+{
+    // The text-decoration-line property takes priority over text-decoration, unless the latter has important priority set.
+    if (propId == CSSPropertyTextDecoration && !important && m_currentShorthand == CSSPropertyInvalid) {
+        for (unsigned i = 0; i < m_parsedProperties->size(); ++i) {
+            if (m_parsedProperties->at(i).id() == CSSPropertyWebkitTextDecorationLine)
+                return;
+        }
+    }
+    addProperty(propId, value, important);
+}
+
+bool CSSParser::parseTextDecoration(CSSPropertyID propId, bool important)
+{
+    CSSParserValue* value = m_valueList->current();
+    if (value->id == CSSValueNone) {
+        addTextDecorationProperty(propId, cssValuePool().createExplicitInitialValue(), important);
+        m_valueList->next();
+        return true;
+    }
+
+    RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
+    bool isValid = true;
+    while (isValid && value) {
+        switch (value->id) {
+        case CSSValueBlink:
+            // Blink value is not accepted by -webkit-text-decoration-line.
+            isValid = propId != CSSPropertyWebkitTextDecorationLine;
+            break;
+        case CSSValueUnderline:
+        case CSSValueOverline:
+        case CSSValueLineThrough:
+            list->append(cssValuePool().createIdentifierValue(value->id));
+            break;
+        default:
+            isValid = false;
+            break;
+        }
+        if (isValid)
+            value = m_valueList->next();
+    }
+
+    if (list->length() && isValid) {
+        addTextDecorationProperty(propId, list.release(), important);
+        return true;
+    }
+
+    return false;
+}
+
 bool CSSParser::parseTextEmphasisStyle(bool important)
 {
     unsigned valueListSize = m_valueList->size();
@@ -9331,14 +9479,14 @@ PassOwnPtr<CSSParserSelector> CSSParser::sinkFloatingSelector(CSSParserSelector*
     return adoptPtr(selector);
 }
 
-Vector<OwnPtr<CSSParserSelector> >* CSSParser::createFloatingSelectorVector()
+CSSSelectorVector* CSSParser::createFloatingSelectorVector()
 {
-    Vector<OwnPtr<CSSParserSelector> >* selectorVector = new Vector<OwnPtr<CSSParserSelector> >;
+    CSSSelectorVector* selectorVector = new CSSSelectorVector;
     m_floatingSelectorVectors.add(selectorVector);
     return selectorVector;
 }
 
-PassOwnPtr<Vector<OwnPtr<CSSParserSelector> > > CSSParser::sinkFloatingSelectorVector(Vector<OwnPtr<CSSParserSelector> >* selectorVector)
+PassOwnPtr<CSSSelectorVector > CSSParser::sinkFloatingSelectorVector(CSSSelectorVector* selectorVector)
 {
     if (selectorVector) {
         ASSERT(m_floatingSelectorVectors.contains(selectorVector));
@@ -9531,7 +9679,7 @@ StyleRuleKeyframes* CSSParser::createKeyframesRule(const String& name, PassOwnPt
     return rulePtr;
 }
 
-StyleRuleBase* CSSParser::createStyleRule(Vector<OwnPtr<CSSParserSelector> >* selectors)
+StyleRuleBase* CSSParser::createStyleRule(CSSSelectorVector* selectors)
 {
     StyleRule* result = 0;
     if (selectors) {
@@ -9553,8 +9701,8 @@ StyleRuleBase* CSSParser::createStyleRule(Vector<OwnPtr<CSSParserSelector> >* se
 StyleRuleBase* CSSParser::createFontFaceRule()
 {
     m_allowImportRules = m_allowNamespaceDeclarations = false;
-    for (unsigned i = 0; i < m_parsedProperties.size(); ++i) {
-        CSSProperty& property = m_parsedProperties[i];
+    for (unsigned i = 0; i < m_parsedProperties->size(); ++i) {
+        CSSProperty& property = m_parsedProperties->at(i);
         if (property.id() == CSSPropertyFontVariant && property.value()->isPrimitiveValue())
             property.wrapValueInCommaSeparatedList();
         else if (property.id() == CSSPropertyFontFamily && (!property.value()->isValueList() || static_cast<CSSValueList*>(property.value())->length() != 1)) {
@@ -9645,7 +9793,7 @@ StyleRuleBase* CSSParser::createPageRule(PassOwnPtr<CSSParserSelector> pageSelec
     StyleRulePage* pageRule = 0;
     if (pageSelector) {
         RefPtr<StyleRulePage> rule = StyleRulePage::create();
-        Vector<OwnPtr<CSSParserSelector> > selectorVector;
+        CSSSelectorVector selectorVector;
         selectorVector.append(pageSelector);
         rule->parserAdoptSelectorVector(selectorVector);
         rule->setProperties(createStylePropertySet());
@@ -9657,7 +9805,7 @@ StyleRuleBase* CSSParser::createPageRule(PassOwnPtr<CSSParserSelector> pageSelec
     return pageRule;
 }
 
-void CSSParser::setReusableRegionSelectorVector(Vector<OwnPtr<CSSParserSelector> >* selectors)
+void CSSParser::setReusableRegionSelectorVector(CSSSelectorVector* selectors)
 {
     if (selectors)
         m_reusableRegionSelectorVector.swap(*selectors);
@@ -9693,22 +9841,22 @@ StyleRuleBase* CSSParser::createMarginAtRule(CSSSelector::MarginBoxType /* margi
 
 void CSSParser::startDeclarationsForMarginBox()
 {
-    m_numParsedPropertiesBeforeMarginBox = m_parsedProperties.size();
+    m_numParsedPropertiesBeforeMarginBox = m_parsedProperties->size();
 }
 
 void CSSParser::endDeclarationsForMarginBox()
 {
-    rollbackLastProperties(m_parsedProperties.size() - m_numParsedPropertiesBeforeMarginBox);
+    rollbackLastProperties(m_parsedProperties->size() - m_numParsedPropertiesBeforeMarginBox);
     m_numParsedPropertiesBeforeMarginBox = INVALID_NUM_PARSED_PROPERTIES;
 }
 
 void CSSParser::deleteFontFaceOnlyValues()
 {
     ASSERT(m_hasFontFaceOnlyValues);
-    for (unsigned i = 0; i < m_parsedProperties.size();) {
-        CSSProperty& property = m_parsedProperties[i];
+    for (unsigned i = 0; i < m_parsedProperties->size();) {
+        CSSProperty& property = m_parsedProperties->at(i);
         if (property.id() == CSSPropertyFontVariant && property.value()->isValueList()) {
-            m_parsedProperties.remove(i);
+            m_parsedProperties->remove(i);
             continue;
         }
         ++i;
@@ -9747,7 +9895,6 @@ void CSSParser::invalidBlockHit()
 void CSSParser::updateLastSelectorLineAndPosition()
 {
     m_lastSelectorLineNumber = m_lineNumber;
-    markRuleBodyStart();
 }
 
 void CSSParser::updateLastMediaLine(MediaQuerySet* media)
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index 6acbba252..5a1ed97b8 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -64,6 +64,10 @@ class StyleKeyframe;
 class StyleSheetContents;
 class StyledElement;
 
+#if ENABLE(CSS_SHADERS)
+class WebKitCSSMixFunctionValue;
+#endif
+
 class CSSParser {
 public:
     CSSParser(const CSSParserContext&);
@@ -83,7 +87,7 @@ public:
 
     void addProperty(CSSPropertyID, PassRefPtr<CSSValue>, bool important, bool implicit = false);
     void rollbackLastProperties(int num);
-    bool hasProperties() const { return !m_parsedProperties.isEmpty(); }
+    bool hasProperties() const { return !m_parsedProperties->isEmpty(); }
 
     bool parseValue(CSSPropertyID, bool important);
     bool parseShorthand(CSSPropertyID, const StylePropertyShorthand&, bool important);
@@ -213,16 +217,23 @@ public:
     PassRefPtr<CSSValueList> parseFilter();
     PassRefPtr<WebKitCSSFilterValue> parseBuiltinFilterArguments(CSSParserValueList*, WebKitCSSFilterValue::FilterOperationType);
 #if ENABLE(CSS_SHADERS)
+    PassRefPtr<WebKitCSSMixFunctionValue> parseMixFunction(CSSParserValue*);
     PassRefPtr<WebKitCSSFilterValue> parseCustomFilter(CSSParserValue*);
 #endif
 #endif
 
-    PassRefPtr<CSSValueList> parseTransform();
+    static bool isBlendMode(int ident);
+    static bool isCompositeOperator(int ident);
+
+    PassRefPtr<CSSValueList> parseTransform(CSSParserValueList*);
     bool parseTransformOrigin(CSSPropertyID propId, CSSPropertyID& propId1, CSSPropertyID& propId2, CSSPropertyID& propId3, RefPtr<CSSValue>&, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
     bool parsePerspectiveOrigin(CSSPropertyID propId, CSSPropertyID& propId1, CSSPropertyID& propId2,  RefPtr<CSSValue>&, RefPtr<CSSValue>&);
 
     bool parseTextEmphasisStyle(bool important);
 
+    void addTextDecorationProperty(CSSPropertyID, PassRefPtr<CSSValue>, bool important);
+    bool parseTextDecoration(CSSPropertyID propId, bool important);
+
     bool parseLineBoxContain(bool important);
     bool parseCalculation(CSSParserValue*, CalculationPermittedValueRange);
 
@@ -241,8 +252,8 @@ public:
     CSSParserSelector* createFloatingSelector();
     PassOwnPtr<CSSParserSelector> sinkFloatingSelector(CSSParserSelector*);
 
-    Vector<OwnPtr<CSSParserSelector> >* createFloatingSelectorVector();
-    PassOwnPtr<Vector<OwnPtr<CSSParserSelector> > > sinkFloatingSelectorVector(Vector<OwnPtr<CSSParserSelector> >*);
+    CSSSelectorVector* createFloatingSelectorVector();
+    PassOwnPtr<CSSSelectorVector> sinkFloatingSelectorVector(CSSSelectorVector*);
 
     CSSParserValueList* createFloatingValueList();
     PassOwnPtr<CSSParserValueList> sinkFloatingValueList(CSSParserValueList*);
@@ -260,10 +271,10 @@ public:
     typedef Vector<RefPtr<StyleRuleBase> > RuleList;
     StyleRuleBase* createMediaRule(MediaQuerySet*, RuleList*);
     RuleList* createRuleList();
-    StyleRuleBase* createStyleRule(Vector<OwnPtr<CSSParserSelector> >* selectors);
+    StyleRuleBase* createStyleRule(CSSSelectorVector* selectors);
     StyleRuleBase* createFontFaceRule();
     StyleRuleBase* createPageRule(PassOwnPtr<CSSParserSelector> pageSelector);
-    StyleRuleBase* createRegionRule(Vector<OwnPtr<CSSParserSelector> >* regionSelector, RuleList* rules);
+    StyleRuleBase* createRegionRule(CSSSelectorVector* regionSelector, RuleList* rules);
     StyleRuleBase* createMarginAtRule(CSSSelector::MarginBoxType);
     void startDeclarationsForMarginBox();
     void endDeclarationsForMarginBox();
@@ -286,10 +297,10 @@ public:
 
     void invalidBlockHit();
 
-    Vector<OwnPtr<CSSParserSelector> >* reusableSelectorVector() { return &m_reusableSelectorVector; }
+    CSSSelectorVector* selectorVector() { return m_selectorVector.get(); }
 
-    void setReusableRegionSelectorVector(Vector<OwnPtr<CSSParserSelector> >* selectors);
-    Vector<OwnPtr<CSSParserSelector> >* reusableRegionSelectorVector() { return &m_reusableRegionSelectorVector; }
+    void setReusableRegionSelectorVector(CSSSelectorVector* selectors);
+    CSSSelectorVector* reusableRegionSelectorVector() { return &m_reusableRegionSelectorVector; }
 
     void updateLastSelectorLineAndPosition();
     void updateLastMediaLine(MediaQuerySet*);
@@ -307,8 +318,9 @@ public:
     RefPtr<StyleKeyframe> m_keyframe;
     OwnPtr<MediaQuery> m_mediaQuery;
     OwnPtr<CSSParserValueList> m_valueList;
+
     typedef Vector<CSSProperty, 256> ParsedPropertyVector;
-    ParsedPropertyVector m_parsedProperties;
+    OwnPtr<ParsedPropertyVector> m_parsedProperties;
     CSSSelectorList* m_selectorListForParseSelector;
 
     unsigned m_numParsedPropertiesBeforeMarginBox;
@@ -430,7 +442,7 @@ private:
     Vector<RefPtr<MediaQuerySet> > m_parsedMediaQuerySets;
     Vector<OwnPtr<RuleList> > m_parsedRuleLists;
     HashSet<CSSParserSelector*> m_floatingSelectors;
-    HashSet<Vector<OwnPtr<CSSParserSelector> >*> m_floatingSelectorVectors;
+    HashSet<CSSSelectorVector*> m_floatingSelectorVectors;
     HashSet<CSSParserValueList*> m_floatingValueLists;
     HashSet<CSSParserFunction*> m_floatingFunctions;
 
@@ -440,8 +452,8 @@ private:
 
     OwnPtr<Vector<RefPtr<StyleKeyframe> > > m_floatingKeyframeVector;
 
-    Vector<OwnPtr<CSSParserSelector> > m_reusableSelectorVector;
-    Vector<OwnPtr<CSSParserSelector> > m_reusableRegionSelectorVector;
+    OwnPtr<CSSSelectorVector> m_selectorVector;
+    CSSSelectorVector m_reusableRegionSelectorVector;
 
     RefPtr<CSSCalcValue> m_parsedCalculation;
 
diff --git a/Source/WebCore/css/CSSParserValues.cpp b/Source/WebCore/css/CSSParserValues.cpp
index 37a0d452c..1ab4dfefd 100644
--- a/Source/WebCore/css/CSSParserValues.cpp
+++ b/Source/WebCore/css/CSSParserValues.cpp
@@ -114,7 +114,7 @@ CSSParserSelector::~CSSParserSelector()
     }
 }
 
-void CSSParserSelector::adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectorVector)
+void CSSParserSelector::adoptSelectorVector(CSSSelectorVector& selectorVector)
 {
     CSSSelectorList* selectorList = fastNew<CSSSelectorList>();
     selectorList->adoptSelectorVector(selectorVector);
diff --git a/Source/WebCore/css/CSSParserValues.h b/Source/WebCore/css/CSSParserValues.h
index 90d26a46d..a736abb89 100644
--- a/Source/WebCore/css/CSSParserValues.h
+++ b/Source/WebCore/css/CSSParserValues.h
@@ -77,6 +77,7 @@ public:
     void extend(CSSParserValueList&);
 
     unsigned size() const { return m_values.size(); }
+    unsigned currentIndex() { return m_current; }
     CSSParserValue* current() { return m_current < m_values.size() ? &m_values[m_current] : 0; }
     CSSParserValue* next() { ++m_current; return current(); }
     CSSParserValue* previous()
@@ -103,6 +104,10 @@ public:
     OwnPtr<CSSParserValueList> args;
 };
 
+class CSSParserSelector;
+
+typedef Vector<OwnPtr<CSSParserSelector> > CSSSelectorVector;
+
 class CSSParserSelector {
     WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -119,7 +124,7 @@ public:
     void setRelation(CSSSelector::Relation value) { m_selector->m_relation = value; }
     void setForPage() { m_selector->setForPage(); }
 
-    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectorVector);
+    void adoptSelectorVector(CSSSelectorVector&);
 
     CSSSelector::PseudoType pseudoType() const { return m_selector->pseudoType(); }
     bool isUnknownPseudoElement() const { return m_selector->isUnknownPseudoElement(); }
diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
index d5e6eb654..65ca80427 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -31,6 +31,7 @@
 #include "Color.h"
 #include "Counter.h"
 #include "ExceptionCode.h"
+#include "MemoryInstrumentation.h"
 #include "Node.h"
 #include "Pair.h"
 #include "RGBColor.h"
@@ -43,7 +44,7 @@
 #include <wtf/text/StringBuffer.h>
 #include <wtf/text/StringBuilder.h>
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 #include "DashboardRegion.h"
 #endif
 
@@ -330,7 +331,7 @@ void CSSPrimitiveValue::init(PassRefPtr<Quad> quad)
     m_value.quad = quad.leakRef();
 }
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 void CSSPrimitiveValue::init(PassRefPtr<DashboardRegion> r)
 {
     m_primitiveUnitType = CSS_DASHBOARD_REGION;
@@ -827,17 +828,26 @@ Pair* CSSPrimitiveValue::getPairValue(ExceptionCode& ec) const
     return m_value.pair;
 }
 
-static String formatNumber(double number)
+static String formatNumber(double number, const char* suffix, unsigned suffixLength)
 {
     DecimalNumber decimal(number);
 
-    StringBuffer<UChar> buffer(decimal.bufferLengthForStringDecimal());
+    StringBuffer<LChar> buffer(decimal.bufferLengthForStringDecimal() + suffixLength);
     unsigned length = decimal.toStringDecimal(buffer.characters(), buffer.length());
-    ASSERT_UNUSED(length, length == buffer.length());
+    ASSERT(length + suffixLength == buffer.length());
+
+    for (unsigned i = 0; i < suffixLength; ++i)
+        buffer[length + i] = static_cast<LChar>(suffix[i]);
 
     return String::adopt(buffer);
 }
 
+template <unsigned characterCount>
+ALWAYS_INLINE static String formatNumber(double number, const char (&characters)[characterCount])
+{
+    return formatNumber(number, characters, characterCount - 1);
+}
+
 String CSSPrimitiveValue::customCssText() const
 {
     // FIXME: return the original value instead of a generated one (e.g. color
@@ -855,72 +865,72 @@ String CSSPrimitiveValue::customCssText() const
             break;
         case CSS_NUMBER:
         case CSS_PARSER_INTEGER:
-            text = formatNumber(m_value.num);
+            text = formatNumber(m_value.num, "");
             break;
         case CSS_PERCENTAGE:
-            text = formatNumber(m_value.num) + "%";
+            text = formatNumber(m_value.num, "%");
             break;
         case CSS_EMS:
-            text = formatNumber(m_value.num) + "em";
+            text = formatNumber(m_value.num, "em");
             break;
         case CSS_EXS:
-            text = formatNumber(m_value.num) + "ex";
+            text = formatNumber(m_value.num, "ex");
             break;
         case CSS_REMS:
-            text = formatNumber(m_value.num) + "rem";
+            text = formatNumber(m_value.num, "rem");
             break;
         case CSS_PX:
-            text = formatNumber(m_value.num) + "px";
+            text = formatNumber(m_value.num, "px");
             break;
         case CSS_CM:
-            text = formatNumber(m_value.num) + "cm";
+            text = formatNumber(m_value.num, "cm");
             break;
 #if ENABLE(CSS_IMAGE_RESOLUTION)
         case CSS_DPPX:
-            text = formatNumber(m_value.num) + "dppx";
+            text = formatNumber(m_value.num, "dppx");
             break;
         case CSS_DPI:
-            text = formatNumber(m_value.num) + "dpi";
+            text = formatNumber(m_value.num, "dpi");
             break;
         case CSS_DPCM:
-            text = formatNumber(m_value.num) + "dpcm";
+            text = formatNumber(m_value.num, "dpcm");
             break;
 #endif
         case CSS_MM:
-            text = formatNumber(m_value.num) + "mm";
+            text = formatNumber(m_value.num, "mm");
             break;
         case CSS_IN:
-            text = formatNumber(m_value.num) + "in";
+            text = formatNumber(m_value.num, "in");
             break;
         case CSS_PT:
-            text = formatNumber(m_value.num) + "pt";
+            text = formatNumber(m_value.num, "pt");
             break;
         case CSS_PC:
-            text = formatNumber(m_value.num) + "pc";
+            text = formatNumber(m_value.num, "pc");
             break;
         case CSS_DEG:
-            text = formatNumber(m_value.num) + "deg";
+            text = formatNumber(m_value.num, "deg");
             break;
         case CSS_RAD:
-            text = formatNumber(m_value.num) + "rad";
+            text = formatNumber(m_value.num, "rad");
             break;
         case CSS_GRAD:
-            text = formatNumber(m_value.num) + "grad";
+            text = formatNumber(m_value.num, "grad");
             break;
         case CSS_MS:
-            text = formatNumber(m_value.num) + "ms";
+            text = formatNumber(m_value.num, "ms");
             break;
         case CSS_S:
-            text = formatNumber(m_value.num) + "s";
+            text = formatNumber(m_value.num, "s");
             break;
         case CSS_HZ:
-            text = formatNumber(m_value.num) + "hz";
+            text = formatNumber(m_value.num, "hz");
             break;
         case CSS_KHZ:
-            text = formatNumber(m_value.num) + "khz";
+            text = formatNumber(m_value.num, "khz");
             break;
         case CSS_TURN:
-            text = formatNumber(m_value.num) + "turn";
+            text = formatNumber(m_value.num, "turn");
             break;
         case CSS_DIMENSION:
             // FIXME
@@ -1060,12 +1070,18 @@ String CSSPrimitiveValue::customCssText() const
                 text += m_value.pair->second()->cssText();
             }
             break;
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
         case CSS_DASHBOARD_REGION:
             for (DashboardRegion* region = getDashboardRegionValue(); region; region = region->m_next.get()) {
                 if (!text.isEmpty())
                     text.append(' ');
+#if ENABLE(DASHBOARD_SUPPORT) && ENABLE(WIDGET_REGION)
+                text += region->m_cssFunctionName;
+#elif ENABLE(DASHBOARD_SUPPORT)
                 text += "dashboard-region(";
+#else
+                text += "region(";
+#endif
                 text += region->m_label;
                 if (region->m_isCircle)
                     text += " circle";
@@ -1106,13 +1122,13 @@ String CSSPrimitiveValue::customCssText() const
             text = m_value.shape->cssText();
             break;
         case CSS_VW:
-            text = formatNumber(m_value.num) + "vw";
+            text = formatNumber(m_value.num, "vw");
             break;
         case CSS_VH:
-            text = formatNumber(m_value.num) + "vh";
+            text = formatNumber(m_value.num, "vh");
             break;
         case CSS_VMIN:
-            text = formatNumber(m_value.num) + "vmin";
+            text = formatNumber(m_value.num, "vmin");
             break;
 #if ENABLE(CSS_VARIABLES)
         case CSS_VARIABLE_NAME:
@@ -1188,7 +1204,7 @@ PassRefPtr<CSSPrimitiveValue> CSSPrimitiveValue::cloneForCSSOM() const
         // Pair is not exposed to the CSSOM, no need for a deep clone.
         result = CSSPrimitiveValue::create(m_value.pair);
         break;
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     case CSS_DASHBOARD_REGION:
         // DashboardRegion is not exposed to the CSSOM, no need for a deep clone.
         result = CSSPrimitiveValue::create(m_value.region);
@@ -1252,4 +1268,48 @@ PassRefPtr<CSSPrimitiveValue> CSSPrimitiveValue::cloneForCSSOM() const
     return result;
 }
 
+void CSSPrimitiveValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    switch (m_primitiveUnitType) {
+    case CSS_ATTR:
+    case CSS_COUNTER_NAME:
+    case CSS_PARSER_IDENTIFIER:
+    case CSS_PARSER_HEXCOLOR:
+    case CSS_STRING:
+    case CSS_URI:
+#if ENABLE(CSS_VARIABLES)
+    case CSS_VARIABLE_NAME:
+#endif
+        // FIXME: detect other cases when m_value is StringImpl*
+        info.addMember(m_value.string);
+        break;
+    case CSS_COUNTER:
+        info.addMember(m_value.counter);
+        break;
+    case CSS_RECT:
+        info.addMember(m_value.rect);
+        break;
+    case CSS_QUAD:
+        info.addMember(m_value.quad);
+        break;
+    case CSS_PAIR:
+        info.addMember(m_value.pair);
+        break;
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
+    case CSS_DASHBOARD_REGION:
+        info.addMember(m_value.region);
+        break;
+#endif
+    case CSS_SHAPE:
+        info.addMember(m_value.shape);
+        break;
+    case CSS_CALC:
+        info.addMember(m_value.calc);
+        break;
+    default:
+        break;
+    }
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSPrimitiveValue.h b/Source/WebCore/css/CSSPrimitiveValue.h
index 87069c043..fd0832d34 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.h
+++ b/Source/WebCore/css/CSSPrimitiveValue.h
@@ -306,6 +306,8 @@ public:
     PassRefPtr<CSSPrimitiveValue> cloneForCSSOM() const;
     void setCSSOMSafe() { m_isCSSOMSafe = true; }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     // FIXME: int vs. unsigned overloading is too subtle to distinguish the color and identifier cases.
     CSSPrimitiveValue(int ident);
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index e8638456a..6a337602b 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -2366,6 +2366,9 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EUserSelect e)
         case SELECT_TEXT:
             m_value.ident = CSSValueText;
             break;
+        case SELECT_ALL:
+            m_value.ident = CSSValueAll;
+            break;
     }
 }
 
@@ -2378,6 +2381,8 @@ template<> inline CSSPrimitiveValue::operator EUserSelect() const
             return SELECT_NONE;
         case CSSValueText:
             return SELECT_TEXT;
+        case CSSValueAll:
+            return SELECT_ALL;
         default:
             ASSERT_NOT_REACHED();
             return SELECT_TEXT;
@@ -3379,6 +3384,103 @@ template<> inline CSSPrimitiveValue::operator CustomFilterOperation::MeshBoxType
 }
 #endif // ENABLE(CSS_SHADERS)
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(BlendMode blendMode)
+    : CSSValue(PrimitiveClass)
+{
+    m_primitiveUnitType = CSS_IDENT;
+    switch (blendMode) {
+    case BlendModeNormal:
+        m_value.ident = CSSValueNormal;
+        break;
+    case BlendModeMultiply:
+        m_value.ident = CSSValueMultiply;
+        break;
+    case BlendModeScreen:
+        m_value.ident = CSSValueScreen;
+        break;
+    case BlendModeOverlay:
+        m_value.ident = CSSValueOverlay;
+        break;
+    case BlendModeDarken:
+        m_value.ident = CSSValueDarken;
+        break;
+    case BlendModeLighten:
+        m_value.ident = CSSValueLighten;
+        break;
+    case BlendModeColorDodge:
+        m_value.ident = CSSValueColorDodge;
+        break;
+    case BlendModeColorBurn:
+        m_value.ident = CSSValueColorBurn;
+        break;
+    case BlendModeHardLight:
+        m_value.ident = CSSValueHardLight;
+        break;
+    case BlendModeSoftLight:
+        m_value.ident = CSSValueSoftLight;
+        break;
+    case BlendModeDifference:
+        m_value.ident = CSSValueDifference;
+        break;
+    case BlendModeExclusion:
+        m_value.ident = CSSValueExclusion;
+        break;
+    case BlendModeHue:
+        m_value.ident = CSSValueHue;
+        break;
+    case BlendModeSaturation:
+        m_value.ident = CSSValueSaturation;
+        break;
+    case BlendModeColor:
+        m_value.ident = CSSValueColor;
+        break;
+    case BlendModeLuminosity:
+        m_value.ident = CSSValueLuminosity;
+        break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator BlendMode() const
+{
+    switch (m_value.ident) {
+    case CSSValueNormal:
+        return BlendModeNormal;
+    case CSSValueMultiply:
+        return BlendModeMultiply;
+    case CSSValueScreen:
+        return BlendModeScreen;
+    case CSSValueOverlay:
+        return BlendModeOverlay;
+    case CSSValueDarken:
+        return BlendModeDarken;
+    case CSSValueLighten:
+        return BlendModeLighten;
+    case CSSValueColorDodge:
+        return BlendModeColorDodge;
+    case CSSValueColorBurn:
+        return BlendModeColorBurn;
+    case CSSValueHardLight:
+        return BlendModeHardLight;
+    case CSSValueSoftLight:
+        return BlendModeSoftLight;
+    case CSSValueDifference:
+        return BlendModeDifference;
+    case CSSValueExclusion:
+        return BlendModeExclusion;
+    case CSSValueHue:
+        return BlendModeHue;
+    case CSSValueSaturation:
+        return BlendModeSaturation;
+    case CSSValueColor:
+        return BlendModeColor;
+    case CSSValueLuminosity:
+        return BlendModeLuminosity;
+    default:
+        ASSERT_NOT_REACHED();
+        return BlendModeNormal;
+    }
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
diff --git a/Source/WebCore/css/CSSProperty.cpp b/Source/WebCore/css/CSSProperty.cpp
index 8c82dc65a..0b87cea30 100644
--- a/Source/WebCore/css/CSSProperty.cpp
+++ b/Source/WebCore/css/CSSProperty.cpp
@@ -22,6 +22,7 @@
 #include "CSSProperty.h"
 
 #include "CSSValueList.h"
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 #include "RenderStyleConstants.h"
 #include "StylePropertyShorthand.h"
@@ -339,6 +340,7 @@ bool CSSProperty::isInheritedProperty(CSSPropertyID propertyID)
     case CSSPropertyWebkitPrintColorAdjust:
     case CSSPropertyWebkitRtlOrdering:
     case CSSPropertyWebkitTextCombine:
+    case CSSPropertyWebkitTextDecorationLine:
     case CSSPropertyWebkitTextDecorationsInEffect:
     case CSSPropertyWebkitTextEmphasis:
     case CSSPropertyWebkitTextEmphasisColor:
@@ -682,6 +684,9 @@ bool CSSProperty::isInheritedProperty(CSSPropertyID propertyID)
 #if ENABLE(DASHBOARD_SUPPORT)
     case CSSPropertyWebkitDashboardRegion:
 #endif
+#if ENABLE(WIDGET_REGION)
+    case CSSPropertyWebkitWidgetRegion:
+#endif
         return false;
     case CSSPropertyInvalid:
         ASSERT_NOT_REACHED();
@@ -691,4 +696,10 @@ bool CSSProperty::isInheritedProperty(CSSPropertyID propertyID)
     return false;
 }
 
+void CSSProperty::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_value);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSProperty.h b/Source/WebCore/css/CSSProperty.h
index 712414666..57a30124f 100644
--- a/Source/WebCore/css/CSSProperty.h
+++ b/Source/WebCore/css/CSSProperty.h
@@ -30,6 +30,8 @@
 
 namespace WebCore {
 
+class MemoryObjectInfo;
+
 class CSSProperty {
 public:
     CSSProperty(CSSPropertyID propID, PassRefPtr<CSSValue> value, bool important = false, CSSPropertyID shorthandID = CSSPropertyInvalid, bool implicit = false)
@@ -59,6 +61,8 @@ public:
     static CSSPropertyID resolveDirectionAwareProperty(CSSPropertyID, TextDirection, WritingMode);
     static bool isInheritedProperty(CSSPropertyID);
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     // Make sure the following fits in 4 bytes. Really.
     unsigned m_id : 14;
diff --git a/Source/WebCore/css/CSSPropertyNames.in b/Source/WebCore/css/CSSPropertyNames.in
index 547907efb..0ee20df2b 100644
--- a/Source/WebCore/css/CSSPropertyNames.in
+++ b/Source/WebCore/css/CSSPropertyNames.in
@@ -351,6 +351,7 @@ z-index
 -webkit-rtl-ordering
 -webkit-text-combine
 -epub-text-combine = -webkit-text-combine
+-webkit-text-decoration-line
 -webkit-text-decorations-in-effect
 -webkit-text-emphasis
 -epub-text-emphasis = -webkit-text-emphasis
@@ -401,6 +402,9 @@ z-index
 #if defined(ENABLE_DASHBOARD_SUPPORT) && ENABLE_DASHBOARD_SUPPORT
 -webkit-dashboard-region
 #endif
+#if defined(ENABLE_WIDGET_REGION) && ENABLE_WIDGET_REGION
+-webkit-widget-region
+#endif
 #if defined(ENABLE_OVERFLOW_SCROLLING) && ENABLE_OVERFLOW_SCROLLING
 -webkit-overflow-scrolling
 #endif
diff --git a/Source/WebCore/css/CSSPropertySourceData.h b/Source/WebCore/css/CSSPropertySourceData.h
index 69ee94da0..24daef4a9 100644
--- a/Source/WebCore/css/CSSPropertySourceData.h
+++ b/Source/WebCore/css/CSSPropertySourceData.h
@@ -93,7 +93,8 @@ struct CSSRuleSourceData : public RefCounted<CSSRuleSourceData> {
         MEDIA_RULE,
         FONT_FACE_RULE,
         PAGE_RULE,
-        KEYFRAMES_RULE
+        KEYFRAMES_RULE,
+        REGION_RULE
     };
 
     static PassRefPtr<CSSRuleSourceData> create(Type type)
diff --git a/Source/WebCore/css/CSSReflectValue.cpp b/Source/WebCore/css/CSSReflectValue.cpp
index b36c3ad7b..ede3c9a1f 100644
--- a/Source/WebCore/css/CSSReflectValue.cpp
+++ b/Source/WebCore/css/CSSReflectValue.cpp
@@ -27,6 +27,7 @@
 #include "CSSReflectValue.h"
 
 #include "CSSPrimitiveValue.h"
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 
 using namespace std;
@@ -65,4 +66,11 @@ void CSSReflectValue::addSubresourceStyleURLs(ListHashSet<KURL>& urls, const Sty
         m_mask->addSubresourceStyleURLs(urls, styleSheet);
 }
 
+void CSSReflectValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_offset);
+    info.addInstrumentedMember(m_mask);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSReflectValue.h b/Source/WebCore/css/CSSReflectValue.h
index 5cfb20e27..1bdfd5fe7 100644
--- a/Source/WebCore/css/CSSReflectValue.h
+++ b/Source/WebCore/css/CSSReflectValue.h
@@ -51,6 +51,8 @@ public:
 
     void addSubresourceStyleURLs(ListHashSet<KURL>&, const StyleSheetContents*) const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSReflectValue(CSSReflectionDirection direction, PassRefPtr<CSSPrimitiveValue> offset, PassRefPtr<CSSValue> mask)
         : CSSValue(ReflectClass)
diff --git a/Source/WebCore/css/CSSRule.cpp b/Source/WebCore/css/CSSRule.cpp
index c3105a05e..2915a6e4a 100644
--- a/Source/WebCore/css/CSSRule.cpp
+++ b/Source/WebCore/css/CSSRule.cpp
@@ -164,10 +164,59 @@ void CSSRule::reattach(StyleRuleBase* rule)
     ASSERT_NOT_REACHED();
 }
 
+void CSSRule::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    switch (type()) {
+    case UNKNOWN_RULE:
+        static_cast<const CSSUnknownRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case STYLE_RULE:
+        static_cast<const CSSStyleRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case PAGE_RULE:
+        static_cast<const CSSPageRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case CHARSET_RULE:
+        static_cast<const CSSCharsetRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case IMPORT_RULE:
+        static_cast<const CSSImportRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case MEDIA_RULE:
+        static_cast<const CSSMediaRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case FONT_FACE_RULE:
+        static_cast<const CSSFontFaceRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case WEBKIT_KEYFRAMES_RULE:
+        static_cast<const WebKitCSSKeyframesRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case WEBKIT_KEYFRAME_RULE:
+        static_cast<const WebKitCSSKeyframeRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#if ENABLE(CSS_REGIONS)
+    case WEBKIT_REGION_RULE:
+        static_cast<const WebKitCSSRegionRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#endif
+    }
+    ASSERT_NOT_REACHED();
+    return;
+}
+
 const CSSParserContext& CSSRule::parserContext() const
 {
     CSSStyleSheet* styleSheet = parentStyleSheet();
     return styleSheet ? styleSheet->contents()->parserContext() : strictCSSParserContext();
 }
 
+void CSSRule::reportBaseClassMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    if (m_parentIsRule)
+        info.addInstrumentedMember(m_parentRule);
+    else
+        info.addInstrumentedMember(m_parentStyleSheet);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSRule.h b/Source/WebCore/css/CSSRule.h
index e38e161dc..65df6221c 100644
--- a/Source/WebCore/css/CSSRule.h
+++ b/Source/WebCore/css/CSSRule.h
@@ -30,6 +30,7 @@
 namespace WebCore {
 
 class CSSStyleSheet;
+class MemoryObjectInfo;
 class StyleRuleBase;
 struct CSSParserContext;
 typedef int ExceptionCode;
@@ -103,6 +104,8 @@ public:
 
     void reattach(StyleRuleBase*);
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
     CSSRule(CSSStyleSheet* parent, Type type)
         : m_hasCachedSelectorText(false)
@@ -122,6 +125,8 @@ protected:
 
     const CSSParserContext& parserContext() const;
 
+    void reportBaseClassMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     mutable unsigned m_hasCachedSelectorText : 1;
     unsigned m_parentIsRule : 1;
diff --git a/Source/WebCore/css/CSSRuleList.cpp b/Source/WebCore/css/CSSRuleList.cpp
index a158d6f2e..aed1a7cd9 100644
--- a/Source/WebCore/css/CSSRuleList.cpp
+++ b/Source/WebCore/css/CSSRuleList.cpp
@@ -51,4 +51,10 @@ void StaticCSSRuleList::deref()
         delete this;
 }
 
+void StaticCSSRuleList::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedVector(m_rules);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSRuleList.h b/Source/WebCore/css/CSSRuleList.h
index c6e75c86e..311ead529 100644
--- a/Source/WebCore/css/CSSRuleList.h
+++ b/Source/WebCore/css/CSSRuleList.h
@@ -22,6 +22,7 @@
 #ifndef CSSRuleList_h
 #define CSSRuleList_h
 
+#include "MemoryInstrumentation.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -45,6 +46,8 @@ public:
     virtual CSSRule* item(unsigned index) const = 0;
     
     virtual CSSStyleSheet* styleSheet() const = 0;
+
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const = 0;
     
 protected:
     CSSRuleList();
@@ -61,6 +64,8 @@ public:
     
     virtual CSSStyleSheet* styleSheet() const { return 0; }
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 private:    
     StaticCSSRuleList();
     ~StaticCSSRuleList();
@@ -80,6 +85,12 @@ public:
     
     virtual void ref() { m_rule->ref(); }
     virtual void deref() { m_rule->deref(); }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const OVERRIDE
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+        info.addInstrumentedMember(m_rule);
+    }
     
 private:
     virtual unsigned length() const { return m_rule->length(); }
diff --git a/Source/WebCore/css/CSSSelectorList.cpp b/Source/WebCore/css/CSSSelectorList.cpp
index fb3d1f12f..3cf020a72 100644
--- a/Source/WebCore/css/CSSSelectorList.cpp
+++ b/Source/WebCore/css/CSSSelectorList.cpp
@@ -28,6 +28,7 @@
 #include "CSSSelectorList.h"
 
 #include "CSSParserValues.h"
+#include "MemoryInstrumentation.h"
 #include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
@@ -39,10 +40,7 @@ CSSSelectorList::~CSSSelectorList()
 
 CSSSelectorList::CSSSelectorList(const CSSSelectorList& o)
 {
-    CSSSelector* current = o.m_selectorArray;
-    while (!current->isLastInSelectorList())
-        ++current;
-    unsigned length = (current - o.m_selectorArray) + 1;
+    unsigned length = o.length();
     if (length == 1) {
         // Destructor expects a single selector to be allocated by new, multiple with fastMalloc.
         m_selectorArray = new CSSSelector(o.m_selectorArray[0]);
@@ -60,7 +58,7 @@ void CSSSelectorList::adopt(CSSSelectorList& list)
     list.m_selectorArray = 0;
 }
 
-void CSSSelectorList::adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectorVector)
+void CSSSelectorList::adoptSelectorVector(CSSSelectorVector& selectorVector)
 {
     deleteSelectors();
     const size_t vectorSize = selectorVector.size();
@@ -97,6 +95,16 @@ void CSSSelectorList::adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& se
     selectorVector.shrink(0);
 }
 
+unsigned CSSSelectorList::length() const
+{
+    if (!m_selectorArray)
+        return 0;
+    CSSSelector* current = m_selectorArray;
+    while (!current->isLastInSelectorList())
+        ++current;
+    return (current - m_selectorArray) + 1;
+}
+
 void CSSSelectorList::deleteSelectors()
 {
     if (!m_selectorArray)
@@ -135,6 +143,12 @@ String CSSSelectorList::selectorsText() const
     return result.toString();
 }
 
+void CSSSelectorList::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addRawBuffer(m_selectorArray, length() * sizeof(CSSSelector));
+}
+
 template <typename Functor>
 static bool forEachTagSelector(Functor& functor, CSSSelector* selector)
 {
diff --git a/Source/WebCore/css/CSSSelectorList.h b/Source/WebCore/css/CSSSelectorList.h
index e0aa65c02..c160020e3 100644
--- a/Source/WebCore/css/CSSSelectorList.h
+++ b/Source/WebCore/css/CSSSelectorList.h
@@ -26,11 +26,13 @@
 #ifndef CSSSelectorList_h
 #define CSSSelectorList_h
 
+#include "CSSParserValues.h"
 #include "CSSSelector.h"
 
 namespace WebCore {
 
 class CSSParserSelector;
+class MemoryObjectInfo;
 
 class CSSSelectorList {
     WTF_MAKE_FAST_ALLOCATED;
@@ -41,18 +43,31 @@ public:
     ~CSSSelectorList();
 
     void adopt(CSSSelectorList& list);
-    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectorVector);
+    void adoptSelectorVector(CSSSelectorVector&);
 
     CSSSelector* first() const { return m_selectorArray ? m_selectorArray : 0; }
     static CSSSelector* next(CSSSelector*);
     bool hasOneSelector() const { return m_selectorArray && !next(m_selectorArray); }
+    CSSSelector* selectorAt(size_t index) const { return &m_selectorArray[index]; }
+
+    size_t indexOfNextSelectorAfter(size_t index) const
+    {
+        CSSSelector* current = selectorAt(index);
+        current = next(current);
+        if (!current)
+            return notFound;
+        return current - m_selectorArray;
+    }
 
     bool selectorsNeedNamespaceResolution();
     bool hasUnknownPseudoElements() const;
 
     String selectorsText() const;
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
+    unsigned length() const;
     void deleteSelectors();
 
     // End of a multipart selector is indicated by m_isLastInTagHistory bit in the last item.
diff --git a/Source/WebCore/css/CSSStyleDeclaration.h b/Source/WebCore/css/CSSStyleDeclaration.h
index 5d88ebd07..35a08fe52 100644
--- a/Source/WebCore/css/CSSStyleDeclaration.h
+++ b/Source/WebCore/css/CSSStyleDeclaration.h
@@ -30,6 +30,7 @@ namespace WebCore {
 class CSSProperty;
 class CSSStyleSheet;
 class CSSValue;
+class MemoryObjectInfo;
 class StylePropertySet;
 class StyledElement;
 
@@ -69,6 +70,8 @@ public:
     virtual bool cssPropertyMatches(const CSSProperty*) const = 0;
     virtual CSSStyleSheet* parentStyleSheet() const { return 0; }
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const = 0;
+
 protected:
     CSSStyleDeclaration() { }
 };
diff --git a/Source/WebCore/css/CSSStyleRule.cpp b/Source/WebCore/css/CSSStyleRule.cpp
index 1eeb32d42..7f82ae593 100644
--- a/Source/WebCore/css/CSSStyleRule.cpp
+++ b/Source/WebCore/css/CSSStyleRule.cpp
@@ -26,6 +26,7 @@
 #include "CSSSelector.h"
 #include "CSSStyleSheet.h"
 #include "Document.h"
+#include "MemoryInstrumentation.h"
 #include "PropertySetCSSStyleDeclaration.h"
 #include "StylePropertySet.h"
 #include "StyleRule.h"
@@ -127,4 +128,12 @@ void CSSStyleRule::reattach(StyleRule* rule)
         m_propertiesCSSOMWrapper->reattach(m_styleRule->mutableProperties());
 }
 
+void CSSStyleRule::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSRule::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_styleRule);
+    info.addInstrumentedMember(m_propertiesCSSOMWrapper);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSStyleRule.h b/Source/WebCore/css/CSSStyleRule.h
index d76a802fa..f96cb16cf 100644
--- a/Source/WebCore/css/CSSStyleRule.h
+++ b/Source/WebCore/css/CSSStyleRule.h
@@ -50,6 +50,8 @@ public:
 
     void reattach(StyleRule*);
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSStyleRule(StyleRule*, CSSStyleSheet*);
 
diff --git a/Source/WebCore/css/CSSStyleSheet.cpp b/Source/WebCore/css/CSSStyleSheet.cpp
index 00b2d91c5..523a895f5 100644
--- a/Source/WebCore/css/CSSStyleSheet.cpp
+++ b/Source/WebCore/css/CSSStyleSheet.cpp
@@ -32,6 +32,7 @@
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "MediaList.h"
+#include "MemoryInstrumentation.h"
 #include "Node.h"
 #include "SVGNames.h"
 #include "SecurityOrigin.h"
@@ -52,6 +53,12 @@ private:
     virtual CSSRule* item(unsigned index) const { return m_styleSheet->item(index); }
     
     virtual CSSStyleSheet* styleSheet() const { return m_styleSheet; }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const OVERRIDE
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+        info.addInstrumentedMember(m_styleSheet);
+    }
     
     CSSStyleSheet* m_styleSheet;
 };
@@ -168,6 +175,18 @@ void CSSStyleSheet::reattachChildRuleCSSOMWrappers()
     }
 }
 
+void CSSStyleSheet::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_contents);
+    info.addMember(m_title);
+    info.addInstrumentedMember(m_mediaQueries);
+    info.addInstrumentedMember(m_ownerNode);
+    info.addInstrumentedMember(m_ownerRule);
+    info.addInstrumentedMember(m_mediaCSSOMWrapper);
+    info.addInstrumentedVector(m_childRuleCSSOMWrappers);
+}
+
 void CSSStyleSheet::setDisabled(bool disabled)
 { 
     if (disabled == m_isDisabled)
diff --git a/Source/WebCore/css/CSSStyleSheet.h b/Source/WebCore/css/CSSStyleSheet.h
index 5a839e0ee..f38472dca 100644
--- a/Source/WebCore/css/CSSStyleSheet.h
+++ b/Source/WebCore/css/CSSStyleSheet.h
@@ -39,6 +39,7 @@ class CSSStyleSheet;
 class CachedCSSStyleSheet;
 class Document;
 class MediaQuerySet;
+class MemoryObjectInfo;
 class SecurityOrigin;
 class StyleSheetContents;
 
@@ -105,6 +106,8 @@ public:
 
     StyleSheetContents* contents() const { return m_contents.get(); }
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSStyleSheet(PassRefPtr<StyleSheetContents>, CSSImportRule* ownerRule);
     CSSStyleSheet(PassRefPtr<StyleSheetContents>, Node* ownerNode);
diff --git a/Source/WebCore/css/CSSTimingFunctionValue.cpp b/Source/WebCore/css/CSSTimingFunctionValue.cpp
index dcf7bb29b..9abb19e69 100644
--- a/Source/WebCore/css/CSSTimingFunctionValue.cpp
+++ b/Source/WebCore/css/CSSTimingFunctionValue.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "CSSTimingFunctionValue.h"
 
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 
 namespace WebCore {
@@ -35,6 +36,11 @@ String CSSLinearTimingFunctionValue::customCssText() const
     return "linear";
 }
 
+void CSSLinearTimingFunctionValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+}
+
 String CSSCubicBezierTimingFunctionValue::customCssText() const
 {
     String text("cubic-bezier(");
@@ -49,6 +55,11 @@ String CSSCubicBezierTimingFunctionValue::customCssText() const
     return text;
 }
 
+void CSSCubicBezierTimingFunctionValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+}
+
 String CSSStepsTimingFunctionValue::customCssText() const
 {
     String text("steps(");
@@ -59,4 +70,9 @@ String CSSStepsTimingFunctionValue::customCssText() const
     return text;
 }
 
+void CSSStepsTimingFunctionValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSTimingFunctionValue.h b/Source/WebCore/css/CSSTimingFunctionValue.h
index e544c5ff0..3eb4b2295 100644
--- a/Source/WebCore/css/CSSTimingFunctionValue.h
+++ b/Source/WebCore/css/CSSTimingFunctionValue.h
@@ -40,6 +40,8 @@ public:
 
     String customCssText() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSLinearTimingFunctionValue()
         : CSSValue(LinearTimingFunctionClass)
@@ -61,6 +63,8 @@ public:
     double x2() const { return m_x2; }
     double y2() const { return m_y2; }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSCubicBezierTimingFunctionValue(double x1, double y1, double x2, double y2)
         : CSSValue(CubicBezierTimingFunctionClass)
@@ -89,6 +93,8 @@ public:
 
     String customCssText() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSStepsTimingFunctionValue(int steps, bool stepAtStart)
         : CSSValue(StepsTimingFunctionClass)
diff --git a/Source/WebCore/css/CSSUnicodeRangeValue.cpp b/Source/WebCore/css/CSSUnicodeRangeValue.cpp
index 2c2c44d27..abd806df4 100644
--- a/Source/WebCore/css/CSSUnicodeRangeValue.cpp
+++ b/Source/WebCore/css/CSSUnicodeRangeValue.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "CSSUnicodeRangeValue.h"
 
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 
 namespace WebCore {
@@ -37,4 +38,9 @@ String CSSUnicodeRangeValue::customCssText() const
     return result;
 }
 
+void CSSUnicodeRangeValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+}
+
 }
diff --git a/Source/WebCore/css/CSSUnicodeRangeValue.h b/Source/WebCore/css/CSSUnicodeRangeValue.h
index 4fe1db77c..d50f5b681 100644
--- a/Source/WebCore/css/CSSUnicodeRangeValue.h
+++ b/Source/WebCore/css/CSSUnicodeRangeValue.h
@@ -44,6 +44,8 @@ public:
 
     String customCssText() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CSSUnicodeRangeValue(UChar32 from, UChar32 to)
         : CSSValue(UnicodeRangeClass)
diff --git a/Source/WebCore/css/CSSUnknownRule.h b/Source/WebCore/css/CSSUnknownRule.h
index 9f746ba0e..ab68aef9e 100644
--- a/Source/WebCore/css/CSSUnknownRule.h
+++ b/Source/WebCore/css/CSSUnknownRule.h
@@ -23,12 +23,19 @@
 #define CSSUnknownRule_h
 
 #include "CSSRule.h"
+#include "MemoryInstrumentation.h"
 
 namespace WebCore {
 
 class CSSUnknownRule : public CSSRule {
 public:
     CSSUnknownRule() : CSSRule(0, CSSRule::UNKNOWN_RULE) { }
+
+    void reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+        CSSRule::reportBaseClassMemoryUsage(memoryObjectInfo);
+    }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSValue.cpp b/Source/WebCore/css/CSSValue.cpp
index cda43b9cf..da1ac3314 100644
--- a/Source/WebCore/css/CSSValue.cpp
+++ b/Source/WebCore/css/CSSValue.cpp
@@ -52,10 +52,12 @@
 #endif
 #include "FontValue.h"
 #include "FontFeatureValue.h"
+#include "MemoryInstrumentation.h"
 #include "ShadowValue.h"
 #include "SVGColor.h"
 #include "SVGPaint.h"
 #include "WebKitCSSFilterValue.h"
+#include "WebKitCSSMixFunctionValue.h"
 #include "WebKitCSSShaderValue.h"
 #include "WebKitCSSTransformValue.h"
 
@@ -77,6 +79,12 @@ public:
 
     String cssText() const { return m_cssText; }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+        info.addMember(m_cssText);
+    }
+
 private:
     TextCloneCSSValue(ClassType classType, const String& text) 
         : CSSValue(classType, /*isCSSOMSafe*/ true)
@@ -121,6 +129,149 @@ void CSSValue::addSubresourceStyleURLs(ListHashSet<KURL>& urls, const StyleSheet
         static_cast<const CSSReflectValue*>(this)->addSubresourceStyleURLs(urls, styleSheet);
 }
 
+bool CSSValue::hasFailedOrCanceledSubresources() const
+{
+    // This should get called for internal instances only.
+    ASSERT(!isCSSOMSafe());
+
+    if (isValueList())
+        return static_cast<const CSSValueList*>(this)->hasFailedOrCanceledSubresources();
+    if (classType() == FontFaceSrcClass)
+        return static_cast<const CSSFontFaceSrcValue*>(this)->hasFailedOrCanceledSubresources();
+    if (classType() == ImageClass)
+        return static_cast<const CSSImageValue*>(this)->hasFailedOrCanceledSubresources();
+    if (classType() == CrossfadeClass)
+        return static_cast<const CSSCrossfadeValue*>(this)->hasFailedOrCanceledSubresources();
+#if ENABLE(CSS_IMAGE_SET)
+    if (classType() == ImageSetClass)
+        return static_cast<const CSSImageSetValue*>(this)->hasFailedOrCanceledSubresources();
+#endif
+    return false;
+}
+
+void CSSValue::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    if (m_isTextClone) {
+        ASSERT(isCSSOMSafe());
+        static_cast<const TextCloneCSSValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    }
+
+    ASSERT(!isCSSOMSafe() || isSubtypeExposedToCSSOM());
+    switch (classType()) {
+    case PrimitiveClass:
+        static_cast<const CSSPrimitiveValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case ImageClass:
+        static_cast<const CSSImageValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case CursorImageClass:
+        static_cast<const CSSCursorImageValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case CanvasClass:
+        static_cast<const CSSCanvasValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case CrossfadeClass:
+        static_cast<const CSSCrossfadeValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case LinearGradientClass:
+        static_cast<const CSSLinearGradientValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case RadialGradientClass:
+        static_cast<const CSSRadialGradientValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case CubicBezierTimingFunctionClass:
+        static_cast<const CSSCubicBezierTimingFunctionValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case LinearTimingFunctionClass:
+        static_cast<const CSSLinearTimingFunctionValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case StepsTimingFunctionClass:
+        static_cast<const CSSStepsTimingFunctionValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case AspectRatioClass:
+        static_cast<const CSSAspectRatioValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case BorderImageSliceClass:
+        static_cast<const CSSBorderImageSliceValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case FontFeatureClass:
+        static_cast<const FontFeatureValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case FontClass:
+        static_cast<const FontValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case FontFaceSrcClass:
+        static_cast<const CSSFontFaceSrcValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case FunctionClass:
+        static_cast<const CSSFunctionValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case InheritedClass:
+        static_cast<const CSSInheritedValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case InitialClass:
+        static_cast<const CSSInitialValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case ReflectClass:
+        static_cast<const CSSReflectValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case ShadowClass:
+        static_cast<const ShadowValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case UnicodeRangeClass:
+        static_cast<const CSSUnicodeRangeValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case LineBoxContainClass:
+        static_cast<const CSSLineBoxContainValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case CalculationClass:
+        static_cast<const CSSCalcValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#if ENABLE(CSS_FILTERS) && ENABLE(CSS_SHADERS)
+    case WebKitCSSMixFunctionValueClass:
+        static_cast<const WebKitCSSMixFunctionValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case WebKitCSSShaderClass:
+        static_cast<const WebKitCSSShaderValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#endif
+#if ENABLE(CSS_VARIABLES)
+    case VariableClass:
+        static_cast<const CSSVariableValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#endif
+#if ENABLE(SVG)
+    case SVGColorClass:
+        static_cast<const SVGColor*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case SVGPaintClass:
+        static_cast<const SVGPaint*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case WebKitCSSSVGDocumentClass:
+        static_cast<const WebKitCSSSVGDocumentValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#endif
+    case ValueListClass:
+        static_cast<const CSSValueList*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#if ENABLE(CSS_IMAGE_SET)
+    case ImageSetClass:
+        static_cast<const CSSImageSetValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#endif
+#if ENABLE(CSS_FILTERS)
+    case WebKitCSSFilterClass:
+        static_cast<const WebKitCSSFilterValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#endif
+    case WebKitCSSTransformClass:
+        static_cast<const WebKitCSSTransformValue*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
 String CSSValue::cssText() const
 {
     if (m_isTextClone) {
@@ -188,6 +339,8 @@ String CSSValue::cssText() const
     case WebKitCSSFilterClass:
         return static_cast<const WebKitCSSFilterValue*>(this)->customCssText();
 #if ENABLE(CSS_SHADERS)
+    case WebKitCSSMixFunctionValueClass:
+        return static_cast<const WebKitCSSMixFunctionValue*>(this)->customCssText();
     case WebKitCSSShaderClass:
         return static_cast<const WebKitCSSShaderValue*>(this)->customCssText();
 #endif
@@ -320,6 +473,9 @@ void CSSValue::destroy()
         delete static_cast<WebKitCSSFilterValue*>(this);
         return;
 #if ENABLE(CSS_SHADERS)
+    case WebKitCSSMixFunctionValueClass:
+        delete static_cast<WebKitCSSMixFunctionValue*>(this);
+        return;
     case WebKitCSSShaderClass:
         delete static_cast<WebKitCSSShaderValue*>(this);
         return;
@@ -358,6 +514,10 @@ PassRefPtr<CSSValue> CSSValue::cloneForCSSOM() const
 #if ENABLE(CSS_FILTERS)
     case WebKitCSSFilterClass:
         return static_cast<const WebKitCSSFilterValue*>(this)->cloneForCSSOM();
+#if ENABLE(CSS_SHADERS)
+    case WebKitCSSMixFunctionValueClass:
+        return static_cast<const WebKitCSSMixFunctionValue*>(this)->cloneForCSSOM();
+#endif
 #endif
     case WebKitCSSTransformClass:
         return static_cast<const WebKitCSSTransformValue*>(this)->cloneForCSSOM();
diff --git a/Source/WebCore/css/CSSValue.h b/Source/WebCore/css/CSSValue.h
index 93a6d4a91..63b8a2586 100644
--- a/Source/WebCore/css/CSSValue.h
+++ b/Source/WebCore/css/CSSValue.h
@@ -29,6 +29,7 @@
 
 namespace WebCore {
 
+class MemoryObjectInfo;
 class StyleSheetContents;
     
 // FIXME: The current CSSValue and subclasses should be turned into internal types (StyleValue).
@@ -91,6 +92,7 @@ public:
 #if ENABLE(CSS_FILTERS)
     bool isWebKitCSSFilterValue() const { return m_classType == WebKitCSSFilterClass; }
 #if ENABLE(CSS_SHADERS)
+    bool isWebKitCSSMixFunctionValue() const { return m_classType == WebKitCSSMixFunctionValueClass; }
     bool isWebKitCSSShaderValue() const { return m_classType == WebKitCSSShaderClass; }
 #endif
 #endif // ENABLE(CSS_FILTERS)
@@ -117,9 +119,13 @@ public:
 
     void addSubresourceStyleURLs(ListHashSet<KURL>&, const StyleSheetContents*) const;
 
+    bool hasFailedOrCanceledSubresources() const;
+
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
 
-    static const size_t ClassTypeBits = 5;
+    static const size_t ClassTypeBits = 6;
     enum ClassType {
         PrimitiveClass,
 
@@ -173,6 +179,9 @@ protected:
 #endif
 #if ENABLE(CSS_FILTERS)
         WebKitCSSFilterClass,
+#if ENABLE(CSS_SHADERS)
+        WebKitCSSMixFunctionValueClass,
+#endif
 #endif
         WebKitCSSTransformClass,
         // Do not append non-list class types here.
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index b6350722b..4af25f80c 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -937,6 +937,23 @@ filter-box
 detached
 #endif // CSS_SHADERS
 #endif // CSS_FILTERS
+// blend modes
+// normal
+multiply
+screen
+// overlay
+darken
+lighten
+color-dodge
+color-burn
+hard-light
+soft-light
+difference
+exclusion
+hue
+saturation
+color
+luminosity
 
 #if defined(ENABLE_CSS_IMAGE_RESOLUTION) && ENABLE_CSS_IMAGE_RESOLUTION
 from-image
diff --git a/Source/WebCore/css/CSSValueList.cpp b/Source/WebCore/css/CSSValueList.cpp
index 06f093e1f..0b7ac7380 100644
--- a/Source/WebCore/css/CSSValueList.cpp
+++ b/Source/WebCore/css/CSSValueList.cpp
@@ -22,6 +22,7 @@
 #include "CSSValueList.h"
 
 #include "CSSParserValues.h"
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/StringBuilder.h>
@@ -173,6 +174,15 @@ void CSSValueList::addSubresourceStyleURLs(ListHashSet<KURL>& urls, const StyleS
         m_values[i]->addSubresourceStyleURLs(urls, styleSheet);
 }
 
+bool CSSValueList::hasFailedOrCanceledSubresources() const
+{
+    for (unsigned i = 0; i < m_values.size(); ++i) {
+        if (m_values[i]->hasFailedOrCanceledSubresources())
+            return true;
+    }
+    return false;
+}
+
 CSSValueList::CSSValueList(const CSSValueList& cloneFrom)
     : CSSValue(cloneFrom.classType(), /* isCSSOMSafe */ true)
 {
@@ -187,4 +197,10 @@ PassRefPtr<CSSValueList> CSSValueList::cloneForCSSOM() const
     return adoptRef(new CSSValueList(*this));
 }
 
+void CSSValueList::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedVector(m_values);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSValueList.h b/Source/WebCore/css/CSSValueList.h
index 94643daad..e988d6c2e 100644
--- a/Source/WebCore/css/CSSValueList.h
+++ b/Source/WebCore/css/CSSValueList.h
@@ -64,9 +64,13 @@ public:
 #endif
 
     void addSubresourceStyleURLs(ListHashSet<KURL>&, const StyleSheetContents*) const;
+
+    bool hasFailedOrCanceledSubresources() const;
     
     PassRefPtr<CSSValueList> cloneForCSSOM() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
     CSSValueList(ClassType, ValueListSeparator);
     CSSValueList(const CSSValueList& cloneFrom);
diff --git a/Source/WebCore/css/CSSVariableValue.h b/Source/WebCore/css/CSSVariableValue.h
index 2c5b66a6b..e0b97d3ff 100644
--- a/Source/WebCore/css/CSSVariableValue.h
+++ b/Source/WebCore/css/CSSVariableValue.h
@@ -34,6 +34,7 @@
 #include "CSSParserValues.h"
 #include "CSSPropertyNames.h"
 #include "CSSValue.h"
+#include "MemoryInstrumentation.h"
 
 namespace WebCore {
 
@@ -47,6 +48,13 @@ public:
     const AtomicString& name() const { return m_name; }
     const String& value() const { return m_value; }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+        info.addMember(m_name);
+        info.addMember(m_value);
+    }
+
 private:
     CSSVariableValue(const AtomicString& name, const String& value)
         : CSSValue(VariableClass)
diff --git a/Source/WebCore/css/DashboardRegion.h b/Source/WebCore/css/DashboardRegion.h
index 91e5d7ae1..a698e4919 100644
--- a/Source/WebCore/css/DashboardRegion.h
+++ b/Source/WebCore/css/DashboardRegion.h
@@ -23,7 +23,7 @@
 
 #include "Rect.h"
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 
 namespace WebCore {
 
@@ -37,6 +37,11 @@ public:
     bool m_isCircle : 1;
     bool m_isRectangle : 1;
 
+#if ENABLE(DASHBOARD_SUPPORT) && ENABLE(WIDGET_REGION)
+    // Used to tell different CSS function name when both features are enabled.
+    String m_cssFunctionName;
+#endif
+
 private:
     DashboardRegion() : m_isCircle(false), m_isRectangle(false) { }
 };
diff --git a/Source/WebCore/css/FontFeatureValue.cpp b/Source/WebCore/css/FontFeatureValue.cpp
index 62c396068..491b192e6 100644
--- a/Source/WebCore/css/FontFeatureValue.cpp
+++ b/Source/WebCore/css/FontFeatureValue.cpp
@@ -28,6 +28,7 @@
 
 #include "CSSParser.h"
 #include "CSSValueKeywords.h"
+#include "MemoryInstrumentation.h"
 #include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
@@ -49,4 +50,10 @@ String FontFeatureValue::customCssText() const
     return builder.toString();
 }
 
+void FontFeatureValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_tag);
+}
+
 }
diff --git a/Source/WebCore/css/FontFeatureValue.h b/Source/WebCore/css/FontFeatureValue.h
index 7d5e036c0..28d89f423 100644
--- a/Source/WebCore/css/FontFeatureValue.h
+++ b/Source/WebCore/css/FontFeatureValue.h
@@ -42,6 +42,8 @@ public:
     int value() const { return m_value; }
     String customCssText() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     FontFeatureValue(const String&, int);
 
diff --git a/Source/WebCore/css/FontValue.cpp b/Source/WebCore/css/FontValue.cpp
index 8841a7993..4f8742c70 100644
--- a/Source/WebCore/css/FontValue.cpp
+++ b/Source/WebCore/css/FontValue.cpp
@@ -22,6 +22,7 @@
 
 #include "CSSValueList.h"
 #include "CSSPrimitiveValue.h"
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 #include <wtf/text/StringBuilder.h>
 
@@ -65,4 +66,15 @@ String FontValue::customCssText() const
     return result.toString();
 }
 
+void FontValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(style);
+    info.addInstrumentedMember(variant);
+    info.addInstrumentedMember(weight);
+    info.addInstrumentedMember(size);
+    info.addInstrumentedMember(lineHeight);
+    info.addInstrumentedMember(family);
+}
+
 }
diff --git a/Source/WebCore/css/FontValue.h b/Source/WebCore/css/FontValue.h
index 5f8336921..03a61268a 100644
--- a/Source/WebCore/css/FontValue.h
+++ b/Source/WebCore/css/FontValue.h
@@ -39,6 +39,8 @@ public:
 
     String customCssText() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
     RefPtr<CSSPrimitiveValue> style;
     RefPtr<CSSPrimitiveValue> variant;
     RefPtr<CSSPrimitiveValue> weight;
diff --git a/Source/WebCore/css/MediaList.cpp b/Source/WebCore/css/MediaList.cpp
index 5fc793e31..5ba7341eb 100644
--- a/Source/WebCore/css/MediaList.cpp
+++ b/Source/WebCore/css/MediaList.cpp
@@ -26,6 +26,7 @@
 #include "ExceptionCode.h"
 #include "MediaQuery.h"
 #include "MediaQueryExp.h"
+#include "MemoryInstrumentation.h"
 
 namespace WebCore {
 
@@ -209,6 +210,12 @@ String MediaQuerySet::mediaText() const
     }
     return text;
 }
+
+void MediaQuerySet::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedVector(m_queries);
+}
     
 MediaList::MediaList(MediaQuerySet* mediaQueries, CSSStyleSheet* parentSheet)
     : m_mediaQueries(mediaQueries)
@@ -282,4 +289,10 @@ void MediaList::reattach(MediaQuerySet* mediaQueries)
     m_mediaQueries = mediaQueries;
 }
 
+void MediaList::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_mediaQueries);
+}
+
 }
diff --git a/Source/WebCore/css/MediaList.h b/Source/WebCore/css/MediaList.h
index 32d0ec37d..55f0fc14b 100644
--- a/Source/WebCore/css/MediaList.h
+++ b/Source/WebCore/css/MediaList.h
@@ -34,6 +34,7 @@ class CSSRule;
 class CSSStyleSheet;
 class MediaList;
 class MediaQuery;
+class MemoryObjectInfo;
 
 class MediaQuerySet : public RefCounted<MediaQuerySet> {
 public:
@@ -66,6 +67,8 @@ public:
 
     PassRefPtr<MediaQuerySet> copy() const { return adoptRef(new MediaQuerySet(*this)); }
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     MediaQuerySet();
     MediaQuerySet(const String& mediaQuery, bool fallbackToDescription);
@@ -106,6 +109,8 @@ public:
 
     void reattach(MediaQuerySet*);
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     MediaList();
     MediaList(MediaQuerySet*, CSSStyleSheet* parentSheet);
diff --git a/Source/WebCore/css/MediaQuery.cpp b/Source/WebCore/css/MediaQuery.cpp
index 704c00a59..1aabd69d4 100644
--- a/Source/WebCore/css/MediaQuery.cpp
+++ b/Source/WebCore/css/MediaQuery.cpp
@@ -30,6 +30,7 @@
 #include "MediaQuery.h"
 
 #include "MediaQueryExp.h"
+#include "MemoryInstrumentation.h"
 #include <wtf/NonCopyingSort.h>
 #include <wtf/text/StringBuilder.h>
 
@@ -133,4 +134,12 @@ String MediaQuery::cssText() const
     return m_serializationCache;
 }
 
+void MediaQuery::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_mediaType);
+    info.addInstrumentedVectorPtr(m_expressions);
+    info.addMember(m_serializationCache);
+}
+
 } //namespace
diff --git a/Source/WebCore/css/MediaQuery.h b/Source/WebCore/css/MediaQuery.h
index 398e84527..f37c76492 100644
--- a/Source/WebCore/css/MediaQuery.h
+++ b/Source/WebCore/css/MediaQuery.h
@@ -36,6 +36,7 @@
 
 namespace WebCore {
 class MediaQueryExp;
+class MemoryObjectInfo;
 
 class MediaQuery {
     WTF_MAKE_FAST_ALLOCATED;
@@ -58,6 +59,8 @@ public:
 
     PassOwnPtr<MediaQuery> copy() const { return adoptPtr(new MediaQuery(*this)); }
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
  private:
     MediaQuery(const MediaQuery&);
 
diff --git a/Source/WebCore/css/MediaQueryExp.cpp b/Source/WebCore/css/MediaQueryExp.cpp
index 770d88273..3c778956c 100644
--- a/Source/WebCore/css/MediaQueryExp.cpp
+++ b/Source/WebCore/css/MediaQueryExp.cpp
@@ -32,6 +32,7 @@
 #include "CSSParser.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSValueList.h"
+#include "MemoryInstrumentation.h"
 #include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
@@ -108,4 +109,12 @@ String MediaQueryExp::serialize() const
     return m_serializationCache;
 }
 
+void MediaQueryExp::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_mediaFeature);
+    info.addMember(m_serializationCache);
+    info.addInstrumentedMember(m_value);
+}
+
 } // namespace
diff --git a/Source/WebCore/css/MediaQueryExp.h b/Source/WebCore/css/MediaQueryExp.h
index 003de02b5..e77ea1790 100644
--- a/Source/WebCore/css/MediaQueryExp.h
+++ b/Source/WebCore/css/MediaQueryExp.h
@@ -37,6 +37,7 @@
 
 namespace WebCore {
 class CSSParserValueList;
+class MemoryObjectInfo;
 
 class MediaQueryExp {
     WTF_MAKE_FAST_ALLOCATED;
@@ -72,6 +73,8 @@ public:
 
     PassOwnPtr<MediaQueryExp> copy() const { return adoptPtr(new MediaQueryExp(*this)); }
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     MediaQueryExp(const AtomicString& mediaFeature, CSSParserValueList* values);
 
diff --git a/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp b/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
index 8a0afd6e8..0c555804e 100644
--- a/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
+++ b/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
@@ -26,6 +26,7 @@
 #include "CSSStyleSheet.h"
 #include "HTMLNames.h"
 #include "InspectorInstrumentation.h"
+#include "MemoryInstrumentation.h"
 #include "MutationObserverInterestGroup.h"
 #include "MutationRecord.h"
 #include "StylePropertySet.h"
@@ -130,21 +131,29 @@ void PropertySetCSSStyleDeclaration::deref()
     m_propertySet->deref(); 
 }
 
+void PropertySetCSSStyleDeclaration::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_propertySet);
+    if (m_cssomCSSValueClones)
+        info.addInstrumentedMapEntries(*m_cssomCSSValueClones);
+}
+
 unsigned PropertySetCSSStyleDeclaration::length() const
 {
-    return propertySet()->propertyCount();
+    return m_propertySet->propertyCount();
 }
 
 String PropertySetCSSStyleDeclaration::item(unsigned i) const
 {
-    if (i >= propertySet()->propertyCount())
+    if (i >= m_propertySet->propertyCount())
         return "";
-    return getPropertyName(propertySet()->propertyAt(i).id());
+    return getPropertyName(m_propertySet->propertyAt(i).id());
 }
 
 String PropertySetCSSStyleDeclaration::cssText() const
 {
-    return propertySet()->asText();
+    return m_propertySet->asText();
 }
     
 void PropertySetCSSStyleDeclaration::setCssText(const String& text, ExceptionCode& ec)
@@ -156,7 +165,7 @@ void PropertySetCSSStyleDeclaration::setCssText(const String& text, ExceptionCod
 
     ec = 0;
     // FIXME: Detect syntax errors and set ec.
-    ensureMutablePropertySet()->parseDeclaration(text, contextStyleSheet());
+    m_propertySet->parseDeclaration(text, contextStyleSheet());
 
     didMutate(PropertyChanged);
 
@@ -170,7 +179,7 @@ PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValue(const S
     CSSPropertyID propertyID = cssPropertyID(propertyName);
     if (!propertyID)
         return 0;
-    return cloneAndCacheForCSSOM(propertySet()->getPropertyCSSValue(propertyID).get());
+    return cloneAndCacheForCSSOM(m_propertySet->getPropertyCSSValue(propertyID).get());
 }
 
 String PropertySetCSSStyleDeclaration::getPropertyValue(const String &propertyName)
@@ -178,7 +187,7 @@ String PropertySetCSSStyleDeclaration::getPropertyValue(const String &propertyNa
     CSSPropertyID propertyID = cssPropertyID(propertyName);
     if (!propertyID)
         return String();
-    return propertySet()->getPropertyValue(propertyID);
+    return m_propertySet->getPropertyValue(propertyID);
 }
 
 String PropertySetCSSStyleDeclaration::getPropertyPriority(const String& propertyName)
@@ -186,7 +195,7 @@ String PropertySetCSSStyleDeclaration::getPropertyPriority(const String& propert
     CSSPropertyID propertyID = cssPropertyID(propertyName);
     if (!propertyID)
         return String();
-    return propertySet()->propertyIsImportant(propertyID) ? "important" : "";
+    return m_propertySet->propertyIsImportant(propertyID) ? "important" : "";
 }
 
 String PropertySetCSSStyleDeclaration::getPropertyShorthand(const String& propertyName)
@@ -194,7 +203,7 @@ String PropertySetCSSStyleDeclaration::getPropertyShorthand(const String& proper
     CSSPropertyID propertyID = cssPropertyID(propertyName);
     if (!propertyID)
         return String();
-    CSSPropertyID shorthandID = propertySet()->getPropertyShorthand(propertyID);
+    CSSPropertyID shorthandID = m_propertySet->getPropertyShorthand(propertyID);
     if (!shorthandID)
         return String();
     return getPropertyName(shorthandID);
@@ -205,7 +214,7 @@ bool PropertySetCSSStyleDeclaration::isPropertyImplicit(const String& propertyNa
     CSSPropertyID propertyID = cssPropertyID(propertyName);
     if (!propertyID)
         return false;
-    return propertySet()->isPropertyImplicit(propertyID);
+    return m_propertySet->isPropertyImplicit(propertyID);
 }
 
 void PropertySetCSSStyleDeclaration::setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode& ec)
@@ -222,7 +231,7 @@ void PropertySetCSSStyleDeclaration::setProperty(const String& propertyName, con
     willMutate();
 
     ec = 0;
-    bool changed = ensureMutablePropertySet()->setProperty(propertyID, value, important, contextStyleSheet());
+    bool changed = m_propertySet->setProperty(propertyID, value, important, contextStyleSheet());
 
     didMutate(changed ? PropertyChanged : NoChanges);
 
@@ -248,7 +257,7 @@ String PropertySetCSSStyleDeclaration::removeProperty(const String& propertyName
 
     ec = 0;
     String result;
-    bool changed = ensureMutablePropertySet()->removeProperty(propertyID, &result);
+    bool changed = m_propertySet->removeProperty(propertyID, &result);
 
     didMutate(changed ? PropertyChanged : NoChanges);
 
@@ -262,12 +271,12 @@ String PropertySetCSSStyleDeclaration::removeProperty(const String& propertyName
 
 PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal(CSSPropertyID propertyID)
 {
-    return propertySet()->getPropertyCSSValue(propertyID);
+    return m_propertySet->getPropertyCSSValue(propertyID);
 }
 
 String PropertySetCSSStyleDeclaration::getPropertyValueInternal(CSSPropertyID propertyID)
 { 
-    return propertySet()->getPropertyValue(propertyID);
+    return m_propertySet->getPropertyValue(propertyID);
 }
 
 void PropertySetCSSStyleDeclaration::setPropertyInternal(CSSPropertyID propertyID, const String& value, bool important, ExceptionCode& ec)
@@ -278,7 +287,7 @@ void PropertySetCSSStyleDeclaration::setPropertyInternal(CSSPropertyID propertyI
     willMutate();
 
     ec = 0;
-    bool changed = ensureMutablePropertySet()->setProperty(propertyID, value, important, contextStyleSheet());
+    bool changed = m_propertySet->setProperty(propertyID, value, important, contextStyleSheet());
 
     didMutate(changed ? PropertyChanged : NoChanges);
 
@@ -313,17 +322,18 @@ StyleSheetContents* PropertySetCSSStyleDeclaration::contextStyleSheet() const
 
 PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::copy() const
 {
-    return propertySet()->copy();
+    return m_propertySet->copy();
 }
 
 PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::makeMutable()
 {
-    return ensureMutablePropertySet();
+    ASSERT(m_propertySet->isMutable());
+    return m_propertySet;
 }
 
 bool PropertySetCSSStyleDeclaration::cssPropertyMatches(const CSSProperty* property) const
 {
-    return propertySet()->propertyMatches(property);
+    return m_propertySet->propertyMatches(property);
 }
     
 StyleRuleCSSStyleDeclaration::StyleRuleCSSStyleDeclaration(StylePropertySet* propertySet, CSSRule* parentRule)
@@ -380,6 +390,20 @@ void StyleRuleCSSStyleDeclaration::reattach(StylePropertySet* propertySet)
     m_propertySet->ref();
 }
 
+void StyleRuleCSSStyleDeclaration::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    PropertySetCSSStyleDeclaration::reportMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_parentRule);
+}
+
+void InlineCSSStyleDeclaration::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    PropertySetCSSStyleDeclaration::reportMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_parentElement);
+}
+
 void InlineCSSStyleDeclaration::didMutate(MutationType type)
 {
     if (type == NoChanges)
@@ -400,11 +424,4 @@ CSSStyleSheet* InlineCSSStyleDeclaration::parentStyleSheet() const
     return m_parentElement ? m_parentElement->document()->elementSheet() : 0;
 }
 
-StylePropertySet* InlineCSSStyleDeclaration::ensureMutablePropertySet()
-{
-    ASSERT(m_propertySet);
-    ASSERT(m_propertySet->isMutable());
-    return m_propertySet;
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/css/PropertySetCSSStyleDeclaration.h b/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
index 44b73de6f..0bbd64b7c 100644
--- a/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
+++ b/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
@@ -48,9 +48,7 @@ public:
     virtual void ref() OVERRIDE;
     virtual void deref() OVERRIDE;
 
-protected:
-    const StylePropertySet* propertySet() const { return m_propertySet; }
-    virtual StylePropertySet* ensureMutablePropertySet() { return m_propertySet; }
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
 
 private:
     virtual CSSRule* parentRule() const OVERRIDE { return 0; };
@@ -99,6 +97,8 @@ public:
 
     void reattach(StylePropertySet*);
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 private:
     StyleRuleCSSStyleDeclaration(StylePropertySet*, CSSRule*);
     virtual ~StyleRuleCSSStyleDeclaration();
@@ -110,8 +110,6 @@ private:
     virtual void willMutate() OVERRIDE;
     virtual void didMutate(MutationType) OVERRIDE;
 
-    virtual StylePropertySet* ensureMutablePropertySet() OVERRIDE { return m_propertySet; }
-
     unsigned m_refCount;
     CSSRule* m_parentRule;
 };
@@ -124,6 +122,8 @@ public:
         , m_parentElement(parentElement) 
     {
     }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
     
 private:
     virtual CSSStyleSheet* parentStyleSheet() const OVERRIDE;
@@ -132,8 +132,6 @@ private:
 
     virtual void didMutate(MutationType) OVERRIDE;
 
-    virtual StylePropertySet* ensureMutablePropertySet() OVERRIDE;
-    
     StyledElement* m_parentElement;
 };
 
diff --git a/Source/WebCore/css/SVGCSSParser.cpp b/Source/WebCore/css/SVGCSSParser.cpp
index d06bb203b..c7ec6d9f9 100644
--- a/Source/WebCore/css/SVGCSSParser.cpp
+++ b/Source/WebCore/css/SVGCSSParser.cpp
@@ -281,7 +281,7 @@ bool CSSParser::parseSVGValue(CSSPropertyID propId, bool important)
             rollbackLastProperties(1);
             return false;
         }
-        CSSValue* value = m_parsedProperties.last().value();
+        CSSValue* value = m_parsedProperties->last().value();
         addProperty(CSSPropertyMarkerMid, value, important);
         addProperty(CSSPropertyMarkerEnd, value, important);
         m_implicitShorthand = false;
diff --git a/Source/WebCore/css/SelectorChecker.cpp b/Source/WebCore/css/SelectorChecker.cpp
index ef6ea8236..9a32d6080 100644
--- a/Source/WebCore/css/SelectorChecker.cpp
+++ b/Source/WebCore/css/SelectorChecker.cpp
@@ -1066,11 +1066,11 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, P
         case CSSSelector::PseudoReadOnly:
             if (!element || !element->isFormControlElement())
                 return false;
-            return element->isTextFormControl() && element->isReadOnlyFormControl();
+            return element->isTextFormControl() && element->shouldMatchReadOnlySelector();
         case CSSSelector::PseudoReadWrite:
             if (!element || !element->isFormControlElement())
                 return false;
-            return element->isTextFormControl() && !element->isReadOnlyFormControl();
+            return element->isTextFormControl() && element->shouldMatchReadWriteSelector();
         case CSSSelector::PseudoOptional:
             return element && element->isOptionalFormControl();
         case CSSSelector::PseudoRequired:
diff --git a/Source/WebCore/css/ShadowValue.cpp b/Source/WebCore/css/ShadowValue.cpp
index 14c7cda8c..5db003651 100644
--- a/Source/WebCore/css/ShadowValue.cpp
+++ b/Source/WebCore/css/ShadowValue.cpp
@@ -21,6 +21,7 @@
 #include "ShadowValue.h"
 
 #include "CSSPrimitiveValue.h"
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 
 namespace WebCore {
@@ -77,4 +78,15 @@ String ShadowValue::customCssText() const
     return text;
 }
 
+void ShadowValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(x);
+    info.addInstrumentedMember(y);
+    info.addInstrumentedMember(blur);
+    info.addInstrumentedMember(spread);
+    info.addInstrumentedMember(style);
+    info.addInstrumentedMember(color);
+}
+
 }
diff --git a/Source/WebCore/css/ShadowValue.h b/Source/WebCore/css/ShadowValue.h
index 21547a571..f2d8e6f6f 100644
--- a/Source/WebCore/css/ShadowValue.h
+++ b/Source/WebCore/css/ShadowValue.h
@@ -44,6 +44,8 @@ public:
 
     String customCssText() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
     RefPtr<CSSPrimitiveValue> x;
     RefPtr<CSSPrimitiveValue> y;
     RefPtr<CSSPrimitiveValue> blur;
diff --git a/Source/WebCore/css/StyleBuilder.cpp b/Source/WebCore/css/StyleBuilder.cpp
index b6bf332a5..25c134990 100644
--- a/Source/WebCore/css/StyleBuilder.cpp
+++ b/Source/WebCore/css/StyleBuilder.cpp
@@ -1933,6 +1933,7 @@ StyleBuilder::StyleBuilder()
     setPropertyHandler(CSSPropertyTabSize, ApplyPropertyDefault<unsigned, &RenderStyle::tabSize, unsigned, &RenderStyle::setTabSize, unsigned, &RenderStyle::initialTabSize>::createHandler());
     setPropertyHandler(CSSPropertyTextAlign, ApplyPropertyTextAlign::createHandler());
     setPropertyHandler(CSSPropertyTextDecoration, ApplyPropertyTextDecoration::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTextDecorationLine, ApplyPropertyTextDecoration::createHandler());
     setPropertyHandler(CSSPropertyTextIndent, ApplyPropertyLength<&RenderStyle::textIndent, &RenderStyle::setTextIndent, &RenderStyle::initialTextIndent>::createHandler());
     setPropertyHandler(CSSPropertyTextOverflow, ApplyPropertyDefault<TextOverflow, &RenderStyle::textOverflow, TextOverflow, &RenderStyle::setTextOverflow, TextOverflow, &RenderStyle::initialTextOverflow>::createHandler());
     setPropertyHandler(CSSPropertyTextRendering, ApplyPropertyFont<TextRenderingMode, &FontDescription::textRenderingMode, &FontDescription::setTextRenderingMode, AutoTextRendering>::createHandler());
@@ -1990,13 +1991,15 @@ StyleBuilder::StyleBuilder()
     setPropertyHandler(CSSPropertyWebkitAlignContent, ApplyPropertyDefault<EAlignContent, &RenderStyle::alignContent, EAlignContent, &RenderStyle::setAlignContent, EAlignContent, &RenderStyle::initialAlignContent>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAlignItems, ApplyPropertyDefault<EAlignItems, &RenderStyle::alignItems, EAlignItems, &RenderStyle::setAlignItems, EAlignItems, &RenderStyle::initialAlignItems>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAlignSelf, ApplyPropertyDefault<EAlignItems, &RenderStyle::alignSelf, EAlignItems, &RenderStyle::setAlignSelf, EAlignItems, &RenderStyle::initialAlignSelf>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlex, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitFlexGrow, CSSPropertyWebkitFlexShrink, CSSPropertyWebkitFlexBasis>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexBasis, ApplyPropertyLength<&RenderStyle::flexBasis, &RenderStyle::setFlexBasis, &RenderStyle::initialFlexBasis, AutoEnabled>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexDirection, ApplyPropertyDefault<EFlexDirection, &RenderStyle::flexDirection, EFlexDirection, &RenderStyle::setFlexDirection, EFlexDirection, &RenderStyle::initialFlexDirection>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexFlow, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitFlexDirection, CSSPropertyWebkitFlexWrap>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexGrow, ApplyPropertyDefault<float, &RenderStyle::flexGrow, float, &RenderStyle::setFlexGrow, float, &RenderStyle::initialFlexGrow>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexShrink, ApplyPropertyDefault<float, &RenderStyle::flexShrink, float, &RenderStyle::setFlexShrink, float, &RenderStyle::initialFlexShrink>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexWrap, ApplyPropertyDefault<EFlexWrap, &RenderStyle::flexWrap, EFlexWrap, &RenderStyle::setFlexWrap, EFlexWrap, &RenderStyle::initialFlexWrap>::createHandler());
     setPropertyHandler(CSSPropertyWebkitJustifyContent, ApplyPropertyDefault<EJustifyContent, &RenderStyle::justifyContent, EJustifyContent, &RenderStyle::setJustifyContent, EJustifyContent, &RenderStyle::initialJustifyContent>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitOrder, ApplyPropertyDefault<float, &RenderStyle::order, float, &RenderStyle::setOrder, float, &RenderStyle::initialOrder>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitOrder, ApplyPropertyDefault<int, &RenderStyle::order, int, &RenderStyle::setOrder, int, &RenderStyle::initialOrder>::createHandler());
 #endif
 #if ENABLE(CSS_REGIONS)
     setPropertyHandler(CSSPropertyWebkitFlowFrom, ApplyPropertyString<MapNoneToNull, &RenderStyle::regionThread, &RenderStyle::setRegionThread, &RenderStyle::initialRegionThread>::createHandler());
diff --git a/Source/WebCore/css/StylePropertySet.cpp b/Source/WebCore/css/StylePropertySet.cpp
index 0c25a5a9c..a48728ae6 100644
--- a/Source/WebCore/css/StylePropertySet.cpp
+++ b/Source/WebCore/css/StylePropertySet.cpp
@@ -894,6 +894,16 @@ void StylePropertySet::addSubresourceStyleURLs(ListHashSet<KURL>& urls, StyleShe
         propertyAt(i).value()->addSubresourceStyleURLs(urls, contextStyleSheet);
 }
 
+bool StylePropertySet::hasFailedOrCanceledSubresources() const
+{
+    unsigned size = propertyCount();
+    for (unsigned i = 0; i < size; ++i) {
+        if (propertyAt(i).value()->hasFailedOrCanceledSubresources())
+            return true;
+    }
+    return false;
+}
+
 // This is the list of properties we want to copy in the copyBlockProperties() function.
 // It is the list of CSS properties that apply specially to block-level elements.
 static const CSSPropertyID blockProperties[] = {
@@ -1036,8 +1046,10 @@ PassRefPtr<StylePropertySet> StylePropertySet::copyPropertiesInSet(const CSSProp
     return StylePropertySet::create(list.data(), list.size());
 }
 
-CSSStyleDeclaration* StylePropertySet::ensureCSSStyleDeclaration() const
+CSSStyleDeclaration* StylePropertySet::ensureCSSStyleDeclaration()
 {
+    ASSERT(isMutable());
+
     if (m_ownsCSSOMWrapper) {
         ASSERT(!static_cast<CSSStyleDeclaration*>(propertySetCSSOMWrapperMap().get(this))->parentRule());
         ASSERT(!propertySetCSSOMWrapperMap().get(this)->parentElement());
@@ -1049,8 +1061,10 @@ CSSStyleDeclaration* StylePropertySet::ensureCSSStyleDeclaration() const
     return cssomWrapper;
 }
 
-CSSStyleDeclaration* StylePropertySet::ensureInlineCSSStyleDeclaration(const StyledElement* parentElement) const
+CSSStyleDeclaration* StylePropertySet::ensureInlineCSSStyleDeclaration(const StyledElement* parentElement)
 {
+    ASSERT(isMutable());
+
     if (m_ownsCSSOMWrapper) {
         ASSERT(propertySetCSSOMWrapperMap().get(this)->parentElement() == parentElement);
         return propertySetCSSOMWrapperMap().get(this);
@@ -1075,6 +1089,18 @@ unsigned StylePropertySet::averageSizeInBytes()
     return sizeof(StylePropertySet) + sizeof(CSSProperty) * 2;
 }
 
+void StylePropertySet::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    if (m_isMutable)
+        info.addVectorPtr(m_mutablePropertyVector);
+    else
+        info.addRawBuffer(m_properties, m_arraySize * sizeof(CSSProperty));
+    unsigned count = propertyCount();
+    for (unsigned i = 0; i < count; ++i)
+        info.addInstrumentedMember(propertyAt(i));
+}
+
 // See the function above if you need to update this.
 struct SameSizeAsStylePropertySet : public RefCounted<SameSizeAsStylePropertySet> {
     unsigned bitfield;
diff --git a/Source/WebCore/css/StylePropertySet.h b/Source/WebCore/css/StylePropertySet.h
index a4a13ef5e..307a3ef80 100644
--- a/Source/WebCore/css/StylePropertySet.h
+++ b/Source/WebCore/css/StylePropertySet.h
@@ -25,7 +25,6 @@
 #include "CSSPrimitiveValue.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
-#include "MemoryInstrumentation.h"
 #include <wtf/ListHashSet.h>
 #include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
@@ -35,6 +34,7 @@ namespace WebCore {
 class CSSRule;
 class CSSStyleDeclaration;
 class KURL;
+class MemoryObjectInfo;
 class PropertySetCSSStyleDeclaration;
 class StyledElement;
 class StylePropertyShorthand;
@@ -105,24 +105,20 @@ public:
     
     void clearParentElement(StyledElement*);
 
-    CSSStyleDeclaration* ensureCSSStyleDeclaration() const;
-    CSSStyleDeclaration* ensureInlineCSSStyleDeclaration(const StyledElement* parentElement) const;
+    CSSStyleDeclaration* ensureCSSStyleDeclaration();
+    CSSStyleDeclaration* ensureInlineCSSStyleDeclaration(const StyledElement* parentElement);
 
     bool isMutable() const { return m_isMutable; }
 
+    bool hasFailedOrCanceledSubresources() const;
+
     static unsigned averageSizeInBytes();
+    void reportMemoryUsage(MemoryObjectInfo*) const;
 
 #ifndef NDEBUG
     void showStyle();
 #endif
     
-    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
-    {
-        MemoryClassInfo<StylePropertySet> info(memoryObjectInfo, this, MemoryInstrumentation::CSS, m_arraySize * sizeof(CSSProperty));
-        if (m_isMutable)
-            info.addMember(m_mutablePropertyVector);
-    }
-
 private:
     StylePropertySet(CSSParserMode);
     StylePropertySet(const CSSProperty* properties, unsigned count, CSSParserMode, bool makeMutable);
diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
index 92b925ca2..ff9213aa8 100644
--- a/Source/WebCore/css/StyleResolver.cpp
+++ b/Source/WebCore/css/StyleResolver.cpp
@@ -132,7 +132,7 @@
 #include "WebKitCSSFilterValue.h"
 #endif
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 #include "DashboardRegion.h"
 #endif
 
@@ -153,6 +153,7 @@
 #include "StyleCustomFilterProgram.h"
 #include "StylePendingShader.h"
 #include "StyleShader.h"
+#include "WebKitCSSMixFunctionValue.h"
 #include "WebKitCSSShaderValue.h"
 #endif
 
@@ -198,11 +199,12 @@ if (primitiveValue) \
 
 class RuleData {
 public:
-    RuleData(StyleRule*, CSSSelector*, unsigned position, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool inRegionRule);
+    RuleData(StyleRule*, unsigned selectorIndex, unsigned position, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool inRegionRule);
 
     unsigned position() const { return m_position; }
     StyleRule* rule() const { return m_rule; }
-    CSSSelector* selector() const { return m_selector; }
+    CSSSelector* selector() const { return m_rule->selectorList().selectorAt(m_selectorIndex); }
+    unsigned selectorIndex() const { return m_selectorIndex; }
 
     bool hasFastCheckableSelector() const { return m_hasFastCheckableSelector; }
     bool hasMultipartSelector() const { return m_hasMultipartSelector; }
@@ -221,11 +223,11 @@ public:
 
 private:
     StyleRule* m_rule;
-    CSSSelector* m_selector;
-    unsigned m_specificity;
+    unsigned m_selectorIndex : 12;
     // This number was picked fairly arbitrarily. We can probably lower it if we need to.
     // Some simple testing showed <100,000 RuleData's on large sites.
-    unsigned m_position : 24;
+    unsigned m_position : 20;
+    unsigned m_specificity : 24;
     unsigned m_hasFastCheckableSelector : 1;
     unsigned m_hasMultipartSelector : 1;
     unsigned m_hasRightmostSelectorMatchingHTMLBasedOnRuleHash : 1;
@@ -239,10 +241,9 @@ private:
     
 struct SameSizeAsRuleData {
     void* a;
-    void* b;
+    unsigned b;
     unsigned c;
-    unsigned d;
-    unsigned e[4];
+    unsigned d[4];
 };
 
 COMPILE_ASSERT(sizeof(RuleData) == sizeof(SameSizeAsRuleData), RuleData_should_stay_small);
@@ -257,7 +258,7 @@ public:
     void addRulesFromSheet(StyleSheetContents*, const MediaQueryEvaluator&, StyleResolver* = 0, const ContainerNode* = 0);
 
     void addStyleRule(StyleRule*, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool isInRegionRule = false);
-    void addRule(StyleRule*, CSSSelector*, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool isInRegionRule = false);
+    void addRule(StyleRule*, unsigned selectorIndex, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool isInRegionRule = false);
     void addPageRule(StyleRulePage*);
     void addToRuleSet(AtomicStringImpl* key, AtomRuleMap&, const RuleData&);
     void addRegionRule(StyleRuleRegion*, bool hasDocumentSecurityOrigin);
@@ -480,7 +481,7 @@ static PassOwnPtr<RuleSet> makeRuleSet(const Vector<StyleResolver::RuleFeature>&
         return nullptr;
     OwnPtr<RuleSet> ruleSet = RuleSet::create();
     for (size_t i = 0; i < size; ++i)
-        ruleSet->addRule(rules[i].rule, rules[i].selector, rules[i].hasDocumentSecurityOrigin, false);
+        ruleSet->addRule(rules[i].rule, rules[i].selectorIndex, rules[i].hasDocumentSecurityOrigin, false);
     ruleSet->shrinkToFit();
     return ruleSet.release();
 }
@@ -737,7 +738,7 @@ void StyleResolver::Features::clear()
 
 void StyleResolver::Features::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<StyleResolver::Features> info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
     info.addHashSet(idsInRules);
     info.addHashSet(attrsInRules);
     info.addVector(siblingRules);
@@ -863,7 +864,7 @@ void StyleResolver::addMatchedProperties(MatchResult& matchResult, const StylePr
     matchResult.matchedRules.append(rule);
 }
 
-inline void StyleResolver::addElementStyleProperties(MatchResult& result, StylePropertySet* propertySet, bool isCacheable)
+inline void StyleResolver::addElementStyleProperties(MatchResult& result, const StylePropertySet* propertySet, bool isCacheable)
 {
     if (!propertySet)
         return;
@@ -886,10 +887,8 @@ void StyleResolver::collectMatchingRules(RuleSet* rules, int& firstRuleIndex, in
         collectMatchingRulesForList(rules->idRules(m_element->idForStyleResolution().impl()), firstRuleIndex, lastRuleIndex, options);
     if (m_element->hasClass()) {
         ASSERT(m_styledElement);
-        const SpaceSplitString& classNames = m_styledElement->classNames();
-        size_t size = classNames.size();
-        for (size_t i = 0; i < size; ++i)
-            collectMatchingRulesForList(rules->classRules(classNames[i].impl()), firstRuleIndex, lastRuleIndex, options);
+        for (size_t i = 0; i < m_styledElement->classNames().size(); ++i)
+            collectMatchingRulesForList(rules->classRules(m_styledElement->classNames()[i].impl()), firstRuleIndex, lastRuleIndex, options);
     }
     const AtomicString& pseudoId = m_element->shadowPseudoId();
     if (!pseudoId.isEmpty()) {
@@ -1186,7 +1185,7 @@ void StyleResolver::matchAllRules(MatchResult& result, bool includeSMILPropertie
         // FIXME: Media control shadow trees seem to have problems with caching.
         bool isInlineStyleCacheable = !m_styledElement->inlineStyle()->isMutable() && !m_styledElement->isInShadowTree();
         // FIXME: Constify.
-        addElementStyleProperties(result, const_cast<StylePropertySet*>(m_styledElement->inlineStyle()), isInlineStyleCacheable);
+        addElementStyleProperties(result, m_styledElement->inlineStyle(), isInlineStyleCacheable);
     }
 
 #if ENABLE(SVG)
@@ -1350,7 +1349,7 @@ bool StyleResolver::canShareStyleWithControl(StyledElement* element) const
 }
 
 // This function makes some assumptions that only make sense for attribute styles (we only compare CSSProperty::id() and CSSProperty::value().)
-static inline bool attributeStylesEqual(StylePropertySet* a, StylePropertySet* b)
+static inline bool attributeStylesEqual(const StylePropertySet* a, const StylePropertySet* b)
 {
     if (a == b)
         return true;
@@ -1395,14 +1394,16 @@ bool StyleResolver::canShareStyleWithElement(StyledElement* element) const
         return false;
     if (element->inlineStyle())
         return false;
+    if (element->needsStyleRecalc())
+        return false;
 #if ENABLE(SVG)
     if (element->isSVGElement() && static_cast<SVGElement*>(element)->animatedSMILStyleProperties())
         return false;
 #endif
     if (!!element->attributeStyle() != !!m_styledElement->attributeStyle())
         return false;
-    StylePropertySet* additionalAttributeStyleA = element->additionalAttributeStyle();
-    StylePropertySet* additionalAttributeStyleB = m_styledElement->additionalAttributeStyle();
+    const StylePropertySet* additionalAttributeStyleA = element->additionalAttributeStyle();
+    const StylePropertySet* additionalAttributeStyleB = m_styledElement->additionalAttributeStyle();
     if (!additionalAttributeStyleA != !additionalAttributeStyleB)
         return false;
     if (element->isLink() != m_element->isLink())
@@ -1482,8 +1483,17 @@ bool StyleResolver::canShareStyleWithElement(StyledElement* element) const
     if (elementHasDirectionAuto(element) || elementHasDirectionAuto(m_element))
         return false;
 
-    if (element->hasClass() && m_element->getAttribute(classAttr) != element->getAttribute(classAttr))
-        return false;
+    if (element->hasClass()) {
+#if ENABLE(SVG)
+        // SVG elements require a (slow!) getAttribute comparision because "class" is an animatable attribute for SVG.
+        if (element->isSVGElement()) {
+            if (element->getAttribute(classAttr) != m_element->getAttribute(classAttr))
+                return false;
+        } else
+#endif
+        if (element->fastGetAttribute(classAttr) != m_element->fastGetAttribute(classAttr))
+            return false;
+    }
 
     if (element->attributeStyle() && !attributeStylesEqual(element->attributeStyle(), m_styledElement->attributeStyle()))
         return false;
@@ -2143,8 +2153,10 @@ void StyleResolver::adjustRenderStyle(RenderStyle* style, RenderStyle* parentSty
         if (style->writingMode() != TopToBottomWritingMode && (style->display() == BOX || style->display() == INLINE_BOX))
             style->setWritingMode(TopToBottomWritingMode);
 
-        if (e && e->parentNode() && e->parentNode()->renderer() && e->parentNode()->renderer()->isFlexibleBox())
+        if (e && e->parentNode() && e->parentNode()->renderer() && e->parentNode()->renderer()->isFlexibleBox()) {
+            style->setFloating(NoFloat);
             style->setDisplay(equivalentBlockDisplay(style->display(), style->isFloating(), m_checker.strictParsing()));
+        }
     }
 
     // Make sure our z-index value is only applied if the object is positioned.
@@ -2483,25 +2495,27 @@ static inline bool containsUncommonAttributeSelector(const CSSSelector* selector
     return false;
 }
 
-RuleData::RuleData(StyleRule* rule, CSSSelector* selector, unsigned position, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool inRegionRule)
+RuleData::RuleData(StyleRule* rule, unsigned selectorIndex, unsigned position, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool inRegionRule)
     : m_rule(rule)
-    , m_selector(selector)
-    , m_specificity(selector->specificity())
+    , m_selectorIndex(selectorIndex)
     , m_position(position)
-    , m_hasFastCheckableSelector(canUseFastCheckSelector && SelectorChecker::isFastCheckableSelector(selector))
-    , m_hasMultipartSelector(!!selector->tagHistory())
-    , m_hasRightmostSelectorMatchingHTMLBasedOnRuleHash(isSelectorMatchingHTMLBasedOnRuleHash(selector))
-    , m_containsUncommonAttributeSelector(WebCore::containsUncommonAttributeSelector(selector))
-    , m_linkMatchType(SelectorChecker::determineLinkMatchType(selector))
+    , m_specificity(selector()->specificity())
+    , m_hasFastCheckableSelector(canUseFastCheckSelector && SelectorChecker::isFastCheckableSelector(selector()))
+    , m_hasMultipartSelector(!!selector()->tagHistory())
+    , m_hasRightmostSelectorMatchingHTMLBasedOnRuleHash(isSelectorMatchingHTMLBasedOnRuleHash(selector()))
+    , m_containsUncommonAttributeSelector(WebCore::containsUncommonAttributeSelector(selector()))
+    , m_linkMatchType(SelectorChecker::determineLinkMatchType(selector()))
     , m_hasDocumentSecurityOrigin(hasDocumentSecurityOrigin)
     , m_isInRegionRule(inRegionRule)
 {
-    SelectorChecker::collectIdentifierHashes(m_selector, m_descendantSelectorIdentifierHashes, maximumIdentifierCount);
+    ASSERT(m_position == position);
+    ASSERT(m_selectorIndex == selectorIndex);
+    SelectorChecker::collectIdentifierHashes(selector(), m_descendantSelectorIdentifierHashes, maximumIdentifierCount);
 }
 
 void RuleData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<RuleData> info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
 }
 
 RuleSet::RuleSet()
@@ -2510,8 +2524,7 @@ RuleSet::RuleSet()
 {
 }
 
-
-static void reportAtomRuleMap(MemoryClassInfo<RuleSet>* info, const RuleSet::AtomRuleMap& atomicRuleMap)
+static void reportAtomRuleMap(MemoryClassInfo* info, const RuleSet::AtomRuleMap& atomicRuleMap)
 {
     info->addHashMap(atomicRuleMap);
     for (RuleSet::AtomRuleMap::const_iterator it = atomicRuleMap.begin(); it != atomicRuleMap.end(); ++it)
@@ -2520,7 +2533,7 @@ static void reportAtomRuleMap(MemoryClassInfo<RuleSet>* info, const RuleSet::Ato
 
 void RuleSet::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<RuleSet> info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
     reportAtomRuleMap(&info, m_idRules);
     reportAtomRuleMap(&info, m_classRules);
     reportAtomRuleMap(&info, m_tagRules);
@@ -2534,7 +2547,7 @@ void RuleSet::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 
 void RuleSet::RuleSetSelectorPair::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<RuleSet::RuleSetSelectorPair> info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
     info.addInstrumentedMember(ruleSet);
 }
 
@@ -2577,9 +2590,9 @@ static void collectFeaturesFromRuleData(StyleResolver::Features& features, const
             foundSiblingSelector = true;
     }
     if (foundSiblingSelector)
-        features.siblingRules.append(StyleResolver::RuleFeature(ruleData.rule(), ruleData.selector(), ruleData.hasDocumentSecurityOrigin()));
+        features.siblingRules.append(StyleResolver::RuleFeature(ruleData.rule(), ruleData.selectorIndex(), ruleData.hasDocumentSecurityOrigin()));
     if (ruleData.containsUncommonAttributeSelector())
-        features.uncommonAttributeRules.append(StyleResolver::RuleFeature(ruleData.rule(), ruleData.selector(), ruleData.hasDocumentSecurityOrigin()));
+        features.uncommonAttributeRules.append(StyleResolver::RuleFeature(ruleData.rule(), ruleData.selectorIndex(), ruleData.hasDocumentSecurityOrigin()));
 }
     
 void RuleSet::addToRuleSet(AtomicStringImpl* key, AtomRuleMap& map, const RuleData& ruleData)
@@ -2592,11 +2605,13 @@ void RuleSet::addToRuleSet(AtomicStringImpl* key, AtomRuleMap& map, const RuleDa
     rules->append(ruleData);
 }
 
-void RuleSet::addRule(StyleRule* rule, CSSSelector* selector, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool inRegionRule)
+void RuleSet::addRule(StyleRule* rule, unsigned selectorIndex, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool inRegionRule)
 {
-    RuleData ruleData(rule, selector, m_ruleCount++, hasDocumentSecurityOrigin, canUseFastCheckSelector, inRegionRule);
+    RuleData ruleData(rule, selectorIndex, m_ruleCount++, hasDocumentSecurityOrigin, canUseFastCheckSelector, inRegionRule);
     collectFeaturesFromRuleData(m_features, ruleData);
 
+    CSSSelector* selector = ruleData.selector();
+
     if (selector->m_match == CSSSelector::Id) {
         addToRuleSet(selector->value().impl(), m_idRules, ruleData);
         return;
@@ -2737,8 +2752,8 @@ void RuleSet::addRulesFromSheet(StyleSheetContents* sheet, const MediaQueryEvalu
 
 void RuleSet::addStyleRule(StyleRule* rule, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool isInRegionRule)
 {
-    for (CSSSelector* s = rule->selectorList().first(); s; s = CSSSelectorList::next(s))
-        addRule(rule, s, hasDocumentSecurityOrigin, canUseFastCheckSelector, isInRegionRule);
+    for (size_t selectorIndex = 0; selectorIndex != notFound; selectorIndex = rule->selectorList().indexOfNextSelectorAfter(selectorIndex))
+        addRule(rule, selectorIndex, hasDocumentSecurityOrigin, canUseFastCheckSelector, isInRegionRule);
 }
 
 static inline void shrinkMapVectorsToFit(RuleSet::AtomRuleMap& map)
@@ -3501,22 +3516,25 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
         }
         if (value->isValueList()) {
             CSSValueList* list = static_cast<CSSValueList*>(value);
-            QuotesData* data = QuotesData::create(list->length());
-            if (!data)
-                return; // Out of memory
-            String* quotes = data->data();
-            for (CSSValueListIterator i = list; i.hasMore(); i.advance()) {
-                CSSValue* item = i.value();
-                ASSERT(item->isPrimitiveValue());
-                primitiveValue = static_cast<CSSPrimitiveValue*>(item);
-                ASSERT(primitiveValue->isString());
-                quotes[i.index()] = primitiveValue->getStringValue();
+            RefPtr<QuotesData> quotes = QuotesData::create();
+            for (size_t i = 0; i < list->length(); i += 2) {
+                CSSValue* first = list->itemWithoutBoundsCheck(i);
+                // item() returns null if out of bounds so this is safe.
+                CSSValue* second = list->item(i + 1);
+                if (!second)
+                    continue;
+                ASSERT(first->isPrimitiveValue());
+                ASSERT(second->isPrimitiveValue());
+                String startQuote = static_cast<CSSPrimitiveValue*>(first)->getStringValue();
+                String endQuote = static_cast<CSSPrimitiveValue*>(second)->getStringValue();
+                quotes->addPair(std::make_pair(startQuote, endQuote));
             }
-            m_style->setQuotes(adoptRef(data));
-        } else if (primitiveValue) {
-            ASSERT(primitiveValue->isIdent());
+            m_style->setQuotes(quotes);
+            return;
+        }
+        if (primitiveValue) {
             if (primitiveValue->getIdent() == CSSValueNone)
-                m_style->setQuotes(adoptRef(QuotesData::create(0)));
+                m_style->setQuotes(QuotesData::create());
         }
         return;
     case CSSPropertyFontFamily: {
@@ -3856,8 +3874,14 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
         setTextSizeAdjust(primitiveValue->getIdent() == CSSValueAuto);
         return;
     }
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 #if ENABLE(DASHBOARD_SUPPORT)
-    case CSSPropertyWebkitDashboardRegion: {
+    case CSSPropertyWebkitDashboardRegion:
+#endif
+#if ENABLE(WIDGET_REGION)
+    case CSSPropertyWebkitWidgetRegion:
+#endif
+    {
         HANDLE_INHERIT_AND_INITIAL(dashboardRegions, DashboardRegions)
         if (!primitiveValue)
             return;
@@ -3989,19 +4013,6 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
         return;
     }
 #endif
-#if ENABLE(CSS3_FLEXBOX)
-    case CSSPropertyWebkitFlex:
-        if (isInherit) {
-            m_style->setFlexGrow(m_parentStyle->flexGrow());
-            m_style->setFlexShrink(m_parentStyle->flexShrink());
-            m_style->setFlexBasis(m_parentStyle->flexBasis());
-        } else if (isInitial) {
-            m_style->setFlexGrow(RenderStyle::initialFlexGrow());
-            m_style->setFlexShrink(RenderStyle::initialFlexShrink());
-            m_style->setFlexBasis(RenderStyle::initialFlexBasis());
-        }
-        return;
-#endif
     case CSSPropertyInvalid:
         return;
     // Directional properties are resolved by resolveDirectionAwareProperty() before the switch.
@@ -4332,6 +4343,7 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
     case CSSPropertyWebkitAlignContent:
     case CSSPropertyWebkitAlignItems:
     case CSSPropertyWebkitAlignSelf:
+    case CSSPropertyWebkitFlex:
     case CSSPropertyWebkitFlexBasis:
     case CSSPropertyWebkitFlexDirection:
     case CSSPropertyWebkitFlexFlow:
@@ -4391,6 +4403,7 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
 #endif
     case CSSPropertyWebkitRtlOrdering:
     case CSSPropertyWebkitTextCombine:
+    case CSSPropertyWebkitTextDecorationLine:
     case CSSPropertyWebkitTextEmphasisColor:
     case CSSPropertyWebkitTextEmphasisPosition:
     case CSSPropertyWebkitTextEmphasisStyle:
@@ -4461,14 +4474,14 @@ PassRefPtr<StyleImage> StyleResolver::cachedOrPendingFromValue(CSSPropertyID pro
 {
     RefPtr<StyleImage> image = value->cachedOrPendingImage();
     if (image && image->isPendingImage())
-        m_pendingImageProperties.add(property);
+        m_pendingImageProperties.set(property, value);
     return image.release();
 }
 
 PassRefPtr<StyleImage> StyleResolver::generatedOrPendingFromValue(CSSPropertyID property, CSSImageGeneratorValue* value)
 {
     if (value->isPending()) {
-        m_pendingImageProperties.add(property);
+        m_pendingImageProperties.set(property, value);
         return StylePendingImage::create(value);
     }
     return StyleGeneratedImage::create(value);
@@ -4479,7 +4492,7 @@ PassRefPtr<StyleImage> StyleResolver::setOrPendingFromValue(CSSPropertyID proper
 {
     RefPtr<StyleImage> image = value->cachedOrPendingImageSet(document());
     if (image && image->isPendingImage())
-        m_pendingImageProperties.add(property);
+        m_pendingImageProperties.set(property, value);
     return image.release();
 }
 #endif
@@ -5279,7 +5292,34 @@ PassRefPtr<CustomFilterOperation> StyleResolver::createCustomFilterOperation(Web
 
     ASSERT(shadersList->length());
     RefPtr<StyleShader> vertexShader = styleShader(shadersList->itemWithoutBoundsCheck(0));
-    RefPtr<StyleShader> fragmentShader = (shadersList->length() > 1) ? styleShader(shadersList->itemWithoutBoundsCheck(1)) : 0;
+
+    RefPtr<StyleShader> fragmentShader;
+    CustomFilterProgramMixSettings mixSettings;
+    if (shadersList->length() > 1) {
+        CSSValue* fragmentShaderOrMixFunction = shadersList->itemWithoutBoundsCheck(1);
+        if (fragmentShaderOrMixFunction->isWebKitCSSMixFunctionValue()) {
+            mixSettings.enabled = true;
+            WebKitCSSMixFunctionValue* mixFunction = static_cast<WebKitCSSMixFunctionValue*>(fragmentShaderOrMixFunction);
+            CSSValueListIterator iterator(mixFunction);
+
+            ASSERT(mixFunction->length());
+            fragmentShader = styleShader(iterator.value());
+            iterator.advance();
+
+            ASSERT(mixFunction->length() <= 3);
+            while (iterator.hasMore()) {
+                CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(iterator.value());
+                if (CSSParser::isBlendMode(primitiveValue->getIdent()))
+                    mixSettings.blendMode = *primitiveValue;
+                else if (CSSParser::isCompositeOperator(primitiveValue->getIdent()))
+                    mixSettings.compositeOperator = *primitiveValue;
+                else
+                    ASSERT_NOT_REACHED();
+                iterator.advance();
+            }
+        } else
+            fragmentShader = styleShader(fragmentShaderOrMixFunction);
+    }
     
     unsigned meshRows = 1;
     unsigned meshColumns = 1;
@@ -5348,7 +5388,7 @@ PassRefPtr<CustomFilterOperation> StyleResolver::createCustomFilterOperation(Web
     if (parametersValue && !parseCustomFilterParameterList(parametersValue, parameterList))
         return 0;
     
-    RefPtr<StyleCustomFilterProgram> program = StyleCustomFilterProgram::create(vertexShader.release(), fragmentShader.release());
+    RefPtr<StyleCustomFilterProgram> program = StyleCustomFilterProgram::create(vertexShader.release(), fragmentShader.release(), mixSettings);
     return CustomFilterOperation::create(program.release(), parameterList, meshRows, meshColumns, meshBoxType, meshType);
 }
 #endif
@@ -5536,8 +5576,8 @@ void StyleResolver::loadPendingImages()
     if (m_pendingImageProperties.isEmpty())
         return;
 
-    HashSet<CSSPropertyID>::const_iterator end = m_pendingImageProperties.end();
-    for (HashSet<CSSPropertyID>::const_iterator it = m_pendingImageProperties.begin(); it != end; ++it) {
+    PendingImagePropertyMap::const_iterator::Keys end = m_pendingImageProperties.end().keys();
+    for (PendingImagePropertyMap::const_iterator::Keys it = m_pendingImageProperties.begin().keys(); it != end; ++it) {
         CSSPropertyID currentProperty = *it;
 
         switch (currentProperty) {
@@ -5629,9 +5669,27 @@ void StyleResolver::loadPendingResources()
 #endif
 }
 
+void StyleResolver::MatchedProperties::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(properties);
+}
+
+void StyleResolver::MatchedPropertiesCacheItem::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedVector(matchedProperties);
+}
+
+void MediaQueryResult::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_expression);
+}
+
 void StyleResolver::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<StyleResolver> info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
     info.addMember(m_style);
     info.addInstrumentedMember(m_authorStyle);
     info.addInstrumentedMember(m_userStyle);
@@ -5639,18 +5697,23 @@ void StyleResolver::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     info.addInstrumentedMember(m_uncommonAttributeRuleSet);
     info.addHashMap(m_keyframesRuleMap);
     info.addHashMap(m_matchedPropertiesCache);
+    info.addInstrumentedMapValues(m_matchedPropertiesCache);
     info.addVector(m_matchedRules);
 
-    // FIXME: Instrument StaticCSSRuleList and add m_ruleList here.
-    info.addHashSet(m_pendingImageProperties);
-    info.addVector(m_viewportDependentMediaQueryResults);
+    info.addInstrumentedMember(m_ruleList);
+    info.addHashMap(m_pendingImageProperties);
+    info.addInstrumentedMapValues(m_pendingImageProperties);
+    info.addInstrumentedMember(m_lineHeightValue);
+    info.addInstrumentedVector(m_viewportDependentMediaQueryResults);
     info.addHashMap(m_styleRuleToCSSOMWrapperMap);
-    info.addHashSet(m_styleSheetCSSOMWrapperSet);
+    info.addInstrumentedMapEntries(m_styleRuleToCSSOMWrapperMap);
+    info.addInstrumentedHashSet(m_styleSheetCSSOMWrapperSet);
 #if ENABLE(CSS_FILTERS) && ENABLE(SVG)
     info.addHashMap(m_pendingSVGDocuments);
 #endif
 #if ENABLE(STYLE_SCOPED)
     info.addHashMap(m_scopedAuthorStyles);
+    info.addInstrumentedMapEntries(m_scopedAuthorStyles);
     info.addVector(m_scopeStack);
 #endif
 
diff --git a/Source/WebCore/css/StyleResolver.h b/Source/WebCore/css/StyleResolver.h
index f181eb60e..46f909ad2 100644
--- a/Source/WebCore/css/StyleResolver.h
+++ b/Source/WebCore/css/StyleResolver.h
@@ -102,6 +102,7 @@ public:
         , m_result(result)
     {
     }
+    void reportMemoryUsage(MemoryObjectInfo*) const;
 
     MediaQueryExp m_expression;
     bool m_result;
@@ -273,14 +274,14 @@ public:
     void loadPendingResources();
 
     struct RuleFeature {
-        RuleFeature(StyleRule* rule, CSSSelector* selector, bool hasDocumentSecurityOrigin)
+        RuleFeature(StyleRule* rule, unsigned selectorIndex, bool hasDocumentSecurityOrigin)
             : rule(rule)
-            , selector(selector)
+            , selectorIndex(selectorIndex)
             , hasDocumentSecurityOrigin(hasDocumentSecurityOrigin) 
         { 
         }
         StyleRule* rule;
-        CSSSelector* selector;
+        unsigned selectorIndex;
         bool hasDocumentSecurityOrigin;
     };
     struct Features {
@@ -320,6 +321,7 @@ private:
 
     struct MatchedProperties {
         MatchedProperties() : possiblyPaddedMember(0) { }
+        void reportMemoryUsage(MemoryObjectInfo*) const;
         
         RefPtr<StylePropertySet> properties;
         union {
@@ -347,7 +349,7 @@ private:
     };
 
     static void addMatchedProperties(MatchResult&, const StylePropertySet* properties, StyleRule* = 0, unsigned linkMatchType = SelectorChecker::MatchAll, bool inRegionRule = false);
-    void addElementStyleProperties(MatchResult&, StylePropertySet*, bool isCacheable = true);
+    void addElementStyleProperties(MatchResult&, const StylePropertySet*, bool isCacheable = true);
 
     void matchAllRules(MatchResult&, bool includeSMILProperties);
     void matchUARules(MatchResult&);
@@ -447,6 +449,7 @@ private:
 
     static unsigned computeMatchedPropertiesHash(const MatchedProperties*, unsigned size);
     struct MatchedPropertiesCacheItem {
+        void reportMemoryUsage(MemoryObjectInfo*) const;
         Vector<MatchedProperties> matchedProperties;
         MatchRanges ranges;
         RefPtr<RenderStyle> renderStyle;
@@ -470,7 +473,8 @@ private:
 
     RefPtr<StaticCSSRuleList> m_ruleList;
 
-    HashSet<CSSPropertyID> m_pendingImageProperties;
+    typedef HashMap<CSSPropertyID, RefPtr<CSSValue> > PendingImagePropertyMap;
+    PendingImagePropertyMap m_pendingImageProperties;
 
     OwnPtr<MediaQueryEvaluator> m_medium;
     RefPtr<RenderStyle> m_rootDefaultStyle;
diff --git a/Source/WebCore/css/StyleRule.cpp b/Source/WebCore/css/StyleRule.cpp
index 3427f0559..03efc3a34 100644
--- a/Source/WebCore/css/StyleRule.cpp
+++ b/Source/WebCore/css/StyleRule.cpp
@@ -28,6 +28,7 @@
 #include "CSSMediaRule.h"
 #include "CSSPageRule.h"
 #include "CSSStyleRule.h"
+#include "MemoryInstrumentation.h"
 #include "StyleRuleImport.h"
 #include "WebKitCSSKeyframeRule.h"
 #include "WebKitCSSKeyframesRule.h"
@@ -51,6 +52,41 @@ PassRefPtr<CSSRule> StyleRuleBase::createCSSOMWrapper(CSSRule* parentRule) const
     return createCSSOMWrapper(0, parentRule);
 }
 
+void StyleRuleBase::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    switch (type()) {
+    case Style:
+        static_cast<const StyleRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case Page:
+        static_cast<const StyleRulePage*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case FontFace:
+        static_cast<const StyleRuleFontFace*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case Media:
+        static_cast<const StyleRuleMedia*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#if ENABLE(CSS_REGIONS)
+    case Region:
+        static_cast<const StyleRuleRegion*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#endif
+    case Import:
+        static_cast<const StyleRuleImport*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case Keyframes:
+        static_cast<const StyleRuleKeyframes*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+    case Unknown:
+    case Charset:
+    case Keyframe:
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+        return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
 void StyleRuleBase::destroy()
 {
     switch (type()) {
@@ -170,6 +206,13 @@ unsigned StyleRule::averageSizeInBytes()
     return sizeof(StyleRule) + StylePropertySet::averageSizeInBytes();
 }
 
+void StyleRule::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_properties);
+    info.addInstrumentedMember(m_selectorList);
+}
+
 StyleRule::StyleRule(int sourceLine)
     : StyleRuleBase(Style, sourceLine)
 {
@@ -226,6 +269,13 @@ void StyleRulePage::setProperties(PassRefPtr<StylePropertySet> properties)
     m_properties = properties;
 }
 
+void StyleRulePage::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_properties);
+    info.addInstrumentedMember(m_selectorList);
+}
+
 StyleRuleFontFace::StyleRuleFontFace()
     : StyleRuleBase(FontFace, 0)
 {
@@ -253,6 +303,13 @@ void StyleRuleFontFace::setProperties(PassRefPtr<StylePropertySet> properties)
     m_properties = properties;
 }
 
+void StyleRuleFontFace::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_properties);
+}
+
+
 StyleRuleBlock::StyleRuleBlock(Type type, Vector<RefPtr<StyleRuleBase> >& adoptRule)
     : StyleRuleBase(type, 0)
 {
@@ -277,6 +334,12 @@ void StyleRuleBlock::wrapperRemoveRule(unsigned index)
     m_childRules.remove(index);
 }
 
+void StyleRuleBlock::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedVector(m_childRules);
+}
+
 StyleRuleMedia::StyleRuleMedia(PassRefPtr<MediaQuerySet> media, Vector<RefPtr<StyleRuleBase> >& adoptRules)
     : StyleRuleBlock(Media, adoptRules)
     , m_mediaQueries(media)
@@ -290,7 +353,13 @@ StyleRuleMedia::StyleRuleMedia(const StyleRuleMedia& o)
         m_mediaQueries = o.m_mediaQueries->copy();
 }
 
-StyleRuleRegion::StyleRuleRegion(Vector<OwnPtr<CSSParserSelector> >* selectors, Vector<RefPtr<StyleRuleBase> >& adoptRules)
+void StyleRuleMedia::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_mediaQueries);
+}
+
+StyleRuleRegion::StyleRuleRegion(CSSSelectorVector* selectors, Vector<RefPtr<StyleRuleBase> >& adoptRules)
     : StyleRuleBlock(Region, adoptRules)
 {
     m_selectorList.adoptSelectorVector(*selectors);
@@ -302,4 +371,10 @@ StyleRuleRegion::StyleRuleRegion(const StyleRuleRegion& o)
 {
 }
 
+void StyleRuleRegion::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_selectorList);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/StyleRule.h b/Source/WebCore/css/StyleRule.h
index 7fc20a303..7b6025042 100644
--- a/Source/WebCore/css/StyleRule.h
+++ b/Source/WebCore/css/StyleRule.h
@@ -31,6 +31,7 @@ namespace WebCore {
 class CSSRule;
 class CSSStyleRule;
 class CSSStyleSheet;
+class MemoryObjectInfo;
 class StylePropertySet;
 
 class StyleRuleBase : public WTF::RefCountedBase {
@@ -72,6 +73,8 @@ public:
     PassRefPtr<CSSRule> createCSSOMWrapper(CSSStyleSheet* parentSheet = 0) const;
     PassRefPtr<CSSRule> createCSSOMWrapper(CSSRule* parentRule) const;
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
     StyleRuleBase(Type type, signed sourceLine = 0) : m_type(type), m_sourceLine(sourceLine) { }
     StyleRuleBase(const StyleRuleBase& o) : WTF::RefCountedBase(), m_type(o.m_type), m_sourceLine(o.m_sourceLine) { }
@@ -97,13 +100,14 @@ public:
     const StylePropertySet* properties() const { return m_properties.get(); }
     StylePropertySet* mutableProperties();
     
-    void parserAdoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectors) { m_selectorList.adoptSelectorVector(selectors); }
+    void parserAdoptSelectorVector(CSSSelectorVector& selectors) { m_selectorList.adoptSelectorVector(selectors); }
     void wrapperAdoptSelectorList(CSSSelectorList& selectors) { m_selectorList.adopt(selectors); }
     void setProperties(PassRefPtr<StylePropertySet>);
 
     PassRefPtr<StyleRule> copy() const { return adoptRef(new StyleRule(*this)); }
 
     static unsigned averageSizeInBytes();
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
 
 private:
     StyleRule(int sourceLine);
@@ -126,6 +130,8 @@ public:
 
     PassRefPtr<StyleRuleFontFace> copy() const { return adoptRef(new StyleRuleFontFace(*this)); }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     StyleRuleFontFace();
     StyleRuleFontFace(const StyleRuleFontFace&);
@@ -143,12 +149,14 @@ public:
     const StylePropertySet* properties() const { return m_properties.get(); }
     StylePropertySet* mutableProperties();
 
-    void parserAdoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectors) { m_selectorList.adoptSelectorVector(selectors); }
+    void parserAdoptSelectorVector(CSSSelectorVector& selectors) { m_selectorList.adoptSelectorVector(selectors); }
     void wrapperAdoptSelectorList(CSSSelectorList& selectors) { m_selectorList.adopt(selectors); }
     void setProperties(PassRefPtr<StylePropertySet>);
 
     PassRefPtr<StyleRulePage> copy() const { return adoptRef(new StyleRulePage(*this)); }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     StyleRulePage();
     StyleRulePage(const StyleRulePage&);
@@ -163,6 +171,8 @@ public:
     
     void wrapperInsertRule(unsigned, PassRefPtr<StyleRuleBase>);
     void wrapperRemoveRule(unsigned);
+
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
     
 protected:
     StyleRuleBlock(Type, Vector<RefPtr<StyleRuleBase> >& adoptRule);
@@ -183,6 +193,8 @@ public:
 
     PassRefPtr<StyleRuleMedia> copy() const { return adoptRef(new StyleRuleMedia(*this)); }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     StyleRuleMedia(PassRefPtr<MediaQuerySet>, Vector<RefPtr<StyleRuleBase> >& adoptRules);
     StyleRuleMedia(const StyleRuleMedia&);
@@ -192,7 +204,7 @@ private:
 
 class StyleRuleRegion : public StyleRuleBlock {
 public:
-    static PassRefPtr<StyleRuleRegion> create(Vector<OwnPtr<CSSParserSelector> >* selectors, Vector<RefPtr<StyleRuleBase> >& adoptRules)
+    static PassRefPtr<StyleRuleRegion> create(CSSSelectorVector* selectors, Vector<RefPtr<StyleRuleBase> >& adoptRules)
     {
         return adoptRef(new StyleRuleRegion(selectors, adoptRules));
     }
@@ -201,8 +213,10 @@ public:
 
     PassRefPtr<StyleRuleRegion> copy() const { return adoptRef(new StyleRuleRegion(*this)); }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
-    StyleRuleRegion(Vector<OwnPtr<CSSParserSelector> >*, Vector<RefPtr<StyleRuleBase> >& adoptRules);
+    StyleRuleRegion(CSSSelectorVector*, Vector<RefPtr<StyleRuleBase> >& adoptRules);
     StyleRuleRegion(const StyleRuleRegion&);
     
     CSSSelectorList m_selectorList;
diff --git a/Source/WebCore/css/StyleRuleImport.cpp b/Source/WebCore/css/StyleRuleImport.cpp
index df8fa0774..70ee9c3df 100644
--- a/Source/WebCore/css/StyleRuleImport.cpp
+++ b/Source/WebCore/css/StyleRuleImport.cpp
@@ -128,4 +128,12 @@ void StyleRuleImport::requestStyleSheet()
     }
 }
 
+void StyleRuleImport::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_strHref);
+    info.addInstrumentedMember(m_mediaQueries);
+    info.addInstrumentedMember(m_styleSheet);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/StyleRuleImport.h b/Source/WebCore/css/StyleRuleImport.h
index 3a8d01389..c0f898c65 100644
--- a/Source/WebCore/css/StyleRuleImport.h
+++ b/Source/WebCore/css/StyleRuleImport.h
@@ -30,6 +30,7 @@ namespace WebCore {
 
 class CachedCSSStyleSheet;
 class MediaQuerySet;
+class MemoryObjectInfo;
 class StyleSheetContents;
 
 class StyleRuleImport : public StyleRuleBase {
@@ -50,6 +51,8 @@ public:
 
     void requestStyleSheet();
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     // NOTE: We put the CachedStyleSheetClient in a member instead of inheriting from it
     // to avoid adding a vptr to StyleRuleImport.
diff --git a/Source/WebCore/css/StyleSheetContents.cpp b/Source/WebCore/css/StyleSheetContents.cpp
index 970c828ca..292debb94 100644
--- a/Source/WebCore/css/StyleSheetContents.cpp
+++ b/Source/WebCore/css/StyleSheetContents.cpp
@@ -26,6 +26,7 @@
 #include "CSSStyleSheet.h"
 #include "CachedCSSStyleSheet.h"
 #include "Document.h"
+#include "MemoryInstrumentation.h"
 #include "Node.h"
 #include "SecurityOrigin.h"
 #include "StylePropertySet.h"
@@ -409,6 +410,46 @@ void StyleSheetContents::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
     }
 }
 
+static bool childRulesHaveFailedOrCanceledSubresources(const Vector<RefPtr<StyleRuleBase> >& rules)
+{
+    for (unsigned i = 0; i < rules.size(); ++i) {
+        const StyleRuleBase* rule = rules[i].get();
+        switch (rule->type()) {
+        case StyleRuleBase::Style:
+            if (static_cast<const StyleRule*>(rule)->properties()->hasFailedOrCanceledSubresources())
+                return true;
+            break;
+        case StyleRuleBase::FontFace:
+            if (static_cast<const StyleRuleFontFace*>(rule)->properties()->hasFailedOrCanceledSubresources())
+                return true;
+            break;
+        case StyleRuleBase::Media:
+            if (childRulesHaveFailedOrCanceledSubresources(static_cast<const StyleRuleMedia*>(rule)->childRules()))
+                return true;
+            break;
+        case StyleRuleBase::Region:
+            if (childRulesHaveFailedOrCanceledSubresources(static_cast<const StyleRuleRegion*>(rule)->childRules()))
+                return true;
+            break;
+        case StyleRuleBase::Import:
+            ASSERT_NOT_REACHED();
+        case StyleRuleBase::Page:
+        case StyleRuleBase::Keyframes:
+        case StyleRuleBase::Unknown:
+        case StyleRuleBase::Charset:
+        case StyleRuleBase::Keyframe:
+            break;
+        }
+    }
+    return false;
+}
+
+bool StyleSheetContents::hasFailedOrCanceledSubresources() const
+{
+    ASSERT(isCacheable());
+    return childRulesHaveFailedOrCanceledSubresources(m_childRules);
+}
+
 StyleSheetContents* StyleSheetContents::parentStyleSheet() const
 {
     return m_ownerRule ? m_ownerRule->parentStyleSheet() : 0;
@@ -441,4 +482,16 @@ void StyleSheetContents::removedFromMemoryCache()
     m_isInMemoryCache = false;
 }
 
+void StyleSheetContents::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_originalURL);
+    info.addMember(m_finalURL);
+    info.addMember(m_encodingFromCharsetRule);
+    info.addVector(m_importRules);
+    info.addInstrumentedVector(m_childRules);
+    info.addHashMap(m_namespaces);
+    info.addVector(m_clients);
+}
+
 }
diff --git a/Source/WebCore/css/StyleSheetContents.h b/Source/WebCore/css/StyleSheetContents.h
index 7df34b703..b1ddb8ccb 100644
--- a/Source/WebCore/css/StyleSheetContents.h
+++ b/Source/WebCore/css/StyleSheetContents.h
@@ -34,6 +34,7 @@ namespace WebCore {
 class CSSStyleSheet;
 class CachedCSSStyleSheet;
 class Document;
+class MemoryObjectInfo;
 class Node;
 class SecurityOrigin;
 class StyleRuleBase;
@@ -78,6 +79,7 @@ public:
     const String& charset() const { return m_parserContext.charset; }
 
     bool loadCompleted() const { return m_loadCompleted; }
+    bool hasFailedOrCanceledSubresources() const;
 
     KURL completeURL(const String& url) const;
     void addSubresourceStyleURLs(ListHashSet<KURL>&);
@@ -137,6 +139,8 @@ public:
     void addedToMemoryCache();
     void removedFromMemoryCache();
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     StyleSheetContents(StyleRuleImport* ownerRule, const String& originalURL, const KURL& baseURL, const CSSParserContext&);
     StyleSheetContents(const StyleSheetContents&);
diff --git a/Source/WebCore/css/WebKitCSSFilterValue.cpp b/Source/WebCore/css/WebKitCSSFilterValue.cpp
index 2916dc2d1..f70b2673a 100644
--- a/Source/WebCore/css/WebKitCSSFilterValue.cpp
+++ b/Source/WebCore/css/WebKitCSSFilterValue.cpp
@@ -29,6 +29,7 @@
 #if ENABLE(CSS_FILTERS)
 
 #include "CSSValueList.h"
+#include "MemoryInstrumentation.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/text/WTFString.h>
 
@@ -110,6 +111,12 @@ PassRefPtr<WebKitCSSFilterValue> WebKitCSSFilterValue::cloneForCSSOM() const
     return adoptRef(new WebKitCSSFilterValue(*this));
 }
 
+void WebKitCSSFilterValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSValueList::reportDescendantMemoryUsage(memoryObjectInfo);
+}
+
 }
 
 #endif // ENABLE(CSS_FILTERS)
diff --git a/Source/WebCore/css/WebKitCSSFilterValue.h b/Source/WebCore/css/WebKitCSSFilterValue.h
index a34d5745c..08b3e9f9a 100644
--- a/Source/WebCore/css/WebKitCSSFilterValue.h
+++ b/Source/WebCore/css/WebKitCSSFilterValue.h
@@ -68,6 +68,8 @@ public:
 
     PassRefPtr<WebKitCSSFilterValue> cloneForCSSOM() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     WebKitCSSFilterValue(FilterOperationType);
     WebKitCSSFilterValue(const WebKitCSSFilterValue& cloneFrom);
diff --git a/Source/WebCore/css/WebKitCSSKeyframeRule.cpp b/Source/WebCore/css/WebKitCSSKeyframeRule.cpp
index 0577b46f0..5c093022c 100644
--- a/Source/WebCore/css/WebKitCSSKeyframeRule.cpp
+++ b/Source/WebCore/css/WebKitCSSKeyframeRule.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "WebKitCSSKeyframeRule.h"
 
+#include "MemoryInstrumentation.h"
 #include "PropertySetCSSStyleDeclaration.h"
 #include "StylePropertySet.h"
 #include "WebKitCSSKeyframesRule.h"
@@ -85,6 +86,13 @@ String StyleKeyframe::cssText() const
     return result;
 }
 
+void StyleKeyframe::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedMember(m_properties);
+    info.addMember(m_key);
+}
+
 WebKitCSSKeyframeRule::WebKitCSSKeyframeRule(StyleKeyframe* keyframe, WebKitCSSKeyframesRule* parent)
     : CSSRule(0, CSSRule::WEBKIT_KEYFRAME_RULE)
     , m_keyframe(keyframe)
@@ -105,4 +113,12 @@ CSSStyleDeclaration* WebKitCSSKeyframeRule::style() const
     return m_propertiesCSSOMWrapper.get();
 }
 
+void WebKitCSSKeyframeRule::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSRule::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_keyframe);
+    info.addInstrumentedMember(m_propertiesCSSOMWrapper);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/WebKitCSSKeyframeRule.h b/Source/WebCore/css/WebKitCSSKeyframeRule.h
index 444b64820..f0e697e7a 100644
--- a/Source/WebCore/css/WebKitCSSKeyframeRule.h
+++ b/Source/WebCore/css/WebKitCSSKeyframeRule.h
@@ -34,6 +34,7 @@
 
 namespace WebCore {
 
+class MemoryInstrumentation;
 class StyleRuleCSSStyleDeclaration;
 class WebKitCSSKeyframesRule;
 
@@ -55,6 +56,8 @@ public:
     
     String cssText() const;
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:    
     StyleKeyframe() { }
     
@@ -77,6 +80,8 @@ public:
 
     String cssText() const { return m_keyframe->cssText(); }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     WebKitCSSKeyframeRule(StyleKeyframe*, WebKitCSSKeyframesRule* parent);
 
diff --git a/Source/WebCore/css/WebKitCSSKeyframesRule.cpp b/Source/WebCore/css/WebKitCSSKeyframesRule.cpp
index 12700e9fd..383068da6 100644
--- a/Source/WebCore/css/WebKitCSSKeyframesRule.cpp
+++ b/Source/WebCore/css/WebKitCSSKeyframesRule.cpp
@@ -29,6 +29,7 @@
 #include "CSSParser.h"
 #include "CSSRuleList.h"
 #include "CSSStyleSheet.h"
+#include "MemoryInstrumentation.h"
 #include "StylePropertySet.h"
 #include "StyleSheet.h"
 #include "WebKitCSSKeyframeRule.h"
@@ -86,6 +87,13 @@ int StyleRuleKeyframes::findKeyframeIndex(const String& key) const
     return -1;
 }
 
+void StyleRuleKeyframes::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addInstrumentedVector(m_keyframes);
+    info.addMember(m_name);
+}
+
 WebKitCSSKeyframesRule::WebKitCSSKeyframesRule(StyleRuleKeyframes* keyframesRule, CSSStyleSheet* parent)
     : CSSRule(parent, CSSRule::WEBKIT_KEYFRAMES_RULE)
     , m_keyframesRule(keyframesRule)
@@ -198,4 +206,13 @@ void WebKitCSSKeyframesRule::reattach(StyleRuleKeyframes* rule)
     m_keyframesRule = rule;
 }
 
+void WebKitCSSKeyframesRule::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSRule::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_keyframesRule);
+    info.addInstrumentedVector(m_childRuleCSSOMWrappers);
+    info.addInstrumentedMember(m_ruleListCSSOMWrapper);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/WebKitCSSKeyframesRule.h b/Source/WebCore/css/WebKitCSSKeyframesRule.h
index 2f9365c80..e83c08cbd 100644
--- a/Source/WebCore/css/WebKitCSSKeyframesRule.h
+++ b/Source/WebCore/css/WebKitCSSKeyframesRule.h
@@ -36,6 +36,7 @@
 namespace WebCore {
 
 class CSSRuleList;
+class MemoryObjectInfo;
 class StyleKeyframe;
 class WebKitCSSKeyframeRule;
 
@@ -58,6 +59,8 @@ public:
 
     PassRefPtr<StyleRuleKeyframes> copy() const { return adoptRef(new StyleRuleKeyframes(*this)); }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     StyleRuleKeyframes();
     StyleRuleKeyframes(const StyleRuleKeyframes&);
@@ -89,6 +92,8 @@ public:
 
     void reattach(StyleRuleKeyframes*);
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     WebKitCSSKeyframesRule(StyleRuleKeyframes*, CSSStyleSheet* parent);
 
diff --git a/Source/WebCore/css/WebKitCSSMixFunctionValue.cpp b/Source/WebCore/css/WebKitCSSMixFunctionValue.cpp
new file mode 100644
index 000000000..7f8d27d85
--- /dev/null
+++ b/Source/WebCore/css/WebKitCSSMixFunctionValue.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebKitCSSMixFunctionValue.h"
+
+#include "MemoryInstrumentation.h"
+
+#if ENABLE(CSS_SHADERS)
+
+namespace WebCore {
+    
+WebKitCSSMixFunctionValue::WebKitCSSMixFunctionValue()
+    : CSSValueList(WebKitCSSMixFunctionValueClass, SpaceSeparator)
+{
+}
+
+WebKitCSSMixFunctionValue::WebKitCSSMixFunctionValue(const WebKitCSSMixFunctionValue& cloneFrom)
+    : CSSValueList(cloneFrom)
+{
+}
+
+String WebKitCSSMixFunctionValue::customCssText() const
+{
+    return "mix(" + CSSValueList::customCssText() + ")";
+}
+
+PassRefPtr<WebKitCSSMixFunctionValue> WebKitCSSMixFunctionValue::cloneForCSSOM() const
+{
+    return adoptRef(new WebKitCSSMixFunctionValue(*this));
+}
+
+void WebKitCSSMixFunctionValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSValueList::reportDescendantMemoryUsage(memoryObjectInfo);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(CSS_SHADERS)
diff --git a/Source/WebCore/css/WebKitCSSMixFunctionValue.h b/Source/WebCore/css/WebKitCSSMixFunctionValue.h
new file mode 100644
index 000000000..af9794a19
--- /dev/null
+++ b/Source/WebCore/css/WebKitCSSMixFunctionValue.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef WebKitCSSMixFunctionValue_h
+#define WebKitCSSMixFunctionValue_h
+
+#if ENABLE(CSS_SHADERS)
+
+#include "CSSValueList.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+    
+class WebKitCSSMixFunctionValue : public CSSValueList {
+public:
+    static PassRefPtr<WebKitCSSMixFunctionValue> create()
+    {
+        return adoptRef(new WebKitCSSMixFunctionValue());
+    }
+
+    String customCssText() const;
+
+    PassRefPtr<WebKitCSSMixFunctionValue> cloneForCSSOM() const;
+
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
+private:
+    WebKitCSSMixFunctionValue();
+    WebKitCSSMixFunctionValue(const WebKitCSSMixFunctionValue& cloneFrom);
+};
+    
+} // namespace WebCore
+
+#endif // ENABLE(CSS_SHADERS)
+
+#endif
diff --git a/Source/WebCore/css/WebKitCSSRegionRule.cpp b/Source/WebCore/css/WebKitCSSRegionRule.cpp
index bdab5acce..2db2059f1 100644
--- a/Source/WebCore/css/WebKitCSSRegionRule.cpp
+++ b/Source/WebCore/css/WebKitCSSRegionRule.cpp
@@ -108,6 +108,15 @@ void WebKitCSSRegionRule::reattach(StyleRuleRegion* rule)
     }
 }
 
+void WebKitCSSRegionRule::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSRule::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_regionRule);
+    info.addInstrumentedVector(m_childRuleCSSOMWrappers);
+    info.addInstrumentedMember(m_ruleListCSSOMWrapper);
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/css/WebKitCSSRegionRule.h b/Source/WebCore/css/WebKitCSSRegionRule.h
index 2b4216699..c02f4c4c2 100644
--- a/Source/WebCore/css/WebKitCSSRegionRule.h
+++ b/Source/WebCore/css/WebKitCSSRegionRule.h
@@ -57,6 +57,8 @@ public:
 
     void reattach(StyleRuleRegion*);
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     WebKitCSSRegionRule(StyleRuleRegion*, CSSStyleSheet* parent);
 
diff --git a/Source/WebCore/css/WebKitCSSSVGDocumentValue.cpp b/Source/WebCore/css/WebKitCSSSVGDocumentValue.cpp
index 490250496..3e16bbd32 100644
--- a/Source/WebCore/css/WebKitCSSSVGDocumentValue.cpp
+++ b/Source/WebCore/css/WebKitCSSSVGDocumentValue.cpp
@@ -30,6 +30,7 @@
 #include "CSSParser.h"
 #include "CachedResourceLoader.h"
 #include "Document.h"
+#include "MemoryInstrumentation.h"
 
 namespace WebCore {
 
@@ -63,6 +64,13 @@ String WebKitCSSSVGDocumentValue::customCssText() const
     return quoteCSSStringIfNeeded(m_url);
 }
 
+void WebKitCSSSVGDocumentValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_url);
+    // FIXME: add m_document when cached resources are instrumented.
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/css/WebKitCSSSVGDocumentValue.h b/Source/WebCore/css/WebKitCSSSVGDocumentValue.h
index cb03f56ee..96bcc8c30 100644
--- a/Source/WebCore/css/WebKitCSSSVGDocumentValue.h
+++ b/Source/WebCore/css/WebKitCSSSVGDocumentValue.h
@@ -45,6 +45,8 @@ public:
     const String& url() const { return m_url; }
     bool loadRequested() const { return m_loadRequested; }
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     WebKitCSSSVGDocumentValue(const String& url);
 
diff --git a/Source/WebCore/css/WebKitCSSShaderValue.cpp b/Source/WebCore/css/WebKitCSSShaderValue.cpp
index 8651758ed..482a36089 100644
--- a/Source/WebCore/css/WebKitCSSShaderValue.cpp
+++ b/Source/WebCore/css/WebKitCSSShaderValue.cpp
@@ -35,6 +35,7 @@
 #include "CachedResourceLoader.h"
 #include "CSSParser.h"
 #include "Document.h"
+#include "MemoryInstrumentation.h"
 #include "StyleCachedShader.h"
 #include "StylePendingShader.h"
 
@@ -79,6 +80,12 @@ String WebKitCSSShaderValue::customCssText() const
     return "url(" + quoteCSSURLIfNeeded(m_url) + ")";
 }
 
+void WebKitCSSShaderValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_url);
+}
+    
 } // namespace WebCore
 
 #endif // ENABLE(CSS_SHADERS)
diff --git a/Source/WebCore/css/WebKitCSSShaderValue.h b/Source/WebCore/css/WebKitCSSShaderValue.h
index fd95bc63c..c43201ca2 100644
--- a/Source/WebCore/css/WebKitCSSShaderValue.h
+++ b/Source/WebCore/css/WebKitCSSShaderValue.h
@@ -50,6 +50,8 @@ public:
 
     String customCssText() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     WebKitCSSShaderValue(const String& url);
 
diff --git a/Source/WebCore/css/WebKitCSSTransformValue.cpp b/Source/WebCore/css/WebKitCSSTransformValue.cpp
index 87ded7da6..8e196e5ac 100644
--- a/Source/WebCore/css/WebKitCSSTransformValue.cpp
+++ b/Source/WebCore/css/WebKitCSSTransformValue.cpp
@@ -27,6 +27,7 @@
 #include "WebKitCSSTransformValue.h"
 
 #include "CSSValueList.h"
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/text/StringBuilder.h>
@@ -104,4 +105,10 @@ PassRefPtr<WebKitCSSTransformValue> WebKitCSSTransformValue::cloneForCSSOM() con
     return adoptRef(new WebKitCSSTransformValue(*this));
 }
 
+void WebKitCSSTransformValue::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    CSSValueList::reportDescendantMemoryUsage(memoryObjectInfo);
+}
+
 }
diff --git a/Source/WebCore/css/WebKitCSSTransformValue.h b/Source/WebCore/css/WebKitCSSTransformValue.h
index 5fc4f7d6b..fd117f232 100644
--- a/Source/WebCore/css/WebKitCSSTransformValue.h
+++ b/Source/WebCore/css/WebKitCSSTransformValue.h
@@ -74,6 +74,8 @@ public:
     
     PassRefPtr<WebKitCSSTransformValue> cloneForCSSOM() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     WebKitCSSTransformValue(TransformOperationType);
     WebKitCSSTransformValue(const WebKitCSSTransformValue& cloneFrom);
diff --git a/Source/WebCore/css/html.css b/Source/WebCore/css/html.css
index e5ad78cff..43b65a139 100644
--- a/Source/WebCore/css/html.css
+++ b/Source/WebCore/css/html.css
@@ -435,6 +435,7 @@ input[type="search"] {
 input::-webkit-textfield-decoration-container {
     display: -webkit-box;
     -webkit-box-align: center;
+    -webkit-user-modify: read-only !important;
 }
 
 input[type="search"]::-webkit-textfield-decoration-container {
@@ -445,24 +446,28 @@ input[type="search"]::-webkit-search-cancel-button {
     -webkit-appearance: searchfield-cancel-button;
     display: block;
     -webkit-box-flex: 0;
+    -webkit-user-modify: read-only !important;
 }
 
 input[type="search"]::-webkit-search-decoration {
     -webkit-appearance: searchfield-decoration;
     display: block;
     -webkit-box-flex: 0;
+    -webkit-user-modify: read-only !important;
 }
 
 input[type="search"]::-webkit-search-results-decoration {
     -webkit-appearance: searchfield-results-decoration;
     display: block;
     -webkit-box-flex: 0;
+    -webkit-user-modify: read-only !important;
 }
 
 input[type="search"]::-webkit-search-results-button {
     -webkit-appearance: searchfield-results-button;
     display: block;
     -webkit-box-flex: 0;
+    -webkit-user-modify: read-only !important;
 }
 
 #if defined(ENABLE_DATALIST_ELEMENT) && ENABLE_DATALIST_ELEMENT
@@ -471,14 +476,84 @@ datalist {
 }
 #endif
 
+#if defined(ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS) && ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS
+input[type="time"] {
+    font-family: monospace;
+}
+
+input::-webkit-datetime-edit {
+    -webkit-user-modify: read-only !important;
+    display: -webkit-box;
+    -webkit-box-align: center;
+}
+
+input::-webkit-datetime-edit-ampm-field {
+    -webkit-user-modify: read-only !important;
+    border: none;
+    width: 2em;
+    padding: 2px;
+}
+
+input::-webkit-datetime-edit-hour-field {
+    -webkit-user-modify: read-only !important;
+    display: inline-block;
+    border: none;
+    text-align: center;
+    width: 1.2em;
+    padding: 2px;
+}
+
+input::-webkit-datetime-edit-millisecond-field {
+    -webkit-user-modify: read-only !important;
+    display: inline-block;
+    border: none;
+    text-align: center;
+    width: 1.8em;
+    padding: 2px;
+}
+
+input::-webkit-datetime-edit-minute-field {
+    -webkit-user-modify: read-only !important;
+    display: inline-block;
+    border: none;
+    text-align: center;
+    width: 1.2em;
+    padding: 2px;
+}
+
+/* This selector is used when step >= 3600 second but format contains minute field. */
+input::-webkit-datetime-edit-minute-field[readonly] {
+    color: GrayText;
+}
+
+input::-webkit-datetime-edit-second-field {
+    -webkit-user-modify: read-only !important;
+    display: inline-block;
+    border: none;
+    text-align: center;
+    width: 1.2em;
+    padding: 2px;
+}
+
+/* This selector is used when step >= 60 second but format contains second field. */
+input::-webkit-datetime-edit-second-field[readonly] {
+    color: GrayText;
+}
+#endif
+
 input::-webkit-inner-spin-button {
     -webkit-appearance: inner-spin-button;
     display: block;
     position: relative;
     cursor: default;
+    /* This height property is ignored for input type "number" and others which
+     * use RenderTextControlSingleLine as renderer which sets height of spin
+     * button in layout(). */
+    height: 1.5em;
     vertical-align: top;
     -webkit-box-flex: 0;
     -webkit-user-select: none;
+    -webkit-user-modify: read-only !important;
 }
 
 #if defined(ENABLE_INPUT_SPEECH) && ENABLE_INPUT_SPEECH
@@ -487,6 +562,7 @@ input::-webkit-input-speech-button {
     display: block;
     vertical-align: top;
     -webkit-box-flex: 0;
+    -webkit-user-modify: read-only !important;
 }
 #endif
 
@@ -523,6 +599,7 @@ input::-webkit-input-placeholder, isindex::-webkit-input-placeholder {
     white-space: pre;
     word-wrap: normal;
     overflow: hidden;
+    -webkit-user-modify: read-only !important;
 }
 
 input[type="password"] {
@@ -562,6 +639,7 @@ input[type="button"], input[type="submit"], input[type="reset"] {
 
 input[type="file"]::-webkit-file-upload-button {
     -webkit-appearance: push-button;
+    -webkit-user-modify: read-only !important;
     white-space: nowrap;
     margin: 0;
     font-size: inherit;
@@ -590,6 +668,7 @@ input[type="range"]::-webkit-slider-container, input[type="range"]::-webkit-medi
     -webkit-box-align: center;
     -webkit-box-orient: horizontal; /* This property is updated by C++ code. */
     -webkit-box-sizing: border-box;
+    -webkit-user-modify: read-only !important;
     display: -webkit-box;
     height: 100%;
     width: 100%;
@@ -598,19 +677,22 @@ input[type="range"]::-webkit-slider-container, input[type="range"]::-webkit-medi
 input[type="range"]::-webkit-slider-runnable-track {
     -webkit-box-flex: 1;
     -webkit-box-sizing: border-box;
+    -webkit-user-modify: read-only !important;
     display: block;
 }
 
 input[type="range"]::-webkit-slider-thumb, input[type="range"]::-webkit-media-slider-thumb {
     -webkit-appearance: sliderthumb-horizontal;
     -webkit-box-sizing: border-box;
+    -webkit-user-modify: read-only !important;
     display: block;
     position: relative;
 }
 
 input[type="button"]:disabled, input[type="submit"]:disabled, input[type="reset"]:disabled,
 input[type="file"]:disabled::-webkit-file-upload-button, button:disabled,
-select:disabled, keygen:disabled, optgroup:disabled, option:disabled {
+select:disabled, keygen:disabled, optgroup:disabled, option:disabled,
+select[disabled]>option {
     color: GrayText
 }
 
@@ -648,6 +730,7 @@ input[type="color"]::-webkit-color-swatch-wrapper {
     display:-webkit-box;
     padding: 4px 2px;
     -webkit-box-sizing: border-box;
+    -webkit-user-modify: read-only !important;
     width: 100%;
     height: 100%
 }
@@ -656,6 +739,7 @@ input[type="color"]::-webkit-color-swatch {
     background-color: #000000;
     border: 1px solid #777777;
     -webkit-box-flex: 1;
+    -webkit-user-modify: read-only !important;
 }
 
 #if defined(ENABLE_DATALIST_ELEMENT) && ENABLE_DATALIST_ELEMENT
@@ -684,6 +768,7 @@ input::-webkit-calendar-picker-indicator {
     width: 0.66em;
     height: 0.66em;
     padding: 0.17em 0.34em;
+    -webkit-user-modify: read-only !important;
 }
 
 input::-webkit-calendar-picker-indicator:hover {
@@ -857,6 +942,14 @@ progress {
     vertical-align: -0.2em;
 }
 
+progress::-webkit-progress-inner-element {
+    -webkit-appearance: inherit;
+    -webkit-box-sizing: inherit;
+    -webkit-user-modify: read-only;
+    height: 100%;
+    width: 100%;
+}
+
 progress::-webkit-progress-bar {
     background-color: gray;
     height: 100%;
diff --git a/Source/WebCore/css/mathml.css b/Source/WebCore/css/mathml.css
index a96e3fa4b..fa4288f51 100644
--- a/Source/WebCore/css/mathml.css
+++ b/Source/WebCore/css/mathml.css
@@ -1,13 +1,20 @@
 @namespace "http://www.w3.org/1998/Math/MathML";
 
 math {
+    -webkit-line-box-contain: glyphs replaced;
+    line-height: 0;
+}
+mtext {
+    line-height: 1.0;
+}
+
+math {
     font-family: STIXGeneral, Symbol, "Times New Roman", sans-serif;
     display: inline-block;
     padding: 0px;
     margin: 0px;
     text-align: left;
     vertical-align: baseline;
-    line-height: 1.0;
     padding-left: 1px;
     padding-right: 1px;
 }
@@ -160,11 +167,7 @@ mroot > * + * {
     top: 0;
     padding-right: 0.4em;
     padding-left: 0.2em;
-    padding-bottom: 0.2em; /* FIXME: change to 0.25em */
-}
-
-mroot > * + mrow, mroot > * + mfenced { /* FIXME: eliminate */
-    padding-bottom: 0.4em;
+    padding-bottom: 0.35em;
 }
 
 mtable {
@@ -179,7 +182,7 @@ mtr {
 
 mtd {
     display: table-cell;
-    padding: 0 0.5ex;
+    padding: 0.5ex;
 }
 
 mtable[columnalign="left"], mtr[columnalign="left"], mtd[columnalign="left"] {
diff --git a/Source/WebCore/dom/CharacterData.cpp b/Source/WebCore/dom/CharacterData.cpp
index af1d8fed4..91f5ac70f 100644
--- a/Source/WebCore/dom/CharacterData.cpp
+++ b/Source/WebCore/dom/CharacterData.cpp
@@ -94,9 +94,9 @@ unsigned CharacterData::parserAppendData(const UChar* data, unsigned dataLength,
 
 void CharacterData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<CharacterData> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
-    info.visitBaseClass<Node>(this);
-    info.addString(m_data);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    Node::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_data);
 }
 
 void CharacterData::appendData(const String& data, ExceptionCode&)
@@ -209,14 +209,16 @@ void CharacterData::dispatchModifiedEvent(const String& oldData)
     if (OwnPtr<MutationObserverInterestGroup> mutationRecipients = MutationObserverInterestGroup::createForCharacterDataMutation(this))
         mutationRecipients->enqueueMutationRecord(MutationRecord::createCharacterData(this, oldData));
 #endif
-    if (parentNode())
-        parentNode()->childrenChanged();
-    if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER))
-        dispatchScopedEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, oldData, m_data));
-    dispatchSubtreeModifiedEvent();
+    if (!isInShadowTree()) {
+        if (parentNode())
+            parentNode()->childrenChanged();
+        if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER))
+            dispatchScopedEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, oldData, m_data));
+        dispatchSubtreeModifiedEvent();
 #if ENABLE(INSPECTOR)
-    InspectorInstrumentation::characterDataModified(document(), this);
+        InspectorInstrumentation::characterDataModified(document(), this);
 #endif
+    }
 }
 
 void CharacterData::checkCharDataOperation(unsigned offset, ExceptionCode& ec)
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index fd53a2fad..add53ce9a 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -60,6 +60,8 @@ static NodeCallbackQueue* s_postAttachCallbackQueue;
 static size_t s_attachDepth;
 static bool s_shouldReEnableMemoryCacheCallsAfterAttach;
 
+ChildNodesLazySnapshot* ChildNodesLazySnapshot::latestSnapshot = 0;
+
 static void collectTargetNodes(Node* node, NodeVector& nodes)
 {
     if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) {
@@ -271,11 +273,21 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
     if (next && (next->previousSibling() == newChild || next == newChild)) // nothing to do
         return true;
 
+    // Does this one more time because removeChild() fires a MutationEvent.
+    checkReplaceChild(newChild.get(), oldChild, ec);
+    if (ec)
+        return false;
+
     NodeVector targets;
     collectChildrenAndRemoveFromOldParent(newChild.get(), targets, ec);
     if (ec)
         return false;
 
+    // Does this yet another check because collectChildrenAndRemoveFromOldParent() fires a MutationEvent.
+    checkReplaceChild(newChild.get(), oldChild, ec);
+    if (ec)
+        return false;
+
     InspectorInstrumentation::willInsertDOMNode(document(), this);
 
     // Add the new child(ren)
@@ -685,22 +697,16 @@ void ContainerNode::childrenChanged(bool changedByParser, Node*, Node*, int chil
 
 void ContainerNode::cloneChildNodes(ContainerNode *clone)
 {
-    // disable the delete button so it's elements are not serialized into the markup
-    bool isEditorEnabled = false;
-    if (document()->frame() && document()->frame()->editor()->canEdit()) {
-        FrameSelection* selection = document()->frame()->selection();
-        Element* root = selection ? selection->rootEditableElement() : 0;
-        isEditorEnabled = root && isDescendantOf(root);
+    HTMLElement* deleteButtonContainerElement = 0;
+    if (Frame* frame = document()->frame())
+        deleteButtonContainerElement = frame->editor()->deleteButtonController()->containerElement();
 
-        if (isEditorEnabled)
-            document()->frame()->editor()->deleteButtonController()->disable();
-    }
-    
     ExceptionCode ec = 0;
-    for (Node* n = firstChild(); n && !ec; n = n->nextSibling())
+    for (Node* n = firstChild(); n && !ec; n = n->nextSibling()) {
+        if (n == deleteButtonContainerElement)
+            continue;
         clone->appendChild(n->cloneNode(true), ec);
-    if (isEditorEnabled && document()->frame())
-        document()->frame()->editor()->deleteButtonController()->enable();
+    }
 }
 
 bool ContainerNode::getUpperLeftCorner(FloatPoint& point) const
diff --git a/Source/WebCore/dom/ContainerNode.h b/Source/WebCore/dom/ContainerNode.h
index 9abaf2373..c19ae0bec 100644
--- a/Source/WebCore/dom/ContainerNode.h
+++ b/Source/WebCore/dom/ContainerNode.h
@@ -27,6 +27,9 @@
 #include "ExceptionCodePlaceholder.h"
 #include "Node.h"
 
+#include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
+
 namespace WebCore {
 
 class FloatPoint;
@@ -101,8 +104,8 @@ public:
 
     virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo<ContainerNode> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
-        info.visitBaseClass<Node>(this);
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        Node::reportMemoryUsage(memoryObjectInfo);
         info.addInstrumentedMember(m_firstChild);
         info.addInstrumentedMember(m_lastChild);
     }
@@ -298,6 +301,71 @@ inline void getChildNodes(Node* node, NodeVector& nodes)
         nodes.append(child);
 }
 
+class ChildNodesLazySnapshot {
+    WTF_MAKE_NONCOPYABLE(ChildNodesLazySnapshot);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    explicit ChildNodesLazySnapshot(Node* parentNode)
+        : m_currentNode(parentNode->firstChild())
+        , m_currentIndex(0)
+    {
+        m_nextSnapshot = latestSnapshot;
+        latestSnapshot = this;
+    }
+
+    ~ChildNodesLazySnapshot()
+    {
+        latestSnapshot = m_nextSnapshot;
+    }
+
+    // Returns 0 if there is no next Node.
+    Node* nextNode()
+    {
+        if (LIKELY(!hasSnapshot())) {
+            Node* node = m_currentNode;
+            if (m_currentNode)
+                m_currentNode = m_currentNode->nextSibling();
+            return node;
+        }
+        Vector<RefPtr<Node> >* nodeVector = m_childNodes.get();
+        if (m_currentIndex >= nodeVector->size())
+            return 0;
+        return (*nodeVector)[m_currentIndex++].get();
+    }
+
+    void takeSnapshot()
+    {
+        if (hasSnapshot())
+            return;
+        m_childNodes = adoptPtr(new Vector<RefPtr<Node> >());
+        Node* node = m_currentNode;
+        while (node) {
+            m_childNodes->append(node);
+            node = node->nextSibling();
+        }
+    }
+
+    ChildNodesLazySnapshot* nextSnapshot() { return m_nextSnapshot; }
+    bool hasSnapshot() { return !!m_childNodes.get(); }
+
+    static void takeChildNodesLazySnapshot()
+    {
+        ChildNodesLazySnapshot* snapshot = latestSnapshot;
+        while (snapshot && !snapshot->hasSnapshot()) {
+            snapshot->takeSnapshot();
+            snapshot = snapshot->nextSnapshot();
+        }
+    }
+
+private:
+    static ChildNodesLazySnapshot* latestSnapshot;
+
+    Node* m_currentNode;
+    unsigned m_currentIndex;
+    OwnPtr<Vector<RefPtr<Node> > > m_childNodes; // Lazily instantiated.
+    ChildNodesLazySnapshot* m_nextSnapshot;
+};
+
 } // namespace WebCore
 
 #endif // ContainerNode_h
diff --git a/Source/WebCore/dom/ContainerNodeAlgorithms.cpp b/Source/WebCore/dom/ContainerNodeAlgorithms.cpp
index c8959dfb8..2edea30e0 100644
--- a/Source/WebCore/dom/ContainerNodeAlgorithms.cpp
+++ b/Source/WebCore/dom/ContainerNodeAlgorithms.cpp
@@ -34,16 +34,15 @@ namespace WebCore {
 
 void ChildNodeInsertionNotifier::notifyDescendantInsertedIntoDocument(ContainerNode* node)
 {
-    NodeVector children;
-    getChildNodes(node, children);
-    for (size_t i = 0; i < children.size(); ++i) {
+    ChildNodesLazySnapshot snapshot(node);
+    while (Node* child = snapshot.nextNode()) {
         // If we have been removed from the document during this loop, then
         // we don't want to tell the rest of our children that they've been
         // inserted into the document because they haven't.
-        if (node->inDocument() && children[i]->parentNode() == node)
-            notifyNodeInsertedIntoDocument(children[i].get());
+        if (node->inDocument() && child->parentNode() == node)
+            notifyNodeInsertedIntoDocument(child);
     }
-        
+
     if (!node->isElementNode())
         return;
 
@@ -67,14 +66,13 @@ void ChildNodeInsertionNotifier::notifyDescendantInsertedIntoTree(ContainerNode*
 
 void ChildNodeRemovalNotifier::notifyDescendantRemovedFromDocument(ContainerNode* node)
 {
-    NodeVector children;
-    getChildNodes(node, children);
-    for (size_t i = 0; i < children.size(); ++i) {
+    ChildNodesLazySnapshot snapshot(node);
+    while (Node* child = snapshot.nextNode()) {
         // If we have been added to the document during this loop, then we
         // don't want to tell the rest of our children that they've been
         // removed from the document because they haven't.
-        if (!node->inDocument() && children[i]->parentNode() == node)
-            notifyNodeRemovedFromDocument(children[i].get());
+        if (!node->inDocument() && child->parentNode() == node)
+            notifyNodeRemovedFromDocument(child);
     }
 
     if (!node->isElementNode())
diff --git a/Source/WebCore/dom/DeviceOrientationController.cpp b/Source/WebCore/dom/DeviceOrientationController.cpp
index 0d002c1e2..302db6124 100644
--- a/Source/WebCore/dom/DeviceOrientationController.cpp
+++ b/Source/WebCore/dom/DeviceOrientationController.cpp
@@ -29,11 +29,13 @@
 #include "DeviceOrientationClient.h"
 #include "DeviceOrientationData.h"
 #include "DeviceOrientationEvent.h"
+#include "InspectorInstrumentation.h"
 
 namespace WebCore {
 
-DeviceOrientationController::DeviceOrientationController(DeviceOrientationClient* client)
+DeviceOrientationController::DeviceOrientationController(Page* page, DeviceOrientationClient* client)
     : m_client(client)
+    , m_page(page)
     , m_timer(this, &DeviceOrientationController::timerFired)
 {
     ASSERT(m_client);
@@ -45,9 +47,9 @@ DeviceOrientationController::~DeviceOrientationController()
     m_client->deviceOrientationControllerDestroyed();
 }
 
-PassOwnPtr<DeviceOrientationController> DeviceOrientationController::create(DeviceOrientationClient* client)
+PassOwnPtr<DeviceOrientationController> DeviceOrientationController::create(Page* page, DeviceOrientationClient* client)
 {
-    return adoptPtr(new DeviceOrientationController(client));
+    return adoptPtr(new DeviceOrientationController(page, client));
 }
 
 void DeviceOrientationController::timerFired(Timer<DeviceOrientationController>* timer)
@@ -129,6 +131,7 @@ void DeviceOrientationController::resumeEventsForAllListeners(DOMWindow* window)
 
 void DeviceOrientationController::didChangeDeviceOrientation(DeviceOrientationData* orientation)
 {
+    orientation = InspectorInstrumentation::overrideDeviceOrientation(m_page, orientation);
     RefPtr<DeviceOrientationEvent> event = DeviceOrientationEvent::create(eventNames().deviceorientationEvent, orientation);
     Vector<RefPtr<DOMWindow> > listenersVector;
     copyToVector(m_listeners, listenersVector);
@@ -151,7 +154,7 @@ bool DeviceOrientationController::isActiveAt(Page* page)
 
 void provideDeviceOrientationTo(Page* page, DeviceOrientationClient* client)
 {
-    DeviceOrientationController::provideTo(page, DeviceOrientationController::supplementName(), DeviceOrientationController::create(client));
+    DeviceOrientationController::provideTo(page, DeviceOrientationController::supplementName(), DeviceOrientationController::create(page, client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DeviceOrientationController.h b/Source/WebCore/dom/DeviceOrientationController.h
index bfe451745..f5e6f9503 100644
--- a/Source/WebCore/dom/DeviceOrientationController.h
+++ b/Source/WebCore/dom/DeviceOrientationController.h
@@ -41,7 +41,7 @@ class DeviceOrientationController : public Supplement<Page> {
 public:
     ~DeviceOrientationController();
 
-    static PassOwnPtr<DeviceOrientationController> create(DeviceOrientationClient*);
+    static PassOwnPtr<DeviceOrientationController> create(Page*, DeviceOrientationClient*);
 
     void addListener(DOMWindow*);
     void removeListener(DOMWindow*);
@@ -61,11 +61,12 @@ public:
     static bool isActiveAt(Page*);
 
 private:
-    explicit DeviceOrientationController(DeviceOrientationClient*);
+    explicit DeviceOrientationController(Page*, DeviceOrientationClient*);
 
     void timerFired(Timer<DeviceOrientationController>*);
 
     DeviceOrientationClient* m_client;
+    Page* m_page;
     typedef HashCountedSet<RefPtr<DOMWindow> > ListenersCountedSet;
     ListenersCountedSet m_listeners;
     ListenersCountedSet m_suspendedListeners;
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index 169d8a5a0..f4304c607 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -51,9 +51,7 @@
 #include "DOMWindow.h"
 #include "DateComponents.h"
 #include "DeviceMotionController.h"
-#include "DeviceMotionEvent.h"
 #include "DeviceOrientationController.h"
-#include "DeviceOrientationEvent.h"
 #include "DocumentEventQueue.h"
 #include "DocumentFragment.h"
 #include "DocumentLoader.h"
@@ -454,7 +452,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_hasXMLDeclaration(0)
     , m_savedRenderer(0)
     , m_designMode(inherit)
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     , m_hasDashboardRegions(false)
     , m_dashboardRegionsDirty(false)
 #endif
@@ -2045,6 +2043,7 @@ void Document::setIsViewSource(bool isViewSource)
         return;
 
     setSecurityOrigin(SecurityOrigin::createUnique());
+    didUpdateSecurityOrigin();
 }
 
 void Document::combineCSSFeatureFlags()
@@ -3714,7 +3713,7 @@ void Document::activeChainNodeDetached(Node* node)
         m_activeNode = m_activeNode->parentNode();
 }
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 const Vector<DashboardRegionValue>& Document::dashboardRegions() const
 {
     return m_dashboardRegions;
@@ -4148,8 +4147,6 @@ void Document::addListenerTypeIfNeeded(const AtomicString& eventType)
 #endif
     else if (eventType == eventNames().scrollEvent)
         addListenerType(SCROLL_LISTENER);
-    else if (eventType == eventNames().webkitRegionLayoutUpdateEvent)
-        addListenerType(REGIONLAYOUTUPDATE_LISTENER);
 }
 
 CSSStyleDeclaration* Document::getOverrideStyle(Element*, const String&)
@@ -5018,6 +5015,8 @@ void Document::initSecurityContext()
                 securityOrigin()->enforceFilePathSeparation();
             }
         }
+        if (settings->thirdPartyStorageBlockingEnabled())
+            securityOrigin()->blockThirdPartyStorage();
     }
 
     Document* parentDocument = ownerElement() ? ownerElement()->document() : 0;
@@ -5063,8 +5062,9 @@ void Document::initSecurityContext()
 
 void Document::initContentSecurityPolicy()
 {
-    if (!m_frame->tree()->parent() || !shouldInheritSecurityOriginFromOwner(m_url))
+    if (!m_frame->tree()->parent() || (!shouldInheritSecurityOriginFromOwner(m_url) && !isPluginDocument()))
         return;
+
     contentSecurityPolicy()->copyStateFrom(m_frame->tree()->parent()->document()->contentSecurityPolicy());
 }
 
@@ -5615,7 +5615,7 @@ void Document::webkitWillEnterFullScreenForElement(Element* element)
     }
 
     if (m_fullScreenElement != documentElement())
-        RenderFullScreen::wrapRenderer(renderer, this);
+        RenderFullScreen::wrapRenderer(renderer, renderer ? renderer->parent() : 0, this);
 
     m_fullScreenElement->setContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(true);
     
@@ -5829,8 +5829,13 @@ void Document::addDocumentToFullScreenChangeEventQueue(Document* doc)
 #if ENABLE(POINTER_LOCK)
 void Document::webkitExitPointerLock()
 {
-    if (page())
-        page()->pointerLockController()->requestPointerUnlock();
+    if (!page())
+        return;
+    if (Element* target = page()->pointerLockController()->element()) {
+        if (target->document() != this)
+            return;
+    }
+    page()->pointerLockController()->requestPointerUnlock();
 }
 
 Element* Document::webkitPointerLockElement() const
@@ -6016,7 +6021,7 @@ DocumentLoader* Document::loader() const
 PassRefPtr<NodeList> Document::getItems(const String& typeNames)
 {
     // Since documet.getItem() is allowed for microdata, typeNames will be null string.
-    // In this case we need to create an unique string identifier to map such request in the cache.
+    // In this case we need to create an empty string identifier to map such request in the cache.
     String localTypeNames = typeNames.isNull() ? MicroDataItemList::undefinedItemType() : typeNames;
 
     return ensureRareData()->ensureNodeLists()->addCacheWithName<MicroDataItemList>(this, DynamicNodeList::MicroDataItemListType, localTypeNames);
@@ -6087,26 +6092,36 @@ void Document::setContextFeatures(PassRefPtr<ContextFeatures> features)
 
 void Document::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<Document> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
     info.addInstrumentedMember(m_styleResolver);
-    info.visitBaseClass<ContainerNode>(this);
+    ContainerNode::reportMemoryUsage(memoryObjectInfo);
     info.addVector(m_customFonts);
-    info.addString(m_documentURI);
-    info.addString(m_baseTarget);
+    info.addMember(m_url);
+    info.addMember(m_baseURL);
+    info.addMember(m_baseURLOverride);
+    info.addMember(m_baseElementURL);
+    info.addMember(m_cookieURL);
+    info.addMember(m_firstPartyForCookies);
+    info.addMember(m_documentURI);
+    info.addMember(m_baseTarget);
+    info.addInstrumentedMember(m_frame);
+    info.addInstrumentedMember(m_cachedResourceLoader);
+    info.addInstrumentedMember(m_elemSheet);
+    info.addInstrumentedMember(m_pageUserSheet);
     if (m_pageGroupUserSheets)
-        info.addVector(*m_pageGroupUserSheets.get());
+        info.addInstrumentedVectorPtr(m_pageGroupUserSheets);
     if (m_userSheets)
-        info.addVector(*m_userSheets.get());
+        info.addInstrumentedVectorPtr(m_userSheets);
     info.addHashSet(m_nodeIterators);
     info.addHashSet(m_ranges);
     info.addListHashSet(m_styleSheetCandidateNodes);
-    info.addString(m_preferredStylesheetSet);
-    info.addString(m_selectedStylesheetSet);
-    info.addString(m_title.string());
-    info.addString(m_rawTitle.string());
-    info.addString(m_xmlEncoding);
-    info.addString(m_xmlVersion);
-    info.addString(m_contentLanguage);
+    info.addMember(m_preferredStylesheetSet);
+    info.addMember(m_selectedStylesheetSet);
+    info.addMember(m_title.string());
+    info.addMember(m_rawTitle.string());
+    info.addMember(m_xmlEncoding);
+    info.addMember(m_xmlVersion);
+    info.addMember(m_contentLanguage);
     info.addHashMap(m_documentNamedItemCollections);
     info.addHashMap(m_windowNamedItemCollections);
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -6118,6 +6133,7 @@ void Document::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     info.addHashSet(m_mediaVolumeCallbackElements);
     info.addHashSet(m_privateBrowsingStateChangedElements);
     info.addHashMap(m_elementsByAccessKey);
+    info.addInstrumentedMember(m_eventQueue);
     info.addHashSet(m_mediaCanStartListeners);
     info.addVector(m_pendingTasks);
 }
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index 017eb8c85..c6767f864 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -153,7 +153,7 @@ class SVGDocumentExtensions;
 class TransformSource;
 #endif
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 struct DashboardRegionValue;
 #endif
 
@@ -794,8 +794,7 @@ public:
         TRANSITIONEND_LISTENER               = 0x800,
         BEFORELOAD_LISTENER                  = 0x1000,
         TOUCH_LISTENER                       = 0x2000,
-        SCROLL_LISTENER                      = 0x4000,
-        REGIONLAYOUTUPDATE_LISTENER          = 0x8000
+        SCROLL_LISTENER                      = 0x4000
     };
 
     bool hasListenerType(ListenerType listenerType) const { return (m_listenerTypes & listenerType); }
@@ -1019,7 +1018,7 @@ public:
     void setFrameElementsShouldIgnoreScrolling(bool ignore) { m_frameElementsShouldIgnoreScrolling = ignore; }
     bool frameElementsShouldIgnoreScrolling() const { return m_frameElementsShouldIgnoreScrolling; }
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     void setDashboardRegionsDirty(bool f) { m_dashboardRegionsDirty = f; }
     bool dashboardRegionsDirty() const { return m_dashboardRegionsDirty; }
     bool hasDashboardRegions () const { return m_hasDashboardRegions; }
@@ -1448,7 +1447,7 @@ private:
     OwnPtr<SVGDocumentExtensions> m_svgExtensions;
 #endif
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     Vector<DashboardRegionValue> m_dashboardRegions;
     bool m_hasDashboardRegions;
     bool m_dashboardRegionsDirty;
diff --git a/Source/WebCore/dom/Document.idl b/Source/WebCore/dom/Document.idl
index 742381f2a..b83f40c99 100644
--- a/Source/WebCore/dom/Document.idl
+++ b/Source/WebCore/dom/Document.idl
@@ -75,7 +75,7 @@ module core {
         Node               adoptNode(in [Optional=DefaultIsUndefined] Node source)
             raises (DOMException);
 
-#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C || defined(LANGUAGE_GOBJECT) && LANGUAGE_GOBJECT
         // document.documentURI was writable in DOM3 Core, but is read-only in DOM4
         // (see http://www.w3.org/TR/2011/WD-dom-20110915/#document). We need to keep
         // the writable version around for Objective C clients, but are moving to
diff --git a/Source/WebCore/dom/DocumentEventQueue.cpp b/Source/WebCore/dom/DocumentEventQueue.cpp
index 549408252..f9a717e40 100644
--- a/Source/WebCore/dom/DocumentEventQueue.cpp
+++ b/Source/WebCore/dom/DocumentEventQueue.cpp
@@ -31,6 +31,7 @@
 #include "Document.h"
 #include "Event.h"
 #include "EventNames.h"
+#include "MemoryInstrumentation.h"
 #include "RuntimeApplicationChecks.h"
 #include "ScriptExecutionContext.h"
 #include "SuspendableTimer.h"
@@ -107,6 +108,14 @@ void DocumentEventQueue::enqueueOrDispatchScrollEvent(PassRefPtr<Node> target, S
     enqueueEvent(scrollEvent.release());
 }
 
+void DocumentEventQueue::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    info.addMember(m_pendingEventTimer);
+    info.addInstrumentedHashSet(m_queuedEvents);
+    info.addInstrumentedHashSet(m_nodesWithQueuedScrollEvents);
+}
+
 bool DocumentEventQueue::cancelEvent(Event* event)
 {
     bool found = m_queuedEvents.contains(event);
diff --git a/Source/WebCore/dom/DocumentEventQueue.h b/Source/WebCore/dom/DocumentEventQueue.h
index 1f7e0dd96..14157b151 100644
--- a/Source/WebCore/dom/DocumentEventQueue.h
+++ b/Source/WebCore/dom/DocumentEventQueue.h
@@ -38,6 +38,7 @@ namespace WebCore {
 
 class Event;
 class DocumentEventQueueTimer;
+class MemoryObjectInfo;
 class Node;
 class ScriptExecutionContext;
 
@@ -58,6 +59,8 @@ public:
 
     void enqueueOrDispatchScrollEvent(PassRefPtr<Node>, ScrollEventTargetType);
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     explicit DocumentEventQueue(ScriptExecutionContext*);
 
diff --git a/Source/WebCore/dom/DynamicNodeList.cpp b/Source/WebCore/dom/DynamicNodeList.cpp
index b6a87d41b..b6a3a6fcd 100644
--- a/Source/WebCore/dom/DynamicNodeList.cpp
+++ b/Source/WebCore/dom/DynamicNodeList.cpp
@@ -33,19 +33,20 @@ namespace WebCore {
 
 Node* DynamicNodeListCacheBase::rootNode() const
 {
-    if ((isRootedAtDocument() || ownerNodeHasItemRefAttribute()) && m_ownerNode->inDocument())
+    if (isRootedAtDocument() && m_ownerNode->inDocument())
         return m_ownerNode->document();
-    return m_ownerNode.get();
-}
 
-ALWAYS_INLINE bool DynamicNodeListCacheBase::ownerNodeHasItemRefAttribute() const
-{
-#if ENABLE(MICRODATA)
-    if (m_rootType == NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr)
-        return toElement(ownerNode())->fastHasAttribute(HTMLNames::itemrefAttr);
-#endif
+    if (ownerNodeHasItemRefAttribute()) {
+        if (m_ownerNode->inDocument())
+            return m_ownerNode->document();
+
+        Node* root = m_ownerNode.get();
+        while (Node* parent = root->parentNode())
+            root = parent;
+        return root;
+    }
 
-    return false;
+    return m_ownerNode.get();
 }
 
 void DynamicNodeListCacheBase::invalidateCache() const
diff --git a/Source/WebCore/dom/DynamicNodeList.h b/Source/WebCore/dom/DynamicNodeList.h
index 860e2269a..3ba692df9 100644
--- a/Source/WebCore/dom/DynamicNodeList.h
+++ b/Source/WebCore/dom/DynamicNodeList.h
@@ -26,6 +26,7 @@
 
 #include "CollectionType.h"
 #include "Document.h"
+#include "Element.h"
 #include "HTMLNames.h"
 #include "NodeList.h"
 #include <wtf/Forward.h>
@@ -33,9 +34,6 @@
 
 namespace WebCore {
 
-class Element;
-class Node;
-
 enum NodeListRootType {
     NodeListIsRootedAtNode,
     NodeListIsRootedAtDocument,
@@ -70,7 +68,7 @@ public:
     }
 
 public:
-    ALWAYS_INLINE bool isRootedAtDocument() const { return m_rootType == NodeListIsRootedAtDocument; }
+    ALWAYS_INLINE bool isRootedAtDocument() const { return m_rootType == NodeListIsRootedAtDocument || m_rootType == NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr; }
     ALWAYS_INLINE NodeListInvalidationType invalidationType() const { return static_cast<NodeListInvalidationType>(m_invalidationType); }
     ALWAYS_INLINE CollectionType type() const { return static_cast<CollectionType>(m_collectionType); }
     Node* ownerNode() const { return m_ownerNode.get(); }
@@ -166,7 +164,8 @@ ALWAYS_INLINE bool DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChan
         return attrName == HTMLNames::hrefAttr;
     case InvalidateOnItemAttrChange:
 #if ENABLE(MICRODATA)
-        return attrName == HTMLNames::itemscopeAttr || attrName == HTMLNames::itempropAttr || attrName == HTMLNames::itemtypeAttr || attrName == HTMLNames::itemrefAttr;
+        return attrName == HTMLNames::itemscopeAttr || attrName == HTMLNames::itempropAttr
+            || attrName == HTMLNames::itemtypeAttr || attrName == HTMLNames::itemrefAttr || attrName == HTMLNames::idAttr;
 #endif // Intentionally fall through
     case DoNotInvalidateOnAttributeChanges:
         return false;
@@ -176,6 +175,16 @@ ALWAYS_INLINE bool DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChan
     return false;
 }
 
+ALWAYS_INLINE bool DynamicNodeListCacheBase::ownerNodeHasItemRefAttribute() const
+{
+#if ENABLE(MICRODATA)
+    if (m_rootType == NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr)
+        return toElement(ownerNode())->fastHasAttribute(HTMLNames::itemrefAttr);
+#endif
+
+    return false;
+}
+
 class DynamicNodeList : public NodeList, public DynamicNodeListCacheBase {
 public:
     enum NodeListType {
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index c323fa10d..287780268 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -416,12 +416,8 @@ int Element::clientLeft()
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (RenderBox* renderer = renderBox()) {
-        LayoutUnit clientLeft = renderer->clientLeft();
-        if (renderer->style() && renderer->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
-            clientLeft += renderer->verticalScrollbarWidth();
-        return adjustForAbsoluteZoom(roundToInt(clientLeft), renderer);
-    }
+    if (RenderBox* renderer = renderBox())
+        return adjustForAbsoluteZoom(roundToInt(renderer->clientLeft()), renderer);
     return 0;
 }
 
@@ -656,31 +652,36 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
 
     size_t index = ensureUpdatedAttributeData()->getAttributeItemIndex(localName, false);
     const QualifiedName& qName = index != notFound ? attributeItem(index)->name() : QualifiedName(nullAtom, localName, nullAtom);
-    setAttributeInternal(index, qName, value, NotInUpdateStyleAttribute);
+    setAttributeInternal(index, qName, value, NotInSynchronizationOfLazyAttribute);
+}
+
+void Element::setAttribute(const QualifiedName& name, const AtomicString& value)
+{
+    setAttributeInternal(ensureUpdatedAttributeData()->getAttributeItemIndex(name), name, value, NotInSynchronizationOfLazyAttribute);
 }
 
-void Element::setAttribute(const QualifiedName& name, const AtomicString& value, EInUpdateStyleAttribute inUpdateStyleAttribute)
+void Element::setSynchronizedLazyAttribute(const QualifiedName& name, const AtomicString& value)
 {
-    setAttributeInternal(ensureUpdatedAttributeData()->getAttributeItemIndex(name), name, value, inUpdateStyleAttribute);
+    setAttributeInternal(mutableAttributeData()->getAttributeItemIndex(name), name, value, InSynchronizationOfLazyAttribute);
 }
 
-inline void Element::setAttributeInternal(size_t index, const QualifiedName& name, const AtomicString& value, EInUpdateStyleAttribute inUpdateStyleAttribute)
+inline void Element::setAttributeInternal(size_t index, const QualifiedName& name, const AtomicString& value, SynchronizationOfLazyAttribute inSynchronizationOfLazyAttribute)
 {
     ElementAttributeData* attributeData = mutableAttributeData();
 
     Attribute* old = index != notFound ? attributeData->attributeItem(index) : 0;
     if (value.isNull()) {
         if (old)
-            attributeData->removeAttribute(index, this, inUpdateStyleAttribute);
+            attributeData->removeAttribute(index, this, inSynchronizationOfLazyAttribute);
         return;
     }
 
     if (!old) {
-        attributeData->addAttribute(Attribute(name, value), this, inUpdateStyleAttribute);
+        attributeData->addAttribute(Attribute(name, value), this, inSynchronizationOfLazyAttribute);
         return;
     }
 
-    if (inUpdateStyleAttribute == NotInUpdateStyleAttribute)
+    if (inSynchronizationOfLazyAttribute == NotInSynchronizationOfLazyAttribute)
         willModifyAttribute(name, old->value(), value);
 
     if (RefPtr<Attr> attrNode = attrIfExists(name))
@@ -688,7 +689,7 @@ inline void Element::setAttributeInternal(size_t index, const QualifiedName& nam
     else
         old->setValue(value);
 
-    if (inUpdateStyleAttribute == NotInUpdateStyleAttribute)
+    if (inSynchronizationOfLazyAttribute == NotInSynchronizationOfLazyAttribute)
         didModifyAttribute(Attribute(old->name(), old->value()));
 }
 
@@ -755,9 +756,11 @@ static bool isEventHandlerAttribute(const QualifiedName& name)
     return name.namespaceURI().isNull() && name.localName().startsWith("on");
 }
 
+// FIXME: Share code with Element::isURLAttribute.
 static bool isAttributeToRemove(const QualifiedName& name, const AtomicString& value)
-{    
-    return (name.localName().endsWith(hrefAttr.localName()) || name == srcAttr || name == actionAttr) && protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(value));       
+{
+    return (name.localName() == hrefAttr.localName() || name.localName() == nohrefAttr.localName()
+        || name == srcAttr || name == actionAttr || name == formactionAttr) && protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(value));
 }
 
 void Element::parserSetAttributes(const Vector<Attribute>& attributeVector, FragmentScriptingPermission scriptingPermission)
@@ -1202,14 +1205,6 @@ ShadowRoot* Element::userAgentShadowRoot() const
     return 0;
 }
 
-ShadowRoot* Element::ensureShadowRoot()
-{
-    if (ElementShadow* shadow = this->shadow())
-        return shadow->oldestShadowRoot();
-
-    return ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot).get();
-}
-
 const AtomicString& Element::shadowPseudoId() const
 {
     return hasRareData() ? elementRareData()->m_shadowPseudoId : nullAtom;
@@ -1495,12 +1490,12 @@ void Element::removeAttribute(size_t index)
     mutableAttributeData()->removeAttribute(index, this);
 }
 
-void Element::removeAttribute(const String& name)
+void Element::removeAttribute(const AtomicString& name)
 {
     if (!attributeData())
         return;
 
-    String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
+    AtomicString localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
     size_t index = attributeData()->getAttributeItemIndex(localName, false);
     if (index == notFound)
         return;
@@ -1508,12 +1503,12 @@ void Element::removeAttribute(const String& name)
     mutableAttributeData()->removeAttribute(index, this);
 }
 
-void Element::removeAttributeNS(const String& namespaceURI, const String& localName)
+void Element::removeAttributeNS(const AtomicString& namespaceURI, const AtomicString& localName)
 {
     removeAttribute(QualifiedName(nullAtom, localName, namespaceURI));
 }
 
-PassRefPtr<Attr> Element::getAttributeNode(const String& name)
+PassRefPtr<Attr> Element::getAttributeNode(const AtomicString& name)
 {
     const ElementAttributeData* attributeData = updatedAttributeData();
     if (!attributeData)
@@ -1521,7 +1516,7 @@ PassRefPtr<Attr> Element::getAttributeNode(const String& name)
     return attributeData->getAttributeNode(name, shouldIgnoreAttributeCase(this), this);
 }
 
-PassRefPtr<Attr> Element::getAttributeNodeNS(const String& namespaceURI, const String& localName)
+PassRefPtr<Attr> Element::getAttributeNodeNS(const AtomicString& namespaceURI, const AtomicString& localName)
 {
     const ElementAttributeData* attributeData = updatedAttributeData();
     if (!attributeData)
@@ -1529,18 +1524,18 @@ PassRefPtr<Attr> Element::getAttributeNodeNS(const String& namespaceURI, const S
     return attributeData->getAttributeNode(QualifiedName(nullAtom, localName, namespaceURI), this);
 }
 
-bool Element::hasAttribute(const String& name) const
+bool Element::hasAttribute(const AtomicString& name) const
 {
     if (!attributeData())
         return false;
 
     // This call to String::lower() seems to be required but
     // there may be a way to remove it.
-    String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
+    AtomicString localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
     return updatedAttributeData()->getAttributeItem(localName, false);
 }
 
-bool Element::hasAttributeNS(const String& namespaceURI, const String& localName) const
+bool Element::hasAttributeNS(const AtomicString& namespaceURI, const AtomicString& localName) const
 {
     const ElementAttributeData* attributeData = updatedAttributeData();
     if (!attributeData)
@@ -1783,6 +1778,16 @@ unsigned Element::childElementCount() const
     return count;
 }
 
+bool Element::shouldMatchReadOnlySelector() const
+{
+    return false;
+}
+
+bool Element::shouldMatchReadWriteSelector() const
+{
+    return false;
+}
+
 bool Element::webkitMatchesSelector(const String& selector, ExceptionCode& ec)
 {
     if (selector.isEmpty()) {
@@ -1917,7 +1922,7 @@ void Element::setContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(boo
 void Element::webkitRequestPointerLock()
 {
     if (document()->page())
-        document()->page()->pointerLockController()->requestPointerLock(this, 0, 0);
+        document()->page()->pointerLockController()->requestPointerLock(this);
 }
 #endif
 
@@ -1972,30 +1977,40 @@ PassRefPtr<WebKitAnimationList> Element::webkitGetAnimations() const
     return animController->animationsForRenderer(renderer());
 }
 
-const AtomicString& Element::webkitRegionOverflow() const
+RenderRegion* Element::renderRegion() const
+{
+    if (renderer() && renderer()->isRenderRegion())
+        return toRenderRegion(renderer());
+
+    return 0;
+}
+
+const AtomicString& Element::webkitRegionOverset() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (document()->cssRegionsEnabled() && renderer() && renderer()->isRenderRegion()) {
-        RenderRegion* region = toRenderRegion(renderer());
-        switch (region->regionState()) {
-        case RenderRegion::RegionFit: {
-            DEFINE_STATIC_LOCAL(AtomicString, fitState, ("fit"));
-            return fitState;
-        }
-        case RenderRegion::RegionEmpty: {
-            DEFINE_STATIC_LOCAL(AtomicString, emptyState, ("empty"));
-            return emptyState;
-        }
-        case RenderRegion::RegionOverflow: {
-            DEFINE_STATIC_LOCAL(AtomicString, overflowState, ("overflow"));
-            return overflowState;
-        }
-        default:
-            break;
-        }
-    }
     DEFINE_STATIC_LOCAL(AtomicString, undefinedState, ("undefined"));
+    if (!document()->cssRegionsEnabled() || !renderRegion())
+        return undefinedState;
+
+    switch (renderRegion()->regionState()) {
+    case RenderRegion::RegionFit: {
+        DEFINE_STATIC_LOCAL(AtomicString, fitState, ("fit"));
+        return fitState;
+    }
+    case RenderRegion::RegionEmpty: {
+        DEFINE_STATIC_LOCAL(AtomicString, emptyState, ("empty"));
+        return emptyState;
+    }
+    case RenderRegion::RegionOverset: {
+        DEFINE_STATIC_LOCAL(AtomicString, overflowState, ("overset"));
+        return overflowState;
+    }
+    case RenderRegion::RegionUndefined:
+        return undefinedState;
+    }
+
+    ASSERT_NOT_REACHED();
     return undefinedState;
 }
 
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index 01590217c..d056a9d43 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -40,9 +40,10 @@ class ClientRectList;
 class DOMStringMap;
 class DOMTokenList;
 class ElementRareData;
+class ElementShadow;
 class IntSize;
+class RenderRegion;
 class ShadowRoot;
-class ElementShadow;
 class WebKitAnimationList;
 
 enum SpellcheckAttributeState {
@@ -113,7 +114,8 @@ public:
 
     bool hasAttribute(const QualifiedName&) const;
     const AtomicString& getAttribute(const QualifiedName&) const;
-    void setAttribute(const QualifiedName&, const AtomicString& value, EInUpdateStyleAttribute = NotInUpdateStyleAttribute);
+    void setAttribute(const QualifiedName&, const AtomicString& value);
+    void setSynchronizedLazyAttribute(const QualifiedName&, const AtomicString& value);
     void removeAttribute(const QualifiedName&);
     void removeAttribute(size_t index);
 
@@ -139,8 +141,8 @@ public:
     // in style attribute or one of the SVG animation attributes.
     bool hasAttributesWithoutUpdate() const;
 
-    bool hasAttribute(const String& name) const;
-    bool hasAttributeNS(const String& namespaceURI, const String& localName) const;
+    bool hasAttribute(const AtomicString& name) const;
+    bool hasAttributeNS(const AtomicString& namespaceURI, const AtomicString& localName) const;
 
     const AtomicString& getAttribute(const AtomicString& name) const;
     const AtomicString& getAttributeNS(const AtomicString& namespaceURI, const AtomicString& localName) const;
@@ -199,13 +201,13 @@ public:
     // Returns the absolute bounding box translated into screen coordinates:
     IntRect screenRect() const;
 
-    void removeAttribute(const String& name);
-    void removeAttributeNS(const String& namespaceURI, const String& localName);
+    void removeAttribute(const AtomicString& name);
+    void removeAttributeNS(const AtomicString& namespaceURI, const AtomicString& localName);
 
     PassRefPtr<Attr> detachAttribute(size_t index);
 
-    PassRefPtr<Attr> getAttributeNode(const String& name);
-    PassRefPtr<Attr> getAttributeNodeNS(const String& namespaceURI, const String& localName);
+    PassRefPtr<Attr> getAttributeNode(const AtomicString& name);
+    PassRefPtr<Attr> getAttributeNodeNS(const AtomicString& namespaceURI, const AtomicString& localName);
     PassRefPtr<Attr> setAttributeNode(Attr*, ExceptionCode&);
     PassRefPtr<Attr> setAttributeNodeNS(Attr*, ExceptionCode&);
     PassRefPtr<Attr> removeAttributeNode(Attr*, ExceptionCode&);
@@ -275,10 +277,6 @@ public:
 
     ShadowRoot* userAgentShadowRoot() const;
 
-    // FIXME: Remove Element::ensureShadowRoot
-    // https://bugs.webkit.org/show_bug.cgi?id=77608
-    ShadowRoot* ensureShadowRoot();
-
     virtual const AtomicString& shadowPseudoId() const;
     void setShadowPseudoId(const AtomicString&, ExceptionCode& = ASSERT_NO_EXCEPTION);
 
@@ -350,6 +348,8 @@ public:
     Element* nextElementSibling() const;
     unsigned childElementCount() const;
 
+    virtual bool shouldMatchReadOnlySelector() const;
+    virtual bool shouldMatchReadWriteSelector() const;
     bool webkitMatchesSelector(const String& selectors, ExceptionCode&);
 
     DOMTokenList* classList();
@@ -373,7 +373,6 @@ public:
 
     virtual bool isFormControlElement() const { return false; }
     virtual bool isEnabledFormControl() const { return true; }
-    virtual bool isReadOnlyFormControl() const { return false; }
     virtual bool isSpinButtonElement() const { return false; }
     virtual bool isTextFormControl() const { return false; }
     virtual bool isOptionalFormControl() const { return false; }
@@ -424,7 +423,8 @@ public:
     
     PassRefPtr<RenderStyle> styleForRenderer();
 
-    const AtomicString& webkitRegionOverflow() const;
+    RenderRegion* renderRegion() const;
+    const AtomicString& webkitRegionOverset() const;
 
     bool hasID() const;
     bool hasClass() const;
@@ -434,10 +434,10 @@ public:
 
     virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo<Element> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
-        info.visitBaseClass<ContainerNode>(this);
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        ContainerNode::reportMemoryUsage(memoryObjectInfo);
         info.addInstrumentedMember(m_tagName);
-        info.addInstrumentedMember(attributeData());
+        info.addInstrumentedMember(m_attributeData);
     }
 
 #if ENABLE(UNDO_MANAGER)
@@ -478,7 +478,7 @@ private:
     virtual NodeType nodeType() const;
     virtual bool childTypeAllowed(NodeType) const;
 
-    void setAttributeInternal(size_t index, const QualifiedName&, const AtomicString& value, EInUpdateStyleAttribute);
+    void setAttributeInternal(size_t index, const QualifiedName&, const AtomicString& value, SynchronizationOfLazyAttribute);
 
 #ifndef NDEBUG
     virtual void formatForDebugger(char* buffer, unsigned length) const;
diff --git a/Source/WebCore/dom/Element.idl b/Source/WebCore/dom/Element.idl
index 17a4a7ec4..3bdd03bef 100644
--- a/Source/WebCore/dom/Element.idl
+++ b/Source/WebCore/dom/Element.idl
@@ -96,6 +96,9 @@ module core {
         // HTML 5
         NodeList getElementsByClassName(in [Optional=DefaultIsUndefined] DOMString name);
 
+        attribute [Reflect=class] DOMString className;
+        readonly attribute DOMTokenList classList;
+
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute DOMStringMap dataset;
 #endif
@@ -140,7 +143,7 @@ module core {
         [Conditional=POINTER_LOCK, V8EnabledAtRuntime=pointerLock] void webkitRequestPointerLock();
 
         // CSS Regions API
-        readonly attribute DOMString webkitRegionOverflow;
+        readonly attribute DOMString webkitRegionOverset;
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute [Conditional=UNDO_MANAGER] UndoManager undoManager;
diff --git a/Source/WebCore/dom/ElementAttributeData.cpp b/Source/WebCore/dom/ElementAttributeData.cpp
index 6fb53d5d3..bddc6e027 100644
--- a/Source/WebCore/dom/ElementAttributeData.cpp
+++ b/Source/WebCore/dom/ElementAttributeData.cpp
@@ -28,6 +28,7 @@
 
 #include "Attr.h"
 #include "CSSStyleSheet.h"
+#include "MemoryInstrumentation.h"
 #include "StyledElement.h"
 
 namespace WebCore {
@@ -217,20 +218,20 @@ void ElementAttributeData::destroyInlineStyle(StyledElement* element) const
     m_inlineStyleDecl = 0;
 }
 
-void ElementAttributeData::addAttribute(const Attribute& attribute, Element* element, EInUpdateStyleAttribute inUpdateStyleAttribute)
+void ElementAttributeData::addAttribute(const Attribute& attribute, Element* element, SynchronizationOfLazyAttribute inSynchronizationOfLazyAttribute)
 {
     ASSERT(isMutable());
 
-    if (element && inUpdateStyleAttribute == NotInUpdateStyleAttribute)
+    if (element && inSynchronizationOfLazyAttribute == NotInSynchronizationOfLazyAttribute)
         element->willModifyAttribute(attribute.name(), nullAtom, attribute.value());
 
     m_mutableAttributeVector->append(attribute);
 
-    if (element && inUpdateStyleAttribute == NotInUpdateStyleAttribute)
+    if (element && inSynchronizationOfLazyAttribute == NotInSynchronizationOfLazyAttribute)
         element->didAddAttribute(attribute);
 }
 
-void ElementAttributeData::removeAttribute(size_t index, Element* element, EInUpdateStyleAttribute inUpdateStyleAttribute)
+void ElementAttributeData::removeAttribute(size_t index, Element* element, SynchronizationOfLazyAttribute inSynchronizationOfLazyAttribute)
 {
     ASSERT(isMutable());
     ASSERT(index < length());
@@ -238,7 +239,7 @@ void ElementAttributeData::removeAttribute(size_t index, Element* element, EInUp
     Attribute& attribute = m_mutableAttributeVector->at(index);
     QualifiedName name = attribute.name();
 
-    if (element && inUpdateStyleAttribute == NotInUpdateStyleAttribute)
+    if (element && inSynchronizationOfLazyAttribute == NotInSynchronizationOfLazyAttribute)
         element->willRemoveAttribute(name, attribute.value());
 
     if (RefPtr<Attr> attr = attrIfExists(element, name))
@@ -246,7 +247,7 @@ void ElementAttributeData::removeAttribute(size_t index, Element* element, EInUp
 
     m_mutableAttributeVector->remove(index);
 
-    if (element && inUpdateStyleAttribute == NotInUpdateStyleAttribute)
+    if (element && inSynchronizationOfLazyAttribute == NotInSynchronizationOfLazyAttribute)
         element->didRemoveAttribute(name);
 }
 
@@ -283,6 +284,19 @@ void ElementAttributeData::detachAttrObjectsFromElement(Element* element) const
     ASSERT(!element->hasAttrList());
 }
 
+void ElementAttributeData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    info.addInstrumentedMember(m_inlineStyleDecl);
+    info.addInstrumentedMember(m_attributeStyle);
+    info.addMember(m_classNames);
+    info.addMember(m_idForStyleResolution);
+    if (m_isMutable)
+        info.addVectorPtr(m_mutableAttributeVector);
+    else
+        info.addRawBuffer(m_attributes, m_arraySize * sizeof(Attribute));
+}
+
 size_t ElementAttributeData::getAttributeItemIndexSlowCase(const AtomicString& name, bool shouldIgnoreAttributeCase) const
 {
     // Continue to checking case-insensitively and/or full namespaced names if necessary:
diff --git a/Source/WebCore/dom/ElementAttributeData.h b/Source/WebCore/dom/ElementAttributeData.h
index 1c2b2fea3..691f7332c 100644
--- a/Source/WebCore/dom/ElementAttributeData.h
+++ b/Source/WebCore/dom/ElementAttributeData.h
@@ -27,7 +27,6 @@
 #define ElementAttributeData_h
 
 #include "Attribute.h"
-#include "MemoryInstrumentation.h"
 #include "SpaceSplitString.h"
 #include "StylePropertySet.h"
 #include <wtf/NotFound.h>
@@ -36,8 +35,9 @@ namespace WebCore {
 
 class Attr;
 class Element;
+class MemoryObjectInfo;
 
-enum EInUpdateStyleAttribute { NotInUpdateStyleAttribute, InUpdateStyleAttribute };
+enum SynchronizationOfLazyAttribute { NotInSynchronizationOfLazyAttribute, InSynchronizationOfLazyAttribute };
 
 class ElementAttributeData {
     WTF_MAKE_FAST_ALLOCATED;
@@ -60,7 +60,7 @@ public:
     void updateInlineStyleAvoidingMutation(StyledElement*, const String& text) const;
     void destroyInlineStyle(StyledElement*) const;
 
-    StylePropertySet* attributeStyle() const { return m_attributeStyle.get(); }
+    const StylePropertySet* attributeStyle() const { return m_attributeStyle.get(); }
     void setAttributeStyle(PassRefPtr<StylePropertySet> style) const { m_attributeStyle = style; }
 
     size_t length() const;
@@ -78,9 +78,9 @@ public:
     size_t getAttributeItemIndex(const AtomicString& name, bool shouldIgnoreAttributeCase) const;
 
     // These functions do no error checking.
-    void addAttribute(const Attribute&, Element*, EInUpdateStyleAttribute = NotInUpdateStyleAttribute);
+    void addAttribute(const Attribute&, Element*, SynchronizationOfLazyAttribute = NotInSynchronizationOfLazyAttribute);
     void removeAttribute(const QualifiedName&, Element*);
-    void removeAttribute(size_t index, Element*, EInUpdateStyleAttribute = NotInUpdateStyleAttribute);
+    void removeAttribute(size_t index, Element*, SynchronizationOfLazyAttribute = NotInSynchronizationOfLazyAttribute);
     PassRefPtr<Attr> takeAttribute(size_t index, Element*);
 
     bool hasID() const { return !m_idForStyleResolution.isNull(); }
@@ -94,16 +94,7 @@ public:
     PassRefPtr<Attr> ensureAttr(Element*, const QualifiedName&) const;
     void detachAttrObjectsFromElement(Element*) const;
 
-    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
-    {
-        MemoryClassInfo<ElementAttributeData> info(memoryObjectInfo, this, MemoryInstrumentation::DOM, m_arraySize * sizeof(Attribute));
-        info.addInstrumentedMember(m_inlineStyleDecl.get());
-        info.addInstrumentedMember(m_attributeStyle.get());
-        info.addMember(m_classNames);
-        info.addString(m_idForStyleResolution);
-        if (m_isMutable)
-            info.addVector(*m_mutableAttributeVector);
-    }
+    void reportMemoryUsage(MemoryObjectInfo*) const;
 
 private:
     friend class Element;
diff --git a/Source/WebCore/dom/ElementShadow.cpp b/Source/WebCore/dom/ElementShadow.cpp
index 6f5e33245..a68ef3575 100644
--- a/Source/WebCore/dom/ElementShadow.cpp
+++ b/Source/WebCore/dom/ElementShadow.cpp
@@ -79,7 +79,8 @@ void ElementShadow::addShadowRoot(Element* shadowHost, PassRefPtr<ShadowRoot> sh
     shadowRoot->setHost(shadowHost);
     shadowRoot->setParentTreeScope(shadowHost->treeScope());
     m_shadowRoots.push(shadowRoot.get());
-    invalidateDistribution(shadowHost, InvalidateIfNeeded);
+    setValidityUndetermined();
+    invalidateDistribution(shadowHost);
     ChildNodeInsertionNotifier(shadowHost).notify(shadowRoot.get());
 
     if (shadowHost->attached() && !shadowRoot->attached())
@@ -108,7 +109,7 @@ void ElementShadow::removeAllShadowRoots()
         ChildNodeRemovalNotifier(shadowHost).notify(oldRoot.get());
     }
 
-    invalidateDistribution(shadowHost, InvalidateIfNeeded);
+    invalidateDistribution(shadowHost);
 }
 
 void ElementShadow::attach()
@@ -188,18 +189,20 @@ void ElementShadow::ensureDistribution()
     m_distributor.distribute(host());
 }
 
-void ElementShadow::invalidateDistribution(InvalidationType type)
+void ElementShadow::setValidityUndetermined()
 {
-    invalidateDistribution(host(), type);
+    m_distributor.setValidity(ContentDistributor::Undetermined);
 }
 
-void ElementShadow::invalidateDistribution(Element* host, InvalidationType type)
+void ElementShadow::invalidateDistribution()
 {
-    bool needsReattach = (type == InvalidateAndForceReattach);
-    bool needsInvalidation = m_distributor.needsInvalidation();
+    invalidateDistribution(host());
+}
 
-    if (needsInvalidation)
-        needsReattach |= m_distributor.invalidate(host);
+void ElementShadow::invalidateDistribution(Element* host)
+{
+    bool needsInvalidation = m_distributor.needsInvalidation();
+    bool needsReattach = needsInvalidation ? m_distributor.invalidate(host) : false;
 
     if (needsReattach && host->attached()) {
         host->detach();
diff --git a/Source/WebCore/dom/ElementShadow.h b/Source/WebCore/dom/ElementShadow.h
index 3ab5c075d..f58616efb 100644
--- a/Source/WebCore/dom/ElementShadow.h
+++ b/Source/WebCore/dom/ElementShadow.h
@@ -62,12 +62,8 @@ public:
     bool needsStyleRecalc();
     void recalcStyle(Node::StyleChange);
 
-    enum InvalidationType {
-        InvalidateIfNeeded,
-        InvalidateAndForceReattach
-    };
-
-    void invalidateDistribution(InvalidationType = InvalidateIfNeeded);
+    void setValidityUndetermined();
+    void invalidateDistribution();
     void ensureDistribution();
  
     InsertionPoint* insertionPointFor(const Node*) const;
@@ -76,7 +72,7 @@ public:
     const ContentDistributor& distributor() const;
 
 private:
-    void invalidateDistribution(Element* host, InvalidationType);
+    void invalidateDistribution(Element* host);
 
     DoublyLinkedList<ShadowRoot> m_shadowRoots;
     ContentDistributor m_distributor;
diff --git a/Source/WebCore/dom/Event.cpp b/Source/WebCore/dom/Event.cpp
index 761313c59..08e644ff6 100644
--- a/Source/WebCore/dom/Event.cpp
+++ b/Source/WebCore/dom/Event.cpp
@@ -155,6 +155,15 @@ void Event::storeResult(const String&)
 {
 }
 
+void Event::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    info.addMember(m_type);
+    info.addMember(m_currentTarget);
+    info.addMember(m_target);
+    info.addInstrumentedMember(m_underlyingEvent);
+}
+
 void Event::setTarget(PassRefPtr<EventTarget> target)
 {
     if (m_target == target)
diff --git a/Source/WebCore/dom/Event.h b/Source/WebCore/dom/Event.h
index d298d90a7..e72342315 100644
--- a/Source/WebCore/dom/Event.h
+++ b/Source/WebCore/dom/Event.h
@@ -31,6 +31,7 @@
 
 namespace WebCore {
 
+    class MemoryInstrumentation;
     class EventTarget;
     class EventDispatcher;
 
@@ -152,6 +153,8 @@ namespace WebCore {
 
         bool isBeingDispatched() const { return eventPhase(); }
 
+        virtual void reportMemoryUsage(MemoryObjectInfo*) const;
+
     protected:
         Event();
         Event(const AtomicString& type, bool canBubble, bool cancelable);
diff --git a/Source/WebCore/dom/EventDispatcher.cpp b/Source/WebCore/dom/EventDispatcher.cpp
index a75aab0e3..e1a60f3d4 100644
--- a/Source/WebCore/dom/EventDispatcher.cpp
+++ b/Source/WebCore/dom/EventDispatcher.cpp
@@ -27,6 +27,7 @@
 #include "EventDispatcher.h"
 
 #include "ComposedShadowTreeWalker.h"
+#include "ContainerNode.h"
 #include "ElementShadow.h"
 #include "EventContext.h"
 #include "EventDispatchMediator.h"
@@ -162,8 +163,6 @@ void EventDispatcher::dispatchSimulatedClick(Node* node, PassRefPtr<Event> under
     if (node->disabled())
         return;
 
-    EventDispatcher dispatcher(node);
-
     if (!gNodesDispatchingSimulatedClicks)
         gNodesDispatchingSimulatedClicks = new HashSet<Node*>;
     else if (gNodesDispatchingSimulatedClicks->contains(node))
@@ -173,14 +172,14 @@ void EventDispatcher::dispatchSimulatedClick(Node* node, PassRefPtr<Event> under
 
     // send mousedown and mouseup before the click, if requested
     if (sendMouseEvents)
-        dispatcher.dispatchEvent(SimulatedMouseEvent::create(eventNames().mousedownEvent, node->document()->defaultView(), underlyingEvent));
+        EventDispatcher(node).dispatchEvent(SimulatedMouseEvent::create(eventNames().mousedownEvent, node->document()->defaultView(), underlyingEvent));
     node->setActive(true, showPressedLook);
     if (sendMouseEvents)
-        dispatcher.dispatchEvent(SimulatedMouseEvent::create(eventNames().mouseupEvent, node->document()->defaultView(), underlyingEvent));
+        EventDispatcher(node).dispatchEvent(SimulatedMouseEvent::create(eventNames().mouseupEvent, node->document()->defaultView(), underlyingEvent));
     node->setActive(false);
 
     // always send click
-    dispatcher.dispatchEvent(SimulatedMouseEvent::create(eventNames().clickEvent, node->document()->defaultView(), underlyingEvent));
+    EventDispatcher(node).dispatchEvent(SimulatedMouseEvent::create(eventNames().clickEvent, node->document()->defaultView(), underlyingEvent));
 
     gNodesDispatchingSimulatedClicks->remove(node);
 }
@@ -201,7 +200,9 @@ void EventDispatcher::adjustRelatedTarget(Event* event, PassRefPtr<EventTarget>
 EventDispatcher::EventDispatcher(Node* node)
     : m_node(node)
     , m_ancestorsInitialized(false)
-    , m_shouldPreventDispatch(false)
+#ifndef NDEBUG
+    , m_eventDispatched(false)
+#endif
 {
     ASSERT(node);
     m_view = node->document()->view();
@@ -237,31 +238,53 @@ void EventDispatcher::ensureEventAncestors(Event* event)
     }
 }
 
-bool EventDispatcher::dispatchEvent(PassRefPtr<Event> event)
+bool EventDispatcher::dispatchEvent(PassRefPtr<Event> prpEvent)
 {
-    event->setTarget(eventTargetRespectingSVGTargetRules(m_node.get()));
+#ifndef NDEBUG
+    ASSERT(!m_eventDispatched);
+    m_eventDispatched = true;
+#endif
+    RefPtr<Event> event = prpEvent;
+    ChildNodesLazySnapshot::takeChildNodesLazySnapshot();
 
+    event->setTarget(eventTargetRespectingSVGTargetRules(m_node.get()));
     ASSERT(!eventDispatchForbidden());
     ASSERT(event->target());
     ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
-
-    RefPtr<EventTarget> originalTarget = event->target();
     ensureEventAncestors(event.get());
+    WindowEventContext windowEventContext(event.get(), m_node.get(), topEventContext());
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willDispatchEvent(m_node->document(), *event, windowEventContext.window(), m_node.get(), m_ancestors);
 
-    WindowEventContext windowContext(event.get(), m_node.get(), topEventContext());
+    void* preDispatchEventHandlerResult;
+    if (dispatchEventPreProcess(event, preDispatchEventHandlerResult) == ContinueDispatching)
+        if (dispatchEventAtCapturing(event, windowEventContext) == ContinueDispatching)
+            if (dispatchEventAtTarget(event) == ContinueDispatching)
+                dispatchEventAtBubbling(event, windowEventContext);
+    dispatchEventPostProcess(event, preDispatchEventHandlerResult);
 
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willDispatchEvent(m_node->document(), *event, windowContext.window(), m_node.get(), m_ancestors);
+    // Ensure that after event dispatch, the event's target object is the
+    // outermost shadow DOM boundary.
+    event->setTarget(windowEventContext.target());
+    event->setCurrentTarget(0);
+    InspectorInstrumentation::didDispatchEvent(cookie);
+
+    return !event->defaultPrevented();
+}
 
+inline EventDispatchContinuation EventDispatcher::dispatchEventPreProcess(PassRefPtr<Event> event, void*& preDispatchEventHandlerResult)
+{
     // Give the target node a chance to do some work before DOM event handlers get a crack.
-    void* data = m_node->preDispatchEventHandler(event.get());
-    if (m_ancestors.isEmpty() || m_shouldPreventDispatch || event->propagationStopped())
-        goto doneDispatching;
+    preDispatchEventHandlerResult = m_node->preDispatchEventHandler(event.get());
+    return (m_ancestors.isEmpty() || event->propagationStopped()) ? DoneDispatching : ContinueDispatching;
+}
 
+inline EventDispatchContinuation EventDispatcher::dispatchEventAtCapturing(PassRefPtr<Event> event, WindowEventContext& windowEventContext)
+{
     // Trigger capturing event handlers, starting at the top and working our way down.
     event->setEventPhase(Event::CAPTURING_PHASE);
 
-    if (windowContext.handleLocalEvents(event.get()) && event->propagationStopped())
-        goto doneDispatching;
+    if (windowEventContext.handleLocalEvents(event.get()) && event->propagationStopped())
+        return DoneDispatching;
 
     for (size_t i = m_ancestors.size() - 1; i > 0; --i) {
         const EventContext& eventContext = m_ancestors[i];
@@ -273,16 +296,21 @@ bool EventDispatcher::dispatchEvent(PassRefPtr<Event> event)
             event->setEventPhase(Event::CAPTURING_PHASE);
         eventContext.handleLocalEvents(event.get());
         if (event->propagationStopped())
-            goto doneDispatching;
+            return DoneDispatching;
     }
 
+    return ContinueDispatching;
+}
+
+inline EventDispatchContinuation EventDispatcher::dispatchEventAtTarget(PassRefPtr<Event> event)
+{
     event->setEventPhase(Event::AT_TARGET);
-    event->setTarget(originalTarget.get());
-    event->setCurrentTarget(eventTargetRespectingSVGTargetRules(m_node.get()));
     m_ancestors[0].handleLocalEvents(event.get());
-    if (event->propagationStopped())
-        goto doneDispatching;
+    return event->propagationStopped() ? DoneDispatching : ContinueDispatching;
+}
 
+inline EventDispatchContinuation EventDispatcher::dispatchEventAtBubbling(PassRefPtr<Event> event, WindowEventContext& windowContext)
+{
     if (event->bubbles() && !event->cancelBubble()) {
         // Trigger bubbling event handlers, starting at the bottom and working our way up.
         event->setEventPhase(Event::BUBBLING_PHASE);
@@ -296,18 +324,21 @@ bool EventDispatcher::dispatchEvent(PassRefPtr<Event> event)
                 event->setEventPhase(Event::BUBBLING_PHASE);
             eventContext.handleLocalEvents(event.get());
             if (event->propagationStopped() || event->cancelBubble())
-                goto doneDispatching;
+                return DoneDispatching;
         }
         windowContext.handleLocalEvents(event.get());
     }
+    return ContinueDispatching;
+}
 
-doneDispatching:
-    event->setTarget(originalTarget.get());
+inline void EventDispatcher::dispatchEventPostProcess(PassRefPtr<Event> event, void* preDispatchEventHandlerResult)
+{
+    event->setTarget(eventTargetRespectingSVGTargetRules(m_node.get()));
     event->setCurrentTarget(0);
     event->setEventPhase(0);
 
     // Pass the data from the preDispatchEventHandler to the postDispatchEventHandler.
-    m_node->postDispatchEventHandler(event.get(), data);
+    m_node->postDispatchEventHandler(event.get(), preDispatchEventHandlerResult);
 
     // Call default event handlers. While the DOM does have a concept of preventing
     // default handling, the detail of which handlers are called is an internal
@@ -317,7 +348,7 @@ doneDispatching:
         m_node->defaultEventHandler(event.get());
         ASSERT(!event->defaultPrevented());
         if (event->defaultHandled())
-            goto doneWithDefault;
+            return;
         // For bubbling events, call default event handlers on the same targets in the
         // same order as the bubbling phase.
         if (event->bubbles()) {
@@ -326,20 +357,10 @@ doneDispatching:
                 m_ancestors[i].node()->defaultEventHandler(event.get());
                 ASSERT(!event->defaultPrevented());
                 if (event->defaultHandled())
-                    goto doneWithDefault;
+                    return;
             }
         }
     }
-
-doneWithDefault:
-
-    // Ensure that after event dispatch, the event's target object is the
-    // outermost shadow DOM boundary.
-    event->setTarget(windowContext.target());
-    event->setCurrentTarget(0);
-    InspectorInstrumentation::didDispatchEvent(cookie);
-
-    return !event->defaultPrevented();
 }
 
 const EventContext* EventDispatcher::topEventContext()
diff --git a/Source/WebCore/dom/EventDispatcher.h b/Source/WebCore/dom/EventDispatcher.h
index 34c55e4db..5bfead0d0 100644
--- a/Source/WebCore/dom/EventDispatcher.h
+++ b/Source/WebCore/dom/EventDispatcher.h
@@ -42,12 +42,18 @@ class PlatformKeyboardEvent;
 class PlatformMouseEvent;
 class ShadowRoot;
 class TreeScope;
+class WindowEventContext;
 
 enum EventDispatchBehavior {
     RetargetEvent,
     StayInsideShadowDOM
 };
 
+enum EventDispatchContinuation {
+    ContinueDispatching,
+    DoneDispatching
+};
+
 class EventRelatedTargetAdjuster {
 public:
     EventRelatedTargetAdjuster(PassRefPtr<Node>, PassRefPtr<Node> relatedTarget);
@@ -80,12 +86,19 @@ private:
     void ensureEventAncestors(Event*);
     const EventContext* topEventContext();
 
+    EventDispatchContinuation dispatchEventPreProcess(PassRefPtr<Event>, void*& preDispatchEventHandlerResult);
+    EventDispatchContinuation dispatchEventAtCapturing(PassRefPtr<Event>, WindowEventContext&);
+    EventDispatchContinuation dispatchEventAtTarget(PassRefPtr<Event>);
+    EventDispatchContinuation dispatchEventAtBubbling(PassRefPtr<Event>, WindowEventContext&);
+    void dispatchEventPostProcess(PassRefPtr<Event>, void* preDispatchEventHandlerResult);
+
     Vector<EventContext> m_ancestors;
     RefPtr<Node> m_node;
-    RefPtr<EventTarget> m_originalTarget;
     RefPtr<FrameView> m_view;
     bool m_ancestorsInitialized;
-    bool m_shouldPreventDispatch;
+#ifndef NDEBUG
+    bool m_eventDispatched;
+#endif
 };
 
 inline Node* EventDispatcher::node() const
diff --git a/Source/WebCore/dom/EventListener.h b/Source/WebCore/dom/EventListener.h
index c3c2d6cbd..d1a6e8f24 100644
--- a/Source/WebCore/dom/EventListener.h
+++ b/Source/WebCore/dom/EventListener.h
@@ -42,7 +42,8 @@ namespace WebCore {
             CPPEventListenerType,
             ConditionEventListenerType,
             GObjectEventListenerType,
-            NativeEventListenerType
+            NativeEventListenerType,
+            SVGTRefTargetEventListenerType
         };
 
         virtual ~EventListener() { }
diff --git a/Source/WebCore/dom/EventNames.cpp b/Source/WebCore/dom/EventNames.cpp
index 08646f714..6df1290ee 100644
--- a/Source/WebCore/dom/EventNames.cpp
+++ b/Source/WebCore/dom/EventNames.cpp
@@ -24,10 +24,10 @@
 namespace WebCore {
 
 #define INITIALIZE_EVENT_NAME(name) \
-    , name##Event(#name)
+    , name##Event(#name, AtomicString::ConstructFromLiteral)
 
 #define INITIALIZE_EVENT_INTERFACE(name) \
-    , interfaceFor##name(#name)
+    , interfaceFor##name(#name, AtomicString::ConstructFromLiteral)
 
 EventNames::EventNames()
     : dummy(0)
diff --git a/Source/WebCore/dom/EventNames.h b/Source/WebCore/dom/EventNames.h
index b0efbe765..6d0a10573 100644
--- a/Source/WebCore/dom/EventNames.h
+++ b/Source/WebCore/dom/EventNames.h
@@ -71,6 +71,11 @@ namespace WebCore {
     macro(focus) \
     macro(focusin) \
     macro(focusout) \
+    macro(gesturetap) \
+    macro(gesturetapdown) \
+    macro(gesturescrollstart) \
+    macro(gesturescrollend) \
+    macro(gesturescrollupdate) \
     macro(hashchange) \
     macro(input) \
     macro(invalid) \
@@ -224,7 +229,6 @@ namespace WebCore {
     \
     macro(show) \
     \
-    macro(webkitpointerlocklost) \
     macro(webkitpointerlockchange) \
     macro(webkitpointerlockerror) \
     \
@@ -234,6 +238,8 @@ namespace WebCore {
     \
     macro(webkitresourcetimingbufferfull) \
     \
+    macro(webkitdeviceproximity) \
+    \
 
 // end of DOM_EVENT_NAMES_FOR_EACH
 
@@ -262,6 +268,15 @@ namespace WebCore {
                 || eventType == touchcancelEvent;
         }
 
+        inline bool isGestureEventType(const AtomicString& eventType) const
+        {
+            return eventType == gesturetapEvent
+                || eventType == gesturetapdownEvent
+                || eventType == gesturescrollstartEvent
+                || eventType == gesturescrollendEvent
+                || eventType == gesturescrollupdateEvent;
+        }
+
         Vector<AtomicString> touchEventNames() const
         {
             Vector<AtomicString> names;
diff --git a/Source/WebCore/dom/EventNames.in b/Source/WebCore/dom/EventNames.in
index 9c0ac5558..5da57ffc6 100644
--- a/Source/WebCore/dom/EventNames.in
+++ b/Source/WebCore/dom/EventNames.in
@@ -43,6 +43,7 @@ IDBVersionChangeEvent conditional=INDEXED_DATABASE
 TouchEvent conditional=TOUCH_EVENTS, runtimeConditional=touchEnabled
 DeviceMotionEvent conditional=DEVICE_ORIENTATION
 DeviceOrientationEvent conditional=DEVICE_ORIENTATION
+DeviceProximityEvent conditional=PROXIMITY_EVENTS
 OrientationEvent interfaceName=Event, conditional=ORIENTATION_EVENTS
 MediaKeyEvent conditional=ENCRYPTED_MEDIA
 TrackEvent conditional=VIDEO_TRACK
diff --git a/Source/WebCore/dom/EventTarget.h b/Source/WebCore/dom/EventTarget.h
index ab0d7c7f1..d85a8c4c9 100644
--- a/Source/WebCore/dom/EventTarget.h
+++ b/Source/WebCore/dom/EventTarget.h
@@ -56,6 +56,7 @@ namespace WebCore {
     class JavaScriptAudioNode;
     class LocalMediaStream;
     class MediaController;
+    class MediaSource;
     class MediaStream;
     class MessagePort;
     class Node;
@@ -68,6 +69,7 @@ namespace WebCore {
     class TextTrack;
     class TextTrackCue;
     class WebSocket;
+    class WebKitNamedFlow;
     class Worker;
     class XMLHttpRequest;
     class XMLHttpRequestUpload;
diff --git a/Source/WebCore/dom/EventTargetFactory.in b/Source/WebCore/dom/EventTargetFactory.in
index ff60aad4d..6d972c396 100644
--- a/Source/WebCore/dom/EventTargetFactory.in
+++ b/Source/WebCore/dom/EventTargetFactory.in
@@ -15,6 +15,7 @@ IDBVersionChangeRequest conditional=INDEXED_DATABASE
 JavaScriptAudioNode conditional=WEB_AUDIO
 LocalMediaStream conditional=MEDIA_STREAM
 MediaController conditional=VIDEO
+MediaSource conditional=MEDIA_SOURCE
 MediaStream conditional=MEDIA_STREAM
 MediaStreamTrack conditional=MEDIA_STREAM
 MediaStreamTrackList conditional=MEDIA_STREAM
@@ -24,6 +25,7 @@ Node
 Notification conditional=NOTIFICATIONS|LEGACY_NOTIFICATIONS
 PeerConnection00 conditional=MEDIA_STREAM
 Performance conditional=WEB_TIMING
+RTCPeerConnection conditional=MEDIA_STREAM
 SharedWorker conditional=SHARED_WORKERS
 SharedWorkerContext conditional=SHARED_WORKERS
 SourceBufferList conditional=MEDIA_SOURCE
@@ -32,6 +34,7 @@ SVGElementInstance conditional=SVG
 TextTrack conditional=VIDEO_TRACK
 TextTrackCue conditional=VIDEO_TRACK
 TextTrackList conditional=VIDEO_TRACK
+WebKitNamedFlow
 WebSocket conditional=WEB_SOCKETS
 Worker conditional=WORKERS
 XMLHttpRequest
diff --git a/Source/WebCore/dom/GenericEventQueue.cpp b/Source/WebCore/dom/GenericEventQueue.cpp
index 75543c7b6..a177d61a8 100644
--- a/Source/WebCore/dom/GenericEventQueue.cpp
+++ b/Source/WebCore/dom/GenericEventQueue.cpp
@@ -85,6 +85,7 @@ void GenericEventQueue::timerFired(Timer<GenericEventQueue>*)
     Vector<RefPtr<Event> > pendingEvents;
     m_pendingEvents.swap(pendingEvents);
 
+    RefPtr<EventTarget> protect(m_owner);
     for (unsigned i = 0; i < pendingEvents.size(); ++i) {
         EventTarget* target = pendingEvents[i]->target() ? pendingEvents[i]->target() : m_owner;
         target->dispatchEvent(pendingEvents[i].release());
diff --git a/Source/WebCore/dom/GestureEvent.cpp b/Source/WebCore/dom/GestureEvent.cpp
new file mode 100644
index 000000000..d75cdaa09
--- /dev/null
+++ b/Source/WebCore/dom/GestureEvent.cpp
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(GESTURE_EVENTS)
+
+#include "GestureEvent.h"
+
+#include <wtf/text/AtomicString.h>
+
+namespace WebCore {
+
+PassRefPtr<GestureEvent> GestureEvent::create()
+{
+    return adoptRef(new GestureEvent);
+}
+
+PassRefPtr<GestureEvent> GestureEvent::create(PassRefPtr<AbstractView> view, const PlatformGestureEvent& event)
+{
+    AtomicString eventType;
+    switch (event.type()) {
+    case PlatformEvent::GestureScrollBegin:
+        eventType = eventNames().gesturescrollstartEvent; break;
+    case PlatformEvent::GestureScrollEnd:
+        eventType = eventNames().gesturescrollendEvent; break;
+    case PlatformEvent::GestureScrollUpdate:
+        eventType = eventNames().gesturescrollupdateEvent; break;
+    case PlatformEvent::GestureTap:
+        eventType = eventNames().gesturetapEvent; break;
+    case PlatformEvent::GestureTapDown:
+        eventType = eventNames().gesturetapdownEvent; break;
+    case PlatformEvent::GestureDoubleTap:
+    case PlatformEvent::GestureTwoFingerTap:
+    case PlatformEvent::GestureLongPress:
+    case PlatformEvent::GesturePinchBegin:
+    case PlatformEvent::GesturePinchEnd:
+    case PlatformEvent::GesturePinchUpdate:
+    default:
+        return 0;
+    }
+    return adoptRef(new GestureEvent(eventType, view, event.globalPosition().x(), event.globalPosition().y(), event.position().x(), event.position().y(), event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(), event.deltaX(), event.deltaY()));
+}
+
+void GestureEvent::initGestureEvent(const AtomicString& type, PassRefPtr<AbstractView> view, int screenX, int screenY, int clientX, int clientY, bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, float deltaX, float deltaY)
+{
+    if (dispatched())
+        return;
+
+    initUIEvent(type, true, true, view, 0);
+    m_screenLocation = IntPoint(screenX, screenY);
+    m_ctrlKey = ctrlKey;
+    m_altKey = altKey;
+    m_shiftKey = shiftKey;
+    m_metaKey = metaKey;
+
+    m_deltaX = deltaX;
+    m_deltaY = deltaY;
+
+    initCoordinates(IntPoint(clientX, clientY));
+}
+
+const AtomicString& GestureEvent::interfaceName() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("TBDInterface"));
+    return name;
+}
+
+GestureEvent::GestureEvent()
+    : m_deltaX(0)
+    , m_deltaY(0)
+{
+}
+
+GestureEvent::GestureEvent(const AtomicString& type, PassRefPtr<AbstractView> view, int screenX, int screenY, int clientX, int clientY, bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, float deltaX, float deltaY)
+    : MouseRelatedEvent(type, true, true, view, 0, IntPoint(screenX, screenY), IntPoint(clientX, clientY),
+#if ENABLE(POINTER_LOCK)
+                        IntPoint(0, 0),
+#endif
+                        ctrlKey, altKey, shiftKey, metaKey)
+    , m_deltaX(deltaX)
+    , m_deltaY(deltaY)
+{
+}
+
+GestureEventDispatchMediator::GestureEventDispatchMediator(PassRefPtr<GestureEvent> gestureEvent)
+    : EventDispatchMediator(gestureEvent)
+{
+}
+
+GestureEvent* GestureEventDispatchMediator::event() const
+{
+    return static_cast<GestureEvent*>(EventDispatchMediator::event());
+}
+
+bool GestureEventDispatchMediator::dispatchEvent(EventDispatcher* dispatcher) const
+{
+    if (dispatcher->node()->disabled())
+        return true;
+
+    dispatcher->dispatchEvent(event());
+    ASSERT(!event()->defaultPrevented());
+    return event()->defaultHandled() || event()->defaultPrevented();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(GESTURE_EVENTS)
diff --git a/Source/WebCore/dom/GestureEvent.h b/Source/WebCore/dom/GestureEvent.h
new file mode 100644
index 000000000..ff083c3f2
--- /dev/null
+++ b/Source/WebCore/dom/GestureEvent.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GestureEvent_h
+#define GestureEvent_h
+
+#if ENABLE(GESTURE_EVENTS)
+
+#include "EventDispatcher.h"
+#include "EventNames.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "MouseRelatedEvent.h"
+#include "PlatformEvent.h"
+#include "PlatformGestureEvent.h"
+
+namespace WebCore {
+
+class GestureEvent : public MouseRelatedEvent {
+public:
+    virtual ~GestureEvent() { }
+
+    static PassRefPtr<GestureEvent> create();
+    static PassRefPtr<GestureEvent> create(PassRefPtr<AbstractView>, const PlatformGestureEvent&);
+
+    void initGestureEvent(const AtomicString& type, PassRefPtr<AbstractView>, int screenX, int screenY, int clientX, int clientY, bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, float deltaX, float deltaY);
+
+    virtual const AtomicString& interfaceName() const;
+
+    float deltaX() const { return m_deltaX; }
+    float deltaY() const { return m_deltaY; }
+
+private:
+    GestureEvent();
+    GestureEvent(const AtomicString& type, PassRefPtr<AbstractView>, int screenX, int screenY, int clientX, int clientY, bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, float deltaX, float deltaY);
+
+    float m_deltaX;
+    float m_deltaY;
+};
+
+class GestureEventDispatchMediator : public EventDispatchMediator {
+public:
+    static PassRefPtr<GestureEventDispatchMediator> create(PassRefPtr<GestureEvent> gestureEvent)
+    {
+        return adoptRef(new GestureEventDispatchMediator(gestureEvent));
+    }
+
+private:
+    explicit GestureEventDispatchMediator(PassRefPtr<GestureEvent>);
+
+    GestureEvent* event() const;
+
+    virtual bool dispatchEvent(EventDispatcher*) const;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(GESTURE_EVENTS)
+
+#endif // GestureEvent_h
diff --git a/Source/WebCore/dom/MemoryInstrumentation.cpp b/Source/WebCore/dom/MemoryInstrumentation.cpp
new file mode 100644
index 000000000..8a0175356
--- /dev/null
+++ b/Source/WebCore/dom/MemoryInstrumentation.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MemoryInstrumentation.h"
+
+#include "KURL.h"
+#include <wtf/text/StringImpl.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+void MemoryInstrumentation::addObject(const String& string, ObjectType objectType)
+{
+    addObject(string.impl(), objectType);
+}
+
+void MemoryInstrumentation::addObject(const StringImpl* stringImpl, ObjectType objectType)
+{
+    if (!stringImpl || visited(stringImpl))
+        return;
+    countObjectSize(objectType, stringImpl->sizeInBytes());
+}
+
+void MemoryInstrumentation::addObject(const KURL& url, ObjectType objectType)
+{
+    if (visited(&url))
+        return;
+    addObject(url.string(), objectType);
+    if (url.innerURL())
+        addObject(url.innerURL(), objectType);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/dom/MemoryInstrumentation.h b/Source/WebCore/dom/MemoryInstrumentation.h
index 96c017887..33f2e6e8a 100644
--- a/Source/WebCore/dom/MemoryInstrumentation.h
+++ b/Source/WebCore/dom/MemoryInstrumentation.h
@@ -1,3 +1,4 @@
+
 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
@@ -30,7 +31,6 @@
 
 #ifndef MemoryInstrumentation_h
 #define MemoryInstrumentation_h
-#include <stdio.h>
 
 #include <wtf/Assertions.h>
 #include <wtf/Forward.h>
@@ -40,6 +40,8 @@
 
 namespace WebCore {
 
+template <typename T> class DataRef;
+class KURL;
 class MemoryObjectInfo;
 
 class MemoryInstrumentation {
@@ -52,32 +54,72 @@ public:
         CSS,
         Binding,
         Loader,
+        MemoryCacheStructures,
+        CachedResource,
+        CachedResourceCSS,
+        CachedResourceFont,
+        CachedResourceImage,
+        CachedResourceScript,
+        CachedResourceSVG,
+        CachedResourceShader,
+        CachedResourceXSLT,
         LastTypeEntry
     };
 
-    template <typename T> void addInstrumentedMember(const T& t)
+    template <typename T> void addRootObject(const T& t)
     {
-        OwningTraits<T>::addInstrumentedMember(this, t);
+        addInstrumentedObject(t, Other);
+        processDeferredInstrumentedPointers();
     }
 
-    template <typename T> void addMember(const T& t, ObjectType objectType)
+    template <typename Container> static size_t calculateContainerSize(const Container&, bool contentOnly = false);
+
+protected:
+    class InstrumentedPointerBase {
+    public:
+        virtual ~InstrumentedPointerBase() { }
+        virtual void process(MemoryInstrumentation*) = 0;
+    };
+
+private:
+    virtual void countObjectSize(ObjectType, size_t) = 0;
+    virtual void deferInstrumentedPointer(PassOwnPtr<InstrumentedPointerBase>) = 0;
+    virtual bool visited(const void*) = 0;
+    virtual void processDeferredInstrumentedPointers() = 0;
+
+    friend class MemoryClassInfo;
+    template <typename T> class InstrumentedPointer : public InstrumentedPointerBase {
+    public:
+        explicit InstrumentedPointer(const T* pointer, ObjectType ownerObjectType) : m_pointer(pointer), m_ownerObjectType(ownerObjectType) { }
+        virtual void process(MemoryInstrumentation*) OVERRIDE;
+
+    private:
+        const T* m_pointer;
+        const ObjectType m_ownerObjectType;
+    };
+
+    template <typename T> void addObject(const T& t, ObjectType ownerObjectType)
     {
-        OwningTraits<T>::addMember(this, t, objectType);
+        OwningTraits<T>::addObject(this, t, ownerObjectType);
     }
-
+    void addObject(const String&, ObjectType);
+    void addObject(const StringImpl*, ObjectType);
+    void addObject(const KURL&, ObjectType);
+    template <typename T> void addInstrumentedObject(const T& t, ObjectType ownerObjectType) { OwningTraits<T>::addInstrumentedObject(this, t, ownerObjectType); }
     template <typename HashMapType> void addHashMap(const HashMapType&, ObjectType, bool contentOnly = false);
     template <typename HashSetType> void addHashSet(const HashSetType&, ObjectType, bool contentOnly = false);
     template <typename CollectionType> void addInstrumentedCollection(const CollectionType&, ObjectType, bool contentOnly = false);
+    template <typename MapType> void addInstrumentedMapEntries(const MapType&, ObjectType);
+    template <typename MapType> void addInstrumentedMapValues(const MapType&, ObjectType);
     template <typename ListHashSetType> void addListHashSet(const ListHashSetType&, ObjectType, bool contentOnly = false);
     template <typename VectorType> void addVector(const VectorType&, ObjectType, bool contentOnly = false);
-    void addRawBuffer(const void* const& buffer, ObjectType objectType, size_t size)
+    void addRawBuffer(const void* const& buffer, ObjectType ownerObjectType, size_t size)
     {
         if (!buffer || visited(buffer))
             return;
-        countObjectSize(objectType, size);
+        countObjectSize(ownerObjectType, size);
     }
 
-protected:
     enum OwningType {
         byPointer,
         byReference
@@ -85,69 +127,34 @@ protected:
 
     template <typename T>
     struct OwningTraits { // Default byReference implementation.
-        static void addInstrumentedMember(MemoryInstrumentation* instrumentation, const T& t) { instrumentation->addInstrumentedMemberImpl(&t, byReference); }
-        static void addMember(MemoryInstrumentation* instrumentation, const T& t, MemoryInstrumentation::ObjectType objectType) { instrumentation->addMemberImpl(&t, objectType, byReference); }
+        static void addInstrumentedObject(MemoryInstrumentation* instrumentation, const T& t, ObjectType ownerObjectType) { instrumentation->addInstrumentedObjectImpl(&t, ownerObjectType, byReference); }
+        static void addObject(MemoryInstrumentation* instrumentation, const T& t, ObjectType ownerObjectType) { instrumentation->addObjectImpl(&t, ownerObjectType, byReference); }
     };
 
     template <typename T>
     struct OwningTraits<T*> { // Custom byPointer implementation.
-        static void addInstrumentedMember(MemoryInstrumentation* instrumentation, const T* const& t) { instrumentation->addInstrumentedMemberImpl(t, byPointer); }
-        static void addMember(MemoryInstrumentation* instrumentation, const T* const& t, MemoryInstrumentation::ObjectType objectType) { instrumentation->addMemberImpl(t, objectType, byPointer); }
+        static void addInstrumentedObject(MemoryInstrumentation* instrumentation, const T* const& t, ObjectType ownerObjectType) { instrumentation->addInstrumentedObjectImpl(t, ownerObjectType, byPointer); }
+        static void addObject(MemoryInstrumentation* instrumentation, const T* const& t, ObjectType ownerObjectType) { instrumentation->addObjectImpl(t, ownerObjectType, byPointer); }
     };
 
-    template <typename T> void addInstrumentedMemberImpl(const T* const&, OwningType);
-    template <typename T> void addInstrumentedMemberImpl(const OwnPtr<T>* const& object, MemoryInstrumentation::OwningType owningType) { addInstrumentedMemberImpl(object->get(), owningType); }
-    template <typename T> void addInstrumentedMemberImpl(const RefPtr<T>* const& object, MemoryInstrumentation::OwningType owningType) { addInstrumentedMemberImpl(object->get(), owningType); }
-
-    template <typename T>
-    void addMemberImpl(const T* const& object, ObjectType objectType, OwningType owningType)
-    {
-        if (!object || visited(object))
-            return;
-        if (owningType == byReference)
-            return;
-        countObjectSize(objectType, sizeof(T));
-    }
+    template <typename T> void addInstrumentedObjectImpl(const T* const&, ObjectType, OwningType);
+    template <typename T> void addInstrumentedObjectImpl(const DataRef<T>* const&, ObjectType, OwningType);
+    template <typename T> void addInstrumentedObjectImpl(const OwnPtr<T>* const&, ObjectType, OwningType);
+    template <typename T> void addInstrumentedObjectImpl(const RefPtr<T>* const&, ObjectType, OwningType);
 
-    class InstrumentedPointerBase {
-    public:
-        virtual ~InstrumentedPointerBase() { }
-
-        virtual void process(MemoryInstrumentation*) = 0;
-    };
-
-    template <typename Container>
-    size_t calculateContainerSize(const Container& container, bool contentOnly = false)
-    {
-        return (contentOnly ? 0 : sizeof(container)) + container.capacity() * sizeof(typename Container::ValueType);
-    }
-
-private:
-    template <typename T> friend class MemoryClassInfo;
-    template <typename T>
-    class InstrumentedPointer : public InstrumentedPointerBase {
-    public:
-        explicit InstrumentedPointer(const T* pointer) : m_pointer(pointer) { }
-
-        virtual void process(MemoryInstrumentation*) OVERRIDE;
-
-    private:
-        const T* m_pointer;
-    };
-
-    virtual void addString(const String&, ObjectType) = 0;
-    virtual void countObjectSize(ObjectType, size_t) = 0;
-    virtual void deferInstrumentedPointer(PassOwnPtr<InstrumentedPointerBase>) = 0;
-    virtual bool visited(const void*) = 0;
+    template <typename T> void addObjectImpl(const T* const&, ObjectType, OwningType);
+    template <typename T> void addObjectImpl(const DataRef<T>* const&, ObjectType, OwningType);
+    template <typename T> void addObjectImpl(const OwnPtr<T>* const&, ObjectType, OwningType);
+    template <typename T> void addObjectImpl(const RefPtr<T>* const&, ObjectType, OwningType);
 };
 
 class MemoryObjectInfo {
 public:
-    explicit MemoryObjectInfo(MemoryInstrumentation* memoryInstrumentation)
+    MemoryObjectInfo(MemoryInstrumentation* memoryInstrumentation, MemoryInstrumentation::ObjectType ownerObjectType)
         : m_memoryInstrumentation(memoryInstrumentation)
-        , m_objectType(MemoryInstrumentation::Other)
+        , m_objectType(ownerObjectType)
         , m_objectSize(0)
-     { }
+    { }
 
     MemoryInstrumentation::ObjectType objectType() const { return m_objectType; }
     size_t objectSize() const { return m_objectSize; }
@@ -155,14 +162,15 @@ public:
     MemoryInstrumentation* memoryInstrumentation() { return m_memoryInstrumentation; }
 
 private:
-    template <typename T> friend class MemoryClassInfo;
+    friend class MemoryClassInfo;
 
-    template <typename T> void reportObjectInfo(const T*, MemoryInstrumentation::ObjectType objectType, size_t extraObjectSize)
+    template <typename T> void reportObjectInfo(MemoryInstrumentation::ObjectType objectType)
     {
-        if (m_objectType != MemoryInstrumentation::Other)
-            return;
-        m_objectType = objectType;
-        m_objectSize = sizeof(T) + extraObjectSize;
+        if (!m_objectSize) {
+            m_objectSize = sizeof(T);
+            if (objectType != MemoryInstrumentation::Other)
+                m_objectType = objectType;
+        }
     }
 
     MemoryInstrumentation* m_memoryInstrumentation;
@@ -170,50 +178,38 @@ private:
     size_t m_objectSize;
 };
 
-// Link time guard for string members. They produce link error is a string is reported via addMember.
-template <> void MemoryInstrumentation::addMemberImpl<AtomicString>(const AtomicString* const&, MemoryInstrumentation::ObjectType, MemoryInstrumentation::OwningType);
-template <> void MemoryInstrumentation::addMemberImpl<String>(const String* const&, MemoryInstrumentation::ObjectType, MemoryInstrumentation::OwningType);
-
-
-template <typename T>
-void MemoryInstrumentation::addInstrumentedMemberImpl(const T* const& object, MemoryInstrumentation::OwningType owningType)
-{
-    if (!object || visited(object))
-        return;
-    if (owningType == byReference) {
-        MemoryObjectInfo memoryObjectInfo(this);
-        object->reportMemoryUsage(&memoryObjectInfo);
-    } else
-        deferInstrumentedPointer(adoptPtr(new InstrumentedPointer<T>(object)));
-}
-
-
-template <typename T>
 class MemoryClassInfo {
 public:
-    MemoryClassInfo(MemoryObjectInfo* memoryObjectInfo, const T* ptr, MemoryInstrumentation::ObjectType objectType, size_t extraObjectSize = 0)
+    template <typename T>
+    MemoryClassInfo(MemoryObjectInfo* memoryObjectInfo, const T*, MemoryInstrumentation::ObjectType objectType)
         : m_memoryObjectInfo(memoryObjectInfo)
         , m_memoryInstrumentation(memoryObjectInfo->memoryInstrumentation())
     {
-        m_memoryObjectInfo->reportObjectInfo(ptr, objectType, extraObjectSize);
+        m_memoryObjectInfo->reportObjectInfo<T>(objectType);
         m_objectType = memoryObjectInfo->objectType();
     }
 
-    template <typename P> void visitBaseClass(const P* ptr) { ptr->P::reportMemoryUsage(m_memoryObjectInfo); }
-
-    template <typename M> void addInstrumentedMember(const M& member) { m_memoryInstrumentation->addInstrumentedMember(member); }
-    template <typename M> void addMember(const M& member) { m_memoryInstrumentation->addMember(member, m_objectType); }
+    template <typename M> void addInstrumentedMember(const M& member) { m_memoryInstrumentation->addInstrumentedObject(member, m_objectType); }
+    template <typename M> void addMember(const M& member) { m_memoryInstrumentation->addObject(member, m_objectType); }
 
     template <typename HashMapType> void addHashMap(const HashMapType& map) { m_memoryInstrumentation->addHashMap(map, m_objectType, true); }
     template <typename HashSetType> void addHashSet(const HashSetType& set) { m_memoryInstrumentation->addHashSet(set, m_objectType, true); }
+    template <typename HashSetType> void addHashCountedSet(const HashSetType& set) { m_memoryInstrumentation->addHashSet(set, m_objectType, true); }
     template <typename HashSetType> void addInstrumentedHashSet(const HashSetType& set) { m_memoryInstrumentation->addInstrumentedCollection(set, m_objectType, true); }
     template <typename VectorType> void addInstrumentedVector(const VectorType& vector) { m_memoryInstrumentation->addInstrumentedCollection(vector, m_objectType, true); }
+    template <typename VectorType> void addInstrumentedVectorPtr(const OwnPtr<VectorType>& vector) { m_memoryInstrumentation->addInstrumentedCollection(*vector, m_objectType, false); }
+    template <typename VectorType> void addInstrumentedVectorPtr(const VectorType* const& vector) { m_memoryInstrumentation->addInstrumentedCollection(*vector, m_objectType, false); }
+    template <typename MapType> void addInstrumentedMapEntries(const MapType& map) { m_memoryInstrumentation->addInstrumentedMapEntries(map, m_objectType); }
+    template <typename MapType> void addInstrumentedMapValues(const MapType& map) { m_memoryInstrumentation->addInstrumentedMapValues(map, m_objectType); }
     template <typename ListHashSetType> void addListHashSet(const ListHashSetType& set) { m_memoryInstrumentation->addListHashSet(set, m_objectType, true); }
     template <typename VectorType> void addVector(const VectorType& vector) { m_memoryInstrumentation->addVector(vector, m_objectType, true); }
+    template <typename VectorType> void addVectorPtr(const VectorType* const vector) { m_memoryInstrumentation->addVector(*vector, m_objectType, false); }
     void addRawBuffer(const void* const& buffer, size_t size) { m_memoryInstrumentation->addRawBuffer(buffer, m_objectType, size); }
 
-    void addString(const String& string) { m_memoryInstrumentation->addString(string, m_objectType); }
-    void addString(const AtomicString& string) { m_memoryInstrumentation->addString((const String&)string, m_objectType); }
+    void addMember(const String& string) { m_memoryInstrumentation->addObject(string, m_objectType); }
+    void addMember(const AtomicString& string) { m_memoryInstrumentation->addObject((const String&)string, m_objectType); }
+    void addMember(const StringImpl* string) { m_memoryInstrumentation->addObject(string, m_objectType); }
+    void addMember(const KURL& url) { m_memoryInstrumentation->addObject(url, m_objectType); }
 
 private:
     MemoryObjectInfo* m_memoryObjectInfo;
@@ -221,54 +217,149 @@ private:
     MemoryInstrumentation::ObjectType m_objectType;
 };
 
+template <typename T>
+void MemoryInstrumentation::addInstrumentedObjectImpl(const T* const& object, ObjectType ownerObjectType, OwningType owningType)
+{
+    if (owningType == byReference) {
+        MemoryObjectInfo memoryObjectInfo(this, ownerObjectType);
+        object->reportMemoryUsage(&memoryObjectInfo);
+    } else {
+        if (!object || visited(object))
+            return;
+        deferInstrumentedPointer(adoptPtr(new InstrumentedPointer<T>(object, ownerObjectType)));
+    }
+}
+
+template <typename T>
+void MemoryInstrumentation::addInstrumentedObjectImpl(const DataRef<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
+{
+    if (owningType == byPointer)
+        countObjectSize(ownerObjectType, sizeof(DataRef<T>));
+    addInstrumentedObjectImpl(object->get(), ownerObjectType, byPointer);
+}
+
+template <typename T>
+void MemoryInstrumentation::addInstrumentedObjectImpl(const OwnPtr<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
+{
+    if (owningType == byPointer)
+        countObjectSize(ownerObjectType, sizeof(OwnPtr<T>));
+    addInstrumentedObjectImpl(object->get(), ownerObjectType, byPointer);
+}
+
+template <typename T>
+void MemoryInstrumentation::addInstrumentedObjectImpl(const RefPtr<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
+{
+    if (owningType == byPointer)
+        countObjectSize(ownerObjectType, sizeof(RefPtr<T>));
+    addInstrumentedObjectImpl(object->get(), ownerObjectType, byPointer);
+}
+
+template <typename T>
+void MemoryInstrumentation::addObjectImpl(const DataRef<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
+{
+    if (owningType == byPointer)
+        countObjectSize(ownerObjectType, sizeof(DataRef<T>));
+    addObjectImpl(object->get(), ownerObjectType, byPointer);
+}
+
+template <typename T>
+void MemoryInstrumentation::addObjectImpl(const OwnPtr<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
+{
+    if (owningType == byPointer)
+        countObjectSize(ownerObjectType, sizeof(RefPtr<T>));
+    addObjectImpl(object->get(), ownerObjectType, byPointer);
+}
+
+template <typename T>
+void MemoryInstrumentation::addObjectImpl(const RefPtr<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
+{
+    if (owningType == byPointer)
+        countObjectSize(ownerObjectType, sizeof(RefPtr<T>));
+    addObjectImpl(object->get(), ownerObjectType, byPointer);
+}
+
+template <typename T>
+void MemoryInstrumentation::addObjectImpl(const T* const& object, ObjectType ownerObjectType, OwningType owningType)
+{
+    if (!object || visited(object))
+        return;
+    if (owningType == byReference)
+        return;
+    countObjectSize(ownerObjectType, sizeof(T));
+}
+
 template<typename HashMapType>
-void MemoryInstrumentation::addHashMap(const HashMapType& hashMap, ObjectType objectType, bool contentOnly)
+void MemoryInstrumentation::addHashMap(const HashMapType& hashMap, ObjectType ownerObjectType, bool contentOnly)
 {
     if (visited(&hashMap))
         return;
-    countObjectSize(objectType, calculateContainerSize(hashMap, contentOnly));
+    countObjectSize(ownerObjectType, calculateContainerSize(hashMap, contentOnly));
 }
 
 template<typename HashSetType>
-void MemoryInstrumentation::addHashSet(const HashSetType& hashSet, ObjectType objectType, bool contentOnly)
+void MemoryInstrumentation::addHashSet(const HashSetType& hashSet, ObjectType ownerObjectType, bool contentOnly)
 {
     if (visited(&hashSet))
         return;
-    countObjectSize(objectType, calculateContainerSize(hashSet, contentOnly));
+    countObjectSize(ownerObjectType, calculateContainerSize(hashSet, contentOnly));
 }
 
 template <typename CollectionType>
-void MemoryInstrumentation::addInstrumentedCollection(const CollectionType& collection, ObjectType objectType, bool contentOnly)
+void MemoryInstrumentation::addInstrumentedCollection(const CollectionType& collection, ObjectType ownerObjectType, bool contentOnly)
 {
     if (visited(&collection))
         return;
-    countObjectSize(objectType, calculateContainerSize(collection, contentOnly));
+    countObjectSize(ownerObjectType, calculateContainerSize(collection, contentOnly));
     typename CollectionType::const_iterator end = collection.end();
     for (typename CollectionType::const_iterator i = collection.begin(); i != end; ++i)
-        addInstrumentedMember(*i);
+        addInstrumentedObject(*i, ownerObjectType);
+}
+
+template <typename MapType>
+void MemoryInstrumentation::addInstrumentedMapEntries(const MapType& map, ObjectType ownerObjectType)
+{
+    typename MapType::const_iterator end = map.end();
+    for (typename MapType::const_iterator i = map.begin(); i != end; ++i) {
+        addInstrumentedObject(i->first, ownerObjectType);
+        addInstrumentedObject(i->second, ownerObjectType);
+    }
+}
+
+template <typename MapType>
+void MemoryInstrumentation::addInstrumentedMapValues(const MapType& map, ObjectType ownerObjectType)
+{
+    typename MapType::const_iterator end = map.end();
+    for (typename MapType::const_iterator i = map.begin(); i != end; ++i)
+        addInstrumentedObject(i->second, ownerObjectType);
 }
 
 template<typename ListHashSetType>
-void MemoryInstrumentation::addListHashSet(const ListHashSetType& hashSet, ObjectType objectType, bool contentOnly)
+void MemoryInstrumentation::addListHashSet(const ListHashSetType& hashSet, ObjectType ownerObjectType, bool contentOnly)
 {
     if (visited(&hashSet))
         return;
     size_t size = (contentOnly ? 0 : sizeof(ListHashSetType)) + hashSet.capacity() * sizeof(void*) + hashSet.size() * (sizeof(typename ListHashSetType::ValueType) + 2 * sizeof(void*));
-    countObjectSize(objectType, size);
+    countObjectSize(ownerObjectType, size);
 }
 
 template <typename VectorType>
-void MemoryInstrumentation::addVector(const VectorType& vector, ObjectType objectType, bool contentOnly)
+void MemoryInstrumentation::addVector(const VectorType& vector, ObjectType ownerObjectType, bool contentOnly)
 {
     if (!vector.data() || visited(vector.data()))
         return;
-    countObjectSize(objectType, calculateContainerSize(vector, contentOnly));
+    countObjectSize(ownerObjectType, calculateContainerSize(vector, contentOnly));
+}
+
+template <typename Container>
+size_t MemoryInstrumentation::calculateContainerSize(const Container& container, bool contentOnly)
+{
+    return (contentOnly ? 0 : sizeof(container)) + container.capacity() * sizeof(typename Container::ValueType);
 }
 
 template<typename T>
 void MemoryInstrumentation::InstrumentedPointer<T>::process(MemoryInstrumentation* memoryInstrumentation)
 {
-    MemoryObjectInfo memoryObjectInfo(memoryInstrumentation);
+    MemoryObjectInfo memoryObjectInfo(memoryInstrumentation, m_ownerObjectType);
     m_pointer->reportMemoryUsage(&memoryObjectInfo);
     memoryInstrumentation->countObjectSize(memoryObjectInfo.objectType(), memoryObjectInfo.objectSize());
 }
diff --git a/Source/WebCore/dom/MicroDataItemList.cpp b/Source/WebCore/dom/MicroDataItemList.cpp
index 6fc53936e..38460ce3d 100644
--- a/Source/WebCore/dom/MicroDataItemList.cpp
+++ b/Source/WebCore/dom/MicroDataItemList.cpp
@@ -40,7 +40,7 @@ using namespace HTMLNames;
 
 const String& MicroDataItemList::undefinedItemType()
 {
-    DEFINE_STATIC_LOCAL(String, undefinedItemTypeString, ("http://webkit.org/microdata/undefinedItemType"));
+    DEFINE_STATIC_LOCAL(String, undefinedItemTypeString, (""));
     return undefinedItemTypeString;
 }
 
@@ -65,7 +65,7 @@ bool MicroDataItemList::nodeMatches(Element* testNode) const
     if (!testElement->fastHasAttribute(itemscopeAttr) || testElement->fastHasAttribute(itempropAttr))
         return false;
 
-    if (m_originalTypeNames == undefinedItemType())
+    if (!m_typeNames.size())
         return true;
 
     return testElement->itemType()->tokens().containsAll(m_typeNames);
diff --git a/Source/WebCore/dom/MouseEvent.cpp b/Source/WebCore/dom/MouseEvent.cpp
index cf2e2660a..9edda71ea 100644
--- a/Source/WebCore/dom/MouseEvent.cpp
+++ b/Source/WebCore/dom/MouseEvent.cpp
@@ -207,22 +207,21 @@ bool MouseEventDispatchMediator::dispatchEvent(EventDispatcher* dispatcher) cons
     dispatcher->dispatchEvent(event());
     bool swallowEvent = event()->defaultHandled() || event()->defaultPrevented();
 
+    if (event()->type() != eventNames().clickEvent || event()->detail() != 2)
+        return swallowEvent;
     // Special case: If it's a double click event, we also send the dblclick event. This is not part
     // of the DOM specs, but is used for compatibility with the ondblclick="" attribute. This is treated
     // as a separate event in other DOM-compliant browsers like Firefox, and so we do the same.
-    if (event()->type() == eventNames().clickEvent && event()->detail() == 2) {
-        RefPtr<MouseEvent> doubleClickEvent = MouseEvent::create();
-        doubleClickEvent->initMouseEvent(eventNames().dblclickEvent, event()->bubbles(), event()->cancelable(), event()->view(),
-                event()->detail(), event()->screenX(), event()->screenY(), event()->clientX(), event()->clientY(),
-                event()->ctrlKey(), event()->altKey(), event()->shiftKey(), event()->metaKey(),
-                event()->button(), relatedTarget);
-        if (event()->defaultHandled())
-            doubleClickEvent->setDefaultHandled();
-        dispatcher->dispatchEvent(doubleClickEvent);
-        if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
-            swallowEvent = true;
-    }
-
+    RefPtr<MouseEvent> doubleClickEvent = MouseEvent::create();
+    doubleClickEvent->initMouseEvent(eventNames().dblclickEvent, event()->bubbles(), event()->cancelable(), event()->view(),
+                                     event()->detail(), event()->screenX(), event()->screenY(), event()->clientX(), event()->clientY(),
+                                     event()->ctrlKey(), event()->altKey(), event()->shiftKey(), event()->metaKey(),
+                                     event()->button(), relatedTarget);
+    if (event()->defaultHandled())
+        doubleClickEvent->setDefaultHandled();
+    EventDispatcher::dispatchEvent(dispatcher->node(), MouseEventDispatchMediator::create(doubleClickEvent));
+    if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
+        return true;
     return swallowEvent;
 }
 
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index f30c3fcbf..3841e0cdd 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -67,6 +67,7 @@
 #include "KeyboardEvent.h"
 #include "LabelsNodeList.h"
 #include "Logging.h"
+#include "MemoryInstrumentation.h"
 #include "MouseEvent.h"
 #include "MutationEvent.h"
 #include "NameNodeList.h"
@@ -109,6 +110,10 @@
 #include <wtf/text/CString.h>
 #include <wtf/text/StringBuilder.h>
 
+#if ENABLE(GESTURE_EVENTS)
+#include "GestureEvent.h"
+#endif
+
 #if ENABLE(INSPECTOR)
 #include "InspectorController.h"
 #endif
@@ -2127,7 +2132,7 @@ void Node::showNodePathForThis() const
         const Node* node = chain[index - 1];
         if (node->isShadowRoot()) {
             int count = 0;
-            for (ShadowRoot* shadowRoot = oldestShadowRootFor(node); shadowRoot && shadowRoot != node; shadowRoot = shadowRoot->youngerShadowRoot())
+            for (ShadowRoot* shadowRoot = oldestShadowRootFor(toShadowRoot(node)->host()); shadowRoot && shadowRoot != node; shadowRoot = shadowRoot->youngerShadowRoot())
                 ++count;
             fprintf(stderr, "/#shadow-root[%d]", count);
             continue;
@@ -2262,7 +2267,7 @@ void NodeListsNodeData::invalidateCaches(const QualifiedName* attrName)
     for (NodeListNameCacheMap::const_iterator it = m_nameCaches.begin(); it != nameCacheEnd; ++it)
         it->second->invalidateCache(attrName);
 
-    if (!attrName)
+    if (attrName)
         return;
 
     TagNodeListCacheNS::iterator tagCacheEnd = m_tagNodeListCacheNS.end();
@@ -2576,16 +2581,6 @@ bool Node::dispatchEvent(PassRefPtr<Event> event)
     return EventDispatcher::dispatchEvent(this, EventDispatchMediator::create(event));
 }
 
-void Node::dispatchRegionLayoutUpdateEvent()
-{
-    ASSERT(!eventDispatchForbidden());
-
-    if (!document()->hasListenerType(Document::REGIONLAYOUTUPDATE_LISTENER))
-        return;
-
-    dispatchScopedEvent(UIEvent::create(eventNames().webkitRegionLayoutUpdateEvent, true, true, document()->defaultView(), 0));
-}
-
 void Node::dispatchSubtreeModifiedEvent()
 {
     if (isInShadowTree())
@@ -2633,6 +2628,16 @@ bool Node::dispatchMouseEvent(const PlatformMouseEvent& event, const AtomicStrin
     return EventDispatcher::dispatchEvent(this, MouseEventDispatchMediator::create(MouseEvent::create(eventType, document()->defaultView(), event, detail, relatedTarget)));
 }
 
+#if ENABLE(GESTURE_EVENTS)
+bool Node::dispatchGestureEvent(const PlatformGestureEvent& event)
+{
+    RefPtr<GestureEvent> gestureEvent = GestureEvent::create(document()->defaultView(), event);
+    if (!gestureEvent.get())
+        return false;
+    return EventDispatcher::dispatchEvent(this, GestureEventDispatchMediator::create(gestureEvent));
+}
+#endif
+
 void Node::dispatchSimulatedClick(PassRefPtr<Event> event, bool sendMouseEvents, bool showPressedLook)
 {
     EventDispatcher::dispatchSimulatedClick(this, event, sendMouseEvents, showPressedLook);
@@ -2742,6 +2747,20 @@ void Node::defaultEventHandler(Event* event)
     }
 }
 
+bool Node::willRespondToMouseMoveEvents()
+{
+    if (disabled())
+        return false;
+    return hasEventListeners(eventNames().mousemoveEvent) || hasEventListeners(eventNames().mouseoverEvent) || hasEventListeners(eventNames().mouseoutEvent);
+}
+
+bool Node::willRespondToMouseClickEvents()
+{
+    if (disabled())
+        return false;
+    return isContentEditable() || hasEventListeners(eventNames().mouseupEvent) || hasEventListeners(eventNames().mousedownEvent) || hasEventListeners(eventNames().clickEvent) || hasEventListeners(eventNames().DOMActivateEvent);
+}
+
 #if ENABLE(MICRODATA)
 DOMSettableTokenList* Node::itemProp()
 {
@@ -2798,12 +2817,14 @@ void Node::removedLastRef()
 
 void Node::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<Node> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
-    info.visitBaseClass<TreeShared<Node, ContainerNode> >(this);
-    info.visitBaseClass<ScriptWrappable>(this);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    TreeShared<Node, ContainerNode>::reportMemoryUsage(memoryObjectInfo);
+    ScriptWrappable::reportMemoryUsage(memoryObjectInfo);
     info.addInstrumentedMember(m_document);
     info.addInstrumentedMember(m_next);
     info.addInstrumentedMember(m_previous);
+    if (m_renderer)
+        info.addInstrumentedMember(m_renderer->style());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 86a7d39ed..141ce96bb 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -29,7 +29,6 @@
 #include "EventTarget.h"
 #include "KURLHash.h"
 #include "LayoutTypes.h"
-#include "MemoryInstrumentation.h"
 #include "MutationObserver.h"
 #include "RenderStyleConstants.h"
 #include "ScriptWrappable.h"
@@ -66,6 +65,7 @@ class Frame;
 class HTMLInputElement;
 class IntRect;
 class KeyboardEvent;
+class MemoryObjectInfo;
 class NSResolver;
 class NamedNodeMap;
 class NameNodeList;
@@ -88,6 +88,10 @@ class ShadowRoot;
 class TagNodeList;
 class TreeScope;
 
+#if ENABLE(GESTURE_EVENTS)
+class PlatformGestureEvent;
+#endif
+
 #if ENABLE(MICRODATA)
 class HTMLPropertiesCollection;
 class PropertyNodeList;
@@ -218,6 +222,7 @@ public:
     virtual bool isAttributeNode() const { return false; }
     virtual bool isCharacterDataNode() const { return false; }
     virtual bool isFrameOwnerElement() const { return false; }
+    virtual bool isPluginElement() const { return false; }
     bool isDocumentNode() const;
     bool isShadowRoot() const { return getFlag(IsShadowRootFlag); }
     bool inNamedFlow() const { return getFlag(InNamedFlowFlag); }
@@ -573,6 +578,9 @@ public:
     PassRefPtr<NodeList> getElementsByClassName(const String& classNames);
     PassRefPtr<RadioNodeList> radioNodeList(const AtomicString&);
 
+    virtual bool willRespondToMouseMoveEvents();
+    virtual bool willRespondToMouseClickEvents();
+
     PassRefPtr<Element> querySelector(const AtomicString& selectors, ExceptionCode&);
     PassRefPtr<NodeList> querySelectorAll(const AtomicString& selectors, ExceptionCode&);
 
@@ -599,8 +607,6 @@ public:
 
     virtual void handleLocalEvents(Event*);
 
-    void dispatchRegionLayoutUpdateEvent();
-
     void dispatchSubtreeModifiedEvent();
     bool dispatchDOMActivateEvent(int detail, PassRefPtr<Event> underlyingEvent);
     void dispatchFocusInEvent(const AtomicString& eventType, PassRefPtr<Node> oldFocusedNode);
@@ -609,6 +615,9 @@ public:
     bool dispatchKeyEvent(const PlatformKeyboardEvent&);
     bool dispatchWheelEvent(const PlatformWheelEvent&);
     bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType, int clickCount = 0, Node* relatedTarget = 0);
+#if ENABLE(GESTURE_EVENTS)
+    bool dispatchGestureEvent(const PlatformGestureEvent&);
+#endif
     void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
     bool dispatchBeforeLoadEvent(const String& sourceURL);
 
diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
index 0bdc3e8ac..1fdebb6d2 100644
--- a/Source/WebCore/dom/NodeRareData.h
+++ b/Source/WebCore/dom/NodeRareData.h
@@ -137,19 +137,15 @@ public:
             NodeListAtomicNameCacheMap::const_iterator atomicNameCacheEnd = m_atomicNameCaches.end();
             for (NodeListAtomicNameCacheMap::const_iterator it = m_atomicNameCaches.begin(); it != atomicNameCacheEnd; ++it) {
                 DynamicSubtreeNodeList* list = it->second;
-                if (list->isRootedAtDocument()) {
-                    oldDocument->unregisterNodeListCache(list);
-                    newDocument->registerNodeListCache(list);
-                }
+                oldDocument->unregisterNodeListCache(list);
+                newDocument->registerNodeListCache(list);
             }
 
             NodeListNameCacheMap::const_iterator nameCacheEnd = m_nameCaches.end();
             for (NodeListNameCacheMap::const_iterator it = m_nameCaches.begin(); it != nameCacheEnd; ++it) {
                 DynamicSubtreeNodeList* list = it->second;
-                if (list->isRootedAtDocument()) {
-                    oldDocument->unregisterNodeListCache(list);
-                    newDocument->registerNodeListCache(list);
-                }
+                oldDocument->unregisterNodeListCache(list);
+                newDocument->registerNodeListCache(list);
             }
 
             TagNodeListCacheNS::const_iterator tagEnd = m_tagNodeListCacheNS.end();
diff --git a/Source/WebCore/dom/NodeRenderingContext.cpp b/Source/WebCore/dom/NodeRenderingContext.cpp
index 180aa94fe..84bdf90eb 100644
--- a/Source/WebCore/dom/NodeRenderingContext.cpp
+++ b/Source/WebCore/dom/NodeRenderingContext.cpp
@@ -325,7 +325,7 @@ void NodeRendererFactory::createRendererIfNeeded()
 
 #if ENABLE(FULLSCREEN_API)
     if (document->webkitIsFullScreen() && document->webkitCurrentFullScreenElement() == node)
-        newRenderer = RenderFullScreen::wrapRenderer(newRenderer, document);
+        newRenderer = RenderFullScreen::wrapRenderer(newRenderer, parentRenderer, document);
 #endif
 
     if (!newRenderer)
diff --git a/Source/WebCore/dom/PropertyNodeList.cpp b/Source/WebCore/dom/PropertyNodeList.cpp
index 3d3c042ba..1ebed0837 100644
--- a/Source/WebCore/dom/PropertyNodeList.cpp
+++ b/Source/WebCore/dom/PropertyNodeList.cpp
@@ -78,7 +78,7 @@ void PropertyNodeList::updateRefElements() const
 
 bool PropertyNodeList::nodeMatches(Element* testElement) const
 {
-    if (!testElement->isHTMLElement() || !testElement->fastHasAttribute(itempropAttr))
+    if (!testElement->isHTMLElement() || !testElement->fastHasAttribute(itempropAttr) || testElement == ownerNode())
         return false;
 
     for (unsigned i = 0; i < m_itemRefElementsCache.size(); ++i) {
diff --git a/Source/WebCore/dom/QualifiedName.h b/Source/WebCore/dom/QualifiedName.h
index de3827175..a62d4c2da 100644
--- a/Source/WebCore/dom/QualifiedName.h
+++ b/Source/WebCore/dom/QualifiedName.h
@@ -52,11 +52,11 @@ public:
 
         void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
         {
-            MemoryClassInfo<QualifiedNameImpl> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
-            info.addString(m_prefix);
-            info.addString(m_localName);
-            info.addString(m_namespace);
-            info.addString(m_localNameUpper);
+            MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+            info.addMember(m_prefix);
+            info.addMember(m_localName);
+            info.addMember(m_namespace);
+            info.addMember(m_localNameUpper);
         }
     private:
         QualifiedNameImpl(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI)
@@ -103,7 +103,7 @@ public:
     
     void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo<QualifiedName> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
         info.addInstrumentedMember(m_impl);
     }
 private:
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index 3a9fb48d8..e943cf5d9 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -303,13 +303,7 @@ bool Range::isPointInRange(Node* refNode, int offset, ExceptionCode& ec)
         return false;
     }
 
-    if (!refNode->attached()) {
-        // Firefox doesn't throw an exception for this case; it returns false.
-        return false;
-    }
-
-    if (refNode->document() != m_ownerDocument) {
-        ec = WRONG_DOCUMENT_ERR;
+    if (!refNode->attached() || refNode->document() != m_ownerDocument) {
         return false;
     }
 
diff --git a/Source/WebCore/dom/SecurityContext.h b/Source/WebCore/dom/SecurityContext.h
index fc9df3e34..9cf49d398 100644
--- a/Source/WebCore/dom/SecurityContext.h
+++ b/Source/WebCore/dom/SecurityContext.h
@@ -49,6 +49,7 @@ enum SandboxFlag {
     SandboxPopups = 1 << 6, // See https://www.w3.org/Bugs/Public/show_bug.cgi?id=12393
     SandboxAutomaticFeatures = 1 << 7,
     SandboxSeamlessIframes = 1 << 8,
+    SandboxPointerLock = 1 << 9,
     SandboxAll = -1 // Mask with all bits set to 1.
 };
 
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
index 9e82ab2b4..b9c481c18 100644
--- a/Source/WebCore/dom/ShadowRoot.cpp
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -35,9 +35,12 @@
 #include "Element.h"
 #include "ElementShadow.h"
 #include "HTMLContentElement.h"
+#include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "HTMLTextAreaElement.h"
 #include "InsertionPoint.h"
 #include "NodeRareData.h"
+#include "RuntimeEnabledFeatures.h"
 #include "SVGNames.h"
 #include "StyleResolver.h"
 #include "markup.h"
@@ -75,6 +78,19 @@ ShadowRoot::~ShadowRoot()
 
 static bool allowsAuthorShadowRoot(Element* element)
 {
+#if ENABLE(SHADOW_DOM)
+    if (RuntimeEnabledFeatures::authorShadowDOMForAnyElementEnabled())
+        return true;
+#endif
+
+    // FIXME: The elements in Shadow DOM of an input element assumes that they have renderer if the input
+    // element has a renderer. However, this does not hold until input elemnet is AuthorShadowDOM-ready.
+    // So we would like to prohibit having a AuthorShadowDOM for a while. The same thing happens to
+    // textarea element also.
+    // https://bugs.webkit.org/show_bug.cgi?id=92608
+    if (isHTMLInputElement(element) || isHTMLTextAreaElement(element))
+        return false;
+
     // FIXME: We disable multiple shadow subtrees for SVG for while, because there will be problems to support it.
     // https://bugs.webkit.org/show_bug.cgi?id=78205
     // Especially SVG TREF recreates shadow root dynamically.
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index 9ae672fa3..c5616b082 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -127,7 +127,7 @@ void StyledElement::updateStyleAttribute() const
     ASSERT(!isStyleAttributeValid());
     setIsStyleAttributeValid();
     if (const StylePropertySet* inlineStyle = this->inlineStyle())
-        const_cast<StyledElement*>(this)->setAttribute(styleAttr, inlineStyle->asText(), InUpdateStyleAttribute);
+        const_cast<StyledElement*>(this)->setSynchronizedLazyAttribute(styleAttr, inlineStyle->asText());
 }
 
 StyledElement::StyledElement(const QualifiedName& name, Document* document, ConstructionType type)
@@ -170,10 +170,12 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
     if (hasClass) {
         const bool shouldFoldCase = document()->inQuirksMode();
         ensureAttributeData()->setClass(newClassString, shouldFoldCase);
-        if (DOMTokenList* classList = optionalClassList())
-            static_cast<ClassList*>(classList)->reset(newClassString);
     } else if (attributeData())
         mutableAttributeData()->clearClass();
+
+    if (DOMTokenList* classList = optionalClassList())
+        static_cast<ClassList*>(classList)->reset(newClassString);
+
     setNeedsStyleRecalc();
 }
 
diff --git a/Source/WebCore/dom/StyledElement.h b/Source/WebCore/dom/StyledElement.h
index 0f61d1c66..a080dc136 100644
--- a/Source/WebCore/dom/StyledElement.h
+++ b/Source/WebCore/dom/StyledElement.h
@@ -37,7 +37,7 @@ class StyledElement : public Element {
 public:
     virtual ~StyledElement();
 
-    virtual StylePropertySet* additionalAttributeStyle() { return 0; }
+    virtual const StylePropertySet* additionalAttributeStyle() { return 0; }
     void invalidateStyleAttribute();
 
     const StylePropertySet* inlineStyle() const { return attributeData() ? attributeData()->inlineStyle() : 0; }
@@ -51,7 +51,7 @@ public:
     
     virtual CSSStyleDeclaration* style() OVERRIDE;
 
-    StylePropertySet* attributeStyle();
+    const StylePropertySet* attributeStyle();
 
     const SpaceSplitString& classNames() const;
 
@@ -106,7 +106,7 @@ inline void StyledElement::invalidateStyleAttribute()
     clearIsStyleAttributeValid();
 }
 
-inline StylePropertySet* StyledElement::attributeStyle()
+inline const StylePropertySet* StyledElement::attributeStyle()
 {
     if (attributeStyleDirty())
         updateAttributeStyle();
diff --git a/Source/WebCore/dom/WebKitNamedFlow.cpp b/Source/WebCore/dom/WebKitNamedFlow.cpp
index 7a07fba17..aa5901b67 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.cpp
+++ b/Source/WebCore/dom/WebKitNamedFlow.cpp
@@ -30,9 +30,12 @@
 #include "config.h"
 #include "WebKitNamedFlow.h"
 
+#include "EventNames.h"
 #include "RenderNamedFlowThread.h"
 #include "RenderRegion.h"
+#include "ScriptExecutionContext.h"
 #include "StaticNodeList.h"
+#include "UIEvent.h"
 #include "WebKitNamedFlowCollection.h"
 
 namespace WebCore {
@@ -114,7 +117,8 @@ PassRefPtr<NodeList> WebKitNamedFlow::getRegionsByContent(Node* contentNode)
         const RenderRegionList& regionList = m_parentFlowThread->renderRegionList();
         for (RenderRegionList::const_iterator iter = regionList.begin(); iter != regionList.end(); ++iter) {
             const RenderRegion* renderRegion = *iter;
-            if (!renderRegion->isValid())
+            // FIXME: Pseudo-elements are not included in the list
+            if (!renderRegion->isValid() || !renderRegion->node())
                 continue;
             if (m_parentFlowThread->objectInFlowRegion(contentNode->renderer(), renderRegion))
                 regionNodes.append(renderRegion->node());
@@ -124,6 +128,30 @@ PassRefPtr<NodeList> WebKitNamedFlow::getRegionsByContent(Node* contentNode)
     return StaticNodeList::adopt(regionNodes);
 }
 
+PassRefPtr<NodeList> WebKitNamedFlow::getRegions()
+{
+    Vector<RefPtr<Node> > regionNodes;
+
+    if (m_flowManager->document())
+        m_flowManager->document()->updateLayoutIgnorePendingStylesheets();
+
+    // The renderer may be destroyed or created after the style update.
+    // Because this is called from JS, where the wrapper keeps a reference to the NamedFlow, no guard is necessary.
+    if (!m_parentFlowThread)
+        return StaticNodeList::adopt(regionNodes);
+
+    const RenderRegionList& regionList = m_parentFlowThread->renderRegionList();
+    for (RenderRegionList::const_iterator iter = regionList.begin(); iter != regionList.end(); ++iter) {
+        const RenderRegion* renderRegion = *iter;
+        // FIXME: Pseudo-elements are not included in the list
+        if (!renderRegion->isValid() || !renderRegion->node())
+            continue;
+        regionNodes.append(renderRegion->node());
+    }
+
+    return StaticNodeList::adopt(regionNodes);
+}
+
 PassRefPtr<NodeList> WebKitNamedFlow::getContent()
 {
     Vector<RefPtr<Node> > contentNodes;
@@ -155,5 +183,40 @@ void WebKitNamedFlow::setRenderer(RenderNamedFlowThread* parentFlowThread)
     m_parentFlowThread = parentFlowThread;
 }
 
+EventTargetData* WebKitNamedFlow::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* WebKitNamedFlow::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+void WebKitNamedFlow::dispatchRegionLayoutUpdateEvent()
+{
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(m_parentFlowThread);
+
+    RefPtr<Event> event = UIEvent::create(eventNames().webkitRegionLayoutUpdateEvent, false, false, m_parentFlowThread->document()->defaultView(), 0);
+
+    dispatchEvent(event);
+}
+
+const AtomicString& WebKitNamedFlow::interfaceName() const
+{
+    return eventNames().interfaceForWebKitNamedFlow;
+}
+
+ScriptExecutionContext* WebKitNamedFlow::scriptExecutionContext() const
+{
+    return m_flowManager->document();
+}
+
+Node* WebKitNamedFlow::base() const
+{
+    return m_flowManager->document();
+}
+
 } // namespace WebCore
 
diff --git a/Source/WebCore/dom/WebKitNamedFlow.h b/Source/WebCore/dom/WebKitNamedFlow.h
index 5a39e8d9c..b51eadfb9 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.h
+++ b/Source/WebCore/dom/WebKitNamedFlow.h
@@ -30,18 +30,23 @@
 #ifndef WebKitNamedFlow_h
 #define WebKitNamedFlow_h
 
-#include <Node.h>
+#include "EventTarget.h"
+
 #include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
+#include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
+class Document;
+class Node;
 class NodeList;
 class RenderNamedFlowThread;
+class ScriptExecutionContext;
 class WebKitNamedFlowCollection;
 
-class WebKitNamedFlow : public RefCounted<WebKitNamedFlow> {
+class WebKitNamedFlow : public RefCounted<WebKitNamedFlow>, public EventTarget {
 public:
     static PassRefPtr<WebKitNamedFlow> create(PassRefPtr<WebKitNamedFlowCollection> manager, const AtomicString& flowThreadName);
 
@@ -51,8 +56,19 @@ public:
     bool overset() const;
     int firstEmptyRegionIndex() const;
     PassRefPtr<NodeList> getRegionsByContent(Node*);
+    PassRefPtr<NodeList> getRegions();
     PassRefPtr<NodeList> getContent();
 
+    using RefCounted<WebKitNamedFlow>::ref;
+    using RefCounted<WebKitNamedFlow>::deref;
+
+    virtual const AtomicString& interfaceName() const;
+    virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+    // This function is called from the JS binding code to determine if the NamedFlow object is reachable or not.
+    // If the object has listeners, the object should only be discarded if the parent Document is not reachable.
+    Node* base() const;
+
     void setRenderer(RenderNamedFlowThread* parentFlowThread);
 
     enum FlowState {
@@ -62,14 +78,25 @@ public:
 
     FlowState flowState() const { return m_parentFlowThread ? FlowStateCreated : FlowStateNull; }
 
+    void dispatchRegionLayoutUpdateEvent();
+
 private:
     WebKitNamedFlow(PassRefPtr<WebKitNamedFlowCollection>, const AtomicString&);
 
+    // EventTarget implementation.
+    virtual void refEventTarget() { ref(); }
+    virtual void derefEventTarget() { deref(); }
+
+    virtual EventTargetData* eventTargetData() OVERRIDE;
+    virtual EventTargetData* ensureEventTargetData() OVERRIDE;
+
     // The name of the flow thread as specified in CSS.
     AtomicString m_flowThreadName;
 
     RefPtr<WebKitNamedFlowCollection> m_flowManager;
     RenderNamedFlowThread* m_parentFlowThread;
+
+    EventTargetData m_eventTargetData;
 };
 
 }
diff --git a/Source/WebCore/dom/WebKitNamedFlow.idl b/Source/WebCore/dom/WebKitNamedFlow.idl
index 4d4e99b7e..45b43e787 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.idl
+++ b/Source/WebCore/dom/WebKitNamedFlow.idl
@@ -29,13 +29,26 @@
 
 module core {
     interface [
-        JSGenerateToJSObject
+        EventTarget,
+        JSGenerateToJSObject,
+        GenerateIsReachable=ImplBaseRoot
     ] WebKitNamedFlow {
         readonly attribute DOMString name;
         readonly attribute boolean overset;
         readonly attribute long firstEmptyRegionIndex;
         NodeList getRegionsByContent(in Node contentNode);
+        NodeList getRegions();
         NodeList getContent();
+        
+        // EventTarget interface
+        void addEventListener(in DOMString type, 
+                              in EventListener listener, 
+                              in [Optional] boolean useCapture);
+        void removeEventListener(in DOMString type, 
+                                 in EventListener listener, 
+                                 in [Optional] boolean useCapture);
+        boolean dispatchEvent(in Event event)
+            raises(EventException);
     };
 }
 
diff --git a/Source/WebCore/dom/WebKitNamedFlowCollection.cpp b/Source/WebCore/dom/WebKitNamedFlowCollection.cpp
index c50e0572f..9273727ef 100644
--- a/Source/WebCore/dom/WebKitNamedFlowCollection.cpp
+++ b/Source/WebCore/dom/WebKitNamedFlowCollection.cpp
@@ -31,6 +31,7 @@
 #include "WebKitNamedFlowCollection.h"
 
 #include "Document.h"
+#include "InspectorInstrumentation.h"
 #include "WebKitNamedFlow.h"
 
 #include <wtf/text/StringHash.h>
@@ -43,15 +44,15 @@ WebKitNamedFlowCollection::WebKitNamedFlowCollection(Document* doc)
 {
 }
 
-Vector<String> WebKitNamedFlowCollection::namedFlowsNames()
+Vector<RefPtr<WebKitNamedFlow> > WebKitNamedFlowCollection::namedFlows()
 {
-    Vector<String> namedFlows;
+    Vector<RefPtr<WebKitNamedFlow> > namedFlows;
 
     for (NamedFlowSet::iterator it = m_namedFlows.begin(); it != m_namedFlows.end(); ++it) {
         if ((*it)->flowState() == WebKitNamedFlow::FlowStateNull)
             continue;
 
-        namedFlows.append((*it)->name().string());
+        namedFlows.append(RefPtr<WebKitNamedFlow>(*it));
     }
 
     return namedFlows;
@@ -79,6 +80,8 @@ PassRefPtr<WebKitNamedFlow> WebKitNamedFlowCollection::ensureFlowWithName(const
     RefPtr<WebKitNamedFlow> newFlow = WebKitNamedFlow::create(this, flowName);
     m_namedFlows.add(newFlow.get());
 
+    InspectorInstrumentation::didCreateNamedFlow(m_document, newFlow->name());
+
     return newFlow.release();
 }
 
@@ -92,6 +95,8 @@ void WebKitNamedFlowCollection::discardNamedFlow(WebKitNamedFlow* namedFlow)
     ASSERT(m_namedFlows.contains(namedFlow));
 
     m_namedFlows.remove(namedFlow);
+
+    InspectorInstrumentation::didRemoveNamedFlow(m_document, namedFlow->name());
 }
 
 void WebKitNamedFlowCollection::documentDestroyed()
diff --git a/Source/WebCore/dom/WebKitNamedFlowCollection.h b/Source/WebCore/dom/WebKitNamedFlowCollection.h
index 67878a71a..bf01d4b84 100644
--- a/Source/WebCore/dom/WebKitNamedFlowCollection.h
+++ b/Source/WebCore/dom/WebKitNamedFlowCollection.h
@@ -45,7 +45,7 @@ class WebKitNamedFlowCollection : public RefCounted<WebKitNamedFlowCollection> {
 public:
     static PassRefPtr<WebKitNamedFlowCollection> create(Document* doc) { return adoptRef(new WebKitNamedFlowCollection(doc)); }
 
-    Vector<String> namedFlowsNames();
+    Vector<RefPtr<WebKitNamedFlow> > namedFlows();
     WebKitNamedFlow* flowByName(const String&);
     PassRefPtr<WebKitNamedFlow> ensureFlowWithName(const String&);
 
diff --git a/Source/WebCore/editing/DeleteButton.h b/Source/WebCore/editing/DeleteButton.h
index d50d75f6c..e0629894b 100644
--- a/Source/WebCore/editing/DeleteButton.h
+++ b/Source/WebCore/editing/DeleteButton.h
@@ -34,6 +34,8 @@ class DeleteButton : public HTMLImageElement {
 public:
     static PassRefPtr<DeleteButton> create(Document*);
 
+    virtual bool willRespondToMouseClickEvents() OVERRIDE { return true; }
+
 private:
     explicit DeleteButton(Document*);
 
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 9f33299c2..20b6af967 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -985,9 +985,10 @@ void Editor::cut()
     RefPtr<Range> selection = selectedRange();
     if (shouldDeleteRange(selection.get())) {
         updateMarkersForWordsAffectedByEditing(true);
-        if (enclosingTextFormControl(m_frame->selection()->start()))
-            Pasteboard::generalPasteboard()->writePlainText(selectedText());
-        else
+        if (enclosingTextFormControl(m_frame->selection()->start())) {
+            Pasteboard::generalPasteboard()->writePlainText(selectedText(),
+                canSmartCopyOrDelete() ? Pasteboard::CanSmartReplace : Pasteboard::CannotSmartReplace);
+        } else
             Pasteboard::generalPasteboard()->writeSelection(selection.get(), canSmartCopyOrDelete(), m_frame);
         didWriteSelectionToPasteboard();
         deleteSelectionWithSmartDelete(canSmartCopyOrDelete());
@@ -1003,9 +1004,10 @@ void Editor::copy()
         return;
     }
 
-    if (enclosingTextFormControl(m_frame->selection()->start()))
-        Pasteboard::generalPasteboard()->writePlainText(selectedText());
-    else {
+    if (enclosingTextFormControl(m_frame->selection()->start())) {
+        Pasteboard::generalPasteboard()->writePlainText(selectedText(),
+            canSmartCopyOrDelete() ? Pasteboard::CanSmartReplace : Pasteboard::CannotSmartReplace);
+    } else {
         Document* document = m_frame->document();
         if (HTMLImageElement* imageElement = imageElementFromImageDocument(document))
             Pasteboard::generalPasteboard()->writeImage(imageElement, document->url(), document->title());
diff --git a/Source/WebCore/editing/EditorCommand.cpp b/Source/WebCore/editing/EditorCommand.cpp
index a2f147ea2..478ab6c5a 100644
--- a/Source/WebCore/editing/EditorCommand.cpp
+++ b/Source/WebCore/editing/EditorCommand.cpp
@@ -1233,9 +1233,8 @@ static bool enabledInEditableText(Frame* frame, Event* event, EditorCommandSourc
 static bool enabledDelete(Frame* frame, Event* event, EditorCommandSource source)
 {
     switch (source) {
-    case CommandFromMenuOrKeyBinding:
-        // "Delete" from menu only affects selected range, just like Cut but without affecting pasteboard
-        return enabledCut(frame, event, source);
+    case CommandFromMenuOrKeyBinding:    
+        return frame->editor()->canDelete();
     case CommandFromDOM:
     case CommandFromDOMWithUserInterface:
         // "Delete" from DOM is like delete/backspace keypress, affects selected range if non-empty,
diff --git a/Source/WebCore/editing/MarkupAccumulator.cpp b/Source/WebCore/editing/MarkupAccumulator.cpp
index 3734b5e20..3ca48cf8a 100644
--- a/Source/WebCore/editing/MarkupAccumulator.cpp
+++ b/Source/WebCore/editing/MarkupAccumulator.cpp
@@ -36,7 +36,9 @@
 #include "HTMLNames.h"
 #include "KURL.h"
 #include "ProcessingInstruction.h"
+#include "XLinkNames.h"
 #include "XMLNSNames.h"
+#include "XMLNames.h"
 #include <wtf/unicode/CharacterNames.h>
 
 namespace WebCore {
@@ -418,16 +420,35 @@ void MarkupAccumulator::appendCloseTag(StringBuilder& result, Element* element)
     result.append('>');
 }
 
+static inline bool attributeIsInSerializedNamespace(const Attribute& attribute)
+{
+    return attribute.namespaceURI() == XMLNames::xmlNamespaceURI
+        || attribute.namespaceURI() == XLinkNames::xlinkNamespaceURI
+        || attribute.namespaceURI() == XMLNSNames::xmlnsNamespaceURI;
+}
+
 void MarkupAccumulator::appendAttribute(StringBuilder& result, Element* element, const Attribute& attribute, Namespaces* namespaces)
 {
     bool documentIsHTML = element->document()->isHTMLDocument();
 
     result.append(' ');
 
-    if (documentIsHTML)
+    if (documentIsHTML && !attributeIsInSerializedNamespace(attribute))
         result.append(attribute.name().localName());
-    else
-        result.append(attribute.name().toString());
+    else {
+        QualifiedName prefixedName = attribute.name();
+        if (attribute.namespaceURI() == XLinkNames::xlinkNamespaceURI) {
+            if (attribute.prefix() != xlinkAtom)
+                prefixedName.setPrefix(xlinkAtom);
+        } else if (attribute.namespaceURI() == XMLNames::xmlNamespaceURI) {
+            if (attribute.prefix() != xmlAtom)
+                prefixedName.setPrefix(xmlAtom);
+        } else if (attribute.namespaceURI() == XMLNSNames::xmlnsNamespaceURI) {
+            if (attribute.name() != XMLNSNames::xmlnsAttr && attribute.prefix() != xmlnsAtom)
+                prefixedName.setPrefix(xmlnsAtom);
+        }
+        result.append(prefixedName.toString());
+    }
 
     result.append('=');
 
diff --git a/Source/WebCore/editing/qt/SmartReplaceQt.cpp b/Source/WebCore/editing/qt/SmartReplaceQt.cpp
deleted file mode 100644
index 4bbb82c2e..000000000
--- a/Source/WebCore/editing/qt/SmartReplaceQt.cpp
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright (C) 2010 Robert Hogan <robert@roberthogan.net>.  All rights reserved.
- * Copyright (C) 2007,2008,2009 Apple Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#if USE(QT4_UNICODE)
-#include "SmartReplace.h"
-#include <QChar>
-
-namespace WebCore {
-
-bool isCharacterSmartReplaceExempt(UChar32 c, bool isPreviousCharacter)
-{
-    QChar d(c);
-    if (d.isSpace())
-        return true;
-    if (!isPreviousCharacter && d.isPunct())
-        return true;
-
-    if ((c >= 0x1100 && c <= (0x1100 + 256)) // Hangul Jamo (0x1100 - 0x11FF)
-        || (c >= 0x2E80 && c <= (0x2E80 + 352)) // CJK & Kangxi Radicals (0x2E80 - 0x2FDF)
-        || (c >= 0x2FF0 && c <= (0x2FF0 + 464)) // Ideograph Deseriptions, CJK Symbols, Hiragana, Katakana, Bopomofo, Hangul Compatibility Jamo, Kanbun, & Bopomofo Ext (0x2FF0 - 0x31BF)
-        || (c >= 0x3200 && c <= (0x3200 + 29392)) // Enclosed CJK, CJK Ideographs (Uni Han & Ext A), & Yi (0x3200 - 0xA4CF)
-        || (c >= 0xAC00 && c <= (0xAC00 + 11183)) // Hangul Syllables (0xAC00 - 0xD7AF)
-        || (c >= 0xF900 && c <= (0xF900 + 352)) // CJK Compatibility Ideographs (0xF900 - 0xFA5F)
-        || (c >= 0xFE30 && c <= (0xFE30 + 32)) // CJK Compatibility From (0xFE30 - 0xFE4F)
-        || (c >= 0xFF00 && c <= (0xFF00 + 240)) // Half/Full Width Form (0xFF00 - 0xFFEF)
-        || (c >= 0x20000 && c <= (0x20000 + 0xA6D7)) // CJK Ideograph Exntension B
-        || (c >= 0x2F800 && c <= (0x2F800 + 0x021E))) // CJK Compatibility Ideographs (0x2F800 - 0x2FA1D)
-       return true;
-
-    const char prev[] = "([\"\'#$/-`{\0";
-    const char next[] = ")].,;:?\'!\"%*-/}\0";
-    const char* str = (isPreviousCharacter) ? prev : next;
-    for (int i = 0; i < strlen(str); ++i) {
-        if (str[i] == c)
-          return true;
-    }
-
-    return false;
-}
-
-}
-#endif
diff --git a/Source/WebCore/html/ClassList.cpp b/Source/WebCore/html/ClassList.cpp
index 2ea838202..a325a1226 100644
--- a/Source/WebCore/html/ClassList.cpp
+++ b/Source/WebCore/html/ClassList.cpp
@@ -131,14 +131,14 @@ String ClassList::toString() const
 
 void ClassList::reset(const String& newClassName)
 {
-    if (!m_classNamesForQuirksMode.isNull())
+    if (m_element->document()->inQuirksMode())
         m_classNamesForQuirksMode.set(newClassName, false);
 }
 
 const SpaceSplitString& ClassList::classNames() const
 {
     ASSERT(m_element->hasClass());
-    if (!m_classNamesForQuirksMode.isNull())
+    if (m_element->document()->inQuirksMode())
         return m_classNamesForQuirksMode;
     return m_element->attributeData()->classNames();
 }
diff --git a/Source/WebCore/html/ColorInputType.cpp b/Source/WebCore/html/ColorInputType.cpp
index 3e75c6e65..c4eb524e5 100644
--- a/Source/WebCore/html/ColorInputType.cpp
+++ b/Source/WebCore/html/ColorInputType.cpp
@@ -168,7 +168,7 @@ bool ColorInputType::shouldRespectListAttribute()
 
 bool ColorInputType::typeMismatchFor(const String& value) const
 {
-    return isValidColorString(value);
+    return !isValidColorString(value);
 }
 
 void ColorInputType::didChooseColor(const Color& color)
diff --git a/Source/WebCore/html/DOMTokenList.cpp b/Source/WebCore/html/DOMTokenList.cpp
index 5c41f74b5..7132b1169 100644
--- a/Source/WebCore/html/DOMTokenList.cpp
+++ b/Source/WebCore/html/DOMTokenList.cpp
@@ -56,8 +56,9 @@ String DOMTokenList::addToken(const AtomicString& input, const AtomicString& tok
 
     StringBuilder builder;
     builder.append(input);
-    if (input[input.length()-1] != ' ')
+    if (!isHTMLSpace(input[input.length() - 1]))
         builder.append(' ');
+
     builder.append(token);
     return builder.toString();
 }
diff --git a/Source/WebCore/html/DOMURL.cpp b/Source/WebCore/html/DOMURL.cpp
index 4f9780dcd..f6586264f 100644
--- a/Source/WebCore/html/DOMURL.cpp
+++ b/Source/WebCore/html/DOMURL.cpp
@@ -42,6 +42,11 @@
 #include <wtf/PassOwnPtr.h>
 #include <wtf/MainThread.h>
 
+#if ENABLE(MEDIA_SOURCE)
+#include "MediaSource.h"
+#include "MediaSourceRegistry.h"
+#endif
+
 #if ENABLE(MEDIA_STREAM)
 #include "MediaStream.h"
 #include "MediaStreamRegistry.h"
@@ -49,6 +54,26 @@
 
 namespace WebCore {
 
+#if ENABLE(MEDIA_SOURCE)
+String DOMURL::createObjectURL(ScriptExecutionContext* scriptExecutionContext, MediaSource* source)
+{
+    // Since WebWorkers cannot obtain MediaSource objects, we should be on the main thread.
+    ASSERT(isMainThread());
+
+    if (!scriptExecutionContext || !source)
+        return String();
+
+    KURL publicURL = BlobURL::createPublicURL(scriptExecutionContext->securityOrigin());
+    if (publicURL.isEmpty())
+        return String();
+
+    MediaSourceRegistry::registry().registerMediaSourceURL(publicURL, source);
+    scriptExecutionContext->publicURLManager().sourceURLs().add(publicURL.string());
+
+    return publicURL.string();
+}
+#endif
+
 #if ENABLE(MEDIA_STREAM)
 String DOMURL::createObjectURL(ScriptExecutionContext* scriptExecutionContext, MediaStream* stream)
 {
@@ -98,6 +123,13 @@ void DOMURL::revokeObjectURL(ScriptExecutionContext* scriptExecutionContext, con
         blobURLs.remove(url.string());
     }
 
+#if ENABLE(MEDIA_SOURCE)
+    HashSet<String>& sourceURLs = scriptExecutionContext->publicURLManager().sourceURLs();
+    if (sourceURLs.contains(url.string())) {
+        MediaSourceRegistry::registry().unregisterMediaSourceURL(url);
+        sourceURLs.remove(url.string());
+    }
+#endif
 #if ENABLE(MEDIA_STREAM)
     HashSet<String>& streamURLs = scriptExecutionContext->publicURLManager().streamURLs();
     if (streamURLs.contains(url.string())) {
diff --git a/Source/WebCore/html/DOMURL.h b/Source/WebCore/html/DOMURL.h
index 25ae013eb..d71fb93f3 100644
--- a/Source/WebCore/html/DOMURL.h
+++ b/Source/WebCore/html/DOMURL.h
@@ -36,6 +36,7 @@
 namespace WebCore {
 
 class Blob;
+class MediaSource;
 class MediaStream;
 class ScriptExecutionContext;
 
@@ -49,6 +50,9 @@ public:
 
     static String createObjectURL(ScriptExecutionContext*, Blob*);
     static void revokeObjectURL(ScriptExecutionContext*, const String&);
+#if ENABLE(MEDIA_SOURCE)
+    static String createObjectURL(ScriptExecutionContext*, MediaSource*);
+#endif
 #if ENABLE(MEDIA_STREAM)
     static String createObjectURL(ScriptExecutionContext*, MediaStream*);
 #endif
diff --git a/Source/WebCore/html/DOMURL.idl b/Source/WebCore/html/DOMURL.idl
index ed04c23d5..b36e8f7ce 100644
--- a/Source/WebCore/html/DOMURL.idl
+++ b/Source/WebCore/html/DOMURL.idl
@@ -33,6 +33,9 @@ module html {
         JSNoStaticTables,
         InterfaceName=URL
     ] DOMURL {
+#if defined(ENABLE_MEDIA_SOURCE) && ENABLE_MEDIA_SOURCE
+        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(in MediaSource? source);
+#endif
 #if defined(ENABLE_MEDIA_STREAM) && ENABLE_MEDIA_STREAM
         [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(in MediaStream? stream);
 #endif
diff --git a/Source/WebCore/html/FTPDirectoryDocument.cpp b/Source/WebCore/html/FTPDirectoryDocument.cpp
index 18689c97f..8fefc201e 100644
--- a/Source/WebCore/html/FTPDirectoryDocument.cpp
+++ b/Source/WebCore/html/FTPDirectoryDocument.cpp
@@ -36,10 +36,11 @@
 #include "Settings.h"
 #include "SharedBuffer.h"
 #include "Text.h"
-#include <wtf/text/CString.h>
-#include <wtf/text/WTFString.h>
 #include <wtf/CurrentTime.h>
+#include <wtf/GregorianDateTime.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
 #include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
@@ -219,26 +220,23 @@ static String processFileDateString(const FTPTime& fileTime)
     }
 
     // If it was today or yesterday, lets just do that - but we have to compare to the current time
-    struct tm now;
-    getCurrentLocalTime(&now);
-
-    // localtime does "year = current year - 1900", compensate for that for readability and comparison purposes
-    now.tm_year += 1900;
+    GregorianDateTime now;
+    now.setToCurrentLocalTime();
 
-    if (fileTime.tm_year == now.tm_year) {
-        if (fileTime.tm_mon == now.tm_mon) {
-            if (fileTime.tm_mday == now.tm_mday)
+    if (fileTime.tm_year == now.year()) {
+        if (fileTime.tm_mon == now.month()) {
+            if (fileTime.tm_mday == now.monthDay())
                 return "Today" + timeOfDay;
-            if (fileTime.tm_mday == now.tm_mday - 1)
+            if (fileTime.tm_mday == now.monthDay() - 1)
                 return "Yesterday" + timeOfDay;
         }
         
-        if (now.tm_mday == 1 && (now.tm_mon == fileTime.tm_mon + 1 || (now.tm_mon == 0 && fileTime.tm_mon == 11)) &&
+        if (now.monthDay() == 1 && (now.month() == fileTime.tm_mon + 1 || (now.month() == 0 && fileTime.tm_mon == 11)) &&
             wasLastDayOfMonth(fileTime.tm_year, fileTime.tm_mon, fileTime.tm_mday))
                 return "Yesterday" + timeOfDay;
     }
 
-    if (fileTime.tm_year == now.tm_year - 1 && fileTime.tm_mon == 12 && fileTime.tm_mday == 31 && now.tm_mon == 1 && now.tm_mday == 1)
+    if (fileTime.tm_year == now.year() - 1 && fileTime.tm_mon == 12 && fileTime.tm_mday == 31 && now.month() == 1 && now.monthDay() == 1)
         return "Yesterday" + timeOfDay;
 
     static const char* months[] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec", "???" };
@@ -252,7 +250,7 @@ static String processFileDateString(const FTPTime& fileTime)
     if (fileTime.tm_year > -1)
         dateString = String(months[month]) + " " + String::number(fileTime.tm_mday) + ", " + String::number(fileTime.tm_year);
     else
-        dateString = String(months[month]) + " " + String::number(fileTime.tm_mday) + ", " + String::number(now.tm_year);
+        dateString = String(months[month]) + " " + String::number(fileTime.tm_mday) + ", " + String::number(now.year());
 
     return dateString + timeOfDay;
 }
@@ -368,7 +366,7 @@ void FTPDirectoryDocumentParser::append(const SegmentedString& source)
     m_dest = m_buffer;
     SegmentedString str = source;
     while (!str.isEmpty()) {
-        UChar c = *str;
+        UChar c = str.currentChar();
 
         if (c == '\r') {
             *m_dest++ = '\n';
diff --git a/Source/WebCore/html/HTMLAnchorElement.cpp b/Source/WebCore/html/HTMLAnchorElement.cpp
index d31188f12..9f50c7feb 100644
--- a/Source/WebCore/html/HTMLAnchorElement.cpp
+++ b/Source/WebCore/html/HTMLAnchorElement.cpp
@@ -569,24 +569,14 @@ bool isEnterKeyKeydownEvent(Event* event)
     return event->type() == eventNames().keydownEvent && event->isKeyboardEvent() && static_cast<KeyboardEvent*>(event)->keyIdentifier() == "Enter";
 }
 
-bool isMiddleMouseButtonEvent(Event* event)
-{
-    return event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == MiddleButton;
-}
-
 bool isLinkClick(Event* event)
 {
     return event->type() == eventNames().clickEvent && (!event->isMouseEvent() || static_cast<MouseEvent*>(event)->button() != RightButton);
 }
 
-void handleLinkClick(Event* event, Document* document, const String& url, const String& target, bool hideReferrer)
+bool HTMLAnchorElement::willRespondToMouseClickEvents()
 {
-    event->setDefaultHandled();
-
-    Frame* frame = document->frame();
-    if (!frame)
-        return;
-    frame->loader()->urlSelected(document->completeURL(url), target, event, false, false, hideReferrer ? NeverSendReferrer : MaybeSendReferrer);
+    return isLink() || HTMLElement::willRespondToMouseClickEvents();
 }
 
 #if ENABLE(MICRODATA)
diff --git a/Source/WebCore/html/HTMLAnchorElement.h b/Source/WebCore/html/HTMLAnchorElement.h
index 9a875c25b..6afe5a5c5 100644
--- a/Source/WebCore/html/HTMLAnchorElement.h
+++ b/Source/WebCore/html/HTMLAnchorElement.h
@@ -94,6 +94,8 @@ public:
 
     bool isLiveLink() const;
 
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
+
     bool hasRel(uint32_t relation) const;
     void setRel(const String&);
     
@@ -155,9 +157,7 @@ inline LinkHash HTMLAnchorElement::visitedLinkHash() const
 // Functions shared with the other anchor elements (i.e., SVG).
 
 bool isEnterKeyKeydownEvent(Event*);
-bool isMiddleMouseButtonEvent(Event*);
 bool isLinkClick(Event*);
-void handleLinkClick(Event*, Document*, const String& url, const String& target, bool hideReferrer = false);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/html/HTMLAppletElement.cpp b/Source/WebCore/html/HTMLAppletElement.cpp
index 5bd5fd5aa..afc7268dd 100644
--- a/Source/WebCore/html/HTMLAppletElement.cpp
+++ b/Source/WebCore/html/HTMLAppletElement.cpp
@@ -81,7 +81,7 @@ RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style
     return new (document()->renderArena()) RenderApplet(this);
 }
 
-RenderWidget* HTMLAppletElement::renderWidgetForJSBindings()
+RenderWidget* HTMLAppletElement::renderWidgetForJSBindings() const
 {
     if (!canEmbedJava())
         return 0;
diff --git a/Source/WebCore/html/HTMLAppletElement.h b/Source/WebCore/html/HTMLAppletElement.h
index ee4e30cf0..4c7275c72 100644
--- a/Source/WebCore/html/HTMLAppletElement.h
+++ b/Source/WebCore/html/HTMLAppletElement.h
@@ -39,7 +39,7 @@ private:
     virtual bool rendererIsNeeded(const NodeRenderingContext&) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
 
-    virtual RenderWidget* renderWidgetForJSBindings();
+    virtual RenderWidget* renderWidgetForJSBindings() const;
     virtual void updateWidget(PluginCreationOption) OVERRIDE;
 
     bool canEmbedJava() const;
diff --git a/Source/WebCore/html/HTMLButtonElement.cpp b/Source/WebCore/html/HTMLButtonElement.cpp
index d82a1a737..ecb4a21ba 100644
--- a/Source/WebCore/html/HTMLButtonElement.cpp
+++ b/Source/WebCore/html/HTMLButtonElement.cpp
@@ -153,6 +153,13 @@ void HTMLButtonElement::defaultEventHandler(Event* event)
     HTMLFormControlElement::defaultEventHandler(event);
 }
 
+bool HTMLButtonElement::willRespondToMouseClickEvents()
+{
+    if (!disabled() && form() && (m_type == SUBMIT || m_type == RESET))
+        return true;
+    return HTMLFormControlElement::willRespondToMouseClickEvents();
+}
+
 bool HTMLButtonElement::isSuccessfulSubmitButton() const
 {
     // HTML spec says that buttons must have names to be considered successful.
diff --git a/Source/WebCore/html/HTMLButtonElement.h b/Source/WebCore/html/HTMLButtonElement.h
index 7bf99b7b8..92ca0a3f6 100644
--- a/Source/WebCore/html/HTMLButtonElement.h
+++ b/Source/WebCore/html/HTMLButtonElement.h
@@ -36,6 +36,8 @@ public:
     
     String value() const;
 
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
+
 private:
     HTMLButtonElement(const QualifiedName& tagName, Document*, HTMLFormElement*);
 
@@ -48,6 +50,7 @@ private:
     virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void defaultEventHandler(Event*);
+
     virtual bool appendFormData(FormDataList&, bool);
 
     virtual bool isEnumeratable() const { return true; } 
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index d873d9b7f..b707ef234 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -1010,16 +1010,24 @@ void HTMLElement::getItemRefElements(Vector<HTMLElement*>& itemRefElements)
     if (!fastHasAttribute(itemscopeAttr))
         return;
 
-    if (!fastHasAttribute(itemrefAttr)) {
+    if (!fastHasAttribute(itemrefAttr) || !itemRef()->length()) {
         itemRefElements.append(this);
         return;
     }
 
     DOMSettableTokenList* itemRefs = itemRef();
     RefPtr<DOMSettableTokenList> processedItemRef = DOMSettableTokenList::create();
-    Node* rootNode = treeScope()->rootNode();
 
-    for (Node* current = rootNode->firstChild(); current; current = current->traverseNextNode(rootNode)) {
+    Node* rootNode;
+    if (inDocument())
+        rootNode = document();
+    else {
+        rootNode = this;
+        while (Node* parent = rootNode->parentNode())
+            rootNode = parent;
+    }
+
+    for (Node* current = rootNode; current; current = current->traverseNextNode(rootNode)) {
         if (!current->isHTMLElement())
             continue;
         HTMLElement* element = toHTMLElement(current);
diff --git a/Source/WebCore/html/HTMLElement.idl b/Source/WebCore/html/HTMLElement.idl
index 4f5f236f6..9501d3a6a 100644
--- a/Source/WebCore/html/HTMLElement.idl
+++ b/Source/WebCore/html/HTMLElement.idl
@@ -32,8 +32,6 @@ module html {
                  attribute [Reflect] DOMString lang;
                  attribute boolean             translate;
                  attribute [Reflect] DOMString dir;
-                 attribute [Reflect=class] DOMString className;
-                 readonly attribute DOMTokenList classList;
 
                  attribute long              tabIndex;
                  attribute boolean           draggable;
diff --git a/Source/WebCore/html/HTMLEmbedElement.cpp b/Source/WebCore/html/HTMLEmbedElement.cpp
index 15e32eef7..3bc2d933d 100644
--- a/Source/WebCore/html/HTMLEmbedElement.cpp
+++ b/Source/WebCore/html/HTMLEmbedElement.cpp
@@ -68,7 +68,7 @@ static inline RenderWidget* findWidgetRenderer(const Node* n)
     return 0;
 }
 
-RenderWidget* HTMLEmbedElement::renderWidgetForJSBindings()
+RenderWidget* HTMLEmbedElement::renderWidgetForJSBindings() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
     return findWidgetRenderer(this);
diff --git a/Source/WebCore/html/HTMLEmbedElement.h b/Source/WebCore/html/HTMLEmbedElement.h
index ba828a172..bda2e9149 100644
--- a/Source/WebCore/html/HTMLEmbedElement.h
+++ b/Source/WebCore/html/HTMLEmbedElement.h
@@ -43,7 +43,7 @@ private:
     virtual bool isURLAttribute(const Attribute&) const OVERRIDE;
     virtual const QualifiedName& imageSourceAttributeName() const;
 
-    virtual RenderWidget* renderWidgetForJSBindings();
+    virtual RenderWidget* renderWidgetForJSBindings() const;
 
     virtual void updateWidget(PluginCreationOption);
 
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index d52d0ba85..2d47ac8c4 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -482,6 +482,16 @@ void HTMLFormControlElement::setCustomValidity(const String& error)
     setNeedsValidityCheck();
 }
 
+bool HTMLFormControlElement::shouldMatchReadOnlySelector() const
+{
+    return readOnly();
+}
+
+bool HTMLFormControlElement::shouldMatchReadWriteSelector() const
+{
+    return !readOnly();
+}
+
 bool HTMLFormControlElement::validationMessageShadowTreeContains(Node* node) const
 {
     return m_validationMessage && m_validationMessage->shadowTreeContains(node);
diff --git a/Source/WebCore/html/HTMLFormControlElement.h b/Source/WebCore/html/HTMLFormControlElement.h
index b132cbe0b..d129bc2c2 100644
--- a/Source/WebCore/html/HTMLFormControlElement.h
+++ b/Source/WebCore/html/HTMLFormControlElement.h
@@ -81,7 +81,8 @@ public:
 
     virtual const AtomicString& formControlType() const OVERRIDE = 0;
     virtual bool isEnabledFormControl() const { return !disabled(); }
-    virtual bool isReadOnlyFormControl() const { return readOnly(); }
+    virtual bool shouldMatchReadOnlySelector() const OVERRIDE;
+    virtual bool shouldMatchReadWriteSelector() const OVERRIDE;
 
     virtual bool canTriggerImplicitSubmission() const { return false; }
 
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 59c6205a8..e07067c66 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -313,6 +313,13 @@ StepRange HTMLInputElement::createStepRange(AnyStepHandling anyStepHandling) con
     return m_inputType->createStepRange(anyStepHandling);
 }
 
+#if ENABLE(DATALIST_ELEMENT)
+Decimal HTMLInputElement::findClosestTickMarkValue(const Decimal& value)
+{
+    return m_inputType->findClosestTickMarkValue(value);
+}
+#endif
+
 void HTMLInputElement::stepUp(int n, ExceptionCode& ec)
 {
     m_inputType->stepUp(n, ec);
@@ -619,6 +626,12 @@ void HTMLInputElement::parseAttribute(const Attribute& attribute)
     } else if (attribute.name() == typeAttr) {
         updateType();
     } else if (attribute.name() == valueAttr) {
+        // Changes to the value attribute may change whether or not this element has a default value.
+        // If this field is autocomplete=off that might affect the return value of needsSuspensionCallback.
+        if (m_autocomplete == Off) {
+            unregisterForSuspensionCallbackIfNeeded();
+            registerForSuspensionCallbackIfNeeded();
+        }
         // We only need to setChanged if the form is looking at the default value right now.
         if (!hasDirtyValue()) {
             updatePlaceholderVisibility(false);
@@ -1160,6 +1173,15 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         HTMLTextFormControlElement::defaultEventHandler(evt);
 }
 
+bool HTMLInputElement::willRespondToMouseClickEvents()
+{
+    // FIXME: Consider implementing willRespondToMouseClickEvents() in InputType if more accurate results are necessary.
+    if (!disabled())
+        return true;
+
+    return HTMLTextFormControlElement::willRespondToMouseClickEvents();
+}
+
 bool HTMLInputElement::isURLAttribute(const Attribute& attribute) const
 {
     return attribute.name() == srcAttr || attribute.name() == formactionAttr || HTMLTextFormControlElement::isURLAttribute(attribute);
@@ -1363,7 +1385,17 @@ bool HTMLInputElement::isOutOfRange() const
 
 bool HTMLInputElement::needsSuspensionCallback()
 {
-    return m_autocomplete == Off || m_inputType->shouldResetOnDocumentActivation();
+    if (m_inputType->shouldResetOnDocumentActivation())
+        return true;
+
+    // Sensitive input elements are marked with autocomplete=off, and we want to wipe them out
+    // when going back; returning true here arranges for us to call reset at the time
+    // the page is restored. Non-empty textual default values indicate that the field
+    // is not really sensitive -- there's no default value for an account number --
+    // and we would see unexpected results if we reset to something other than blank.
+    bool isSensitive = m_autocomplete == Off && !(m_inputType->isTextType() && !defaultValue().isEmpty());
+
+    return isSensitive;
 }
 
 void HTMLInputElement::registerForSuspensionCallbackIfNeeded()
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index fa4aa9153..dc32159f2 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -72,6 +72,10 @@ public:
     bool getAllowedValueStep(Decimal*) const;
     StepRange createStepRange(AnyStepHandling) const;
 
+#if ENABLE(DATALIST_ELEMENT)
+    Decimal findClosestTickMarkValue(const Decimal&);
+#endif
+
     // Implementations of HTMLInputElement::stepUp() and stepDown().
     void stepUp(int, ExceptionCode&);
     void stepDown(int, ExceptionCode&);
@@ -232,6 +236,8 @@ public:
     void addSearchResult();
     void onSearch();
 
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
+
 #if ENABLE(DATALIST_ELEMENT)
     HTMLElement* list() const;
     HTMLDataListElement* dataList() const;
@@ -400,5 +406,11 @@ private:
 #endif
 };
 
+inline bool isHTMLInputElement(Node* node)
+{
+    ASSERT(node);
+    return node->hasTagName(HTMLNames::inputTag);
+}
+
 } //namespace
 #endif
diff --git a/Source/WebCore/html/HTMLLabelElement.cpp b/Source/WebCore/html/HTMLLabelElement.cpp
index c1021b358..242fb0cbd 100644
--- a/Source/WebCore/html/HTMLLabelElement.cpp
+++ b/Source/WebCore/html/HTMLLabelElement.cpp
@@ -147,6 +147,14 @@ void HTMLLabelElement::defaultEventHandler(Event* evt)
     HTMLElement::defaultEventHandler(evt);
 }
 
+bool HTMLLabelElement::willRespondToMouseClickEvents()
+{
+    if (control() && control()->willRespondToMouseClickEvents())
+        return true;
+
+    return HTMLElement::willRespondToMouseClickEvents();
+}
+
 void HTMLLabelElement::focus(bool)
 {
     // to match other browsers, always restore previous selection
diff --git a/Source/WebCore/html/HTMLLabelElement.h b/Source/WebCore/html/HTMLLabelElement.h
index a821b2507..f48c6805e 100644
--- a/Source/WebCore/html/HTMLLabelElement.h
+++ b/Source/WebCore/html/HTMLLabelElement.h
@@ -36,6 +36,8 @@ public:
     LabelableElement* control();
     HTMLFormElement* form() const;
 
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
+
 private:
     HTMLLabelElement(const QualifiedName&, Document*);
 
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index cc025c12b..fadcfe7c6 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -111,6 +111,11 @@
 #include "DisplaySleepDisabler.h"
 #endif
 
+#if ENABLE(MEDIA_SOURCE)
+#include "MediaSource.h"
+#include "MediaSourceRegistry.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -145,7 +150,7 @@ static const char* boolString(bool val)
 
 #if ENABLE(MEDIA_SOURCE)
 // URL protocol used to signal that the media source API is being used.
-static const char* mediaSourceURLProtocol = "x-media-source";
+static const char* mediaSourceBlobProtocol = "blob";
 #endif
 
 using namespace HTMLNames;
@@ -219,9 +224,6 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* docum
     , m_preload(MediaPlayer::Auto)
     , m_displayMode(Unknown)
     , m_processingMediaPlayerCallback(0)
-#if ENABLE(MEDIA_SOURCE)      
-    , m_sourceState(SOURCE_CLOSED)
-#endif
     , m_cachedTime(MediaPlayer::invalidTime())
     , m_cachedTimeWallClockUpdateTime(0)
     , m_minimumWallClockTimeToCacheMediaTime(0)
@@ -272,7 +274,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* docum
     }
 
 #if ENABLE(MEDIA_SOURCE)
-    m_mediaSourceURL.setProtocol(mediaSourceURLProtocol);
+    m_mediaSourceURL.setProtocol(mediaSourceBlobProtocol);
     m_mediaSourceURL.setPath(createCanonicalUUIDString());
 #endif
 
@@ -421,14 +423,6 @@ void HTMLMediaElement::parseAttribute(const Attribute& attribute)
         setAttributeEventListener(eventNames().webkitbeginfullscreenEvent, createAttributeEventListener(this, attribute));
     else if (attribute.name() == onwebkitendfullscreenAttr)
         setAttributeEventListener(eventNames().webkitendfullscreenEvent, createAttributeEventListener(this, attribute));
-#if ENABLE(MEDIA_SOURCE)
-    else if (attribute.name() == onwebkitsourcecloseAttr)
-        setAttributeEventListener(eventNames().webkitsourcecloseEvent, createAttributeEventListener(this, attribute));
-    else if (attribute.name() == onwebkitsourceendedAttr)
-        setAttributeEventListener(eventNames().webkitsourceendedEvent, createAttributeEventListener(this, attribute));
-    else if (attribute.name() == onwebkitsourceopenAttr)
-        setAttributeEventListener(eventNames().webkitsourceopenEvent, createAttributeEventListener(this, attribute));
-#endif
     else
         HTMLElement::parseAttribute(attribute);
 }
@@ -693,6 +687,10 @@ void HTMLMediaElement::prepareForLoad()
     if (m_networkState == NETWORK_LOADING || m_networkState == NETWORK_IDLE)
         scheduleEvent(eventNames().abortEvent);
 
+#if ENABLE(MEDIA_SOURCE)
+    setSourceState(MediaSource::closedKeyword());
+#endif
+
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     createMediaPlayer();
 #else
@@ -702,11 +700,6 @@ void HTMLMediaElement::prepareForLoad()
         createMediaPlayerProxy();
 #endif
 
-#if ENABLE(MEDIA_SOURCE)
-    if (m_sourceState != SOURCE_CLOSED)
-        setSourceState(SOURCE_CLOSED);
-#endif
-
     // 4 - If the media element's networkState is not set to NETWORK_EMPTY, then run these substeps
     if (m_networkState != NETWORK_EMPTY) {
         m_networkState = NETWORK_EMPTY;
@@ -927,10 +920,16 @@ void HTMLMediaElement::loadResource(const KURL& initialURL, ContentType& content
     }
     
 #if ENABLE(MEDIA_SOURCE)
-    // If this is a media source URL, make sure it is the one for this media element.
-    if (url.protocolIs(mediaSourceURLProtocol) && url != m_mediaSourceURL) {
-        mediaLoadingFailed(MediaPlayer::FormatError);
-        return;
+    if (url.protocolIs(mediaSourceBlobProtocol)) {
+        if (m_mediaSource)
+            m_mediaSource->setReadyState(MediaSource::closedKeyword());
+
+        m_mediaSource = MediaSourceRegistry::registry().lookupMediaSource(url.string());
+
+        if (m_mediaSource) {
+            m_mediaSource->setMediaPlayer(m_player.get());
+            m_mediaSourceURL = url;
+        }
     }
 #endif
 
@@ -1432,8 +1431,7 @@ void HTMLMediaElement::noneSupported()
     scheduleEvent(eventNames().errorEvent);
 
 #if ENABLE(MEDIA_SOURCE)
-    if (m_sourceState != SOURCE_CLOSED)
-        setSourceState(SOURCE_CLOSED);
+    setSourceState(MediaSource::closedKeyword());
 #endif
 
     // 8 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
@@ -1464,8 +1462,7 @@ void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
     scheduleEvent(eventNames().errorEvent);
 
 #if ENABLE(MEDIA_SOURCE)
-    if (m_sourceState != SOURCE_CLOSED)
-        setSourceState(SOURCE_CLOSED);
+    setSourceState(MediaSource::closedKeyword());
 #endif
 
     // 4 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
@@ -1581,7 +1578,6 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
     if (state == MediaPlayer::Idle) {
         if (m_networkState > NETWORK_IDLE) {
             changeNetworkStateFromLoadingToIdle();
-            scheduleEvent(eventNames().suspendEvent);
             setShouldDelayLoadEvent(false);
         } else {
             m_networkState = NETWORK_IDLE;
@@ -1613,6 +1609,7 @@ void HTMLMediaElement::changeNetworkStateFromLoadingToIdle()
     // Schedule one last progress event so we guarantee that at least one is fired
     // for files that load very quickly.
     scheduleEvent(eventNames().progressEvent);
+    scheduleEvent(eventNames().suspendEvent);
     m_networkState = NETWORK_IDLE;
 }
 
@@ -1750,7 +1747,7 @@ void HTMLMediaElement::mediaPlayerSourceOpened()
 {
     beginProcessingMediaPlayerCallback();
 
-    setSourceState(SOURCE_OPEN);
+    setSourceState(MediaSource::openKeyword());
 
     endProcessingMediaPlayerCallback();
 }
@@ -1759,22 +1756,6 @@ String HTMLMediaElement::mediaPlayerSourceURL() const
 {
     return m_mediaSourceURL.string();
 }
-
-bool HTMLMediaElement::isValidSourceId(const String& id, ExceptionCode& ec) const
-{
-    if (id.isNull() || id.isEmpty()) {
-        ec = INVALID_ACCESS_ERR;
-        return false;
-    }
-
-    if (!m_sourceIDs.contains(id)) {
-        ec = SYNTAX_ERR;
-        return false;
-    }
-
-    return true;
-}
-
 #endif
 
 #if ENABLE(ENCRYPTED_MEDIA)
@@ -1998,8 +1979,8 @@ void HTMLMediaElement::seek(float time, ExceptionCode& ec)
 #if ENABLE(MEDIA_SOURCE)
     // Always notify the media engine of a seek if the source is not closed. This ensures that the source is
     // always in a flushed state when the 'seeking' event fires.
-    if (m_sourceState != SOURCE_CLOSED)
-      noSeekRequired = false;
+    if (m_mediaSource && m_mediaSource->readyState() != MediaSource::closedKeyword())
+        noSeekRequired = false;
 #endif
 
     if (noSeekRequired) {
@@ -2021,8 +2002,8 @@ void HTMLMediaElement::seek(float time, ExceptionCode& ec)
     m_sentEndEvent = false;
 
 #if ENABLE(MEDIA_SOURCE)
-    if (m_sourceState == SOURCE_ENDED)
-        setSourceState(SOURCE_OPEN);
+    if (m_mediaSource && m_mediaSource->readyState() == MediaSource::endedKeyword())
+        setSourceState(MediaSource::openKeyword());
 #endif
 
     // 8 - Set the current playback position to the given new playback position
@@ -2370,175 +2351,12 @@ void HTMLMediaElement::pauseInternal()
 }
 
 #if ENABLE(MEDIA_SOURCE)
-
-void HTMLMediaElement::webkitSourceAddId(const String& id, const String& type, ExceptionCode& ec)
-{
-    if (id.isNull() || id.isEmpty()) {
-        ec = INVALID_ACCESS_ERR;
-        return;
-    }
-
-    if (m_sourceIDs.contains(id)) {
-        ec = INVALID_STATE_ERR;
-        return;
-    }
-
-    if (type.isNull() || type.isEmpty()) {
-        ec = INVALID_ACCESS_ERR;
-        return;
-    }
-
-    if (!m_player || m_currentSrc != m_mediaSourceURL || m_sourceState != SOURCE_OPEN) {
-        ec = INVALID_STATE_ERR;
-        return;
-    }
-
-    ContentType contentType(type);
-    Vector<String> codecs = contentType.codecs();
-
-    if (!codecs.size()) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
-    }
-
-    switch (m_player->sourceAddId(id, contentType.type(), codecs)) {
-    case MediaPlayer::Ok:
-        m_sourceIDs.add(id);
-        return;
-    case MediaPlayer::NotSupported:
-        ec = NOT_SUPPORTED_ERR;
-        return;
-    case MediaPlayer::ReachedIdLimit:
-        ec = QUOTA_EXCEEDED_ERR;
-        return;
-    }
-
-    ASSERT_NOT_REACHED();
-}
-
-void HTMLMediaElement::webkitSourceRemoveId(const String& id, ExceptionCode& ec)
-{
-    if (!isValidSourceId(id, ec))
-        return;
-
-    if (!m_player || m_currentSrc != m_mediaSourceURL || m_sourceState == SOURCE_CLOSED) {
-        ec = INVALID_STATE_ERR;
-        return;
-    }
-
-    if (!m_player->sourceRemoveId(id))
-        ASSERT_NOT_REACHED();
-
-    m_sourceIDs.remove(id);
-}
-
-PassRefPtr<TimeRanges> HTMLMediaElement::webkitSourceBuffered(const String& id, ExceptionCode& ec)
-{
-    if (!isValidSourceId(id, ec))
-        return 0;
-
-    if (!m_player || m_currentSrc != m_mediaSourceURL || m_sourceState == SOURCE_CLOSED) {
-        ec = INVALID_STATE_ERR;
-        return 0;
-    }
-
-    return m_player->sourceBuffered(id);
-}
-
-void HTMLMediaElement::webkitSourceAppend(const String& id, PassRefPtr<Uint8Array> data, ExceptionCode& ec)
-{
-    if (!isValidSourceId(id, ec))
-        return;
-
-    if (!m_player || m_currentSrc != m_mediaSourceURL || m_sourceState != SOURCE_OPEN) {
-        ec = INVALID_STATE_ERR;
-        return;
-    }
-
-    if (!data.get()) {
-        ec = INVALID_ACCESS_ERR;
-        return;
-    }
-
-    if (!data->length())
-        return;
-
-    if (!m_player->sourceAppend(id, data->data(), data->length())) {
-        ec = SYNTAX_ERR;
-        return;
-    }
-}
-
-void HTMLMediaElement::webkitSourceAbort(const String& id, ExceptionCode& ec)
-{
-    if (!isValidSourceId(id, ec))
-        return;
-
-    if (!m_player || m_currentSrc != m_mediaSourceURL || m_sourceState != SOURCE_OPEN) {
-        ec = INVALID_STATE_ERR;
-        return;
-    }
-
-    if (!m_player->sourceAbort(id))
-        ASSERT_NOT_REACHED();
-}
-
-void HTMLMediaElement::webkitSourceEndOfStream(unsigned short status, ExceptionCode& ec)
-{
-    if (!m_player || m_currentSrc != m_mediaSourceURL || m_sourceState != SOURCE_OPEN) {
-        ec = INVALID_STATE_ERR;
-        return;
-    }
-
-    MediaPlayer::EndOfStreamStatus eosStatus = MediaPlayer::EosNoError;
-
-    switch (status) {
-    case EOS_NO_ERROR:
-        eosStatus = MediaPlayer::EosNoError;
-        break;
-    case EOS_NETWORK_ERR:
-        eosStatus = MediaPlayer::EosNetworkError;
-        break;
-    case EOS_DECODE_ERR:
-        eosStatus = MediaPlayer::EosDecodeError;
-        break;
-    default:
-        ec = SYNTAX_ERR;
-        return;
-    }
-
-    setSourceState(SOURCE_ENDED);
-    m_player->sourceEndOfStream(eosStatus);
-}
-
-HTMLMediaElement::SourceState HTMLMediaElement::webkitSourceState() const
+void HTMLMediaElement::setSourceState(const String& state)
 {
-    return m_sourceState;
-}
+    if (!m_mediaSource)
+         return;
 
-void HTMLMediaElement::setSourceState(SourceState state)
-{
-    SourceState oldState = m_sourceState;
-    m_sourceState = static_cast<SourceState>(state);
-
-    if (m_sourceState == oldState)
-        return;
-
-    if (m_sourceState == SOURCE_CLOSED) {
-        m_sourceIDs.clear();
-        scheduleEvent(eventNames().webkitsourcecloseEvent);
-        return;
-    }
-
-    if (oldState == SOURCE_OPEN && m_sourceState == SOURCE_ENDED) {
-        scheduleEvent(eventNames().webkitsourceendedEvent);
-        return;
-    }
-
-    if (m_sourceState == SOURCE_OPEN) {
-        scheduleEvent(eventNames().webkitsourceopenEvent);
-        return;
-    }
+    m_mediaSource->setReadyState(state);
 }
 #endif
 
@@ -3351,7 +3169,7 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
     invalidateCachedTime();
 
     // 4.8.10.9 step 14 & 15.  Needed if no ReadyState change is associated with the seek.
-    if (m_seeking && m_readyState >= HAVE_CURRENT_DATA)
+    if (m_seeking && m_readyState >= HAVE_CURRENT_DATA && !m_player->seeking())
         finishSeek();
     
     // Always call scheduleTimeupdateEvent when the media engine reports a time discontinuity, 
@@ -3793,8 +3611,7 @@ void HTMLMediaElement::userCancelledLoad()
     scheduleEvent(eventNames().abortEvent);
 
 #if ENABLE(MEDIA_SOURCE)
-    if (m_sourceState != SOURCE_CLOSED)
-        setSourceState(SOURCE_CLOSED);
+    setSourceState(MediaSource::closedKeyword());
 #endif
 
     // 4 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the 
@@ -3910,6 +3727,15 @@ void HTMLMediaElement::defaultEventHandler(Event* event)
 #endif
 }
 
+bool HTMLMediaElement::willRespondToMouseClickEvents()
+{
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    return true;
+#else
+    return HTMLElement::willRespondToMouseClickEvents();
+#endif
+}
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
 
 void HTMLMediaElement::ensureMediaPlayer()
@@ -4298,6 +4124,11 @@ void HTMLMediaElement::createMediaPlayer()
         
     m_player = MediaPlayer::create(this);
 
+#if ENABLE(MEDIA_SOURCE)
+    if (m_mediaSource)
+        m_mediaSource->setMediaPlayer(m_player.get());
+#endif
+
 #if ENABLE(WEB_AUDIO)
     if (m_audioSourceNode) {
         // When creating the player, make sure its AudioSourceProvider knows about the MediaElementAudioSourceNode.
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index 335bfbd36..bdc614989 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -175,20 +175,7 @@ public:
 #if ENABLE(MEDIA_SOURCE)
 //  Media Source.
     const KURL& webkitMediaSourceURL() const { return m_mediaSourceURL; }
-    void webkitSourceAddId(const String&, const String&, ExceptionCode&);
-    void webkitSourceRemoveId(const String&, ExceptionCode&);
-    PassRefPtr<TimeRanges> webkitSourceBuffered(const String&, ExceptionCode&);
-    void webkitSourceAppend(const String&, PassRefPtr<Uint8Array> data, ExceptionCode&);
-    void webkitSourceAbort(const String&, ExceptionCode&);
-    enum EndOfStreamStatus { EOS_NO_ERROR, EOS_NETWORK_ERR, EOS_DECODE_ERR };
-    void webkitSourceEndOfStream(unsigned short, ExceptionCode&);
-    enum SourceState { SOURCE_CLOSED, SOURCE_OPEN, SOURCE_ENDED };
-    SourceState webkitSourceState() const;
-    void setSourceState(SourceState);
-
-    DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitsourceopen);
-    DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitsourceended);
-    DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitsourceclose);
+    void setSourceState(const String&);
 #endif 
 
 #if ENABLE(ENCRYPTED_MEDIA)
@@ -328,6 +315,8 @@ public:
 
     virtual bool dispatchEvent(PassRefPtr<Event>);
 
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
+
 protected:
     HTMLMediaElement(const QualifiedName&, Document*, bool);
     virtual ~HTMLMediaElement();
@@ -418,7 +407,6 @@ private:
 #if ENABLE(MEDIA_SOURCE)
     virtual void mediaPlayerSourceOpened();
     virtual String mediaPlayerSourceURL() const;
-    bool isValidSourceId(const String&, ExceptionCode&) const;
 #endif
 
 #if ENABLE(ENCRYPTED_MEDIA)
@@ -596,8 +584,7 @@ private:
 
 #if ENABLE(MEDIA_SOURCE)
     KURL m_mediaSourceURL;
-    SourceState m_sourceState;
-    HashSet<String> m_sourceIDs;
+    RefPtr<MediaSource> m_mediaSource;
 #endif
 
     mutable float m_cachedTime;
diff --git a/Source/WebCore/html/HTMLMediaElement.idl b/Source/WebCore/html/HTMLMediaElement.idl
index ac0fa467b..9d0ae8a77 100644
--- a/Source/WebCore/html/HTMLMediaElement.idl
+++ b/Source/WebCore/html/HTMLMediaElement.idl
@@ -98,35 +98,6 @@ module html {
 #if defined(ENABLE_MEDIA_SOURCE) && ENABLE_MEDIA_SOURCE
     // URL passed to src attribute to enable the media source logic.
     readonly attribute [V8EnabledAtRuntime=mediaSource, URL] DOMString webkitMediaSourceURL;
-
-    // Manages IDs for appending media to the source.
-    [V8EnabledAtRuntime=mediaSource] void webkitSourceAddId(in DOMString id, in DOMString type) raises (DOMException);
-    [V8EnabledAtRuntime=mediaSource] void webkitSourceRemoveId(in DOMString id) raises (DOMException);
-
-    // Returns the time ranges buffered for a specific source ID.
-    [V8EnabledAtRuntime=mediaSource] TimeRanges webkitSourceBuffered(in DOMString id) raises (DOMException);
-    
-    // Appends segment data.
-    [V8EnabledAtRuntime=mediaSource] void webkitSourceAppend(in DOMString id, in Uint8Array data) raises (DOMException);
-
-    // Aborts the current segment.
-    [V8EnabledAtRuntime=mediaSource] void webkitSourceAbort(in DOMString id) raises (DOMException);
-
-    // Signals the end of stream.
-    [V8EnabledAtRuntime=mediaSource] const unsigned short EOS_NO_ERROR = 0; // End of stream reached w/o error.
-    [V8EnabledAtRuntime=mediaSource] const unsigned short EOS_NETWORK_ERR = 1; // A network error triggered end of stream.
-    [V8EnabledAtRuntime=mediaSource] const unsigned short EOS_DECODE_ERR = 2; // A decode error triggered end of stream.
-    [V8EnabledAtRuntime=mediaSource] void webkitSourceEndOfStream(in unsigned short status) raises (DOMException);
-
-    // Indicates the current state of the media source.
-    [V8EnabledAtRuntime=mediaSource] const unsigned short SOURCE_CLOSED = 0;
-    [V8EnabledAtRuntime=mediaSource] const unsigned short SOURCE_OPEN = 1;
-    [V8EnabledAtRuntime=mediaSource] const unsigned short SOURCE_ENDED = 2;
-    readonly attribute [V8EnabledAtRuntime=mediaSource] unsigned short webkitSourceState;
-
-    attribute [V8EnabledAtRuntime=mediaSource] EventListener onwebkitsourceopen;
-    attribute [V8EnabledAtRuntime=mediaSource] EventListener onwebkitsourceended;
-    attribute [V8EnabledAtRuntime=mediaSource] EventListener onwebkitsourceclose;
 #endif
 
 #if defined(ENABLE_ENCRYPTED_MEDIA) && ENABLE_ENCRYPTED_MEDIA
diff --git a/Source/WebCore/html/HTMLObjectElement.cpp b/Source/WebCore/html/HTMLObjectElement.cpp
index 5715d2382..cf185a8d3 100644
--- a/Source/WebCore/html/HTMLObjectElement.cpp
+++ b/Source/WebCore/html/HTMLObjectElement.cpp
@@ -73,7 +73,7 @@ PassRefPtr<HTMLObjectElement> HTMLObjectElement::create(const QualifiedName& tag
     return adoptRef(new HTMLObjectElement(tagName, document, form, createdByParser));
 }
 
-RenderWidget* HTMLObjectElement::renderWidgetForJSBindings()
+RenderWidget* HTMLObjectElement::renderWidgetForJSBindings() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
     return renderPart(); // This will return 0 if the renderer is not a RenderPart.
diff --git a/Source/WebCore/html/HTMLObjectElement.h b/Source/WebCore/html/HTMLObjectElement.h
index e12785d10..e3b49b4bd 100644
--- a/Source/WebCore/html/HTMLObjectElement.h
+++ b/Source/WebCore/html/HTMLObjectElement.h
@@ -82,7 +82,7 @@ private:
     virtual bool isURLAttribute(const Attribute&) const OVERRIDE;
     virtual const QualifiedName& imageSourceAttributeName() const;
 
-    virtual RenderWidget* renderWidgetForJSBindings();
+    virtual RenderWidget* renderWidgetForJSBindings() const;
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
diff --git a/Source/WebCore/html/HTMLOptionElement.cpp b/Source/WebCore/html/HTMLOptionElement.cpp
index bb68a9d32..8fcc22c27 100644
--- a/Source/WebCore/html/HTMLOptionElement.cpp
+++ b/Source/WebCore/html/HTMLOptionElement.cpp
@@ -329,7 +329,14 @@ String HTMLOptionElement::textIndentedToRespectGroupLabel() const
 
 bool HTMLOptionElement::disabled() const
 {
-    return ownElementDisabled() || (parentNode() && parentNode()->isHTMLElement() && static_cast<HTMLElement*>(parentNode())->disabled());
+    if (ownElementDisabled())
+        return true;
+
+    if (!parentNode() || !parentNode()->isHTMLElement())
+        return false;
+
+    HTMLElement* parentElement = static_cast<HTMLElement*>(parentNode());
+    return parentElement->hasTagName(optgroupTag) && parentElement->disabled();
 }
 
 Node::InsertionNotificationRequest HTMLOptionElement::insertedInto(ContainerNode* insertionPoint)
diff --git a/Source/WebCore/html/HTMLPlugInElement.cpp b/Source/WebCore/html/HTMLPlugInElement.cpp
index 5bdf60d44..1b5843483 100644
--- a/Source/WebCore/html/HTMLPlugInElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInElement.cpp
@@ -33,10 +33,12 @@
 #include "FrameTree.h"
 #include "HTMLNames.h"
 #include "Page.h"
+#include "PluginViewBase.h"
 #include "RenderEmbeddedObject.h"
 #include "RenderWidget.h"
 #include "Settings.h"
 #include "Widget.h"
+#include <wtf/UnusedParam.h>
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 #include "npruntime_impl.h"
@@ -125,7 +127,7 @@ bool HTMLPlugInElement::guardedDispatchBeforeLoadEvent(const String& sourceURL)
     return beforeLoadAllowedLoad;
 }
 
-Widget* HTMLPlugInElement::pluginWidget()
+Widget* HTMLPlugInElement::pluginWidget() const
 {
     if (m_inBeforeLoadEventHandler) {
         // The plug-in hasn't loaded yet, and it makes no sense to try to load if beforeload handler happened to touch the plug-in element.
@@ -190,6 +192,24 @@ void HTMLPlugInElement::defaultEventHandler(Event* event)
     HTMLFrameOwnerElement::defaultEventHandler(event);
 }
 
+bool HTMLPlugInElement::isKeyboardFocusable(KeyboardEvent* event) const
+{
+    UNUSED_PARAM(event);
+    if (!document()->page())
+        return false;
+
+    const PluginViewBase* plugin = pluginWidget() && pluginWidget()->isPluginViewBase() ? static_cast<const PluginViewBase*>(pluginWidget()) : 0;
+    if (plugin)
+        return plugin->supportsKeyboardFocus();
+
+    return false;
+}
+
+bool HTMLPlugInElement::isPluginElement() const
+{
+    return true;
+}
+
 #if ENABLE(NETSCAPE_PLUGIN_API)
 
 NPObject* HTMLPlugInElement::getNPObject()
diff --git a/Source/WebCore/html/HTMLPlugInElement.h b/Source/WebCore/html/HTMLPlugInElement.h
index 067e9aef9..94887748d 100644
--- a/Source/WebCore/html/HTMLPlugInElement.h
+++ b/Source/WebCore/html/HTMLPlugInElement.h
@@ -45,7 +45,7 @@ public:
 
     PassScriptInstance getInstance();
 
-    Widget* pluginWidget();
+    Widget* pluginWidget() const;
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
     NPObject* getNPObject();
@@ -72,7 +72,10 @@ private:
 
     virtual void defaultEventHandler(Event*);
 
-    virtual RenderWidget* renderWidgetForJSBindings() = 0;
+    virtual RenderWidget* renderWidgetForJSBindings() const = 0;
+
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
+    virtual bool isPluginElement() const;
 
 private:
     mutable ScriptInstance m_instance;
diff --git a/Source/WebCore/html/HTMLProgressElement.cpp b/Source/WebCore/html/HTMLProgressElement.cpp
index 742b09ffa..48b5b886e 100644
--- a/Source/WebCore/html/HTMLProgressElement.cpp
+++ b/Source/WebCore/html/HTMLProgressElement.cpp
@@ -43,6 +43,7 @@ const double HTMLProgressElement::InvalidPosition = -2;
 
 HTMLProgressElement::HTMLProgressElement(const QualifiedName& tagName, Document* document)
     : LabelableElement(tagName, document)
+    , m_hasAuthorShadowRoot(false)
 {
     ASSERT(hasTagName(progressTag));
 }
@@ -58,8 +59,11 @@ PassRefPtr<HTMLProgressElement> HTMLProgressElement::create(const QualifiedName&
     return progress;
 }
 
-RenderObject* HTMLProgressElement::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* HTMLProgressElement::createRenderer(RenderArena* arena, RenderStyle* style)
 {
+    if (!style->hasAppearance() || hasAuthorShadowRoot())
+        return RenderObject::createObject(this, style);
+
     return new (arena) RenderProgress(this);
 }
 
@@ -68,6 +72,21 @@ bool HTMLProgressElement::childShouldCreateRenderer(const NodeRenderingContext&
     return childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
 }
 
+RenderProgress* HTMLProgressElement::renderProgress() const
+{
+    if (renderer() && renderer()->isProgress())
+        return static_cast<RenderProgress*>(renderer());
+
+    RenderObject* renderObject = userAgentShadowRoot()->firstChild()->renderer();
+    ASSERT(!renderObject || renderObject->isProgress());
+    return static_cast<RenderProgress*>(renderObject);
+}
+
+void HTMLProgressElement::willAddAuthorShadowRoot()
+{
+    m_hasAuthorShadowRoot = true;
+}
+
 bool HTMLProgressElement::supportsFocus() const
 {
     return Node::supportsFocus() && !disabled();
@@ -134,10 +153,9 @@ bool HTMLProgressElement::isDeterminate() const
 void HTMLProgressElement::didElementStateChange()
 {
     m_value->setWidthPercentage(position() * 100);
-    if (renderer() && renderer()->isProgress()) {
-        RenderProgress* render = toRenderProgress(renderer());
+    if (RenderProgress* render = renderProgress()) {
         bool wasDeterminate = render->isDeterminate();
-        renderer()->updateFromElement();
+        render->updateFromElement();
         if (wasDeterminate != isDeterminate())
             setNeedsStyleRecalc();
     }
@@ -145,14 +163,18 @@ void HTMLProgressElement::didElementStateChange()
 
 void HTMLProgressElement::createShadowSubtree()
 {
-    ASSERT(!shadow());
+    ASSERT(!userAgentShadowRoot());
+           
+    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot, ASSERT_NO_EXCEPTION);
+
+    RefPtr<ProgressInnerElement> inner = ProgressInnerElement::create(document());
+    root->appendChild(inner);
 
     RefPtr<ProgressBarElement> bar = ProgressBarElement::create(document());
     m_value = ProgressValueElement::create(document());
     bar->appendChild(m_value, ASSERT_NO_EXCEPTION);
 
-    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot, ASSERT_NO_EXCEPTION);
-    root->appendChild(bar, ASSERT_NO_EXCEPTION);
+    inner->appendChild(bar, ASSERT_NO_EXCEPTION);
 }
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLProgressElement.h b/Source/WebCore/html/HTMLProgressElement.h
index 72180b93d..6660d9d85 100644
--- a/Source/WebCore/html/HTMLProgressElement.h
+++ b/Source/WebCore/html/HTMLProgressElement.h
@@ -27,6 +27,7 @@
 namespace WebCore {
 
 class ProgressValueElement;
+class RenderProgress;
 
 class HTMLProgressElement : public LabelableElement {
 public:
@@ -35,6 +36,8 @@ public:
 
     static PassRefPtr<HTMLProgressElement> create(const QualifiedName&, Document*);
 
+    bool hasAuthorShadowRoot() const { return m_hasAuthorShadowRoot; }
+
     double value() const;
     void setValue(double, ExceptionCode&);
 
@@ -51,12 +54,15 @@ private:
     HTMLProgressElement(const QualifiedName&, Document*);
     virtual ~HTMLProgressElement();
 
+    virtual void willAddAuthorShadowRoot() OVERRIDE;
+
     virtual bool supportLabels() const OVERRIDE { return true; }
 
     virtual bool supportsFocus() const;
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
+    RenderProgress* renderProgress() const;
 
     virtual void parseAttribute(const Attribute&) OVERRIDE;
 
@@ -66,8 +72,21 @@ private:
     void createShadowSubtree();
 
     RefPtr<ProgressValueElement> m_value;
+    bool m_hasAuthorShadowRoot;
 };
 
+inline bool isHTMLProgressElement(Node* node)
+{
+    ASSERT(node);
+    return node->hasTagName(HTMLNames::progressTag);
+}
+
+inline HTMLProgressElement* toHTMLProgressElement(Node* node)
+{
+    ASSERT(!node || isHTMLProgressElement(node));
+    return static_cast<HTMLProgressElement*>(node);
+}
+
 } // namespace
 
 #endif
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.cpp b/Source/WebCore/html/HTMLPropertiesCollection.cpp
index b67c4c16a..7e81766db 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.cpp
+++ b/Source/WebCore/html/HTMLPropertiesCollection.cpp
@@ -69,14 +69,14 @@ void HTMLPropertiesCollection::updateRefElements() const
     toHTMLElement(base())->getItemRefElements(m_itemRefElements);
 }
 
-static Node* nextNodeWithProperty(Node* base, Node* node)
+static Node* nextNodeWithProperty(Node* rootNode, Node* previous, Node* ownerNode)
 {
     // An Microdata item may contain properties which in turn are items themselves. Properties can
     // also themselves be groups of name-value pairs, by putting the itemscope attribute on the element
     // that declares the property. If the property has an itemscope attribute specified then we need
     // to traverse the next sibling.
-    return node == base || (node->isHTMLElement() && !toHTMLElement(node)->fastHasAttribute(itemscopeAttr))
-            ? node->traverseNextNode(base) : node->traverseNextSibling(base);
+    return previous == ownerNode || (previous->isHTMLElement() && !toHTMLElement(previous)->fastHasAttribute(itemscopeAttr))
+            ? previous->traverseNextNode(rootNode) : previous->traverseNextSibling(rootNode);
 }
 
 Element* HTMLPropertiesCollection::virtualItemAfter(unsigned& offsetInArray, Element* previousItem) const
@@ -90,13 +90,14 @@ Element* HTMLPropertiesCollection::virtualItemAfter(unsigned& offsetInArray, Ele
     return 0;
 }
 
-HTMLElement* HTMLPropertiesCollection::virtualItemAfter(HTMLElement* base, Element* previous) const
+HTMLElement* HTMLPropertiesCollection::virtualItemAfter(HTMLElement* rootNode, Element* previous) const
 {
     Node* current;
-    current = previous ? nextNodeWithProperty(base, previous) : base;
+    Node* ownerNode = this->ownerNode();
+    current = previous ? nextNodeWithProperty(rootNode, previous, ownerNode) : rootNode;
 
-    for (; current; current = nextNodeWithProperty(base, current)) {
-        if (!current->isHTMLElement())
+    for (; current; current = nextNodeWithProperty(rootNode, current, ownerNode)) {
+        if (current == ownerNode || !current->isHTMLElement())
             continue;
         HTMLElement* element = toHTMLElement(current);
         if (element->fastHasAttribute(itempropAttr) && element->itemProp()->length()) {
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index 83ccec5c3..98c99b830 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -1292,11 +1292,13 @@ void HTMLSelectElement::listBoxDefaultEventHandler(Event* event)
         IntPoint localOffset = roundedIntPoint(renderer()->absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
         int listIndex = toRenderListBox(renderer())->listIndexAtOffset(toSize(localOffset));
         if (listIndex >= 0) {
+            if (!disabled()) {
 #if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
-            updateSelectedState(listIndex, mouseEvent->metaKey(), mouseEvent->shiftKey());
+                updateSelectedState(listIndex, mouseEvent->metaKey(), mouseEvent->shiftKey());
 #else
-            updateSelectedState(listIndex, mouseEvent->ctrlKey(), mouseEvent->shiftKey());
+                updateSelectedState(listIndex, mouseEvent->ctrlKey(), mouseEvent->shiftKey());
 #endif
+            }
             if (Frame* frame = document()->frame())
                 frame->eventHandler()->setMouseDownMayStartAutoscroll();
 
@@ -1310,13 +1312,15 @@ void HTMLSelectElement::listBoxDefaultEventHandler(Event* event)
         IntPoint localOffset = roundedIntPoint(renderer()->absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
         int listIndex = toRenderListBox(renderer())->listIndexAtOffset(toSize(localOffset));
         if (listIndex >= 0) {
-            if (m_multiple) {
-                setActiveSelectionEndIndex(listIndex);
-                updateListBoxSelection(false);
-            } else {
-                setActiveSelectionAnchorIndex(listIndex);
-                setActiveSelectionEndIndex(listIndex);
-                updateListBoxSelection(true);
+            if (!disabled()) {
+                if (m_multiple) {
+                    setActiveSelectionEndIndex(listIndex);
+                    updateListBoxSelection(false);
+                } else {
+                    setActiveSelectionAnchorIndex(listIndex);
+                    setActiveSelectionEndIndex(listIndex);
+                    updateListBoxSelection(true);
+                }
             }
             event->setDefaultHandled();
         }
diff --git a/Source/WebCore/html/HTMLSummaryElement.cpp b/Source/WebCore/html/HTMLSummaryElement.cpp
index 74ff5e6d7..e3b37b505 100644
--- a/Source/WebCore/html/HTMLSummaryElement.cpp
+++ b/Source/WebCore/html/HTMLSummaryElement.cpp
@@ -157,6 +157,14 @@ void HTMLSummaryElement::defaultEventHandler(Event* event)
     HTMLElement::defaultEventHandler(event);
 }
 
+bool HTMLSummaryElement::willRespondToMouseClickEvents()
+{
+    if (isMainSummary() && renderer())
+        return true;
+
+    return HTMLElement::willRespondToMouseClickEvents();
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/html/HTMLSummaryElement.h b/Source/WebCore/html/HTMLSummaryElement.h
index 49a2d0bac..2c8a93fb5 100644
--- a/Source/WebCore/html/HTMLSummaryElement.h
+++ b/Source/WebCore/html/HTMLSummaryElement.h
@@ -31,6 +31,7 @@ class HTMLSummaryElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLSummaryElement> create(const QualifiedName&, Document*);
     bool isMainSummary() const;
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
 
 private:
     HTMLSummaryElement(const QualifiedName&, Document*);
diff --git a/Source/WebCore/html/HTMLTableCellElement.cpp b/Source/WebCore/html/HTMLTableCellElement.cpp
index c75ecc8a1..294607d77 100644
--- a/Source/WebCore/html/HTMLTableCellElement.cpp
+++ b/Source/WebCore/html/HTMLTableCellElement.cpp
@@ -114,7 +114,7 @@ void HTMLTableCellElement::parseAttribute(const Attribute& attribute)
         HTMLTablePartElement::parseAttribute(attribute);
 }
 
-StylePropertySet* HTMLTableCellElement::additionalAttributeStyle()
+const StylePropertySet* HTMLTableCellElement::additionalAttributeStyle()
 {
     if (HTMLTableElement* table = findParentTable())
         return table->additionalCellStyle();
diff --git a/Source/WebCore/html/HTMLTableCellElement.h b/Source/WebCore/html/HTMLTableCellElement.h
index 5213e1c16..1850974cf 100644
--- a/Source/WebCore/html/HTMLTableCellElement.h
+++ b/Source/WebCore/html/HTMLTableCellElement.h
@@ -57,7 +57,7 @@ private:
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
-    virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
+    virtual const StylePropertySet* additionalAttributeStyle() OVERRIDE;
 
     virtual bool isURLAttribute(const Attribute&) const OVERRIDE;
 
diff --git a/Source/WebCore/html/HTMLTableColElement.cpp b/Source/WebCore/html/HTMLTableColElement.cpp
index 651a3bc71..2830dfa48 100644
--- a/Source/WebCore/html/HTMLTableColElement.cpp
+++ b/Source/WebCore/html/HTMLTableColElement.cpp
@@ -81,7 +81,7 @@ void HTMLTableColElement::parseAttribute(const Attribute& attribute)
         HTMLTablePartElement::parseAttribute(attribute);
 }
 
-StylePropertySet* HTMLTableColElement::additionalAttributeStyle()
+const StylePropertySet* HTMLTableColElement::additionalAttributeStyle()
 {
     if (!hasLocalName(colgroupTag))
         return 0;
diff --git a/Source/WebCore/html/HTMLTableColElement.h b/Source/WebCore/html/HTMLTableColElement.h
index 1916d250a..64069d9e1 100644
--- a/Source/WebCore/html/HTMLTableColElement.h
+++ b/Source/WebCore/html/HTMLTableColElement.h
@@ -45,7 +45,7 @@ private:
     virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
-    virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
+    virtual const StylePropertySet* additionalAttributeStyle() OVERRIDE;
 
     int m_span;
 };
diff --git a/Source/WebCore/html/HTMLTableElement.cpp b/Source/WebCore/html/HTMLTableElement.cpp
index 6232609fe..283786b72 100644
--- a/Source/WebCore/html/HTMLTableElement.cpp
+++ b/Source/WebCore/html/HTMLTableElement.cpp
@@ -432,7 +432,7 @@ static StylePropertySet* leakBorderStyle(int value)
     return style.release().leakRef();
 }
 
-StylePropertySet* HTMLTableElement::additionalAttributeStyle()
+const StylePropertySet* HTMLTableElement::additionalAttributeStyle()
 {
     if (m_frameAttr)
         return 0;
@@ -518,7 +518,7 @@ PassRefPtr<StylePropertySet> HTMLTableElement::createSharedCellStyle()
     return style.release();
 }
 
-StylePropertySet* HTMLTableElement::additionalCellStyle()
+const StylePropertySet* HTMLTableElement::additionalCellStyle()
 {
     if (!m_sharedCellStyle)
         m_sharedCellStyle = createSharedCellStyle();
@@ -542,7 +542,7 @@ static StylePropertySet* leakGroupBorderStyle(int rows)
     return style.release().leakRef();
 }
 
-StylePropertySet* HTMLTableElement::additionalGroupStyle(bool rows)
+const StylePropertySet* HTMLTableElement::additionalGroupStyle(bool rows)
 {
     if (m_rulesAttr != GroupsRules)
         return 0;
diff --git a/Source/WebCore/html/HTMLTableElement.h b/Source/WebCore/html/HTMLTableElement.h
index 2b05053ad..f11c467a8 100644
--- a/Source/WebCore/html/HTMLTableElement.h
+++ b/Source/WebCore/html/HTMLTableElement.h
@@ -65,8 +65,8 @@ public:
     String rules() const;
     String summary() const;
 
-    StylePropertySet* additionalCellStyle();
-    StylePropertySet* additionalGroupStyle(bool rows);
+    const StylePropertySet* additionalCellStyle();
+    const StylePropertySet* additionalGroupStyle(bool rows);
 
 private:
     HTMLTableElement(const QualifiedName&, Document*);
@@ -77,7 +77,7 @@ private:
     virtual bool isURLAttribute(const Attribute&) const OVERRIDE;
 
     // Used to obtain either a solid or outset border decl and to deal with the frame and rules attributes.
-    virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
+    virtual const StylePropertySet* additionalAttributeStyle() OVERRIDE;
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
diff --git a/Source/WebCore/html/HTMLTableSectionElement.cpp b/Source/WebCore/html/HTMLTableSectionElement.cpp
index 60e54289c..582fcbbea 100644
--- a/Source/WebCore/html/HTMLTableSectionElement.cpp
+++ b/Source/WebCore/html/HTMLTableSectionElement.cpp
@@ -47,7 +47,7 @@ PassRefPtr<HTMLTableSectionElement> HTMLTableSectionElement::create(const Qualif
     return adoptRef(new HTMLTableSectionElement(tagName, document));
 }
 
-StylePropertySet* HTMLTableSectionElement::additionalAttributeStyle()
+const StylePropertySet* HTMLTableSectionElement::additionalAttributeStyle()
 {
     if (HTMLTableElement* table = findParentTable())
         return table->additionalGroupStyle(true);
diff --git a/Source/WebCore/html/HTMLTableSectionElement.h b/Source/WebCore/html/HTMLTableSectionElement.h
index 7156a70f0..075d052bf 100644
--- a/Source/WebCore/html/HTMLTableSectionElement.h
+++ b/Source/WebCore/html/HTMLTableSectionElement.h
@@ -56,7 +56,7 @@ public:
 private:
     HTMLTableSectionElement(const QualifiedName& tagName, Document*);
 
-    virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
+    virtual const StylePropertySet* additionalAttributeStyle() OVERRIDE;
 };
 
 } //namespace
diff --git a/Source/WebCore/html/HTMLTextAreaElement.h b/Source/WebCore/html/HTMLTextAreaElement.h
index 18ebead28..4e6db563e 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.h
+++ b/Source/WebCore/html/HTMLTextAreaElement.h
@@ -123,6 +123,11 @@ private:
     mutable bool m_wasModifiedByUser;
 };
 
+inline bool isHTMLTextAreaElement(Node* node)
+{
+    return node->hasTagName(HTMLNames::textareaTag);
+}
+
 } //namespace
 
 #endif
diff --git a/Source/WebCore/html/HTMLTrackElement.idl b/Source/WebCore/html/HTMLTrackElement.idl
index 0107df5a3..3e98fed66 100644
--- a/Source/WebCore/html/HTMLTrackElement.idl
+++ b/Source/WebCore/html/HTMLTrackElement.idl
@@ -28,8 +28,8 @@ module html {
         Conditional=VIDEO_TRACK,
         V8EnabledAtRuntime=webkitVideoTrack
     ] HTMLTrackElement : HTMLElement {
-        attribute [Reflect, URL] DOMString src;
         attribute DOMString kind;
+        attribute [Reflect, URL] DOMString src;
         attribute DOMString srclang;
         attribute DOMString label;
         attribute [Reflect] boolean default;
diff --git a/Source/WebCore/html/HTMLVideoElement.cpp b/Source/WebCore/html/HTMLVideoElement.cpp
index eebe53367..0e0e22f71 100644
--- a/Source/WebCore/html/HTMLVideoElement.cpp
+++ b/Source/WebCore/html/HTMLVideoElement.cpp
@@ -87,14 +87,6 @@ void HTMLVideoElement::attach()
 #endif
 }
 
-void HTMLVideoElement::detach()
-{
-    HTMLMediaElement::detach();
-    
-    if (!shouldDisplayPosterImage() && m_imageLoader)
-        m_imageLoader.clear();
-}
-
 void HTMLVideoElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
     if (attribute.name() == widthAttr)
diff --git a/Source/WebCore/html/HTMLVideoElement.h b/Source/WebCore/html/HTMLVideoElement.h
index b4c0391a7..dbe52a403 100644
--- a/Source/WebCore/html/HTMLVideoElement.h
+++ b/Source/WebCore/html/HTMLVideoElement.h
@@ -75,7 +75,6 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 #endif
     virtual void attach();
-    virtual void detach();
     virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index 09a895b50..674572e21 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -908,6 +908,12 @@ String InputType::defaultToolTip() const
 void InputType::listAttributeTargetChanged()
 {
 }
+
+Decimal InputType::findClosestTickMarkValue(const Decimal&)
+{
+    ASSERT_NOT_REACHED();
+    return Decimal::nan();
+}
 #endif
 
 bool InputType::supportsIndeterminateAppearance() const
diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
index 0245ba888..a73ddba27 100644
--- a/Source/WebCore/html/InputType.h
+++ b/Source/WebCore/html/InputType.h
@@ -281,6 +281,7 @@ public:
     virtual String defaultToolTip() const;
 #if ENABLE(DATALIST_ELEMENT)
     virtual void listAttributeTargetChanged();
+    virtual Decimal findClosestTickMarkValue(const Decimal&);
 #endif
 
     // Parses the specified string for the type, and return
diff --git a/Source/WebCore/html/MediaController.cpp b/Source/WebCore/html/MediaController.cpp
index 39fd09d4c..393ca8ade 100644
--- a/Source/WebCore/html/MediaController.cpp
+++ b/Source/WebCore/html/MediaController.cpp
@@ -32,6 +32,7 @@
 #include "ExceptionCode.h"
 #include "HTMLMediaElement.h"
 #include "TimeRanges.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/AtomicString.h>
 
@@ -56,6 +57,8 @@ MediaController::MediaController(ScriptExecutionContext* context)
     , m_closedCaptionsVisible(false)
     , m_clock(Clock::create())
     , m_scriptExecutionContext(context)
+    , m_timeupdateTimer(this, &MediaController::timeupdateTimerFired)
+    , m_previousTimeupdateTime(0)
 {
 }
 
@@ -171,6 +174,8 @@ void MediaController::setCurrentTime(float time, ExceptionCode& code)
     // Seek each slaved media element to the new playback position relative to the media element timeline.
     for (size_t index = 0; index < m_mediaElements.size(); ++index)
         m_mediaElements[index]->seek(time, code);
+
+    scheduleTimeupdateEvent();
 }
 
 void MediaController::play()
@@ -395,14 +400,17 @@ void MediaController::updatePlaybackState()
     case WAITING:
         eventName = eventNames().waitingEvent;
         m_clock->stop();
+        m_timeupdateTimer.stop();
         break;
     case ENDED:
         eventName = eventNames().endedEvent;
         m_clock->stop();
+        m_timeupdateTimer.stop();
         break;
     case PLAYING:
         eventName = eventNames().playingEvent;
         m_clock->start();
+        startTimeupdateTimer();
         break;
     default:
         ASSERT_NOT_REACHED();
@@ -605,4 +613,33 @@ const AtomicString& MediaController::interfaceName() const
     return eventNames().interfaceForMediaController;
 }
 
+// The spec says to fire periodic timeupdate events (those sent while playing) every
+// "15 to 250ms", we choose the slowest frequency
+static const double maxTimeupdateEventFrequency = 0.25;
+
+void MediaController::startTimeupdateTimer()
+{
+    if (m_timeupdateTimer.isActive())
+        return;
+
+    m_timeupdateTimer.startRepeating(maxTimeupdateEventFrequency);
+}
+
+void MediaController::timeupdateTimerFired(Timer<MediaController>*)
+{
+    scheduleTimeupdateEvent();
+}
+
+void MediaController::scheduleTimeupdateEvent()
+{
+    double now = WTF::currentTime();
+    double timedelta = now - m_previousTimeupdateTime;
+
+    if (timedelta < maxTimeupdateEventFrequency)
+        return;
+
+    scheduleEvent(eventNames().timeupdateEvent);
+    m_previousTimeupdateTime = now;
+}
+
 #endif
diff --git a/Source/WebCore/html/MediaController.h b/Source/WebCore/html/MediaController.h
index d32b71279..d293ccb1d 100644
--- a/Source/WebCore/html/MediaController.h
+++ b/Source/WebCore/html/MediaController.h
@@ -125,6 +125,9 @@ private:
     void asyncEventTimerFired(Timer<MediaController>*);
     void clearPositionTimerFired(Timer<MediaController>*);
     bool hasEnded() const;
+    void scheduleTimeupdateEvent();
+    void timeupdateTimerFired(Timer<MediaController>*);
+    void startTimeupdateTimer();
 
     // EventTarget
     virtual void refEventTarget() { ref(); }
@@ -152,6 +155,8 @@ private:
     bool m_closedCaptionsVisible;
     PassRefPtr<Clock> m_clock;
     ScriptExecutionContext* m_scriptExecutionContext;
+    Timer<MediaController> m_timeupdateTimer;
+    double m_previousTimeupdateTime;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/NumberInputType.cpp b/Source/WebCore/html/NumberInputType.cpp
index 8beff28af..82f12d1fd 100644
--- a/Source/WebCore/html/NumberInputType.cpp
+++ b/Source/WebCore/html/NumberInputType.cpp
@@ -239,13 +239,7 @@ String NumberInputType::localizeValue(const String& proposedValue) const
     // We don't localize scientific notations.
     if (proposedValue.find(isE) != notFound)
         return proposedValue;
-    // FIXME: The following three lines should be removed when we
-    // remove the second argument of convertToLocalizedNumber().
-    // Note: parseToDoubleForNumberTypeWithDecimalPlaces set zero to decimalPlaces
-    // if currentValue isn't valid floating pointer number.
-    unsigned decimalPlace;
-    parseToDoubleForNumberTypeWithDecimalPlaces(proposedValue, &decimalPlace);
-    return convertToLocalizedNumber(proposedValue, decimalPlace);
+    return convertToLocalizedNumber(proposedValue);
 }
 
 String NumberInputType::visibleValue() const
diff --git a/Source/WebCore/html/PublicURLManager.h b/Source/WebCore/html/PublicURLManager.h
index 258ac067a..f5e7b20aa 100644
--- a/Source/WebCore/html/PublicURLManager.h
+++ b/Source/WebCore/html/PublicURLManager.h
@@ -37,6 +37,11 @@
 #include "MediaStreamRegistry.h"
 #endif
 
+#if ENABLE(MEDIA_SOURCE)
+#include "MediaSource.h"
+#include "MediaSourceRegistry.h"
+#endif
+
 namespace WebCore {
 
 class ScriptExecutionContext;
@@ -56,18 +61,29 @@ public:
         for (HashSet<String>::iterator iter = m_streamURLs.begin(); iter != streamURLsEnd; ++iter)
             MediaStreamRegistry::registry().unregisterMediaStreamURL(KURL(ParsedURLString, *iter));
 #endif
+#if ENABLE(MEDIA_SOURCE)
+        HashSet<String>::iterator sourceURLsEnd = m_sourceURLs.end();
+        for (HashSet<String>::iterator iter = m_sourceURLs.begin(); iter != sourceURLsEnd; ++iter)
+            MediaSourceRegistry::registry().unregisterMediaSourceURL(KURL(ParsedURLString, *iter));
+#endif
     }
 
     HashSet<String>& blobURLs() { return m_blobURLs; }
 #if ENABLE(MEDIA_STREAM)
     HashSet<String>& streamURLs() { return m_streamURLs; }
 #endif
+#if ENABLE(MEDIA_SOURCE)
+    HashSet<String>& sourceURLs() { return m_sourceURLs; }
+#endif
 
 private:
     HashSet<String> m_blobURLs;
 #if ENABLE(MEDIA_STREAM)
     HashSet<String> m_streamURLs;
 #endif
+#if ENABLE(MEDIA_SOURCE)
+    HashSet<String> m_sourceURLs;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index 901a9acc1..ae696e6df 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -55,6 +55,12 @@
 #include "TouchList.h"
 #endif
 
+#if ENABLE(DATALIST_ELEMENT)
+#include "HTMLDataListElement.h"
+#include "HTMLOptionElement.h"
+#include <wtf/NonCopyingSort.h>
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -76,6 +82,14 @@ PassOwnPtr<InputType> RangeInputType::create(HTMLInputElement* element)
     return adoptPtr(new RangeInputType(element));
 }
 
+RangeInputType::RangeInputType(HTMLInputElement* element)
+    : InputType(element)
+#if ENABLE(DATALIST_ELEMENT)
+    , m_tickMarkValuesDirty(true)
+#endif
+{
+}
+
 bool RangeInputType::isRangeControl() const
 {
     return true;
@@ -319,8 +333,70 @@ HTMLElement* RangeInputType::sliderThumbElement() const
 #if ENABLE(DATALIST_ELEMENT)
 void RangeInputType::listAttributeTargetChanged()
 {
+    m_tickMarkValuesDirty = true;
     element()->setNeedsStyleRecalc();
 }
+
+static bool decimalCompare(const Decimal& a, const Decimal& b)
+{
+    return a < b;
+}
+
+void RangeInputType::updateTickMarkValues()
+{
+    if (!m_tickMarkValuesDirty)
+        return;
+    m_tickMarkValues.clear();
+    m_tickMarkValuesDirty = false;
+    HTMLDataListElement* dataList = element()->dataList();
+    if (!dataList)
+        return;
+    RefPtr<HTMLCollection> options = dataList->options();
+    m_tickMarkValues.reserveCapacity(options->length());
+    for (unsigned i = 0; i < options->length(); ++i) {
+        Node* node = options->item(i);
+        HTMLOptionElement* optionElement = toHTMLOptionElement(node);
+        String optionValue = optionElement->value();
+        if (!element()->isValidValue(optionValue))
+            continue;
+        m_tickMarkValues.append(parseToNumber(optionValue, Decimal::nan()));
+    }
+    m_tickMarkValues.shrinkToFit();
+    nonCopyingSort(m_tickMarkValues.begin(), m_tickMarkValues.end(), decimalCompare);
+}
+
+Decimal RangeInputType::findClosestTickMarkValue(const Decimal& value)
+{
+    updateTickMarkValues();
+    if (!m_tickMarkValues.size())
+        return Decimal::nan();
+
+    size_t left = 0;
+    size_t right = m_tickMarkValues.size();
+    size_t middle;
+    while (true) {
+        ASSERT(left <= right);
+        middle = left + (right - left) / 2;
+        if (!middle)
+            break;
+        if (middle == m_tickMarkValues.size() - 1 && m_tickMarkValues[middle] < value) {
+            middle++;
+            break;
+        }
+        if (m_tickMarkValues[middle - 1] <= value && m_tickMarkValues[middle] >= value)
+            break;
+
+        if (m_tickMarkValues[middle] < value)
+            left = middle;
+        else
+            right = middle;
+    }
+    const Decimal closestLeft = middle ? m_tickMarkValues[middle - 1] : Decimal::infinity(Decimal::Negative);
+    const Decimal closestRight = middle != m_tickMarkValues.size() ? m_tickMarkValues[middle] : Decimal::infinity(Decimal::Positive);
+    if (closestRight - value < value - closestLeft)
+        return closestRight;
+    return closestLeft;
+}
 #endif
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/RangeInputType.h b/Source/WebCore/html/RangeInputType.h
index 69d2ec7c6..8367b6fef 100644
--- a/Source/WebCore/html/RangeInputType.h
+++ b/Source/WebCore/html/RangeInputType.h
@@ -42,7 +42,7 @@ public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
 
 private:
-    RangeInputType(HTMLInputElement* element) : InputType(element) { }
+    RangeInputType(HTMLInputElement*);
     virtual bool isRangeControl() const OVERRIDE;
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual double valueAsDouble() const OVERRIDE;
@@ -72,6 +72,11 @@ private:
     virtual HTMLElement* sliderThumbElement() const OVERRIDE;
 #if ENABLE(DATALIST_ELEMENT)
     virtual void listAttributeTargetChanged() OVERRIDE;
+    void updateTickMarkValues();
+    virtual Decimal findClosestTickMarkValue(const Decimal&) OVERRIDE;
+
+    bool m_tickMarkValuesDirty;
+    Vector<Decimal> m_tickMarkValues;
 #endif
 };
 
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index aced0bd0b..722c9c53d 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -1996,6 +1996,10 @@ void CanvasRenderingContext2D::setFont(const String& newFont)
     if (parsedStyle->isEmpty())
         return;
 
+    RefPtr<CSSValue> fontValue = parsedStyle->getPropertyCSSValue(CSSPropertyFont);
+    if (fontValue && fontValue->isInheritedValue())
+        return;
+
     // The parse succeeded.
     realizeSaves();
     modifiableState().m_unparsedFont = newFont;
diff --git a/Source/WebCore/html/canvas/Float32Array.idl b/Source/WebCore/html/canvas/Float32Array.idl
index 8eaebe4de..b445eb40d 100644
--- a/Source/WebCore/html/canvas/Float32Array.idl
+++ b/Source/WebCore/html/canvas/Float32Array.idl
@@ -26,14 +26,15 @@
 
 module html {
     interface [
-        CustomConstructor,
+        ConstructorTemplate=TypedArray,
         ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
         CustomToJSObject,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        TypedArray=float
     ] Float32Array : ArrayBufferView {
         const unsigned long BYTES_PER_ELEMENT = 4;
 
@@ -43,6 +44,6 @@ module html {
 
         // void set(in Float32Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
-        [Custom] void set();
+        void set();
     };
 }
diff --git a/Source/WebCore/html/canvas/Float64Array.idl b/Source/WebCore/html/canvas/Float64Array.idl
index abfeb2178..da4b483a1 100644
--- a/Source/WebCore/html/canvas/Float64Array.idl
+++ b/Source/WebCore/html/canvas/Float64Array.idl
@@ -26,14 +26,15 @@
 
 module html {
     interface [
-        CustomConstructor,
+        ConstructorTemplate=TypedArray,
         ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
         CustomToJSObject,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        TypedArray=double
     ] Float64Array : ArrayBufferView {
         const unsigned long BYTES_PER_ELEMENT = 8;
 
@@ -43,6 +44,6 @@ module html {
 
         // void set(in Float64Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
-        [Custom] void set();
+        void set();
     };
 }
diff --git a/Source/WebCore/html/canvas/Int16Array.idl b/Source/WebCore/html/canvas/Int16Array.idl
index f6d089ea3..9f98bea93 100644
--- a/Source/WebCore/html/canvas/Int16Array.idl
+++ b/Source/WebCore/html/canvas/Int16Array.idl
@@ -25,14 +25,15 @@
 
 module html {
     interface [
-        CustomConstructor,
+        ConstructorTemplate=TypedArray,
         ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
         CustomToJSObject,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        TypedArray=short
     ] Int16Array : ArrayBufferView {
         const unsigned long BYTES_PER_ELEMENT = 2;
 
@@ -42,6 +43,6 @@ module html {
 
         // void set(in Int16Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
-        [Custom] void set();
+        void set();
     };
 }
diff --git a/Source/WebCore/html/canvas/Int32Array.idl b/Source/WebCore/html/canvas/Int32Array.idl
index f98835a2c..87cd7587c 100644
--- a/Source/WebCore/html/canvas/Int32Array.idl
+++ b/Source/WebCore/html/canvas/Int32Array.idl
@@ -26,14 +26,15 @@
 
 module html {
     interface [
-        CustomConstructor,
+        ConstructorTemplate=TypedArray,
         ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
         CustomToJSObject,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        TypedArray=int
     ] Int32Array : ArrayBufferView {
         const unsigned long BYTES_PER_ELEMENT = 4;
 
@@ -43,6 +44,6 @@ module html {
 
         // void set(in Int32Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
-        [Custom] void set();
+        void set();
     };
 }
diff --git a/Source/WebCore/html/canvas/Int8Array.idl b/Source/WebCore/html/canvas/Int8Array.idl
index 00faa4fc3..10cf12003 100644
--- a/Source/WebCore/html/canvas/Int8Array.idl
+++ b/Source/WebCore/html/canvas/Int8Array.idl
@@ -26,14 +26,15 @@
 
 module html {
     interface [
-        CustomConstructor,
+        ConstructorTemplate=TypedArray,
         ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
         CustomToJSObject,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        TypedArray=signed char
     ] Int8Array : ArrayBufferView {
         const unsigned long BYTES_PER_ELEMENT = 1;
 
@@ -43,6 +44,6 @@ module html {
 
         // void set(in Int8Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
-        [Custom] void set();
+        void set();
     };
 }
diff --git a/Source/WebCore/html/canvas/Uint16Array.idl b/Source/WebCore/html/canvas/Uint16Array.idl
index 79e05efc4..72998a35d 100644
--- a/Source/WebCore/html/canvas/Uint16Array.idl
+++ b/Source/WebCore/html/canvas/Uint16Array.idl
@@ -26,14 +26,15 @@
 
 module html {
     interface [
-        CustomConstructor,
+        ConstructorTemplate=TypedArray,
         ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
         CustomToJSObject,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        TypedArray=unsigned short
     ] Uint16Array : ArrayBufferView {
         const unsigned long BYTES_PER_ELEMENT = 2;
 
@@ -42,6 +43,6 @@ module html {
 
         // void set(in Uint16Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
-        [Custom] void set();
+        void set();
     };
 }
diff --git a/Source/WebCore/html/canvas/Uint32Array.idl b/Source/WebCore/html/canvas/Uint32Array.idl
index 67e61b29f..65c44bef9 100644
--- a/Source/WebCore/html/canvas/Uint32Array.idl
+++ b/Source/WebCore/html/canvas/Uint32Array.idl
@@ -26,14 +26,15 @@
 
 module html {
     interface [
-        CustomConstructor,
+        ConstructorTemplate=TypedArray,
         ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
         CustomToJSObject,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        TypedArray=unsigned int
     ] Uint32Array : ArrayBufferView {
         const unsigned long BYTES_PER_ELEMENT = 4;
 
@@ -42,6 +43,6 @@ module html {
 
         // void set(in Uint32Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
-        [Custom] void set();
+        void set();
     };
 }
diff --git a/Source/WebCore/html/canvas/Uint8Array.idl b/Source/WebCore/html/canvas/Uint8Array.idl
index 260a3273e..f6ef9377d 100644
--- a/Source/WebCore/html/canvas/Uint8Array.idl
+++ b/Source/WebCore/html/canvas/Uint8Array.idl
@@ -26,14 +26,15 @@
 
 module html {
     interface [
-        CustomConstructor,
+        ConstructorTemplate=TypedArray,
         ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
         CustomToJSObject,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        TypedArray=unsigned char
     ] Uint8Array : ArrayBufferView {
         const unsigned long BYTES_PER_ELEMENT = 1;
 
@@ -42,6 +43,6 @@ module html {
 
         // void set(in Uint8Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
-        [Custom] void set();
+        void set();
     };
 }
diff --git a/Source/WebCore/html/canvas/Uint8ClampedArray.idl b/Source/WebCore/html/canvas/Uint8ClampedArray.idl
index cadd66364..c646e57e9 100644
--- a/Source/WebCore/html/canvas/Uint8ClampedArray.idl
+++ b/Source/WebCore/html/canvas/Uint8ClampedArray.idl
@@ -26,14 +26,15 @@
 
 module html {
     interface [
-        CustomConstructor,
+        ConstructorTemplate=TypedArray,
         ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
         CustomToJSObject,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        TypedArray=unsigned char
     ] Uint8ClampedArray : Uint8Array {
         const unsigned long BYTES_PER_ELEMENT = 1;
 
@@ -43,6 +44,6 @@ module html {
         // FIXME: Missing other setters!
         // void set(in Uint8ClampedArray array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
-        [Custom] void set();
+        void set();
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index c0abf0fba..1ee6215fd 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -548,6 +548,7 @@ void WebGLRenderingContext::setupFlags()
         m_isGLES2NPOTStrict = !m_context->getExtensions()->isEnabled("GL_ARB_texture_non_power_of_two");
         m_isDepthStencilSupported = m_context->getExtensions()->isEnabled("GL_EXT_packed_depth_stencil");
     }
+    m_isRobustnessEXTSupported = m_context->getExtensions()->isEnabled("GL_EXT_robustness");
 }
 
 bool WebGLRenderingContext::allowPrivilegedExtensions() const
@@ -2975,21 +2976,30 @@ WebGLGetInfo WebGLRenderingContext::getUniform(WebGLProgram* program, const WebG
                 switch (baseType) {
                 case GraphicsContext3D::FLOAT: {
                     GC3Dfloat value[16] = {0};
-                    m_context->getUniformfv(objectOrZero(program), location, value);
+                    if (m_isRobustnessEXTSupported)
+                        m_context->getExtensions()->getnUniformfvEXT(objectOrZero(program), location, 16, value);
+                    else
+                        m_context->getUniformfv(objectOrZero(program), location, value);
                     if (length == 1)
                         return WebGLGetInfo(value[0]);
                     return WebGLGetInfo(Float32Array::create(value, length));
                 }
                 case GraphicsContext3D::INT: {
                     GC3Dint value[4] = {0};
-                    m_context->getUniformiv(objectOrZero(program), location, value);
+                    if (m_isRobustnessEXTSupported)
+                        m_context->getExtensions()->getnUniformivEXT(objectOrZero(program), location, 4, value);
+                    else
+                        m_context->getUniformiv(objectOrZero(program), location, value);
                     if (length == 1)
                         return WebGLGetInfo(value[0]);
                     return WebGLGetInfo(Int32Array::create(value, length));
                 }
                 case GraphicsContext3D::BOOL: {
                     GC3Dint value[4] = {0};
-                    m_context->getUniformiv(objectOrZero(program), location, value);
+                    if (m_isRobustnessEXTSupported)
+                        m_context->getExtensions()->getnUniformivEXT(objectOrZero(program), location, 4, value);
+                    else
+                        m_context->getUniformiv(objectOrZero(program), location, value);
                     if (length > 1) {
                         bool boolValue[16] = {0};
                         for (unsigned j = 0; j < length; j++)
@@ -3290,26 +3300,34 @@ void WebGLRenderingContext::readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC
         return;
     }
     // Calculate array size, taking into consideration of PACK_ALIGNMENT.
-    unsigned int totalBytesRequired;
-    unsigned int padding;
-    GC3Denum error = m_context->computeImageSizeInBytes(format, type, width, height, m_packAlignment, &totalBytesRequired, &padding);
-    if (error != GraphicsContext3D::NO_ERROR) {
-        synthesizeGLError(error, "readPixels", "invalid dimensions");
-        return;
-    }
-    if (pixels->byteLength() < totalBytesRequired) {
-        synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "readPixels", "ArrayBufferView not large enough for dimensions");
-        return;
+    unsigned int totalBytesRequired = 0;
+    unsigned int padding = 0;
+    if (!m_isRobustnessEXTSupported) {
+        GC3Denum error = m_context->computeImageSizeInBytes(format, type, width, height, m_packAlignment, &totalBytesRequired, &padding);
+        if (error != GraphicsContext3D::NO_ERROR) {
+            synthesizeGLError(error, "readPixels", "invalid dimensions");
+            return;
+        }
+        if (pixels->byteLength() < totalBytesRequired) {
+            synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "readPixels", "ArrayBufferView not large enough for dimensions");
+            return;
+        }
     }
+
     clearIfComposited();
     void* data = pixels->baseAddress();
 
     {
         ScopedDrawingBufferBinder binder(m_drawingBuffer.get(), m_framebufferBinding.get());
-        m_context->readPixels(x, y, width, height, format, type, data);
+        if (m_isRobustnessEXTSupported)
+            m_context->getExtensions()->readnPixelsEXT(x, y, width, height, format, type, pixels->byteLength(), data);
+        else
+            m_context->readPixels(x, y, width, height, format, type, data);
     }
 
 #if OS(DARWIN) || OS(QNX)
+    if (m_isRobustnessEXTSupported) // we haven't computed padding
+        m_context->computeImageSizeInBytes(format, type, width, height, m_packAlignment, &totalBytesRequired, &padding);
     // FIXME: remove this section when GL driver bug on Mac AND the GLES driver bug
     // on QC & Imagination QNX is fixed, i.e., when alpha is off, readPixels should
     // set alpha to 255 instead of 0.
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index 4c890ea21..c72ac590a 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -494,6 +494,7 @@ public:
     bool m_isErrorGeneratedOnOutOfBoundsAccesses;
     bool m_isResourceSafe;
     bool m_isDepthStencilSupported;
+    bool m_isRobustnessEXTSupported;
 
     bool m_synthesizedErrorsToConsole;
     int m_numGLErrorsToConsoleAllowed;
diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.cpp b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
index 62678722c..fc9d7c664 100644
--- a/Source/WebCore/html/parser/HTMLConstructionSite.cpp
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
@@ -70,15 +70,6 @@ static bool hasImpliedEndTag(const HTMLStackItem* item)
         || item->hasTagName(rtTag);
 }
 
-static bool causesFosterParenting(const HTMLStackItem* item)
-{
-    return item->hasTagName(tableTag)
-        || item->hasTagName(tbodyTag)
-        || item->hasTagName(tfootTag)
-        || item->hasTagName(theadTag)
-        || item->hasTagName(trTag);
-}
-
 static inline bool isAllWhitespace(const String& string)
 {
     return string.isAllSpecialCharacters<isHTMLSpace>();
@@ -277,9 +268,9 @@ void HTMLConstructionSite::insertCommentOnHTMLHtmlElement(AtomicHTMLToken* token
 void HTMLConstructionSite::insertHTMLHeadElement(AtomicHTMLToken* token)
 {
     ASSERT(!shouldFosterParent());
-    m_head = createHTMLElement(token);
-    attachLater(currentNode(), m_head);
-    m_openElements.pushHTMLHeadElement(HTMLStackItem::create(m_head, token));
+    m_head = HTMLStackItem::create(createHTMLElement(token), token);
+    attachLater(currentNode(), m_head->element());
+    m_openElements.pushHTMLHeadElement(m_head);
 }
 
 void HTMLConstructionSite::insertHTMLBodyElement(AtomicHTMLToken* token)
@@ -476,7 +467,10 @@ void HTMLConstructionSite::findFosterSite(HTMLConstructionSiteTask& task)
     HTMLElementStack::ElementRecord* lastTableElementRecord = m_openElements.topmost(tableTag.localName());
     if (lastTableElementRecord) {
         Element* lastTableElement = lastTableElementRecord->element();
-        if (ContainerNode* parent = lastTableElement->parentNode()) {
+        ContainerNode* parent = lastTableElement->parentNode();
+        // When parsing HTML fragments, we skip step 4.2 ("Let root be a new html element with no attributes") for efficiency,
+        // and instead use the DocumentFragment as a root node. So we must treat the root node (DocumentFragment) as if it is a html element here.
+        if (parent && (parent->isElementNode() || (m_isParsingFragment && parent == m_openElements.rootNode()))) {
             task.parent = parent;
             task.nextChild = lastTableElement;
             return;
@@ -492,7 +486,7 @@ bool HTMLConstructionSite::shouldFosterParent() const
 {
     return m_redirectAttachToFosterParent
         && currentStackItem()->isElementNode()
-        && causesFosterParenting(currentStackItem());
+        && currentStackItem()->causesFosterParenting();
 }
 
 void HTMLConstructionSite::fosterParent(PassRefPtr<Node> node)
diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.h b/Source/WebCore/html/parser/HTMLConstructionSite.h
index 656e7987b..60572bdd8 100644
--- a/Source/WebCore/html/parser/HTMLConstructionSite.h
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.h
@@ -97,7 +97,6 @@ public:
     void insertHTMLHtmlStartTagInBody(AtomicHTMLToken*);
     void insertHTMLBodyStartTagInBody(AtomicHTMLToken*);
 
-    PassRefPtr<Element> createHTMLElement(AtomicHTMLToken*);
     PassRefPtr<HTMLStackItem> createElementFromSavedToken(HTMLStackItem*);
 
     bool shouldFosterParent() const;
@@ -114,12 +113,13 @@ public:
     Element* currentElement() const { return m_openElements.top(); }
     ContainerNode* currentNode() const { return m_openElements.topNode(); }
     HTMLStackItem* currentStackItem() const { return m_openElements.topStackItem(); }
-    Element* oneBelowTop() const { return m_openElements.oneBelowTop(); }
+    HTMLStackItem* oneBelowTop() const { return m_openElements.oneBelowTop(); }
 
     HTMLElementStack* openElements() const { return &m_openElements; }
     HTMLFormattingElementList* activeFormattingElements() const { return &m_activeFormattingElements; }
 
-    Element* head() const { return m_head.get(); }
+    Element* head() const { return m_head->element(); }
+    HTMLStackItem* headStackItem() const { return m_head.get(); }
 
     void setForm(HTMLFormElement*);
     HTMLFormElement* form() const { return m_form.get(); }
@@ -154,6 +154,7 @@ private:
 
     void findFosterSite(HTMLConstructionSiteTask&);
 
+    PassRefPtr<Element> createHTMLElement(AtomicHTMLToken*);
     PassRefPtr<Element> createElement(AtomicHTMLToken*, const AtomicString& namespaceURI);
 
     void mergeAttributesFromTokenIntoElement(AtomicHTMLToken*, Element*);
@@ -166,7 +167,7 @@ private:
     // and a Document in all other cases.
     ContainerNode* m_attachmentRoot;
     
-    RefPtr<Element> m_head;
+    RefPtr<HTMLStackItem> m_head;
     RefPtr<HTMLFormElement> m_form;
     mutable HTMLElementStack m_openElements;
     mutable HTMLFormattingElementList m_activeFormattingElements;
diff --git a/Source/WebCore/html/parser/HTMLElementStack.cpp b/Source/WebCore/html/parser/HTMLElementStack.cpp
index df074ffd3..62ed6f4e3 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.cpp
+++ b/Source/WebCore/html/parser/HTMLElementStack.cpp
@@ -210,13 +210,13 @@ void HTMLElementStack::popAll()
 
 void HTMLElementStack::pop()
 {
-    ASSERT(!top()->hasTagName(HTMLNames::headTag));
+    ASSERT(!topStackItem()->hasTagName(HTMLNames::headTag));
     popCommon();
 }
 
 void HTMLElementStack::popUntil(const AtomicString& tagName)
 {
-    while (!top()->hasLocalName(tagName)) {
+    while (!topStackItem()->hasLocalName(tagName)) {
         // pop() will ASSERT at <body> if callers fail to check that there is an
         // element with localName |tagName| on the stack of open elements.
         pop();
@@ -314,7 +314,7 @@ void HTMLElementStack::pushRootNode(PassRefPtr<HTMLStackItem> rootItem)
 
 void HTMLElementStack::pushHTMLHtmlElement(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(item->element()->hasTagName(HTMLNames::htmlTag));
+    ASSERT(item->hasTagName(HTMLNames::htmlTag));
     pushRootNodeCommon(item);
 }
     
@@ -328,7 +328,7 @@ void HTMLElementStack::pushRootNodeCommon(PassRefPtr<HTMLStackItem> rootItem)
 
 void HTMLElementStack::pushHTMLHeadElement(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(item->element()->hasTagName(HTMLNames::headTag));
+    ASSERT(item->hasTagName(HTMLNames::headTag));
     ASSERT(!m_headElement);
     m_headElement = item->element();
     pushCommon(item);
@@ -336,7 +336,7 @@ void HTMLElementStack::pushHTMLHeadElement(PassRefPtr<HTMLStackItem> item)
 
 void HTMLElementStack::pushHTMLBodyElement(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(item->element()->hasTagName(HTMLNames::bodyTag));
+    ASSERT(item->hasTagName(HTMLNames::bodyTag));
     ASSERT(!m_bodyElement);
     m_bodyElement = item->element();
     pushCommon(item);
@@ -344,9 +344,9 @@ void HTMLElementStack::pushHTMLBodyElement(PassRefPtr<HTMLStackItem> item)
 
 void HTMLElementStack::push(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(!item->element()->hasTagName(HTMLNames::htmlTag));
-    ASSERT(!item->element()->hasTagName(HTMLNames::headTag));
-    ASSERT(!item->element()->hasTagName(HTMLNames::bodyTag));
+    ASSERT(!item->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!item->hasTagName(HTMLNames::headTag));
+    ASSERT(!item->hasTagName(HTMLNames::bodyTag));
     ASSERT(m_rootNode);
     pushCommon(item);
 }
@@ -356,9 +356,9 @@ void HTMLElementStack::insertAbove(PassRefPtr<HTMLStackItem> item, ElementRecord
     ASSERT(item);
     ASSERT(recordBelow);
     ASSERT(m_top);
-    ASSERT(!item->element()->hasTagName(HTMLNames::htmlTag));
-    ASSERT(!item->element()->hasTagName(HTMLNames::headTag));
-    ASSERT(!item->element()->hasTagName(HTMLNames::bodyTag));
+    ASSERT(!item->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!item->hasTagName(HTMLNames::headTag));
+    ASSERT(!item->hasTagName(HTMLNames::bodyTag));
     ASSERT(m_rootNode);
     if (recordBelow == m_top) {
         push(item);
@@ -383,21 +383,16 @@ HTMLElementStack::ElementRecord* HTMLElementStack::topRecord() const
     return m_top.get();
 }
 
-Element* HTMLElementStack::oneBelowTop() const
+HTMLStackItem* HTMLElementStack::oneBelowTop() const
 {
     // We should never call this if there are fewer than 2 elements on the stack.
     ASSERT(m_top);
     ASSERT(m_top->next());
     if (m_top->next()->stackItem()->isElementNode())
-        return m_top->next()->element();
+        return m_top->next()->stackItem().get();
     return 0;
 }
 
-Element* HTMLElementStack::bottom() const
-{
-    return htmlElement();
-}
-
 void HTMLElementStack::removeHTMLHeadElement(Element* element)
 {
     ASSERT(m_headElement == element);
@@ -576,9 +571,9 @@ void HTMLElementStack::pushCommon(PassRefPtr<HTMLStackItem> item)
 
 void HTMLElementStack::popCommon()
 {
-    ASSERT(!top()->hasTagName(HTMLNames::htmlTag));
-    ASSERT(!top()->hasTagName(HTMLNames::headTag) || !m_headElement);
-    ASSERT(!top()->hasTagName(HTMLNames::bodyTag) || !m_bodyElement);
+    ASSERT(!topStackItem()->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!topStackItem()->hasTagName(HTMLNames::headTag) || !m_headElement);
+    ASSERT(!topStackItem()->hasTagName(HTMLNames::bodyTag) || !m_bodyElement);
     top()->finishParsingChildren();
     m_top = m_top->releaseNext();
 
diff --git a/Source/WebCore/html/parser/HTMLElementStack.h b/Source/WebCore/html/parser/HTMLElementStack.h
index f19bc3001..620c5a194 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.h
+++ b/Source/WebCore/html/parser/HTMLElementStack.h
@@ -98,9 +98,8 @@ public:
         return m_top->stackItem().get();
     }
 
-    Element* oneBelowTop() const;
+    HTMLStackItem* oneBelowTop() const;
     ElementRecord* topRecord() const;
-    Element* bottom() const;
     ElementRecord* find(Element*) const;
     ElementRecord* topmost(const AtomicString& tagName) const;
 
diff --git a/Source/WebCore/html/parser/HTMLEntityParser.cpp b/Source/WebCore/html/parser/HTMLEntityParser.cpp
index 442cedbc2..18718054b 100644
--- a/Source/WebCore/html/parser/HTMLEntityParser.cpp
+++ b/Source/WebCore/html/parser/HTMLEntityParser.cpp
@@ -87,7 +87,7 @@ public:
         StringBuilder consumedCharacters;
         HTMLEntitySearch entitySearch;
         while (!source.isEmpty()) {
-            cc = *source;
+            cc = source.currentChar();
             entitySearch.advance(cc);
             if (!entitySearch.isEntityPrefix())
                 break;
@@ -114,13 +114,13 @@ public:
             const int length = entitySearch.mostRecentMatch()->length;
             const UChar* reference = entitySearch.mostRecentMatch()->entity;
             for (int i = 0; i < length; ++i) {
-                cc = *source;
+                cc = source.currentChar();
                 ASSERT_UNUSED(reference, cc == *reference++);
                 consumedCharacters.append(cc);
                 source.advanceAndASSERT(cc);
                 ASSERT(!source.isEmpty());
             }
-            cc = *source;
+            cc = source.currentChar();
         }
         if (entitySearch.mostRecentMatch()->lastCharacter() == ';'
             || !additionalAllowedCharacter
diff --git a/Source/WebCore/html/parser/HTMLFormattingElementList.cpp b/Source/WebCore/html/parser/HTMLFormattingElementList.cpp
index 1a45fb469..e7dd0dae1 100644
--- a/Source/WebCore/html/parser/HTMLFormattingElementList.cpp
+++ b/Source/WebCore/html/parser/HTMLFormattingElementList.cpp
@@ -59,7 +59,7 @@ Element* HTMLFormattingElementList::closestElementInScopeWithName(const AtomicSt
         const Entry& entry = m_entries[m_entries.size() - i];
         if (entry.isMarker())
             return 0;
-        if (entry.element()->hasLocalName(targetName))
+        if (entry.stackItem()->hasLocalName(targetName))
             return entry.element();
     }
     return 0;
diff --git a/Source/WebCore/html/parser/HTMLInputStream.h b/Source/WebCore/html/parser/HTMLInputStream.h
index da6932fd4..593290bcf 100644
--- a/Source/WebCore/html/parser/HTMLInputStream.h
+++ b/Source/WebCore/html/parser/HTMLInputStream.h
@@ -74,7 +74,7 @@ public:
     {
         // FIXME: This should use InputStreamPreprocessor::endOfFileMarker
         // once InputStreamPreprocessor is split off into its own header.
-        static const UChar endOfFileMarker = 0;
+        static const LChar endOfFileMarker = 0;
         m_last->append(SegmentedString(String(&endOfFileMarker, 1)));
         m_last->close();
     }
diff --git a/Source/WebCore/html/parser/HTMLParserIdioms.cpp b/Source/WebCore/html/parser/HTMLParserIdioms.cpp
index c3becc360..f0eb0ebb7 100644
--- a/Source/WebCore/html/parser/HTMLParserIdioms.cpp
+++ b/Source/WebCore/html/parser/HTMLParserIdioms.cpp
@@ -34,13 +34,13 @@
 
 namespace WebCore {
 
-String stripLeadingAndTrailingHTMLSpaces(const String& string)
+template <typename CharType>
+static String stripLeadingAndTrailingHTMLSpaces(String string, CharType characters, unsigned length)
 {
-    const UChar* characters = string.characters();
-    unsigned length = string.length();
+    unsigned numLeadingSpaces = 0;
+    unsigned numTrailingSpaces = 0;
 
-    unsigned numLeadingSpaces;
-    for (numLeadingSpaces = 0; numLeadingSpaces < length; ++numLeadingSpaces) {
+    for (; numLeadingSpaces < length; ++numLeadingSpaces) {
         if (isNotHTMLSpace(characters[numLeadingSpaces]))
             break;
     }
@@ -48,17 +48,32 @@ String stripLeadingAndTrailingHTMLSpaces(const String& string)
     if (numLeadingSpaces == length)
         return string.isNull() ? string : emptyAtom.string();
 
-    unsigned numTrailingSpaces;
-    for (numTrailingSpaces = 0; numTrailingSpaces < length; ++numTrailingSpaces) {
+    for (; numTrailingSpaces < length; ++numTrailingSpaces) {
         if (isNotHTMLSpace(characters[length - numTrailingSpaces - 1]))
             break;
     }
 
     ASSERT(numLeadingSpaces + numTrailingSpaces < length);
 
+    if (!(numLeadingSpaces | numTrailingSpaces))
+        return string;
+
     return string.substring(numLeadingSpaces, length - (numLeadingSpaces + numTrailingSpaces));
 }
 
+String stripLeadingAndTrailingHTMLSpaces(const String& string)
+{
+    unsigned length = string.length();
+
+    if (!length)
+        return string.isNull() ? string : emptyAtom.string();
+
+    if (string.is8Bit())
+        return stripLeadingAndTrailingHTMLSpaces(string, string.characters8(), length);
+
+    return stripLeadingAndTrailingHTMLSpaces(string, string.characters(), length);
+}
+
 String serializeForNumberType(const Decimal& number)
 {
     if (number.isZero()) {
@@ -137,84 +152,6 @@ double parseToDoubleForNumberType(const String& string)
     return parseToDoubleForNumberType(string, std::numeric_limits<double>::quiet_NaN());
 }
 
-double parseToDoubleForNumberTypeWithDecimalPlaces(const String& string, unsigned *decimalPlaces, double fallbackValue)
-{
-    if (decimalPlaces)
-        *decimalPlaces = 0;
-
-    double value = parseToDoubleForNumberType(string, std::numeric_limits<double>::quiet_NaN());
-    if (!isfinite(value))
-        return fallbackValue;
-
-    if (!decimalPlaces)
-        return value;
-
-    size_t dotIndex = string.find('.');
-    size_t eIndex = string.find('e');
-    if (eIndex == notFound) 
-        eIndex = string.find('E');
-
-    unsigned baseDecimalPlaces = 0;
-    if (dotIndex != notFound) {
-        if (eIndex == notFound)
-            baseDecimalPlaces = string.length() - dotIndex - 1;
-        else
-            baseDecimalPlaces = eIndex - dotIndex - 1;
-    }
-
-    int exponent = 0;
-    if (eIndex != notFound) {
-        unsigned cursor = eIndex + 1, cursorSaved;
-        int digit, exponentSign;
-        int32_t exponent32;
-        size_t length = string.length();
-
-        // Not using String.toInt() in order to perform the same computation as dtoa() does.
-        exponentSign = 0;
-        switch (digit = string[cursor]) {
-        case '-':
-            exponentSign = 1;
-        case '+':
-            digit = string[++cursor];
-        }
-        if (digit >= '0' && digit <= '9') {
-            while (cursor < length && digit == '0')
-                digit = string[++cursor];
-            if (digit > '0' && digit <= '9') {
-                exponent32 = digit - '0';
-                cursorSaved = cursor;
-                while (cursor < length && (digit = string[++cursor]) >= '0' && digit <= '9')
-                    exponent32 = (10 * exponent32) + digit - '0';
-                if (cursor - cursorSaved > 8 || exponent32 > 19999)
-                    /* Avoid confusion from exponents
-                     * so large that e might overflow.
-                     */
-                    exponent = 19999; /* safe for 16 bit ints */
-                else
-                    exponent = static_cast<int>(exponent32);
-                if (exponentSign)
-                    exponent = -exponent;
-            } else
-                exponent = 0;
-        }
-    }
-
-    int intDecimalPlaces = baseDecimalPlaces - exponent;
-    if (intDecimalPlaces < 0)
-        *decimalPlaces = 0;
-    else if (intDecimalPlaces > 19999)
-        *decimalPlaces = 19999;
-    else
-        *decimalPlaces = static_cast<unsigned>(intDecimalPlaces);
-
-    return value;
-}
-
-double parseToDoubleForNumberTypeWithDecimalPlaces(const String& string, unsigned *decimalPlaces)
-{
-    return parseToDoubleForNumberTypeWithDecimalPlaces(string, decimalPlaces, std::numeric_limits<double>::quiet_NaN());
-}
-
 // http://www.whatwg.org/specs/web-apps/current-work/#rules-for-parsing-integers
 bool parseHTMLInteger(const String& input, int& value)
 {
diff --git a/Source/WebCore/html/parser/HTMLParserIdioms.h b/Source/WebCore/html/parser/HTMLParserIdioms.h
index 5f0186d44..577e02e85 100644
--- a/Source/WebCore/html/parser/HTMLParserIdioms.h
+++ b/Source/WebCore/html/parser/HTMLParserIdioms.h
@@ -51,8 +51,6 @@ Decimal parseToDecimalForNumberType(const String&);
 Decimal parseToDecimalForNumberType(const String&, const Decimal& fallbackValue);
 double parseToDoubleForNumberType(const String&);
 double parseToDoubleForNumberType(const String&, double fallbackValue);
-double parseToDoubleForNumberTypeWithDecimalPlaces(const String&, unsigned*);
-double parseToDoubleForNumberTypeWithDecimalPlaces(const String&, unsigned*, double fallbackValue);
 
 // http://www.whatwg.org/specs/web-apps/current-work/#rules-for-parsing-integers
 bool parseHTMLInteger(const String&, int&);
diff --git a/Source/WebCore/html/parser/HTMLSourceTracker.cpp b/Source/WebCore/html/parser/HTMLSourceTracker.cpp
index e7c68764b..b042dd657 100644
--- a/Source/WebCore/html/parser/HTMLSourceTracker.cpp
+++ b/Source/WebCore/html/parser/HTMLSourceTracker.cpp
@@ -71,12 +71,12 @@ String HTMLSourceTracker::sourceForToken(const HTMLToken& token)
 
     size_t i = 0;
     for ( ; i < length && !m_previousSource.isEmpty(); ++i) {
-        source.append(*m_previousSource);
+        source.append(m_previousSource.currentChar());
         m_previousSource.advance();
     }
     for ( ; i < length; ++i) {
         ASSERT(!m_currentSource.isEmpty());
-        source.append(*m_currentSource);
+        source.append(m_currentSource.currentChar());
         m_currentSource.advance();
     }
 
diff --git a/Source/WebCore/html/parser/HTMLStackItem.h b/Source/WebCore/html/parser/HTMLStackItem.h
index 05b221042..371ac43f4 100644
--- a/Source/WebCore/html/parser/HTMLStackItem.h
+++ b/Source/WebCore/html/parser/HTMLStackItem.h
@@ -70,6 +70,15 @@ public:
     bool hasLocalName(const AtomicString& name) const { return m_token->name() == name; }
     bool hasTagName(const QualifiedName& name) const { return m_token->name() == name.localName() && m_namespaceURI == name.namespaceURI(); }
 
+    bool causesFosterParenting()
+    {
+        return hasTagName(HTMLNames::tableTag)
+            || hasTagName(HTMLNames::tbodyTag)
+            || hasTagName(HTMLNames::tfootTag)
+            || hasTagName(HTMLNames::theadTag)
+            || hasTagName(HTMLNames::trTag);
+    }
+
 private:
     HTMLStackItem(PassRefPtr<ContainerNode> node, ItemType type)
         : m_node(node)
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 3526acafc..a7f14519e 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -710,14 +710,15 @@ static void adjustForeignAttributes(AtomicHTMLToken* token)
     static PrefixedNameToQualifiedNameMap* map = 0;
     if (!map) {
         map = new PrefixedNameToQualifiedNameMap;
+
         QualifiedName** attrs = XLinkNames::getXLinkAttrs();
-        addNamesWithPrefix(map, "xlink", attrs, XLinkNames::XLinkAttrsCount);
+        addNamesWithPrefix(map, xlinkAtom, attrs, XLinkNames::XLinkAttrsCount);
 
         attrs = XMLNames::getXMLAttrs();
-        addNamesWithPrefix(map, "xml", attrs, XMLNames::XMLAttrsCount);
+        addNamesWithPrefix(map, xmlAtom, attrs, XMLNames::XMLAttrsCount);
 
-        map->add("xmlns", XMLNSNames::xmlnsAttr);
-        map->add("xmlns:xlink", QualifiedName("xmlns", "xlink", XMLNSNames::xmlnsNamespaceURI));
+        map->add(WTF::xmlnsAtom, XMLNSNames::xmlnsAttr);
+        map->add("xmlns:xlink", QualifiedName(xmlnsAtom, xlinkAtom, XMLNSNames::xmlnsNamespaceURI));
     }
 
     for (unsigned i = 0; i < token->attributes().size(); ++i) {
@@ -1189,7 +1190,7 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken* token)
             || token->name() == titleTag) {
             parseError(token);
             ASSERT(m_tree.head());
-            m_tree.openElements()->pushHTMLHeadElement(HTMLStackItem::create(m_tree.head(), token));
+            m_tree.openElements()->pushHTMLHeadElement(m_tree.headStackItem());
             processStartTagForInHead(token);
             m_tree.openElements()->removeHTMLHeadElement(m_tree.head());
             return;
@@ -1542,7 +1543,7 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken* token)
         }
         // 4.
         ASSERT(furthestBlock->isAbove(formattingElementRecord));
-        RefPtr<ContainerNode> commonAncestor = formattingElementRecord->next()->node();
+        RefPtr<HTMLStackItem> commonAncestor = formattingElementRecord->next()->stackItem();
         // 5.
         HTMLFormattingElementList::Bookmark bookmark = m_tree.activeFormattingElements()->bookmarkFor(formattingElement);
         // 6.
@@ -1584,17 +1585,12 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken* token)
             lastNode = node;
         }
         // 7
-        const AtomicString& commonAncestorTag = commonAncestor->localName();
         if (ContainerNode* parent = lastNode->element()->parentNode())
             parent->parserRemoveChild(lastNode->element());
-        // FIXME: If this moves to HTMLConstructionSite, this check should use
-        // causesFosterParenting(tagName) instead.
-        if (commonAncestorTag == tableTag
-            || commonAncestorTag == trTag
-            || isTableBodyContextTag(commonAncestorTag))
+        if (commonAncestor->causesFosterParenting())
             m_tree.fosterParent(lastNode->element());
         else {
-            commonAncestor->parserAddChild(lastNode->element());
+            commonAncestor->node()->parserAddChild(lastNode->element());
             ASSERT(lastNode->stackItem()->isElementNode());
             ASSERT(lastNode->element()->parentNode());
             if (lastNode->element()->parentNode()->attached() && !lastNode->element()->attached())
diff --git a/Source/WebCore/html/shadow/CalendarPickerElement.cpp b/Source/WebCore/html/shadow/CalendarPickerElement.cpp
index b7ea32f28..e70151df6 100644
--- a/Source/WebCore/html/shadow/CalendarPickerElement.cpp
+++ b/Source/WebCore/html/shadow/CalendarPickerElement.cpp
@@ -104,6 +104,15 @@ void CalendarPickerElement::defaultEventHandler(Event* event)
         HTMLDivElement::defaultEventHandler(event);
 }
 
+bool CalendarPickerElement::willRespondToMouseClickEvents()
+{
+    const HTMLInputElement* input = hostInput();
+    if (renderer() && !input->readOnly() && !input->disabled())
+        return true;
+
+    return HTMLDivElement::willRespondToMouseClickEvents();
+}
+
 void CalendarPickerElement::openPopup()
 {
     if (m_popup)
@@ -139,7 +148,7 @@ void CalendarPickerElement::detach()
 
 IntSize CalendarPickerElement::contentSize()
 {
-    return IntSize(100, 100);
+    return IntSize(0, 0);
 }
 
 void CalendarPickerElement::writeDocument(DocumentWriter& writer)
diff --git a/Source/WebCore/html/shadow/CalendarPickerElement.h b/Source/WebCore/html/shadow/CalendarPickerElement.h
index e6f6a4d1d..cbf213fc5 100644
--- a/Source/WebCore/html/shadow/CalendarPickerElement.h
+++ b/Source/WebCore/html/shadow/CalendarPickerElement.h
@@ -46,6 +46,7 @@ public:
     virtual ~CalendarPickerElement();
     void openPopup();
     void closePopup();
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
 
 private:
     CalendarPickerElement(Document*);
diff --git a/Source/WebCore/html/shadow/ContentDistributor.cpp b/Source/WebCore/html/shadow/ContentDistributor.cpp
index b3fdd32ad..324a5d0ed 100644
--- a/Source/WebCore/html/shadow/ContentDistributor.cpp
+++ b/Source/WebCore/html/shadow/ContentDistributor.cpp
@@ -49,7 +49,6 @@ InsertionPoint* ContentDistributor::findInsertionPointFor(const Node* key) const
     return m_nodeToInsertionPoint.get(key);
 }
 
-
 void ContentDistributor::distribute(Element* host)
 {
     ASSERT(needsDistribution());
diff --git a/Source/WebCore/html/shadow/ContentDistributor.h b/Source/WebCore/html/shadow/ContentDistributor.h
index 3077cff41..214e54fce 100644
--- a/Source/WebCore/html/shadow/ContentDistributor.h
+++ b/Source/WebCore/html/shadow/ContentDistributor.h
@@ -60,6 +60,8 @@ public:
 
     InsertionPoint* findInsertionPointFor(const Node* key) const;
 
+    void setValidity(Validity validity) { m_validity = validity; }
+
     void distribute(Element* host);
     bool invalidate(Element* host);
     void finishInivalidation();
diff --git a/Source/WebCore/html/shadow/DateTimeEditElement.cpp b/Source/WebCore/html/shadow/DateTimeEditElement.cpp
new file mode 100644
index 000000000..0ed1dacc3
--- /dev/null
+++ b/Source/WebCore/html/shadow/DateTimeEditElement.cpp
@@ -0,0 +1,472 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include "DateTimeEditElement.h"
+
+#include "DateComponents.h"
+#include "DateTimeFieldElements.h"
+#include "DateTimeFormat.h"
+#include "DateTimeSymbolicFieldElement.h"
+#include "EventHandler.h"
+#include "HTMLNames.h"
+#include "KeyboardEvent.h"
+#include "LocalizedDate.h"
+#include "LocalizedNumber.h"
+#include "MouseEvent.h"
+#include "StepRange.h"
+#include "Text.h"
+#include <wtf/DateMath.h>
+#include <wtf/text/StringBuilder.h>
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+class DateTimeEditBuilder : private DateTimeFormat::TokenHandler {
+    WTF_MAKE_NONCOPYABLE(DateTimeEditBuilder);
+
+public:
+    DateTimeEditBuilder(DateTimeEditElement&, const StepRange&);
+
+    bool build(const String&);
+    bool needSecondField() const;
+
+private:
+    bool needMillisecondField() const;
+    bool needMinuteField() const;
+    bool shouldMillisecondFieldReadOnly() const;
+    bool shouldMinuteFieldReadOnly() const;
+    bool shouldSecondFieldReadOnly() const;
+
+    // DateTimeFormat::TokenHandler functions.
+    virtual void visitField(DateTimeFormat::FieldType, int) OVERRIDE FINAL;
+    virtual void visitLiteral(const String&) OVERRIDE FINAL;
+
+    DateTimeEditElement& m_editElement;
+    const StepRange& m_stepRange;
+};
+
+DateTimeEditBuilder::DateTimeEditBuilder(DateTimeEditElement& elemnt, const StepRange& stepRange)
+    : m_editElement(elemnt)
+    , m_stepRange(stepRange)
+{
+}
+
+bool DateTimeEditBuilder::build(const String& formatString)
+{
+    m_editElement.resetLayout();
+    return DateTimeFormat::parse(formatString, *this);
+}
+
+bool DateTimeEditBuilder::needMillisecondField() const
+{
+    return !m_stepRange.minimum().remainder(static_cast<int>(msPerSecond)).isZero()
+        || !m_stepRange.step().remainder(static_cast<int>(msPerSecond)).isZero();
+}
+
+bool DateTimeEditBuilder::needMinuteField() const
+{
+    return !m_stepRange.minimum().remainder(static_cast<int>(msPerHour)).isZero()
+        || !m_stepRange.step().remainder(static_cast<int>(msPerHour)).isZero();
+}
+
+bool DateTimeEditBuilder::needSecondField() const
+{
+    return !m_stepRange.minimum().remainder(static_cast<int>(msPerMinute)).isZero()
+        || !m_stepRange.step().remainder(static_cast<int>(msPerMinute)).isZero();
+}
+
+void DateTimeEditBuilder::visitField(DateTimeFormat::FieldType fieldType, int)
+{
+    Document* const document = m_editElement.document();
+
+    switch (fieldType) {
+    case DateTimeFormat::FieldTypeHour11:
+        m_editElement.addField(DateTimeHourFieldElement::create(document, m_editElement, 0, 11));
+        return;
+
+    case DateTimeFormat::FieldTypeHour12:
+        m_editElement.addField(DateTimeHourFieldElement::create(document, m_editElement, 1, 12));
+        return;
+
+    case DateTimeFormat::FieldTypeHour23:
+        m_editElement.addField(DateTimeHourFieldElement::create(document, m_editElement, 0, 23));
+        return;
+
+    case DateTimeFormat::FieldTypeHour24:
+        m_editElement.addField(DateTimeHourFieldElement::create(document, m_editElement, 1, 24));
+        return;
+
+    case DateTimeFormat::FieldTypeMinute: {
+        RefPtr<DateTimeNumericFieldElement> field = DateTimeMinuteFieldElement::create(document, m_editElement);
+        m_editElement.addField(field);
+        if (shouldMinuteFieldReadOnly())
+            field->setReadOnly();
+        return;
+    }
+
+    case DateTimeFormat::FieldTypePeriod:
+        m_editElement.addField(DateTimeAMPMFieldElement::create(document, m_editElement, timeAMPMLabels()));
+        return;
+
+    case DateTimeFormat::FieldTypeSecond: {
+        RefPtr<DateTimeSecondFieldElement> field = DateTimeSecondFieldElement::create(document, m_editElement);
+        m_editElement.addField(field);
+        if (shouldSecondFieldReadOnly())
+            field->setReadOnly();
+
+        if (needMillisecondField()) {
+            visitLiteral(localizedDecimalSeparator());
+            visitField(DateTimeFormat::FieldTypeFractionalSecond, 3);
+        }
+        return;
+    }
+
+    case DateTimeFormat::FieldTypeFractionalSecond: {
+        RefPtr<DateTimeMillisecondFieldElement> field = DateTimeMillisecondFieldElement::create(document, m_editElement);
+        m_editElement.addField(field);
+        if (shouldMillisecondFieldReadOnly())
+            field->setReadOnly();
+        return;
+    }
+
+    default:
+        return;
+    }
+}
+
+bool DateTimeEditBuilder::shouldMillisecondFieldReadOnly() const
+{
+    return m_stepRange.step().remainder(static_cast<int>(msPerSecond)).isZero();
+}
+
+bool DateTimeEditBuilder::shouldMinuteFieldReadOnly() const
+{
+    return m_stepRange.step().remainder(static_cast<int>(msPerHour)).isZero();
+}
+
+bool DateTimeEditBuilder::shouldSecondFieldReadOnly() const
+{
+    return m_stepRange.step().remainder(static_cast<int>(msPerMinute)).isZero();
+}
+
+void DateTimeEditBuilder::visitLiteral(const String& text)
+{
+    ASSERT(text.length());
+    m_editElement.appendChild(Text::create(m_editElement.document(), text));
+}
+
+// ----------------------------
+
+DateTimeEditElement::EditControlOwner::~EditControlOwner()
+{
+}
+
+DateTimeEditElement::DateTimeEditElement(Document* document, EditControlOwner& editControlOwner)
+    : HTMLDivElement(divTag, document)
+    , m_editControlOwner(&editControlOwner)
+    , m_spinButton(0)
+    , m_focusFieldIndex(invalidFieldIndex)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, dateTimeEditPseudoId, ("-webkit-datetime-edit"));
+    setShadowPseudoId(dateTimeEditPseudoId);
+}
+
+DateTimeEditElement::~DateTimeEditElement()
+{
+    for (size_t fieldIndex = 0; fieldIndex < m_fields.size(); ++fieldIndex)
+        m_fields[fieldIndex]->removeEventHandler();
+
+    if (m_spinButton)
+        m_spinButton->removeStepActionHandler();
+}
+
+void DateTimeEditElement::addField(PassRefPtr<DateTimeFieldElement> field)
+{
+    if (m_fields.size() == m_fields.capacity())
+        return;
+    m_fields.append(field.get());
+    appendChild(field);
+}
+
+PassRefPtr<DateTimeEditElement> DateTimeEditElement::create(Document* document, EditControlOwner& editControlOwner, const StepRange& stepRange)
+{
+    RefPtr<DateTimeEditElement> container = adoptRef(new DateTimeEditElement(document, editControlOwner));
+    container->layout(stepRange);
+    return container.release();
+}
+
+void DateTimeEditElement::disabledStateChanged()
+{
+    updateUIState();
+}
+
+DateTimeFieldElement* DateTimeEditElement::fieldAt(size_t fieldIndex) const
+{
+    return fieldIndex < m_fields.size() ? m_fields[fieldIndex] : 0;
+}
+
+void DateTimeEditElement::focusFieldAt(size_t newFocusFieldIndex)
+{
+    if (m_focusFieldIndex == newFocusFieldIndex)
+        return;
+
+    DateTimeFieldElement* const newFocusField = fieldAt(newFocusFieldIndex);
+    if (newFocusField && newFocusField->isReadOnly())
+        return;
+
+    DateTimeFieldElement* const currentFocusField = fieldAt(m_focusFieldIndex);
+
+    if (currentFocusField)
+        currentFocusField->setFocus(false);
+
+    if (!newFocusField) {
+        m_focusFieldIndex = invalidFieldIndex;
+        return;
+    }
+
+    m_focusFieldIndex = newFocusFieldIndex;
+    newFocusField->setFocus(true);
+}
+
+void DateTimeEditElement::handleKeyboardEvent(KeyboardEvent* keyboardEvent)
+{
+    if (isDisabled() || isReadOnly())
+        return;
+
+    if (!fieldAt(m_focusFieldIndex))
+        return;
+
+    if (keyboardEvent->type() != eventNames().keydownEvent)
+        return;
+
+    const String& keyIdentifier = keyboardEvent->keyIdentifier();
+
+    if (keyIdentifier == "Left") {
+        keyboardEvent->setDefaultHandled();
+        const size_t fieldIndex = previousFieldIndex();
+        if (fieldAt(fieldIndex))
+            focusFieldAt(fieldIndex);
+        return;
+    }
+
+    if (keyIdentifier == "Right") {
+        keyboardEvent->setDefaultHandled();
+        const size_t fieldIndex = nextFieldIndex();
+        if (fieldAt(fieldIndex))
+            focusFieldAt(fieldIndex);
+        return;
+    }
+
+    if (keyIdentifier == "U+0009") {
+        const size_t fieldIndex = keyboardEvent->getModifierState("Shift") ? previousFieldIndex() : nextFieldIndex();
+        if (fieldAt(fieldIndex)) {
+            keyboardEvent->setDefaultHandled();
+            focusFieldAt(fieldIndex);
+            return;
+        }
+    }
+}
+
+void DateTimeEditElement::fieldValueChanged()
+{
+    if (m_editControlOwner)
+        m_editControlOwner->editControlValueChanged();
+}
+
+void DateTimeEditElement::focusOnNextField()
+{
+    if (m_focusFieldIndex != invalidFieldIndex)
+        focusFieldAt(nextFieldIndex());
+}
+
+void DateTimeEditElement::handleMouseEvent(MouseEvent* mouseEvent)
+{
+    if (isDisabled() || isReadOnly())
+        return;
+
+    if (mouseEvent->type() != eventNames().mousedownEvent || mouseEvent->button() != LeftButton)
+        return;
+
+    Node* const relatedTarget = mouseEvent->target()->toNode();
+    for (size_t fieldIndex = 0; fieldIndex < m_fields.size(); ++fieldIndex) {
+        if (m_fields[fieldIndex] == relatedTarget) {
+            mouseEvent->setDefaultHandled();
+            focusFieldAt(fieldIndex);
+            if (m_editControlOwner)
+                m_editControlOwner->editControlMouseFocus();
+            break;
+        }
+    }
+}
+
+bool DateTimeEditElement::isDisabled() const
+{
+    return m_editControlOwner && m_editControlOwner->isEditControlOwnerDisabled();
+}
+
+bool DateTimeEditElement::isReadOnly() const
+{
+    return m_editControlOwner && m_editControlOwner->isEditControlOwnerReadOnly();
+}
+
+void DateTimeEditElement::layout(const StepRange& stepRange)
+{
+    DateTimeFieldElement* const focusField = fieldAt(m_focusFieldIndex);
+    focusFieldAt(invalidFieldIndex);
+
+    DateTimeEditBuilder builder(*this, stepRange);
+    const String dateTimeFormat = builder.needSecondField() ? localizedTimeFormatText() : localizedShortTimeFormatText();
+    if (!builder.build(dateTimeFormat) || m_fields.isEmpty())
+        builder.build(builder.needSecondField() ? "HH:mm:ss" : "HH:mm");
+
+    RefPtr<SpinButtonElement> spinButton = SpinButtonElement::create(document(), *this);
+    m_spinButton = spinButton.get();
+    appendChild(spinButton);
+
+    if (focusField) {
+        for (size_t fieldIndex = 0; fieldIndex < m_fields.size(); ++fieldIndex) {
+            if (focusField == m_fields[fieldIndex]) {
+                focusFieldAt(fieldIndex);
+                break;
+            }
+        }
+    }
+}
+
+size_t DateTimeEditElement::nextFieldIndex() const
+{
+    ASSERT(m_focusFieldIndex != invalidFieldIndex);
+    for (size_t fieldIndex = m_focusFieldIndex + 1; fieldIndex < m_fields.size(); ++fieldIndex) {
+        if (!m_fields[fieldIndex]->isReadOnly())
+            return fieldIndex;
+    }
+    return m_fields.size();
+}
+
+size_t DateTimeEditElement::previousFieldIndex() const
+{
+    ASSERT(m_focusFieldIndex != invalidFieldIndex);
+    size_t fieldIndex = m_focusFieldIndex;
+    while (fieldIndex > 0) {
+        --fieldIndex;
+        if (!m_fields[fieldIndex]->isReadOnly())
+            return fieldIndex;
+    }
+    return invalidFieldIndex;
+}
+
+void DateTimeEditElement::readOnlyStateChanged()
+{
+    updateUIState();
+}
+
+void DateTimeEditElement::resetLayout()
+{
+    m_fields.shrink(0);
+    m_spinButton = 0;
+    m_focusFieldIndex = invalidFieldIndex;
+    removeChildren();
+}
+
+void DateTimeEditElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().focusEvent) {
+        if (!isDisabled() && !isReadOnly() && m_focusFieldIndex == invalidFieldIndex)
+            focusFieldAt(0);
+        return;
+    }
+
+    if (event->type() == eventNames().blurEvent) {
+        focusFieldAt(invalidFieldIndex);
+        return;
+    }
+
+    if (event->isMouseEvent()) {
+        handleMouseEvent(static_cast<MouseEvent*>(event));
+    } else if (event->isKeyboardEvent())
+        handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
+
+    if (event->defaultHandled())
+        return;
+
+    DateTimeFieldElement* const focusField = fieldAt(m_focusFieldIndex);
+    if (!focusField)
+        return;
+
+    focusField->defaultEventHandler(event);
+}
+
+void DateTimeEditElement::setValueAsDate(const DateComponents& date)
+{
+    for (size_t fieldIndex = 0; fieldIndex < m_fields.size(); ++fieldIndex)
+        m_fields[fieldIndex]->setValueAsDate(date);
+}
+
+void DateTimeEditElement::setEmptyValue(const DateComponents& dateForReadOnlyField)
+{
+    for (size_t fieldIndex = 0; fieldIndex < m_fields.size(); ++fieldIndex)
+        m_fields[fieldIndex]->setEmptyValue(dateForReadOnlyField, DateTimeFieldElement::DispatchNoEvent);
+}
+
+void DateTimeEditElement::spinButtonStepDown()
+{
+    if (DateTimeFieldElement* const focusField = fieldAt(m_focusFieldIndex))
+        focusField->stepDown();
+}
+
+void DateTimeEditElement::spinButtonStepUp()
+{
+    if (DateTimeFieldElement* const focusField = fieldAt(m_focusFieldIndex))
+        focusField->stepUp();
+}
+
+void DateTimeEditElement::updateUIState()
+{
+    if (isDisabled() || isReadOnly()) {
+        m_spinButton->releaseCapture();
+        focusFieldAt(invalidFieldIndex);
+    }
+}
+
+double DateTimeEditElement::valueAsDouble() const
+{
+    double value = 0;
+
+    for (size_t fieldIndex = 0; fieldIndex < m_fields.size(); ++fieldIndex) {
+        const DateTimeFieldElement* const field = m_fields[fieldIndex];
+        if (!field->hasValue())
+            return std::numeric_limits<double>::quiet_NaN();
+        value += field->valueAsDouble();
+    }
+
+    return value;
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/html/shadow/DateTimeEditElement.h b/Source/WebCore/html/shadow/DateTimeEditElement.h
new file mode 100644
index 000000000..462faa4a6
--- /dev/null
+++ b/Source/WebCore/html/shadow/DateTimeEditElement.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef DateTimeEditElement_h
+#define DateTimeEditElement_h
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include "DateTimeFieldElement.h"
+#include "TextControlInnerElements.h"
+
+namespace WebCore {
+
+class DateComponents;
+class DateTimeEditLayouter;
+class KeyboardEvent;
+class MouseEvent;
+class StepRange;
+
+// DateTimeEditElement class contains numberic field and symbolc field for
+// representing date and time, such as
+//  - Year, Month, Day Of Month
+//  - Hour, Minute, Second, Millisecond, AM/PM
+class DateTimeEditElement : public HTMLDivElement, public DateTimeFieldElement::FieldEventHandler, private SpinButtonElement::StepActionHandler {
+    WTF_MAKE_NONCOPYABLE(DateTimeEditElement);
+
+public:
+    // EditControlOwner implementer must call removeEditControlOwner when
+    // it doesn't handle event, e.g. at destruction.
+    class EditControlOwner {
+    public:
+        virtual ~EditControlOwner();
+        virtual void editControlMouseFocus() = 0;
+        virtual void editControlValueChanged() = 0;
+        virtual bool isEditControlOwnerDisabled() const = 0;
+        virtual bool isEditControlOwnerReadOnly() const = 0;
+    };
+
+    static PassRefPtr<DateTimeEditElement> create(Document*, EditControlOwner&, const StepRange&);
+
+    virtual ~DateTimeEditElement();
+    void addField(PassRefPtr<DateTimeFieldElement>);
+    virtual void defaultEventHandler(Event*) OVERRIDE;
+    void disabledStateChanged();
+    void layout(const StepRange&);
+    void readOnlyStateChanged();
+    void removeEditControlOwner() { m_editControlOwner = 0; }
+    void resetLayout();
+    void setEmptyValue(const DateComponents&  dateForReadOnlyField);
+    void setValueAsDate(const DateComponents&);
+    double valueAsDouble() const;
+
+private:
+    static const size_t invalidFieldIndex = static_cast<size_t>(-1);
+
+    // Datetime can be represent at most five fields, such as
+    //  1. year
+    //  2. month
+    //  3. day-of-month
+    //  4. hour
+    //  5. minute
+    //  6. second
+    //  7. millisecond
+    //  8. AM/PM
+    static const int maximumNumberOfFields = 8;
+
+    DateTimeEditElement(Document*, EditControlOwner&);
+
+    DateTimeFieldElement* fieldAt(size_t) const;
+    void focusFieldAt(size_t);
+    void handleKeyboardEvent(KeyboardEvent*);
+    void handleMouseEvent(MouseEvent*);
+    bool isDisabled() const;
+    bool isReadOnly() const;
+    size_t nextFieldIndex() const;
+    size_t previousFieldIndex() const;
+    void updateUIState();
+
+    // DateTimeFieldElement::FieldEventHandler functions.
+    virtual void fieldValueChanged() OVERRIDE FINAL;
+    virtual void focusOnNextField() OVERRIDE FINAL;
+
+    // SpinButtonElement::StepActionHandler functions.
+    virtual void spinButtonStepDown() OVERRIDE FINAL;
+    virtual void spinButtonStepUp() OVERRIDE FINAL;
+
+    Vector<DateTimeFieldElement*, maximumNumberOfFields> m_fields;
+    EditControlOwner* m_editControlOwner;
+    SpinButtonElement* m_spinButton;
+    size_t m_focusFieldIndex;
+};
+
+} // namespace WebCore
+
+#endif
+#endif
diff --git a/Source/WebCore/html/shadow/DateTimeFieldElement.cpp b/Source/WebCore/html/shadow/DateTimeFieldElement.cpp
new file mode 100644
index 000000000..702e4900c
--- /dev/null
+++ b/Source/WebCore/html/shadow/DateTimeFieldElement.cpp
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include "DateTimeFieldElement.h"
+
+#include "DateComponents.h"
+#include "HTMLNames.h"
+#include "KeyboardEvent.h"
+#include "Text.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+DateTimeFieldElement::FieldEventHandler::~FieldEventHandler()
+{
+}
+
+DateTimeFieldElement::DateTimeFieldElement(Document* document, FieldEventHandler& fieldEventHandler)
+    : HTMLElement(spanTag, document)
+    , m_fieldEventHandler(&fieldEventHandler)
+{
+}
+
+void DateTimeFieldElement::defaultEventHandler(Event* event)
+{
+    if (event->isKeyboardEvent()) {
+        KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(event);
+        handleKeyboardEvent(keyboardEvent);
+        if (keyboardEvent->defaultHandled())
+            return;
+        defaultKeyboardEventHandler(keyboardEvent);
+        if (keyboardEvent->defaultHandled())
+            return;
+    }
+
+    HTMLElement::defaultEventHandler(event);
+}
+
+void DateTimeFieldElement::defaultKeyboardEventHandler(KeyboardEvent* keyboardEvent)
+{
+    if (keyboardEvent->type() != eventNames().keydownEvent)
+        return;
+
+    const String& keyIdentifier = keyboardEvent->keyIdentifier();
+
+    if (keyIdentifier == "Down") {
+        keyboardEvent->setDefaultHandled();
+        stepDown();
+        return;
+    }
+
+    if (keyIdentifier == "Up") {
+        keyboardEvent->setDefaultHandled();
+        stepUp();
+        return;
+    }
+
+    if (keyIdentifier == "U+0008") {
+        keyboardEvent->setDefaultHandled();
+        setEmptyValue(DateComponents(), DispatchEvent);
+        return;
+    }
+}
+
+void DateTimeFieldElement::focusOnNextField()
+{
+    if (m_fieldEventHandler)
+        m_fieldEventHandler->focusOnNextField();
+}
+
+void DateTimeFieldElement::initialize(const AtomicString& shadowPseudoId)
+{
+    setShadowPseudoId(shadowPseudoId);
+    appendChild(Text::create(document(), visibleValue()));
+}
+
+bool DateTimeFieldElement::isReadOnly() const
+{
+    return fastHasAttribute(readonlyAttr);
+}
+
+void DateTimeFieldElement::setReadOnly()
+{
+    // Set HTML attribute readonly to change apperance.
+    setBooleanAttribute(readonlyAttr, true);
+    setNeedsStyleRecalc();
+}
+
+void DateTimeFieldElement::updateVisibleValue(EventBehavior eventBehavior)
+{
+    Text* const textNode = toText(firstChild());
+    const String newVisibleValue = visibleValue();
+    ASSERT(newVisibleValue.length() > 0);
+
+    if (textNode->wholeText() == newVisibleValue)
+        return;
+
+    textNode->replaceWholeText(newVisibleValue, ASSERT_NO_EXCEPTION);
+
+    if (eventBehavior == DispatchEvent && m_fieldEventHandler)
+        m_fieldEventHandler->fieldValueChanged();
+}
+
+double DateTimeFieldElement::valueAsDouble() const
+{
+    return hasValue() ? valueAsInteger() * unitInMillisecond() : std::numeric_limits<double>::quiet_NaN();
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/html/shadow/DateTimeFieldElement.h b/Source/WebCore/html/shadow/DateTimeFieldElement.h
new file mode 100644
index 000000000..066b61ffa
--- /dev/null
+++ b/Source/WebCore/html/shadow/DateTimeFieldElement.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef DateTimeFieldElement_h
+#define DateTimeFieldElement_h
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+
+#include "HTMLDivElement.h"
+
+namespace WebCore {
+
+class DateComponents;
+
+// DateTimeFieldElement is base class of date time field element.
+class DateTimeFieldElement : public HTMLElement {
+    WTF_MAKE_NONCOPYABLE(DateTimeFieldElement);
+
+public:
+    enum EventBehavior {
+        DispatchNoEvent,
+        DispatchEvent,
+    };
+
+    // FieldEventHandler implementer must call removeEventHandler when
+    // it doesn't handle event, e.g. at destruction.
+    class FieldEventHandler {
+    public:
+        virtual ~FieldEventHandler();
+        virtual void fieldValueChanged() = 0;
+        virtual void focusOnNextField() = 0;
+    };
+
+    virtual void defaultEventHandler(Event*) OVERRIDE;
+    virtual bool hasValue() const = 0;
+    bool isReadOnly() const;
+    void removeEventHandler() { m_fieldEventHandler = 0; }
+    void setReadOnly();
+    virtual void setEmptyValue(const DateComponents& dateForReadOnlyField, EventBehavior = DispatchNoEvent) = 0;
+    virtual void setValueAsDate(const DateComponents&) = 0;
+    virtual void setValueAsInteger(int, EventBehavior = DispatchNoEvent) = 0;
+    virtual void stepDown() = 0;
+    virtual void stepUp() = 0;
+    virtual String value() const = 0;
+    double valueAsDouble() const;
+    virtual int valueAsInteger() const = 0;
+    virtual String visibleValue() const = 0;
+
+protected:
+    DateTimeFieldElement(Document*, FieldEventHandler&);
+    void focusOnNextField();
+    virtual void handleKeyboardEvent(KeyboardEvent*) = 0;
+    void initialize(const AtomicString&);
+    virtual double unitInMillisecond() const = 0;
+    void updateVisibleValue(EventBehavior);
+
+private:
+    void defaultKeyboardEventHandler(KeyboardEvent*);
+
+    FieldEventHandler* m_fieldEventHandler;
+};
+
+} // namespace WebCore
+
+#endif
+#endif
diff --git a/Source/WebCore/html/shadow/DateTimeFieldElements.cpp b/Source/WebCore/html/shadow/DateTimeFieldElements.cpp
new file mode 100644
index 000000000..1ff7fa5c7
--- /dev/null
+++ b/Source/WebCore/html/shadow/DateTimeFieldElements.cpp
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include "DateTimeFieldElements.h"
+
+#include "DateComponents.h"
+#include <wtf/DateMath.h>
+
+namespace WebCore {
+
+DateTimeAMPMFieldElement::DateTimeAMPMFieldElement(Document* document, FieldEventHandler& fieldEventHandler, const Vector<String>& ampmLabels)
+    : DateTimeSymbolicFieldElement(document, fieldEventHandler, ampmLabels)
+{
+}
+
+PassRefPtr<DateTimeAMPMFieldElement> DateTimeAMPMFieldElement::create(Document* document, FieldEventHandler& fieldEventHandler, const Vector<String>& ampmLabels)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, ampmPsuedoId, ("-webkit-datetime-edit-ampm-field"));
+    RefPtr<DateTimeAMPMFieldElement> field = adoptRef(new DateTimeAMPMFieldElement(document, fieldEventHandler, ampmLabels));
+    field->initialize(ampmPsuedoId);
+    return field.release();
+}
+
+void DateTimeAMPMFieldElement::setValueAsDate(const DateComponents& date)
+{
+    setValueAsInteger(date.hour() >= 12 ? 1 : 0);
+}
+
+double DateTimeAMPMFieldElement::unitInMillisecond() const
+{
+    return msPerHour * 12;
+}
+
+// ----------------------------
+
+DateTimeHourFieldElement::DateTimeHourFieldElement(Document* document, FieldEventHandler& fieldEventHandler, int minimum, int maximum)
+    : DateTimeNumericFieldElement(document, fieldEventHandler, minimum, maximum)
+    , m_alignment(maximum + maximum % 2)
+{
+    ASSERT((!minimum && (maximum == 11 || maximum == 23)) || (minimum == 1 && (maximum == 12 || maximum == 24)));
+}
+
+PassRefPtr<DateTimeHourFieldElement> DateTimeHourFieldElement::create(Document* document, FieldEventHandler& fieldEventHandler, int minimum, int maximum)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, hourPsuedoId, ("-webkit-datetime-edit-hour-field"));
+    RefPtr<DateTimeHourFieldElement> field = adoptRef(new DateTimeHourFieldElement(document, fieldEventHandler, minimum, maximum));
+    field->initialize(hourPsuedoId);
+    return field.release();
+}
+
+void DateTimeHourFieldElement::setValueAsDate(const DateComponents& date)
+{
+    setValueAsInteger(date.hour());
+}
+
+void DateTimeHourFieldElement::setValueAsInteger(int valueAsHour23, EventBehavior eventBehavior)
+{
+    const int value = Range(0, 23).clampValue(valueAsHour23) % m_alignment;
+    DateTimeNumericFieldElement::setValueAsInteger(range().minimum && !value ? m_alignment : value, eventBehavior);
+}
+
+double DateTimeHourFieldElement::unitInMillisecond() const
+{
+    return msPerHour;
+}
+
+int DateTimeHourFieldElement::valueAsInteger() const
+{
+    return hasValue() ? DateTimeNumericFieldElement::valueAsInteger() % m_alignment : -1;
+}
+
+// ----------------------------
+
+DateTimeMillisecondFieldElement::DateTimeMillisecondFieldElement(Document* document, FieldEventHandler& fieldEventHandler)
+    : DateTimeNumericFieldElement(document, fieldEventHandler, 0, 999)
+{
+}
+
+PassRefPtr<DateTimeMillisecondFieldElement> DateTimeMillisecondFieldElement::create(Document* document, FieldEventHandler& fieldEventHandler)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, millisecondPsuedoId, ("-webkit-datetime-edit-millisecond-field"));
+    RefPtr<DateTimeMillisecondFieldElement> field = adoptRef(new DateTimeMillisecondFieldElement(document, fieldEventHandler));
+    field->initialize(millisecondPsuedoId);
+    return field.release();
+}
+
+void DateTimeMillisecondFieldElement::setValueAsDate(const DateComponents& date)
+{
+    setValueAsInteger(date.millisecond());
+}
+
+double DateTimeMillisecondFieldElement::unitInMillisecond() const
+{
+    return 1;
+}
+
+// ----------------------------
+
+DateTimeMinuteFieldElement::DateTimeMinuteFieldElement(Document* document, FieldEventHandler& fieldEventHandler)
+    : DateTimeNumericFieldElement(document, fieldEventHandler, 0, 59)
+{
+}
+
+PassRefPtr<DateTimeMinuteFieldElement> DateTimeMinuteFieldElement::create(Document* document, FieldEventHandler& fieldEventHandler)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, minutePsuedoId, ("-webkit-datetime-edit-minute-field"));
+    RefPtr<DateTimeMinuteFieldElement> field = adoptRef(new DateTimeMinuteFieldElement(document, fieldEventHandler));
+    field->initialize(minutePsuedoId);
+    return field.release();
+}
+
+void DateTimeMinuteFieldElement::setValueAsDate(const DateComponents& date)
+{
+    setValueAsInteger(date.minute());
+}
+
+double DateTimeMinuteFieldElement::unitInMillisecond() const
+{
+    return msPerMinute;
+}
+
+// ----------------------------
+
+DateTimeSecondFieldElement::DateTimeSecondFieldElement(Document* document, FieldEventHandler& fieldEventHandler)
+    : DateTimeNumericFieldElement(document, fieldEventHandler, 0, 59)
+{
+}
+
+PassRefPtr<DateTimeSecondFieldElement> DateTimeSecondFieldElement::create(Document* document, FieldEventHandler& fieldEventHandler)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, secondPsuedoId, ("-webkit-datetime-edit-second-field"));
+    RefPtr<DateTimeSecondFieldElement> field = adoptRef(new DateTimeSecondFieldElement(document, fieldEventHandler));
+    field->initialize(secondPsuedoId);
+    return field.release();
+}
+
+void DateTimeSecondFieldElement::setValueAsDate(const DateComponents& date)
+{
+    setValueAsInteger(date.second());
+}
+
+double DateTimeSecondFieldElement::unitInMillisecond() const
+{
+    return msPerSecond;
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/html/shadow/DateTimeFieldElements.h b/Source/WebCore/html/shadow/DateTimeFieldElements.h
new file mode 100644
index 000000000..57bc1efa5
--- /dev/null
+++ b/Source/WebCore/html/shadow/DateTimeFieldElements.h
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef DateTimeFieldElements_h
+#define DateTimeFieldElements_h
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include "DateTimeNumericFieldElement.h"
+#include "DateTimeSymbolicFieldElement.h"
+
+namespace WebCore {
+
+class DateTimeAMPMFieldElement : public DateTimeSymbolicFieldElement {
+    WTF_MAKE_NONCOPYABLE(DateTimeAMPMFieldElement);
+
+public:
+    static PassRefPtr<DateTimeAMPMFieldElement> create(Document*, FieldEventHandler&, const Vector<String>&);
+
+private:
+    DateTimeAMPMFieldElement(Document*, FieldEventHandler&, const Vector<String>&);
+
+    // DateTimeFieldElement functions.
+    virtual void setValueAsDate(const DateComponents&) OVERRIDE FINAL;
+    virtual double unitInMillisecond() const OVERRIDE FINAL;
+};
+
+
+// DateTimeHourFieldElement is used for hour field of date time format
+// supporting following patterns:
+//  - 0 to 11
+//  - 1 to 12
+//  - 0 to 23
+//  - 1 to 24
+class DateTimeHourFieldElement : public DateTimeNumericFieldElement {
+    WTF_MAKE_NONCOPYABLE(DateTimeHourFieldElement);
+
+public:
+    static PassRefPtr<DateTimeHourFieldElement> create(Document*, FieldEventHandler&, int minimum, int maximum);
+
+private:
+    DateTimeHourFieldElement(Document*, FieldEventHandler&, int minimum, int maximum);
+
+    // DateTimeFieldElement functions.
+    virtual void setValueAsDate(const DateComponents&) OVERRIDE FINAL;
+    virtual void setValueAsInteger(int, EventBehavior = DispatchNoEvent) OVERRIDE FINAL;
+    virtual double unitInMillisecond() const OVERRIDE FINAL;
+    virtual int valueAsInteger() const OVERRIDE FINAL;
+
+    const int m_alignment;
+};
+
+class DateTimeMillisecondFieldElement : public DateTimeNumericFieldElement {
+    WTF_MAKE_NONCOPYABLE(DateTimeMillisecondFieldElement);
+
+public:
+    static PassRefPtr<DateTimeMillisecondFieldElement> create(Document*, FieldEventHandler&);
+
+private:
+    DateTimeMillisecondFieldElement(Document*, FieldEventHandler&);
+
+    // DateTimeFieldElement functions.
+    virtual void setValueAsDate(const DateComponents&) OVERRIDE FINAL;
+    virtual double unitInMillisecond() const OVERRIDE FINAL;
+};
+
+class DateTimeMinuteFieldElement : public DateTimeNumericFieldElement {
+    WTF_MAKE_NONCOPYABLE(DateTimeMinuteFieldElement);
+
+public:
+    static PassRefPtr<DateTimeMinuteFieldElement> create(Document*, FieldEventHandler&);
+
+private:
+    DateTimeMinuteFieldElement(Document*, FieldEventHandler&);
+
+    // DateTimeFieldElement functions.
+    virtual void setValueAsDate(const DateComponents&) OVERRIDE FINAL;
+    virtual double unitInMillisecond() const OVERRIDE FINAL;
+};
+
+class DateTimeSecondFieldElement : public DateTimeNumericFieldElement {
+    WTF_MAKE_NONCOPYABLE(DateTimeSecondFieldElement);
+
+public:
+    static PassRefPtr<DateTimeSecondFieldElement> create(Document*, FieldEventHandler&);
+
+private:
+    DateTimeSecondFieldElement(Document*, FieldEventHandler&);
+
+    // DateTimeFieldElement functions.
+    virtual void setValueAsDate(const DateComponents&) OVERRIDE FINAL;
+    virtual double unitInMillisecond() const OVERRIDE FINAL;
+};
+
+} // namespace WebCore
+
+#endif
+#endif
diff --git a/Source/WebCore/html/shadow/DateTimeNumericFieldElement.cpp b/Source/WebCore/html/shadow/DateTimeNumericFieldElement.cpp
new file mode 100644
index 000000000..d522e1579
--- /dev/null
+++ b/Source/WebCore/html/shadow/DateTimeNumericFieldElement.cpp
@@ -0,0 +1,178 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include "DateTimeNumericFieldElement.h"
+
+#include "KeyboardEvent.h"
+#include "LocalizedNumber.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace WebCore {
+
+static const DOMTimeStamp typeAheadTimeout = 1000;
+
+static size_t displaySizeOfNumber(int value)
+{
+    ASSERT(value >= 0);
+
+    if (!value)
+        return 1;
+
+    int numberOfDigits = 0;
+    while (value) {
+        value /= 10;
+        ++numberOfDigits;
+    }
+
+    return numberOfDigits;
+}
+
+DateTimeNumericFieldElement::Range::Range(int minimum, int maximum)
+    : maximum(maximum)
+    , minimum(minimum)
+{
+    ASSERT(minimum <= maximum);
+}
+
+int DateTimeNumericFieldElement::Range::clampValue(int value) const
+{
+    return std::min(std::max(value, minimum), maximum);
+}
+
+DateTimeNumericFieldElement::DateTimeNumericFieldElement(Document* document, FieldEventHandler& fieldEventHandler, int minimum, int maximum)
+    : DateTimeFieldElement(document, fieldEventHandler)
+    , m_lastDigitCharTime(0)
+    , m_range(minimum, maximum)
+    , m_value(0)
+    , m_hasValue(false)
+{
+}
+
+void DateTimeNumericFieldElement::handleKeyboardEvent(KeyboardEvent* keyboardEvent)
+{
+    if (isReadOnly())
+        return;
+
+    if (keyboardEvent->type() != eventNames().keypressEvent)
+        return;
+
+    UChar charCode = static_cast<UChar>(keyboardEvent->charCode());
+    if (charCode < ' ')
+        return;
+
+    DOMTimeStamp delta = keyboardEvent->timeStamp() - m_lastDigitCharTime;
+    m_lastDigitCharTime = 0;
+
+    String number = convertFromLocalizedNumber(String(&charCode, 1));
+    const int digit = number[0] - '0';
+    if (digit < 0 || digit > 9)
+        return;
+
+    keyboardEvent->setDefaultHandled();
+    setValueAsInteger(m_hasValue && delta < typeAheadTimeout ? m_value * 10 + digit : digit, DispatchEvent);
+    if (m_value * 10 > m_range.maximum)
+        focusOnNextField();
+    else
+        m_lastDigitCharTime = keyboardEvent->timeStamp();
+}
+
+bool DateTimeNumericFieldElement::hasValue() const
+{
+    return m_hasValue;
+}
+
+void DateTimeNumericFieldElement::setEmptyValue(const DateComponents& dateForReadOnlyField, EventBehavior eventBehavior)
+{
+    m_lastDigitCharTime = 0;
+
+    if (isReadOnly()) {
+        setValueAsDate(dateForReadOnlyField);
+        return;
+    }
+
+    m_hasValue = false;
+    m_value = 0;
+    updateVisibleValue(eventBehavior);
+}
+
+void DateTimeNumericFieldElement::setValueAsInteger(int value, EventBehavior eventBehavior)
+{
+    m_value = clampValue(value);
+    m_hasValue = true;
+    updateVisibleValue(eventBehavior);
+    m_lastDigitCharTime = 0;
+}
+
+void DateTimeNumericFieldElement::stepDown()
+{
+    if (m_hasValue)
+        setValueAsInteger(m_value == m_range.minimum ? m_range.maximum : clampValue(m_value - 1), DispatchEvent);
+    else
+        setValueAsInteger(m_range.maximum, DispatchEvent);
+}
+
+void DateTimeNumericFieldElement::stepUp()
+{
+    if (m_hasValue)
+        setValueAsInteger(m_value == m_range.maximum ? m_range.minimum : clampValue(m_value + 1), DispatchEvent);
+    else
+        setValueAsInteger(m_range.minimum, DispatchEvent);
+}
+
+String DateTimeNumericFieldElement::value() const
+{
+    if (!m_hasValue)
+        return emptyString();
+
+    if (m_range.maximum > 999)
+        return convertToLocalizedNumber(String::number(m_value));
+
+    if (m_range.maximum > 99)
+        return convertToLocalizedNumber(String::format("%03d", m_value));
+
+    return convertToLocalizedNumber(String::format("%02d", m_value));
+}
+
+int DateTimeNumericFieldElement::valueAsInteger() const
+{
+    return m_hasValue ? m_value : -1;
+}
+
+String DateTimeNumericFieldElement::visibleValue() const
+{
+    if (m_hasValue)
+        return value();
+
+    StringBuilder builder;
+    for (int numberOfDashs = std::max(displaySizeOfNumber(m_range.maximum), displaySizeOfNumber(m_range.minimum)); numberOfDashs; --numberOfDashs)
+        builder.append('-');
+    return builder.toString();
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/html/shadow/DateTimeNumericFieldElement.h b/Source/WebCore/html/shadow/DateTimeNumericFieldElement.h
new file mode 100644
index 000000000..7cb398250
--- /dev/null
+++ b/Source/WebCore/html/shadow/DateTimeNumericFieldElement.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef DateTimeNumericFieldElement_h
+#define DateTimeNumericFieldElement_h
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include "DateTimeFieldElement.h"
+
+namespace WebCore {
+
+// DateTimeNumericFieldElement represents numeric field of date time format,
+// such as:
+//  - hour
+//  - minute
+//  - millisecond
+//  - second
+//  - year
+class DateTimeNumericFieldElement : public DateTimeFieldElement {
+    WTF_MAKE_NONCOPYABLE(DateTimeNumericFieldElement);
+
+protected:
+    struct Range {
+        Range(int minimum, int maximum);
+        int clampValue(int) const;
+
+        int maximum;
+        int minimum;
+    };
+
+    DateTimeNumericFieldElement(Document*, FieldEventHandler&, int minimum, int maximum);
+
+    int clampValue(int value) const { return m_range.clampValue(value); }
+    const Range& range() const { return m_range; }
+
+    // DateTimeFieldElement functions.
+    virtual bool hasValue() const OVERRIDE FINAL;
+    virtual void setValueAsInteger(int, EventBehavior = DispatchNoEvent) OVERRIDE;
+    virtual int valueAsInteger() const OVERRIDE;
+    virtual String visibleValue() const OVERRIDE FINAL;
+
+private:
+    // DateTimeFieldElement functions.
+    virtual void handleKeyboardEvent(KeyboardEvent*) OVERRIDE FINAL;
+    virtual void setEmptyValue(const DateComponents& dateForReadOnlyField, EventBehavior) OVERRIDE FINAL;
+    virtual void stepDown() OVERRIDE FINAL;
+    virtual void stepUp() OVERRIDE FINAL;
+    virtual String value() const OVERRIDE FINAL;
+
+    DOMTimeStamp m_lastDigitCharTime;
+    const Range m_range;
+    int m_value;
+    bool m_hasValue;
+};
+
+} // namespace WebCore
+
+#endif
+#endif
diff --git a/Source/WebCore/html/shadow/DateTimeSymbolicFieldElement.cpp b/Source/WebCore/html/shadow/DateTimeSymbolicFieldElement.cpp
new file mode 100644
index 000000000..08eb52229
--- /dev/null
+++ b/Source/WebCore/html/shadow/DateTimeSymbolicFieldElement.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include "DateTimeSymbolicFieldElement.h"
+
+#include "KeyboardEvent.h"
+#include <wtf/unicode/Unicode.h>
+
+namespace WebCore {
+
+DateTimeSymbolicFieldElement::DateTimeSymbolicFieldElement(Document* document, FieldEventHandler& fieldEventHandler, const Vector<String>& symbols)
+    : DateTimeFieldElement(document, fieldEventHandler)
+    , m_symbols(symbols)
+    , m_selectedIndex(-1)
+{
+    ASSERT(!symbols.isEmpty());
+}
+
+void DateTimeSymbolicFieldElement::handleKeyboardEvent(KeyboardEvent* keyboardEvent)
+{
+    if (keyboardEvent->type() != eventNames().keypressEvent)
+        return;
+
+    const UChar charCode = WTF::Unicode::toLower(keyboardEvent->charCode());
+    if (charCode < ' ')
+        return;
+
+    keyboardEvent->setDefaultHandled();
+    for (unsigned index = 0; index < m_symbols.size(); ++index) {
+        if (!m_symbols[index].isEmpty() && WTF::Unicode::toLower(m_symbols[index][0]) == charCode) {
+            setValueAsInteger(index, DispatchEvent);
+            return;
+        }
+    }
+}
+
+bool DateTimeSymbolicFieldElement::hasValue() const
+{
+    return m_selectedIndex >= 0;
+}
+
+void DateTimeSymbolicFieldElement::setEmptyValue(const DateComponents&, EventBehavior eventBehavior)
+{
+    m_selectedIndex = invalidIndex;
+    updateVisibleValue(eventBehavior);
+}
+
+void DateTimeSymbolicFieldElement::setValueAsInteger(int newSelectedIndex, EventBehavior eventBehavior)
+{
+    m_selectedIndex = std::max(0, std::min(newSelectedIndex, static_cast<int>(m_symbols.size() - 1)));
+    updateVisibleValue(eventBehavior);
+}
+
+void DateTimeSymbolicFieldElement::stepDown()
+{
+    const int size = m_symbols.size();
+    m_selectedIndex = hasValue() ? (m_selectedIndex + size - 1) % size : size - 1;
+    updateVisibleValue(DispatchEvent);
+}
+
+void DateTimeSymbolicFieldElement::stepUp()
+{
+    m_selectedIndex = hasValue() ? (m_selectedIndex + 1) % m_symbols.size() : 0;
+    updateVisibleValue(DispatchEvent);
+}
+
+String DateTimeSymbolicFieldElement::value() const
+{
+    return hasValue() ? m_symbols[m_selectedIndex] : emptyString();
+}
+
+int DateTimeSymbolicFieldElement::valueAsInteger() const
+{
+    return m_selectedIndex;
+}
+
+String DateTimeSymbolicFieldElement::visibleValue() const
+{
+    return hasValue() ? m_symbols[m_selectedIndex] : "--";
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/html/shadow/DateTimeSymbolicFieldElement.h b/Source/WebCore/html/shadow/DateTimeSymbolicFieldElement.h
new file mode 100644
index 000000000..8329dd114
--- /dev/null
+++ b/Source/WebCore/html/shadow/DateTimeSymbolicFieldElement.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef DateTimeSymbolicFieldElement_h
+#define DateTimeSymbolicFieldElement_h
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include "DateTimeFieldElement.h"
+
+namespace WebCore {
+
+// DateTimeSymbolicFieldElement represents non-numeric field of data time
+// format, such as: AM/PM, and month.
+class DateTimeSymbolicFieldElement : public DateTimeFieldElement {
+    WTF_MAKE_NONCOPYABLE(DateTimeSymbolicFieldElement);
+
+protected:
+    DateTimeSymbolicFieldElement(Document*, FieldEventHandler&, const Vector<String>&);
+    virtual void setValueAsInteger(int, EventBehavior = DispatchNoEvent) OVERRIDE FINAL;
+
+private:
+    static const int invalidIndex = -1;
+
+    // DateTimeFieldElement functions.
+    virtual void handleKeyboardEvent(KeyboardEvent*) OVERRIDE FINAL;
+    virtual bool hasValue() const OVERRIDE FINAL;
+    virtual void setEmptyValue(const DateComponents& dateForReadOnlyField, EventBehavior = DispatchNoEvent) OVERRIDE FINAL;
+    virtual void stepDown() OVERRIDE FINAL;
+    virtual void stepUp() OVERRIDE FINAL;
+    virtual String value() const OVERRIDE FINAL;
+    virtual int valueAsInteger() const OVERRIDE FINAL;
+    virtual String visibleValue() const OVERRIDE FINAL;
+
+    const Vector<String> m_symbols;
+    int m_selectedIndex;
+};
+
+} // namespace WebCore
+
+#endif
+#endif
diff --git a/Source/WebCore/html/shadow/InsertionPoint.cpp b/Source/WebCore/html/shadow/InsertionPoint.cpp
index fadbb457b..435796677 100644
--- a/Source/WebCore/html/shadow/InsertionPoint.cpp
+++ b/Source/WebCore/html/shadow/InsertionPoint.cpp
@@ -118,8 +118,10 @@ Node::InsertionNotificationRequest InsertionPoint::insertedInto(ContainerNode* i
 {
     HTMLElement::insertedInto(insertionPoint);
     if (insertionPoint->inDocument()) {
-        if (ShadowRoot* root = shadowRoot())
-            root->owner()->invalidateDistribution(ElementShadow::InvalidateAndForceReattach);
+        if (ShadowRoot* root = shadowRoot()) {
+            root->owner()->setValidityUndetermined();
+            root->owner()->invalidateDistribution();
+        }
     }
 
     return InsertionDone;
diff --git a/Source/WebCore/html/shadow/MediaControlElements.cpp b/Source/WebCore/html/shadow/MediaControlElements.cpp
index 2c4bd9e91..1b67afec3 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.cpp
+++ b/Source/WebCore/html/shadow/MediaControlElements.cpp
@@ -388,7 +388,6 @@ void MediaControlVolumeSliderContainerElement::defaultEventHandler(Event* event)
     hide();
 }
 
-
 MediaControlElementType MediaControlVolumeSliderContainerElement::displayType() const
 {
     return MediaVolumeSliderContainer;
@@ -924,7 +923,15 @@ void MediaControlTimelineElement::defaultEventHandler(Event* event)
         m_controls->updateTimeDisplay();
 }
 
-void MediaControlTimelineElement::setPosition(float currentTime) 
+bool MediaControlTimelineElement::willRespondToMouseClickEvents()
+{
+    if (!attached())
+        return false;
+
+    return true;
+}
+
+void MediaControlTimelineElement::setPosition(float currentTime)
 {
     setValue(String::number(currentTime));
 }
@@ -983,6 +990,22 @@ void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
         mediaController()->setMuted(false);
 }
 
+bool MediaControlVolumeSliderElement::willRespondToMouseMoveEvents()
+{
+    if (!attached())
+        return false;
+
+    return MediaControlInputElement::willRespondToMouseMoveEvents();
+}
+
+bool MediaControlVolumeSliderElement::willRespondToMouseClickEvents()
+{
+    if (!attached())
+        return false;
+
+    return MediaControlInputElement::willRespondToMouseClickEvents();
+}
+
 void MediaControlVolumeSliderElement::setVolume(float volume)
 {
     if (value().toFloat() != volume)
diff --git a/Source/WebCore/html/shadow/MediaControlElements.h b/Source/WebCore/html/shadow/MediaControlElements.h
index c1514e231..effdcee7f 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.h
+++ b/Source/WebCore/html/shadow/MediaControlElements.h
@@ -116,6 +116,9 @@ public:
     void makeOpaque();
     void makeTransparent();
 
+    virtual bool willRespondToMouseMoveEvents() OVERRIDE { return true; }
+    virtual bool willRespondToMouseClickEvents() OVERRIDE { return true; }
+
 private:
     MediaControlPanelElement(Document*);
     virtual MediaControlElementType displayType() const;
@@ -160,6 +163,8 @@ class MediaControlVolumeSliderContainerElement : public MediaControlElement {
 public:
     static PassRefPtr<MediaControlVolumeSliderContainerElement> create(Document*);
 
+    virtual bool willRespondToMouseMoveEvents() OVERRIDE { return true; }
+
 private:
     MediaControlVolumeSliderContainerElement(Document*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -218,11 +223,12 @@ class MediaControlMuteButtonElement : public MediaControlInputElement {
 public:
     void changedMute();
 
+    virtual bool willRespondToMouseClickEvents() OVERRIDE { return true; }
+
 protected:
     MediaControlMuteButtonElement(Document*, MediaControlElementType);
     virtual void defaultEventHandler(Event*);
 
-
 private:
     virtual void updateDisplayType();
 };
@@ -233,6 +239,8 @@ class MediaControlPanelMuteButtonElement : public MediaControlMuteButtonElement
 public:
     static PassRefPtr<MediaControlPanelMuteButtonElement> create(Document*, MediaControls*);
 
+    virtual bool willRespondToMouseMoveEvents() OVERRIDE { return true; }
+
 private:
     MediaControlPanelMuteButtonElement(Document*, MediaControls*);
 
@@ -262,6 +270,7 @@ public:
     static PassRefPtr<MediaControlPlayButtonElement> create(Document*);
 
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseClickEvents() OVERRIDE { return true; }
     virtual void updateDisplayType();
 
 private:
@@ -289,6 +298,7 @@ private:
 class MediaControlSeekButtonElement : public MediaControlInputElement {
 public:
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseClickEvents() OVERRIDE { return true; }
 
 protected:
     MediaControlSeekButtonElement(Document*, MediaControlElementType);
@@ -342,6 +352,7 @@ public:
     static PassRefPtr<MediaControlRewindButtonElement> create(Document*);
 
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseClickEvents() OVERRIDE { return true; }
 
 private:
     MediaControlRewindButtonElement(Document*);
@@ -356,6 +367,7 @@ public:
     static PassRefPtr<MediaControlReturnToRealtimeButtonElement> create(Document*);
 
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseClickEvents() OVERRIDE { return true; }
 
 private:
     MediaControlReturnToRealtimeButtonElement(Document*);
@@ -370,6 +382,7 @@ public:
     static PassRefPtr<MediaControlToggleClosedCaptionsButtonElement> create(Document*);
 
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseClickEvents() OVERRIDE { return true; }
     virtual void updateDisplayType();
 
 private:
@@ -385,6 +398,7 @@ public:
     static PassRefPtr<MediaControlTimelineElement> create(Document*, MediaControls*);
 
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
     void setPosition(float);
     void setDuration(float);
 
@@ -403,6 +417,8 @@ public:
     static PassRefPtr<MediaControlVolumeSliderElement> create(Document*);
 
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseMoveEvents() OVERRIDE;
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
     void setVolume(float);
     void setClearMutedOnUserInteraction(bool);
 
@@ -421,6 +437,7 @@ public:
     static PassRefPtr<MediaControlFullscreenButtonElement> create(Document*, MediaControls*);
 
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseClickEvents() OVERRIDE { return true; }
     void setIsFullscreen(bool);
 
 private:
@@ -448,7 +465,8 @@ public:
     static PassRefPtr<MediaControlFullscreenVolumeMinButtonElement> create(Document*);
     
     virtual void defaultEventHandler(Event*);
-    
+    virtual bool willRespondToMouseClickEvents() OVERRIDE { return true; }
+
 private:
     MediaControlFullscreenVolumeMinButtonElement(Document*);
     
@@ -462,7 +480,8 @@ public:
     static PassRefPtr<MediaControlFullscreenVolumeMaxButtonElement> create(Document*);
     
     virtual void defaultEventHandler(Event*);
-    
+    virtual bool willRespondToMouseClickEvents() OVERRIDE { return true; }
+
 private:
     MediaControlFullscreenVolumeMaxButtonElement(Document*);
     
diff --git a/Source/WebCore/html/shadow/MediaControlRootElement.h b/Source/WebCore/html/shadow/MediaControlRootElement.h
index f9f475c2e..5ce6ac7ea 100644
--- a/Source/WebCore/html/shadow/MediaControlRootElement.h
+++ b/Source/WebCore/html/shadow/MediaControlRootElement.h
@@ -114,6 +114,8 @@ public:
 
     void bufferingProgressed();
 
+    virtual bool willRespondToMouseMoveEvents() OVERRIDE { return true; }
+
 private:
     MediaControlRootElement(Document*);
 
diff --git a/Source/WebCore/html/shadow/ProgressShadowElement.cpp b/Source/WebCore/html/shadow/ProgressShadowElement.cpp
index 800f22351..465d5ba8f 100644
--- a/Source/WebCore/html/shadow/ProgressShadowElement.cpp
+++ b/Source/WebCore/html/shadow/ProgressShadowElement.cpp
@@ -34,22 +34,20 @@
 #if ENABLE(PROGRESS_ELEMENT)
 #include "HTMLNames.h"
 #include "HTMLProgressElement.h"
-#include "RenderObject.h"
+#include "RenderProgress.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-ProgressShadowElement::ProgressShadowElement(Document* document) 
+ProgressShadowElement::ProgressShadowElement(Document* document)
     : HTMLDivElement(HTMLNames::divTag, document)
 {
 }
 
 HTMLProgressElement* ProgressShadowElement::progressElement() const
 {
-    Element* element = shadowHost();
-    ASSERT(!element || element->hasTagName(progressTag));
-    return static_cast<HTMLProgressElement*>(element);
+    return toHTMLProgressElement(shadowHost());
 }
 
 bool ProgressShadowElement::rendererIsNeeded(const NodeRenderingContext& context)
@@ -58,6 +56,36 @@ bool ProgressShadowElement::rendererIsNeeded(const NodeRenderingContext& context
     return progressRenderer && !progressRenderer->style()->hasAppearance() && HTMLDivElement::rendererIsNeeded(context);
 }
 
+ProgressInnerElement::ProgressInnerElement(Document* document)
+    : ProgressShadowElement(document)
+{    
+}
+
+PassRefPtr<ProgressInnerElement> ProgressInnerElement::create(Document* document)
+{
+    return adoptRef(new ProgressInnerElement(document));
+}
+
+const AtomicString& ProgressInnerElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, pseudId, ("-webkit-progress-inner-element"));
+    return pseudId;
+}
+
+RenderObject* ProgressInnerElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderProgress(this);
+}
+
+bool ProgressInnerElement::rendererIsNeeded(const NodeRenderingContext& context)
+{
+    if (progressElement()->hasAuthorShadowRoot())
+        return HTMLDivElement::rendererIsNeeded(context);
+
+    RenderObject* progressRenderer = progressElement()->renderer();
+    return progressRenderer && !progressRenderer->style()->hasAppearance() && HTMLDivElement::rendererIsNeeded(context);    
+}
+
 const AtomicString& ProgressBarElement::shadowPseudoId() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, pseudId, ("-webkit-progress-bar"));
diff --git a/Source/WebCore/html/shadow/ProgressShadowElement.h b/Source/WebCore/html/shadow/ProgressShadowElement.h
index aff94fba3..4d03e43ab 100644
--- a/Source/WebCore/html/shadow/ProgressShadowElement.h
+++ b/Source/WebCore/html/shadow/ProgressShadowElement.h
@@ -45,7 +45,18 @@ public:
     ProgressShadowElement(Document*);
     HTMLProgressElement* progressElement() const;
 
+protected:
+    virtual bool rendererIsNeeded(const NodeRenderingContext&);
+};
+
+class ProgressInnerElement : public ProgressShadowElement {
+public:
+    ProgressInnerElement(Document*);
+
+    static PassRefPtr<ProgressInnerElement> create(Document*);
 private:
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
+    virtual const AtomicString& shadowPseudoId() const;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 };
 
@@ -65,7 +76,6 @@ inline PassRefPtr<ProgressBarElement> ProgressBarElement::create(Document* docum
     return adoptRef(new ProgressBarElement(document));
 }
 
-
 class ProgressValueElement : public ProgressShadowElement {
 public:
     ProgressValueElement(Document* document) 
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index cccad81ef..baca86c7b 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -51,6 +51,8 @@ using namespace std;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 inline static Decimal sliderPosition(HTMLInputElement* element)
 {
     const StepRange stepRange(element->createStepRange(RejectAny));
@@ -214,9 +216,14 @@ bool SliderThumbElement::isEnabledFormControl() const
     return hostInput()->isEnabledFormControl();
 }
 
-bool SliderThumbElement::isReadOnlyFormControl() const
+bool SliderThumbElement::shouldMatchReadOnlySelector() const
 {
-    return hostInput()->isReadOnlyFormControl();
+    return hostInput()->shouldMatchReadOnlySelector();
+}
+
+bool SliderThumbElement::shouldMatchReadWriteSelector() const
+{
+    return hostInput()->shouldMatchReadWriteSelector();
 }
 
 Node* SliderThumbElement::focusDelegate()
@@ -265,7 +272,21 @@ void SliderThumbElement::setPositionFromPoint(const LayoutPoint& point)
     const Decimal ratio = Decimal::fromDouble(static_cast<double>(position) / trackSize);
     const Decimal fraction = isVertical || !renderBox()->style()->isLeftToRightDirection() ? Decimal(1) - ratio : ratio;
     StepRange stepRange(input->createStepRange(RejectAny));
-    const Decimal value = stepRange.clampValue(stepRange.valueFromProportion(fraction));
+    Decimal value = stepRange.clampValue(stepRange.valueFromProportion(fraction));
+
+#if ENABLE(DATALIST_ELEMENT)
+    const LayoutUnit snappingThreshold = renderer()->theme()->sliderTickSnappingThreshold();
+    if (snappingThreshold > 0) {
+        Decimal closest = input->findClosestTickMarkValue(value);
+        if (closest.isFinite()) {
+            double closestFraction = stepRange.proportionFromValue(closest).toDouble();
+            double closestRatio = isVertical || !renderBox()->style()->isLeftToRightDirection() ? 1.0 - closestFraction : closestFraction;
+            LayoutUnit closestPosition = trackSize * closestRatio;
+            if ((closestPosition - position).abs() <= snappingThreshold)
+                value = closest;
+        }
+    }
+#endif
 
     // FIXME: This is no longer being set from renderer. Consider updating the method name.
     input->setValueFromRenderer(serializeForNumberType(value));
@@ -303,7 +324,7 @@ void SliderThumbElement::defaultEventHandler(Event* event)
     // FIXME: Should handle this readonly/disabled check in more general way.
     // Missing this kind of check is likely to occur elsewhere if adding it in each shadow element.
     HTMLInputElement* input = hostInput();
-    if (!input || input->isReadOnlyFormControl() || !input->isEnabledFormControl()) {
+    if (!input || input->readOnly() || !input->isEnabledFormControl()) {
         stopDragging();
         HTMLDivElement::defaultEventHandler(event);
         return;
@@ -331,6 +352,24 @@ void SliderThumbElement::defaultEventHandler(Event* event)
     HTMLDivElement::defaultEventHandler(event);
 }
 
+bool SliderThumbElement::willRespondToMouseMoveEvents()
+{
+    const HTMLInputElement* input = hostInput();
+    if (input && !input->readOnly() && input->isEnabledFormControl() && m_inDragMode)
+        return true;
+
+    return HTMLDivElement::willRespondToMouseMoveEvents();
+}
+
+bool SliderThumbElement::willRespondToMouseClickEvents()
+{
+    const HTMLInputElement* input = hostInput();
+    if (input && !input->readOnly() && input->isEnabledFormControl())
+        return true;
+
+    return HTMLDivElement::willRespondToMouseClickEvents();
+}
+
 void SliderThumbElement::detach()
 {
     if (m_inDragMode) {
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.h b/Source/WebCore/html/shadow/SliderThumbElement.h
index 36d64186f..04e41c7bf 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.h
+++ b/Source/WebCore/html/shadow/SliderThumbElement.h
@@ -54,6 +54,8 @@ public:
 
     void dragFrom(const LayoutPoint&);
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseMoveEvents() OVERRIDE;
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
     virtual void detach();
     virtual const AtomicString& shadowPseudoId() const;
     HTMLInputElement* hostInput() const;
@@ -64,7 +66,8 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual PassRefPtr<Element> cloneElementWithoutAttributesAndChildren();
     virtual bool isEnabledFormControl() const;
-    virtual bool isReadOnlyFormControl() const;
+    virtual bool shouldMatchReadOnlySelector() const OVERRIDE;
+    virtual bool shouldMatchReadWriteSelector() const OVERRIDE;
     virtual Node* focusDelegate();
     void startDragging();
     void stopDragging();
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index e3097bb5e..e06d56f2f 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -165,6 +165,11 @@ void SearchFieldResultsButtonElement::defaultEventHandler(Event* event)
         HTMLDivElement::defaultEventHandler(event);
 }
 
+bool SearchFieldResultsButtonElement::willRespondToMouseClickEvents()
+{
+    return true;
+}
+
 // ----------------------------
 
 inline SearchFieldCancelButtonElement::SearchFieldCancelButtonElement(Document* document)
@@ -198,7 +203,7 @@ void SearchFieldCancelButtonElement::defaultEventHandler(Event* event)
 {
     // If the element is visible, on mouseup, clear the value, and set selection
     RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowHost()));
-    if (input->disabled() || input->isReadOnlyFormControl()) {
+    if (input->disabled() || input->readOnly()) {
         if (!event->defaultHandled())
             HTMLDivElement::defaultEventHandler(event);
         return;
@@ -234,6 +239,15 @@ void SearchFieldCancelButtonElement::defaultEventHandler(Event* event)
         HTMLDivElement::defaultEventHandler(event);
 }
 
+bool SearchFieldCancelButtonElement::willRespondToMouseClickEvents()
+{
+    const HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
+    if (!input->disabled() && !input->readOnly())
+        return true;
+
+    return HTMLDivElement::willRespondToMouseClickEvents();
+}
+
 // ----------------------------
 
 inline SpinButtonElement::SpinButtonElement(Document* document, StepActionHandler& stepActionHandler)
@@ -279,7 +293,7 @@ void SpinButtonElement::defaultEventHandler(Event* event)
     }
 
     RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowHost()));
-    if (input->disabled() || input->isReadOnlyFormControl()) {
+    if (input->disabled() || input->readOnly()) {
         if (!event->defaultHandled())
             HTMLDivElement::defaultEventHandler(event);
         return;
@@ -328,6 +342,24 @@ void SpinButtonElement::defaultEventHandler(Event* event)
         HTMLDivElement::defaultEventHandler(event);
 }
 
+bool SpinButtonElement::willRespondToMouseMoveEvents()
+{
+    const HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
+    if (renderBox() && !input->disabled() && !input->readOnly())
+        return true;
+
+    return HTMLDivElement::willRespondToMouseMoveEvents();
+}
+
+bool SpinButtonElement::willRespondToMouseClickEvents()
+{
+    const HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
+    if (renderBox() && !input->disabled() && !input->readOnly())
+        return true;
+
+    return HTMLDivElement::willRespondToMouseClickEvents();
+}
+
 void SpinButtonElement::doStepAction(int amount)
 {
     if (!m_stepActionHandler)
@@ -350,6 +382,16 @@ void SpinButtonElement::releaseCapture()
     }
 }
 
+bool SpinButtonElement::shouldMatchReadOnlySelector() const
+{
+    return shadowHost()->shouldMatchReadOnlySelector();
+}
+
+bool SpinButtonElement::shouldMatchReadWriteSelector() const
+{
+    return shadowHost()->shouldMatchReadWriteSelector();
+}
+
 void SpinButtonElement::startRepeatingTimer()
 {
     m_pressStartingState = m_upDownState;
@@ -365,7 +407,7 @@ void SpinButtonElement::stopRepeatingTimer()
 void SpinButtonElement::step(int amount)
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
-    if (input->disabled() || input->isReadOnlyFormControl())
+    if (input->disabled() || input->readOnly())
         return;
     // On Mac OS, NSStepper updates the value for the button under the mouse
     // cursor regardless of the button pressed at the beginning. So the
@@ -431,7 +473,7 @@ void InputFieldSpeechButtonElement::defaultEventHandler(Event* event)
     // here, we take a temporary reference.
     RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowHost()));
 
-    if (input->disabled() || input->isReadOnlyFormControl()) {
+    if (input->disabled() || input->readOnly()) {
         if (!event->defaultHandled())
             HTMLDivElement::defaultEventHandler(event);
         return;
@@ -479,6 +521,15 @@ void InputFieldSpeechButtonElement::defaultEventHandler(Event* event)
         HTMLDivElement::defaultEventHandler(event);
 }
 
+bool InputFieldSpeechButtonElement::willRespondToMouseClickEvents()
+{
+    const HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
+    if (!input->disabled() && !input->readOnly())
+        return true;
+
+    return HTMLDivElement::willRespondToMouseClickEvents();
+}
+
 void InputFieldSpeechButtonElement::setState(SpeechInputState state)
 {
     if (m_state != state) {
@@ -510,7 +561,7 @@ void InputFieldSpeechButtonElement::setRecognitionResult(int, const SpeechInputR
     // remove the input element from DOM. To make sure it remains valid until we finish our work
     // here, we take a temporary reference.
     RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowHost()));
-    if (input->disabled() || input->isReadOnlyFormControl())
+    if (input->disabled() || input->readOnly())
         return;
 
     RefPtr<InputFieldSpeechButtonElement> holdRefButton(this);
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.h b/Source/WebCore/html/shadow/TextControlInnerElements.h
index 33d5890a9..6336dcb63 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.h
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.h
@@ -66,6 +66,7 @@ public:
     static PassRefPtr<SearchFieldResultsButtonElement> create(Document*);
 
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
 
 private:
     SearchFieldResultsButtonElement(Document*);
@@ -78,6 +79,7 @@ public:
     static PassRefPtr<SearchFieldCancelButtonElement> create(Document*);
 
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
 
 private:
     SearchFieldCancelButtonElement(Document*);
@@ -113,6 +115,9 @@ public:
 
     void step(int amount);
     
+    virtual bool willRespondToMouseMoveEvents() OVERRIDE;
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
+
 private:
     SpinButtonElement(Document*, StepActionHandler&);
 
@@ -120,7 +125,8 @@ private:
     virtual void detach();
     virtual bool isSpinButtonElement() const { return true; }
     virtual bool isEnabledFormControl() const { return shadowHost()->isEnabledFormControl(); }
-    virtual bool isReadOnlyFormControl() const { return shadowHost()->isReadOnlyFormControl(); }
+    virtual bool shouldMatchReadOnlySelector() const OVERRIDE;
+    virtual bool shouldMatchReadWriteSelector() const OVERRIDE;
     virtual void defaultEventHandler(Event*);
     void doStepAction(int);
     void startRepeatingTimer();
@@ -153,6 +159,7 @@ public:
 
     virtual void detach();
     virtual void defaultEventHandler(Event*);
+    virtual bool willRespondToMouseClickEvents();
     virtual bool isInputFieldSpeechButtonElement() const { return true; }
     SpeechInputState state() const { return m_state; }
     void startSpeechInput();
diff --git a/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp b/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp
index 09cc7b1d4..689aa0ad2 100644
--- a/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp
+++ b/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp
@@ -198,4 +198,13 @@ void TextFieldDecorationElement::defaultEventHandler(Event* event)
         HTMLDivElement::defaultEventHandler(event);
 }
 
+bool TextFieldDecorationElement::willRespondToMouseClickEvents()
+{
+    const HTMLInputElement* input = hostInput();
+    if (!input->disabled() && !input->readOnly())
+        return true;
+
+    return HTMLDivElement::willRespondToMouseClickEvents();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/html/shadow/TextFieldDecorationElement.h b/Source/WebCore/html/shadow/TextFieldDecorationElement.h
index f2c827a45..2c8d822b3 100644
--- a/Source/WebCore/html/shadow/TextFieldDecorationElement.h
+++ b/Source/WebCore/html/shadow/TextFieldDecorationElement.h
@@ -71,6 +71,8 @@ public:
     TextFieldDecorator* textFieldDecorator() { return m_textFieldDecorator; }
     void decorate(HTMLInputElement*, bool visible);
 
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
+
 private:
     TextFieldDecorationElement(Document*, TextFieldDecorator*);
     virtual bool isTextFieldDecoration() const OVERRIDE;
diff --git a/Source/WebCore/html/track/TextTrack.cpp b/Source/WebCore/html/track/TextTrack.cpp
index a6e7f844c..75d763cdd 100644
--- a/Source/WebCore/html/track/TextTrack.cpp
+++ b/Source/WebCore/html/track/TextTrack.cpp
@@ -198,6 +198,10 @@ void TextTrack::addCue(PassRefPtr<TextTrackCue> prpCue, ExceptionCode& ec)
 
     RefPtr<TextTrackCue> cue = prpCue;
 
+    // TODO(93143): Add spec-compliant behavior for negative time values.
+    if (cue->startTime() < 0 || cue->endTime() < 0)
+        return;
+
     // 4.8.10.12.4 Text track API
 
     // The addCue(cue) method of TextTrack objects, when invoked, must run the following steps:
diff --git a/Source/WebCore/html/track/TextTrackCue.cpp b/Source/WebCore/html/track/TextTrackCue.cpp
index d2de4d3e5..7973fc5f5 100644
--- a/Source/WebCore/html/track/TextTrackCue.cpp
+++ b/Source/WebCore/html/track/TextTrackCue.cpp
@@ -168,7 +168,8 @@ void TextTrackCue::setId(const String& id)
 
 void TextTrackCue::setStartTime(double value)
 {
-    if (m_startTime == value)
+    // TODO(93143): Add spec-compliant behavior for negative time values.
+    if (m_startTime == value || value < 0)
         return;
     
     cueWillChange();
@@ -178,7 +179,8 @@ void TextTrackCue::setStartTime(double value)
     
 void TextTrackCue::setEndTime(double value)
 {
-    if (m_endTime == value)
+    // TODO(93143): Add spec-compliant behavior for negative time values.
+    if (m_endTime == value || value < 0)
         return;
     
     cueWillChange();
diff --git a/Source/WebCore/html/track/TextTrackCueList.cpp b/Source/WebCore/html/track/TextTrackCueList.cpp
index 391b2f651..45ef441b1 100644
--- a/Source/WebCore/html/track/TextTrackCueList.cpp
+++ b/Source/WebCore/html/track/TextTrackCueList.cpp
@@ -77,6 +77,9 @@ TextTrackCueList* TextTrackCueList::activeCues()
 
 bool TextTrackCueList::add(PassRefPtr<TextTrackCue> cue)
 {
+    ASSERT(cue->startTime() >= 0);
+    ASSERT(cue->endTime() >= 0);
+
     return add(cue, 0, m_list.size());
 }
 
diff --git a/Source/WebCore/inspector/CodeGeneratorInspector.py b/Source/WebCore/inspector/CodeGeneratorInspector.py
index ec3812b16..0921fa9ce 100755
--- a/Source/WebCore/inspector/CodeGeneratorInspector.py
+++ b/Source/WebCore/inspector/CodeGeneratorInspector.py
@@ -237,29 +237,11 @@ class RawTypes(object):
         @classmethod
         def request_raw_internal_runtime_cast(cls):
             if not cls.need_internal_runtime_cast_:
-                RawTypes.types_to_generate_validator_.append(cls)
                 cls.need_internal_runtime_cast_ = True
 
         @classmethod
-        def generate_validate_method(cls, writer):
-            params = cls.get_validate_method_params()
-            writer.newline("static void assert%s(InspectorValue* value)\n" % params.name)
-            writer.newline("{\n")
-            writer.newline("    ASSERT(value->type() == InspectorValue::Type%s);\n" % params.as_method_name)
-            writer.newline("}\n\n\n")
-
-        @classmethod
         def get_raw_validator_call_text(cls):
-            return "assert%s" % cls.get_validate_method_params().name
-
-    types_to_generate_validator_ = []
-
-    @classmethod
-    def generate_validate_methods(cls, writer):
-        for t in cls.types_to_generate_validator_:
-            if t.need_internal_runtime_cast_:
-                t.generate_validate_method(writer)
-
+            return "RuntimeCastHelper::assertType<InspectorValue::Type%s>" % cls.get_validate_method_params().template_type
 
     class String(BaseType):
         @staticmethod
@@ -279,8 +261,7 @@ class RawTypes(object):
         @staticmethod
         def get_validate_method_params():
             class ValidateMethodParams:
-                name = "String"
-                as_method_name = "String"
+                template_type = "String"
             return ValidateMethodParams
 
         @staticmethod
@@ -317,18 +298,8 @@ class RawTypes(object):
             return "number"
 
         @classmethod
-        def generate_validate_method(cls, writer):
-            writer.newline("static void assertInt(InspectorValue* value)\n")
-            writer.newline("{\n")
-            writer.newline("    double v;\n")
-            writer.newline("    bool castRes = value->asNumber(&v);\n")
-            writer.newline("    ASSERT_UNUSED(castRes, castRes);\n")
-            writer.newline("    ASSERT(static_cast<double>(static_cast<int>(v)) == v);\n")
-            writer.newline("}\n\n\n")
-
-        @classmethod
         def get_raw_validator_call_text(cls):
-            return "assertInt"
+            return "RuntimeCastHelper::assertInt"
 
         @staticmethod
         def get_output_pass_model():
@@ -366,8 +337,7 @@ class RawTypes(object):
         @staticmethod
         def get_validate_method_params():
             class ValidateMethodParams:
-                name = "Double"
-                as_method_name = "Number"
+                template_type = "Number"
             return ValidateMethodParams
 
         @staticmethod
@@ -404,8 +374,7 @@ class RawTypes(object):
         @staticmethod
         def get_validate_method_params():
             class ValidateMethodParams:
-                name = "Boolean"
-                as_method_name = "Boolean"
+                template_type = "Boolean"
             return ValidateMethodParams
 
         @staticmethod
@@ -448,8 +417,7 @@ class RawTypes(object):
         @staticmethod
         def get_validate_method_params():
             class ValidateMethodParams:
-                name = "Object"
-                as_method_name = "Object"
+                template_type = "Object"
             return ValidateMethodParams
 
         @staticmethod
@@ -484,15 +452,8 @@ class RawTypes(object):
             raise Exception("Unsupported")
 
         @staticmethod
-        def generate_validate_method(writer):
-            writer.newline("static void assertAny(InspectorValue*)\n")
-            writer.newline("{\n")
-            writer.newline("    // No-op.\n")
-            writer.newline("}\n\n\n")
-
-        @staticmethod
         def get_raw_validator_call_text():
-            return "assertAny"
+            return "RuntimeCastHelper::assertAny"
 
         @staticmethod
         def get_output_pass_model():
@@ -533,7 +494,9 @@ class RawTypes(object):
 
         @staticmethod
         def get_validate_method_params():
-            raise Exception("TODO")
+            class ValidateMethodParams:
+                template_type = "Array"
+            return ValidateMethodParams
 
         @staticmethod
         def get_output_pass_model():
@@ -1452,7 +1415,7 @@ class TypeBindings:
 
                     @staticmethod
                     def get_validator_call_text():
-                        return "assertObject"
+                        return "RuntimeCastHelper::assertType<InspectorValue::TypeObject>"
 
                     @classmethod
                     def get_array_item_c_type_text(cls):
@@ -2267,6 +2230,19 @@ inline int ExactlyInt::cast_to_int<int>(int i) { return i; }
 template<>
 inline int ExactlyInt::cast_to_int<unsigned int>(unsigned int i) { return i; }
 
+class RuntimeCastHelper {
+public:
+#if !ASSERT_DISABLED
+    template<InspectorValue::Type TYPE>
+    static void assertType(InspectorValue* value)
+    {
+        ASSERT(value->type() == TYPE);
+    }
+    static void assertAny(InspectorValue*);
+    static void assertInt(InspectorValue* value);
+#endif
+};
+
 
 // This class provides "Traits" type for the input type T. It is programmed using C++ template specialization
 // technique. By default it simply takes "ItemTraits" type from T, but it doesn't work with the base types.
@@ -2332,10 +2308,12 @@ struct StructItemTraits {
         array->pushValue(value);
     }
 
+#if """ + VALIDATOR_IFDEF_NAME + """
     template<typename T>
     static void assertCorrectValue(InspectorValue* value) {
         T::assertCorrectValue(value);
     }
+#endif  // !ASSERT_DISABLED
 };
 
 template<>
@@ -2345,6 +2323,13 @@ struct ArrayItemHelper<String> {
         {
             array->pushString(value);
         }
+
+#if """ + VALIDATOR_IFDEF_NAME + """
+        template<typename T>
+        static void assertCorrectValue(InspectorValue* value) {
+            RuntimeCastHelper::assertType<InspectorValue::TypeString>(value);
+        }
+#endif  // !ASSERT_DISABLED
     };
 };
 
@@ -2355,6 +2340,47 @@ struct ArrayItemHelper<int> {
         {
             array->pushInt(value);
         }
+
+#if """ + VALIDATOR_IFDEF_NAME + """
+        template<typename T>
+        static void assertCorrectValue(InspectorValue* value) {
+            RuntimeCastHelper::assertInt(value);
+        }
+#endif  // !ASSERT_DISABLED
+    };
+};
+
+template<>
+struct ArrayItemHelper<double> {
+    struct Traits {
+        static void pushRaw(InspectorArray* array, double value)
+        {
+            array->pushNumber(value);
+        }
+
+#if """ + VALIDATOR_IFDEF_NAME + """
+        template<typename T>
+        static void assertCorrectValue(InspectorValue* value) {
+            RuntimeCastHelper::assertType<InspectorValue::TypeNumber>(value);
+        }
+#endif  // !ASSERT_DISABLED
+    };
+};
+
+template<>
+struct ArrayItemHelper<bool> {
+    struct Traits {
+        static void pushRaw(InspectorArray* array, bool value)
+        {
+            array->pushBoolean(value);
+        }
+
+#if """ + VALIDATOR_IFDEF_NAME + """
+        template<typename T>
+        static void assertCorrectValue(InspectorValue* value) {
+            RuntimeCastHelper::assertType<InspectorValue::TypeBoolean>(value);
+        }
+#endif  // !ASSERT_DISABLED
     };
 };
 
@@ -2365,6 +2391,13 @@ struct ArrayItemHelper<InspectorValue> {
         {
             array->pushValue(value);
         }
+
+#if """ + VALIDATOR_IFDEF_NAME + """
+        template<typename T>
+        static void assertCorrectValue(InspectorValue* value) {
+            RuntimeCastHelper::assertAny(value);
+        }
+#endif  // !ASSERT_DISABLED
     };
 };
 
@@ -2375,6 +2408,30 @@ struct ArrayItemHelper<InspectorObject> {
         {
             array->pushValue(value);
         }
+
+#if """ + VALIDATOR_IFDEF_NAME + """
+        template<typename T>
+        static void assertCorrectValue(InspectorValue* value) {
+            RuntimeCastHelper::assertType<InspectorValue::TypeObject>(value);
+        }
+#endif  // !ASSERT_DISABLED
+    };
+};
+
+template<>
+struct ArrayItemHelper<InspectorArray> {
+    struct Traits {
+        static void pushRefPtr(InspectorArray* array, PassRefPtr<InspectorArray> value)
+        {
+            array->pushArray(value);
+        }
+
+#if """ + VALIDATOR_IFDEF_NAME + """
+        template<typename T>
+        static void assertCorrectValue(InspectorValue* value) {
+            RuntimeCastHelper::assertType<InspectorValue::TypeArray>(value);
+        }
+#endif  // !ASSERT_DISABLED
     };
 };
 
@@ -2385,6 +2442,13 @@ struct ArrayItemHelper<TypeBuilder::Array<T> > {
         {
             array->pushValue(value);
         }
+
+#if """ + VALIDATOR_IFDEF_NAME + """
+        template<typename S>
+        static void assertCorrectValue(InspectorValue* value) {
+            S::assertCorrectValue(value);
+        }
+#endif  // !ASSERT_DISABLED
     };
 };
 
@@ -2429,6 +2493,20 @@ $implCode
 
 #if """ + VALIDATOR_IFDEF_NAME + """
 
+void TypeBuilder::RuntimeCastHelper::assertAny(InspectorValue*)
+{
+    // No-op.
+}
+
+
+void TypeBuilder::RuntimeCastHelper::assertInt(InspectorValue* value)
+{
+    double v;
+    bool castRes = value->asNumber(&v);
+    ASSERT_UNUSED(castRes, castRes);
+    ASSERT(static_cast<double>(static_cast<int>(v)) == v);
+}
+
 $validatorCode
 
 #endif // """ + VALIDATOR_IFDEF_NAME + """
@@ -2545,14 +2623,11 @@ class Generator:
     type_builder_fragments = []
     type_builder_forwards = []
     validator_impl_list = []
-    validator_impl_raw_types_list = []
     type_builder_impl_list = []
 
 
     @staticmethod
     def go():
-        Generator.validator_impl_list.append(Generator.validator_impl_raw_types_list)
-
         Generator.process_types(type_map)
 
         first_cycle_guardable_list_list = [
@@ -2625,8 +2700,6 @@ class Generator:
                     domain_guard.generate_close(l)
             Generator.backend_js_domain_initializer_list.append("\n")
 
-        RawTypes.generate_validate_methods(Writer(Generator.validator_impl_raw_types_list, ""))
-
     @staticmethod
     def process_event(json_event, domain_name, frontend_method_declaration_lines):
         event_name = json_event["name"]
diff --git a/Source/WebCore/inspector/ConsoleMessage.cpp b/Source/WebCore/inspector/ConsoleMessage.cpp
index 0aa982899..801755390 100644
--- a/Source/WebCore/inspector/ConsoleMessage.cpp
+++ b/Source/WebCore/inspector/ConsoleMessage.cpp
@@ -133,7 +133,7 @@ static TypeBuilder::Console::ConsoleMessage::Level::Enum messageLevelValue(Messa
     return TypeBuilder::Console::ConsoleMessage::Level::Log;
 }
 
-void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, InjectedScriptManager* injectedScriptManager)
+void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, InjectedScriptManager* injectedScriptManager, bool generatePreview)
 {
     RefPtr<TypeBuilder::Console::ConsoleMessage> jsonObj = TypeBuilder::Console::ConsoleMessage::create()
         .setSource(messageSourceValue(m_source))
@@ -151,7 +151,7 @@ void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, Injecte
         if (!injectedScript.hasNoValue()) {
             RefPtr<TypeBuilder::Array<TypeBuilder::Runtime::RemoteObject> > jsonArgs = TypeBuilder::Array<TypeBuilder::Runtime::RemoteObject>::create();
             for (unsigned i = 0; i < m_arguments->argumentCount(); ++i) {
-                RefPtr<TypeBuilder::Runtime::RemoteObject> inspectorValue = injectedScript.wrapObject(m_arguments->argumentAt(i), "console");
+                RefPtr<TypeBuilder::Runtime::RemoteObject> inspectorValue = injectedScript.wrapObject(m_arguments->argumentAt(i), "console", generatePreview);
                 if (!inspectorValue) {
                     ASSERT_NOT_REACHED();
                     return;
diff --git a/Source/WebCore/inspector/ConsoleMessage.h b/Source/WebCore/inspector/ConsoleMessage.h
index bd1abf593..6461db720 100644
--- a/Source/WebCore/inspector/ConsoleMessage.h
+++ b/Source/WebCore/inspector/ConsoleMessage.h
@@ -56,7 +56,7 @@ public:
     ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, const String& responseUrl, const String& requestId);
     ~ConsoleMessage();
 
-    void addToFrontend(InspectorFrontend::Console*, InjectedScriptManager*);
+    void addToFrontend(InspectorFrontend::Console*, InjectedScriptManager*, bool generatePreview);
     void updateRepeatCountInConsole(InspectorFrontend::Console*);
     void incrementCount() { ++m_repeatCount; }
     bool isEqual(ConsoleMessage* msg) const;
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index aa9ada2a8..599668866 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -180,13 +180,14 @@ PassRefPtr<Array<CallFrame> > InjectedScript::wrapCallFrames(const ScriptValue&
 }
 #endif
 
-PassRefPtr<TypeBuilder::Runtime::RemoteObject> InjectedScript::wrapObject(const ScriptValue& value, const String& groupName) const
+PassRefPtr<TypeBuilder::Runtime::RemoteObject> InjectedScript::wrapObject(const ScriptValue& value, const String& groupName, bool generatePreview) const
 {
     ASSERT(!hasNoValue());
     ScriptFunctionCall wrapFunction(injectedScriptObject(), "wrapObject");
     wrapFunction.appendArgument(value);
     wrapFunction.appendArgument(groupName);
     wrapFunction.appendArgument(canAccessInspectedWindow());
+    wrapFunction.appendArgument(generatePreview);
     bool hadException = false;
     ScriptValue r = callFunctionWithEvalEnabled(wrapFunction, hadException);
     if (hadException) {
diff --git a/Source/WebCore/inspector/InjectedScript.h b/Source/WebCore/inspector/InjectedScript.h
index dbb1a22bd..44274278d 100644
--- a/Source/WebCore/inspector/InjectedScript.h
+++ b/Source/WebCore/inspector/InjectedScript.h
@@ -86,7 +86,7 @@ public:
     PassRefPtr<TypeBuilder::Array<TypeBuilder::Debugger::CallFrame> > wrapCallFrames(const ScriptValue&);
 #endif
 
-    PassRefPtr<TypeBuilder::Runtime::RemoteObject> wrapObject(const ScriptValue&, const String& groupName) const;
+    PassRefPtr<TypeBuilder::Runtime::RemoteObject> wrapObject(const ScriptValue&, const String& groupName, bool generatePreview = false) const;
     PassRefPtr<TypeBuilder::Runtime::RemoteObject> wrapNode(Node*, const String& groupName);
     PassRefPtr<TypeBuilder::Runtime::RemoteObject> wrapSerializedObject(SerializedScriptValue*, const String& groupName) const;
     ScriptValue findObjectById(const String& objectId) const;
diff --git a/Source/WebCore/inspector/InjectedScriptHost.cpp b/Source/WebCore/inspector/InjectedScriptHost.cpp
index e49f993d3..2e634d44b 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.cpp
+++ b/Source/WebCore/inspector/InjectedScriptHost.cpp
@@ -120,7 +120,7 @@ void InjectedScriptHost::clearConsoleMessages()
 
 void InjectedScriptHost::copyText(const String& text)
 {
-    Pasteboard::generalPasteboard()->writePlainText(text);
+    Pasteboard::generalPasteboard()->writePlainText(text, Pasteboard::CannotSmartReplace);
 }
 
 ScriptValue InjectedScriptHost::InspectableObject::get(ScriptState*)
diff --git a/Source/WebCore/inspector/InjectedScriptSource.js b/Source/WebCore/inspector/InjectedScriptSource.js
index 0335c9868..069b7c003 100644
--- a/Source/WebCore/inspector/InjectedScriptSource.js
+++ b/Source/WebCore/inspector/InjectedScriptSource.js
@@ -71,12 +71,13 @@ InjectedScript.prototype = {
      * @param {*} object
      * @param {string} groupName
      * @param {boolean} canAccessInspectedWindow
+     * @param {boolean} generatePreview
      * @return {Object}
      */
-    wrapObject: function(object, groupName, canAccessInspectedWindow)
+    wrapObject: function(object, groupName, canAccessInspectedWindow, generatePreview)
     {
         if (canAccessInspectedWindow)
-            return this._wrapObject(object, groupName);
+            return this._wrapObject(object, groupName, false, generatePreview);
 
         var result = {};
         result.type = typeof object;
@@ -128,12 +129,13 @@ InjectedScript.prototype = {
      * @param {*} object
      * @param {string=} objectGroupName
      * @param {boolean=} forceValueType
+     * @param {boolean=} generatePreview
      * @return {InjectedScript.RemoteObject}
      */
-    _wrapObject: function(object, objectGroupName, forceValueType)
+    _wrapObject: function(object, objectGroupName, forceValueType, generatePreview)
     {
         try {
-            return new InjectedScript.RemoteObject(object, objectGroupName, forceValueType);
+            return new InjectedScript.RemoteObject(object, objectGroupName, forceValueType, generatePreview);
         } catch (e) {
             try {
                 var description = injectedScript._describe(e);
@@ -404,7 +406,7 @@ InjectedScript.prototype = {
     {
         try {
             return { wasThrown: false,
-                     result: this._wrapObject(this._evaluateOn(evalFunction, object, expression, isEvalOnCallFrame, injectCommandLineAPI), objectGroup, returnByValue) };
+                     result: this._wrapObject(this._evaluateOn(evalFunction, object, objectGroup, expression, isEvalOnCallFrame, injectCommandLineAPI), objectGroup, returnByValue, false) };
         } catch (e) {
             return this._createThrownValue(e, objectGroup);
         }
@@ -428,12 +430,13 @@ InjectedScript.prototype = {
     /**
      * @param {Function} evalFunction
      * @param {Object} object
+     * @param {string} objectGroup
      * @param {string} expression
      * @param {boolean} isEvalOnCallFrame
      * @param {boolean} injectCommandLineAPI
      * @return {*}
      */
-    _evaluateOn: function(evalFunction, object, expression, isEvalOnCallFrame, injectCommandLineAPI)
+    _evaluateOn: function(evalFunction, object, objectGroup, expression, isEvalOnCallFrame, injectCommandLineAPI)
     {
         // Only install command line api object for the time of evaluation.
         // Surround the expression in with statements to inject our command line API so that
@@ -444,7 +447,10 @@ InjectedScript.prototype = {
                 inspectedWindow.console._commandLineAPI = new CommandLineAPI(this._commandLineAPIImpl, isEvalOnCallFrame ? object : null);
                 expression = "with ((window && window.console && window.console._commandLineAPI) || {}) {\n" + expression + "\n}";
             }
-            return evalFunction.call(object, expression);
+            var result = evalFunction.call(object, expression);
+            if (objectGroup === "console")
+                this._lastResult = result;
+            return result;
         } finally {
             if (injectCommandLineAPI && inspectedWindow.console)
                 delete inspectedWindow.console._commandLineAPI;
@@ -631,6 +637,19 @@ InjectedScript.prototype = {
         if (subtype === "date")
             return this._toString(obj);
 
+        if (subtype === "node") {
+            var description = obj.nodeName.toLowerCase();
+            switch (obj.nodeType) {
+            case 1 /* Node.ELEMENT_NODE */:
+                description =  "<" + description + ">";
+                break;
+            case 10 /*Node.DOCUMENT_TYPE_NODE */:
+                description = "<!DOCTYPE " + description + ">";
+                break;
+            }
+            return description;
+        }
+
         var className = InjectedScriptHost.internalConstructorName(obj);
         if (subtype === "array") {
             if (typeof obj.length === "number")
@@ -674,8 +693,9 @@ var injectedScript = new InjectedScript();
  * @param {*} object
  * @param {string=} objectGroupName
  * @param {boolean=} forceValueType
+ * @param {boolean=} generatePreview
  */
-InjectedScript.RemoteObject = function(object, objectGroupName, forceValueType)
+InjectedScript.RemoteObject = function(object, objectGroupName, forceValueType, generatePreview)
 {
     this.type = typeof object;
     if (injectedScript.isPrimitiveValue(object) || object === null || forceValueType) {
@@ -694,13 +714,104 @@ InjectedScript.RemoteObject = function(object, objectGroupName, forceValueType)
     }
 
     this.objectId = injectedScript._bind(object, objectGroupName);
-    var subtype = injectedScript._subtype(object)
+    var subtype = injectedScript._subtype(object);
     if (subtype)
         this.subtype = subtype;
     this.className = InjectedScriptHost.internalConstructorName(object);
     this.description = injectedScript._describe(object);
+
+    if (generatePreview && (this.type === "object" || injectedScript._isHTMLAllCollection(object)))
+        this._generatePreview(/** @type {!Object} */ object);
 }
 
+InjectedScript.RemoteObject.prototype = {
+    /**
+     * @param {!Object} object
+     */
+    _generatePreview: function(object)
+    {
+        var preview = {};
+        var isArray = this.subtype === "array";
+        var elementsToDump = isArray ? 100 : 5;
+  
+        var propertyNames = Object.getOwnPropertyNames(object);
+        preview.lossless = true;
+        preview.overflow = false;
+        var properties = preview.properties = [];
+
+        try {
+            for (var i = 0; i < propertyNames.length; ++i) {
+                if (properties.length >= elementsToDump) {
+                    preview.overflow = true;
+                    preview.lossless = false;
+                    break;
+                }
+                var name = propertyNames[i];
+                if (isArray && name === "length")
+                    continue;
+
+                var descriptor = Object.getOwnPropertyDescriptor(object, name);
+                if (!("value" in descriptor) || !descriptor.enumerable) {
+                    preview.lossless = false;
+                    continue;
+                }
+
+                var value = descriptor.value;
+                if (value === null) {
+                    properties.push({ name: name, type: "object", value: "null" });
+                    continue;
+                }
+    
+                const maxLength = 100;
+                var type = typeof value;
+
+                if (InjectedScript.primitiveTypes[type]) {
+                    if (type === "string") {
+                        if (value.length > maxLength) {
+                            value = this._abbreviateString(value, maxLength, true);
+                            preview.lossless = false;
+                        }
+                        value = "\"" + value.replace(/\n/g, "\u21B5") + "\"";
+                    }
+                    properties.push({ name: name, type: type, value: value + "" });
+                    continue;
+                }
+    
+                preview.lossless = false;
+
+                if (type === "function")
+                    continue;
+
+                var subtype = injectedScript._subtype(value);
+                var property = { name: name, type: type, value: this._abbreviateString(injectedScript._describe(value), maxLength, subtype === "regexp") };
+                if (subtype)
+                    property.subtype = subtype;
+                properties.push(property);
+            }
+            if (properties.length)
+                this.preview = preview;
+        } catch (e) {
+        }
+    },
+
+    /**
+     * @param {string} string
+     * @param {number} maxLength
+     * @param {boolean=} middle
+     * @returns
+     */
+    _abbreviateString: function(string, maxLength, middle)
+    {
+        if (string.length <= maxLength)
+            return string;
+        if (middle) {
+            var leftHalf = maxLength >> 1;
+            var rightHalf = maxLength - leftHalf - 1;
+            return string.substr(0, leftHalf) + "\u2026" + string.substr(string.length - rightHalf, rightHalf);
+        }
+        return string.substr(0, maxLength) + "\u2026";
+    }
+}
 /**
  * @constructor
  * @param {number} ordinal
@@ -797,6 +908,8 @@ function CommandLineAPI(commandLineAPIImpl, callFrame)
 
         this.__defineGetter__("$" + i, commandLineAPIImpl._inspectedObject.bind(commandLineAPIImpl, i));
     }
+
+    this.$_ = injectedScript._lastResult;
 }
 
 /**
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index 88e8f3b95..3e9117700 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -373,6 +373,37 @@
                     { "name": "result", "type": "boolean", "description": "True if browser can ovrride Geolocation." }
                 ],
                 "hidden": true
+            },
+            {
+                "name": "setDeviceOrientationOverride",
+                "description": "Overrides the Device Orientation.",
+                "parameters": [
+                    { "name": "alpha", "type": "number", "description": "Mock alpha"},
+                    { "name": "beta", "type": "number", "description": "Mock beta"},
+                    { "name": "gamma", "type": "number", "description": "Mock gamma"}
+                ],
+                "hidden": true
+            },
+            {
+                "name": "clearDeviceOrientationOverride",
+                "description": "Clears the overridden Device Orientation.",
+                "hidden": true
+            },
+            {
+                "name": "canOverrideDeviceOrientation",
+                "description": "Check the backend if Web Inspector can override the device orientation.",
+                "returns": [
+                    { "name": "result", "type": "boolean", "description": "If true, <code>setDeviceOrientationOverride</code> can safely be invoked on the agent." }
+                ],
+                "hidden": true
+            },
+            {
+                "name": "setTouchEmulationEnabled",
+                "parameters": [
+                    { "name": "enabled", "type": "boolean", "description": "Whether the touch event emulation should be enabled." }
+                ],
+                "description": "Toggles mouse event-based touch event emulation.",
+                "hidden": true
             }
         ],
         "events": [
@@ -425,7 +456,30 @@
                     { "name": "className", "type": "string", "optional": true, "description": "Object class (constructor) name. Specified for <code>object</code> type values only." },
                     { "name": "value", "type": "any", "optional": true, "description": "Remote object value (in case of primitive values or JSON values if it was requested)." },
                     { "name": "description", "type": "string", "optional": true, "description": "String representation of the object." },
-                    { "name": "objectId", "$ref": "RemoteObjectId", "optional": true, "description": "Unique object identifier (for non-primitive values)." }
+                    { "name": "objectId", "$ref": "RemoteObjectId", "optional": true, "description": "Unique object identifier (for non-primitive values)." },
+                    { "name": "preview", "$ref": "ObjectPreview", "optional": true, "description": "Preview containsing abbreviated property values.", "hidden": true }
+                ]
+            },
+            {
+                "id": "ObjectPreview",
+                "type": "object",
+                "hidden": true,
+                "description": "Object containing abbreviated remote object value.",
+                "properties": [
+                    { "name": "lossless", "type": "boolean", "description": "Determines whether preview is lossless (contains all information of the original object)." },
+                    { "name": "overflow", "type": "boolean", "description": "True iff some of the properties of the original did not fit." },
+                    { "name": "properties", "type": "array", "items": { "$ref": "PropertyPreview" }, "description": "List of the properties." }
+                ]
+            },
+            {
+                "id": "PropertyPreview",
+                "type": "object",
+                "hidden": true,
+                "properties": [
+                    { "name": "name", "type": "string", "description": "Property name." },
+	                { "name": "type", "type": "string", "enum": ["object", "function", "undefined", "string", "number", "boolean"], "description": "Object type." },
+	                { "name": "value", "type": "string", "optional": true, "description": "User-friendly property value string." },
+	                { "name": "subtype", "type": "string", "optional": true, "enum": ["array", "null", "node", "regexp", "date"], "description": "Object subtype hint. Specified for <code>object</code> type values only." }
                 ]
             },
             {
@@ -1255,7 +1309,7 @@
                 "description": "DOM Storage entry.",
                 "hidden": true,
                 "properties": [
-                    { "name": "host", "type": "string", "description": "Domain name." },
+                    { "name": "origin", "type": "string", "description": "Document origin." },
                     { "name": "isLocalStorage", "type": "boolean", "description": "True for local storage." },
                     { "name": "id", "$ref": "StorageId", "description": "Entry id for further reference." }
                 ]
@@ -1857,14 +1911,6 @@
                 "description": "Moves node into the new container, places it before the given anchor."
             },
             {
-                "name": "setTouchEmulationEnabled",
-                "parameters": [
-                    { "name": "enabled", "type": "boolean", "description": "Whether the touch event emulation should be enabled." }
-                ],
-                "description": "Toggles mouse event-based touch event emulation.",
-                "hidden": true
-            },
-            {
                 "name": "undo",
                 "description": "Undoes the last performed action.",
                 "hidden": true
@@ -2160,12 +2206,24 @@
                 ]
             },
             {
+                "id": "Region",
+                "type": "object",
+                "properties": [
+                    { "name": "regionOverset", "type": "string", "enum": ["overset", "fit", "empty"], "description": "The \"overset\" attribute of a Named Flow." },
+                    { "name": "nodeId", "$ref": "DOM.NodeId", "description": "The corresponding DOM node id." }
+                ],
+                "description": "This object represents a region that flows from a Named Flow.",
+                "hidden": true
+            },
+            {
                 "id": "NamedFlow",
                 "type": "object",
                 "properties": [
-                    { "name": "nodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
+                    { "name": "documentNodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
                     { "name": "name", "type": "string", "description": "Named Flow identifier." },
-                    { "name": "overset", "type": "boolean", "description": "The \"overset\" attribute of a Named Flow." }
+                    { "name": "overset", "type": "boolean", "description": "The \"overset\" attribute of a Named Flow." },
+                    { "name": "content", "type": "array", "items": { "$ref": "DOM.NodeId" }, "description": "An array of nodes that flow into the Named Flow." },
+                    { "name": "regions", "type": "array", "items": { "$ref": "Region" }, "description": "An array of regions associated with the Named Flow." }
                 ],
                 "description": "This object represents a Named Flow.",
                 "hidden": true
@@ -2318,10 +2376,10 @@
             {
                 "name": "getNamedFlowCollection",
                 "parameters": [
-                    { "name": "nodeId", "$ref": "DOM.NodeId", "description": "The document node id for which to get the Named Flow Collection." }
+                    { "name": "documentNodeId", "$ref": "DOM.NodeId", "description": "The document node id for which to get the Named Flow Collection." }
                 ],
                 "returns": [
-                    { "name": "namedFlows", "type": "array", "items": { "type": "string" }, "description": "An array containing the Named Flows in the document." }
+                    { "name": "namedFlows", "type": "array", "items": { "$ref": "NamedFlow" }, "description": "An array containing the Named Flows in the document." }
                 ],
                 "description": "Returns the Named Flows from the document.",
                 "hidden": true
@@ -2329,7 +2387,7 @@
             {
                 "name": "getFlowByName",
                 "parameters": [
-                    { "name": "nodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
+                    { "name": "documentNodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
                     { "name": "name", "type": "string", "description": "Named Flow identifier." }
                 ],
                 "returns": [
@@ -2350,6 +2408,24 @@
                     { "name": "styleSheetId", "$ref": "StyleSheetId" }
                 ],
                 "description": "Fired whenever a stylesheet is changed as a result of the client operation."
+            },
+            {
+                "name": "namedFlowCreated",
+                "parameters": [
+                    { "name": "documentNodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
+                    { "name": "namedFlow", "type": "string", "description": "Identifier of the new Named Flow." }
+                ],
+                "description": "Fires when a Named Flow is created.",
+                "hidden": true
+            },
+            {
+                "name": "namedFlowRemoved",
+                "parameters": [
+                    { "name": "documentNodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
+                    { "name": "namedFlow", "type": "string", "description": "Identifier of the removed Named Flow." }
+                ],
+                "description": "Fires when a Named Flow is removed: has no associated content nodes and regions.",
+                "hidden": true
             }
         ]
     },
@@ -2974,10 +3050,10 @@
         "types": [],
         "commands": [
             {
-                "name": "setWorkerInspectionEnabled",
-                "parameters": [
-                    { "name": "value", "type": "boolean" }
-                ]
+                "name": "enable"
+            },
+            {
+                "name": "disable"
             },
             {
                 "name": "sendMessageToWorker",
diff --git a/Source/WebCore/inspector/InspectorAllInOne.cpp b/Source/WebCore/inspector/InspectorAllInOne.cpp
index 26bba2aec..db3f82cbe 100644
--- a/Source/WebCore/inspector/InspectorAllInOne.cpp
+++ b/Source/WebCore/inspector/InspectorAllInOne.cpp
@@ -28,7 +28,6 @@
 #include "ConsoleMessage.cpp"
 #include "ContentSearchUtils.cpp"
 #include "DOMEditor.cpp"
-#include "DOMNodeHighlighter.cpp"
 #include "DOMPatchSupport.cpp"
 #include "IdentifiersFactory.cpp"
 #include "InjectedScript.cpp"
@@ -57,6 +56,7 @@
 #include "InspectorIndexedDBAgent.cpp"
 #include "InspectorInstrumentation.cpp"
 #include "InspectorMemoryAgent.cpp"
+#include "InspectorOverlay.cpp"
 #include "InspectorPageAgent.cpp"
 #include "InspectorProfilerAgent.cpp"
 #include "InspectorResourceAgent.cpp"
@@ -69,6 +69,7 @@
 #include "InspectorWebGLAgent.cpp"
 #include "InspectorWorkerAgent.cpp"
 #include "InstrumentingAgents.cpp"
+#include "MemoryInstrumentationImpl.cpp"
 #include "NetworkResourcesData.cpp"
 #include "PageConsoleAgent.cpp"
 #include "PageDebuggerAgent.cpp"
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.cpp b/Source/WebCore/inspector/InspectorCSSAgent.cpp
index 4db27b646..88aa0047a 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.cpp
+++ b/Source/WebCore/inspector/InspectorCSSAgent.cpp
@@ -47,6 +47,7 @@
 #include "InstrumentingAgents.h"
 #include "Node.h"
 #include "NodeList.h"
+#include "RenderRegion.h"
 #include "StylePropertySet.h"
 #include "StylePropertyShorthand.h"
 #include "StyleResolver.h"
@@ -467,13 +468,11 @@ InspectorCSSAgent::InspectorCSSAgent(InstrumentingAgents* instrumentingAgents, I
     , m_lastStyleSheetId(1)
 {
     m_domAgent->setDOMListener(this);
-    m_instrumentingAgents->setInspectorCSSAgent(this);
 }
 
 InspectorCSSAgent::~InspectorCSSAgent()
 {
     ASSERT(!m_domAgent);
-    m_instrumentingAgents->setInspectorCSSAgent(0);
     reset();
 }
 
@@ -481,12 +480,14 @@ void InspectorCSSAgent::setFrontend(InspectorFrontend* frontend)
 {
     ASSERT(!m_frontend);
     m_frontend = frontend->css();
+    m_instrumentingAgents->setInspectorCSSAgent(this);
 }
 
 void InspectorCSSAgent::clearFrontend()
 {
     ASSERT(m_frontend);
     m_frontend = 0;
+    m_instrumentingAgents->setInspectorCSSAgent(0);
     resetPseudoStates();
     String errorString;
     stopSelectorProfilerImpl(&errorString, false);
@@ -516,6 +517,7 @@ void InspectorCSSAgent::reset()
     m_cssStyleSheetToInspectorStyleSheet.clear();
     m_nodeToInspectorStyleSheet.clear();
     m_documentToInspectorStyleSheet.clear();
+    m_namedFlowCollectionsRequested.clear();
     resetPseudoStates();
 }
 
@@ -535,6 +537,24 @@ void InspectorCSSAgent::mediaQueryResultChanged()
         m_frontend->mediaQueryResultChanged();
 }
 
+void InspectorCSSAgent::didCreateNamedFlow(Document* document, const AtomicString& name)
+{
+    int nodeId = m_domAgent->boundNodeId(document);
+    if (!nodeId || !m_namedFlowCollectionsRequested.contains(nodeId))
+        return;
+
+    m_frontend->namedFlowCreated(nodeId, name.string());
+}
+
+void InspectorCSSAgent::didRemoveNamedFlow(Document* document, const AtomicString& name)
+{
+    int nodeId = m_domAgent->boundNodeId(document);
+    if (!nodeId || !m_namedFlowCollectionsRequested.contains(nodeId))
+        return;
+
+    m_frontend->namedFlowRemoved(nodeId, name.string());
+}
+
 bool InspectorCSSAgent::forcePseudoState(Element* element, CSSSelector::PseudoType pseudoType)
 {
     if (m_nodeIdToForcedPseudoState.isEmpty())
@@ -805,37 +825,37 @@ void InspectorCSSAgent::getSupportedCSSProperties(ErrorString*, RefPtr<TypeBuild
     cssProperties = properties.release();
 }
 
-void InspectorCSSAgent::getNamedFlowCollection(ErrorString* errorString, int nodeId, RefPtr<TypeBuilder::Array<String> >& result)
+void InspectorCSSAgent::getNamedFlowCollection(ErrorString* errorString, int documentNodeId, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::NamedFlow> >& result)
 {
-    Document* document = m_domAgent->assertDocument(errorString, nodeId);
+    Document* document = m_domAgent->assertDocument(errorString, documentNodeId);
     if (!document)
         return;
 
-    Vector<String> namedFlowsVector = document->namedFlows()->namedFlowsNames();
-    RefPtr<TypeBuilder::Array<String> > namedFlows = TypeBuilder::Array<String>::create();
+    m_namedFlowCollectionsRequested.add(documentNodeId);
+    Vector<RefPtr<WebKitNamedFlow> > namedFlowsVector = document->namedFlows()->namedFlows();
+    RefPtr<TypeBuilder::Array<TypeBuilder::CSS::NamedFlow> > namedFlows = TypeBuilder::Array<TypeBuilder::CSS::NamedFlow>::create();
 
-    for (Vector<String>::iterator it = namedFlowsVector.begin(); it != namedFlowsVector.end(); ++it)
-        namedFlows->addItem(*it);
+
+    for (Vector<RefPtr<WebKitNamedFlow> >::iterator it = namedFlowsVector.begin(); it != namedFlowsVector.end(); ++it)
+        namedFlows->addItem(buildObjectForNamedFlow(errorString, it->get(), documentNodeId));
 
     result = namedFlows.release();
 }
 
-void InspectorCSSAgent::getFlowByName(ErrorString* errorString, int nodeId, const String& flowName, RefPtr<TypeBuilder::CSS::NamedFlow>& result)
+void InspectorCSSAgent::getFlowByName(ErrorString* errorString, int documentNodeId, const String& flowName, RefPtr<TypeBuilder::CSS::NamedFlow>& result)
 {
-    Document* document = m_domAgent->assertDocument(errorString, nodeId);
+    Document* document = m_domAgent->assertDocument(errorString, documentNodeId);
     if (!document)
         return;
 
-    WebKitNamedFlow* namedFlow = document->namedFlows()->flowByName(flowName);
-    if (!namedFlow) {
+    WebKitNamedFlow* webkitNamedFlow = document->namedFlows()->flowByName(flowName);
+    if (!webkitNamedFlow) {
         *errorString = "No target CSS Named Flow found";
         return;
     }
 
-    result = TypeBuilder::CSS::NamedFlow::create()
-        .setNodeId(nodeId)
-        .setName(flowName)
-        .setOverset(namedFlow->overset());
+    RefPtr<WebKitNamedFlow> protector(webkitNamedFlow);
+    result = buildObjectForNamedFlow(errorString, webkitNamedFlow, documentNodeId);
 }
 
 void InspectorCSSAgent::startSelectorProfiler(ErrorString*)
@@ -1043,14 +1063,69 @@ PassRefPtr<TypeBuilder::CSS::CSSStyle> InspectorCSSAgent::buildObjectForAttribut
     if (!element->isStyledElement())
         return 0;
 
-    StylePropertySet* attributeStyle = static_cast<StyledElement*>(element)->attributeStyle();
+    const StylePropertySet* attributeStyle = static_cast<StyledElement*>(element)->attributeStyle();
     if (!attributeStyle)
         return 0;
 
-    RefPtr<InspectorStyle> inspectorStyle = InspectorStyle::create(InspectorCSSId(), attributeStyle->ensureCSSStyleDeclaration(), 0);
+    RefPtr<InspectorStyle> inspectorStyle = InspectorStyle::create(InspectorCSSId(), const_cast<StylePropertySet*>(attributeStyle)->ensureCSSStyleDeclaration(), 0);
     return inspectorStyle->buildObjectForStyle();
 }
 
+PassRefPtr<TypeBuilder::Array<TypeBuilder::CSS::Region> > InspectorCSSAgent::buildArrayForRegions(ErrorString* errorString, PassRefPtr<NodeList> regionList, int documentNodeId)
+{
+    RefPtr<TypeBuilder::Array<TypeBuilder::CSS::Region> > regions = TypeBuilder::Array<TypeBuilder::CSS::Region>::create();
+
+    for (unsigned i = 0; i < regionList->length(); ++i) {
+        TypeBuilder::CSS::Region::RegionOverset::Enum regionOverset;
+
+        switch (toElement(regionList->item(i))->renderRegion()->regionState()) {
+        case RenderRegion::RegionFit:
+            regionOverset = TypeBuilder::CSS::Region::RegionOverset::Fit;
+            break;
+        case RenderRegion::RegionEmpty:
+            regionOverset = TypeBuilder::CSS::Region::RegionOverset::Empty;
+            break;
+        case RenderRegion::RegionOverset:
+            regionOverset = TypeBuilder::CSS::Region::RegionOverset::Overset;
+            break;
+        case RenderRegion::RegionUndefined:
+            continue;
+        default:
+            ASSERT_NOT_REACHED();
+            continue;
+        }
+
+        RefPtr<TypeBuilder::CSS::Region> region = TypeBuilder::CSS::Region::create()
+            .setRegionOverset(regionOverset)
+            // documentNodeId was previously asserted
+            .setNodeId(m_domAgent->pushNodeToFrontend(errorString, documentNodeId, regionList->item(i)));
+
+        regions->addItem(region);
+    }
+
+    return regions.release();
+}
+
+PassRefPtr<TypeBuilder::CSS::NamedFlow> InspectorCSSAgent::buildObjectForNamedFlow(ErrorString* errorString, WebKitNamedFlow* webkitNamedFlow, int documentNodeId)
+{
+    RefPtr<NodeList> contentList = webkitNamedFlow->getContent();
+    RefPtr<TypeBuilder::Array<int> > content = TypeBuilder::Array<int>::create();
+
+    for (unsigned i = 0; i < contentList->length(); ++i) {
+        // documentNodeId was previously asserted
+        content->addItem(m_domAgent->pushNodeToFrontend(errorString, documentNodeId, contentList->item(i)));
+    }
+
+    RefPtr<TypeBuilder::CSS::NamedFlow> namedFlow = TypeBuilder::CSS::NamedFlow::create()
+        .setDocumentNodeId(documentNodeId)
+        .setName(webkitNamedFlow->name().string())
+        .setOverset(webkitNamedFlow->overset())
+        .setContent(content)
+        .setRegions(buildArrayForRegions(errorString, webkitNamedFlow->getRegions(), documentNodeId));
+
+    return namedFlow.release();
+}
+
 void InspectorCSSAgent::didRemoveDocument(Document* document)
 {
     if (document)
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.h b/Source/WebCore/inspector/InspectorCSSAgent.h
index 76d87795f..8778050dd 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.h
+++ b/Source/WebCore/inspector/InspectorCSSAgent.h
@@ -36,6 +36,7 @@
 #include "SecurityContext.h"
 
 #include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -97,6 +98,8 @@ public:
     virtual void disable(ErrorString*);
     void reset();
     void mediaQueryResultChanged();
+    void didCreateNamedFlow(Document*, const AtomicString& name);
+    void didRemoveNamedFlow(Document*, const AtomicString& name);
 
     virtual void getComputedStyleForNode(ErrorString*, int nodeId, const RefPtr<InspectorArray>* forcedPseudoClasses, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::CSSComputedStyleProperty> >&);
     virtual void getInlineStylesForNode(ErrorString*, int nodeId, RefPtr<TypeBuilder::CSS::CSSStyle>& inlineStyle, RefPtr<TypeBuilder::CSS::CSSStyle>& attributes);
@@ -110,8 +113,8 @@ public:
     virtual void setRuleSelector(ErrorString*, const RefPtr<InspectorObject>& ruleId, const String& selector, RefPtr<TypeBuilder::CSS::CSSRule>& result);
     virtual void addRule(ErrorString*, int contextNodeId, const String& selector, RefPtr<TypeBuilder::CSS::CSSRule>& result);
     virtual void getSupportedCSSProperties(ErrorString*, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::CSSPropertyInfo> >& result);
-    virtual void getNamedFlowCollection(ErrorString*, int nodeId, RefPtr<TypeBuilder::Array<String> >& result);
-    virtual void getFlowByName(ErrorString*, int nodeId, const String& flowName, RefPtr<TypeBuilder::CSS::NamedFlow>& result);
+    virtual void getNamedFlowCollection(ErrorString*, int documentNodeId, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::NamedFlow> >& result);
+    virtual void getFlowByName(ErrorString*, int documentNodeId, const String& flowName, RefPtr<TypeBuilder::CSS::NamedFlow>& result);
 
     virtual void startSelectorProfiler(ErrorString*);
     virtual void stopSelectorProfiler(ErrorString*, RefPtr<TypeBuilder::CSS::SelectorProfile>&);
@@ -150,6 +153,8 @@ private:
 
     PassRefPtr<TypeBuilder::Array<TypeBuilder::CSS::CSSRule> > buildArrayForRuleList(CSSRuleList*, StyleResolver*);
     PassRefPtr<TypeBuilder::CSS::CSSStyle> buildObjectForAttributesStyle(Element*);
+    PassRefPtr<TypeBuilder::Array<TypeBuilder::CSS::Region> > buildArrayForRegions(ErrorString*, PassRefPtr<NodeList>, int documentNodeId);
+    PassRefPtr<TypeBuilder::CSS::NamedFlow> buildObjectForNamedFlow(ErrorString*, WebKitNamedFlow*, int documentNodeId);
 
     // InspectorDOMAgent::DOMListener implementation
     virtual void didRemoveDocument(Document*);
@@ -169,6 +174,7 @@ private:
     NodeToInspectorStyleSheet m_nodeToInspectorStyleSheet;
     DocumentToViaInspectorStyleSheet m_documentToInspectorStyleSheet;
     NodeIdToForcedPseudoState m_nodeIdToForcedPseudoState;
+    HashSet<int> m_namedFlowCollectionsRequested;
 
     int m_lastStyleSheetId;
 
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.cpp b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
index 270c4aea0..ca1918974 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.cpp
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
@@ -83,12 +83,12 @@ void InspectorConsoleAgent::enable(ErrorString*)
 
     if (m_expiredConsoleMessageCount) {
         ConsoleMessage expiredMessage(OtherMessageSource, LogMessageType, WarningMessageLevel, String::format("%d console messages are not shown.", m_expiredConsoleMessageCount), "", 0, "");
-        expiredMessage.addToFrontend(m_frontend, m_injectedScriptManager);
+        expiredMessage.addToFrontend(m_frontend, m_injectedScriptManager, false);
     }
 
     size_t messageCount = m_consoleMessages.size();
     for (size_t i = 0; i < messageCount; ++i)
-        m_consoleMessages[i]->addToFrontend(m_frontend, m_injectedScriptManager);
+        m_consoleMessages[i]->addToFrontend(m_frontend, m_injectedScriptManager, false);
 }
 
 void InspectorConsoleAgent::disable(ErrorString*)
@@ -281,7 +281,7 @@ void InspectorConsoleAgent::addConsoleMessage(PassOwnPtr<ConsoleMessage> console
         m_previousMessage = consoleMessage.get();
         m_consoleMessages.append(consoleMessage);
         if (m_frontend && m_state->getBoolean(ConsoleAgentState::consoleMessagesEnabled))
-            m_previousMessage->addToFrontend(m_frontend, m_injectedScriptManager);
+            m_previousMessage->addToFrontend(m_frontend, m_injectedScriptManager, true);
     }
 
     if (!m_frontend && m_consoleMessages.size() >= maximumConsoleMessages) {
diff --git a/Source/WebCore/inspector/InspectorConsoleInstrumentation.h b/Source/WebCore/inspector/InspectorConsoleInstrumentation.h
index 9f92315b6..f04326b69 100644
--- a/Source/WebCore/inspector/InspectorConsoleInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorConsoleInstrumentation.h
@@ -81,28 +81,28 @@ inline void InspectorInstrumentation::consoleCount(Page* page, PassRefPtr<Script
 #endif
 }
 
-inline void InspectorInstrumentation::startConsoleTiming(Page* page, const String& title)
+inline void InspectorInstrumentation::startConsoleTiming(Frame* frame, const String& title)
 {
 #if ENABLE(INSPECTOR)
-    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForPage(page))
-        startConsoleTimingImpl(instrumentingAgents, title);
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForFrame(frame))
+        startConsoleTimingImpl(instrumentingAgents, frame, title);
 #endif
 }
 
-inline void InspectorInstrumentation::stopConsoleTiming(Page* page, const String& title, PassRefPtr<ScriptCallStack> stack)
+inline void InspectorInstrumentation::stopConsoleTiming(Frame* frame, const String& title, PassRefPtr<ScriptCallStack> stack)
 {
 #if ENABLE(INSPECTOR)
-    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForPage(page))
-        stopConsoleTimingImpl(instrumentingAgents, title, stack);
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForFrame(frame))
+        stopConsoleTimingImpl(instrumentingAgents, frame, title, stack);
 #endif
 }
 
-inline void InspectorInstrumentation::consoleTimeStamp(Page* page, PassRefPtr<ScriptArguments> arguments)
+inline void InspectorInstrumentation::consoleTimeStamp(Frame* frame, PassRefPtr<ScriptArguments> arguments)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(void());
-    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForPage(page))
-        consoleTimeStampImpl(instrumentingAgents, arguments);
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForFrame(frame))
+        consoleTimeStampImpl(instrumentingAgents, frame, arguments);
 #endif
 }
 
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index ab6e377c1..5a0f3bf43 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -34,7 +34,6 @@
 
 #include "InspectorController.h"
 
-#include "DOMNodeHighlighter.h"
 #include "Frame.h"
 #include "GraphicsContext.h"
 #include "IdentifiersFactory.h"
@@ -57,6 +56,7 @@
 #include "InspectorIndexedDBAgent.h"
 #include "InspectorInstrumentation.h"
 #include "InspectorMemoryAgent.h"
+#include "InspectorOverlay.h"
 #include "InspectorPageAgent.h"
 #include "InspectorProfilerAgent.h"
 #include "InspectorResourceAgent.h"
@@ -114,7 +114,7 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
     OwnPtr<InspectorDOMStorageAgent> domStorageAgentPtr(InspectorDOMStorageAgent::create(m_instrumentingAgents.get(), m_state.get()));
     InspectorDOMStorageAgent* domStorageAgent = domStorageAgentPtr.get();
     m_agents.append(domStorageAgentPtr.release());
-    m_agents.append(InspectorMemoryAgent::create(m_instrumentingAgents.get(), m_state.get(), m_page, m_domAgent));
+    m_agents.append(InspectorMemoryAgent::create(m_instrumentingAgents.get(), m_state.get(), m_page, domStorageAgent));
     m_agents.append(InspectorTimelineAgent::create(m_instrumentingAgents.get(), pageAgent, m_state.get(), InspectorTimelineAgent::PageInspector,
        inspectorClient));
     m_agents.append(InspectorApplicationCacheAgent::create(m_instrumentingAgents.get(), m_state.get(), pageAgent));
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.cpp b/Source/WebCore/inspector/InspectorDOMAgent.cpp
index 91a38310f..5929c729f 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMAgent.cpp
@@ -47,7 +47,6 @@
 #include "Cookie.h"
 #include "CookieJar.h"
 #include "DOMEditor.h"
-#include "DOMNodeHighlighter.h"
 #include "DOMPatchSupport.h"
 #include "DOMWindow.h"
 #include "Document.h"
@@ -68,6 +67,7 @@
 #include "InjectedScriptManager.h"
 #include "InspectorFrontend.h"
 #include "InspectorHistory.h"
+#include "InspectorOverlay.h"
 #include "InspectorPageAgent.h"
 #include "InspectorState.h"
 #include "InstrumentingAgents.h"
@@ -104,10 +104,6 @@ using namespace HTMLNames;
 
 namespace DOMAgentState {
 static const char documentRequested[] = "documentRequested";
-
-#if ENABLE(TOUCH_EVENTS)
-static const char touchEventEmulationEnabled[] = "touchEventEmulationEnabled";
-#endif
 };
 
 static const size_t maxTextSize = 10000;
@@ -232,17 +228,14 @@ void InspectorDOMAgent::clearFrontend()
 
     m_history.clear();
     m_domEditor.clear();
-    setSearchingForNode(false, 0);
 
     ErrorString error;
+    setSearchingForNode(&error, false, 0);
     hideHighlight(&error);
 
     m_frontend = 0;
     m_instrumentingAgents->setInspectorDOMAgent(0);
     m_state->setBoolean(DOMAgentState::documentRequested, false);
-#if ENABLE(TOUCH_EVENTS)
-    updateTouchEventEmulationInPage(false);
-#endif
     reset();
 }
 
@@ -251,9 +244,6 @@ void InspectorDOMAgent::restore()
     // Reset document to avoid early return from setDocument.
     m_document = 0;
     setDocument(m_pageAgent->mainFrame()->document());
-#if ENABLE(TOUCH_EVENTS)
-    updateTouchEventEmulationInPage(m_state->getBoolean(DOMAgentState::touchEventEmulationEnabled));
-#endif
 }
 
 Vector<Document*> InspectorDOMAgent::documents()
@@ -459,14 +449,18 @@ void InspectorDOMAgent::discardBindings()
     m_childrenRequested.clear();
 }
 
-#if ENABLE(TOUCH_EVENTS)
-void InspectorDOMAgent::updateTouchEventEmulationInPage(bool enabled)
+int InspectorDOMAgent::pushNodeToFrontend(ErrorString* errorString, int documentNodeId, Node* nodeToPush)
 {
-    m_state->setBoolean(DOMAgentState::touchEventEmulationEnabled, enabled);
-    if (m_pageAgent->mainFrame() && m_pageAgent->mainFrame()->settings())
-        m_pageAgent->mainFrame()->settings()->setTouchEventEmulationEnabled(enabled);
+    Document* document = assertDocument(errorString, documentNodeId);
+    if (!document)
+        return 0;
+    if (nodeToPush->document() != document) {
+        *errorString = "Node is not part of the document with given id";
+        return 0;
+    }
+
+    return pushNodePathToFrontend(nodeToPush);
 }
-#endif
 
 Node* InspectorDOMAgent::nodeForId(int id)
 {
@@ -953,7 +947,8 @@ bool InspectorDOMAgent::handleMousePress()
 
 void InspectorDOMAgent::inspect(Node* node)
 {
-    setSearchingForNode(false, 0);
+    ErrorString error;
+    setSearchingForNode(&error, false, 0);
 
     if (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE)
         node = node->parentNode();
@@ -994,66 +989,69 @@ void InspectorDOMAgent::mouseDidMoveOverElement(const HitTestResult& result, uns
     Node* node = result.innerNode();
     while (node && node->nodeType() == Node::TEXT_NODE)
         node = node->parentNode();
-    if (node)
-        m_overlay->highlightNode(node);
+    if (node && m_inspectModeHighlightConfig)
+        m_overlay->highlightNode(node, *m_inspectModeHighlightConfig);
 }
 
-void InspectorDOMAgent::setSearchingForNode(bool enabled, InspectorObject* highlightConfig)
+void InspectorDOMAgent::setSearchingForNode(ErrorString* errorString, bool enabled, InspectorObject* highlightInspectorObject)
 {
     if (m_searchingForNode == enabled)
         return;
     m_searchingForNode = enabled;
-    if (enabled)
-        setHighlightDataFromConfig(highlightConfig);
-    else {
-        ErrorString error;
-        hideHighlight(&error);
-        m_overlay->clearHighlightData();
-    }
+    if (enabled) {
+        m_inspectModeHighlightConfig = highlightConfigFromInspectorObject(errorString, highlightInspectorObject);
+        if (!m_inspectModeHighlightConfig)
+            return;
+    } else
+        hideHighlight(errorString);
 }
 
-bool InspectorDOMAgent::setHighlightDataFromConfig(InspectorObject* highlightConfig)
+PassOwnPtr<HighlightConfig> InspectorDOMAgent::highlightConfigFromInspectorObject(ErrorString* errorString, InspectorObject* highlightInspectorObject)
 {
-    if (!highlightConfig) {
-        m_overlay->clearHighlightData();
-        return false;
+    if (!highlightInspectorObject) {
+        *errorString = "Internal error: highlight configuration parameter is missing";
+        return nullptr;
     }
 
-    OwnPtr<HighlightData> highlightData = adoptPtr(new HighlightData());
+    OwnPtr<HighlightConfig> highlightConfig = adoptPtr(new HighlightConfig());
     bool showInfo = false; // Default: false (do not show a tooltip).
-    highlightConfig->getBoolean("showInfo", &showInfo);
-    highlightData->showInfo = showInfo;
-    highlightData->content = parseConfigColor("contentColor", highlightConfig);
-    highlightData->contentOutline = parseConfigColor("contentOutlineColor", highlightConfig);
-    highlightData->padding = parseConfigColor("paddingColor", highlightConfig);
-    highlightData->border = parseConfigColor("borderColor", highlightConfig);
-    highlightData->margin = parseConfigColor("marginColor", highlightConfig);
-    m_overlay->setHighlightData(highlightData.release());
-    return true;
+    highlightInspectorObject->getBoolean("showInfo", &showInfo);
+    highlightConfig->showInfo = showInfo;
+    highlightConfig->content = parseConfigColor("contentColor", highlightInspectorObject);
+    highlightConfig->contentOutline = parseConfigColor("contentOutlineColor", highlightInspectorObject);
+    highlightConfig->padding = parseConfigColor("paddingColor", highlightInspectorObject);
+    highlightConfig->border = parseConfigColor("borderColor", highlightInspectorObject);
+    highlightConfig->margin = parseConfigColor("marginColor", highlightInspectorObject);
+    return highlightConfig.release();
 }
 
-void InspectorDOMAgent::setInspectModeEnabled(ErrorString*, bool enabled, const RefPtr<InspectorObject>* highlightConfig)
+void InspectorDOMAgent::setInspectModeEnabled(ErrorString* errorString, bool enabled, const RefPtr<InspectorObject>* highlightConfig)
 {
-    setSearchingForNode(enabled, highlightConfig ? highlightConfig->get() : 0);
+    setSearchingForNode(errorString, enabled, highlightConfig ? highlightConfig->get() : 0);
 }
 
 void InspectorDOMAgent::highlightRect(ErrorString*, int x, int y, int width, int height, const RefPtr<InspectorObject>* color, const RefPtr<InspectorObject>* outlineColor)
 {
-    OwnPtr<HighlightData> highlightData = adoptPtr(new HighlightData());
-    highlightData->rect = adoptPtr(new IntRect(x, y, width, height));
-    highlightData->content = parseColor(color);
-    highlightData->contentOutline = parseColor(outlineColor);
-    m_overlay->setHighlightData(highlightData.release());
+    OwnPtr<HighlightConfig> highlightConfig = adoptPtr(new HighlightConfig());
+    highlightConfig->content = parseColor(color);
+    highlightConfig->contentOutline = parseColor(outlineColor);
+    m_overlay->highlightRect(adoptPtr(new IntRect(x, y, width, height)), *highlightConfig);
 }
 
 void InspectorDOMAgent::highlightNode(
-    ErrorString*,
+    ErrorString* errorString,
     int nodeId,
-    const RefPtr<InspectorObject>& highlightConfig)
+    const RefPtr<InspectorObject>& highlightInspectorObject)
 {
-    if (Node* node = nodeForId(nodeId))
-        if (setHighlightDataFromConfig(highlightConfig.get()))
-            m_overlay->highlightNode(node);
+    Node* node = nodeForId(nodeId);
+    if (!node)
+        return;
+
+    OwnPtr<HighlightConfig> highlightConfig = highlightConfigFromInspectorObject(errorString, highlightInspectorObject.get());
+    if (!highlightConfig)
+        return;
+
+    m_overlay->highlightNode(node, *highlightConfig);
 }
 
 void InspectorDOMAgent::highlightFrame(
@@ -1064,12 +1062,11 @@ void InspectorDOMAgent::highlightFrame(
 {
     Frame* frame = m_pageAgent->frameForId(frameId);
     if (frame && frame->ownerElement()) {
-        OwnPtr<HighlightData> highlightData = adoptPtr(new HighlightData());
-        highlightData->node = frame->ownerElement();
-        highlightData->showInfo = true; // Always show tooltips for frames.
-        highlightData->content = parseColor(color);
-        highlightData->contentOutline = parseColor(outlineColor);
-        m_overlay->setHighlightData(highlightData.release());
+        OwnPtr<HighlightConfig> highlightConfig = adoptPtr(new HighlightConfig());
+        highlightConfig->showInfo = true; // Always show tooltips for frames.
+        highlightConfig->content = parseColor(color);
+        highlightConfig->contentOutline = parseColor(outlineColor);
+        m_overlay->highlightNode(frame->ownerElement(), *highlightConfig);
     }
 }
 
@@ -1105,19 +1102,6 @@ void InspectorDOMAgent::moveTo(ErrorString* errorString, int nodeId, int targetE
     *newNodeId = pushNodePathToFrontend(node);
 }
 
-void InspectorDOMAgent::setTouchEmulationEnabled(ErrorString* error, bool enabled)
-{
-#if ENABLE(TOUCH_EVENTS)
-    if (m_state->getBoolean(DOMAgentState::touchEventEmulationEnabled) == enabled)
-        return;
-    UNUSED_PARAM(error);
-    updateTouchEventEmulationInPage(enabled);
-#else
-    *error = "Touch events emulation not supported";
-    UNUSED_PARAM(enabled);
-#endif
-}
-
 void InspectorDOMAgent::undo(ErrorString* errorString)
 {
     ExceptionCode ec = 0;
@@ -1277,15 +1261,17 @@ PassRefPtr<TypeBuilder::Array<String> > InspectorDOMAgent::buildArrayForElementA
 PassRefPtr<TypeBuilder::Array<TypeBuilder::DOM::Node> > InspectorDOMAgent::buildArrayForContainerChildren(Node* container, int depth, NodeToIdMap* nodesMap)
 {
     RefPtr<TypeBuilder::Array<TypeBuilder::DOM::Node> > children = TypeBuilder::Array<TypeBuilder::DOM::Node>::create();
-    Node* child = innerFirstChild(container);
-
     if (depth == 0) {
         // Special-case the only text child - pretend that container's children have been requested.
-        if (child && child->nodeType() == Node::TEXT_NODE && !innerNextSibling(child))
-            return buildArrayForContainerChildren(container, 1, nodesMap);
+        Node* firstChild = container->firstChild();
+        if (firstChild && firstChild->nodeType() == Node::TEXT_NODE && !firstChild->nextSibling()) {
+            children->addItem(buildObjectForNode(firstChild, 0, nodesMap));
+            m_childrenRequested.add(bind(container, nodesMap));
+        }
         return children.release();
     }
 
+    Node* child = innerFirstChild(container);
     depth--;
     m_childrenRequested.add(bind(container, nodesMap));
 
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.h b/Source/WebCore/inspector/InspectorDOMAgent.h
index ac478cce0..aedf77920 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMAgent.h
@@ -35,6 +35,7 @@
 #include "InjectedScriptManager.h"
 #include "InspectorBaseAgent.h"
 #include "InspectorFrontend.h"
+#include "InspectorOverlay.h"
 #include "InspectorValues.h"
 #include "Timer.h"
 
@@ -69,6 +70,8 @@ class RevalidateStyleAttributeTask;
 class ScriptValue;
 class ShadowRoot;
 
+struct HighlightConfig;
+
 typedef String ErrorString;
 
 #if ENABLE(INSPECTOR)
@@ -141,7 +144,6 @@ public:
     virtual void highlightNode(ErrorString*, int nodeId, const RefPtr<InspectorObject>& highlightConfig);
     virtual void highlightFrame(ErrorString*, const String& frameId, const RefPtr<InspectorObject>* color, const RefPtr<InspectorObject>* outlineColor);
     virtual void moveTo(ErrorString*, int nodeId, int targetNodeId, const int* anchorNodeId, int* newNodeId);
-    virtual void setTouchEmulationEnabled(ErrorString*, bool);
     virtual void undo(ErrorString*);
     virtual void redo(ErrorString*);
     virtual void markUndoableState(ErrorString*);
@@ -166,6 +168,7 @@ public:
     void didPushShadowRoot(Element* host, ShadowRoot*);
     void willPopShadowRoot(Element* host, ShadowRoot*);
 
+    int pushNodeToFrontend(ErrorString*, int documentNodeId, Node*);
     Node* nodeForId(int nodeId);
     int boundNodeId(Node*);
     void setDOMListener(DOMListener*);
@@ -198,8 +201,8 @@ public:
 private:
     InspectorDOMAgent(InstrumentingAgents*, InspectorPageAgent*, InspectorState*, InjectedScriptManager*, InspectorOverlay*);
 
-    void setSearchingForNode(bool enabled, InspectorObject* highlightConfig);
-    bool setHighlightDataFromConfig(InspectorObject* highlightConfig);
+    void setSearchingForNode(ErrorString*, bool enabled, InspectorObject* highlightConfig);
+    PassOwnPtr<HighlightConfig> highlightConfigFromInspectorObject(ErrorString*, InspectorObject* highlightInspectorObject);
 
     // Node-related methods.
     typedef HashMap<RefPtr<Node>, int> NodeToIdMap;
@@ -226,10 +229,6 @@ private:
 
     void discardBindings();
 
-#if ENABLE(TOUCH_EVENTS)
-    void updateTouchEventEmulationInPage(bool);
-#endif
-
     InspectorPageAgent* m_pageAgent;
     InjectedScriptManager* m_injectedScriptManager;
     InspectorOverlay* m_overlay;
@@ -248,6 +247,7 @@ private:
     OwnPtr<RevalidateStyleAttributeTask> m_revalidateStyleAttrTask;
     RefPtr<Node> m_nodeToFocus;
     bool m_searchingForNode;
+    OwnPtr<HighlightConfig> m_inspectModeHighlightConfig;
     OwnPtr<InspectorHistory> m_history;
     OwnPtr<DOMEditor> m_domEditor;
     bool m_suppressAttributeModifiedEvent;
diff --git a/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp b/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
index 726ef72bb..93999d1fb 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
@@ -157,12 +157,7 @@ String InspectorDOMStorageAgent::storageId(Storage* storage)
     Frame* frame = storage->frame();
     ExceptionCode ec = 0;
     bool isLocalStorage = (frame->domWindow()->localStorage(ec) == storage && !ec);
-    DOMStorageResourcesMap::iterator domStorageEnd = m_resources.end();
-    for (DOMStorageResourcesMap::iterator it = m_resources.begin(); it != domStorageEnd; ++it) {
-        if (it->second->isSameHostAndType(frame->document()->securityOrigin(), isLocalStorage))
-            return it->first;
-    }
-    return String();
+    return storageId(frame->document()->securityOrigin(), isLocalStorage);
 }
 
 String InspectorDOMStorageAgent::storageId(SecurityOrigin* securityOrigin, bool isLocalStorage)
@@ -170,7 +165,7 @@ String InspectorDOMStorageAgent::storageId(SecurityOrigin* securityOrigin, bool
     ASSERT(securityOrigin);
     DOMStorageResourcesMap::iterator domStorageEnd = m_resources.end();
     for (DOMStorageResourcesMap::iterator it = m_resources.begin(); it != domStorageEnd; ++it) {
-        if (it->second->isSameHostAndType(securityOrigin, isLocalStorage))
+        if (it->second->isSameOriginAndType(securityOrigin, isLocalStorage))
             return it->first;
     }
     return String();
@@ -188,7 +183,7 @@ void InspectorDOMStorageAgent::didUseDOMStorage(StorageArea* storageArea, bool i
 {
     DOMStorageResourcesMap::iterator domStorageEnd = m_resources.end();
     for (DOMStorageResourcesMap::iterator it = m_resources.begin(); it != domStorageEnd; ++it) {
-        if (it->second->isSameHostAndType(frame->document()->securityOrigin(), isLocalStorage))
+        if (it->second->isSameOriginAndType(frame->document()->securityOrigin(), isLocalStorage))
             return;
     }
 
@@ -219,6 +214,14 @@ void InspectorDOMStorageAgent::clearResources()
     m_resources.clear();
 }
 
+size_t InspectorDOMStorageAgent::memoryBytesUsedByStorageCache() const
+{
+    size_t size = 0;
+    for (DOMStorageResourcesMap::const_iterator it = m_resources.begin(); it != m_resources.end(); ++it)
+        size += it->second->storageArea()->memoryBytesUsedByCache();
+    return size;
+}
+
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/inspector/InspectorDOMStorageAgent.h b/Source/WebCore/inspector/InspectorDOMStorageAgent.h
index f69f09741..6664a8db5 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMStorageAgent.h
@@ -78,6 +78,9 @@ public:
     void didUseDOMStorage(StorageArea*, bool isLocalStorage, Frame*);
     void didDispatchDOMStorageEvent(const String& key, const String& oldValue, const String& newValue, StorageType, SecurityOrigin*, Page*);
 
+    // Called from InspectorMemoryAgent
+    size_t memoryBytesUsedByStorageCache() const;
+
 private:
     InspectorDOMStorageAgent(InstrumentingAgents*, InspectorState*);
 
diff --git a/Source/WebCore/inspector/InspectorDOMStorageResource.cpp b/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
index 0ae120773..f7a8368fd 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -60,9 +60,9 @@ InspectorDOMStorageResource::InspectorDOMStorageResource(StorageArea* storageAre
 {
 }
 
-bool InspectorDOMStorageResource::isSameHostAndType(SecurityOrigin* securityOrigin, bool isLocalStorage) const
+bool InspectorDOMStorageResource::isSameOriginAndType(SecurityOrigin* securityOrigin, bool isLocalStorage) const
 {
-    return equalIgnoringCase(m_frame->document()->securityOrigin()->host(), securityOrigin->host()) && m_isLocalStorage == isLocalStorage;
+    return m_frame->document()->securityOrigin()->equal(securityOrigin) && m_isLocalStorage == isLocalStorage;
 }
 
 void InspectorDOMStorageResource::bind(InspectorFrontend* frontend)
@@ -71,7 +71,7 @@ void InspectorDOMStorageResource::bind(InspectorFrontend* frontend)
     m_frontend = frontend->domstorage();
 
     RefPtr<TypeBuilder::DOMStorage::Entry> jsonObject = TypeBuilder::DOMStorage::Entry::create()
-        .setHost(m_frame->document()->securityOrigin()->host())
+        .setOrigin(m_frame->document()->securityOrigin()->toRawString())
         .setIsLocalStorage(m_isLocalStorage)
         .setId(m_id);
     m_frontend->addDOMStorage(jsonObject);
diff --git a/Source/WebCore/inspector/InspectorDOMStorageResource.h b/Source/WebCore/inspector/InspectorDOMStorageResource.h
index 9256949d5..ac059cba8 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageResource.h
+++ b/Source/WebCore/inspector/InspectorDOMStorageResource.h
@@ -53,7 +53,7 @@ public:
     void bind(InspectorFrontend*);
     void unbind();
 
-    bool isSameHostAndType(SecurityOrigin*, bool isLocalStorage) const;
+    bool isSameOriginAndType(SecurityOrigin*, bool isLocalStorage) const;
     String id() const { return m_id; }
     StorageArea* storageArea() const { return m_storageArea.get(); }
     Frame* frame() const { return m_frame.get(); }
diff --git a/Source/WebCore/inspector/InspectorFrontendClient.h b/Source/WebCore/inspector/InspectorFrontendClient.h
index 655d59f0e..c461fd99c 100644
--- a/Source/WebCore/inspector/InspectorFrontendClient.h
+++ b/Source/WebCore/inspector/InspectorFrontendClient.h
@@ -62,6 +62,7 @@ public:
     virtual bool canSave() = 0;
     virtual void save(const WTF::String& url, const WTF::String& content, bool forceSaveAs) = 0;
     virtual void append(const WTF::String& url, const WTF::String& content) = 0;
+    virtual bool canInspectWorkers() = 0;
 
     virtual void inspectedURLChanged(const String&) = 0;
 
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.h b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
index f3971fd55..4027397ac 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.h
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
@@ -71,6 +71,7 @@ public:
     virtual bool canSave() { return false; }
     virtual void save(const String&, const String&, bool) { }
     virtual void append(const String&, const String&) { }
+    virtual bool canInspectWorkers() { return false; }
 
     virtual void attachWindow() = 0;
     virtual void detachWindow() = 0;
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.cpp b/Source/WebCore/inspector/InspectorFrontendHost.cpp
index 963d9ba75..e7b02200e 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendHost.cpp
@@ -222,7 +222,7 @@ String InspectorFrontendHost::hiddenPanels()
 
 void InspectorFrontendHost::copyText(const String& text)
 {
-    Pasteboard::generalPasteboard()->writePlainText(text);
+    Pasteboard::generalPasteboard()->writePlainText(text, Pasteboard::CannotSmartReplace);
 }
 
 void InspectorFrontendHost::openInNewTab(const String& url)
@@ -250,6 +250,17 @@ void InspectorFrontendHost::append(const String& url, const String& content)
         m_client->append(url, content);
 }
 
+bool InspectorFrontendHost::canInspectWorkers()
+{
+#if ENABLE(WORKERS)
+    if (m_client)
+        return m_client->canInspectWorkers();
+    return false;
+#else
+    return false;
+#endif
+}
+
 void InspectorFrontendHost::sendMessageToBackend(const String& message)
 {
     if (m_client)
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.h b/Source/WebCore/inspector/InspectorFrontendHost.h
index 674a5a2b3..9633d8296 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.h
+++ b/Source/WebCore/inspector/InspectorFrontendHost.h
@@ -79,6 +79,8 @@ public:
     void save(const String& url, const String& content, bool forceSaveAs);
     void append(const String& url, const String& content);
 
+    bool canInspectWorkers();
+
     // Called from [Custom] implementations.
     void showContextMenu(Event*, const Vector<ContextMenuItem>& items);
     void sendMessageToBackend(const String& message);
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.idl b/Source/WebCore/inspector/InspectorFrontendHost.idl
index 2a20370ce..9f4b40d8b 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.idl
+++ b/Source/WebCore/inspector/InspectorFrontendHost.idl
@@ -56,6 +56,8 @@ module core {
         void save(in DOMString url, in DOMString content, in boolean forceSaveAs);
         void append(in DOMString url, in DOMString content);
 
+        boolean canInspectWorkers();
+
         [Custom] DOMString platform();
         [Custom] DOMString port();
         [Custom] void showContextMenu(in MouseEvent event, in DOMObject items);
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index 0bc16f494..faea068d2 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -38,6 +38,7 @@
 #include "CSSStyleRule.h"
 #include "DOMWindow.h"
 #include "Database.h"
+#include "DeviceOrientationData.h"
 #include "DocumentLoader.h"
 #include "Event.h"
 #include "EventContext.h"
@@ -231,6 +232,18 @@ void InspectorInstrumentation::willPopShadowRootImpl(InstrumentingAgents* instru
         domAgent->willPopShadowRoot(host, root);
 }
 
+void InspectorInstrumentation::didCreateNamedFlowImpl(InstrumentingAgents* instrumentingAgents, Document* document, const AtomicString& name)
+{
+    if (InspectorCSSAgent* cssAgent = instrumentingAgents->inspectorCSSAgent())
+        cssAgent->didCreateNamedFlow(document, name);
+}
+
+void InspectorInstrumentation::didRemoveNamedFlowImpl(InstrumentingAgents* instrumentingAgents, Document* document, const AtomicString& name)
+{
+    if (InspectorCSSAgent* cssAgent = instrumentingAgents->inspectorCSSAgent())
+        cssAgent->didRemoveNamedFlow(document, name);
+}
+
 void InspectorInstrumentation::mouseDidMoveOverElementImpl(InstrumentingAgents* instrumentingAgents, const HitTestResult& result, unsigned modifierFlags)
 {
     if (InspectorDOMAgent* domAgent = instrumentingAgents->inspectorDOMAgent())
@@ -894,28 +907,28 @@ void InspectorInstrumentation::consoleCountImpl(InstrumentingAgents* instrumenti
         consoleAgent->count(arguments, stack);
 }
 
-void InspectorInstrumentation::startConsoleTimingImpl(InstrumentingAgents* instrumentingAgents, const String& title)
+void InspectorInstrumentation::startConsoleTimingImpl(InstrumentingAgents* instrumentingAgents, Frame* frame, const String& title)
 {
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent())
-        timelineAgent->time(title);
+        timelineAgent->time(frame, title);
     if (InspectorConsoleAgent* consoleAgent = instrumentingAgents->inspectorConsoleAgent())
         consoleAgent->startTiming(title);
 }
 
-void InspectorInstrumentation::stopConsoleTimingImpl(InstrumentingAgents* instrumentingAgents, const String& title, PassRefPtr<ScriptCallStack> stack)
+void InspectorInstrumentation::stopConsoleTimingImpl(InstrumentingAgents* instrumentingAgents, Frame* frame, const String& title, PassRefPtr<ScriptCallStack> stack)
 {
     if (InspectorConsoleAgent* consoleAgent = instrumentingAgents->inspectorConsoleAgent())
         consoleAgent->stopTiming(title, stack);
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent())
-        timelineAgent->timeEnd(title);
+        timelineAgent->timeEnd(frame, title);
 }
 
-void InspectorInstrumentation::consoleTimeStampImpl(InstrumentingAgents* instrumentingAgents, PassRefPtr<ScriptArguments> arguments)
+void InspectorInstrumentation::consoleTimeStampImpl(InstrumentingAgents* instrumentingAgents, Frame* frame, PassRefPtr<ScriptArguments> arguments)
 {
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent()) {
         String message;
         arguments->getFirstArgumentAsString(message);
-        timelineAgent->didTimeStamp(message);
+        timelineAgent->didTimeStamp(frame, message);
      }
 }
 
@@ -1169,8 +1182,10 @@ void InspectorInstrumentation::unregisterInstrumentingAgents(InstrumentingAgents
     if (!instrumentingAgentsSet)
         return;
     instrumentingAgentsSet->remove(instrumentingAgents);
-    if (!instrumentingAgentsSet->size())
+    if (instrumentingAgentsSet->isEmpty()) {
         delete instrumentingAgentsSet;
+        instrumentingAgentsSet = 0;
+    }
 }
 
 InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(const InspectorInstrumentationCookie& cookie)
@@ -1215,6 +1230,13 @@ GeolocationPosition* InspectorInstrumentation::overrideGeolocationPositionImpl(I
 }
 #endif
 
+DeviceOrientationData* InspectorInstrumentation::overrideDeviceOrientationImpl(InstrumentingAgents* instrumentingAgents, DeviceOrientationData* deviceOrientation)
+{
+    if (InspectorPageAgent* pageAgent = instrumentingAgents->inspectorPageAgent())
+        deviceOrientation = pageAgent->overrideDeviceOrientation(deviceOrientation);
+    return deviceOrientation;
+}
+
 } // namespace WebCore
 
 #endif // !ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index 6147f77de..116d76c2b 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -56,6 +56,7 @@ class Database;
 class Element;
 class EventContext;
 class DocumentLoader;
+class DeviceOrientationData;
 class GeolocationPosition;
 class GraphicsContext;
 class HitTestResult;
@@ -112,6 +113,8 @@ public:
     static void mediaQueryResultChanged(Document*);
     static void didPushShadowRoot(Element* host, ShadowRoot*);
     static void willPopShadowRoot(Element* host, ShadowRoot*);
+    static void didCreateNamedFlow(Document*, const AtomicString& name);
+    static void didRemoveNamedFlow(Document*, const AtomicString& name);
 
     static void mouseDidMoveOverElement(Page*, const HitTestResult&, unsigned modifierFlags);
     static bool handleMousePress(Page*);
@@ -199,9 +202,9 @@ public:
     static void addMessageToConsole(WorkerContext*, MessageSource, MessageType, MessageLevel, const String& message, const String&, unsigned lineNumber);
 #endif
     static void consoleCount(Page*, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
-    static void startConsoleTiming(Page*, const String& title);
-    static void stopConsoleTiming(Page*, const String& title, PassRefPtr<ScriptCallStack>);
-    static void consoleTimeStamp(Page*, PassRefPtr<ScriptArguments>);
+    static void startConsoleTiming(Frame*, const String& title);
+    static void stopConsoleTiming(Frame*, const String& title, PassRefPtr<ScriptCallStack>);
+    static void consoleTimeStamp(Frame*, PassRefPtr<ScriptArguments>);
 
     static void didRequestAnimationFrame(Document*, int callbackId);
     static void didCancelAnimationFrame(Document*, int callbackId);
@@ -267,6 +270,8 @@ public:
     static void registerInstrumentingAgents(InstrumentingAgents*);
     static void unregisterInstrumentingAgents(InstrumentingAgents*);
 
+    static DeviceOrientationData* overrideDeviceOrientation(Page*, DeviceOrientationData*);
+
 private:
 #if ENABLE(INSPECTOR)
     static WTF::ThreadSpecific<InspectorTimelineAgent*>& threadSpecificTimelineAgentForOrphanEvents();
@@ -287,6 +292,8 @@ private:
     static void mediaQueryResultChangedImpl(InstrumentingAgents*);
     static void didPushShadowRootImpl(InstrumentingAgents*, Element* host, ShadowRoot*);
     static void willPopShadowRootImpl(InstrumentingAgents*, Element* host, ShadowRoot*);
+    static void didCreateNamedFlowImpl(InstrumentingAgents*, Document*, const AtomicString& name);
+    static void didRemoveNamedFlowImpl(InstrumentingAgents*, Document*, const AtomicString& name);
 
     static void mouseDidMoveOverElementImpl(InstrumentingAgents*, const HitTestResult&, unsigned modifierFlags);
     static bool handleMousePressImpl(InstrumentingAgents*);
@@ -371,9 +378,9 @@ private:
     static void addMessageToConsoleImpl(InstrumentingAgents*, MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     static void addMessageToConsoleImpl(InstrumentingAgents*, MessageSource, MessageType, MessageLevel, const String& message, const String& scriptId, unsigned lineNumber);
     static void consoleCountImpl(InstrumentingAgents*, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
-    static void startConsoleTimingImpl(InstrumentingAgents*, const String& title);
-    static void stopConsoleTimingImpl(InstrumentingAgents*, const String& title, PassRefPtr<ScriptCallStack>);
-    static void consoleTimeStampImpl(InstrumentingAgents*, PassRefPtr<ScriptArguments>);
+    static void startConsoleTimingImpl(InstrumentingAgents*, Frame*, const String& title);
+    static void stopConsoleTimingImpl(InstrumentingAgents*, Frame*, const String& title, PassRefPtr<ScriptCallStack>);
+    static void consoleTimeStampImpl(InstrumentingAgents*, Frame*, PassRefPtr<ScriptArguments>);
 
     static void didRequestAnimationFrameImpl(InstrumentingAgents*, int callbackId, Frame*);
     static void didCancelAnimationFrameImpl(InstrumentingAgents*, int callbackId, Frame*);
@@ -431,6 +438,7 @@ private:
     static GeolocationPosition* overrideGeolocationPositionImpl(InstrumentingAgents*, GeolocationPosition*);
 #endif
 
+    static DeviceOrientationData* overrideDeviceOrientationImpl(InstrumentingAgents*, DeviceOrientationData*);
     static int s_frontendCounter;
 #endif
 };
@@ -553,6 +561,24 @@ inline void InspectorInstrumentation::willPopShadowRoot(Element* host, ShadowRoo
 #endif
 }
 
+inline void InspectorInstrumentation::didCreateNamedFlow(Document* document, const AtomicString& name)
+{
+#if ENABLE(INSPECTOR)
+    FAST_RETURN_IF_NO_FRONTENDS(void());
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(document))
+        didCreateNamedFlowImpl(instrumentingAgents, document, name);
+#endif
+}
+
+inline void InspectorInstrumentation::didRemoveNamedFlow(Document* document, const AtomicString& name)
+{
+#if ENABLE(INSPECTOR)
+    FAST_RETURN_IF_NO_FRONTENDS(void());
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(document))
+        didRemoveNamedFlowImpl(instrumentingAgents, document, name);
+#endif
+}
+
 inline void InspectorInstrumentation::mouseDidMoveOverElement(Page* page, const HitTestResult& result, unsigned modifierFlags)
 {
 #if ENABLE(INSPECTOR)
@@ -1386,7 +1412,6 @@ inline void InspectorInstrumentation::didFireAnimationFrame(const InspectorInstr
 #endif
 }
 
-
 #if ENABLE(GEOLOCATION)
 inline GeolocationPosition* InspectorInstrumentation::overrideGeolocationPosition(Page* page, GeolocationPosition* position)
 {
@@ -1399,6 +1424,16 @@ inline GeolocationPosition* InspectorInstrumentation::overrideGeolocationPositio
 }
 #endif
 
+inline DeviceOrientationData* InspectorInstrumentation::overrideDeviceOrientation(Page* page, DeviceOrientationData* deviceOrientation)
+{
+#if ENABLE(INSPECTOR)
+    FAST_RETURN_IF_NO_FRONTENDS(deviceOrientation);
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForPage(page))
+        return overrideDeviceOrientationImpl(instrumentingAgents, deviceOrientation);
+#endif
+    return deviceOrientation;
+}
+
 #if ENABLE(INSPECTOR)
 inline bool InspectorInstrumentation::collectingHTMLParseErrors(Page* page)
 {
diff --git a/Source/WebCore/inspector/InspectorMemoryAgent.cpp b/Source/WebCore/inspector/InspectorMemoryAgent.cpp
index db411458c..ea5254aab 100644
--- a/Source/WebCore/inspector/InspectorMemoryAgent.cpp
+++ b/Source/WebCore/inspector/InspectorMemoryAgent.cpp
@@ -39,12 +39,13 @@
 #include "Document.h"
 #include "EventListenerMap.h"
 #include "Frame.h"
+#include "InspectorDOMStorageAgent.h"
 #include "InspectorFrontend.h"
 #include "InspectorState.h"
 #include "InspectorValues.h"
 #include "InstrumentingAgents.h"
 #include "MemoryCache.h"
-#include "MemoryInstrumentation.h"
+#include "MemoryInstrumentationImpl.h"
 #include "MemoryUsageSupport.h"
 #include "Node.h"
 #include "Page.h"
@@ -80,14 +81,20 @@ static const char jsExternalStrings[] = "JSExternalStrings";
 static const char inspectorData[] = "InspectorData";
 static const char inspectorDOMData[] = "InspectorDOMData";
 static const char inspectorJSHeapData[] = "InspectorJSHeapData";
-static const char memoryCache[] = "MemoryCache";
 static const char processPrivateMemory[] = "ProcessPrivateMemory";
 
-static const char cachedImages[] = "CachedImages";
-static const char cachedCssStyleSheets[] = "CachedCssStyleSheets";
-static const char cachedScripts[] = "CachedScripts";
-static const char cachedXslStyleSheets[] = "CachedXslStyleSheets";
-static const char cachedFonts[] = "CachedFonts";
+static const char memoryCache[] = "MemoryCache";
+static const char memoryCacheStructures[] = "MemoryCacheStructures";
+static const char cachedResource[] = "CachedResource";
+static const char cachedResourceImage[] = "CachedImages";
+static const char cachedResourceCSS[] = "CachedCssStyleSheets";
+static const char cachedResourceScript[] = "CachedScripts";
+static const char cachedResourceXSL[] = "CachedXslStyleSheets";
+static const char cachedResourceFont[] = "CachedFonts";
+static const char cachedResourceSVG[] = "CachedSVGGraphics";
+static const char cachedResourceShader[] = "CachedShaders";
+static const char cachedResourceXSLT[] = "CachedShadersXSLT";
+
 static const char renderTreeUsed[] = "RenderTreeUsed";
 static const char renderTreeAllocated[] = "RenderTreeAllocated";
 
@@ -97,12 +104,12 @@ static const char domTreeDOM[] = "DOMTreeDOM";
 static const char domTreeCSS[] = "DOMTreeCSS";
 static const char domTreeBinding[] = "DOMTreeBinding";
 static const char domTreeLoader[] = "DOMTreeLoader";
+
+static const char domStorageCache[] = "DOMStorageCache";
 }
 
 namespace {
 
-typedef HashSet<const void*> VisitedObjects;
-
 String nodeName(Node* node)
 {
     if (node->document()->isXHTMLDocument())
@@ -110,21 +117,6 @@ String nodeName(Node* node)
     return node->nodeName().lower();
 }
 
-size_t stringSize(StringImpl* string)
-{
-    // FIXME: support substrings
-    size_t size = string->length();
-    if (string->is8Bit()) {
-        if (string->has16BitShadow()) {
-            size += 2 * size;
-            if (string->hasTerminatingNullCharacter())
-                size += 2;
-        }
-    } else
-        size *= 2;
-    return size + sizeof(*string);
-}
-
 typedef HashSet<StringImpl*, PtrHash<StringImpl*> > StringImplIdentitySet;
 
 class CharacterDataStatistics {
@@ -143,7 +135,7 @@ public:
             return;
         m_domStringImplSet.add(dataImpl);
 
-        m_characterDataSize += stringSize(dataImpl);
+        m_characterDataSize += dataImpl->sizeInBytes();
     }
 
     bool contains(StringImpl* s) { return m_domStringImplSet.contains(s); }
@@ -288,7 +280,7 @@ public:
 
     virtual void visitJSExternalString(StringImpl* string)
     {
-        int size = stringSize(string);
+        int size = string->sizeInBytes();
         m_jsExternalStringSize += size;
         if (m_characterDataStatistics.contains(string))
             m_sharedStringSize += size;
@@ -352,7 +344,7 @@ private:
     virtual void visitJSExternalString(StringImpl* string)
     {
         if (m_visitedObjects.add(string).isNewEntry)
-            m_jsExternalStringSize += stringSize(string);
+            m_jsExternalStringSize += string->sizeInBytes();
     }
 
     VisitedObjects& m_visitedObjects;
@@ -457,109 +449,86 @@ static void addMemoryBlockFor(TypeBuilder::Array<InspectorMemoryBlock>* array, s
 
 namespace {
 
-class MemoryInstrumentationImpl : public MemoryInstrumentation {
+class DOMTreesIterator : public NodeWrapperVisitor {
 public:
-    explicit MemoryInstrumentationImpl(VisitedObjects& visitedObjects)
-        : m_visitedObjects(visitedObjects)
-    {
-        for (int i = 0; i < LastTypeEntry; ++i)
-            m_totalSizes[i] = 0;
-    }
-
-    PassRefPtr<InspectorMemoryBlock> dumpStatistics(InspectorDataCounter* inspectorData)
-    {
-        size_t inspectorSize
-            = calculateContainerSize(m_visitedObjects)
-            + calculateContainerSize(m_deferredInstrumentedPointers);
-        inspectorData->addComponent(MemoryBlockName::inspectorDOMData, inspectorSize);
-
-        size_t totalSize = 0;
-        for (int i = Other; i < LastTypeEntry; ++i)
-            totalSize += m_totalSizes[i];
-
-        RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > domChildren = TypeBuilder::Array<InspectorMemoryBlock>::create();
-        addMemoryBlockFor(domChildren.get(), m_totalSizes[Other], MemoryBlockName::domTreeOther);
-        addMemoryBlockFor(domChildren.get(), m_totalSizes[DOM], MemoryBlockName::domTreeDOM);
-        addMemoryBlockFor(domChildren.get(), m_totalSizes[CSS], MemoryBlockName::domTreeCSS);
-        addMemoryBlockFor(domChildren.get(), m_totalSizes[Binding], MemoryBlockName::domTreeBinding);
-        addMemoryBlockFor(domChildren.get(), m_totalSizes[Loader], MemoryBlockName::domTreeLoader);
-
-        RefPtr<InspectorMemoryBlock> dom = InspectorMemoryBlock::create().setName(MemoryBlockName::dom);
-        dom->setSize(totalSize);
-        dom->setChildren(domChildren.release());
-        return dom.release();
-    }
-
-    void processDeferredInstrumentedPointers()
+    DOMTreesIterator(Page* page, VisitedObjects& visitedObjects)
+        : m_page(page)
+        , m_domMemoryUsage(visitedObjects)
     {
-        while (!m_deferredInstrumentedPointers.isEmpty()) {
-            OwnPtr<InstrumentedPointerBase> pointer = m_deferredInstrumentedPointers.last().release();
-            m_deferredInstrumentedPointers.removeLast();
-            pointer->process(this);
-        }
     }
 
-private:
-    virtual void addString(const String& string, ObjectType objectType)
+    virtual void visitNode(Node* node) OVERRIDE
     {
-        if (string.isNull() || visited(string.impl()))
+        if (node->document() && node->document()->frame() && m_page != node->document()->frame()->page())
             return;
-        countObjectSize(objectType, stringSize(string.impl()));
-    }
 
-    virtual void countObjectSize(ObjectType objectType, size_t size) OVERRIDE
-    {
-        ASSERT(objectType >= 0 && objectType < LastTypeEntry);
-        m_totalSizes[objectType] += size;
+        m_domMemoryUsage.addRootObject(node);
     }
 
-    virtual void deferInstrumentedPointer(PassOwnPtr<InstrumentedPointerBase> pointer) OVERRIDE
+    void visitFrame(Frame* frame)
     {
-        m_deferredInstrumentedPointers.append(pointer);
+        m_domMemoryUsage.addRootObject(frame);
     }
 
-    virtual bool visited(const void* object) OVERRIDE
+    void visitBindings()
     {
-        return !m_visitedObjects.add(object).isNewEntry;
+        ScriptProfiler::collectBindingMemoryInfo(&m_domMemoryUsage);
     }
 
-    size_t m_totalSizes[LastTypeEntry];
-    VisitedObjects& m_visitedObjects;
-    Vector<OwnPtr<InstrumentedPointerBase> > m_deferredInstrumentedPointers;
-};
-
-class DOMTreesIterator : public NodeWrapperVisitor {
-public:
-    DOMTreesIterator(Page* page, VisitedObjects& visitedObjects)
-        : m_page(page)
-        , m_domMemoryUsage(visitedObjects)
+    void visitMemoryCache()
     {
+        m_domMemoryUsage.addRootObject(memoryCache());
     }
 
-    virtual void visitNode(Node* node) OVERRIDE
+    PassRefPtr<InspectorMemoryBlock> buildObjectForMemoryCache() const
     {
-        if (node->document() && node->document()->frame() && m_page != node->document()->frame()->page())
-            return;
+        size_t totalSize = 0;
 
-        m_domMemoryUsage.addInstrumentedMember(node);
-        m_domMemoryUsage.processDeferredInstrumentedPointers();
+        COMPILE_ASSERT(MemoryInstrumentation::LastTypeEntry == MemoryInstrumentation::CachedResourceXSLT + 1, object_type_enum_was_changed_please_fix_the_implementation);
+        for (int i = MemoryInstrumentation::MemoryCacheStructures; i < MemoryInstrumentation::LastTypeEntry; ++i)
+            totalSize += m_domMemoryUsage.totalSize(static_cast<MemoryInstrumentation::ObjectType>(i));
+
+        RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > children = TypeBuilder::Array<InspectorMemoryBlock>::create();
+        addMemoryBlockFor(children.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::MemoryCacheStructures), MemoryBlockName::memoryCacheStructures);
+        addMemoryBlockFor(children.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::CachedResource), MemoryBlockName::cachedResource);
+        addMemoryBlockFor(children.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::CachedResourceCSS), MemoryBlockName::cachedResourceCSS);
+        addMemoryBlockFor(children.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::CachedResourceFont), MemoryBlockName::cachedResourceFont);
+        addMemoryBlockFor(children.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::CachedResourceImage), MemoryBlockName::cachedResourceImage);
+        addMemoryBlockFor(children.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::CachedResourceScript), MemoryBlockName::cachedResourceScript);
+        addMemoryBlockFor(children.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::CachedResourceSVG), MemoryBlockName::cachedResourceSVG);
+        addMemoryBlockFor(children.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::CachedResourceShader), MemoryBlockName::cachedResourceShader);
+        addMemoryBlockFor(children.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::CachedResourceXSLT), MemoryBlockName::cachedResourceXSLT);
+
+        RefPtr<InspectorMemoryBlock> block = InspectorMemoryBlock::create().setName(MemoryBlockName::memoryCache);
+        block->setSize(totalSize);
+        block->setChildren(children.release());
+        return block.release();
     }
 
-    void visitFrame(Frame* frame)
+    PassRefPtr<InspectorMemoryBlock> buildObjectForDOM() const
     {
-        m_domMemoryUsage.addInstrumentedMember(frame);
-        m_domMemoryUsage.processDeferredInstrumentedPointers();
-    }
+        size_t totalSize = 0;
+        for (int i = MemoryInstrumentation::Other; i < MemoryInstrumentation::MemoryCacheStructures; ++i)
+            totalSize += m_domMemoryUsage.totalSize(static_cast<MemoryInstrumentation::ObjectType>(i));
 
-    void visitBindings()
-    {
-        ScriptProfiler::collectBindingMemoryInfo(&m_domMemoryUsage);
-        m_domMemoryUsage.processDeferredInstrumentedPointers();
+        RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > domChildren = TypeBuilder::Array<InspectorMemoryBlock>::create();
+        addMemoryBlockFor(domChildren.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::Other), MemoryBlockName::domTreeOther);
+        addMemoryBlockFor(domChildren.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::DOM), MemoryBlockName::domTreeDOM);
+        addMemoryBlockFor(domChildren.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::CSS), MemoryBlockName::domTreeCSS);
+        addMemoryBlockFor(domChildren.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::Binding), MemoryBlockName::domTreeBinding);
+        addMemoryBlockFor(domChildren.get(), m_domMemoryUsage.totalSize(MemoryInstrumentation::Loader), MemoryBlockName::domTreeLoader);
+
+        RefPtr<InspectorMemoryBlock> dom = InspectorMemoryBlock::create().setName(MemoryBlockName::dom);
+        dom->setSize(totalSize);
+        dom->setChildren(domChildren.release());
+        return dom.release();
     }
 
-    PassRefPtr<InspectorMemoryBlock> dumpStatistics(InspectorDataCounter* inspectorData)
+    void dumpStatistics(TypeBuilder::Array<InspectorMemoryBlock>* children, InspectorDataCounter* inspectorData)
     {
-        return m_domMemoryUsage.dumpStatistics(inspectorData);
+        children->addItem(buildObjectForMemoryCache());
+        children->addItem(buildObjectForDOM());
+        inspectorData->addComponent(MemoryBlockName::inspectorDOMData, m_domMemoryUsage.selfSize());
     }
 
 private:
@@ -569,9 +538,10 @@ private:
 
 }
 
-static PassRefPtr<InspectorMemoryBlock> domTreeInfo(Page* page, VisitedObjects& visitedObjects, InspectorDataCounter* inspectorData)
+static void collectDomTreeInfo(Page* page, VisitedObjects& visitedObjects, TypeBuilder::Array<InspectorMemoryBlock>* children, InspectorDataCounter* inspectorData)
 {
     DOMTreesIterator domTreesIterator(page, visitedObjects);
+
     ScriptProfiler::visitNodeWrappers(&domTreesIterator);
 
     // Make sure all documents reachable from the main frame are accounted.
@@ -583,29 +553,20 @@ static PassRefPtr<InspectorMemoryBlock> domTreeInfo(Page* page, VisitedObjects&
     }
 
     domTreesIterator.visitBindings();
+    domTreesIterator.visitMemoryCache();
 
-    return domTreesIterator.dumpStatistics(inspectorData);
+    domTreesIterator.dumpStatistics(children, inspectorData);
 }
 
-static PassRefPtr<InspectorMemoryBlock> memoryCacheInfo()
+static void addPlatformComponentsInfo(PassRefPtr<TypeBuilder::Array<InspectorMemoryBlock> > children)
 {
-    MemoryCache::Statistics stats = memoryCache()->getStatistics();
-    int totalSize = stats.images.size +
-                    stats.cssStyleSheets.size +
-                    stats.scripts.size +
-                    stats.xslStyleSheets.size +
-                    stats.fonts.size;
-    RefPtr<InspectorMemoryBlock> memoryCacheStats = InspectorMemoryBlock::create().setName(MemoryBlockName::memoryCache);
-    memoryCacheStats->setSize(totalSize);
-
-    RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > children = TypeBuilder::Array<InspectorMemoryBlock>::create();
-    addMemoryBlockFor(children.get(), stats.images.size, MemoryBlockName::cachedImages);
-    addMemoryBlockFor(children.get(), stats.cssStyleSheets.size, MemoryBlockName::cachedCssStyleSheets);
-    addMemoryBlockFor(children.get(), stats.scripts.size, MemoryBlockName::cachedScripts);
-    addMemoryBlockFor(children.get(), stats.xslStyleSheets.size, MemoryBlockName::cachedXslStyleSheets);
-    addMemoryBlockFor(children.get(), stats.fonts.size, MemoryBlockName::cachedFonts);
-    memoryCacheStats->setChildren(children.get());
-    return memoryCacheStats.release();
+    Vector<MemoryUsageSupport::ComponentInfo> components;
+    MemoryUsageSupport::memoryUsageByComponents(components);
+    for (Vector<MemoryUsageSupport::ComponentInfo>::iterator it = components.begin(); it != components.end(); ++it) {
+        RefPtr<InspectorMemoryBlock> block = InspectorMemoryBlock::create().setName(it->m_name);
+        block->setSize(it->m_sizeInBytes);
+        children->addItem(block);
+    }
 }
 
 static PassRefPtr<InspectorMemoryBlock> jsExternalResourcesInfo(VisitedObjects& visitedObjects)
@@ -629,6 +590,13 @@ static PassRefPtr<InspectorMemoryBlock> jsExternalResourcesInfo(VisitedObjects&
     return externalResourcesStats.release();
 }
 
+static PassRefPtr<InspectorMemoryBlock> dumpDOMStorageCache(size_t cacheSize)
+{
+    RefPtr<InspectorMemoryBlock> domStorageCache = InspectorMemoryBlock::create().setName(MemoryBlockName::domStorageCache);
+    domStorageCache->setSize(cacheSize);
+    return domStorageCache;
+}
+
 void InspectorMemoryAgent::getProcessMemoryDistribution(ErrorString*, RefPtr<InspectorMemoryBlock>& processMemory)
 {
     processMemory = InspectorMemoryBlock::create().setName(MemoryBlockName::processPrivateMemory);
@@ -639,11 +607,12 @@ void InspectorMemoryAgent::getProcessMemoryDistribution(ErrorString*, RefPtr<Ins
     VisitedObjects visitedObjects;
     RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > children = TypeBuilder::Array<InspectorMemoryBlock>::create();
     children->addItem(jsHeapInfo());
-    children->addItem(memoryCacheInfo());
     children->addItem(renderTreeInfo(m_page)); // FIXME: collect for all pages?
-    children->addItem(domTreeInfo(m_page, visitedObjects, &inspectorData)); // FIXME: collect for all pages?
     children->addItem(jsExternalResourcesInfo(visitedObjects));
+    collectDomTreeInfo(m_page, visitedObjects, children.get(), &inspectorData); // FIXME: collect for all pages?
     children->addItem(inspectorData.dumpStatistics());
+    children->addItem(dumpDOMStorageCache(m_domStorageAgent->memoryBytesUsedByStorageCache()));
+    addPlatformComponentsInfo(children);
     processMemory->setChildren(children);
 
     size_t privateBytes = 0;
@@ -652,9 +621,10 @@ void InspectorMemoryAgent::getProcessMemoryDistribution(ErrorString*, RefPtr<Ins
     processMemory->setSize(privateBytes);
 }
 
-InspectorMemoryAgent::InspectorMemoryAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, Page* page, InspectorDOMAgent*)
+InspectorMemoryAgent::InspectorMemoryAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, Page* page, InspectorDOMStorageAgent* domStorageAgent)
     : InspectorBaseAgent<InspectorMemoryAgent>("Memory", instrumentingAgents, state)
     , m_page(page)
+    , m_domStorageAgent(domStorageAgent)
 {
 }
 
diff --git a/Source/WebCore/inspector/InspectorMemoryAgent.h b/Source/WebCore/inspector/InspectorMemoryAgent.h
index 91f3fbed5..3b648642e 100644
--- a/Source/WebCore/inspector/InspectorMemoryAgent.h
+++ b/Source/WebCore/inspector/InspectorMemoryAgent.h
@@ -38,10 +38,9 @@
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
-class InspectorDOMAgent;
-class InspectorFrontend;
+
+class InspectorDOMStorageAgent;
 class InspectorState;
-class InspectorArray;
 class InstrumentingAgents;
 class Page;
 
@@ -52,19 +51,19 @@ class InspectorMemoryAgent : public InspectorBaseAgent<InspectorMemoryAgent>, pu
 public:
     typedef Vector<OwnPtr<InspectorBaseAgentInterface> > InspectorAgents;
 
-    static PassOwnPtr<InspectorMemoryAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, Page* page, InspectorDOMAgent* domAgent)
+    static PassOwnPtr<InspectorMemoryAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, Page* page, InspectorDOMStorageAgent* domStorageAgent)
     {
-        return adoptPtr(new InspectorMemoryAgent(instrumentingAgents, state, page, domAgent));
+        return adoptPtr(new InspectorMemoryAgent(instrumentingAgents, state, page, domStorageAgent));
     }
     virtual ~InspectorMemoryAgent();
 
     virtual void getDOMNodeCount(ErrorString*, RefPtr<TypeBuilder::Array<TypeBuilder::Memory::DOMGroup> >& domGroups, RefPtr<TypeBuilder::Memory::StringStatistics>& strings);
     virtual void getProcessMemoryDistribution(ErrorString*, RefPtr<TypeBuilder::Memory::MemoryBlock>& processMemory);
 
-
 private:
-    InspectorMemoryAgent(InstrumentingAgents*, InspectorState*, Page*, InspectorDOMAgent* domAgent);
+    InspectorMemoryAgent(InstrumentingAgents*, InspectorState*, Page*, InspectorDOMStorageAgent*);
     Page* m_page;
+    InspectorDOMStorageAgent* m_domStorageAgent;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.cpp b/Source/WebCore/inspector/InspectorOverlay.cpp
index 10c785b2a..21bd0ed49 100644
--- a/Source/WebCore/inspector/DOMNodeHighlighter.cpp
+++ b/Source/WebCore/inspector/InspectorOverlay.cpp
@@ -30,7 +30,7 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "DOMNodeHighlighter.h"
+#include "InspectorOverlay.h"
 
 #include "Element.h"
 #include "FontCache.h"
@@ -113,35 +113,35 @@ void drawOutlinedQuadWithClip(GraphicsContext& context, const FloatQuad& quad, c
     context.restore();
 }
 
-void drawHighlightForBox(GraphicsContext& context, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad, HighlightData* highlightData)
+void drawHighlightForBox(GraphicsContext& context, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad, const HighlightConfig& highlightConfig)
 {
-    bool hasMargin = highlightData->margin != Color::transparent;
-    bool hasBorder = highlightData->border != Color::transparent;
-    bool hasPadding = highlightData->padding != Color::transparent;
-    bool hasContent = highlightData->content != Color::transparent || highlightData->contentOutline != Color::transparent;
+    bool hasMargin = highlightConfig.margin != Color::transparent;
+    bool hasBorder = highlightConfig.border != Color::transparent;
+    bool hasPadding = highlightConfig.padding != Color::transparent;
+    bool hasContent = highlightConfig.content != Color::transparent || highlightConfig.contentOutline != Color::transparent;
 
     FloatQuad clipQuad;
     Color clipColor;
     if (hasMargin && (!hasBorder || marginQuad != borderQuad)) {
-        drawOutlinedQuadWithClip(context, marginQuad, borderQuad, highlightData->margin);
+        drawOutlinedQuadWithClip(context, marginQuad, borderQuad, highlightConfig.margin);
         clipQuad = borderQuad;
     }
     if (hasBorder && (!hasPadding || borderQuad != paddingQuad)) {
-        drawOutlinedQuadWithClip(context, borderQuad, paddingQuad, highlightData->border);
+        drawOutlinedQuadWithClip(context, borderQuad, paddingQuad, highlightConfig.border);
         clipQuad = paddingQuad;
     }
     if (hasPadding && (!hasContent || paddingQuad != contentQuad)) {
-        drawOutlinedQuadWithClip(context, paddingQuad, contentQuad, highlightData->padding);
+        drawOutlinedQuadWithClip(context, paddingQuad, contentQuad, highlightConfig.padding);
         clipQuad = contentQuad;
     }
     if (hasContent)
-        drawOutlinedQuad(context, contentQuad, highlightData->content, highlightData->contentOutline);
+        drawOutlinedQuad(context, contentQuad, highlightConfig.content, highlightConfig.contentOutline);
 }
 
-void drawHighlightForSVGRenderer(GraphicsContext& context, const Vector<FloatQuad>& absoluteQuads, HighlightData* highlightData)
+void drawHighlightForSVGRenderer(GraphicsContext& context, const Vector<FloatQuad>& absoluteQuads, const HighlightConfig& highlightConfig)
 {
     for (size_t i = 0; i < absoluteQuads.size(); ++i)
-        drawOutlinedQuad(context, absoluteQuads[i], highlightData->content, Color::transparent);
+        drawOutlinedQuad(context, absoluteQuads[i], highlightConfig.content, Color::transparent);
 }
 
 int drawSubstring(const TextRun& globalTextRun, int offset, int length, const Color& textColor, const Font& font, GraphicsContext& context, const LayoutRect& titleRect)
@@ -363,9 +363,8 @@ static void contentsQuadToPage(const FrameView* mainView, const FrameView* view,
     quad += mainView->scrollOffset();
 }
 
-static void getOrDrawNodeHighlight(GraphicsContext* context, HighlightData* highlightData, Highlight* highlight)
+static void getOrDrawNodeHighlight(GraphicsContext* context, Node* node, const HighlightConfig& highlightConfig, Highlight* highlight)
 {
-    Node* node = highlightData->node.get();
     RenderObject* renderer = node->renderer();
     Frame* containingFrame = node->document()->frame();
 
@@ -397,7 +396,7 @@ static void getOrDrawNodeHighlight(GraphicsContext* context, HighlightData* high
             contentsQuadToPage(mainView, containingView, highlight->quads[i]);
 
         if (context)
-            drawHighlightForSVGRenderer(*context, highlight->quads, highlightData);
+            drawHighlightForSVGRenderer(*context, highlight->quads, highlightConfig);
     } else if (renderer->isBox() || renderer->isRenderInline()) {
         LayoutRect contentBox;
         LayoutRect paddingBox;
@@ -451,7 +450,7 @@ static void getOrDrawNodeHighlight(GraphicsContext* context, HighlightData* high
         highlight->quads.append(absContentQuad);
 
         if (context)
-            drawHighlightForBox(*context, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad, highlightData);
+            drawHighlightForBox(*context, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad, highlightConfig);
     }
 
     // Draw node title if necessary.
@@ -459,16 +458,16 @@ static void getOrDrawNodeHighlight(GraphicsContext* context, HighlightData* high
     if (!node->isElementNode())
         return;
 
-    if (context && highlightData->showInfo)
+    if (context && highlightConfig.showInfo)
         drawElementTitle(*context, node, renderer, pixelSnappedIntRect(boundingBox), pixelSnappedIntRect(titleAnchorBox), visibleRect, containingFrame->settings());
 }
 
-static void getOrDrawRectHighlight(GraphicsContext* context, Page* page, HighlightData* highlightData, Highlight *highlight)
+static void getOrDrawRectHighlight(GraphicsContext* context, Page* page, IntRect* rect, const HighlightConfig& highlightConfig, Highlight *highlight)
 {
     if (!page)
         return;
 
-    FloatRect highlightRect(*(highlightData->rect));
+    FloatRect highlightRect(*rect);
 
     highlight->type = HighlightTypeRects;
     highlight->quads.append(highlightRect);
@@ -480,7 +479,7 @@ static void getOrDrawRectHighlight(GraphicsContext* context, Page* page, Highlig
             context->translate(-visibleRect.x(), -visibleRect.y());
         }
 
-        drawOutlinedQuad(*context, highlightRect, highlightData->content, highlightData->contentOutline);
+        drawOutlinedQuad(*context, highlightRect, highlightConfig.content, highlightConfig.contentOutline);
     }
 }
 
@@ -495,7 +494,8 @@ InspectorOverlay::InspectorOverlay(Page* page, InspectorClient* client)
 void InspectorOverlay::paint(GraphicsContext& context)
 {
     drawPausedInDebugger(context);
-    drawHighlight(context);
+    drawNodeHighlight(context);
+    drawRectHighlight(context);
 }
 
 void InspectorOverlay::drawOutline(GraphicsContext& context, const LayoutRect& rect, const Color& color)
@@ -506,19 +506,17 @@ void InspectorOverlay::drawOutline(GraphicsContext& context, const LayoutRect& r
 
 void InspectorOverlay::getHighlight(Highlight* highlight) const
 {
-    if (!m_highlightData)
+    if (!m_highlightNode && !m_highlightRect)
         return;
 
-    highlight->contentColor = m_highlightData->content;
-    highlight->paddingColor = m_highlightData->padding;
-    highlight->borderColor = m_highlightData->border;
-    highlight->marginColor = m_highlightData->margin;
     highlight->type = HighlightTypeRects;
-
-    if (m_highlightData->node)
-        getOrDrawNodeHighlight(0, m_highlightData.get(), highlight);
-    else if (m_highlightData->rect)
-        getOrDrawRectHighlight(0, m_page, m_highlightData.get(), highlight);
+    if (m_highlightNode) {
+        highlight->setColors(m_nodeHighlightConfig);
+        getOrDrawNodeHighlight(0, m_highlightNode.get(), m_nodeHighlightConfig, highlight);
+    } else {
+        highlight->setColors(m_rectHighlightConfig);
+        getOrDrawRectHighlight(0, m_page, m_highlightRect.get(), m_rectHighlightConfig, highlight);
+    }
 }
 
 void InspectorOverlay::setPausedInDebuggerMessage(const String* message)
@@ -529,57 +527,54 @@ void InspectorOverlay::setPausedInDebuggerMessage(const String* message)
 
 void InspectorOverlay::hideHighlight()
 {
-    if (m_highlightData) {
-        // FIXME: Clear entire highlight data here, store config upon setInspectModeEnabled
-        m_highlightData->rect.clear();
-        m_highlightData->node.clear();
-    }
-    update();
-}
-
-void InspectorOverlay::highlightNode(Node* node)
-{
-    if (m_highlightData)
-        m_highlightData->node = node;
+    m_highlightNode.clear();
+    m_highlightRect.clear();
     update();
 }
 
-void InspectorOverlay::setHighlightData(PassOwnPtr<HighlightData> highlightData)
+void InspectorOverlay::highlightNode(Node* node, const HighlightConfig& highlightConfig)
 {
-    m_highlightData = highlightData;
+    m_nodeHighlightConfig = highlightConfig;
+    m_highlightNode = node;
     update();
 }
 
-void InspectorOverlay::clearHighlightData()
+void InspectorOverlay::highlightRect(PassOwnPtr<IntRect> rect, const HighlightConfig& highlightConfig)
 {
-    m_highlightData.clear();
+    m_rectHighlightConfig = highlightConfig;
+    m_highlightRect = rect;
     update();
 }
 
 Node* InspectorOverlay::highlightedNode() const
 {
-    return m_highlightData ? m_highlightData->node.get() : 0;
+    return m_highlightNode.get();
 }
 
 void InspectorOverlay::update()
 {
-    // FIXME(91926) Refactor highlightNode to pass highlight data along with the call.
-    if ((m_highlightData && (m_highlightData->rect || m_highlightData->node)) || !m_pausedInDebuggerMessage.isNull())
+    if (m_highlightNode || m_highlightRect || !m_pausedInDebuggerMessage.isNull())
         m_client->highlight();
     else
         m_client->hideHighlight();
 }
 
-void InspectorOverlay::drawHighlight(GraphicsContext& context)
+void InspectorOverlay::drawNodeHighlight(GraphicsContext& context)
+{
+    if (!m_highlightNode)
+        return;
+
+    Highlight highlight;
+    getOrDrawNodeHighlight(&context, m_highlightNode.get(), m_nodeHighlightConfig, &highlight);
+}
+
+void InspectorOverlay::drawRectHighlight(GraphicsContext& context)
 {
-    if (!m_highlightData || (!m_highlightData->rect && !m_highlightData->node))
+    if (!m_highlightRect)
         return;
 
     Highlight highlight;
-    if (m_highlightData->node)
-        getOrDrawNodeHighlight(&context, m_highlightData.get(), &highlight);
-    else if (m_highlightData->rect)
-        getOrDrawRectHighlight(&context, m_page, m_highlightData.get(), &highlight);
+    getOrDrawRectHighlight(&context, m_page, m_highlightRect.get(), m_rectHighlightConfig, &highlight);
 }
 
 void InspectorOverlay::drawPausedInDebugger(GraphicsContext& context)
@@ -593,7 +588,7 @@ void InspectorOverlay::drawPausedInDebugger(GraphicsContext& context)
 
     Frame* frame = m_page->mainFrame();
     Settings* settings = frame->settings();
-    IntRect visibleRect = frame->view()->visibleContentRect();
+    IntRect visibleRect = IntRect(IntPoint(), frame->view()->visibleSize());
 
     context.setFillColor(backgroundColor, ColorSpaceDeviceRGB);
     context.fillRect(visibleRect);
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.h b/Source/WebCore/inspector/InspectorOverlay.h
index a200ccc9b..ac22ff1c3 100644
--- a/Source/WebCore/inspector/DOMNodeHighlighter.h
+++ b/Source/WebCore/inspector/InspectorOverlay.h
@@ -26,8 +26,8 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef DOMNodeHighlighter_h
-#define DOMNodeHighlighter_h
+#ifndef InspectorOverlay_h
+#define InspectorOverlay_h
 
 #include "Color.h"
 #include "FloatQuad.h"
@@ -48,17 +48,13 @@ class IntRect;
 class Node;
 class Page;
 
-struct HighlightData {
+struct HighlightConfig {
     Color content;
     Color contentOutline;
     Color padding;
     Color border;
     Color margin;
     bool showInfo;
-
-    // Either of these must be 0.
-    RefPtr<Node> node;
-    OwnPtr<IntRect> rect;
 };
 
 enum HighlightType {
@@ -67,6 +63,14 @@ enum HighlightType {
 };
 
 struct Highlight {
+    void setColors(const HighlightConfig& highlightConfig)
+    {
+        contentColor = highlightConfig.content;
+        paddingColor = highlightConfig.padding;
+        borderColor = highlightConfig.border;
+        marginColor = highlightConfig.margin;
+    }
+
     Color contentColor;
     Color paddingColor;
     Color borderColor;
@@ -92,9 +96,8 @@ public:
     void setPausedInDebuggerMessage(const String*);
 
     void hideHighlight();
-    void highlightNode(Node*);
-    void setHighlightData(PassOwnPtr<HighlightData>);
-    void clearHighlightData();
+    void highlightNode(Node*, const HighlightConfig&);
+    void highlightRect(PassOwnPtr<IntRect>, const HighlightConfig&);
 
     Node* highlightedNode() const;
 
@@ -102,16 +105,20 @@ private:
     InspectorOverlay(Page*, InspectorClient*);
 
     void update();
-    void drawHighlight(GraphicsContext&);
+    void drawNodeHighlight(GraphicsContext&);
+    void drawRectHighlight(GraphicsContext&);
     void drawPausedInDebugger(GraphicsContext&);
 
     Page* m_page;
     InspectorClient* m_client;
     String m_pausedInDebuggerMessage;
-    OwnPtr<HighlightData> m_highlightData;
+    RefPtr<Node> m_highlightNode;
+    HighlightConfig m_nodeHighlightConfig;
+    OwnPtr<IntRect> m_highlightRect;
+    HighlightConfig m_rectHighlightConfig;
 };
 
 } // namespace WebCore
 
 
-#endif // DOMNodeHighlighter_h
+#endif // InspectorOverlay_h
diff --git a/Source/WebCore/inspector/InspectorPageAgent.cpp b/Source/WebCore/inspector/InspectorPageAgent.cpp
index 99d02fe27..c6b06bfa6 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorPageAgent.cpp
@@ -44,8 +44,8 @@
 #include "Cookie.h"
 #include "CookieJar.h"
 #include "DOMImplementation.h"
-#include "DOMNodeHighlighter.h"
 #include "DOMPatchSupport.h"
+#include "DeviceOrientationController.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
@@ -60,6 +60,7 @@
 #include "InspectorClient.h"
 #include "InspectorFrontend.h"
 #include "InspectorInstrumentation.h"
+#include "InspectorOverlay.h"
 #include "InspectorState.h"
 #include "InspectorValues.h"
 #include "InstrumentingAgents.h"
@@ -92,6 +93,9 @@ static const char pageAgentScreenHeightOverride[] = "pageAgentScreenHeightOverri
 static const char pageAgentFontScaleFactorOverride[] = "pageAgentFontScaleFactorOverride";
 static const char pageAgentFitWindow[] = "pageAgentFitWindow";
 static const char showPaintRects[] = "showPaintRects";
+#if ENABLE(TOUCH_EVENTS)
+static const char touchEventEmulationEnabled[] = "touchEventEmulationEnabled";
+#endif
 }
 
 static bool decodeSharedBuffer(PassRefPtr<SharedBuffer> buffer, const String& textEncodingName, String* result)
@@ -334,6 +338,9 @@ void InspectorPageAgent::clearFrontend()
 {
     ErrorString error;
     disable(&error);
+#if ENABLE(TOUCH_EVENTS)
+    updateTouchEventEmulationInPage(false);
+#endif
     m_frontend = 0;
 }
 
@@ -352,6 +359,9 @@ void InspectorPageAgent::restore()
 
         if (m_inspectorAgent->didCommitLoadFired())
             frameNavigated(m_page->mainFrame()->loader()->documentLoader());
+#if ENABLE(TOUCH_EVENTS)
+        updateTouchEventEmulationInPage(m_state->getBoolean(PageAgentState::touchEventEmulationEnabled));
+#endif
     }
 }
 
@@ -972,6 +982,15 @@ void InspectorPageAgent::updateViewMetrics(int width, int height, double fontSca
     InspectorInstrumentation::mediaQueryResultChanged(document);
 }
 
+#if ENABLE(TOUCH_EVENTS)
+void InspectorPageAgent::updateTouchEventEmulationInPage(bool enabled)
+{
+    m_state->setBoolean(PageAgentState::touchEventEmulationEnabled, enabled);
+    if (mainFrame() && mainFrame()->settings())
+        mainFrame()->settings()->setTouchEventEmulationEnabled(enabled);
+}
+#endif
+
 void InspectorPageAgent::setGeolocationOverride(ErrorString* error, const double* latitude, const double* longitude, const double* accuracy)
 {
 #if ENABLE (GEOLOCATION)
@@ -1033,6 +1052,55 @@ GeolocationPosition* InspectorPageAgent::overrideGeolocationPosition(Geolocation
     return position;
 }
 
+void InspectorPageAgent::setDeviceOrientationOverride(ErrorString* error, double alpha, double beta, double gamma)
+{
+    DeviceOrientationController* controller = DeviceOrientationController::from(m_page);
+    if (!controller) {
+        *error = "Internal error: unable to override device orientation.";
+        return;
+    }
+
+    ErrorString clearError;
+    clearDeviceOrientationOverride(&clearError);
+
+    m_deviceOrientation = DeviceOrientationData::create(true, alpha, true, beta, true, gamma);
+    controller->didChangeDeviceOrientation(m_deviceOrientation.get());
+}
+
+void InspectorPageAgent::clearDeviceOrientationOverride(ErrorString*)
+{
+    m_deviceOrientation.clear();
+}
+
+void InspectorPageAgent::canOverrideDeviceOrientation(ErrorString*, bool* outParam)
+{
+#if ENABLE(DEVICE_ORIENTATION)
+    *outParam = true;
+#else
+    *outParam = false;
+#endif
+}
+
+DeviceOrientationData* InspectorPageAgent::overrideDeviceOrientation(DeviceOrientationData* deviceOrientation)
+{
+    if (m_deviceOrientation)
+        deviceOrientation = m_deviceOrientation.get();
+    return deviceOrientation;
+}
+
+void InspectorPageAgent::setTouchEmulationEnabled(ErrorString* error, bool enabled)
+{
+#if ENABLE(TOUCH_EVENTS)
+    if (m_state->getBoolean(PageAgentState::touchEventEmulationEnabled) == enabled)
+        return;
+    UNUSED_PARAM(error);
+    updateTouchEventEmulationInPage(enabled);
+#else
+    *error = "Touch events emulation not supported";
+    UNUSED_PARAM(enabled);
+#endif
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorPageAgent.h b/Source/WebCore/inspector/InspectorPageAgent.h
index e8a98c56c..7b91779f9 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.h
+++ b/Source/WebCore/inspector/InspectorPageAgent.h
@@ -33,6 +33,7 @@
 
 #if ENABLE(INSPECTOR)
 
+#include "DeviceOrientationData.h"
 #include "Frame.h"
 #include "GeolocationPosition.h"
 #include "InspectorBaseAgent.h"
@@ -113,11 +114,17 @@ public:
     virtual void setGeolocationOverride(ErrorString*, const double*, const double*, const double*);
     virtual void clearGeolocationOverride(ErrorString*);
     virtual void canOverrideGeolocation(ErrorString*, bool* out_param);
-
+    virtual void setDeviceOrientationOverride(ErrorString*, double, double, double);
+    virtual void clearDeviceOrientationOverride(ErrorString*);
+    virtual void canOverrideDeviceOrientation(ErrorString*, bool*);
+    virtual void setTouchEmulationEnabled(ErrorString*, bool);
 
     // Geolocation override helpers.
     GeolocationPosition* overrideGeolocationPosition(GeolocationPosition*);
 
+    // DeviceOrientation helper
+    DeviceOrientationData* overrideDeviceOrientation(DeviceOrientationData*);
+
     // InspectorInstrumentation API
     void didClearWindowObjectInWorld(Frame*, DOMWrapperWorld*);
     void domContentEventFired();
@@ -148,6 +155,9 @@ public:
 private:
     InspectorPageAgent(InstrumentingAgents*, Page*, InspectorAgent*, InspectorState*, InjectedScriptManager*, InspectorClient*, InspectorOverlay*);
     void updateViewMetrics(int, int, double, bool);
+#if ENABLE(TOUCH_EVENTS)
+    void updateTouchEventEmulationInPage(bool);
+#endif
 
     PassRefPtr<TypeBuilder::Page::Frame> buildObjectForFrame(Frame*);
     PassRefPtr<TypeBuilder::Page::FrameResourceTree> buildObjectForFrameTree(Frame*);
@@ -169,6 +179,7 @@ private:
     bool m_geolocationOverridden;
     RefPtr<GeolocationPosition> m_geolocationPosition;
     RefPtr<GeolocationPosition> m_platformGeolocationPosition;
+    RefPtr<DeviceOrientationData> m_deviceOrientation;
 };
 
 
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.h b/Source/WebCore/inspector/InspectorResourceAgent.h
index 8dab25308..67ca478e0 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.h
+++ b/Source/WebCore/inspector/InspectorResourceAgent.h
@@ -133,8 +133,6 @@ public:
     virtual void setUserAgentOverride(ErrorString*, const String& userAgent);
     virtual void setExtraHTTPHeaders(ErrorString*, const RefPtr<InspectorObject>&);
     virtual void getResponseBody(ErrorString*, const String& requestId, String* content, bool* base64Encoded);
-    // FIXME: this seems to be unsued.
-    void clearCache(ErrorString*, const String* const optionalPreservedLoaderId);
 
     virtual void canClearBrowserCache(ErrorString*, bool*);
     virtual void clearBrowserCache(ErrorString*);
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.cpp b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
index 5c6bece1d..8cc343912 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -378,19 +378,19 @@ void InspectorTimelineAgent::didFinishLoadingResource(unsigned long identifier,
     appendRecord(TimelineRecordFactory::createResourceFinishData(IdentifiersFactory::requestId(identifier), didFail, finishTime * 1000), TimelineRecordType::ResourceFinish, false, frame);
 }
 
-void InspectorTimelineAgent::didTimeStamp(const String& message)
+void InspectorTimelineAgent::didTimeStamp(Frame* frame, const String& message)
 {
-    appendRecord(TimelineRecordFactory::createTimeStampData(message), TimelineRecordType::TimeStamp, true, 0);
+    appendRecord(TimelineRecordFactory::createTimeStampData(message), TimelineRecordType::TimeStamp, true, frame);
 }
 
-void InspectorTimelineAgent::time(const String& message)
+void InspectorTimelineAgent::time(Frame* frame, const String& message)
 {
-    appendRecord(TimelineRecordFactory::createTimeStampData(message), TimelineRecordType::Time, true, 0);
+    appendRecord(TimelineRecordFactory::createTimeStampData(message), TimelineRecordType::Time, true, frame);
 }
 
-void InspectorTimelineAgent::timeEnd(const String& message)
+void InspectorTimelineAgent::timeEnd(Frame* frame, const String& message)
 {
-    appendRecord(TimelineRecordFactory::createTimeStampData(message), TimelineRecordType::TimeEnd, true, 0);
+    appendRecord(TimelineRecordFactory::createTimeStampData(message), TimelineRecordType::TimeEnd, true, frame);
 }
 
 void InspectorTimelineAgent::didMarkDOMContentEvent(Frame* frame)
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.h b/Source/WebCore/inspector/InspectorTimelineAgent.h
index 2961b7720..0b4b90e84 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.h
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.h
@@ -121,12 +121,12 @@ public:
     void willEvaluateScript(const String&, int, Frame*);
     void didEvaluateScript();
 
-    void didTimeStamp(const String&);
+    void didTimeStamp(Frame*, const String&);
     void didMarkDOMContentEvent(Frame*);
     void didMarkLoadEvent(Frame*);
 
-    void time(const String&);
-    void timeEnd(const String&);
+    void time(Frame*, const String&);
+    void timeEnd(Frame*, const String&);
 
     void didScheduleResourceRequest(const String& url, Frame*);
     void willSendResourceRequest(unsigned long, const ResourceRequest&, Frame*);
diff --git a/Source/WebCore/inspector/InspectorValues.cpp b/Source/WebCore/inspector/InspectorValues.cpp
index b6c714bde..e4ead17e5 100644
--- a/Source/WebCore/inspector/InspectorValues.cpp
+++ b/Source/WebCore/inspector/InspectorValues.cpp
@@ -625,7 +625,7 @@ void InspectorBasicValue::writeJSON(StringBuilder* output) const
         else
             output->append(falseString, 5);
     } else if (type() == TypeNumber) {
-        NumberToUStringBuffer buffer;
+        NumberToLStringBuffer buffer;
         if (!isfinite(m_doubleValue)) {
             output->append(nullString, 4);
             return;
diff --git a/Source/WebCore/inspector/InspectorWorkerAgent.cpp b/Source/WebCore/inspector/InspectorWorkerAgent.cpp
index 1b3859571..24beeb57d 100644
--- a/Source/WebCore/inspector/InspectorWorkerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorWorkerAgent.cpp
@@ -140,15 +140,20 @@ void InspectorWorkerAgent::clearFrontend()
     destroyWorkerFrontendChannels();
 }
 
-void InspectorWorkerAgent::setWorkerInspectionEnabled(ErrorString*, bool value)
+void InspectorWorkerAgent::enable(ErrorString*)
 {
-    m_state->setBoolean(WorkerAgentState::workerInspectionEnabled, value);
+    m_state->setBoolean(WorkerAgentState::workerInspectionEnabled, true);
     if (!m_inspectorFrontend)
         return;
-    if (value)
-        createWorkerFrontendChannelsForExistingWorkers();
-    else
-        destroyWorkerFrontendChannels();
+    createWorkerFrontendChannelsForExistingWorkers();
+}
+
+void InspectorWorkerAgent::disable(ErrorString*)
+{
+    m_state->setBoolean(WorkerAgentState::workerInspectionEnabled, false);
+    if (!m_inspectorFrontend)
+        return;
+    destroyWorkerFrontendChannels();
 }
 
 void InspectorWorkerAgent::connectToWorker(ErrorString* error, int workerId)
diff --git a/Source/WebCore/inspector/InspectorWorkerAgent.h b/Source/WebCore/inspector/InspectorWorkerAgent.h
index be33a5071..6b44bc241 100644
--- a/Source/WebCore/inspector/InspectorWorkerAgent.h
+++ b/Source/WebCore/inspector/InspectorWorkerAgent.h
@@ -62,7 +62,8 @@ public:
     void workerContextTerminated(WorkerContextProxy*);
 
     // Called from InspectorBackendDispatcher
-    virtual void setWorkerInspectionEnabled(ErrorString*, bool value);
+    virtual void enable(ErrorString*);
+    virtual void disable(ErrorString*);
     virtual void connectToWorker(ErrorString*, int workerId);
     virtual void disconnectFromWorker(ErrorString*, int workerId);
     virtual void sendMessageToWorker(ErrorString*, int workerId, const RefPtr<InspectorObject>& message);
diff --git a/Source/WebCore/inspector/MemoryInstrumentationImpl.cpp b/Source/WebCore/inspector/MemoryInstrumentationImpl.cpp
new file mode 100644
index 000000000..347f72d5f
--- /dev/null
+++ b/Source/WebCore/inspector/MemoryInstrumentationImpl.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "MemoryInstrumentationImpl.h"
+
+namespace WebCore {
+
+MemoryInstrumentationImpl::MemoryInstrumentationImpl(VisitedObjects& visitedObjects)
+    : m_visitedObjects(visitedObjects)
+{
+    for (int i = 0; i < LastTypeEntry; ++i)
+        m_totalSizes[i] = 0;
+}
+
+void MemoryInstrumentationImpl::processDeferredInstrumentedPointers()
+{
+    while (!m_deferredInstrumentedPointers.isEmpty()) {
+        OwnPtr<InstrumentedPointerBase> pointer = m_deferredInstrumentedPointers.last().release();
+        m_deferredInstrumentedPointers.removeLast();
+        pointer->process(this);
+    }
+}
+
+void MemoryInstrumentationImpl::countObjectSize(ObjectType objectType, size_t size)
+{
+    ASSERT(objectType >= 0 && objectType < LastTypeEntry);
+    m_totalSizes[objectType] += size;
+}
+
+void MemoryInstrumentationImpl::deferInstrumentedPointer(PassOwnPtr<InstrumentedPointerBase> pointer)
+{
+    m_deferredInstrumentedPointers.append(pointer);
+}
+
+bool MemoryInstrumentationImpl::visited(const void* object)
+{
+    return !m_visitedObjects.add(object).isNewEntry;
+}
+
+size_t MemoryInstrumentationImpl::selfSize() const
+{
+    return calculateContainerSize(m_visitedObjects) + calculateContainerSize(m_deferredInstrumentedPointers);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp b/Source/WebCore/inspector/MemoryInstrumentationImpl.h
index f5bed3f3b..762f190a2 100644
--- a/Source/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp
+++ b/Source/WebCore/inspector/MemoryInstrumentationImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,39 +28,49 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include <wtf/ArrayBuffer.h>
-#include <wtf/Int16Array.h>
+#ifndef MemoryInstrumentationImpl_h
+#define MemoryInstrumentationImpl_h
 
-#include "V8Binding.h"
-#include "V8ArrayBuffer.h"
-#include "V8ArrayBufferViewCustom.h"
-#include "V8Int16Array.h"
-#include "V8Proxy.h"
+#include "MemoryInstrumentation.h"
+
+#include <wtf/HashSet.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
-v8::Handle<v8::Value> V8Int16Array::constructorCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Int16Array.Contructor");
+typedef HashSet<const void*> VisitedObjects;
+
+class MemoryInstrumentationImpl : public MemoryInstrumentation {
+public:
+    explicit MemoryInstrumentationImpl(VisitedObjects&);
+
+    size_t selfSize() const;
+    size_t totalSize(ObjectType objectType) const
+    {
+        ASSERT(objectType >= 0 && objectType < LastTypeEntry);
+        return m_totalSizes[objectType];
+    }
 
-    return constructWebGLArray<Int16Array, short>(args, &info, v8::kExternalShortArray);
-}
+    size_t reportedSizeForAllTypes() const
+    {
+        size_t size = 0;
+        for (int i = 0; i < LastTypeEntry; ++i)
+            size += m_totalSizes[i];
+        return size;
+    }
 
-v8::Handle<v8::Value> V8Int16Array::setCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Int16Array.set()");
-    return setWebGLArrayHelper<Int16Array, V8Int16Array>(args);
-}
+private:
+    virtual void countObjectSize(ObjectType, size_t) OVERRIDE;
+    virtual void deferInstrumentedPointer(PassOwnPtr<InstrumentedPointerBase>) OVERRIDE;
+    virtual bool visited(const void*) OVERRIDE;
+    virtual void processDeferredInstrumentedPointers() OVERRIDE;
 
-v8::Handle<v8::Value> toV8(Int16Array* impl, v8::Isolate* isolate)
-{
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8Int16Array::wrap(impl, isolate);
-    if (!wrapper.IsEmpty())
-        wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), v8::kExternalShortArray, impl->length());
-    return wrapper;
-}
+    size_t m_totalSizes[LastTypeEntry];
+    VisitedObjects& m_visitedObjects;
+    Vector<OwnPtr<InstrumentedPointerBase> > m_deferredInstrumentedPointers;
+};
 
 } // namespace WebCore
+
+#endif // !defined(MemoryInstrumentationImpl_h)
+
diff --git a/Source/WebCore/inspector/NetworkResourcesData.cpp b/Source/WebCore/inspector/NetworkResourcesData.cpp
index 7b1fd1746..e05d13dec 100644
--- a/Source/WebCore/inspector/NetworkResourcesData.cpp
+++ b/Source/WebCore/inspector/NetworkResourcesData.cpp
@@ -38,10 +38,10 @@
 
 namespace {
 // 100MB
-static int maximumResourcesContentSize = 100 * 1000 * 1000;
+static size_t maximumResourcesContentSize = 100 * 1000 * 1000;
 
 // 10MB
-static int maximumSingleResourceContentSize = 10 * 1000 * 1000;
+static size_t maximumSingleResourceContentSize = 10 * 1000 * 1000;
 }
 
 namespace WebCore {
@@ -66,6 +66,11 @@ void NetworkResourcesData::ResourceData::setContent(const String& content, bool
     m_base64Encoded = base64Encoded;
 }
 
+static size_t contentSizeInBytes(const String& content)
+{
+    return content.isNull() ? 0 : content.impl()->sizeInBytes();
+}
+
 unsigned NetworkResourcesData::ResourceData::removeContent()
 {
     unsigned result = 0;
@@ -77,7 +82,7 @@ unsigned NetworkResourcesData::ResourceData::removeContent()
 
     if (hasContent()) {
         ASSERT(!hasData());
-        result = 2 * m_content.length();
+        result = contentSizeInBytes(m_content);
         m_content = String();
     }
     return result;
@@ -89,12 +94,12 @@ unsigned NetworkResourcesData::ResourceData::purgeContent()
     return removeContent();
 }
 
-int NetworkResourcesData::ResourceData::dataLength() const
+size_t NetworkResourcesData::ResourceData::dataLength() const
 {
     return m_dataBuffer ? m_dataBuffer->size() : 0;
 }
 
-void NetworkResourcesData::ResourceData::appendData(const char* data, int dataLength)
+void NetworkResourcesData::ResourceData::appendData(const char* data, size_t dataLength)
 {
     ASSERT(!hasContent());
     if (!m_dataBuffer)
@@ -103,14 +108,14 @@ void NetworkResourcesData::ResourceData::appendData(const char* data, int dataLe
         m_dataBuffer->append(data, dataLength);
 }
 
-int NetworkResourcesData::ResourceData::decodeDataToContent()
+size_t NetworkResourcesData::ResourceData::decodeDataToContent()
 {
     ASSERT(!hasContent());
-    int dataLength = m_dataBuffer->size();
+    size_t dataLength = m_dataBuffer->size();
     m_content = m_decoder->decode(m_dataBuffer->data(), m_dataBuffer->size());
     m_content += m_decoder->flush();
     m_dataBuffer = nullptr;
-    return 2 * m_content.length() - dataLength;
+    return contentSizeInBytes(m_content) - dataLength;
 }
 
 // NetworkResourcesData
@@ -179,7 +184,7 @@ void NetworkResourcesData::setResourceContent(const String& requestId, const Str
     ResourceData* resourceData = m_requestIdToResourceDataMap.get(requestId);
     if (!resourceData)
         return;
-    int dataLength = 2 * content.length();
+    size_t dataLength = contentSizeInBytes(content);
     if (dataLength > m_maximumSingleResourceContentSize)
         return;
     if (resourceData->isContentPurged())
@@ -194,7 +199,7 @@ void NetworkResourcesData::setResourceContent(const String& requestId, const Str
     }
 }
 
-void NetworkResourcesData::maybeAddResourceData(const String& requestId, const char* data, int dataLength)
+void NetworkResourcesData::maybeAddResourceData(const String& requestId, const char* data, size_t dataLength)
 {
     ResourceData* resourceData = m_requestIdToResourceDataMap.get(requestId);
     if (!resourceData)
@@ -220,7 +225,7 @@ void NetworkResourcesData::maybeDecodeDataToContent(const String& requestId)
     if (!resourceData->hasData())
         return;
     m_contentSize += resourceData->decodeDataToContent();
-    int dataLength = 2 * resourceData->content().length();
+    size_t dataLength = contentSizeInBytes(resourceData->content());
     if (dataLength > m_maximumSingleResourceContentSize)
         m_contentSize -= resourceData->purgeContent();
 }
@@ -283,7 +288,7 @@ void NetworkResourcesData::clear(const String& preservedLoaderId)
     m_requestIdToResourceDataMap.swap(preservedMap);
 }
 
-void NetworkResourcesData::setResourcesDataSizeLimits(int maximumResourcesContentSize, int maximumSingleResourceContentSize)
+void NetworkResourcesData::setResourcesDataSizeLimits(size_t maximumResourcesContentSize, size_t maximumSingleResourceContentSize)
 {
     clear();
     m_maximumResourcesContentSize = maximumResourcesContentSize;
@@ -302,7 +307,7 @@ void NetworkResourcesData::ensureNoDataForRequestId(const String& requestId)
     }
 }
 
-bool NetworkResourcesData::ensureFreeSpace(int size)
+bool NetworkResourcesData::ensureFreeSpace(size_t size)
 {
     if (size > m_maximumResourcesContentSize)
         return false;
diff --git a/Source/WebCore/inspector/NetworkResourcesData.h b/Source/WebCore/inspector/NetworkResourcesData.h
index 5aa3f4a81..8dfd5dd0d 100644
--- a/Source/WebCore/inspector/NetworkResourcesData.h
+++ b/Source/WebCore/inspector/NetworkResourcesData.h
@@ -92,9 +92,9 @@ public:
 
     private:
         bool hasData() const { return m_dataBuffer; }
-        int dataLength() const;
-        void appendData(const char* data, int dataLength);
-        int decodeDataToContent();
+        size_t dataLength() const;
+        void appendData(const char* data, size_t dataLength);
+        size_t decodeDataToContent();
 
         String m_requestId;
         String m_loaderId;
@@ -123,7 +123,7 @@ public:
     void setResourceType(const String& requestId, InspectorPageAgent::ResourceType);
     InspectorPageAgent::ResourceType resourceType(const String& requestId);
     void setResourceContent(const String& requestId, const String& content, bool base64Encoded = false);
-    void maybeAddResourceData(const String& requestId, const char* data, int dataLength);
+    void maybeAddResourceData(const String& requestId, const char* data, size_t dataLength);
     void maybeDecodeDataToContent(const String& requestId);
     void addCachedResource(const String& requestId, CachedResource*);
     void addResourceSharedBuffer(const String& requestId, PassRefPtr<SharedBuffer>, const String& textEncodingName);
@@ -131,19 +131,19 @@ public:
     Vector<String> removeCachedResource(CachedResource*);
     void clear(const String& preservedLoaderId = String());
 
-    void setResourcesDataSizeLimits(int maximumResourcesContentSize, int maximumSingleResourceContentSize);
+    void setResourcesDataSizeLimits(size_t maximumResourcesContentSize, size_t maximumSingleResourceContentSize);
 
 private:
     void ensureNoDataForRequestId(const String& requestId);
-    bool ensureFreeSpace(int);
+    bool ensureFreeSpace(size_t);
 
     Deque<String> m_requestIdsDeque;
 
     typedef HashMap<String, ResourceData*> ResourceDataMap;
     ResourceDataMap m_requestIdToResourceDataMap;
-    int m_contentSize;
-    int m_maximumResourcesContentSize;
-    int m_maximumSingleResourceContentSize;
+    size_t m_contentSize;
+    size_t m_maximumResourcesContentSize;
+    size_t m_maximumSingleResourceContentSize;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/PageDebuggerAgent.cpp b/Source/WebCore/inspector/PageDebuggerAgent.cpp
index b646af193..c97323bf1 100644
--- a/Source/WebCore/inspector/PageDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/PageDebuggerAgent.cpp
@@ -35,7 +35,7 @@
 #include "PageDebuggerAgent.h"
 
 #include "Console.h"
-#include "DOMNodeHighlighter.h"
+#include "InspectorOverlay.h"
 #include "Page.h"
 #include "PageScriptDebugServer.h"
 
diff --git a/Source/WebCore/inspector/compile-front-end.py b/Source/WebCore/inspector/compile-front-end.py
index 4d29f7706..e6b498eeb 100755
--- a/Source/WebCore/inspector/compile-front-end.py
+++ b/Source/WebCore/inspector/compile-front-end.py
@@ -82,6 +82,7 @@ modules = [
             "DebuggerScriptMapping.js",
             "FileManager.js",
             "FileSystemModel.js",
+            "FileUtils.js",
             "HAREntry.js",
             "IndexedDBModel.js",
             "Linkifier.js",
@@ -119,6 +120,7 @@ modules = [
             "CookiesTable.js",
             "DOMSyntaxHighlighter.js",
             "DataGrid.js",
+            "DefaultTextEditor.js",
             "Dialog.js",
             "Drawer.js",
             "EmptyView.js",
@@ -128,6 +130,7 @@ modules = [
             "Panel.js",
             "PanelEnablerView.js",
             "Popover.js",
+            "ProgressBar.js",
             "PropertiesSection.js",
             "SearchController.js",
             "Section.js",
diff --git a/Source/WebCore/inspector/front-end/AdvancedSearchController.js b/Source/WebCore/inspector/front-end/AdvancedSearchController.js
index 69616280f..b98ab9045 100644
--- a/Source/WebCore/inspector/front-end/AdvancedSearchController.js
+++ b/Source/WebCore/inspector/front-end/AdvancedSearchController.js
@@ -211,15 +211,7 @@ WebInspector.SearchView = function(controller)
     this._searchStatusBarElement.className = "search-status-bar-item";
     this._searchMessageElement = this._searchStatusBarElement.createChild("div");
     this._searchMessageElement.className = "search-status-bar-message";
-    this._searchProgressElement = document.createElement("progress");
-    this._searchProgressElement.className = "search-status-bar-progress";
-    
-    this._searchStopButtonItem = document.createElement("div");
-    this._searchStopButtonItem.className = "search-status-bar-stop-button-item";
-    this._searchStopStatusBarButton = new WebInspector.StatusBarButton(WebInspector.UIString("Stop search"), "search-status-bar-stop-button");
-    this._searchStopButtonItem.appendChild(this._searchStopStatusBarButton.element);
-    this._searchStopStatusBarButton.addEventListener("click", this._searchStopButtonPressed, this);
-    
+
     this._searchResultsMessageElement = document.createElement("span");
     this._searchResultsMessageElement.className = "search-results-status-bar-message";
 
@@ -262,13 +254,11 @@ WebInspector.SearchView.prototype = {
     {
         this.resetResults();
         this._resetCounters();
-        
-        this._totalSearchResultsCount = totalSearchResultsCount;
 
         this._searchMessageElement.textContent = WebInspector.UIString("Searching...");
-        this._searchStatusBarElement.appendChild(this._searchProgressElement);
-        this._searchStatusBarElement.appendChild(this._searchStopButtonItem);
-        this._updateSearchProgress();
+        this._progressIndicator = new WebInspector.ProgressIndicator();
+        this._progressIndicator.setTotalWork(totalSearchResultsCount);
+        this._progressIndicator.show(this._searchStatusBarElement);
         
         this._updateSearchResultsMessage();
         
@@ -285,12 +275,6 @@ WebInspector.SearchView.prototype = {
             this._searchResultsMessageElement.textContent = "";
     },
 
-    _updateSearchProgress: function()
-    {
-        this._searchProgressElement.setAttribute("max", this._totalSearchResultsCount);
-        this._searchProgressElement.setAttribute("value", this._searchResultsCount);
-    },
-
     resetResults: function()
     {
         if (this._searchingView)
@@ -327,7 +311,10 @@ WebInspector.SearchView.prototype = {
         if (searchResult.searchMatches.length)
             this._nonEmptySearchResultsCount++;
         this._updateSearchResultsMessage();
-        this._updateSearchProgress();
+        if (this._progressIndicator.isCanceled())
+            this._onCancel();
+        else
+            this._progressIndicator.setWorked(this._searchResultsCount);
     },
 
     /**
@@ -335,9 +322,8 @@ WebInspector.SearchView.prototype = {
      */
     searchFinished: function(finished)
     {
+        this._progressIndicator.done();
         this._searchMessageElement.textContent = finished ? WebInspector.UIString("Search finished.") : WebInspector.UIString("Search interrupted.");
-        this._searchStatusBarElement.removeChild(this._searchProgressElement);
-        this._searchStatusBarElement.removeChild(this._searchStopButtonItem);
     },
 
     focus: function()
@@ -386,7 +372,7 @@ WebInspector.SearchView.prototype = {
         this._regexCheckbox.checked = searchConfig.isRegex;
     },
 
-    _searchStopButtonPressed: function()
+    _onCancel: function()
     {
         this._controller.stopSearch();
         this.focus();
diff --git a/Source/WebCore/inspector/front-end/CPUProfileView.js b/Source/WebCore/inspector/front-end/CPUProfileView.js
index eb71ff8a5..301532830 100644
--- a/Source/WebCore/inspector/front-end/CPUProfileView.js
+++ b/Source/WebCore/inspector/front-end/CPUProfileView.js
@@ -560,10 +560,8 @@ WebInspector.CPUProfileType.prototype = {
     {
         if (this._recording) {
             this.stopRecordingProfile();
-            WebInspector.networkManager.enableResourceTracking();
             return false;
         } else {
-            WebInspector.networkManager.disableResourceTracking();
             this.startRecordingProfile();
             return true;
         }
diff --git a/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js b/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
index efa18ee8f..9e64dc698 100644
--- a/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
+++ b/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
@@ -87,7 +87,7 @@ WebInspector.CSSKeywordCompletions._colors = [
 WebInspector.CSSKeywordCompletions._colorAwareProperties = [
     "background", "background-color", "background-image", "border", "border-color", "border-top", "border-right", "border-bottom",
     "border-left", "border-top-color", "border-right-color", "border-bottom-color", "border-left-color", "box-shadow", "color",
-    "outline", "outline-color", "text-line-through", "text-line-through-color", "text-overline", "text-overline-color",
+    "fill", "outline", "outline-color", "stroke", "text-line-through", "text-line-through-color", "text-overline", "text-overline-color",
     "text-shadow", "text-underline", "text-underline-color", "-webkit-box-shadow", "-webkit-text-emphasis", "-webkit-text-emphasis-color"
 ].keySet();
 
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index 5ae521535..0af619f88 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -56,7 +56,9 @@ WebInspector.CSSStyleModel.parseRuleArrayPayload = function(ruleArray)
 
 WebInspector.CSSStyleModel.Events = {
     StyleSheetChanged: "StyleSheetChanged",
-    MediaQueryResultChanged: "MediaQueryResultChanged"
+    MediaQueryResultChanged: "MediaQueryResultChanged",
+    NamedFlowCreated: "NamedFlowCreated",
+    NamedFlowRemoved: "NamedFlowRemoved"
 }
 
 WebInspector.CSSStyleModel.prototype = {
@@ -162,21 +164,21 @@ WebInspector.CSSStyleModel.prototype = {
 
     /**
      * @param {DOMAgent.NodeId} nodeId
-     * @param {function(?Array.<string>)} userCallback
+     * @param {function(?Array.<WebInspector.NamedFlow>)} userCallback
      */
     getNamedFlowCollectionAsync: function(nodeId, userCallback)
     {
         /**
-         * @param {function(?Array.<string>)} userCallback
+         * @param {function(?Array.<WebInspector.NamedFlow>)} userCallback
          * @param {?Protocol.Error} error
-         * @param {?Array.<string>=} namedFlowPayload
+         * @param {?Array.<CSSAgent.NamedFlow>=} namedFlowPayload
          */
         function callback(userCallback, error, namedFlowPayload)
         {
             if (error || !namedFlowPayload)
                 userCallback(null);
             else
-                userCallback(namedFlowPayload);
+                userCallback(WebInspector.NamedFlow.parsePayloadArray(namedFlowPayload));
         }
 
         CSSAgent.getNamedFlowCollection(nodeId, callback.bind(this, userCallback));
@@ -340,6 +342,54 @@ WebInspector.CSSStyleModel.prototype = {
     },
 
     /**
+     * @param {DOMAgent.NodeId} documentNodeId
+     * @param {string} name
+     */
+    _namedFlowCreated: function(documentNodeId, name)
+    {
+        if (!this.hasEventListeners(WebInspector.CSSStyleModel.Events.NamedFlowCreated))
+            return;
+
+        /**
+        * @param {WebInspector.DOMDocument} root
+        */
+        function callback(root)
+        {
+            // FIXME: At the moment we only want support for NamedFlows in the main document
+            if (documentNodeId !== root.id)
+                return;
+
+            this.dispatchEventToListeners(WebInspector.CSSStyleModel.Events.NamedFlowCreated, { documentNodeId: documentNodeId, name: name });
+        }
+
+        WebInspector.domAgent.requestDocument(callback.bind(this));
+    },
+
+    /**
+     * @param {DOMAgent.NodeId} documentNodeId
+     * @param {string} name
+     */
+    _namedFlowRemoved: function(documentNodeId, name)
+    {
+        if (!this.hasEventListeners(WebInspector.CSSStyleModel.Events.NamedFlowRemoved))
+            return;
+
+        /**
+        * @param {WebInspector.DOMDocument} root
+        */
+        function callback(root)
+        {
+            // FIXME: At the moment we only want support for NamedFlows in the main document
+            if (documentNodeId !== root.id)
+                return;
+
+            this.dispatchEventToListeners(WebInspector.CSSStyleModel.Events.NamedFlowRemoved, { documentNodeId: documentNodeId, name: name });
+        }
+
+        WebInspector.domAgent.requestDocument(callback.bind(this));
+    },
+
+    /**
      * @param {CSSAgent.StyleSheetId} styleSheetId
      * @param {string} newText
      * @param {boolean} majorChange
@@ -1265,6 +1315,24 @@ WebInspector.CSSDispatcher.prototype = {
     styleSheetChanged: function(styleSheetId)
     {
         this._cssModel._fireStyleSheetChanged(styleSheetId);
+    },
+
+    /**
+     * @param {DOMAgent.NodeId} documentNodeId
+     * @param {string} name
+     */
+    namedFlowCreated: function(documentNodeId, name)
+    {
+        this._cssModel._namedFlowCreated(documentNodeId, name);
+    },
+
+    /**
+     * @param {DOMAgent.NodeId} documentNodeId
+     * @param {string} name
+     */
+    namedFlowRemoved: function(documentNodeId, name)
+    {
+        this._cssModel._namedFlowRemoved(documentNodeId, name);
     }
 }
 
@@ -1274,9 +1342,11 @@ WebInspector.CSSDispatcher.prototype = {
  */
 WebInspector.NamedFlow = function(payload)
 {
-    this.nodeId = payload.nodeId;
+    this.nodeId = payload.documentNodeId;
     this.name = payload.name;
     this.overset = payload.overset;
+    this.content = payload.content;
+    this.regions = payload.regions;
 }
 
 /**
@@ -1289,6 +1359,21 @@ WebInspector.NamedFlow.parsePayload = function(payload)
 }
 
 /**
+ * @param {?Array.<CSSAgent.NamedFlow>=} namedFlowPayload
+ * @return {?Array.<WebInspector.NamedFlow>}
+ */
+WebInspector.NamedFlow.parsePayloadArray = function(namedFlowPayload)
+{
+    if (!namedFlowPayload)
+        return null;
+
+    var parsedArray = [];
+    for (var i = 0; i < namedFlowPayload.length; ++i)
+        parsedArray[i] = WebInspector.NamedFlow.parsePayload(namedFlowPayload[i]);
+    return parsedArray;
+}
+
+/**
  * @type {WebInspector.CSSStyleModel}
  */
 WebInspector.cssModel = null;
diff --git a/Source/WebCore/inspector/front-end/CodeMirrorTextEditor.js b/Source/WebCore/inspector/front-end/CodeMirrorTextEditor.js
new file mode 100644
index 000000000..88efd38ae
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/CodeMirrorTextEditor.js
@@ -0,0 +1,354 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.View}
+ * @implements {WebInspector.TextEditor}
+ * @param {?string} url
+ * @param {WebInspector.TextEditorDelegate} delegate
+ */
+WebInspector.CodeMirrorTextEditor = function(url, delegate)
+{
+    WebInspector.View.call(this);
+    this._delegate = delegate;
+    this._url = url;
+
+    this._loadLibraries();
+    this.registerRequiredCSS("codemirror.css");
+    this.registerRequiredCSS("cmdevtools.css");
+
+    this._codeMirror = window.CodeMirror(this.element, {
+        lineNumbers: true,
+        fixedGutter: true,
+        onChange: this._onChange.bind(this),
+    });
+
+    this._lastRange = this.range();
+
+    this.element.firstChild.addStyleClass("source-code");
+    this.element.firstChild.addStyleClass("fill");
+}
+
+WebInspector.CodeMirrorTextEditor.prototype = {
+    /**
+     * @param {string} mimeType
+     */
+    set mimeType(mimeType)
+    {
+        this._codeMirror.setOption("mode", mimeType);
+        switch(mimeType) {
+            case "text/html": this._codeMirror.setOption("theme", "web-inspector-html"); break;
+            case "text/css": this._codeMirror.setOption("theme", "web-inspector-css"); break;
+            case "text/javascript": this._codeMirror.setOption("theme", "web-inspector-js"); break;
+        }
+    },
+
+    /**
+     * @param {boolean} readOnly
+     */
+    setReadOnly: function(readOnly)
+    {
+        this._codeMirror.setOption("readOnly", readOnly);
+    },
+
+    /**
+     * @return {boolean}
+     */
+    readOnly: function()
+    {
+        return !!this._codeMirror.getOption("readOnly");
+    },
+
+    /**
+     * @return {Element}
+     */
+    defaultFocusedElement: function()
+    {
+        return this.element.firstChild;
+    },
+
+    focus: function()
+    {
+        this._codeMirror.focus();
+    },
+
+    beginUpdates: function() { },
+
+    endUpdates: function() { },
+
+    /**
+     * @param {number} lineNumber
+     */
+    revealLine: function(lineNumber)
+    {
+        this._codeMirror.setCursor({ line: lineNumber, ch: 0 });
+        var coords = this._codeMirror.cursorCoords();
+        this._codeMirror.scrollTo(coords.x, coords.y);
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
+    addDecoration: function(lineNumber, decoration)
+    {
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
+    removeDecoration: function(lineNumber, decoration)
+    {
+    },
+
+    /**
+     * @param {WebInspector.TextRange} range
+     */
+    markAndRevealRange: function(range)
+    {
+        if (range)
+            this.setSelection(range);
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    highlightLine: function(lineNumber)
+    {
+        var line = this._codeMirror.getLine(lineNumber);
+        var mark = this._codeMirror.markText({ line: lineNumber, ch: 0 }, { line: lineNumber, ch: line.length }, "CodeMirror-searching");
+        setTimeout(mark.clear.bind(mark), 1000);
+    },
+
+    clearLineHighlight: function()
+    {
+    },
+
+    /**
+     * @return {Array.<Element>}
+     */
+    elementsToRestoreScrollPositionsFor: function()
+    {
+        return [];
+    },
+
+    /**
+     * @param {WebInspector.TextEditor} textEditor
+     */
+    inheritScrollPositions: function(textEditor)
+    {
+    },
+
+    onResize: function()
+    {
+        this._codeMirror.refresh();
+    },
+
+    /**
+     * @param {WebInspector.TextRange} range
+     * @param {string} text
+     * @return {WebInspector.TextRange}
+     */
+    editRange: function(range, text)
+    {
+        this._delegate.beforeTextChanged();
+
+        var pos = this._toPos(range);
+        this._codeMirror.replaceRange(text, pos.start, pos.end);
+        var newRange = this._toRange(pos.start, this._codeMirror.posFromIndex(this._codeMirror.indexFromPos(pos.start) + text.length));
+
+        this._delegate.afterTextChanged(range, newRange);
+
+        return newRange;
+    },
+
+    _onChange: function()
+    {
+        this._delegate.beforeTextChanged();
+        var newRange = this.range();
+        this._delegate.afterTextChanged(this._lastRange, newRange);
+        this._lastRange = newRange;
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    scrollToLine: function(lineNumber)
+    {
+        this._codeMirror.setCursor({line:lineNumber, ch:0});
+    },
+
+    /**
+     * @return {WebInspector.TextRange}
+     */
+    selection: function(textRange)
+    {
+        var start = this._codeMirror.cursorCoords(true);
+        var end = this._codeMirror.cursorCoords(false);
+
+        if (start.line > end.line || (start.line == end.line && start.ch > end.ch))
+            return this._toRange(end, start);
+
+        return this._toRange(start, end);
+    },
+
+    /**
+     * @return {WebInspector.TextRange?}
+     */
+    lastSelection: function()
+    {
+        return this._lastSelection;
+    },
+
+    /**
+     * @param {WebInspector.TextRange} textRange
+     */
+    setSelection: function(textRange)
+    {
+        this._lastSelection = textRange;
+        var pos = this._toPos(textRange);
+        this._codeMirror.setSelection(pos.start, pos.end);
+    },
+
+    /**
+     * @param {string} text
+     */
+    setText: function(text)
+    {
+        this._codeMirror.setValue(text);
+    },
+
+    /**
+     * @return {string}
+     */
+    text: function()
+    {
+        return this._codeMirror.getValue();
+    },
+
+    /**
+     * @return {WebInspector.TextRange}
+     */
+    range: function()
+    {
+        var lineCount = this.linesCount;
+        var lastLine = this._codeMirror.getLine(lineCount - 1);
+        return this._toRange({ line: 0, ch: 0 }, { line: lineCount - 1, ch: lastLine.length });
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @return {string}
+     */
+    line: function(lineNumber)
+    {
+        return this._codeMirror.getLine(lineNumber);
+    },
+
+    /**
+     * @return {number}
+     */
+    get linesCount()
+    {
+        return this._codeMirror.lineCount();
+    },
+
+    /**
+     * @param {number} line
+     * @param {string} name
+     * @param {Object?} value
+     */
+    setAttribute: function(line, name, value)
+    {
+        var handle = this._codeMirror.getLineHandle(line);
+        if (handle.attributes === undefined) handle.attributes = {};
+        handle.attributes[name] = value;
+    },
+
+    /**
+     * @param {number} line
+     * @param {string} name
+     * @return {Object|null} value
+     */
+    getAttribute: function(line, name)
+    {
+        var handle = this._codeMirror.getLineHandle(line);
+        return handle.attributes && handle.attributes[name] !== undefined ? handle.attributes[name] : null;
+    },
+
+    /**
+     * @param {number} line
+     * @param {string} name
+     */
+    removeAttribute: function(line, name)
+    {
+        var handle = this._codeMirror.getLineHandle(line);
+        if (handle.attributes)
+            delete handle.attributes[name];
+    },
+
+    _toPos: function(range)
+    {
+        return {
+            start: {line: range.startLine, ch: range.startColumn},
+            end: {line: range.endLine, ch: range.endColumn}
+        }
+    },
+
+    _toRange: function(start, end)
+    {
+        return new WebInspector.TextRange(start.line, start.ch, end.line, end.ch);
+    },
+
+    _loadLibraries: function()
+    {
+        if (window.CodeMirror)
+            return;
+
+        function loadLibrary(file)
+        {
+            var xhr = new XMLHttpRequest();
+            xhr.open("GET", file, false);
+            xhr.send(null);
+            console.log(xhr.responseText);
+            window.eval(xhr.responseText);
+        }
+
+        loadLibrary("codemirror.js");
+        loadLibrary("css.js");
+        loadLibrary("javascript.js");
+        loadLibrary("xml.js");
+        loadLibrary("htmlmixed.js");
+    }
+}
+
+WebInspector.CodeMirrorTextEditor.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/Source/WebCore/inspector/front-end/ConsoleMessage.js b/Source/WebCore/inspector/front-end/ConsoleMessage.js
index 49dbceb09..52a2ca8a6 100644
--- a/Source/WebCore/inspector/front-end/ConsoleMessage.js
+++ b/Source/WebCore/inspector/front-end/ConsoleMessage.js
@@ -43,8 +43,9 @@
  * @param {Array.<RuntimeAgent.RemoteObject>=} parameters
  * @param {ConsoleAgent.StackTrace=} stackTrace
  * @param {WebInspector.NetworkRequest=} request
+ * @param {boolean=} isOutdated
  */
-WebInspector.ConsoleMessageImpl = function(source, level, message, linkifier, type, url, line, repeatCount, parameters, stackTrace, request)
+WebInspector.ConsoleMessageImpl = function(source, level, message, linkifier, type, url, line, repeatCount, parameters, stackTrace, request, isOutdated)
 {
     WebInspector.ConsoleMessage.call(this, source, level, url, line, repeatCount);
 
@@ -54,6 +55,7 @@ WebInspector.ConsoleMessageImpl = function(source, level, message, linkifier, ty
     this._parameters = parameters;
     this._stackTrace = stackTrace;
     this._request = request;
+    this._isOutdated = isOutdated;
 
     this._customFormatters = {
         "object": this._formatParameterAsObject,
@@ -225,7 +227,7 @@ WebInspector.ConsoleMessageImpl.prototype = {
             if (shouldFormatMessage && parameters[i].type === "string")
                 formattedResult.appendChild(document.createTextNode(parameters[i].description));
             else
-                formattedResult.appendChild(this._formatParameter(parameters[i]));
+                formattedResult.appendChild(this._formatParameter(parameters[i], false, true));
             if (i < parameters.length - 1)
                 formattedResult.appendChild(document.createTextNode(" "));
         }
@@ -234,8 +236,9 @@ WebInspector.ConsoleMessageImpl.prototype = {
 
     /**
      * @param {boolean=} forceObjectFormat
+     * @param {boolean=} includePreview
      */
-    _formatParameter: function(output, forceObjectFormat)
+    _formatParameter: function(output, forceObjectFormat, includePreview)
     {
         var type;
         if (forceObjectFormat)
@@ -253,7 +256,7 @@ WebInspector.ConsoleMessageImpl.prototype = {
 
         var span = document.createElement("span");
         span.className = "console-formatted-" + type + " source-code";
-        formatter.call(this, output, span);
+        formatter.call(this, output, span, includePreview);
         return span;
     },
 
@@ -262,13 +265,74 @@ WebInspector.ConsoleMessageImpl.prototype = {
         elem.appendChild(document.createTextNode(val));
     },
 
-    _formatParameterAsObject: function(obj, elem)
+    _formatParameterAsObject: function(obj, elem, includePreview)
     {
-        var section = new WebInspector.ObjectPropertiesSection(obj, obj.description);
+        this._formatParameterAsArrayOrObject(obj, obj.description, elem, includePreview);
+    },
+
+    /**
+     * @param {WebInspector.RemoteObject} obj
+     * @param {string} description
+     * @param {Element} elem
+     * @param {boolean} includePreview
+     */
+    _formatParameterAsArrayOrObject: function(obj, description, elem, includePreview)
+    {
+        var titleElement = document.createElement("span");
+        if (description)
+            titleElement.createTextChild(description);
+        if (includePreview && obj.preview) {
+            titleElement.addStyleClass("console-object-preview");
+            var lossless = this._appendObjectPreview(obj, description, titleElement);
+            if (lossless) {
+                elem.appendChild(titleElement);
+                return;
+            }
+        }
+        var section = new WebInspector.ObjectPropertiesSection(obj, titleElement);
         section.enableContextMenu();
         elem.appendChild(section.element);
     },
 
+    /**
+     * @param {WebInspector.RemoteObject} obj
+     * @param {string} description
+     * @param {Element} titleElement
+     * @return {boolean} true iff preview captured all information.
+     */
+    _appendObjectPreview: function(obj, description, titleElement)
+    {
+        var preview = obj.preview;
+        var isArray = obj.subtype === "array";
+
+        if (description)
+            titleElement.createTextChild(" ");
+        titleElement.createTextChild(isArray ? "[" : "{");
+        for (var i = 0; i < preview.properties.length; ++i) {
+            if (i > 0)
+                titleElement.createTextChild(", ");
+
+            var property = preview.properties[i];
+            if (!isArray || property.name != i) {
+                titleElement.createChild("span", "name").textContent = property.name;
+                titleElement.createTextChild(": ");
+            }
+
+            var span = titleElement.createChild("span", "console-formatted-" + property.type);
+            if (property.type === "object") {
+                if (property.subtype === "node")
+                    span.addStyleClass("console-formatted-preview-node");
+                else if (property.subtype === "regexp")
+                    span.addStyleClass("console-formatted-string");
+            }
+            span.textContent = property.value;
+        }
+        if (preview.overflow)
+            titleElement.createChild("span").textContent = "\u2026";
+        titleElement.createTextChild(isArray ? "]" : "}");
+        return preview.lossless;
+    },
+
     _formatParameterAsNode: function(object, elem)
     {
         function printNode(nodeId)
@@ -276,7 +340,7 @@ WebInspector.ConsoleMessageImpl.prototype = {
             if (!nodeId) {
                 // Sometimes DOM is loaded after the sync message is being formatted, so we get no
                 // nodeId here. So we fall back to object formatting here.
-                this._formatParameterAsObject(object, elem);
+                this._formatParameterAsObject(object, elem, false);
                 return;
             }
             var treeOutline = new WebInspector.ElementsTreeOutline(false, false, true);
@@ -293,9 +357,14 @@ WebInspector.ConsoleMessageImpl.prototype = {
 
     _formatParameterAsArray: function(array, elem)
     {
+        if (array.preview) {
+            this._formatParameterAsArrayOrObject(array, "", elem, true);
+            return;
+        }
+
         const maxFlatArrayLength = 100;
-        if (array.arrayLength() > maxFlatArrayLength)
-            this._formatParameterAsObject(array, elem);
+        if (this._isOutdated || array.arrayLength() > maxFlatArrayLength)
+            this._formatParameterAsObject(array, elem, false);
         else
             array.getOwnProperties(this._printArray.bind(this, array, elem));
     },
@@ -352,7 +421,7 @@ WebInspector.ConsoleMessageImpl.prototype = {
             lastNonEmptyIndex = i;
             if (i < length - 1)
                 elem.appendChild(document.createTextNode(", "));
-        }       
+        }
         appendUndefined(elem, length);
 
         elem.appendChild(document.createTextNode("]"));
@@ -361,7 +430,7 @@ WebInspector.ConsoleMessageImpl.prototype = {
     _formatAsArrayEntry: function(output)
     {
         // Prevent infinite expansion of cross-referencing arrays.
-        return this._formatParameter(output, output.subtype && output.subtype === "array");
+        return this._formatParameter(output, output.subtype && output.subtype === "array", false);
     },
 
     _formatWithSubstitutionString: function(parameters, formattedResult)
@@ -370,7 +439,7 @@ WebInspector.ConsoleMessageImpl.prototype = {
 
         function parameterFormatter(force, obj)
         {
-            return this._formatParameter(obj, force);
+            return this._formatParameter(obj, force, false);
         }
 
         function valueFormatter(obj)
@@ -646,7 +715,7 @@ WebInspector.ConsoleMessageImpl.prototype = {
      */
     clone: function()
     {
-        return WebInspector.ConsoleMessage.create(this.source, this.level, this._messageText, this.type, this.url, this.line, this.repeatCount, this._parameters, this._stackTrace, this._request);
+        return WebInspector.ConsoleMessage.create(this.source, this.level, this._messageText, this.type, this.url, this.line, this.repeatCount, this._parameters, this._stackTrace, this._request, this._isOutdated);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ConsoleModel.js b/Source/WebCore/inspector/front-end/ConsoleModel.js
index 70e8aa0b0..5be5a02c5 100644
--- a/Source/WebCore/inspector/front-end/ConsoleModel.js
+++ b/Source/WebCore/inspector/front-end/ConsoleModel.js
@@ -53,7 +53,20 @@ WebInspector.ConsoleModel.prototype = {
         if (WebInspector.settings.monitoringXHREnabled.get())
             ConsoleAgent.setMonitoringXHREnabled(true);
 
-        ConsoleAgent.enable();
+        this._enablingConsole = true;
+        function callback()
+        {
+            delete this._enablingConsole;
+        }
+        ConsoleAgent.enable(callback.bind(this));
+    },
+
+    /**
+     * @return {boolean}
+     */
+    enablingConsole: function()
+    {
+        return !!this._enablingConsole;
     },
 
     /**
@@ -190,10 +203,10 @@ WebInspector.ConsoleMessage.prototype = {
  * @param {Array.<RuntimeAgent.RemoteObject>=} parameters
  * @param {ConsoleAgent.StackTrace=} stackTrace
  * @param {WebInspector.NetworkRequest=} request
- *
+ * @param {boolean=} isOutdated
  * @return {WebInspector.ConsoleMessage}
  */
-WebInspector.ConsoleMessage.create = function(source, level, message, type, url, line, repeatCount, parameters, stackTrace, request)
+WebInspector.ConsoleMessage.create = function(source, level, message, type, url, line, repeatCount, parameters, stackTrace, request, isOutdated)
 {
 }
 
@@ -254,7 +267,8 @@ WebInspector.ConsoleDispatcher.prototype = {
             payload.repeatCount,
             payload.parameters,
             payload.stackTrace,
-            payload.networkRequestId ? WebInspector.networkRequestById(payload.networkRequestId) : undefined);
+            payload.networkRequestId ? WebInspector.networkRequestById(payload.networkRequestId) : undefined,
+            this._console._enablingConsole);
         this._console.addMessage(consoleMessage);
     },
 
diff --git a/Source/WebCore/inspector/front-end/ConsoleView.js b/Source/WebCore/inspector/front-end/ConsoleView.js
index 02e69bb10..a81cef191 100644
--- a/Source/WebCore/inspector/front-end/ConsoleView.js
+++ b/Source/WebCore/inspector/front-end/ConsoleView.js
@@ -725,16 +725,16 @@ WebInspector.ConsoleView.prototype = {
                 return;
             }
             
-            this._printResult(result, wasThrown);
+            this._printResult(result, wasThrown, null);
         }
     },
 
-    _printResult: function(result, wasThrown)
+    _printResult: function(result, wasThrown, originatingCommand)
     {
         if (!result)
             return;
 
-        this._appendConsoleMessage(new WebInspector.ConsoleCommandResult(result, wasThrown, null, this._linkifier));
+        this._appendConsoleMessage(new WebInspector.ConsoleCommandResult(result, wasThrown, originatingCommand, this._linkifier));
     },
 
     _appendCommand: function(text, newPromptText, useCommandLineAPI, showResultOnly)
@@ -756,7 +756,7 @@ WebInspector.ConsoleView.prototype = {
                 WebInspector.settings.consoleHistory.set(this.prompt.historyData.slice(-30));
             }
             
-            this._printResult(result, wasThrown);
+            this._printResult(result, wasThrown, commandMessage);
         }
         this.evalInInspectedWindow(text, "console", useCommandLineAPI, false, false, printResult.bind(this));
 
@@ -954,7 +954,7 @@ WebInspector.ConsoleGroup.prototype = {
  */
 WebInspector.consoleView = null;
 
-WebInspector.ConsoleMessage.create = function(source, level, message, type, url, line, repeatCount, parameters, stackTrace, request)
+WebInspector.ConsoleMessage.create = function(source, level, message, type, url, line, repeatCount, parameters, stackTrace, request, isOutdated)
 {
-    return new WebInspector.ConsoleMessageImpl(source, level, message, WebInspector.consoleView._linkifier, type, url, line, repeatCount, parameters, stackTrace, request);
+    return new WebInspector.ConsoleMessageImpl(source, level, message, WebInspector.consoleView._linkifier, type, url, line, repeatCount, parameters, stackTrace, request, isOutdated);
 }
diff --git a/Source/WebCore/inspector/front-end/DOMAgent.js b/Source/WebCore/inspector/front-end/DOMAgent.js
index e96855cce..0bb07f94f 100644
--- a/Source/WebCore/inspector/front-end/DOMAgent.js
+++ b/Source/WebCore/inspector/front-end/DOMAgent.js
@@ -1278,7 +1278,7 @@ WebInspector.DOMAgent.prototype = {
             this._addTouchEventsScriptId = scriptId;
         }
 
-        DOMAgent.setTouchEmulationEnabled(emulationEnabled);
+        PageAgent.setTouchEmulationEnabled(emulationEnabled);
     },
 
     markUndoableState: function()
diff --git a/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js b/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js
index f8bd7fd89..abd75baca 100644
--- a/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js
@@ -49,9 +49,9 @@ WebInspector.DOMBreakpointsSidebarPane = function()
     this._breakpointTypeLabels[this._breakpointTypes.NodeRemoved] = WebInspector.UIString("Node Removed");
 
     this._contextMenuLabels = {};
-    this._contextMenuLabels[this._breakpointTypes.SubtreeModified] = WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Break on subtree modifications" : "Break on Subtree Modifications");
-    this._contextMenuLabels[this._breakpointTypes.AttributeModified] = WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Break on attributes modifications" : "Break on Attributes Modifications");
-    this._contextMenuLabels[this._breakpointTypes.NodeRemoved] = WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Break on node removal" : "Break on Node Removal");
+    this._contextMenuLabels[this._breakpointTypes.SubtreeModified] = WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Subtree modifications" : "Subtree Modifications");
+    this._contextMenuLabels[this._breakpointTypes.AttributeModified] = WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Attributes modifications" : "Attributes Modifications");
+    this._contextMenuLabels[this._breakpointTypes.NodeRemoved] = WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Node removal" : "Node Removal");
 
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.InspectedURLChanged, this._inspectedURLChanged, this);
     WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.NodeRemoved, this._nodeRemoved, this);
@@ -84,10 +84,11 @@ WebInspector.DOMBreakpointsSidebarPane.prototype = {
             this._saveBreakpoints();
         }
 
+        var breakPointSubMenu = contextMenu.appendSubMenuItem(WebInspector.UIString("Break on..."));
         for (var key in this._breakpointTypes) {
             var type = this._breakpointTypes[key];
             var label = this._contextMenuLabels[type];
-            contextMenu.appendCheckboxItem(label, toggleBreakpoint.bind(this, type), nodeBreakpoints[type]);
+            breakPointSubMenu.appendCheckboxItem(label, toggleBreakpoint.bind(this, type), nodeBreakpoints[type]);
         }
     },
 
diff --git a/Source/WebCore/inspector/front-end/DOMExtension.js b/Source/WebCore/inspector/front-end/DOMExtension.js
index bec1470d8..3e5926409 100644
--- a/Source/WebCore/inspector/front-end/DOMExtension.js
+++ b/Source/WebCore/inspector/front-end/DOMExtension.js
@@ -253,6 +253,18 @@ Element.prototype.createChild = function(elementName, className)
 DocumentFragment.prototype.createChild = Element.prototype.createChild;
 
 /**
+ * @param {string} text
+ */
+Element.prototype.createTextChild = function(text)
+{
+    var element = this.ownerDocument.createTextNode(text);
+    this.appendChild(element);
+    return element;
+}
+
+DocumentFragment.prototype.createTextChild = Element.prototype.createTextChild;
+
+/**
  * @return {number}
  */
 Element.prototype.totalOffsetLeft = function()
diff --git a/Source/WebCore/inspector/front-end/DOMStorage.js b/Source/WebCore/inspector/front-end/DOMStorage.js
index 859b715ec..0c966935c 100644
--- a/Source/WebCore/inspector/front-end/DOMStorage.js
+++ b/Source/WebCore/inspector/front-end/DOMStorage.js
@@ -100,7 +100,7 @@ WebInspector.DOMStorageDispatcher.prototype = {
     {
         var domStorage = new WebInspector.DOMStorage(
             payload.id,
-            payload.host,
+            payload.origin,
             payload.isLocalStorage);
         WebInspector.panels.resources.addDOMStorage(domStorage);
     },
diff --git a/Source/WebCore/inspector/front-end/DefaultTextEditor.js b/Source/WebCore/inspector/front-end/DefaultTextEditor.js
new file mode 100644
index 000000000..d67b156a6
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/DefaultTextEditor.js
@@ -0,0 +1,2728 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.View}
+ * @implements {WebInspector.TextEditor}
+ * @param {?string} url
+ * @param {WebInspector.TextEditorDelegate} delegate
+ */
+WebInspector.DefaultTextEditor = function(url, delegate)
+{
+    WebInspector.View.call(this);
+    this._delegate = delegate;
+    this._url = url;
+
+    this.registerRequiredCSS("textEditor.css");
+
+    this.element.className = "text-editor monospace";
+
+    this._textModel = new WebInspector.TextEditorModel();
+    this._textModel.addEventListener(WebInspector.TextEditorModel.Events.TextChanged, this._textChanged, this);
+    this._textModel.resetUndoStack();
+
+    var enterTextChangeMode = this._enterInternalTextChangeMode.bind(this);
+    var exitTextChangeMode = this._exitInternalTextChangeMode.bind(this);
+    var syncScrollListener = this._syncScroll.bind(this);
+    var syncDecorationsForLineListener = this._syncDecorationsForLine.bind(this);
+    var syncLineHeightListener = this._syncLineHeight.bind(this);
+    this._mainPanel = new WebInspector.TextEditorMainPanel(this._textModel, url, syncScrollListener, syncDecorationsForLineListener, enterTextChangeMode, exitTextChangeMode);
+    this._gutterPanel = new WebInspector.TextEditorGutterPanel(this._textModel, syncDecorationsForLineListener, syncLineHeightListener);
+
+    this._mainPanel.element.addEventListener("scroll", this._handleScrollChanged.bind(this), false);
+    this._mainPanel._container.addEventListener("focus", this._handleFocused.bind(this), false);
+
+    this.element.appendChild(this._mainPanel.element);
+    this.element.appendChild(this._gutterPanel.element);
+
+    // Forward mouse wheel events from the unscrollable gutter to the main panel.
+    function forwardWheelEvent(event)
+    {
+        var clone = document.createEvent("WheelEvent");
+        clone.initWebKitWheelEvent(event.wheelDeltaX, event.wheelDeltaY,
+                                   event.view,
+                                   event.screenX, event.screenY,
+                                   event.clientX, event.clientY,
+                                   event.ctrlKey, event.altKey, event.shiftKey, event.metaKey);
+        this._mainPanel.element.dispatchEvent(clone);
+    }
+    this._gutterPanel.element.addEventListener("mousewheel", forwardWheelEvent.bind(this), false);
+
+    this.element.addEventListener("keydown", this._handleKeyDown.bind(this), false);
+    this.element.addEventListener("contextmenu", this._contextMenu.bind(this), true);
+
+    this._registerShortcuts();
+}
+
+WebInspector.DefaultTextEditor.prototype = {
+    /**
+     * @param {string} mimeType
+     */
+    set mimeType(mimeType)
+    {
+        this._mainPanel.mimeType = mimeType;
+    },
+
+    /**
+     * @param {boolean} readOnly
+     */
+    setReadOnly: function(readOnly)
+    {
+        if (this._mainPanel.readOnly() === readOnly)
+            return;
+        this._mainPanel.setReadOnly(readOnly, this.isShowing());
+        WebInspector.markBeingEdited(this.element, !readOnly);
+    },
+
+    /**
+     * @return {boolean}
+     */
+    readOnly: function()
+    {
+        return this._mainPanel.readOnly();
+    },
+
+    /**
+     * @return {WebInspector.TextEditorModel}
+     */
+    get textModel()
+    {
+        return this._textModel;
+    },
+
+    /**
+     * @return {Element}
+     */
+    defaultFocusedElement: function()
+    {
+        return this._mainPanel.defaultFocusedElement();
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    revealLine: function(lineNumber)
+    {
+        this._mainPanel.revealLine(lineNumber);
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
+    addDecoration: function(lineNumber, decoration)
+    {
+        this._mainPanel.addDecoration(lineNumber, decoration);
+        this._gutterPanel.addDecoration(lineNumber, decoration);
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
+    removeDecoration: function(lineNumber, decoration)
+    {
+        this._mainPanel.removeDecoration(lineNumber, decoration);
+        this._gutterPanel.removeDecoration(lineNumber, decoration);
+    },
+
+    /**
+     * @param {WebInspector.TextRange} range
+     */
+    markAndRevealRange: function(range)
+    {
+        if (range)
+            this.setSelection(range);
+        this._mainPanel.markAndRevealRange(range);
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    highlightLine: function(lineNumber)
+    {
+        if (typeof lineNumber !== "number" || lineNumber < 0)
+            return;
+
+        lineNumber = Math.min(lineNumber, this._textModel.linesCount - 1);
+        this._mainPanel.highlightLine(lineNumber);
+    },
+
+    clearLineHighlight: function()
+    {
+        this._mainPanel.clearLineHighlight();
+    },
+
+    _freeCachedElements: function()
+    {
+        this._mainPanel._freeCachedElements();
+        this._gutterPanel._freeCachedElements();
+    },
+
+    /**
+     * @return {Array.<Element>}
+     */
+    elementsToRestoreScrollPositionsFor: function()
+    {
+        return [this._mainPanel.element];
+    },
+
+    /**
+     * @param {WebInspector.TextEditor} textEditor
+     */
+    inheritScrollPositions: function(textEditor)
+    {
+        this._mainPanel.element._scrollTop = textEditor._mainPanel.element.scrollTop;
+        this._mainPanel.element._scrollLeft = textEditor._mainPanel.element.scrollLeft;
+    },
+
+    beginUpdates: function()
+    {
+        this._mainPanel.beginUpdates();
+        this._gutterPanel.beginUpdates();
+    },
+
+    endUpdates: function()
+    {
+        this._mainPanel.endUpdates();
+        this._gutterPanel.endUpdates();
+        this._updatePanelOffsets();
+    },
+
+    onResize: function()
+    {
+        this._mainPanel.resize();
+        this._gutterPanel.resize();
+        this._updatePanelOffsets();
+    },
+
+    _textChanged: function(event)
+    {
+        if (!this._internalTextChangeMode)
+            this._textModel.resetUndoStack();
+        this._mainPanel.textChanged(event.data.oldRange, event.data.newRange);
+        this._gutterPanel.textChanged(event.data.oldRange, event.data.newRange);
+        this._updatePanelOffsets();
+    },
+
+    /**
+     * @param {WebInspector.TextRange} range
+     * @param {string} text
+     * @return {WebInspector.TextRange}
+     */
+    editRange: function(range, text)
+    {
+        this._enterInternalTextChangeMode();
+        this._textModel.markUndoableState();
+        var newRange = this._textModel.editRange(range, text);
+        this._exitInternalTextChangeMode(range, newRange);
+        return newRange;
+    },
+
+    _enterInternalTextChangeMode: function()
+    {
+        this._internalTextChangeMode = true;
+        this._delegate.beforeTextChanged();
+    },
+
+    /**
+     * @param {WebInspector.TextRange} oldRange
+     * @param {WebInspector.TextRange} newRange
+     */
+    _exitInternalTextChangeMode: function(oldRange, newRange)
+    {
+        this._internalTextChangeMode = false;
+        this._delegate.afterTextChanged(oldRange, newRange);
+    },
+
+    _updatePanelOffsets: function()
+    {
+        var lineNumbersWidth = this._gutterPanel.element.offsetWidth;
+        if (lineNumbersWidth)
+            this._mainPanel.element.style.setProperty("left", (lineNumbersWidth + 2) + "px");
+        else
+            this._mainPanel.element.style.removeProperty("left"); // Use default value set in CSS.
+    },
+
+    _syncScroll: function()
+    {
+        var mainElement = this._mainPanel.element;
+        var gutterElement = this._gutterPanel.element;
+        // Handle horizontal scroll bar at the bottom of the main panel.
+        this._gutterPanel.syncClientHeight(mainElement.clientHeight);
+        gutterElement.scrollTop = mainElement.scrollTop;
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    _syncDecorationsForLine: function(lineNumber)
+    {
+        if (lineNumber >= this._textModel.linesCount)
+            return;
+
+        var mainChunk = this._mainPanel.chunkForLine(lineNumber);
+        if (mainChunk.linesCount === 1 && mainChunk.decorated) {
+            var gutterChunk = this._gutterPanel.makeLineAChunk(lineNumber);
+            var height = mainChunk.height;
+            if (height)
+                gutterChunk.element.style.setProperty("height", height + "px");
+            else
+                gutterChunk.element.style.removeProperty("height");
+        } else {
+            var gutterChunk = this._gutterPanel.chunkForLine(lineNumber);
+            if (gutterChunk.linesCount === 1)
+                gutterChunk.element.style.removeProperty("height");
+        }
+    },
+
+    /**
+     * @param {Element} gutterRow
+     */
+    _syncLineHeight: function(gutterRow)
+    {
+        if (this._lineHeightSynced)
+            return;
+        if (gutterRow && gutterRow.offsetHeight) {
+            // Force equal line heights for the child panels.
+            this.element.style.setProperty("line-height", gutterRow.offsetHeight + "px");
+            this._lineHeightSynced = true;
+        }
+    },
+
+    _registerShortcuts: function()
+    {
+        var keys = WebInspector.KeyboardShortcut.Keys;
+        var modifiers = WebInspector.KeyboardShortcut.Modifiers;
+
+        this._shortcuts = {};
+        var commitEditing = this._commitEditing.bind(this);
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("s", modifiers.CtrlOrMeta)] = commitEditing;
+
+        var handleEnterKey = this._mainPanel.handleEnterKey.bind(this._mainPanel);
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(keys.Enter.code, WebInspector.KeyboardShortcut.Modifiers.None)] = handleEnterKey;
+
+        var handleUndo = this._mainPanel.handleUndoRedo.bind(this._mainPanel, false);
+        var handleRedo = this._mainPanel.handleUndoRedo.bind(this._mainPanel, true);
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("z", modifiers.CtrlOrMeta)] = handleUndo;
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("z", modifiers.Shift | modifiers.CtrlOrMeta)] = handleRedo;
+
+        var handleTabKey = this._mainPanel.handleTabKeyPress.bind(this._mainPanel, false);
+        var handleShiftTabKey = this._mainPanel.handleTabKeyPress.bind(this._mainPanel, true);
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(keys.Tab.code)] = handleTabKey;
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(keys.Tab.code, modifiers.Shift)] = handleShiftTabKey;
+    },
+
+    _handleKeyDown: function(e)
+    {
+        if (this.readOnly())
+            return;
+
+        var shortcutKey = WebInspector.KeyboardShortcut.makeKeyFromEvent(e);
+        var handler = this._shortcuts[shortcutKey];
+        if (handler && handler())
+            e.consume(true);
+    },
+
+    _contextMenu: function(event)
+    {
+        var contextMenu = new WebInspector.ContextMenu();
+        var target = event.target.enclosingNodeOrSelfWithClass("webkit-line-number");
+        if (target)
+            this._delegate.populateLineGutterContextMenu(contextMenu, target.lineNumber);
+        else {
+            target = this._mainPanel._enclosingLineRowOrSelf(event.target);
+            this._delegate.populateTextAreaContextMenu(contextMenu, target && target.lineNumber);
+        }
+        contextMenu.show(event);
+    },
+
+    _commitEditing: function()
+    {
+        if (this.readOnly())
+            return false;
+
+        this._delegate.commitEditing();
+        if (this._url && WebInspector.fileManager.isURLSaved(this._url))
+            WebInspector.fileManager.save(this._url, this._textModel.text(), false);
+        return true;
+    },
+
+    _handleScrollChanged: function(event)
+    {
+        var visibleFrom = this._mainPanel.element.scrollTop;
+        var firstVisibleLineNumber = this._mainPanel._findFirstVisibleLineNumber(visibleFrom);
+        this._delegate.scrollChanged(firstVisibleLineNumber);
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    scrollToLine: function(lineNumber)
+    {
+        this._mainPanel.scrollToLine(lineNumber);
+    },
+
+    _handleSelectionChange: function(event)
+    {
+        var textRange = this._mainPanel._getSelection();
+        if (textRange) {
+            // We do not restore selection after focus lost to avoid selection blinking. We restore only cursor position instead.
+            // FIXME: consider adding selection decoration to blurred editor.
+            this._lastSelection = WebInspector.TextRange.createFromLocation(textRange.endLine, textRange.endColumn);
+        }
+        this._delegate.selectionChanged(textRange);
+    },
+
+    /**
+     * @return {WebInspector.TextRange}
+     */
+    selection: function(textRange)
+    {
+        return this._mainPanel._getSelection();
+    },
+
+    /**
+     * @return {WebInspector.TextRange?}
+     */
+    lastSelection: function()
+    {
+        return this._lastSelection;
+    },
+
+    /**
+     * @param {WebInspector.TextRange} textRange
+     */
+    setSelection: function(textRange)
+    {
+        this._lastSelection = textRange;
+        if (this.element.isAncestor(document.activeElement))
+            this._mainPanel._restoreSelection(textRange);
+    },
+
+    /**
+     * @param {string} text 
+     */
+    setText: function(text)
+    {
+        this._textModel.setText(text);
+    },
+
+    /**
+     * @return {string}
+     */
+    text: function()
+    {
+        return this._textModel.text();
+    },
+
+    /**
+     * @return {WebInspector.TextRange}
+     */
+    range: function()
+    {
+        return this._textModel.range();
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @return {string}
+     */
+    line: function(lineNumber)
+    {
+        return this._textModel.line(lineNumber);
+    },
+
+    /**
+     * @return {number}
+     */
+    get linesCount()
+    {
+        return this._textModel.linesCount;
+    },
+
+    /**
+     * @param {number} line
+     * @param {string} name  
+     * @param {Object?} value  
+     */
+    setAttribute: function(line, name, value)
+    {
+        this._textModel.setAttribute(line, name, value);
+    },
+
+    /**
+     * @param {number} line
+     * @param {string} name  
+     * @return {Object|null} value  
+     */
+    getAttribute: function(line, name)
+    {
+        return this._textModel.getAttribute(line, name);
+    },
+
+    /**
+     * @param {number} line
+     * @param {string} name
+     */
+    removeAttribute: function(line, name)
+    {
+        this._textModel.removeAttribute(line, name);
+    },
+
+    wasShown: function()
+    {
+        if (!this.readOnly())
+            WebInspector.markBeingEdited(this.element, true);
+
+        this._boundSelectionChangeListener = this._handleSelectionChange.bind(this);
+        document.addEventListener("selectionchange", this._boundSelectionChangeListener, false);
+    },
+
+    _handleFocused: function()
+    {
+        if (this._lastSelection)
+            this.setSelection(this._lastSelection);
+    },
+
+    willHide: function()
+    {
+        document.removeEventListener("selectionchange", this._boundSelectionChangeListener, false);
+        delete this._boundSelectionChangeListener;
+
+        if (!this.readOnly())
+            WebInspector.markBeingEdited(this.element, false);
+        this._freeCachedElements();
+    }
+}
+
+WebInspector.DefaultTextEditor.prototype.__proto__ = WebInspector.View.prototype;
+
+/**
+ * @constructor
+ * @param {WebInspector.TextEditorModel} textModel
+ */
+WebInspector.TextEditorChunkedPanel = function(textModel)
+{
+    this._textModel = textModel;
+
+    this._defaultChunkSize = 50;
+    this._paintCoalescingLevel = 0;
+    this._domUpdateCoalescingLevel = 0;
+}
+
+WebInspector.TextEditorChunkedPanel.prototype = {
+    /**
+     * @return {WebInspector.TextEditorModel}
+     */
+    get textModel()
+    {
+        return this._textModel;
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    scrollToLine: function(lineNumber)
+    {
+        if (lineNumber >= this._textModel.linesCount)
+            return;
+
+        var chunk = this.makeLineAChunk(lineNumber);
+        this.element.scrollTop = chunk.offsetTop;
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    revealLine: function(lineNumber)
+    {
+        if (lineNumber >= this._textModel.linesCount)
+            return;
+
+        var chunk = this.makeLineAChunk(lineNumber);
+        chunk.element.scrollIntoViewIfNeeded();
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
+    addDecoration: function(lineNumber, decoration)
+    {
+        if (lineNumber >= this._textModel.linesCount)
+            return;
+
+        var chunk = this.makeLineAChunk(lineNumber);
+        chunk.addDecoration(decoration);
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
+    removeDecoration: function(lineNumber, decoration)
+    {
+        if (lineNumber >= this._textModel.linesCount)
+            return;
+
+        var chunk = this.chunkForLine(lineNumber);
+        chunk.removeDecoration(decoration);
+    },
+
+    _buildChunks: function()
+    {
+        this.beginDomUpdates();
+
+        this._container.removeChildren();
+
+        this._textChunks = [];
+        for (var i = 0; i < this._textModel.linesCount; i += this._defaultChunkSize) {
+            var chunk = this._createNewChunk(i, i + this._defaultChunkSize);
+            this._textChunks.push(chunk);
+            this._container.appendChild(chunk.element);
+        }
+
+        this._repaintAll();
+
+        this.endDomUpdates();
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    makeLineAChunk: function(lineNumber)
+    {
+        var chunkNumber = this._chunkNumberForLine(lineNumber);
+        var oldChunk = this._textChunks[chunkNumber];
+
+        if (!oldChunk) {
+            console.error("No chunk for line number: " + lineNumber);
+            return;
+        }
+
+        if (oldChunk.linesCount === 1)
+            return oldChunk;
+
+        return this._splitChunkOnALine(lineNumber, chunkNumber, true);
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {number} chunkNumber
+     * @param {boolean=} createSuffixChunk
+     */
+    _splitChunkOnALine: function(lineNumber, chunkNumber, createSuffixChunk)
+    {
+        this.beginDomUpdates();
+
+        var oldChunk = this._textChunks[chunkNumber];
+        var wasExpanded = oldChunk.expanded;
+        oldChunk.expanded = false;
+
+        var insertIndex = chunkNumber + 1;
+
+        // Prefix chunk.
+        if (lineNumber > oldChunk.startLine) {
+            var prefixChunk = this._createNewChunk(oldChunk.startLine, lineNumber);
+            prefixChunk.readOnly = oldChunk.readOnly;
+            this._textChunks.splice(insertIndex++, 0, prefixChunk);
+            this._container.insertBefore(prefixChunk.element, oldChunk.element);
+        }
+
+        // Line chunk.
+        var endLine = createSuffixChunk ? lineNumber + 1 : oldChunk.startLine + oldChunk.linesCount;
+        var lineChunk = this._createNewChunk(lineNumber, endLine);
+        lineChunk.readOnly = oldChunk.readOnly;
+        this._textChunks.splice(insertIndex++, 0, lineChunk);
+        this._container.insertBefore(lineChunk.element, oldChunk.element);
+
+        // Suffix chunk.
+        if (oldChunk.startLine + oldChunk.linesCount > endLine) {
+            var suffixChunk = this._createNewChunk(endLine, oldChunk.startLine + oldChunk.linesCount);
+            suffixChunk.readOnly = oldChunk.readOnly;
+            this._textChunks.splice(insertIndex, 0, suffixChunk);
+            this._container.insertBefore(suffixChunk.element, oldChunk.element);
+        }
+
+        // Remove enclosing chunk.
+        this._textChunks.splice(chunkNumber, 1);
+        this._container.removeChild(oldChunk.element);
+
+        if (wasExpanded) {
+            if (prefixChunk)
+                prefixChunk.expanded = true;
+            lineChunk.expanded = true;
+            if (suffixChunk)
+                suffixChunk.expanded = true;
+        }
+
+        this.endDomUpdates();
+
+        return lineChunk;
+    },
+
+    _scroll: function()
+    {
+        this._scheduleRepaintAll();
+        if (this._syncScrollListener)
+            this._syncScrollListener();
+    },
+
+    _scheduleRepaintAll: function()
+    {
+        if (this._repaintAllTimer)
+            clearTimeout(this._repaintAllTimer);
+        this._repaintAllTimer = setTimeout(this._repaintAll.bind(this), 50);
+    },
+
+    beginUpdates: function()
+    {
+        this._paintCoalescingLevel++;
+    },
+
+    endUpdates: function()
+    {
+        this._paintCoalescingLevel--;
+        if (!this._paintCoalescingLevel)
+            this._repaintAll();
+    },
+
+    beginDomUpdates: function()
+    {
+        this._domUpdateCoalescingLevel++;
+    },
+
+    endDomUpdates: function()
+    {
+        this._domUpdateCoalescingLevel--;
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    _chunkNumberForLine: function(lineNumber)
+    {
+        function compareLineNumbers(value, chunk)
+        {
+            return value < chunk.startLine ? -1 : 1;
+        }
+        var insertBefore = insertionIndexForObjectInListSortedByFunction(lineNumber, this._textChunks, compareLineNumbers);
+        return insertBefore - 1;
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    chunkForLine: function(lineNumber)
+    {
+        return this._textChunks[this._chunkNumberForLine(lineNumber)];
+    },
+
+    /**
+     * @param {number} visibleFrom
+     */
+    _findFirstVisibleChunkNumber: function(visibleFrom)
+    {
+        function compareOffsetTops(value, chunk)
+        {
+            return value < chunk.offsetTop ? -1 : 1;
+        }
+        var insertBefore = insertionIndexForObjectInListSortedByFunction(visibleFrom, this._textChunks, compareOffsetTops);
+        return insertBefore - 1;
+    },
+
+    /**
+     * @param {number} visibleFrom
+     * @param {number} visibleTo
+     */
+    _findVisibleChunks: function(visibleFrom, visibleTo)
+    {
+        var from = this._findFirstVisibleChunkNumber(visibleFrom);
+        for (var to = from + 1; to < this._textChunks.length; ++to) {
+            if (this._textChunks[to].offsetTop >= visibleTo)
+                break;
+        }
+        return { start: from, end: to };
+    },
+
+    /**
+     * @param {number} visibleFrom
+     */
+    _findFirstVisibleLineNumber: function(visibleFrom)
+    {
+        var chunk = this._textChunks[this._findFirstVisibleChunkNumber(visibleFrom)];
+        if (!chunk.expanded)
+            return chunk.startLine;
+
+        var lineNumbers = [];
+        for (var i = 0; i < chunk.linesCount; ++i) {
+            lineNumbers.push(chunk.startLine + i);
+        }
+
+        function compareLineRowOffsetTops(value, lineNumber)
+        {
+            var lineRow = chunk.getExpandedLineRow(lineNumber);
+            return value < lineRow.offsetTop ? -1 : 1;
+        }
+        var insertBefore = insertionIndexForObjectInListSortedByFunction(visibleFrom, lineNumbers, compareLineRowOffsetTops);
+        return lineNumbers[insertBefore - 1];
+    },
+
+    _repaintAll: function()
+    {
+        delete this._repaintAllTimer;
+
+        if (this._paintCoalescingLevel || this._dirtyLines)
+            return;
+
+        var visibleFrom = this.element.scrollTop;
+        var visibleTo = this.element.scrollTop + this.element.clientHeight;
+
+        if (visibleTo) {
+            var result = this._findVisibleChunks(visibleFrom, visibleTo);
+            this._expandChunks(result.start, result.end);
+        }
+    },
+
+    /**
+     * @param {number} fromIndex
+     * @param {number} toIndex
+     */
+    _expandChunks: function(fromIndex, toIndex)
+    {
+        // First collapse chunks to collect the DOM elements into a cache to reuse them later.
+        for (var i = 0; i < fromIndex; ++i)
+            this._textChunks[i].expanded = false;
+        for (var i = toIndex; i < this._textChunks.length; ++i)
+            this._textChunks[i].expanded = false;
+        for (var i = fromIndex; i < toIndex; ++i)
+            this._textChunks[i].expanded = true;
+    },
+
+    /**
+     * @param {Element} firstElement
+     * @param {Element=} lastElement
+     */
+    _totalHeight: function(firstElement, lastElement)
+    {
+        lastElement = (lastElement || firstElement).nextElementSibling;
+        if (lastElement)
+            return lastElement.offsetTop - firstElement.offsetTop;
+
+        var offsetParent = firstElement.offsetParent;
+        if (offsetParent && offsetParent.scrollHeight > offsetParent.clientHeight)
+            return offsetParent.scrollHeight - firstElement.offsetTop;
+
+        var total = 0;
+        while (firstElement && firstElement !== lastElement) {
+            total += firstElement.offsetHeight;
+            firstElement = firstElement.nextElementSibling;
+        }
+        return total;
+    },
+
+    resize: function()
+    {
+        this._repaintAll();
+    }
+}
+
+/**
+ * @constructor
+ * @extends {WebInspector.TextEditorChunkedPanel}
+ * @param {WebInspector.TextEditorModel} textModel
+ */
+WebInspector.TextEditorGutterPanel = function(textModel, syncDecorationsForLineListener, syncLineHeightListener)
+{
+    WebInspector.TextEditorChunkedPanel.call(this, textModel);
+
+    this._syncDecorationsForLineListener = syncDecorationsForLineListener;
+    this._syncLineHeightListener = syncLineHeightListener;
+
+    this.element = document.createElement("div");
+    this.element.className = "text-editor-lines";
+
+    this._container = document.createElement("div");
+    this._container.className = "inner-container";
+    this.element.appendChild(this._container);
+
+    this.element.addEventListener("scroll", this._scroll.bind(this), false);
+
+    this._freeCachedElements();
+    this._buildChunks();
+    this._decorations = {};
+}
+
+WebInspector.TextEditorGutterPanel.prototype = {
+    _freeCachedElements: function()
+    {
+        this._cachedRows = [];
+    },
+
+    /**
+     * @param {number} startLine
+     * @param {number} endLine
+     */
+    _createNewChunk: function(startLine, endLine)
+    {
+        return new WebInspector.TextEditorGutterChunk(this, startLine, endLine);
+    },
+
+    /**
+     * @param {WebInspector.TextRange} oldRange
+     * @param {WebInspector.TextRange} newRange
+     */
+    textChanged: function(oldRange, newRange)
+    {
+        this.beginDomUpdates();
+
+        var linesDiff = newRange.linesCount - oldRange.linesCount;
+        if (linesDiff) {
+            // Remove old chunks (if needed).
+            for (var chunkNumber = this._textChunks.length - 1; chunkNumber >= 0 ; --chunkNumber) {
+                var chunk = this._textChunks[chunkNumber];
+                if (chunk.startLine + chunk.linesCount <= this._textModel.linesCount)
+                    break;
+                chunk.expanded = false;
+                this._container.removeChild(chunk.element);
+            }
+            this._textChunks.length = chunkNumber + 1;
+
+            // Add new chunks (if needed).
+            var totalLines = 0;
+            if (this._textChunks.length) {
+                var lastChunk = this._textChunks[this._textChunks.length - 1];
+                totalLines = lastChunk.startLine + lastChunk.linesCount;
+            }
+
+            for (var i = totalLines; i < this._textModel.linesCount; i += this._defaultChunkSize) {
+                var chunk = this._createNewChunk(i, i + this._defaultChunkSize);
+                this._textChunks.push(chunk);
+                this._container.appendChild(chunk.element);
+            }
+
+            // Shift decorations if necessary
+            for (var lineNumber in this._decorations) {
+                lineNumber = parseInt(lineNumber, 10);
+
+                // Do not move decorations before the start position.
+                if (lineNumber < oldRange.startLine)
+                    continue;
+                // Decorations follow the first character of line.
+                if (lineNumber === oldRange.startLine && oldRange.startColumn)
+                    continue;
+
+                var lineDecorationsCopy = this._decorations[lineNumber].slice();
+                for (var i = 0; i < lineDecorationsCopy.length; ++i) {
+                    var decoration = lineDecorationsCopy[i];
+                    this.removeDecoration(lineNumber, decoration);
+
+                    // Do not restore the decorations before the end position.
+                    if (lineNumber < oldRange.endLine)
+                        continue;
+
+                    this.addDecoration(lineNumber + linesDiff, decoration);
+                }
+            }
+
+            this._repaintAll();
+        } else {
+            // Decorations may have been removed, so we may have to sync those lines.
+            var chunkNumber = this._chunkNumberForLine(newRange.startLine);
+            var chunk = this._textChunks[chunkNumber];
+            while (chunk && chunk.startLine <= newRange.endLine) {
+                if (chunk.linesCount === 1)
+                    this._syncDecorationsForLineListener(chunk.startLine);
+                chunk = this._textChunks[++chunkNumber];
+            }
+        }
+
+        this.endDomUpdates();
+    },
+
+    /**
+     * @param {number} clientHeight
+     */
+    syncClientHeight: function(clientHeight)
+    {
+        if (this.element.offsetHeight > clientHeight)
+            this._container.style.setProperty("padding-bottom", (this.element.offsetHeight - clientHeight) + "px");
+        else
+            this._container.style.removeProperty("padding-bottom");
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
+    addDecoration: function(lineNumber, decoration)
+    {
+        WebInspector.TextEditorChunkedPanel.prototype.addDecoration.call(this, lineNumber, decoration);
+        var decorations = this._decorations[lineNumber];
+        if (!decorations) {
+            decorations = [];
+            this._decorations[lineNumber] = decorations;
+        }
+        decorations.push(decoration);
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
+    removeDecoration: function(lineNumber, decoration)
+    {
+        WebInspector.TextEditorChunkedPanel.prototype.removeDecoration.call(this, lineNumber, decoration);
+        var decorations = this._decorations[lineNumber];
+        if (decorations) {
+            decorations.remove(decoration);
+            if (!decorations.length)
+                delete this._decorations[lineNumber];
+        }
+    }
+}
+
+WebInspector.TextEditorGutterPanel.prototype.__proto__ = WebInspector.TextEditorChunkedPanel.prototype;
+
+/**
+ * @constructor
+ */
+WebInspector.TextEditorGutterChunk = function(textEditor, startLine, endLine)
+{
+    this._textEditor = textEditor;
+    this._textModel = textEditor._textModel;
+
+    this.startLine = startLine;
+    endLine = Math.min(this._textModel.linesCount, endLine);
+    this.linesCount = endLine - startLine;
+
+    this._expanded = false;
+
+    this.element = document.createElement("div");
+    this.element.lineNumber = startLine;
+    this.element.className = "webkit-line-number";
+
+    if (this.linesCount === 1) {
+        // Single line chunks are typically created for decorations. Host line number in
+        // the sub-element in order to allow flexible border / margin management.
+        var innerSpan = document.createElement("span");
+        innerSpan.className = "webkit-line-number-inner";
+        innerSpan.textContent = startLine + 1;
+        var outerSpan = document.createElement("div");
+        outerSpan.className = "webkit-line-number-outer";
+        outerSpan.appendChild(innerSpan);
+        this.element.appendChild(outerSpan);
+    } else {
+        var lineNumbers = [];
+        for (var i = startLine; i < endLine; ++i)
+            lineNumbers.push(i + 1);
+        this.element.textContent = lineNumbers.join("\n");
+    }
+}
+
+WebInspector.TextEditorGutterChunk.prototype = {
+    /**
+     * @param {string} decoration
+     */
+    addDecoration: function(decoration)
+    {
+        this._textEditor.beginDomUpdates();
+        if (typeof decoration === "string")
+            this.element.addStyleClass(decoration);
+        this._textEditor.endDomUpdates();
+    },
+
+    /**
+     * @param {string} decoration
+     */
+    removeDecoration: function(decoration)
+    {
+        this._textEditor.beginDomUpdates();
+        if (typeof decoration === "string")
+            this.element.removeStyleClass(decoration);
+        this._textEditor.endDomUpdates();
+    },
+
+    /**
+     * @return {boolean}
+     */
+    get expanded()
+    {
+        return this._expanded;
+    },
+
+    set expanded(expanded)
+    {
+        if (this.linesCount === 1)
+            this._textEditor._syncDecorationsForLineListener(this.startLine);
+
+        if (this._expanded === expanded)
+            return;
+
+        this._expanded = expanded;
+
+        if (this.linesCount === 1)
+            return;
+
+        this._textEditor.beginDomUpdates();
+
+        if (expanded) {
+            this._expandedLineRows = [];
+            var parentElement = this.element.parentElement;
+            for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
+                var lineRow = this._createRow(i);
+                parentElement.insertBefore(lineRow, this.element);
+                this._expandedLineRows.push(lineRow);
+            }
+            parentElement.removeChild(this.element);
+            this._textEditor._syncLineHeightListener(this._expandedLineRows[0]);
+        } else {
+            var elementInserted = false;
+            for (var i = 0; i < this._expandedLineRows.length; ++i) {
+                var lineRow = this._expandedLineRows[i];
+                var parentElement = lineRow.parentElement;
+                if (parentElement) {
+                    if (!elementInserted) {
+                        elementInserted = true;
+                        parentElement.insertBefore(this.element, lineRow);
+                    }
+                    parentElement.removeChild(lineRow);
+                }
+                this._textEditor._cachedRows.push(lineRow);
+            }
+            delete this._expandedLineRows;
+        }
+
+        this._textEditor.endDomUpdates();
+    },
+
+    /**
+     * @return {number}
+     */
+    get height()
+    {
+        if (!this._expandedLineRows)
+            return this._textEditor._totalHeight(this.element);
+        return this._textEditor._totalHeight(this._expandedLineRows[0], this._expandedLineRows[this._expandedLineRows.length - 1]);
+    },
+
+    /**
+     * @return {number}
+     */
+    get offsetTop()
+    {
+        return (this._expandedLineRows && this._expandedLineRows.length) ? this._expandedLineRows[0].offsetTop : this.element.offsetTop;
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @return {Element}
+     */
+    _createRow: function(lineNumber)
+    {
+        var lineRow = this._textEditor._cachedRows.pop() || document.createElement("div");
+        lineRow.lineNumber = lineNumber;
+        lineRow.className = "webkit-line-number";
+        lineRow.textContent = lineNumber + 1;
+        return lineRow;
+    }
+}
+
+/**
+ * @constructor
+ * @extends {WebInspector.TextEditorChunkedPanel}
+ * @param {WebInspector.TextEditorModel} textModel
+ * @param {?string} url
+ */
+WebInspector.TextEditorMainPanel = function(textModel, url, syncScrollListener, syncDecorationsForLineListener, enterTextChangeMode, exitTextChangeMode)
+{
+    WebInspector.TextEditorChunkedPanel.call(this, textModel);
+
+    this._syncScrollListener = syncScrollListener;
+    this._syncDecorationsForLineListener = syncDecorationsForLineListener;
+    this._enterTextChangeMode = enterTextChangeMode;
+    this._exitTextChangeMode = exitTextChangeMode;
+
+    this._url = url;
+    this._highlighter = new WebInspector.TextEditorHighlighter(textModel, this._highlightDataReady.bind(this));
+    this._readOnly = true;
+
+    this.element = document.createElement("div");
+    this.element.className = "text-editor-contents";
+    this.element.tabIndex = 0;
+
+    this._container = document.createElement("div");
+    this._container.className = "inner-container";
+    this._container.tabIndex = 0;
+    this.element.appendChild(this._container);
+
+    this.element.addEventListener("scroll", this._scroll.bind(this), false);
+    this.element.addEventListener("focus", this._handleElementFocus.bind(this), false);
+
+    // In WebKit the DOMNodeRemoved event is fired AFTER the node is removed, thus it should be
+    // attached to all DOM nodes that we want to track. Instead, we attach the DOMNodeRemoved
+    // listeners only on the line rows, and use DOMSubtreeModified to track node removals inside
+    // the line rows. For more info see: https://bugs.webkit.org/show_bug.cgi?id=55666
+    //
+    // OPTIMIZATION. It is very expensive to listen to the DOM mutation events, thus we remove the
+    // listeners whenever we do any internal DOM manipulations (such as expand/collapse line rows)
+    // and set the listeners back when we are finished.
+    this._handleDOMUpdatesCallback = this._handleDOMUpdates.bind(this);
+    this._container.addEventListener("DOMCharacterDataModified", this._handleDOMUpdatesCallback, false);
+    this._container.addEventListener("DOMNodeInserted", this._handleDOMUpdatesCallback, false);
+    this._container.addEventListener("DOMSubtreeModified", this._handleDOMUpdatesCallback, false);
+
+    this._freeCachedElements();
+    this._buildChunks();
+}
+
+WebInspector.TextEditorMainPanel.prototype = {
+    /**
+     * @param {string} mimeType
+     */
+    set mimeType(mimeType)
+    {
+        this._highlighter.mimeType = mimeType;
+    },
+
+    /**
+     * @param {boolean} readOnly
+     * @param {boolean} requestFocus
+     */
+    setReadOnly: function(readOnly, requestFocus)
+    {
+        if (this._readOnly === readOnly)
+            return;
+
+        this.beginDomUpdates();
+        this._readOnly = readOnly;
+        if (this._readOnly)
+            this._container.removeStyleClass("text-editor-editable");
+        else {
+            this._container.addStyleClass("text-editor-editable");
+            if (requestFocus)
+                this._updateSelectionOnStartEditing();
+        }
+        this.endDomUpdates();
+    },
+
+    /**
+     * @return {boolean}
+     */
+    readOnly: function()
+    {
+        return this._readOnly;
+    },
+
+    _handleElementFocus: function()
+    {
+        if (!this._readOnly)
+            this._container.focus();
+    },
+
+    /**
+     * @return {Element}
+     */
+    defaultFocusedElement: function()
+    {
+        if (this._readOnly)
+            return this.element;
+        return this._container;
+    },
+
+    _updateSelectionOnStartEditing: function()
+    {
+        // focus() needs to go first for the case when the last selection was inside the editor and
+        // the "Edit" button was clicked. In this case we bail at the check below, but the
+        // editor does not receive the focus, thus "Esc" does not cancel editing until at least
+        // one change has been made to the editor contents.
+        this._container.focus();
+        var selection = window.getSelection();
+        if (selection.rangeCount) {
+            var commonAncestorContainer = selection.getRangeAt(0).commonAncestorContainer;
+            if (this._container.isSelfOrAncestor(commonAncestorContainer))
+                return;
+        }
+
+        selection.removeAllRanges();
+        var range = document.createRange();
+        range.setStart(this._container, 0);
+        range.setEnd(this._container, 0);
+        selection.addRange(range);
+    },
+
+    /**
+     * @param {number} startLine
+     * @param {number} endLine
+     */
+    setEditableRange: function(startLine, endLine)
+    {
+        this.beginDomUpdates();
+
+        var firstChunkNumber = this._chunkNumberForLine(startLine);
+        var firstChunk = this._textChunks[firstChunkNumber];
+        if (firstChunk.startLine !== startLine) {
+            this._splitChunkOnALine(startLine, firstChunkNumber);
+            firstChunkNumber += 1;
+        }
+
+        var lastChunkNumber = this._textChunks.length;
+        if (endLine !== this._textModel.linesCount) {
+            lastChunkNumber = this._chunkNumberForLine(endLine);
+            var lastChunk = this._textChunks[lastChunkNumber];
+            if (lastChunk && lastChunk.startLine !== endLine) {
+                this._splitChunkOnALine(endLine, lastChunkNumber);
+                lastChunkNumber += 1;
+            }
+        }
+
+        for (var chunkNumber = 0; chunkNumber < firstChunkNumber; ++chunkNumber)
+            this._textChunks[chunkNumber].readOnly = true;
+        for (var chunkNumber = firstChunkNumber; chunkNumber < lastChunkNumber; ++chunkNumber)
+            this._textChunks[chunkNumber].readOnly = false;
+        for (var chunkNumber = lastChunkNumber; chunkNumber < this._textChunks.length; ++chunkNumber)
+            this._textChunks[chunkNumber].readOnly = true;
+
+        this.endDomUpdates();
+    },
+
+    clearEditableRange: function()
+    {
+        for (var chunkNumber = 0; chunkNumber < this._textChunks.length; ++chunkNumber)
+            this._textChunks[chunkNumber].readOnly = false;
+    },
+
+    /**
+     * @param {WebInspector.TextRange} range
+     */
+    markAndRevealRange: function(range)
+    {
+        if (this._rangeToMark) {
+            var markedLine = this._rangeToMark.startLine;
+            delete this._rangeToMark;
+            // Remove the marked region immediately.
+            if (!this._dirtyLines) {
+                this.beginDomUpdates();
+                var chunk = this.chunkForLine(markedLine);
+                var wasExpanded = chunk.expanded;
+                chunk.expanded = false;
+                chunk.updateCollapsedLineRow();
+                chunk.expanded = wasExpanded;
+                this.endDomUpdates();
+            } else
+                this._paintLines(markedLine, markedLine + 1);
+        }
+
+        if (range) {
+            this._rangeToMark = range;
+            this.revealLine(range.startLine);
+            var chunk = this.makeLineAChunk(range.startLine);
+            this._paintLine(chunk.element);
+            if (this._markedRangeElement)
+                this._markedRangeElement.scrollIntoViewIfNeeded();
+        }
+        delete this._markedRangeElement;
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    highlightLine: function(lineNumber)
+    {
+        this.clearLineHighlight();
+        this._highlightedLine = lineNumber;
+        this.revealLine(lineNumber);
+
+        if (!this._readOnly)
+            this._restoreSelection(WebInspector.TextRange.createFromLocation(lineNumber, 0), false);
+
+        this.addDecoration(lineNumber, "webkit-highlighted-line");
+    },
+
+    clearLineHighlight: function()
+    {
+        if (typeof this._highlightedLine === "number") {
+            this.removeDecoration(this._highlightedLine, "webkit-highlighted-line");
+            delete this._highlightedLine;
+        }
+    },
+
+    _freeCachedElements: function()
+    {
+        this._cachedSpans = [];
+        this._cachedTextNodes = [];
+        this._cachedRows = [];
+    },
+
+    /**
+     * @param {boolean} redo
+     */
+    handleUndoRedo: function(redo)
+    {
+        if (this._dirtyLines)
+            return false;
+
+        this.beginUpdates();
+
+        function before()
+        {
+            this._enterTextChangeMode();
+        }
+
+        function after(oldRange, newRange)
+        {
+            this._exitTextChangeMode(oldRange, newRange);
+        }
+
+        var range = redo ? this._textModel.redo(before.bind(this), after.bind(this)) : this._textModel.undo(before.bind(this), after.bind(this));
+
+        this.endUpdates();
+
+        // Restore location post-repaint.
+        if (range)
+            this._restoreSelection(range, true);
+
+        return true;
+    },
+
+    /**
+     * @param {boolean} shiftKey
+     */
+    handleTabKeyPress: function(shiftKey)
+    {
+        if (this._dirtyLines)
+            return false;
+
+        var selection = this._getSelection();
+        if (!selection)
+            return false;
+
+        var range = selection.normalize();
+
+        this.beginUpdates();
+        this._enterTextChangeMode();
+
+        var newRange;
+        var rangeWasEmpty = range.isEmpty();
+        if (shiftKey)
+            newRange = this._unindentLines(range);
+        else {
+            if (rangeWasEmpty)
+                newRange = this._editRange(range, WebInspector.settings.textEditorIndent.get());
+            else
+                newRange = this._indentLines(range);
+        }
+
+        this._exitTextChangeMode(range, newRange);
+        this.endUpdates();
+        if (rangeWasEmpty)
+            newRange.startColumn = newRange.endColumn;
+        this._restoreSelection(newRange, true);
+        return true;
+    },
+
+    /**
+     * @param {WebInspector.TextRange} range
+     */
+    _indentLines: function(range)
+    {
+        var indent = WebInspector.settings.textEditorIndent.get();
+
+        if (this._lastEditedRange)
+            this._textModel.markUndoableState();
+
+        var newRange = range.clone();
+
+        // Do not change a selection start position when it is at the beginning of a line
+        if (range.startColumn)
+            newRange.startColumn += indent.length;
+
+        var indentEndLine = range.endLine;
+        if (range.endColumn)
+            newRange.endColumn += indent.length;
+        else
+            indentEndLine--;
+
+        for (var lineNumber = range.startLine; lineNumber <= indentEndLine; lineNumber++)
+            this._textModel.editRange(WebInspector.TextRange.createFromLocation(lineNumber, 0), indent);
+
+        this._lastEditedRange = newRange;
+
+        return newRange;
+    },
+
+    /**
+     * @param {WebInspector.TextRange} range
+     */
+    _unindentLines: function(range)
+    {
+        if (this._lastEditedRange)
+            this._textModel.markUndoableState();
+
+        var indent = WebInspector.settings.textEditorIndent.get();
+        var indentLength = indent === WebInspector.TextEditorModel.Indent.TabCharacter ? 4 : indent.length;
+        var lineIndentRegex = new RegExp("^ {1," + indentLength + "}");
+        var newRange = range.clone();
+
+        var indentEndLine = range.endLine;
+        if (!range.endColumn)
+            indentEndLine--;
+
+        for (var lineNumber = range.startLine; lineNumber <= indentEndLine; lineNumber++) {
+            var line = this._textModel.line(lineNumber);
+            var firstCharacter = line.charAt(0);
+            var lineIndentLength;
+
+            if (firstCharacter === " ")
+                lineIndentLength = line.match(lineIndentRegex)[0].length;
+            else if (firstCharacter === "\t")
+                lineIndentLength = 1;
+            else
+                continue;
+
+            this._textModel.editRange(new WebInspector.TextRange(lineNumber, 0, lineNumber, lineIndentLength), "");
+
+            if (lineNumber === range.startLine)
+                newRange.startColumn = Math.max(0, newRange.startColumn - lineIndentLength);
+        }
+
+        if (lineIndentLength)
+            newRange.endColumn = Math.max(0, newRange.endColumn - lineIndentLength);
+
+        this._lastEditedRange = newRange;
+
+        return newRange;
+    },
+
+    handleEnterKey: function()
+    {
+        if (this._dirtyLines)
+            return false;
+
+        var range = this._getSelection();
+        if (!range)
+            return false;
+
+        range = range.normalize();
+
+        if (range.endColumn === 0)
+            return false;
+
+        var line = this._textModel.line(range.startLine);
+        var linePrefix = line.substring(0, range.startColumn);
+        var indentMatch = linePrefix.match(/^\s+/);
+        var currentIndent = indentMatch ? indentMatch[0] : "";
+
+        var textEditorIndent = WebInspector.settings.textEditorIndent.get();
+        var indent = WebInspector.TextEditorModel.endsWithBracketRegex.test(linePrefix) ? currentIndent + textEditorIndent : currentIndent;
+
+        if (!indent)
+            return false;
+
+        this.beginUpdates();
+        this._enterTextChangeMode();
+
+        var lineBreak = this._textModel.lineBreak;
+        var newRange;
+        if (range.isEmpty() && line.substr(range.endColumn - 1, 2) === '{}') {
+            // {|}
+            // becomes
+            // {
+            //     |
+            // }
+            newRange = this._editRange(range, lineBreak + indent + lineBreak + currentIndent);
+            newRange.endLine--;
+            newRange.endColumn += textEditorIndent.length;
+        } else
+            newRange = this._editRange(range, lineBreak + indent);
+
+        this._exitTextChangeMode(range, newRange);
+        this.endUpdates();
+        this._restoreSelection(newRange.collapseToEnd(), true);
+
+        return true;
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {number} chunkNumber
+     * @param {boolean=} createSuffixChunk
+     */
+    _splitChunkOnALine: function(lineNumber, chunkNumber, createSuffixChunk)
+    {
+        var selection = this._getSelection();
+        var chunk = WebInspector.TextEditorChunkedPanel.prototype._splitChunkOnALine.call(this, lineNumber, chunkNumber, createSuffixChunk);
+        this._restoreSelection(selection);
+        return chunk;
+    },
+
+    beginDomUpdates: function()
+    {
+        WebInspector.TextEditorChunkedPanel.prototype.beginDomUpdates.call(this);
+        if (this._domUpdateCoalescingLevel === 1) {
+            this._container.removeEventListener("DOMCharacterDataModified", this._handleDOMUpdatesCallback, false);
+            this._container.removeEventListener("DOMNodeInserted", this._handleDOMUpdatesCallback, false);
+            this._container.removeEventListener("DOMSubtreeModified", this._handleDOMUpdatesCallback, false);
+        }
+    },
+
+    endDomUpdates: function()
+    {
+        WebInspector.TextEditorChunkedPanel.prototype.endDomUpdates.call(this);
+        if (this._domUpdateCoalescingLevel === 0) {
+            this._container.addEventListener("DOMCharacterDataModified", this._handleDOMUpdatesCallback, false);
+            this._container.addEventListener("DOMNodeInserted", this._handleDOMUpdatesCallback, false);
+            this._container.addEventListener("DOMSubtreeModified", this._handleDOMUpdatesCallback, false);
+        }
+    },
+
+    /**
+     * @param {Element} lineRow
+     * @param {boolean} enable
+     */
+    _enableDOMNodeRemovedListener: function(lineRow, enable)
+    {
+        if (enable)
+            lineRow.addEventListener("DOMNodeRemoved", this._handleDOMUpdatesCallback, false);
+        else
+            lineRow.removeEventListener("DOMNodeRemoved", this._handleDOMUpdatesCallback, false);
+    },
+
+    _buildChunks: function()
+    {
+        for (var i = 0; i < this._textModel.linesCount; ++i)
+            this._textModel.removeAttribute(i, "highlight");
+
+        WebInspector.TextEditorChunkedPanel.prototype._buildChunks.call(this);
+    },
+
+    /**
+     * @param {number} startLine
+     * @param {number} endLine
+     */
+    _createNewChunk: function(startLine, endLine)
+    {
+        return new WebInspector.TextEditorMainChunk(this, startLine, endLine);
+    },
+
+    /**
+     * @param {number} fromIndex
+     * @param {number} toIndex
+     */
+    _expandChunks: function(fromIndex, toIndex)
+    {
+        var lastChunk = this._textChunks[toIndex - 1];
+        var lastVisibleLine = lastChunk.startLine + lastChunk.linesCount;
+
+        var selection = this._getSelection();
+
+        this._muteHighlightListener = true;
+        this._highlighter.highlight(lastVisibleLine);
+        delete this._muteHighlightListener;
+
+        this._restorePaintLinesOperationsCredit();
+        WebInspector.TextEditorChunkedPanel.prototype._expandChunks.call(this, fromIndex, toIndex);
+        this._adjustPaintLinesOperationsRefreshValue();
+
+        this._restoreSelection(selection);
+    },
+
+    /**
+     * @param {number} fromLine
+     * @param {number} toLine
+     */
+    _highlightDataReady: function(fromLine, toLine)
+    {
+        if (this._muteHighlightListener)
+            return;
+        this._restorePaintLinesOperationsCredit();
+        this._paintLines(fromLine, toLine, true /*restoreSelection*/);
+    },
+
+    /**
+     * @param {number} startLine
+     * @param {number} endLine
+     */
+    _schedulePaintLines: function(startLine, endLine)
+    {
+        if (startLine >= endLine)
+            return;
+
+        if (!this._scheduledPaintLines) {
+            this._scheduledPaintLines = [ { startLine: startLine, endLine: endLine } ];
+            this._paintScheduledLinesTimer = setTimeout(this._paintScheduledLines.bind(this), 0);
+        } else {
+            for (var i = 0; i < this._scheduledPaintLines.length; ++i) {
+                var chunk = this._scheduledPaintLines[i];
+                if (chunk.startLine <= endLine && chunk.endLine >= startLine) {
+                    chunk.startLine = Math.min(chunk.startLine, startLine);
+                    chunk.endLine = Math.max(chunk.endLine, endLine);
+                    return;
+                }
+                if (chunk.startLine > endLine) {
+                    this._scheduledPaintLines.splice(i, 0, { startLine: startLine, endLine: endLine });
+                    return;
+                }
+            }
+            this._scheduledPaintLines.push({ startLine: startLine, endLine: endLine });
+        }
+    },
+
+    /**
+     * @param {boolean} skipRestoreSelection
+     */
+    _paintScheduledLines: function(skipRestoreSelection)
+    {
+        if (this._paintScheduledLinesTimer)
+            clearTimeout(this._paintScheduledLinesTimer);
+        delete this._paintScheduledLinesTimer;
+
+        if (!this._scheduledPaintLines)
+            return;
+
+        // Reschedule the timer if we can not paint the lines yet, or the user is scrolling.
+        if (this._dirtyLines || this._repaintAllTimer) {
+            this._paintScheduledLinesTimer = setTimeout(this._paintScheduledLines.bind(this), 50);
+            return;
+        }
+
+        var scheduledPaintLines = this._scheduledPaintLines;
+        delete this._scheduledPaintLines;
+
+        this._restorePaintLinesOperationsCredit();
+        this._paintLineChunks(scheduledPaintLines, !skipRestoreSelection);
+        this._adjustPaintLinesOperationsRefreshValue();
+    },
+
+    _restorePaintLinesOperationsCredit: function()
+    {
+        if (!this._paintLinesOperationsRefreshValue)
+            this._paintLinesOperationsRefreshValue = 250;
+        this._paintLinesOperationsCredit = this._paintLinesOperationsRefreshValue;
+        this._paintLinesOperationsLastRefresh = Date.now();
+    },
+
+    _adjustPaintLinesOperationsRefreshValue: function()
+    {
+        var operationsDone = this._paintLinesOperationsRefreshValue - this._paintLinesOperationsCredit;
+        if (operationsDone <= 0)
+            return;
+        var timePast = Date.now() - this._paintLinesOperationsLastRefresh;
+        if (timePast <= 0)
+            return;
+        // Make the synchronous CPU chunk for painting the lines 50 msec.
+        var value = Math.floor(operationsDone / timePast * 50);
+        this._paintLinesOperationsRefreshValue = Number.constrain(value, 150, 1500);
+    },
+
+    /**
+     * @param {number} fromLine
+     * @param {number} toLine
+     * @param {boolean=} restoreSelection
+     */
+    _paintLines: function(fromLine, toLine, restoreSelection)
+    {
+        this._paintLineChunks([ { startLine: fromLine, endLine: toLine } ], restoreSelection);
+    },
+
+    /**
+     * @param {boolean=} restoreSelection
+     */
+    _paintLineChunks: function(lineChunks, restoreSelection)
+    {
+        // First, paint visible lines, so that in case of long lines we should start highlighting
+        // the visible area immediately, instead of waiting for the lines above the visible area.
+        var visibleFrom = this.element.scrollTop;
+        var firstVisibleLineNumber = this._findFirstVisibleLineNumber(visibleFrom);
+
+        var chunk;
+        var selection;
+        var invisibleLineRows = [];
+        for (var i = 0; i < lineChunks.length; ++i) {
+            var lineChunk = lineChunks[i];
+            if (this._dirtyLines || this._scheduledPaintLines) {
+                this._schedulePaintLines(lineChunk.startLine, lineChunk.endLine);
+                continue;
+            }
+            for (var lineNumber = lineChunk.startLine; lineNumber < lineChunk.endLine; ++lineNumber) {
+                if (!chunk || lineNumber < chunk.startLine || lineNumber >= chunk.startLine + chunk.linesCount)
+                    chunk = this.chunkForLine(lineNumber);
+                var lineRow = chunk.getExpandedLineRow(lineNumber);
+                if (!lineRow)
+                    continue;
+                if (lineNumber < firstVisibleLineNumber) {
+                    invisibleLineRows.push(lineRow);
+                    continue;
+                }
+                if (restoreSelection && !selection)
+                    selection = this._getSelection();
+                this._paintLine(lineRow);
+                if (this._paintLinesOperationsCredit < 0) {
+                    this._schedulePaintLines(lineNumber + 1, lineChunk.endLine);
+                    break;
+                }
+            }
+        }
+
+        for (var i = 0; i < invisibleLineRows.length; ++i) {
+            if (restoreSelection && !selection)
+                selection = this._getSelection();
+            this._paintLine(invisibleLineRows[i]);
+        }
+
+        if (restoreSelection)
+            this._restoreSelection(selection);
+    },
+
+    /**
+     * @param {Element} lineRow
+     */
+    _paintLine: function(lineRow)
+    {
+        var lineNumber = lineRow.lineNumber;
+        if (this._dirtyLines) {
+            this._schedulePaintLines(lineNumber, lineNumber + 1);
+            return;
+        }
+
+        this.beginDomUpdates();
+        try {
+            if (this._scheduledPaintLines || this._paintLinesOperationsCredit < 0) {
+                this._schedulePaintLines(lineNumber, lineNumber + 1);
+                return;
+            }
+
+            var highlight = this._textModel.getAttribute(lineNumber, "highlight");
+            if (!highlight)
+                return;
+
+            lineRow.removeChildren();
+            var line = this._textModel.line(lineNumber);
+            if (!line)
+                lineRow.appendChild(document.createElement("br"));
+
+            var plainTextStart = -1;
+            for (var j = 0; j < line.length;) {
+                if (j > 1000) {
+                    // This line is too long - do not waste cycles on minified js highlighting.
+                    if (plainTextStart === -1)
+                        plainTextStart = j;
+                    break;
+                }
+                var attribute = highlight[j];
+                if (!attribute || !attribute.tokenType) {
+                    if (plainTextStart === -1)
+                        plainTextStart = j;
+                    j++;
+                } else {
+                    if (plainTextStart !== -1) {
+                        this._appendTextNode(lineRow, line.substring(plainTextStart, j));
+                        plainTextStart = -1;
+                        --this._paintLinesOperationsCredit;
+                    }
+                    this._appendSpan(lineRow, line.substring(j, j + attribute.length), attribute.tokenType);
+                    j += attribute.length;
+                    --this._paintLinesOperationsCredit;
+                }
+            }
+            if (plainTextStart !== -1) {
+                this._appendTextNode(lineRow, line.substring(plainTextStart, line.length));
+                --this._paintLinesOperationsCredit;
+            }
+            if (lineRow.decorationsElement)
+                lineRow.appendChild(lineRow.decorationsElement);
+        } finally {
+            if (this._rangeToMark && this._rangeToMark.startLine === lineNumber)
+                this._markedRangeElement = WebInspector.highlightSearchResult(lineRow, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
+            this.endDomUpdates();
+        }
+    },
+
+    /**
+     * @param {Element} lineRow
+     */
+    _releaseLinesHighlight: function(lineRow)
+    {
+        if (!lineRow)
+            return;
+        if ("spans" in lineRow) {
+            var spans = lineRow.spans;
+            for (var j = 0; j < spans.length; ++j)
+                this._cachedSpans.push(spans[j]);
+            delete lineRow.spans;
+        }
+        if ("textNodes" in lineRow) {
+            var textNodes = lineRow.textNodes;
+            for (var j = 0; j < textNodes.length; ++j)
+                this._cachedTextNodes.push(textNodes[j]);
+            delete lineRow.textNodes;
+        }
+        this._cachedRows.push(lineRow);
+    },
+
+    /**
+     * @return {WebInspector.TextRange}
+     */
+    _getSelection: function()
+    {
+        var selection = window.getSelection();
+        if (!selection.rangeCount)
+            return null;
+        // Selection may be outside of the editor.
+        if (!this._container.isAncestor(selection.anchorNode) || !this._container.isAncestor(selection.focusNode))
+            return null;
+        var start = this._selectionToPosition(selection.anchorNode, selection.anchorOffset);
+        var end = selection.isCollapsed ? start : this._selectionToPosition(selection.focusNode, selection.focusOffset);
+        return new WebInspector.TextRange(start.line, start.column, end.line, end.column);
+    },
+
+    /**
+     * @param {boolean=} scrollIntoView
+     */
+    _restoreSelection: function(range, scrollIntoView)
+    {
+        if (!range)
+            return;
+        var start = this._positionToSelection(range.startLine, range.startColumn);
+        var end = range.isEmpty() ? start : this._positionToSelection(range.endLine, range.endColumn);
+        window.getSelection().setBaseAndExtent(start.container, start.offset, end.container, end.offset);
+
+        if (scrollIntoView) {
+            for (var node = end.container; node; node = node.parentElement) {
+                if (node.scrollIntoViewIfNeeded) {
+                    node.scrollIntoViewIfNeeded();
+                    break;
+                }
+            }
+        }
+    },
+
+    /**
+     * @param {Node} container
+     * @param {number} offset
+     */
+    _selectionToPosition: function(container, offset)
+    {
+        if (container === this._container && offset === 0)
+            return { line: 0, column: 0 };
+        if (container === this._container && offset === 1)
+            return { line: this._textModel.linesCount - 1, column: this._textModel.lineLength(this._textModel.linesCount - 1) };
+
+        var lineRow = this._enclosingLineRowOrSelf(container);
+        var lineNumber = lineRow.lineNumber;
+        if (container === lineRow && offset === 0)
+            return { line: lineNumber, column: 0 };
+
+        // This may be chunk and chunks may contain \n.
+        var column = 0;
+        var node = lineRow.nodeType === Node.TEXT_NODE ? lineRow : lineRow.traverseNextTextNode(lineRow);
+        while (node && node !== container) {
+            var text = node.textContent;
+            for (var i = 0; i < text.length; ++i) {
+                if (text.charAt(i) === "\n") {
+                    lineNumber++;
+                    column = 0;
+                } else
+                    column++;
+            }
+            node = node.traverseNextTextNode(lineRow);
+        }
+
+        if (node === container && offset) {
+            var text = node.textContent;
+            for (var i = 0; i < offset; ++i) {
+                if (text.charAt(i) === "\n") {
+                    lineNumber++;
+                    column = 0;
+                } else
+                    column++;
+            }
+        }
+        return { line: lineNumber, column: column };
+    },
+
+    /**
+     * @param {number} line
+     * @param {number} column
+     */
+    _positionToSelection: function(line, column)
+    {
+        var chunk = this.chunkForLine(line);
+        // One-lined collapsed chunks may still stay highlighted.
+        var lineRow = chunk.linesCount === 1 ? chunk.element : chunk.getExpandedLineRow(line);
+        if (lineRow)
+            var rangeBoundary = lineRow.rangeBoundaryForOffset(column);
+        else {
+            var offset = column;
+            for (var i = chunk.startLine; i < line; ++i)
+                offset += this._textModel.lineLength(i) + 1; // \n
+            lineRow = chunk.element;
+            if (lineRow.firstChild)
+                var rangeBoundary = { container: lineRow.firstChild, offset: offset };
+            else
+                var rangeBoundary = { container: lineRow, offset: 0 };
+        }
+        return rangeBoundary;
+    },
+
+    /**
+     * @param {Node} element
+     */
+    _enclosingLineRowOrSelf: function(element)
+    {
+        var lineRow = element.enclosingNodeOrSelfWithClass("webkit-line-content");
+        if (lineRow)
+            return lineRow;
+
+        for (lineRow = element; lineRow; lineRow = lineRow.parentElement) {
+            if (lineRow.parentElement === this._container)
+                return lineRow;
+        }
+        return null;
+    },
+
+    /**
+     * @param {Element} element
+     * @param {string} content
+     * @param {string} className
+     */
+    _appendSpan: function(element, content, className)
+    {
+        if (className === "html-resource-link" || className === "html-external-link") {
+            element.appendChild(this._createLink(content, className === "html-external-link"));
+            return;
+        }
+
+        var span = this._cachedSpans.pop() || document.createElement("span");
+        span.className = "webkit-" + className;
+        span.textContent = content;
+        element.appendChild(span);
+        if (!("spans" in element))
+            element.spans = [];
+        element.spans.push(span);
+    },
+
+    /**
+     * @param {Element} element
+     * @param {string} text
+     */
+    _appendTextNode: function(element, text)
+    {
+        var textNode = this._cachedTextNodes.pop();
+        if (textNode)
+            textNode.nodeValue = text;
+        else
+            textNode = document.createTextNode(text);
+        element.appendChild(textNode);
+        if (!("textNodes" in element))
+            element.textNodes = [];
+        element.textNodes.push(textNode);
+    },
+
+    /**
+     * @param {string} content
+     * @param {boolean} isExternal
+     */
+    _createLink: function(content, isExternal)
+    {
+        var quote = content.charAt(0);
+        if (content.length > 1 && (quote === "\"" ||   quote === "'"))
+            content = content.substring(1, content.length - 1);
+        else
+            quote = null;
+
+        var a = WebInspector.linkifyURLAsNode(this._rewriteHref(content), content, undefined, isExternal);
+        var span = document.createElement("span");
+        span.className = "webkit-html-attribute-value";
+        if (quote)
+            span.appendChild(document.createTextNode(quote));
+        span.appendChild(a);
+        if (quote)
+            span.appendChild(document.createTextNode(quote));
+        return span;
+    },
+
+    /**
+     * @param {string=} hrefValue
+     * @param {boolean=} isExternal
+     */
+    _rewriteHref: function(hrefValue, isExternal)
+    {
+        if (!this._url || !hrefValue || hrefValue.indexOf("://") > 0)
+            return hrefValue;
+        return WebInspector.completeURL(this._url, hrefValue);
+    },
+
+    _handleDOMUpdates: function(e)
+    {
+        if (this._domUpdateCoalescingLevel)
+            return;
+
+        var target = e.target;
+        if (target === this._container)
+            return;
+
+        var lineRow = this._enclosingLineRowOrSelf(target);
+        if (!lineRow)
+            return;
+
+        if (lineRow.decorationsElement && lineRow.decorationsElement.isSelfOrAncestor(target)) {
+            if (this._syncDecorationsForLineListener)
+                this._syncDecorationsForLineListener(lineRow.lineNumber);
+            return;
+        }
+
+        if (this._readOnly)
+            return;
+
+        if (target === lineRow && e.type === "DOMNodeInserted") {
+            // Ensure that the newly inserted line row has no lineNumber.
+            delete lineRow.lineNumber;
+        }
+
+        var startLine = 0;
+        for (var row = lineRow; row; row = row.previousSibling) {
+            if (typeof row.lineNumber === "number") {
+                startLine = row.lineNumber;
+                break;
+            }
+        }
+
+        var endLine = startLine + 1;
+        for (var row = lineRow.nextSibling; row; row = row.nextSibling) {
+            if (typeof row.lineNumber === "number" && row.lineNumber > startLine) {
+                endLine = row.lineNumber;
+                break;
+            }
+        }
+
+        if (target === lineRow && e.type === "DOMNodeRemoved") {
+            // Now this will no longer be valid.
+            delete lineRow.lineNumber;
+        }
+
+        if (this._dirtyLines) {
+            this._dirtyLines.start = Math.min(this._dirtyLines.start, startLine);
+            this._dirtyLines.end = Math.max(this._dirtyLines.end, endLine);
+        } else {
+            this._dirtyLines = { start: startLine, end: endLine };
+            setTimeout(this._applyDomUpdates.bind(this), 0);
+            // Remove marked ranges, if any.
+            this.markAndRevealRange(null);
+        }
+    },
+
+    _applyDomUpdates: function()
+    {
+        if (!this._dirtyLines)
+            return;
+
+        // Check if the editor had been set readOnly by the moment when this async callback got executed.
+        if (this._readOnly) {
+            delete this._dirtyLines;
+            return;
+        }
+
+        var dirtyLines = this._dirtyLines;
+
+        var firstChunkNumber = this._chunkNumberForLine(dirtyLines.start);
+        var startLine = this._textChunks[firstChunkNumber].startLine;
+        var endLine = this._textModel.linesCount;
+
+        // Collect lines.
+        var firstLineRow;
+        if (firstChunkNumber) {
+            var chunk = this._textChunks[firstChunkNumber - 1];
+            firstLineRow = chunk.expanded ? chunk.getExpandedLineRow(chunk.startLine + chunk.linesCount - 1) : chunk.element;
+            firstLineRow = firstLineRow.nextSibling;
+        } else
+            firstLineRow = this._container.firstChild;
+
+        var lines = [];
+        for (var lineRow = firstLineRow; lineRow; lineRow = lineRow.nextSibling) {
+            if (typeof lineRow.lineNumber === "number" && lineRow.lineNumber >= dirtyLines.end) {
+                endLine = lineRow.lineNumber;
+                break;
+            }
+            // Update with the newest lineNumber, so that the call to the _getSelection method below should work.
+            lineRow.lineNumber = startLine + lines.length;
+            this._collectLinesFromDiv(lines, lineRow);
+        }
+
+        // Try to decrease the range being replaced, if possible.
+        var startOffset = 0;
+        while (startLine < dirtyLines.start && startOffset < lines.length) {
+            if (this._textModel.line(startLine) !== lines[startOffset])
+                break;
+            ++startOffset;
+            ++startLine;
+        }
+
+        var endOffset = lines.length;
+        while (endLine > dirtyLines.end && endOffset > startOffset) {
+            if (this._textModel.line(endLine - 1) !== lines[endOffset - 1])
+                break;
+            --endOffset;
+            --endLine;
+        }
+
+        lines = lines.slice(startOffset, endOffset);
+
+        // Try to decrease the range being replaced by column offsets, if possible.
+        var startColumn = 0;
+        var endColumn = this._textModel.lineLength(endLine - 1);
+        if (lines.length > 0) {
+            var line1 = this._textModel.line(startLine);
+            var line2 = lines[0];
+            while (line1[startColumn] && line1[startColumn] === line2[startColumn])
+                ++startColumn;
+            lines[0] = line2.substring(startColumn);
+
+            line1 = this._textModel.line(endLine - 1);
+            line2 = lines[lines.length - 1];
+            for (var i = 0; i < endColumn && i < line2.length; ++i) {
+                if (startLine === endLine - 1 && endColumn - i <= startColumn)
+                    break;
+                if (line1[endColumn - i - 1] !== line2[line2.length - i - 1])
+                    break;
+            }
+            if (i) {
+                endColumn -= i;
+                lines[lines.length - 1] = line2.substring(0, line2.length - i);
+            }
+        }
+
+        var selection = this._getSelection();
+
+        if (lines.length === 0 && endLine < this._textModel.linesCount)
+            var oldRange = new WebInspector.TextRange(startLine, 0, endLine, 0);
+        else if (lines.length === 0 && startLine > 0)
+            var oldRange = new WebInspector.TextRange(startLine - 1, this._textModel.lineLength(startLine - 1), endLine - 1, this._textModel.lineLength(endLine - 1));
+        else
+            var oldRange = new WebInspector.TextRange(startLine, startColumn, endLine - 1, endColumn);
+
+        var newContent = lines.join("\n");
+        if (this._textModel.copyRange(oldRange) === newContent) {
+            delete this._dirtyLines;
+            return; // Noop
+        }
+
+        if (lines.length === 1 && lines[0] === "}" && oldRange.isEmpty() && selection.isEmpty() && !this._textModel.line(oldRange.endLine).trim())
+            this._unindentAfterBlock(oldRange, selection);
+        
+        // This is a "foreign" call outside of this class. Should be before we delete the dirty lines flag.
+        this._enterTextChangeMode();
+
+        delete this._dirtyLines;
+
+        var newRange = this._editRange(oldRange, newContent);
+
+        this._paintScheduledLines(true);
+        this._restoreSelection(selection);
+
+        this._exitTextChangeMode(oldRange, newRange);
+    },
+
+    /**
+     * @param {WebInspector.TextRange} oldRange
+     * @param {WebInspector.TextRange} selection
+     */
+    _unindentAfterBlock: function(oldRange, selection)
+    {
+        var nestingLevel = 1;
+        for (var i = oldRange.endLine; i >= 0; --i) {
+            var attribute = this._textModel.getAttribute(i, "highlight");
+            if (!attribute)
+                continue;
+            var columnNumbers = Object.keys(attribute).reverse();
+            for (var j = 0; j < columnNumbers.length; ++j) {
+                var column = columnNumbers[j];
+                if (attribute[column].tokenType === "block-start") {
+                    if (!(--nestingLevel)) {
+                        var lineContent = this._textModel.line(i);
+                        var blockOffset = lineContent.length - lineContent.trimLeft().length;
+                        if (blockOffset < oldRange.startColumn) {
+                            oldRange.startColumn = blockOffset;
+                            selection.startColumn = blockOffset + 1;
+                            selection.endColumn = blockOffset + 1;
+                        }
+                        return;
+                    }
+                }
+                if (attribute[column].tokenType === "block-end")
+                    ++nestingLevel;
+            }
+        }
+    },
+
+    /**
+     * @param {WebInspector.TextRange} oldRange
+     * @param {WebInspector.TextRange} newRange
+     */
+    textChanged: function(oldRange, newRange)
+    {
+        this.beginDomUpdates();
+        this._removeDecorationsInRange(oldRange);
+        this._updateChunksForRanges(oldRange, newRange);
+        this._updateHighlightsForRange(newRange);
+        this.endDomUpdates();
+    },
+
+    /**
+     * @param {WebInspector.TextRange} range
+     * @param {string} text
+     */
+    _editRange: function(range, text)
+    {
+        if (this._lastEditedRange && (!text || text.indexOf("\n") !== -1 || this._lastEditedRange.endLine !== range.startLine || this._lastEditedRange.endColumn !== range.startColumn))
+            this._textModel.markUndoableState();
+
+        var newRange = this._textModel.editRange(range, text);
+        this._lastEditedRange = newRange;
+
+        return newRange;
+    },
+
+    /**
+     * @param {WebInspector.TextRange} range
+     */
+    _removeDecorationsInRange: function(range)
+    {
+        for (var i = this._chunkNumberForLine(range.startLine); i < this._textChunks.length; ++i) {
+            var chunk = this._textChunks[i];
+            if (chunk.startLine > range.endLine)
+                break;
+            chunk.removeAllDecorations();
+        }
+    },
+
+    /**
+     * @param {WebInspector.TextRange} oldRange
+     * @param {WebInspector.TextRange} newRange
+     */
+    _updateChunksForRanges: function(oldRange, newRange)
+    {
+        // Update the chunks in range: firstChunkNumber <= index <= lastChunkNumber
+        var firstChunkNumber = this._chunkNumberForLine(oldRange.startLine);
+        var lastChunkNumber = firstChunkNumber;
+        while (lastChunkNumber + 1 < this._textChunks.length) {
+            if (this._textChunks[lastChunkNumber + 1].startLine > oldRange.endLine)
+                break;
+            ++lastChunkNumber;
+        }
+
+        var startLine = this._textChunks[firstChunkNumber].startLine;
+        var linesCount = this._textChunks[lastChunkNumber].startLine + this._textChunks[lastChunkNumber].linesCount - startLine;
+        var linesDiff = newRange.linesCount - oldRange.linesCount;
+        linesCount += linesDiff;
+
+        if (linesDiff) {
+            // Lines shifted, update the line numbers of the chunks below.
+            for (var chunkNumber = lastChunkNumber + 1; chunkNumber < this._textChunks.length; ++chunkNumber)
+                this._textChunks[chunkNumber].startLine += linesDiff;
+        }
+
+        var firstLineRow;
+        if (firstChunkNumber) {
+            var chunk = this._textChunks[firstChunkNumber - 1];
+            firstLineRow = chunk.expanded ? chunk.getExpandedLineRow(chunk.startLine + chunk.linesCount - 1) : chunk.element;
+            firstLineRow = firstLineRow.nextSibling;
+        } else
+            firstLineRow = this._container.firstChild;
+
+        // Most frequent case: a chunk remained the same.
+        for (var chunkNumber = firstChunkNumber; chunkNumber <= lastChunkNumber; ++chunkNumber) {
+            var chunk = this._textChunks[chunkNumber];
+            if (chunk.startLine + chunk.linesCount > this._textModel.linesCount)
+                break;
+            var lineNumber = chunk.startLine;
+            for (var lineRow = firstLineRow; lineRow && lineNumber < chunk.startLine + chunk.linesCount; lineRow = lineRow.nextSibling) {
+                if (lineRow.lineNumber !== lineNumber || lineRow !== chunk.getExpandedLineRow(lineNumber) || lineRow.textContent !== this._textModel.line(lineNumber) || !lineRow.firstChild)
+                    break;
+                ++lineNumber;
+            }
+            if (lineNumber < chunk.startLine + chunk.linesCount)
+                break;
+            chunk.updateCollapsedLineRow();
+            ++firstChunkNumber;
+            firstLineRow = lineRow;
+            startLine += chunk.linesCount;
+            linesCount -= chunk.linesCount;
+        }
+
+        if (firstChunkNumber > lastChunkNumber && linesCount === 0)
+            return;
+
+        // Maybe merge with the next chunk, so that we should not create 1-sized chunks when appending new lines one by one.
+        var chunk = this._textChunks[lastChunkNumber + 1];
+        var linesInLastChunk = linesCount % this._defaultChunkSize;
+        if (chunk && !chunk.decorated && linesInLastChunk > 0 && linesInLastChunk + chunk.linesCount <= this._defaultChunkSize) {
+            ++lastChunkNumber;
+            linesCount += chunk.linesCount;
+        }
+
+        var scrollTop = this.element.scrollTop;
+        var scrollLeft = this.element.scrollLeft;
+
+        // Delete all DOM elements that were either controlled by the old chunks, or have just been inserted.
+        var firstUnmodifiedLineRow = null;
+        chunk = this._textChunks[lastChunkNumber + 1];
+        if (chunk)
+            firstUnmodifiedLineRow = chunk.expanded ? chunk.getExpandedLineRow(chunk.startLine) : chunk.element;
+
+        while (firstLineRow && firstLineRow !== firstUnmodifiedLineRow) {
+            var lineRow = firstLineRow;
+            firstLineRow = firstLineRow.nextSibling;
+            this._container.removeChild(lineRow);
+        }
+
+        // Replace old chunks with the new ones.
+        for (var chunkNumber = firstChunkNumber; linesCount > 0; ++chunkNumber) {
+            var chunkLinesCount = Math.min(this._defaultChunkSize, linesCount);
+            var newChunk = this._createNewChunk(startLine, startLine + chunkLinesCount);
+            this._container.insertBefore(newChunk.element, firstUnmodifiedLineRow);
+
+            if (chunkNumber <= lastChunkNumber)
+                this._textChunks[chunkNumber] = newChunk;
+            else
+                this._textChunks.splice(chunkNumber, 0, newChunk);
+            startLine += chunkLinesCount;
+            linesCount -= chunkLinesCount;
+        }
+        if (chunkNumber <= lastChunkNumber)
+            this._textChunks.splice(chunkNumber, lastChunkNumber - chunkNumber + 1);
+
+        this.element.scrollTop = scrollTop;
+        this.element.scrollLeft = scrollLeft;
+    },
+
+    /**
+     * @param {WebInspector.TextRange} range
+     */
+    _updateHighlightsForRange: function(range)
+    {
+        var visibleFrom = this.element.scrollTop;
+        var visibleTo = this.element.scrollTop + this.element.clientHeight;
+
+        var result = this._findVisibleChunks(visibleFrom, visibleTo);
+        var chunk = this._textChunks[result.end - 1];
+        var lastVisibleLine = chunk.startLine + chunk.linesCount;
+
+        lastVisibleLine = Math.max(lastVisibleLine, range.endLine + 1);
+        lastVisibleLine = Math.min(lastVisibleLine, this._textModel.linesCount);
+
+        var updated = this._highlighter.updateHighlight(range.startLine, lastVisibleLine);
+        if (!updated) {
+            // Highlights for the chunks below are invalid, so just collapse them.
+            for (var i = this._chunkNumberForLine(range.startLine); i < this._textChunks.length; ++i)
+                this._textChunks[i].expanded = false;
+        }
+
+        this._repaintAll();
+    },
+
+    /**
+     * @param {Array.<string>} lines
+     * @param {Element} element
+     */
+    _collectLinesFromDiv: function(lines, element)
+    {
+        var textContents = [];
+        var node = element.nodeType === Node.TEXT_NODE ? element : element.traverseNextNode(element);
+        while (node) {
+            if (element.decorationsElement === node) {
+                node = node.nextSibling;
+                continue;
+            }
+            if (node.nodeName.toLowerCase() === "br")
+                textContents.push("\n");
+            else if (node.nodeType === Node.TEXT_NODE)
+                textContents.push(node.textContent);
+            node = node.traverseNextNode(element);
+        }
+
+        var textContent = textContents.join("");
+        // The last \n (if any) does not "count" in a DIV.
+        textContent = textContent.replace(/\n$/, "");
+
+        textContents = textContent.split("\n");
+        for (var i = 0; i < textContents.length; ++i)
+            lines.push(textContents[i]);
+    }
+}
+
+WebInspector.TextEditorMainPanel.prototype.__proto__ = WebInspector.TextEditorChunkedPanel.prototype;
+
+/**
+ * @constructor
+ * @param {WebInspector.TextEditorChunkedPanel} chunkedPanel
+ * @param {number} startLine
+ * @param {number} endLine
+*/
+WebInspector.TextEditorMainChunk = function(chunkedPanel, startLine, endLine)
+{
+    this._chunkedPanel = chunkedPanel;
+    this._textModel = chunkedPanel._textModel;
+
+    this.element = document.createElement("div");
+    this.element.lineNumber = startLine;
+    this.element.className = "webkit-line-content";
+    this._chunkedPanel._enableDOMNodeRemovedListener(this.element, true);
+
+    this._startLine = startLine;
+    endLine = Math.min(this._textModel.linesCount, endLine);
+    this.linesCount = endLine - startLine;
+
+    this._expanded = false;
+    this._readOnly = false;
+
+    this.updateCollapsedLineRow();
+}
+
+WebInspector.TextEditorMainChunk.prototype = {
+    addDecoration: function(decoration)
+    {
+        this._chunkedPanel.beginDomUpdates();
+        if (typeof decoration === "string")
+            this.element.addStyleClass(decoration);
+        else {
+            if (!this.element.decorationsElement) {
+                this.element.decorationsElement = document.createElement("div");
+                this.element.decorationsElement.className = "webkit-line-decorations";
+                this.element.appendChild(this.element.decorationsElement);
+            }
+            this.element.decorationsElement.appendChild(decoration);
+        }
+        this._chunkedPanel.endDomUpdates();
+    },
+
+    /**
+     * @param {string|Element} decoration
+     */
+    removeDecoration: function(decoration)
+    {
+        this._chunkedPanel.beginDomUpdates();
+        if (typeof decoration === "string")
+            this.element.removeStyleClass(decoration);
+        else if (this.element.decorationsElement)
+            this.element.decorationsElement.removeChild(decoration);
+        this._chunkedPanel.endDomUpdates();
+    },
+
+    removeAllDecorations: function()
+    {
+        this._chunkedPanel.beginDomUpdates();
+        this.element.className = "webkit-line-content";
+        if (this.element.decorationsElement) {
+            this.element.removeChild(this.element.decorationsElement);
+            delete this.element.decorationsElement;
+        }
+        this._chunkedPanel.endDomUpdates();
+    },
+
+    /**
+     * @return {boolean}
+     */
+    get decorated()
+    {
+        return this.element.className !== "webkit-line-content" || !!(this.element.decorationsElement && this.element.decorationsElement.firstChild);
+    },
+
+    /**
+     * @return {number}
+     */
+    get startLine()
+    {
+        return this._startLine;
+    },
+
+    set startLine(startLine)
+    {
+        this._startLine = startLine;
+        this.element.lineNumber = startLine;
+        if (this._expandedLineRows) {
+            for (var i = 0; i < this._expandedLineRows.length; ++i)
+                this._expandedLineRows[i].lineNumber = startLine + i;
+        }
+    },
+
+    /**
+     * @return {boolean}
+     */
+    get expanded()
+    {
+        return this._expanded;
+    },
+
+    set expanded(expanded)
+    {
+        if (this._expanded === expanded)
+            return;
+
+        this._expanded = expanded;
+
+        if (this.linesCount === 1) {
+            if (expanded)
+                this._chunkedPanel._paintLine(this.element);
+            return;
+        }
+
+        this._chunkedPanel.beginDomUpdates();
+
+        if (expanded) {
+            this._expandedLineRows = [];
+            var parentElement = this.element.parentElement;
+            for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
+                var lineRow = this._createRow(i);
+                this._chunkedPanel._enableDOMNodeRemovedListener(lineRow, true);
+                this._updateElementReadOnlyState(lineRow);
+                parentElement.insertBefore(lineRow, this.element);
+                this._expandedLineRows.push(lineRow);
+            }
+            this._chunkedPanel._enableDOMNodeRemovedListener(this.element, false);
+            parentElement.removeChild(this.element);
+            this._chunkedPanel._paintLines(this.startLine, this.startLine + this.linesCount);
+        } else {
+            var elementInserted = false;
+            for (var i = 0; i < this._expandedLineRows.length; ++i) {
+                var lineRow = this._expandedLineRows[i];
+                this._chunkedPanel._enableDOMNodeRemovedListener(lineRow, false);
+                var parentElement = lineRow.parentElement;
+                if (parentElement) {
+                    if (!elementInserted) {
+                        elementInserted = true;
+                        this._chunkedPanel._enableDOMNodeRemovedListener(this.element, true);
+                        parentElement.insertBefore(this.element, lineRow);
+                    }
+                    parentElement.removeChild(lineRow);
+                }
+                this._chunkedPanel._releaseLinesHighlight(lineRow);
+            }
+            delete this._expandedLineRows;
+        }
+
+        this._chunkedPanel.endDomUpdates();
+    },
+
+    set readOnly(readOnly)
+    {
+        if (this._readOnly === readOnly)
+            return;
+
+        this._readOnly = readOnly;
+        this._updateElementReadOnlyState(this.element);
+        if (this._expandedLineRows) {
+            for (var i = 0; i < this._expandedLineRows.length; ++i)
+                this._updateElementReadOnlyState(this._expandedLineRows[i]);
+        }
+    },
+
+    /**
+     * @return {boolean}
+     */
+    get readOnly()
+    {
+        return this._readOnly;
+    },
+
+    _updateElementReadOnlyState: function(element)
+    {
+        if (this._readOnly)
+            element.addStyleClass("text-editor-read-only");
+        else
+            element.removeStyleClass("text-editor-read-only");
+    },
+
+    /**
+     * @return {number}
+     */
+    get height()
+    {
+        if (!this._expandedLineRows)
+            return this._chunkedPanel._totalHeight(this.element);
+        return this._chunkedPanel._totalHeight(this._expandedLineRows[0], this._expandedLineRows[this._expandedLineRows.length - 1]);
+    },
+
+    /**
+     * @return {number}
+     */
+    get offsetTop()
+    {
+        return (this._expandedLineRows && this._expandedLineRows.length) ? this._expandedLineRows[0].offsetTop : this.element.offsetTop;
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @return {Element}
+     */
+    _createRow: function(lineNumber)
+    {
+        var lineRow = this._chunkedPanel._cachedRows.pop() || document.createElement("div");
+        lineRow.lineNumber = lineNumber;
+        lineRow.className = "webkit-line-content";
+        lineRow.textContent = this._textModel.line(lineNumber);
+        if (!lineRow.textContent)
+            lineRow.appendChild(document.createElement("br"));
+        return lineRow;
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @return {Element}
+     */
+    getExpandedLineRow: function(lineNumber)
+    {
+        if (!this._expanded || lineNumber < this.startLine || lineNumber >= this.startLine + this.linesCount)
+            return null;
+        if (!this._expandedLineRows)
+            return this.element;
+        return this._expandedLineRows[lineNumber - this.startLine];
+    },
+
+    updateCollapsedLineRow: function()
+    {
+        if (this.linesCount === 1 && this._expanded)
+            return;
+
+        var lines = [];
+        for (var i = this.startLine; i < this.startLine + this.linesCount; ++i)
+            lines.push(this._textModel.line(i));
+
+        this.element.removeChildren();
+        this.element.textContent = lines.join("\n");
+
+        // The last empty line will get swallowed otherwise.
+        if (!lines[lines.length - 1])
+            this.element.appendChild(document.createElement("br"));
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index 46c0e3354..341303103 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -2037,9 +2037,13 @@ WebInspector.ElementsTreeUpdater.prototype = {
         }
 
         var updatedParentTreeElements = [];
-        var treeOutlineContainerElement = this._treeOutline.element.parentNode;
-        var originalScrollTop = treeOutlineContainerElement ? treeOutlineContainerElement.scrollTop : 0;
-        this._treeOutline.element.addStyleClass("hidden");
+
+        var hidePanelWhileUpdating = this._recentlyModifiedNodes.length > 10;
+        if (hidePanelWhileUpdating) {
+            var treeOutlineContainerElement = this._treeOutline.element.parentNode;
+            this._treeOutline.element.addStyleClass("hidden");
+            var originalScrollTop = treeOutlineContainerElement ? treeOutlineContainerElement.scrollTop : 0;
+        }
 
         for (var i = 0; i < this._recentlyModifiedNodes.length; ++i) {
             var parent = this._recentlyModifiedNodes[i].parent;
@@ -2074,9 +2078,12 @@ WebInspector.ElementsTreeUpdater.prototype = {
         for (var i = 0; i < updatedParentTreeElements.length; ++i)
             delete updatedParentTreeElements[i].alreadyUpdatedChildren;
 
-        this._treeOutline.element.removeStyleClass("hidden");
-        if (originalScrollTop)
-            treeOutlineContainerElement.scrollTop = originalScrollTop;
+        if (hidePanelWhileUpdating) {
+            this._treeOutline.element.removeStyleClass("hidden");
+            if (originalScrollTop)
+                treeOutlineContainerElement.scrollTop = originalScrollTop;
+            this._treeOutline.updateSelection();
+        }
         this._recentlyModifiedNodes = [];
     },
 
diff --git a/Source/WebCore/inspector/front-end/EmptyView.js b/Source/WebCore/inspector/front-end/EmptyView.js
index 1d44c8ac4..4b7ceee5e 100644
--- a/Source/WebCore/inspector/front-end/EmptyView.js
+++ b/Source/WebCore/inspector/front-end/EmptyView.js
@@ -48,7 +48,7 @@ WebInspector.EmptyView.prototype = {
     set text(text)
     {
         this._text = text;
-        if (this.visible)
+        if (this.isShowing())
             this.element.textContent = this._text;
     },
 }
diff --git a/Source/WebCore/inspector/front-end/FileUtils.js b/Source/WebCore/inspector/front-end/FileUtils.js
new file mode 100644
index 000000000..07fe25f5c
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/FileUtils.js
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @interface
+ */
+WebInspector.OutputStreamDelegate = function()
+{
+}
+
+WebInspector.OutputStreamDelegate.prototype = {
+    onTransferStarted: function(source)
+    {
+    },
+
+    onChunkTransferred: function(source)
+    {
+    },
+
+    onTransferFinished: function(source)
+    {
+    },
+
+    onError: function(source, event)
+    {
+    }
+}
+
+/**
+ * @constructor
+ * @param {!File} file
+ * @param {!number} chunkSize
+ * @param {!WebInspector.OutputStreamDelegate} delegate
+ */
+WebInspector.ChunkedFileReader = function(file, chunkSize, delegate)
+{
+    this._file = file;
+    this._fileSize = file.size;
+    this._loadedSize = 0;
+    this._chunkSize = chunkSize;
+    this._delegate = delegate;
+}
+
+WebInspector.ChunkedFileReader.prototype = {
+    /**
+     * @param {!WebInspector.OutputStream} output
+     */
+    start: function(output)
+    {
+        this._output = output;
+
+        this._reader = new FileReader();
+        this._reader.onload = this._onChunkLoaded.bind(this);
+        this._reader.onerror = this._delegate.onError.bind(this._delegate, this);
+        this._output.startTransfer();
+        this._delegate.onTransferStarted(this);
+        this._loadChunk();
+    },
+
+    loadedSize: function()
+    {
+        return this._loadedSize;
+    },
+
+    fileSize: function()
+    {
+        return this._fileSize;
+    },
+
+    fileName: function()
+    {
+        return this._file.name;
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _onChunkLoaded: function(event)
+    {
+        if (event.target.readyState !== FileReader.DONE)
+            return;
+
+        var data = event.target.result;
+        this._loadedSize += data.length;
+
+        this._output.transferChunk(data);
+        this._delegate.onChunkTransferred(this);
+
+        if (this._loadedSize === this._fileSize) {
+            this._file = null;
+            this._reader = null;
+            this._output.finishTransfer();
+            this._delegate.onTransferFinished(this);
+            return;
+        }
+
+        this._loadChunk();
+    },
+
+    _loadChunk: function()
+    {
+        var chunkStart = this._loadedSize;
+        var chunkEnd = Math.min(this._fileSize, chunkStart + this._chunkSize)
+        var nextPart = this._file.webkitSlice(chunkStart, chunkEnd);
+        this._reader.readAsText(nextPart);
+    }
+}
+
+/**
+ * @param {!function(File)} callback
+ * @return {Node}
+ */
+WebInspector.createFileSelectorElement = function(callback) {
+    var fileSelectorElement = document.createElement("input");
+    fileSelectorElement.type = "file";
+    fileSelectorElement.style.zIndex = -1;
+    fileSelectorElement.style.position = "absolute";
+    fileSelectorElement.onchange = function(event) {
+        callback(fileSelectorElement.files[0]);
+    };
+    return fileSelectorElement;
+}
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js b/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js
index 084ef9635..fc8e45a8d 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js
@@ -30,7 +30,7 @@
 
 /**
  * @constructor
- * @implements {WebInspector.HeapSnapshotReceiver}
+ * @implements {WebInspector.OutputStream}
  */
 WebInspector.HeapSnapshotLoader = function()
 {
@@ -38,13 +38,8 @@ WebInspector.HeapSnapshotLoader = function()
 }
 
 WebInspector.HeapSnapshotLoader.prototype = {
-    /**
-     * @param {function(WebInspector.HeapSnapshotProxy)} callback
-     * @return {boolean}
-     */
-    startLoading: function(callback)
+    startTransfer: function()
     {
-        return true;
     },
 
     dispose: function()
@@ -75,11 +70,14 @@ WebInspector.HeapSnapshotLoader.prototype = {
         return -1;
     },
 
-    finishLoading: function()
+    finishTransfer: function()
+    {
+        if (this._json)
+            this._parseStringsArray();
+    },
+
+    buildSnapshot: function()
     {
-        if (!this._json)
-            return null;
-        this._parseStringsArray();
         var result = new WebInspector.HeapSnapshot(this._snapshot);
         this._reset();
         return result;
@@ -135,7 +133,7 @@ WebInspector.HeapSnapshotLoader.prototype = {
     /**
      * @param {string} chunk
      */
-    pushJSONChunk: function(chunk)
+    transferChunk: function(chunk)
     {
         this._json += chunk;
         switch (this._state) {
@@ -146,7 +144,7 @@ WebInspector.HeapSnapshotLoader.prototype = {
                 throw new Error("Snapshot token not found");
             this._json = this._json.slice(snapshotTokenIndex + snapshotToken.length + 1);
             this._state = "parse-snapshot-info";
-            this.pushJSONChunk("");
+            this.transferChunk("");
             break;
         }
         case "parse-snapshot-info": {
@@ -156,7 +154,7 @@ WebInspector.HeapSnapshotLoader.prototype = {
             this._snapshot.snapshot = /** @type {HeapSnapshotHeader} */JSON.parse(this._json.slice(0, closingBracketIndex));
             this._json = this._json.slice(closingBracketIndex);
             this._state = "find-nodes";
-            this.pushJSONChunk("");
+            this.transferChunk("");
             break;
         }
         case "find-nodes": {
@@ -173,7 +171,7 @@ WebInspector.HeapSnapshotLoader.prototype = {
             this._array = new Uint32Array(nodes_length);
             this._arrayIndex = 0;
             this._state = "parse-nodes";
-            this.pushJSONChunk("");
+            this.transferChunk("");
             break;
         }
         case "parse-nodes": {
@@ -182,7 +180,7 @@ WebInspector.HeapSnapshotLoader.prototype = {
             this._snapshot.nodes = this._array;
             this._state = "find-edges";
             this._array = null;
-            this.pushJSONChunk("");
+            this.transferChunk("");
             break;
         }
         case "find-edges": {
@@ -199,7 +197,7 @@ WebInspector.HeapSnapshotLoader.prototype = {
             this._array = new Uint32Array(edges_length);
             this._arrayIndex = 0;
             this._state = "parse-edges";
-            this.pushJSONChunk("");
+            this.transferChunk("");
             break;
         }
         case "parse-edges": {
@@ -208,7 +206,7 @@ WebInspector.HeapSnapshotLoader.prototype = {
             this._snapshot.edges = this._array;
             this._array = null;
             this._state = "find-strings";
-            this.pushJSONChunk("");
+            this.transferChunk("");
             break;
         }
         case "find-strings": {
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js b/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
index 1277da56b..a63caa735 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
@@ -355,53 +355,63 @@ WebInspector.HeapSnapshotProxyObject.prototype = {
 /**
  * @constructor
  * @extends {WebInspector.HeapSnapshotProxyObject}
- * @implements {WebInspector.HeapSnapshotReceiver}
+ * @implements {WebInspector.OutputStream}
  */
 WebInspector.HeapSnapshotLoaderProxy = function(worker, objectId)
 {
     WebInspector.HeapSnapshotProxyObject.call(this, worker, objectId);
-    this._onLoadCallbacks = [];
+    this._started = false;
+    this._pendingSnapshotConsumers = [];
 }
 
 WebInspector.HeapSnapshotLoaderProxy.prototype = {
+    startTransfer: function()
+    {
+        this._started = true;
+        this.callMethod(null, "startTransfer");
+    },
+
+    isStarted: function()
+    {
+        return this._started;
+    },
+
     /**
      * @param {function(WebInspector.HeapSnapshotProxy)} callback
-     * @return {boolean}
      */
-    startLoading: function(callback)
+    addConsumer: function(callback)
     {
-        var loadingHasJustStarted = !this._onLoadCallbacks.length;
-        this._onLoadCallbacks.push(callback);
-        return loadingHasJustStarted;
+        this._pendingSnapshotConsumers.push(callback);
     },
 
     /**
      * @param {string} chunk
      */
-    pushJSONChunk: function(chunk)
+    transferChunk: function(chunk)
     {
-        this.callMethod(null, "pushJSONChunk", chunk);
+        this.callMethod(null, "transferChunk", chunk);
     },
 
-    /**
-     * @param {function(WebInspector.HeapSnapshotProxy)} callback
-     */
-    finishLoading: function(callback)
+    finishTransfer: function()
     {
-        this._onLoadCallbacks.unshift(callback);
-
+        function buildSnapshot()
+        {
+            this.callFactoryMethod(updateStaticData.bind(this), "buildSnapshot", "WebInspector.HeapSnapshotProxy");
+        }
         function updateStaticData(snapshotProxy)
         {
             this.dispose();
-            snapshotProxy.updateStaticData(callLoadCallbacks.bind(this));
+            snapshotProxy.updateStaticData(notifyPendingConsumers.bind(this));
         }
-        function callLoadCallbacks(snapshotProxy)
+        function notifyPendingConsumers(snapshotProxy)
         {
-            for (var i = 0; i < this._onLoadCallbacks.length; ++i)
-                this._onLoadCallbacks[i](snapshotProxy);
-            this._onLoadCallbacks = null;
+            for (var i = 0; i < this._pendingSnapshotConsumers.length; ++i)
+                this._pendingSnapshotConsumers[i](snapshotProxy);
+
+            this._started = false;
+            this._pendingSnapshotConsumers = [];
         }
-        this.callFactoryMethod(updateStaticData.bind(this), "finishLoading", "WebInspector.HeapSnapshotProxy");
+        this.callMethod(buildSnapshot.bind(this), "finishTransfer");
     }
 };
 
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotView.js b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
index a1183b7e7..5c4df23f2 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotView.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
@@ -787,30 +787,23 @@ WebInspector.HeapSnapshotProfileType.prototype.__proto__ = WebInspector.ProfileT
 /**
  * @interface
  */
-WebInspector.HeapSnapshotReceiver = function()
+WebInspector.OutputStream = function()
 {
 }
 
-WebInspector.HeapSnapshotReceiver.prototype = {
-    /**
-     * @param {function(WebInspector.HeapSnapshotProxy)} callback
-     * @return {boolean}
-     */
-    startLoading: function(callback)
+WebInspector.OutputStream.prototype = {
+    startTransfer: function()
     {
     },
 
     /**
      * @param {string} chunk
      */
-    pushJSONChunk: function(chunk)
+    transferChunk: function(chunk)
     {
     },
 
-    /**
-     * @param {function(WebInspector.HeapSnapshotProxy)} callback
-     */
-    finishLoading: function(callback)
+    finishTransfer: function()
     {
     },
 
@@ -832,7 +825,7 @@ WebInspector.HeapProfileHeader = function(type, title, uid, maxJSObjectId)
     WebInspector.ProfileHeader.call(this, type, title, uid);
     this.maxJSObjectId = maxJSObjectId;
     /**
-     * @type {WebInspector.HeapSnapshotReceiver}
+     * @type {WebInspector.OutputStream}
      */
     this._receiver = null;
     /**
@@ -877,13 +870,16 @@ WebInspector.HeapProfileHeader.prototype = {
 
         if (!this._receiver)
             this._setupWorker();
+        var loaderProxy = /** @type {WebInspector.HeapSnapshotLoaderProxy} */ this._receiver;
 
         this._numberOfChunks = 0;
-        if (this._receiver.startLoading(callback)) {
+        if (!loaderProxy.isStarted()) {
+            loaderProxy.startTransfer();
             this.sidebarElement.subtitle = WebInspector.UIString("Loading\u2026");
             this.sidebarElement.wait = true;
             ProfilerAgent.getProfile(this.profileType().id, this.uid);
         }
+        loaderProxy.addConsumer(callback);
     },
 
     _setupWorker: function()
@@ -893,7 +889,9 @@ WebInspector.HeapProfileHeader.prototype = {
         }
         var worker = new WebInspector.HeapSnapshotWorker();
         worker.addEventListener("wait", setProfileWait, this);
-        this._receiver = worker.createObject("WebInspector.HeapSnapshotLoader");
+        var loaderProxy = worker.createObject("WebInspector.HeapSnapshotLoader");
+        loaderProxy.addConsumer(this._snapshotReceived.bind(this));
+        this._receiver = loaderProxy;
     },
 
     dispose: function()
@@ -912,7 +910,6 @@ WebInspector.HeapProfileHeader.prototype = {
         if (savedChunksCount === this._totalNumberOfChunks) {
             this.sidebarElement.subtitle = Number.bytesToString(this._snapshotProxy.totalSize);
             this.sidebarElement.wait = false;
-            this._savedChunksCount = 0;
         } else
             this.sidebarElement.subtitle = WebInspector.UIString("Saving\u2026 %d\%", (savedChunksCount * 100 / this._totalNumberOfChunks).toFixed(2));
     },
@@ -920,13 +917,13 @@ WebInspector.HeapProfileHeader.prototype = {
     /**
      * @param {string} chunk
      */
-    pushJSONChunk: function(chunk)
+    transferChunk: function(chunk)
     {
         ++this._numberOfChunks;
-        this._receiver.pushJSONChunk(chunk);
+        this._receiver.transferChunk(chunk);
     },
 
-    _parsed: function(snapshotProxy)
+    _snapshotReceived: function(snapshotProxy)
     {
         this._receiver = null;
         if (snapshotProxy)
@@ -938,11 +935,12 @@ WebInspector.HeapProfileHeader.prototype = {
         worker.startCheckingForLongRunningCalls();
     },
 
-    finishHeapSnapshot: function()
+    finishHeapSnapshot: function(transferFinished)
     {
         this._totalNumberOfChunks = this._numberOfChunks;
-        if (this._receiver.finishLoading(this._parsed.bind(this)))
-            this.sidebarElement.subtitle = WebInspector.UIString("Parsing\u2026");
+        this.sidebarElement.subtitle = WebInspector.UIString("Parsing\u2026");
+        if (!transferFinished)
+            this._receiver.finishTransfer();
     },
 
     /**
@@ -951,7 +949,7 @@ WebInspector.HeapProfileHeader.prototype = {
      */
     canSaveToFile: function()
     {
-        return !this.fromFile() && this._snapshotProxy && !this._savedChunksCount && WebInspector.fileManager.canAppend();
+        return !this.fromFile() && this._snapshotProxy && !this._receiver && WebInspector.fileManager.canAppend();
     },
 
     /**
@@ -960,9 +958,20 @@ WebInspector.HeapProfileHeader.prototype = {
     saveToFile: function()
     {
         this._fileName = this._fileName || "Heap-" + new Date().toISO8601Compact() + ".heapsnapshot";
-        this._receiver = new WebInspector.HeapSnapshotSaveToFileReceiver(this._fileName, this);
+        var delegate = new WebInspector.HeapSnapshotSaveToFileDelegate(this);
+        this._receiver = this._createFileWriter(this._fileName, delegate);
         this._numberOfChunks = 0;
-        this._receiver.startLoading(function(snapshot) { });
+        this._receiver.startTransfer();
+    },
+
+    /**
+     * @param {!string} fileName
+     * @param {!WebInspector.OutputStreamDelegate} delegate
+     * @return {WebInspector.OutputStream}
+     */
+    _createFileWriter: function(fileName, delegate)
+    {
+        return new WebInspector.ChunkedFileWriter(fileName, delegate);
     },
 
     /**
@@ -979,123 +988,105 @@ WebInspector.HeapProfileHeader.prototype = {
      */
     loadFromFile: function(file)
     {
-        function onError(e)
-        {
-            switch(e.target.error.code) {
-            case e.target.error.NOT_FOUND_ERR:
-                this.sidebarElement.subtitle = WebInspector.UIString("'%s' not found.", file.name);
-            break;
-            case e.target.error.NOT_READABLE_ERR:
-                this.sidebarElement.subtitle = WebInspector.UIString("'%s' is not readable", file.name);
-            break;
-            case e.target.error.ABORT_ERR:
-                break;
-            default:
-                this.sidebarElement.subtitle = WebInspector.UIString("'%s' error %d", file.name, e.target.error.code);
-            }
-        }
-
         this.title = file.name;
         this.sidebarElement.subtitle = WebInspector.UIString("Loading\u2026");
         this.sidebarElement.wait = true;
         this._setupWorker();
         this._numberOfChunks = 0;
-        this._receiver.startLoading(function(ignoredSnapshotProxy) { });
 
-        /**
-         * @param {Event} event
-         */
-        function onLoad(event)
-        {
-            if (event.target.readyState !== FileReader.DONE)
-                return;
-            this._nextChunkLoaded(event.target.result);
-        }
-
-        this._file = file;
-        this._expectedSize = file.size;
-        this._loadedSize = 0;
-        this._reader = this._createFileReader();
-        this._reader.onload = onLoad.bind(this);
-        this._reader.onerror = onError;
-        this._loadNextChunk();
+        var delegate = new WebInspector.HeapSnapshotLoadFromFileDelegate(this);
+        var fileReader = this._createFileReader(file, delegate);
+        fileReader.start(this._receiver);
     },
 
-    _loadNextChunk: function()
+    _createFileReader: function(file, delegate)
+    {
+        return new WebInspector.ChunkedFileReader(file, 10000000, delegate);
+    }
+}
+
+WebInspector.HeapProfileHeader.prototype.__proto__ = WebInspector.ProfileHeader.prototype;
+
+/**
+ * @constructor
+ * @implements {WebInspector.OutputStreamDelegate}
+ */
+WebInspector.HeapSnapshotLoadFromFileDelegate = function(snapshotHeader)
+{
+    this._snapshotHeader = snapshotHeader;
+}
+
+WebInspector.HeapSnapshotLoadFromFileDelegate.prototype = {
+    onTransferStarted: function(source)
     {
-        var loadedSize = this._loadedSize;
-        var chunkSize = 10000000;
-        var size = this._expectedSize < loadedSize + chunkSize ? this._expectedSize - loadedSize : chunkSize;
-        var nextPart = this._file.webkitSlice(loadedSize, loadedSize + size);
-        this._reader.readAsText(nextPart);
     },
 
-    _nextChunkLoaded: function(data)
+    onChunkTransferred: function(source)
     {
-        this._loadedSize += data.length;
-        this._receiver.pushJSONChunk(data);
-        this.sidebarElement.subtitle = WebInspector.UIString("Loading\u2026 %d%", (this._loadedSize * 100 / this._expectedSize).toFixed(2));
+        this._snapshotHeader.sidebarElement.subtitle = WebInspector.UIString(
+            "Loading\u2026 %d%", (source.loadedSize() * 100 / source.fileSize()).toFixed(2));
+    },
 
-        if (this._loadedSize === this._expectedSize) {
-            this._file = null;
-            this._reader = null;
-            this.finishHeapSnapshot();
-            return;
-        }
-        this._loadNextChunk();
+    onTransferFinished: function(source)
+    {
+        this._snapshotHeader.finishHeapSnapshot(true);
     },
 
-    _createFileReader: function()
+    onError: function (source, e)
     {
-        return new FileReader();
+        switch(e.target.error.code) {
+        case e.target.error.NOT_FOUND_ERR:
+            this._snapshotHeader.sidebarElement.subtitle = WebInspector.UIString("'%s' not found.", source.fileName());
+        break;
+        case e.target.error.NOT_READABLE_ERR:
+            this._snapshotHeader.sidebarElement.subtitle = WebInspector.UIString("'%s' is not readable", source.fileName());
+        break;
+        case e.target.error.ABORT_ERR:
+            break;
+        default:
+            this._snapshotHeader.sidebarElement.subtitle = WebInspector.UIString("'%s' error %d", source.fileName(), e.target.error.code);
+        }
     }
 }
 
-WebInspector.HeapProfileHeader.prototype.__proto__ = WebInspector.ProfileHeader.prototype;
-
-
 /**
  * @constructor
- * @implements {WebInspector.HeapSnapshotReceiver}
+ * @implements {WebInspector.OutputStream}
+ * @param {!string} fileName
+ * @param {!WebInspector.OutputStreamDelegate} delegate
  */
-WebInspector.HeapSnapshotSaveToFileReceiver = function(fileName, snapshotHeader)
+WebInspector.ChunkedFileWriter = function(fileName, delegate)
 {
     this._fileName = fileName;
-    this._snapshotHeader = snapshotHeader;
-    this._savedChunks = 0;
-    this._finishLoadingCallbacks = [];
+    this._delegate = delegate;
 }
 
-WebInspector.HeapSnapshotSaveToFileReceiver.prototype = {
+WebInspector.ChunkedFileWriter.prototype = {
     /**
-     * @param {function(WebInspector.HeapSnapshotProxy)} callback
-     * @return {boolean}
+     * @override
      */
-    startLoading: function(callback)
+    startTransfer: function()
     {
-        WebInspector.fileManager.addEventListener(WebInspector.FileManager.EventTypes.SavedURL, this._startSavingSnapshot, this);
+        WebInspector.fileManager.addEventListener(WebInspector.FileManager.EventTypes.SavedURL, this._onTransferStarted, this);
         WebInspector.fileManager.save(this._fileName, "", true);
-        if (callback)
-            this._finishLoadingCallbacks.push(callback);
-        return true;
     },
 
     /**
+     * @override
      * @param {string} chunk
      */
-    pushJSONChunk: function(chunk)
+    transferChunk: function(chunk)
     {
         WebInspector.fileManager.append(this._fileName, chunk);
     },
 
     /**
-     * @param {function(WebInspector.HeapSnapshotProxy)} callback
+     * @override
      */
-    finishLoading: function(callback)
+    finishTransfer: function()
     {
-        this._finishLoadingCallbacks.push(callback);
-        for (var i = 0; i < this._finishLoadingCallbacks.length; ++i)
-            this._finishLoadingCallbacks[i](null);
+        WebInspector.fileManager.removeEventListener(WebInspector.FileManager.EventTypes.AppendedToURL, this._onChunkTransferred, this);
+        this._delegate.onTransferFinished(this);
     },
 
     dispose: function()
@@ -1105,26 +1096,54 @@ WebInspector.HeapSnapshotSaveToFileReceiver.prototype = {
     /**
      * @param {WebInspector.Event} event
      */
-    _startSavingSnapshot: function(event)
+    _onTransferStarted: function(event)
     {
         if (event.data !== this._fileName)
             return;
-        this._snapshotHeader._saveStatusUpdate(0);
-        WebInspector.fileManager.removeEventListener(WebInspector.FileManager.EventTypes.SavedURL, this._startSavingSnapshot, this);
-        WebInspector.fileManager.addEventListener(WebInspector.FileManager.EventTypes.AppendedToURL, this._saveStatusUpdate, this);
-        ProfilerAgent.getProfile(this._snapshotHeader.profileType().id, this._snapshotHeader.uid);
+        this._delegate.onTransferStarted(this);
+        WebInspector.fileManager.removeEventListener(WebInspector.FileManager.EventTypes.SavedURL, this._onTransferStarted, this);
+        WebInspector.fileManager.addEventListener(WebInspector.FileManager.EventTypes.AppendedToURL, this._onChunkTransferred, this);
     },
 
     /**
      * @param {WebInspector.Event} event
      */
-    _saveStatusUpdate: function(event)
+    _onChunkTransferred: function(event)
     {
         if (event.data !== this._fileName)
             return;
-        this._snapshotHeader._saveStatusUpdate(++this._savedChunks);
-        if (this._savedChunks === this._snapshotHeader._totalNumberOfChunks)
-            WebInspector.fileManager.removeEventListener(WebInspector.FileManager.EventTypes.AppendedToURL, this._saveStatusUpdate, this);
+        this._delegate.onChunkTransferred(this);
     }
-};
+}
 
+/**
+ * @constructor
+ * @implements {WebInspector.OutputStreamDelegate}
+ */
+WebInspector.HeapSnapshotSaveToFileDelegate = function(snapshotHeader)
+{
+    this._snapshotHeader = snapshotHeader;
+    this._savedChunks = 0;
+}
+
+WebInspector.HeapSnapshotSaveToFileDelegate.prototype = {
+    onTransferStarted: function(source)
+    {
+        this._snapshotHeader._saveStatusUpdate(0);
+        ProfilerAgent.getProfile(this._snapshotHeader.profileType().id, this._snapshotHeader.uid);
+    },
+
+    onChunkTransferred: function(source)
+    {
+        this._snapshotHeader._saveStatusUpdate(++this._savedChunks);
+    },
+
+    onTransferFinished: function(source)
+    {
+        this._snapshotHeader._snapshotReceived(null);
+    },
+
+    onError: function(source, event)
+    {
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
index a6f98b212..0b4eaa621 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
@@ -184,6 +184,11 @@ WebInspector.InspectorFrontendHostStub.prototype = {
 
     setZoomFactor: function(zoom)
     {
+    },
+
+    canInspectWorkers: function()
+    {
+        return true;
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/InspectorView.js b/Source/WebCore/inspector/front-end/InspectorView.js
index efa01d49e..c6601c7f1 100644
--- a/Source/WebCore/inspector/front-end/InspectorView.js
+++ b/Source/WebCore/inspector/front-end/InspectorView.js
@@ -44,13 +44,9 @@ WebInspector.InspectorView = function()
     document.addEventListener("keypress", this._keyPress.bind(this), false);
     this._panelOrder = [];
 
-    // Windows and Mac have two different definitions of '[', so accept both.
+    // Windows and Mac have two different definitions of '[' and ']', so accept both of each.
     this._openBracketIdentifiers = ["U+005B", "U+00DB"].keySet();
-    this._openBracketCharCode = "[".charCodeAt(0);
-
-    // Windows and Mac have two different definitions of ']', so accept both.
     this._closeBracketIdentifiers = ["U+005D", "U+00DD"].keySet();
-    this._closeBracketCharCode = "]".charCodeAt(0);
     this._footerElementContainer = this.element.createChild("div", "inspector-footer status-bar hidden");
     this._panelsElement = this.element.createChild("div", "fill");
 }
@@ -98,13 +94,8 @@ WebInspector.InspectorView.prototype = {
 
     _keyPress: function(event)
     {
-        if (!this._keyDownTimer)
-            return;
-
-        if (event.charCode === this._openBracketCharCode || event.charCode === this._closeBracketCharCode) {
-            clearTimeout(this._keyDownTimer);
-            delete this._keyDownTimer;
-        }
+        clearTimeout(this._keyDownTimer);
+        delete this._keyDownTimer;
     },
 
     _keyDown: function(event)
diff --git a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
index 54fa1a096..7c0ae8cd4 100644
--- a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
+++ b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
@@ -150,7 +150,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
     afterTextChanged: function(oldRange, newRange)
     {
         WebInspector.SourceFrame.prototype.afterTextChanged.call(this, oldRange, newRange);
-        this._javaScriptSource.setWorkingCopy(this.textModel.text());
+        this._javaScriptSource.setWorkingCopy(this._textEditor.text());
         this._restoreBreakpointsAfterEditing();
     },
 
@@ -192,8 +192,8 @@ WebInspector.JavaScriptSourceFrame.prototype = {
     {
         if (!this._javaScriptSource.isDirty() || this._javaScriptSource.supportsEnabledBreakpointsWhileEditing()) {
             // Restore all muted breakpoints.
-            for (var lineNumber = 0; lineNumber < this.textModel.linesCount; ++lineNumber) {
-                var breakpointDecoration = this.textModel.getAttribute(lineNumber, "breakpoint");
+            for (var lineNumber = 0; lineNumber < this._textEditor.linesCount; ++lineNumber) {
+                var breakpointDecoration = this._textEditor.getAttribute(lineNumber, "breakpoint");
                 if (breakpointDecoration) {
                     // Remove fake decoration
                     this._removeBreakpointDecoration(lineNumber);
@@ -333,7 +333,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
             condition: condition,
             enabled: enabled
         };
-        this.textModel.setAttribute(lineNumber, "breakpoint", breakpoint);
+        this.textEditor.setAttribute(lineNumber, "breakpoint", breakpoint);
 
         this.textEditor.beginUpdates();
         this.textEditor.addDecoration(lineNumber, "webkit-breakpoint");
@@ -350,7 +350,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
 
     _removeBreakpointDecoration: function(lineNumber)
     {
-        this.textModel.removeAttribute(lineNumber, "breakpoint");
+        this.textEditor.removeAttribute(lineNumber, "breakpoint");
         this.textEditor.beginUpdates();
         this.textEditor.removeDecoration(lineNumber, "webkit-breakpoint");
         this.textEditor.removeDecoration(lineNumber, "webkit-breakpoint-disabled");
@@ -460,7 +460,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         if (lineNumber === oldRange.startLine) {
             var whiteSpacesRegex = /^[\s\xA0]*$/;
             for (var i = 0; lineNumber + i <= newRange.endLine; ++i) {
-                if (!whiteSpacesRegex.test(this.textModel.line(lineNumber + i))) {
+                if (!whiteSpacesRegex.test(this.textEditor.line(lineNumber + i))) {
                     shiftOffset = i;
                     break;
                 }
diff --git a/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js b/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
index 92e25dee9..b4dd51d50 100644
--- a/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
+++ b/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
@@ -224,6 +224,8 @@ WebInspector.MemoryBlockViewProperties._initialize = function()
     addBlock("hsl( 90, 50%,  80%)", "JSExternalStrings", "JavaScript external strings");
     addBlock("hsl(210, 60%,  80%)", "InspectorData", "Inspector data");
     addBlock("hsl( 30, 60%,  80%)", "MemoryCache", "Memory cache resources");
+    addBlock("hsl( 40, 60%,  80%)", "GlyphCache", "Glyph cache resources");
+    addBlock("hsl( 35, 60%,  80%)", "DOMStorageCache", "DOM storage cache");
     addBlock("hsl( 60, 60%,  80%)", "RenderTreeAllocated", "Render tree");
     addBlock("hsl( 60, 60%,  80%)", "RenderTreeUsed", "Render tree used");
 }
diff --git a/Source/WebCore/inspector/front-end/NetworkManager.js b/Source/WebCore/inspector/front-end/NetworkManager.js
index fd6f61c0c..ecf6a5986 100644
--- a/Source/WebCore/inspector/front-end/NetworkManager.js
+++ b/Source/WebCore/inspector/front-end/NetworkManager.js
@@ -49,8 +49,6 @@ WebInspector.NetworkManager = function()
 }
 
 WebInspector.NetworkManager.EventTypes = {
-    ResourceTrackingEnabled: "ResourceTrackingEnabled",
-    ResourceTrackingDisabled: "ResourceTrackingDisabled",
     RequestStarted: "RequestStarted",
     RequestUpdated: "RequestUpdated",
     RequestFinished: "RequestFinished",
@@ -94,24 +92,6 @@ WebInspector.NetworkManager._MIMETypes = {
 }
 
 WebInspector.NetworkManager.prototype = {
-    enableResourceTracking: function()
-    {
-        function callback(error)
-        {
-            this.dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.ResourceTrackingEnabled);
-        }
-        NetworkAgent.enable(callback.bind(this));
-    },
-
-    disableResourceTracking: function()
-    {
-        function callback(error)
-        {
-            this.dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.ResourceTrackingDisabled);
-        }
-        NetworkAgent.disable(callback.bind(this));
-    },
-
     /**
      * @param {string} url
      * @return {WebInspector.NetworkRequest}
diff --git a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
index a036f410e..1adad3de2 100644
--- a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -28,7 +28,7 @@
  * @constructor
  * @extends {WebInspector.PropertiesSection}
  * @param {WebInspector.RemoteObject=} object
- * @param {string=} title
+ * @param {string|Element=} title
  * @param {string=} subtitle
  * @param {string=} emptyPlaceholder
  * @param {boolean=} ignoreHasOwnProperty
@@ -45,7 +45,7 @@ WebInspector.ObjectPropertiesSection = function(object, title, subtitle, emptyPl
     this.editable = true;
     this.skipProto = false;
 
-    WebInspector.PropertiesSection.call(this, title, subtitle);
+    WebInspector.PropertiesSection.call(this, title || "", subtitle);
 }
 
 WebInspector.ObjectPropertiesSection._arrayLoadThreshold = 100;
@@ -226,31 +226,7 @@ WebInspector.ObjectPropertyTreeElement = function(property)
 WebInspector.ObjectPropertyTreeElement.prototype = {
     onpopulate: function()
     {
-        if (this.children.length && !this.shouldRefreshChildren)
-            return;
-
-        if (this.property.value.arrayLength() > WebInspector.ObjectPropertiesSection._arrayLoadThreshold) {
-            this.removeChildren();
-            WebInspector.ArrayGroupingTreeElement._populateArray(this, this.property.value, 0, this.property.value.arrayLength() - 1);
-            return;
-        }
-
-        function callback(properties)
-        {
-            this.removeChildren();
-            if (!properties)
-                return;
-
-            properties.sort(WebInspector.ObjectPropertiesSection.CompareProperties);
-            for (var i = 0; i < properties.length; ++i) {
-                if (this.treeOutline.section.skipProto && properties[i].name === "__proto__")
-                    continue;
-                properties[i].parentObject = this.property.value;
-                this.appendChild(new this.treeOutline.section.treeElementConstructor(properties[i]));
-            }
-        }
-
-        this.property.value.getOwnProperties(callback.bind(this));
+        return WebInspector.ObjectPropertyTreeElement.populate(this, this.property.value);
     },
 
     ondblclick: function(event)
@@ -305,7 +281,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
             this.valueElement.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), false);
 
         this.valueElement.title = description || "";
-        
+
         this.listItemElement.removeChildren();
 
         this.listItemElement.appendChild(this.nameElement);
@@ -468,11 +444,145 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
     }
 }
 
+/**
+ * @param {TreeElement} treeElement
+ * @param {WebInspector.RemoteObject} value
+ */
+WebInspector.ObjectPropertyTreeElement.populate = function(treeElement, value) {
+    if (treeElement.children.length && !treeElement.shouldRefreshChildren)
+        return;
+
+    if (value.arrayLength() > WebInspector.ObjectPropertiesSection._arrayLoadThreshold) {
+        treeElement.removeChildren();
+        WebInspector.ArrayGroupingTreeElement._populateArray(treeElement, value, 0, value.arrayLength() - 1);
+        return;
+    }
+
+    function callback(properties)
+    {
+        treeElement.removeChildren();
+        if (!properties)
+            return;
+
+        properties.sort(WebInspector.ObjectPropertiesSection.CompareProperties);
+        for (var i = 0; i < properties.length; ++i) {
+            if (treeElement.treeOutline.section.skipProto && properties[i].name === "__proto__")
+                continue;
+            properties[i].parentObject = value;
+            treeElement.appendChild(new treeElement.treeOutline.section.treeElementConstructor(properties[i]));
+        }
+        if (value.type === "function")
+            treeElement.appendChild(new WebInspector.FunctionScopeMainTreeElement(value));
+    }
+
+    value.getOwnProperties(callback);
+}
+
 WebInspector.ObjectPropertyTreeElement.prototype.__proto__ = TreeElement.prototype;
 
 /**
  * @constructor
  * @extends {TreeElement}
+ * @param {WebInspector.RemoteObject} remoteObject
+ */
+WebInspector.FunctionScopeMainTreeElement = function(remoteObject)
+{
+    TreeElement.call(this, "<function scope>", null, false);
+    this.toggleOnClick = true;
+    this.selectable = false;
+    this._remoteObject = remoteObject;
+    this.hasChildren = true;
+}
+
+WebInspector.FunctionScopeMainTreeElement.prototype = {
+    onpopulate: function()
+    {
+        if (this.children.length && !this.shouldRefreshChildren)
+            return;
+
+        function didGetDetails(error, response)
+        {
+            if (error) {
+                console.error(error);
+                return;
+            }
+            this.removeChildren();
+
+            var scopeChain = response.scopeChain;
+            for (var i = 0; i < scopeChain.length; ++i) {
+                var scope = scopeChain[i];
+                var title = null;
+                var isTrueObject;
+
+                switch (scope.type) {
+                    case "local":
+                        // Not really expecting this scope type here.
+                        title = WebInspector.UIString("Local");
+                        isTrueObject = false;
+                        break;
+                    case "closure":
+                        title = WebInspector.UIString("Closure");
+                        isTrueObject = false;
+                        break;
+                    case "catch":
+                        title = WebInspector.UIString("Catch");
+                        isTrueObject = false;
+                        break;
+                    case "with":
+                        title = WebInspector.UIString("With Block");
+                        isTrueObject = true;
+                        break;
+                    case "global":
+                        title = WebInspector.UIString("Global");
+                        isTrueObject = true;
+                        break;
+                }
+
+                var remoteObject = WebInspector.RemoteObject.fromPayload(scope.object);
+                if (isTrueObject) {
+                    var property = WebInspector.RemoteObjectProperty.fromScopeValue(title, remoteObject);
+                    property.parentObject = null;
+                    this.appendChild(new this.treeOutline.section.treeElementConstructor(property));
+                } else {
+                    var scopeTreeElement = new WebInspector.ScopeTreeElement(title, null, remoteObject);
+                    this.appendChild(scopeTreeElement);
+                }
+            }
+
+        }
+        DebuggerAgent.getFunctionDetails(this._remoteObject.objectId, didGetDetails.bind(this));
+    }
+};
+
+WebInspector.FunctionScopeMainTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {TreeElement}
+ * @param {WebInspector.RemoteObject} remoteObject
+ */
+WebInspector.ScopeTreeElement = function(title, subtitle, remoteObject)
+{
+    // TODO: use subtitle parameter.
+    TreeElement.call(this, title, null, false);
+    this.toggleOnClick = true;
+    this.selectable = false;
+    this._remoteObject = remoteObject;
+    this.hasChildren = true;
+}
+
+WebInspector.ScopeTreeElement.prototype = {
+    onpopulate: function()
+    {
+        return WebInspector.ObjectPropertyTreeElement.populate(this, this._remoteObject);
+    }
+};
+
+WebInspector.ScopeTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {TreeElement}
  * @param {WebInspector.RemoteObject} object
  * @param {number} fromIndex
  * @param {number} toIndex
@@ -489,7 +599,7 @@ WebInspector.ArrayGroupingTreeElement = function(object, fromIndex, toIndex, pro
     this._populated = false;
 }
 
-WebInspector.ArrayGroupingTreeElement._bucketThreshold = 20;
+WebInspector.ArrayGroupingTreeElement._bucketThreshold = 100;
 
 /**
  * @param {TreeElement|TreeOutline} treeElement
@@ -528,14 +638,11 @@ WebInspector.ArrayGroupingTreeElement._populateRanges = function(treeElement, ob
                 ++count;
         }
 
-        var bucketSize;
-        if (count < bucketThreshold)
+        var bucketSize = count;
+        if (count <= bucketThreshold)
             bucketSize = count;
-        else {
-            bucketSize = Math.ceil(count / bucketThreshold);
-            if (bucketSize < bucketThreshold)
-                bucketSize = Math.floor(Math.sqrt(count));
-        }
+        else
+            bucketSize = Math.pow(bucketThreshold, Math.floor(Math.log(count) / Math.log(bucketThreshold)));
 
         var ranges = [];
         count = 0;
@@ -679,7 +786,7 @@ WebInspector.ArrayGroupingTreeElement.prototype = {
     {
         if (this._populated)
             return;
-        
+
         this._populated = true;
 
         if (this._propertyCount >= WebInspector.ArrayGroupingTreeElement._bucketThreshold) {
diff --git a/Source/WebCore/inspector/front-end/ProfilesPanel.js b/Source/WebCore/inspector/front-end/ProfilesPanel.js
index ed3370d37..8f1b6cfd0 100644
--- a/Source/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/Source/WebCore/inspector/front-end/ProfilesPanel.js
@@ -264,17 +264,8 @@ WebInspector.ProfilesPanel.prototype = {
     {
         if (this._fileSelectorElement)
             this.element.removeChild(this._fileSelectorElement);
-
-        var fileSelectorElement = document.createElement("input");
-        fileSelectorElement.type = "file";
-        fileSelectorElement.style.zIndex = -1;
-        fileSelectorElement.style.position = "absolute";
-        function onChange(event) {
-            this._loadFromFile(this._fileSelectorElement.files[0]);
-        }
-        fileSelectorElement.onchange = onChange.bind(this);
-        this.element.appendChild(fileSelectorElement);
-        this._fileSelectorElement = fileSelectorElement;
+        this._fileSelectorElement = WebInspector.createFileSelectorElement(this._loadFromFile.bind(this));
+        this.element.appendChild(this._fileSelectorElement);
     },
 
     _loadFromFile: function(file)
@@ -675,9 +666,9 @@ WebInspector.ProfilesPanel.prototype = {
     _addHeapSnapshotChunk: function(uid, chunk)
     {
         var profile = this._profilesIdMap[this._makeKey(uid, WebInspector.HeapSnapshotProfileType.TypeId)];
-        if (!profile )
+        if (!profile)
             return;
-        profile.pushJSONChunk(chunk);
+        profile.transferChunk(chunk);
     },
 
     /**
@@ -688,7 +679,7 @@ WebInspector.ProfilesPanel.prototype = {
         var profile = this._profilesIdMap[this._makeKey(uid, WebInspector.HeapSnapshotProfileType.TypeId)];
         if (!profile)
             return;
-        profile.finishHeapSnapshot();
+        profile.finishHeapSnapshot(false);
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/ProgressBar.js b/Source/WebCore/inspector/front-end/ProgressBar.js
new file mode 100644
index 000000000..84ed5a0bb
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/ProgressBar.js
@@ -0,0 +1,247 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @interface
+ */
+WebInspector.Progress = function()
+{
+}
+
+WebInspector.Progress.prototype = {
+    /**
+     * @param {number} totalWork
+     */
+    setTotalWork: function(totalWork) { },
+
+    /**
+     * @param {string} title
+     */
+    setTitle: function(title) { },
+
+    /**
+     * @param {number} worked
+     * @param {string=} title
+     */
+    setWorked: function(worked, title) { },
+
+    done: function() { },
+
+    /**
+     * @return {boolean}
+     */
+    isCanceled: function() { return false; }
+}
+
+/**
+ * @constructor
+ * @implements {WebInspector.Progress}
+ * @extends {WebInspector.Object}
+ */
+WebInspector.ProgressIndicator = function()
+{
+    this.element = document.createElement("div");
+    this.element.className = "progress-bar-container";
+    this._labelElement = this.element.createChild("span");
+    this._progressElement = this.element.createChild("progress");
+    this._stopButton = new WebInspector.StatusBarButton(WebInspector.UIString("Cancel"), "progress-bar-stop-button");
+    this._stopButton.addEventListener("click", this._cancel, this);
+    this.element.appendChild(this._stopButton.element);
+    this._isCanceled = false;
+}
+
+WebInspector.ProgressIndicator.Events = {
+    Done: "Done"
+}
+
+WebInspector.ProgressIndicator.prototype = {
+    /**
+     * @param {Element} parent
+     */
+    show: function(parent)
+    {
+        parent.appendChild(this.element);
+    },
+
+    hide: function()
+    {
+        var parent = this.element.parentElement;
+        if (parent)
+            parent.removeChild(this.element);
+    },
+
+    done: function()
+    {
+        this.hide();
+        this.dispatchEventToListeners(WebInspector.ProgressIndicator.Events.Done);
+    },
+
+    _cancel: function()
+    {
+        this._isCanceled = true;
+    },
+
+    isCanceled: function()
+    {
+        return this._isCanceled;
+    },
+
+    /**
+     * @param {string} title
+     */
+    setTitle: function(title)
+    {
+        this._labelElement.textContent = title;
+    },
+
+    /**
+     * @param {number} totalWork
+     */
+    setTotalWork: function(totalWork)
+    {
+        this._progressElement.max = totalWork;
+    },
+
+    /**
+     * @param {number} worked
+     * @param {string=} title
+     */
+    setWorked: function(worked, title)
+    {
+        this._progressElement.value = worked;
+        if (title)
+            this.setTitle(title);
+    }
+}
+
+WebInspector.ProgressIndicator.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @param {WebInspector.Progress} parent
+ */
+WebInspector.CompositeProgress = function(parent)
+{
+    this._parent = parent;
+    this._children = [];
+    this._childrenDone = 0;
+    this._parent.setTotalWork(1);
+    this._parent.setWorked(0);
+}
+
+WebInspector.CompositeProgress.prototype = {
+    _childDone: function()
+    {
+        if (++this._childrenDone === this._children.length)
+            this._parent.done();
+    },
+
+    /**
+     * @param {number=} weight
+     */
+    createSubProgress: function(weight)
+    {
+        var child = new WebInspector.SubProgress(this, weight);
+        this._children.push(child);
+        return child;
+    },
+
+    _update: function()
+    {
+        var totalWeights = 0;
+        var done = 0;
+
+        for (var i = 0; i < this._children.length; ++i) {
+            var child = this._children[i];
+            if (child._totalWork)
+                done += child._weight * child._worked / child._totalWork;
+            totalWeights += child._weight;
+        }
+        this._parent.setWorked(done / totalWeights);
+    }
+}
+
+/**
+ * @constructor
+ * @implements {WebInspector.Progress}
+ * @param {WebInspector.CompositeProgress} composite
+ * @param {number=} weight
+ */
+WebInspector.SubProgress = function(composite, weight)
+{
+    this._composite = composite;
+    this._weight = weight || 1;
+    this._worked = 0;
+}
+
+WebInspector.SubProgress.prototype = {
+    /**
+     * @return {boolean}
+     */
+    isCanceled: function()
+    {
+        return this._composite._parent.isCanceled();
+    },
+
+    /**
+     * @param {string} title
+     */
+    setTitle: function(title)
+    {
+        this._composite._parent.setTitle(title);
+    },
+
+    done: function()
+    {
+        this.setWorked(this._totalWork);
+        this._composite._childDone();
+    },
+
+    /**
+     * @param {number} totalWork
+     */
+    setTotalWork: function(totalWork)
+    {
+        this._totalWork = totalWork;
+        this._composite._update();
+    },
+
+    /**
+     * @param {number} worked
+     * @param {string=} title
+     */
+    setWorked: function(worked, title)
+    {
+        this._worked = worked;
+        if (typeof title !== "undefined")
+            this.setTitle(title);
+        this._composite._update();
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/PropertiesSection.js b/Source/WebCore/inspector/front-end/PropertiesSection.js
index 0611b143a..4f760e68e 100644
--- a/Source/WebCore/inspector/front-end/PropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/PropertiesSection.js
@@ -30,6 +30,7 @@
 /**
  * @constructor
  * @extends {WebInspector.Section}
+ * @param {string|Element} title
  * @param {string=} subtitle
  */
 WebInspector.PropertiesSection = function(title, subtitle)
diff --git a/Source/WebCore/inspector/front-end/RemoteObject.js b/Source/WebCore/inspector/front-end/RemoteObject.js
index e1b3e6f15..f538738e1 100644
--- a/Source/WebCore/inspector/front-end/RemoteObject.js
+++ b/Source/WebCore/inspector/front-end/RemoteObject.js
@@ -35,8 +35,9 @@
  * @param {string|undefined} subtype
  * @param {*} value
  * @param {string=} description
+ * @param {RuntimeAgent.ObjectPreview=} preview
  */
-WebInspector.RemoteObject = function(objectId, type, subtype, value, description)
+WebInspector.RemoteObject = function(objectId, type, subtype, value, description, preview)
 {
     this._type = type;
     this._subtype = subtype;
@@ -45,6 +46,7 @@ WebInspector.RemoteObject = function(objectId, type, subtype, value, description
         this._objectId = objectId;
         this._description = description;
         this._hasChildren = true;
+        this._preview = preview;
     } else {
         // Primitive or null object.
         console.assert(type !== "object" || value === null);
@@ -104,7 +106,7 @@ WebInspector.RemoteObject.fromPayload = function(payload)
 {
     console.assert(typeof payload === "object", "Remote object payload should only be an object");
 
-    return new WebInspector.RemoteObject(payload.objectId, payload.type, payload.subtype, payload.value, payload.description);
+    return new WebInspector.RemoteObject(payload.objectId, payload.type, payload.subtype, payload.value, payload.description, payload.preview);
 }
 
 /**
@@ -154,6 +156,12 @@ WebInspector.RemoteObject.prototype = {
         return this._hasChildren;
     },
 
+    /** @return {RuntimeAgent.ObjectPreview|undefined} */
+    get preview()
+    {
+        return this._preview;
+    },
+
     /**
      * @param {function(Array.<WebInspector.RemoteObjectProperty>)} callback
      */
@@ -336,7 +344,7 @@ WebInspector.RemoteObject.prototype = {
 /**
  * @constructor
  * @param {string} name
- * @param {WebInspector.RemoteObject} value 
+ * @param {WebInspector.RemoteObject} value
  * @param {Object=} descriptor
  */
 WebInspector.RemoteObjectProperty = function(name, value, descriptor)
@@ -359,6 +367,18 @@ WebInspector.RemoteObjectProperty.fromPrimitiveValue = function(name, value)
     return new WebInspector.RemoteObjectProperty(name, WebInspector.RemoteObject.fromPrimitiveValue(value));
 }
 
+/**
+ * @param {string} name
+ * @param {WebInspector.RemoteObject} value
+ * @return {WebInspector.RemoteObjectProperty}
+ */
+WebInspector.RemoteObjectProperty.fromScopeValue = function(name, value)
+{
+    var result = new WebInspector.RemoteObjectProperty(name, value);
+    result.writable = false;
+    return result;
+}
+
 // The below is a wrapper around a local object that provides an interface comaptible
 // with RemoteObject, to be used by the UI code (primarily ObjectPropertiesSection).
 // Note that only JSON-compliant objects are currently supported, as there's no provision
diff --git a/Source/WebCore/inspector/front-end/ResourceTreeModel.js b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
index e0dfbabb1..36165714d 100644
--- a/Source/WebCore/inspector/front-end/ResourceTreeModel.js
+++ b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
@@ -35,7 +35,6 @@
  */
 WebInspector.ResourceTreeModel = function(networkManager)
 {
-    networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceTrackingEnabled, this._onResourceTrackingEnabled, this);
     networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.RequestUpdated, this._onRequestUpdated, this);
     networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.RequestFinished, this._onRequestUpdated, this);
     networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.RequestUpdateDropped, this._onRequestUpdateDropped, this);
@@ -68,11 +67,6 @@ WebInspector.ResourceTreeModel.EventTypes = {
 }
 
 WebInspector.ResourceTreeModel.prototype = {
-    _onResourceTrackingEnabled: function()
-    {
-        this._fetchResourceTree();
-    },
-
     _fetchResourceTree: function()
     {
         this._frames = {};
diff --git a/Source/WebCore/inspector/front-end/ResourceUtils.js b/Source/WebCore/inspector/front-end/ResourceUtils.js
index 53c1ab621..1412815a3 100644
--- a/Source/WebCore/inspector/front-end/ResourceUtils.js
+++ b/Source/WebCore/inspector/front-end/ResourceUtils.js
@@ -182,7 +182,7 @@ WebInspector.displayNameForURL = function(url)
 
 /**
  * @param {string} string
- * @param {function(string,string,string=):Node} linkifier
+ * @param {function(string,string,number=):Node} linkifier
  * @return {DocumentFragment}
  */
 WebInspector.linkifyStringAsFragmentWithCustomLinkifier = function(string, linkifier)
@@ -204,10 +204,14 @@ WebInspector.linkifyStringAsFragmentWithCustomLinkifier = function(string, linki
         var title = linkString;
         var realURL = (linkString.startsWith("www.") ? "http://" + linkString : linkString);
         var lineColumnMatch = lineColumnRegEx.exec(realURL);
-        if (lineColumnMatch)
+        var lineNumber;
+        if (lineColumnMatch) {
             realURL = realURL.substring(0, realURL.length - lineColumnMatch[0].length);
+            lineNumber = parseInt(lineColumnMatch[1], 10);
+            lineNumber = isNaN(lineNumber) ? undefined : lineNumber;
+        }
 
-        var linkNode = linkifier(title, realURL, lineColumnMatch ? lineColumnMatch[1] : undefined);
+        var linkNode = linkifier(title, realURL, lineNumber);
         container.appendChild(linkNode);
         string = string.substring(linkIndex + linkString.length, string.length);
     }
@@ -237,7 +241,7 @@ WebInspector.linkifyStringAsFragment = function(string)
     /**
      * @param {string} title
      * @param {string} url
-     * @param {string=} lineNumber
+     * @param {number=} lineNumber
      * @return {Node}
      */
     function linkifier(title, url, lineNumber)
@@ -378,7 +382,7 @@ WebInspector.completeURL = function(baseURL, href)
 
         // Return special URLs as-is.
         var trimmedHref = href.trim();
-        if (trimmedHref.startsWith("data:") || trimmedHref.startsWith("javascript:"))
+        if (trimmedHref.startsWith("data:") || trimmedHref.startsWith("javascript:") || trimmedHref.startsWith("blob:"))
             return href;
     }
 
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index 113b95be9..85d3c2226 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -49,7 +49,7 @@ WebInspector.ResourcesPanel = function(database)
     this.resourcesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Frames"), "Frames", ["frame-storage-tree-item"]);
     this.sidebarTree.appendChild(this.resourcesListTreeElement);
 
-    this.databasesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Databases"), "Databases", ["database-storage-tree-item"]);
+    this.databasesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Web SQL"), "Databases", ["database-storage-tree-item"]);
     this.sidebarTree.appendChild(this.databasesListTreeElement);
 
     this.indexedDBListTreeElement = new WebInspector.IndexedDBTreeElement(this);
@@ -1619,7 +1619,7 @@ WebInspector.IDBDatabaseTreeElement.prototype = {
 
         if (this._view)
             this._view.update(database);
-        
+
         this._updateTooltip();
     },
 
@@ -1715,13 +1715,13 @@ WebInspector.IDBObjectStoreTreeElement.prototype = {
 
         if (this._view)
             this._view.update(this._objectStore);
-        
+
         this._updateTooltip();
     },
 
     _updateTooltip: function()
     {
-        
+
         var keyPathString = this._objectStore.keyPathString;
         var tooltipString = keyPathString !== null ? (WebInspector.UIString("Key path: ") + keyPathString) : "";
         if (this._objectStore.autoIncrement)
@@ -1793,7 +1793,7 @@ WebInspector.IDBIndexTreeElement.prototype = {
 
         if (this._view)
             this._view.update(this._index);
-        
+
         this._updateTooltip();
     },
 
diff --git a/Source/WebCore/inspector/front-end/SASSSourceMapping.js b/Source/WebCore/inspector/front-end/SASSSourceMapping.js
index 32d6f80cf..e1c0aa700 100644
--- a/Source/WebCore/inspector/front-end/SASSSourceMapping.js
+++ b/Source/WebCore/inspector/front-end/SASSSourceMapping.js
@@ -80,29 +80,54 @@ WebInspector.SASSSourceMapping.prototype = {
             if (!content)
                 return;
             var lines = content.split(/\r?\n/);
-            var regex = /@media\s\-sass\-debug\-info{filename{font-family:([^}]+)}line{font-family:\\[0]+([^}]*)}}/i;
+            var debugInfoRegex = /@media\s\-sass\-debug\-info{filename{font-family:([^}]+)}line{font-family:\\[0]+([^}]*)}}/i;
+            var lineNumbersRegex = /\/\*\s+line\s+([0-9]+),\s+([^*\/]+)/;
             for (var lineNumber = 0; lineNumber < lines.length; ++lineNumber) {
-                var match = regex.exec(lines[lineNumber]);
-                if (!match)
+                var match = debugInfoRegex.exec(lines[lineNumber]);
+                if (match) {
+                    var url = match[1].replace(/\\(.)/g, "$1");
+                    var line = parseInt(decodeURI(match[2].replace(/(..)/g, "%$1")), 10);
+                    this._bindUISourceCode(url, line, resource.url, lineNumber);
+                    continue;
+                }
+                match = lineNumbersRegex.exec(lines[lineNumber]);
+                if (match) {
+                    var fileName = match[2].trim();
+                    var line = parseInt(match[1], 10);
+                    var url = resource.url;
+                    if (url.endsWith("/" + resource.parsedURL.lastPathComponent))
+                        url = url.substring(0, url.length - resource.parsedURL.lastPathComponent.length) + fileName;
+                    else
+                        url = fileName;
+                    this._bindUISourceCode(url, line, resource.url, lineNumber);
                     continue;
-                var url = match[1].replace(/\\(.)/g, "$1");
-                var uiSourceCode = this._uiSourceCodeForURL[url];
-                if (!uiSourceCode) {
-                    uiSourceCode = new WebInspector.SASSSource(url);
-                    this._uiSourceCodeForURL[url] = uiSourceCode;
-                    this._uiSourceCodes.push(uiSourceCode);
-                    this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, uiSourceCode);
-                    WebInspector.cssModel.setSourceMapping(resource.url, this);
                 }
-                var line = parseInt(decodeURI(match[2].replace(/(..)/g, "%$1")), 10) - 1;
-                var rawLocationString = resource.url + ":" + (lineNumber + 1);
-                this._uiLocations[rawLocationString] = new WebInspector.UILocation(uiSourceCode, line, 0);
             }
         }
         resource.requestContent(didRequestContent.bind(this));
     },
 
     /**
+     * @param {string} url
+     * @param {number} line
+     * @param {string} rawURL
+     * @param {number} rawLine
+     */
+    _bindUISourceCode: function(url, line, rawURL, rawLine)
+    {
+        var uiSourceCode = this._uiSourceCodeForURL[url];
+        if (!uiSourceCode) {
+            uiSourceCode = new WebInspector.SASSSource(url);
+            this._uiSourceCodeForURL[url] = uiSourceCode;
+            this._uiSourceCodes.push(uiSourceCode);
+            this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, uiSourceCode);
+            WebInspector.cssModel.setSourceMapping(rawURL, this);
+        }
+        var rawLocationString = rawURL + ":" + (rawLine + 1);  // Next line after mapping metainfo
+        this._uiLocations[rawLocationString] = new WebInspector.UILocation(uiSourceCode, line - 1, 0);
+    },
+
+    /**
      * @param {WebInspector.RawLocation} rawLocation
      * @return {WebInspector.UILocation}
      */
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index fd29ec9b0..c003f9cf8 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -101,8 +101,8 @@ WebInspector.ScriptsPanel = function(workspaceForTest)
     this.sidebarPanes.xhrBreakpoints = new WebInspector.XHRBreakpointsSidebarPane();
     this.sidebarPanes.eventListenerBreakpoints = new WebInspector.EventListenerBreakpointsSidebarPane();
 
-    if (Preferences.exposeWorkersInspection && !WebInspector.WorkerManager.isWorkerFrontend()) {
-        WorkerAgent.setWorkerInspectionEnabled(true);
+    if (InspectorFrontendHost.canInspectWorkers() && !WebInspector.WorkerManager.isWorkerFrontend()) {
+        WorkerAgent.enable();
         this.sidebarPanes.workerList = new WebInspector.WorkersSidebarPane(WebInspector.workerManager);
     }
 
diff --git a/Source/WebCore/inspector/front-end/ScriptsSearchScope.js b/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
index ce1664c51..e30655a6c 100644
--- a/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
+++ b/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
@@ -77,9 +77,12 @@ WebInspector.ScriptsSearchScope.prototype = {
                 searchFinishedCallback(false);
                 return;
             }
-                
             var searchResult = new WebInspector.FileBasedSearchResultsPane.SearchResult(uiSourceCode, searchMatches);
             searchResultCallback(searchResult);
+            if (searchId !== this._searchId) {
+                searchFinishedCallback(false);
+                return;
+            }
             continueSearch.call(this);
         }
         
diff --git a/Source/WebCore/inspector/front-end/Section.js b/Source/WebCore/inspector/front-end/Section.js
index 007096491..ef7f1ee52 100644
--- a/Source/WebCore/inspector/front-end/Section.js
+++ b/Source/WebCore/inspector/front-end/Section.js
@@ -29,6 +29,7 @@
 
 /**
  * @constructor
+ * @param {string|Element} title
  * @param {string=} subtitle
  */
 WebInspector.Section = function(title, subtitle)
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index fc8332502..f2c45335b 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -41,7 +41,6 @@ var Preferences = {
     sharedWorkersDebugNote: undefined,
     localizeUI: true,
     exposeDisableCache: false,
-    exposeWorkersInspection: false,
     applicationTitle: "Web Inspector - %s",
     showHeapSnapshotObjectsHiddenProperties: false,
     showDockToRight: false,
@@ -57,6 +56,7 @@ var Capabilities = {
     canOverrideDeviceMetrics: false,
     timelineSupportsFrameInstrumentation: false,
     canOverrideGeolocation: false,
+    canOverrideDeviceOrientation: false,
 }
 
 /**
@@ -100,6 +100,7 @@ WebInspector.Settings = function()
     this.savedURLs = this.createSetting("savedURLs", {});
     this.javaScriptDisabled = this.createSetting("javaScriptDisabled", false);
     this.geolocationOverride = this.createSetting("geolocationOverride", "");
+    this.deviceOrientationOverride = this.createSetting("deviceOrientationOverride", "");
 
     // If there are too many breakpoints in a storage, it is likely due to a recent bug that caused
     // periodical breakpoints duplication leading to inspector slowness.
@@ -190,7 +191,9 @@ WebInspector.ExperimentsSettings = function()
     this.fileSystemInspection = this._createExperiment("fileSystemInspection", "FileSystem inspection");
     this.mainThreadMonitoring = this._createExperiment("mainThreadMonitoring", "Show CPU activity in Timeline");
     this.geolocationOverride = this._createExperiment("geolocationOverride", "Override Device Geolocation");
+    this.deviceOrientationOverride = this._createExperiment("deviceOrientationOverride", "Override Device Orientation");
     this.sass = this._createExperiment("sass", "Support for SASS");
+    this.codemirror = this._createExperiment("codemirror", "Use CodeMirror editor");
 
     this._cleanUpSetting();
 }
diff --git a/Source/WebCore/inspector/front-end/SettingsScreen.js b/Source/WebCore/inspector/front-end/SettingsScreen.js
index ff6e313fe..51d4b6253 100644
--- a/Source/WebCore/inspector/front-end/SettingsScreen.js
+++ b/Source/WebCore/inspector/front-end/SettingsScreen.js
@@ -45,7 +45,7 @@ WebInspector.SettingsScreen = function(onHide)
     this._tabbedPane.element.addStyleClass("help-window-main");
     this._tabbedPane.element.appendChild(this._createCloseButton());
     this._tabbedPane.appendTab(WebInspector.SettingsScreen.Tabs.General, WebInspector.UIString("General"), new WebInspector.GenericSettingsTab());
-    this._tabbedPane.appendTab(WebInspector.SettingsScreen.Tabs.UserAgent, WebInspector.UIString("User agent"), new WebInspector.UserAgentSettingsTab());
+    this._tabbedPane.appendTab(WebInspector.SettingsScreen.Tabs.UserAgent, WebInspector.UIString("Overrides"), new WebInspector.UserAgentSettingsTab());
     if (WebInspector.experimentsSettings.experimentsEnabled)
         this._tabbedPane.appendTab(WebInspector.SettingsScreen.Tabs.Experiments, WebInspector.UIString("Experiments"), new WebInspector.ExperimentsSettingsTab());
     this._tabbedPane.appendTab(WebInspector.SettingsScreen.Tabs.Shortcuts, WebInspector.UIString("Shortcuts"), WebInspector.shortcutsScreen.createShortcutsTabView());
@@ -351,6 +351,8 @@ WebInspector.UserAgentSettingsTab = function()
         p.appendChild(this._createDeviceMetricsControl());
     if (Capabilities.canOverrideGeolocation && WebInspector.experimentsSettings.geolocationOverride.isEnabled())
         p.appendChild(this._createGeolocationOverrideControl());
+    if (Capabilities.canOverrideDeviceOrientation && WebInspector.experimentsSettings.deviceOrientationOverride.isEnabled())
+        p.appendChild(this._createDeviceOrientationOverrideControl());
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Emulate touch events"), WebInspector.settings.emulateTouchEvents));
 }
 
@@ -364,7 +366,7 @@ WebInspector.UserAgentSettingsTab.prototype = {
         var checkboxElement = labelElement.createChild("input");
         checkboxElement.type = "checkbox";
         checkboxElement.checked = !!userAgent;
-        labelElement.appendChild(document.createTextNode("Override User Agent"));
+        labelElement.appendChild(document.createTextNode("User Agent"));
         p.appendChild(this._createUserAgentSelectRowElement(checkboxElement));
         return p;
     },
@@ -507,6 +509,27 @@ WebInspector.UserAgentSettingsTab.prototype = {
         PageAgent.getScriptExecutionStatus(executionStatusCallback.bind(this));
     },
 
+    /**
+     * Creates an input element under the parentElement with the given id and defaultText.
+     * It also sets an onblur event listener.
+     * @param {Element} parentElement
+     * @param {string} id
+     * @param {string} defaultText
+     * @param {function(*)} eventListener
+     * @return {Element} element
+     */
+    _createInput: function(parentElement, id, defaultText, eventListener)
+    {
+        var element = parentElement.createChild("input");
+        element.id = id;
+        element.maxLength = 12;
+        element.style.width = "80px";
+        element.value = defaultText;
+        element.align = "right";
+        element.addEventListener("blur", eventListener, false);
+        return element;
+    },
+
     _createDeviceMetricsControl: function()
     {
         const metricsSetting = WebInspector.settings.deviceMetrics.get();
@@ -520,7 +543,7 @@ WebInspector.UserAgentSettingsTab.prototype = {
         checkboxElement.checked = !metrics || (metrics.width && metrics.height && metrics.fontScaleFactor);
         checkboxElement.addEventListener("click", this._onMetricsCheckboxClicked.bind(this), false);
         this._metricsCheckboxElement = checkboxElement;
-        labelElement.appendChild(document.createTextNode(WebInspector.UIString("Override device metrics")));
+        labelElement.appendChild(document.createTextNode(WebInspector.UIString("Device metrics")));
 
         const metricsSectionElement = this._createDeviceMetricsElement(metrics);
         p.appendChild(metricsSectionElement);
@@ -604,17 +627,6 @@ WebInspector.UserAgentSettingsTab.prototype = {
         var fieldsetElement = document.createElement("fieldset");
         fieldsetElement.id = "metrics-override-section";
 
-        function createInput(parentElement, id, defaultText)
-        {
-            var element = parentElement.createChild("input");
-            element.id = id;
-            element.maxLength = 6;
-            element.style.width = "48px";
-            element.value = defaultText;
-            element.addEventListener("blur", this._applyDeviceMetricsUserInput.bind(this), false);
-            return element;
-        }
-
         function swapDimensionsClicked(event)
         {
             var widthValue = this._widthOverrideElement.value;
@@ -629,9 +641,9 @@ WebInspector.UserAgentSettingsTab.prototype = {
         var cellElement = rowElement.createChild("td");
         cellElement.appendChild(document.createTextNode(WebInspector.UIString("Screen resolution:")));
         cellElement = rowElement.createChild("td");
-        this._widthOverrideElement = createInput.call(this, cellElement, "metrics-override-width", String(metrics.width || screen.width));
+        this._widthOverrideElement = this._createInput(cellElement, "metrics-override-width", String(metrics.width || screen.width), this._applyDeviceMetricsUserInput.bind(this));
         cellElement.appendChild(document.createTextNode(" \u00D7 ")); // MULTIPLICATION SIGN.
-        this._heightOverrideElement = createInput.call(this, cellElement, "metrics-override-height", String(metrics.height || screen.height));
+        this._heightOverrideElement = this._createInput(cellElement, "metrics-override-height", String(metrics.height || screen.height), this._applyDeviceMetricsUserInput.bind(this));
         cellElement.appendChild(document.createTextNode(" \u2014 ")); // EM DASH.
         this._swapDimensionsElement = cellElement.createChild("button");
         this._swapDimensionsElement.appendChild(document.createTextNode(" \u21C4 ")); // RIGHTWARDS ARROW OVER LEFTWARDS ARROW.
@@ -642,7 +654,7 @@ WebInspector.UserAgentSettingsTab.prototype = {
         cellElement = rowElement.createChild("td");
         cellElement.appendChild(document.createTextNode(WebInspector.UIString("Font scale factor:")));
         cellElement = rowElement.createChild("td");
-        this._fontScaleFactorOverrideElement = createInput.call(this, cellElement, "metrics-override-font-scale", String(metrics.fontScaleFactor || 1));
+        this._fontScaleFactorOverrideElement = this._createInput(cellElement, "metrics-override-font-scale", String(metrics.fontScaleFactor || 1), this._applyDeviceMetricsUserInput.bind(this));
 
         rowElement = tableElement.createChild("tr");
         cellElement = rowElement.createChild("td");
@@ -728,26 +740,14 @@ WebInspector.UserAgentSettingsTab.prototype = {
         var fieldsetElement = document.createElement("fieldset");
         fieldsetElement.id = "geolocation-override-section";
 
-        function createInput(parentElement, id, defaultText)
-        {
-            var element = parentElement.createChild("input");
-            element.id = id;
-            element.maxLength = 12;
-            element.style.width = "80px";
-            element.value = defaultText;
-            element.addEventListener("blur", this._applyGeolocationUserInput.bind(this), false);
-            return element;
-        }
-
         var tableElement = fieldsetElement.createChild("table");
-
         var rowElement = tableElement.createChild("tr");
         var cellElement = rowElement.createChild("td");
         cellElement.appendChild(document.createTextNode(WebInspector.UIString("Geolocation Position") + ":"));
         cellElement = rowElement.createChild("td");
-        this._latitudeElement = createInput.call(this, cellElement, "geolocation-override-latitude", String(geolocation.latitude));
+        this._latitudeElement = this._createInput(cellElement, "geolocation-override-latitude", String(geolocation.latitude), this._applyGeolocationUserInput.bind(this));
         cellElement.appendChild(document.createTextNode(" , "));
-        this._longitudeElement = createInput.call(this, cellElement, "geolocation-override-longitude", String(geolocation.longitude));
+        this._longitudeElement = this._createInput(cellElement, "geolocation-override-longitude", String(geolocation.longitude), this._applyGeolocationUserInput.bind(this));
         rowElement = tableElement.createChild("tr");
         cellElement = rowElement.createChild("td");
         var geolocationErrorLabelElement = document.createElement("label");
@@ -761,6 +761,99 @@ WebInspector.UserAgentSettingsTab.prototype = {
         cellElement.appendChild(geolocationErrorLabelElement);
 
         return fieldsetElement;
+    },
+
+    _createDeviceOrientationOverrideControl: function()
+    {
+        const deviceOrientationSetting = WebInspector.settings.deviceOrientationOverride.get();
+        var deviceOrientation = WebInspector.UserAgentSupport.DeviceOrientation.parseSetting(deviceOrientationSetting);
+
+        var p = document.createElement("p");
+        var labelElement = p.createChild("label");
+        var checkboxElement = labelElement.createChild("input");
+        checkboxElement.id = "device-orientation-override-checkbox";
+        checkboxElement.type = "checkbox";
+        checkboxElement.checked = !deviceOrientation;
+        checkboxElement.addEventListener("click", this._onDeviceOrientationOverrideCheckboxClicked.bind(this), false);
+        this._deviceOrientationOverrideCheckboxElement = checkboxElement;
+        labelElement.appendChild(document.createTextNode(WebInspector.UIString("Override Device Orientation")));
+
+        var deviceOrientationSectionElement = this._createDeviceOrientationOverrideElement(deviceOrientation);
+        p.appendChild(deviceOrientationSectionElement);
+        this._deviceOrientationSectionElement = deviceOrientationSectionElement;
+
+        this._setDeviceOrientation(deviceOrientation, false, true);
+
+        return p;
+    },
+
+    _onDeviceOrientationOverrideCheckboxClicked: function()
+    {
+        var controlsDisabled = !this._deviceOrientationOverrideCheckboxElement.checked;
+        this._alphaElement.disabled = controlsDisabled;
+        this._betaElement.disabled = controlsDisabled;
+        this._gammaElement.disabled = controlsDisabled;
+
+        if (this._deviceOrientationOverrideCheckboxElement.checked) {
+            var deviceOrientation = WebInspector.UserAgentSupport.DeviceOrientation.parseUserInput(this._alphaElement.value, this._betaElement.value, this._gammaElement.value);
+            if (deviceOrientation)
+                this._setDeviceOrientation(deviceOrientation, false, false);
+            if (!this._alphaElement.value)
+                this._alphaElement.focus();
+        } else
+            WebInspector.UserAgentSupport.DeviceOrientation.clearDeviceOrientationOverride();
+    },
+
+    _applyDeviceOrientationUserInput: function()
+    {
+        this._setDeviceOrientation(WebInspector.UserAgentSupport.DeviceOrientation.parseUserInput(this._alphaElement.value.trim(), this._betaElement.value.trim(), this._gammaElement.value.trim()), true, false);
+    },
+
+    /**
+     * @param {?WebInspector.UserAgentSupport.DeviceOrientation} deviceOrientation
+     * @param {boolean} userInputModified
+     * @param {boolean} updateCheckbox
+     */
+    _setDeviceOrientation: function(deviceOrientation, userInputModified, updateCheckbox)
+    {
+        if (!deviceOrientation)
+            return;
+
+        if (!userInputModified) {
+            this._alphaElement.value = deviceOrientation.alpha;
+            this._betaElement.value = deviceOrientation.beta;
+            this._gammaElement.value = deviceOrientation.gamma;
+        }
+
+        var value = deviceOrientation.toSetting();
+        WebInspector.settings.deviceOrientationOverride.set(value);
+
+        if (this._deviceOrientationOverrideCheckboxElement && updateCheckbox) {
+            this._deviceOrientationOverrideCheckboxElement.checked = !!deviceOrientation.toSetting();
+            this._onDeviceOrientationOverrideCheckboxClicked();
+        }
+    },
+
+    /**
+     * @param {WebInspector.UserAgentSupport.DeviceOrientation} deviceOrientation
+     */
+    _createDeviceOrientationOverrideElement: function(deviceOrientation)
+    {
+        var fieldsetElement = document.createElement("fieldset");
+        fieldsetElement.id = "device-orientation-override-section";
+
+        var tableElement = fieldsetElement.createChild("table");
+
+        var rowElement = tableElement.createChild("tr");
+        var cellElement = rowElement.createChild("td");
+        cellElement.appendChild(document.createTextNode("\u03B1: "));
+        this._alphaElement = this._createInput(cellElement, "device-orientation-override-alpha", String(deviceOrientation.alpha), this._applyDeviceOrientationUserInput.bind(this));
+        cellElement.appendChild(document.createTextNode(" \u03B2: "));
+        this._betaElement = this._createInput(cellElement, "device-orientation-override-beta", String(deviceOrientation.beta), this._applyDeviceOrientationUserInput.bind(this));
+        cellElement.appendChild(document.createTextNode(" \u03B3: "));
+        this._gammaElement = this._createInput(cellElement, "device-orientation-override-gamma", String(deviceOrientation.gamma), this._applyDeviceOrientationUserInput.bind(this));
+
+        return fieldsetElement;
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/SourceFrame.js b/Source/WebCore/inspector/front-end/SourceFrame.js
index 29464dfee..a0ffcfafb 100644
--- a/Source/WebCore/inspector/front-end/SourceFrame.js
+++ b/Source/WebCore/inspector/front-end/SourceFrame.js
@@ -41,10 +41,12 @@ WebInspector.SourceFrame = function(contentProvider)
     this._url = contentProvider.contentURL();
     this._contentProvider = contentProvider;
 
-    this._textModel = new WebInspector.TextEditorModel();
-
     var textEditorDelegate = new WebInspector.TextEditorDelegateForSourceFrame(this);
-    this._textEditor = new WebInspector.TextEditor(this._textModel, this._url, textEditorDelegate);
+
+    if (WebInspector.experimentsSettings.codemirror.isEnabled())
+        this._textEditor = new WebInspector.CodeMirrorTextEditor(this._url, textEditorDelegate);
+    else
+        this._textEditor = new WebInspector.DefaultTextEditor(this._url, textEditorDelegate);
 
     this._currentSearchResultIndex = -1;
     this._searchResults = [];
@@ -96,8 +98,6 @@ WebInspector.SourceFrame.prototype = {
     willHide: function()
     {
         WebInspector.View.prototype.willHide.call(this);
-        if (this.loaded)
-            this._textEditor.freeCachedElements();
 
         this._clearLineHighlight();
         this._clearLineToReveal();
@@ -160,11 +160,6 @@ WebInspector.SourceFrame.prototype = {
         this._textEditor.doResize();
     },
 
-    get textModel()
-    {
-        return this._textModel;
-    },
-
     /**
      * @param {number} line
      */
@@ -299,7 +294,7 @@ WebInspector.SourceFrame.prototype = {
         this._textEditor.mimeType = mimeType;
 
         this._loaded = true;
-        this._textModel.setText(content || "");
+        this._textEditor.setText(content || "");
 
         this._textEditor.beginUpdates();
 
@@ -456,8 +451,8 @@ WebInspector.SourceFrame.prototype = {
     {
         this._textEditor.markAndRevealRange(null);
 
-        var text = this._textModel.text();
-        var range = this._textModel.range();
+        var text = this._textEditor.text();
+        var range = this._textEditor.range();
         text = text.replace(WebInspector.SourceFrame.createSearchRegex(query, "g"), replacement);
 
         this._isReplacing = true;
@@ -468,8 +463,8 @@ WebInspector.SourceFrame.prototype = {
     _collectRegexMatches: function(regexObject)
     {
         var ranges = [];
-        for (var i = 0; i < this._textModel.linesCount; ++i) {
-            var line = this._textModel.line(i);
+        for (var i = 0; i < this._textEditor.linesCount; ++i) {
+            var line = this._textEditor.line(i);
             var offset = 0;
             do {
                 var match = regexObject.exec(line);
@@ -493,8 +488,8 @@ WebInspector.SourceFrame.prototype = {
 
     addMessageToSource: function(lineNumber, msg)
     {
-        if (lineNumber >= this._textModel.linesCount)
-            lineNumber = this._textModel.linesCount - 1;
+        if (lineNumber >= this._textEditor.linesCount)
+            lineNumber = this._textEditor.linesCount - 1;
         if (lineNumber < 0)
             lineNumber = 0;
 
@@ -567,8 +562,8 @@ WebInspector.SourceFrame.prototype = {
 
     removeMessageFromSource: function(lineNumber, msg)
     {
-        if (lineNumber >= this._textModel.linesCount)
-            lineNumber = this._textModel.linesCount - 1;
+        if (lineNumber >= this._textEditor.linesCount)
+            lineNumber = this._textEditor.linesCount - 1;
         if (lineNumber < 0)
             lineNumber = 0;
 
@@ -662,7 +657,7 @@ WebInspector.TextEditorDelegateForSourceFrame.prototype = {
 
     commitEditing: function()
     {
-        this._sourceFrame.commitEditing(this._sourceFrame._textModel.text());
+        this._sourceFrame.commitEditing(this._sourceFrame._textEditor.text());
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/TabbedPane.js b/Source/WebCore/inspector/front-end/TabbedPane.js
index 3a9d9d9a6..a279a1e3d 100644
--- a/Source/WebCore/inspector/front-end/TabbedPane.js
+++ b/Source/WebCore/inspector/front-end/TabbedPane.js
@@ -304,9 +304,14 @@ WebInspector.TabbedPane.prototype = {
         return dropDownContainer;
     },
 
+    _totalWidth: function()
+    {
+        return this._headerContentsElement.getBoundingClientRect().width;
+    },
+
     _updateTabsDropDown: function()
     {
-        var tabsToShowIndexes = this._tabsToShowIndexes(this._tabs, this._tabsHistory, this._headerContentsElement.offsetWidth, this._measuredDropDownButtonWidth);
+        var tabsToShowIndexes = this._tabsToShowIndexes(this._tabs, this._tabsHistory, this._totalWidth(), this._measuredDropDownButtonWidth);
 
         for (var i = 0; i < this._tabs.length; ++i) {
             if (this._tabs[i]._shown && tabsToShowIndexes.indexOf(i) === -1)
@@ -362,7 +367,7 @@ WebInspector.TabbedPane.prototype = {
     {
         this._dropDownButton.addStyleClass("measuring");
         this._headerContentsElement.appendChild(this._dropDownButton);
-        this._measuredDropDownButtonWidth = this._dropDownButton.offsetWidth;
+        this._measuredDropDownButtonWidth = this._dropDownButton.getBoundingClientRect().width;
         this._headerContentsElement.removeChild(this._dropDownButton);
         this._dropDownButton.removeStyleClass("measuring");
     },
@@ -373,8 +378,7 @@ WebInspector.TabbedPane.prototype = {
         for (var tabId in this._tabs)
             measuredWidths.push(this._tabs[tabId].measuredWidth);
         
-        const roundingError = 5;
-        var maxWidth = this._calculateMaxWidth(measuredWidths, this._headerContentsElement.offsetWidth - 5);
+        var maxWidth = this._calculateMaxWidth(measuredWidths, this._totalWidth());
         
         for (var tabId in this._tabs) {
             var tab = this._tabs[tabId];
@@ -657,7 +661,7 @@ WebInspector.TabbedPaneTab.prototype = {
     {
         var measuringTabElement = this._createTabElement(true);
         this._measureElement.appendChild(measuringTabElement);
-        this._measuredWidth = measuringTabElement.offsetWidth;
+        this._measuredWidth = measuringTabElement.getBoundingClientRect().width;
         this._measureElement.removeChild(measuringTabElement);
     },
 
diff --git a/Source/WebCore/inspector/front-end/TextEditor.js b/Source/WebCore/inspector/front-end/TextEditor.js
index fa6f4d209..b93e4e260 100644
--- a/Source/WebCore/inspector/front-end/TextEditor.js
+++ b/Source/WebCore/inspector/front-end/TextEditor.js
@@ -30,2667 +30,193 @@
  */
 
 /**
- * @extends {WebInspector.View}
- * @constructor
- * @param {WebInspector.TextEditorModel} textModel
- * @param {?string} url
- * @param {WebInspector.TextEditorDelegate} delegate
+ * @interface
  */
-WebInspector.TextEditor = function(textModel, url, delegate)
-{
-    WebInspector.View.call(this);
-    this.registerRequiredCSS("textEditor.css");
-
-    this._textModel = textModel;
-    this._textModel.addEventListener(WebInspector.TextEditorModel.Events.TextChanged, this._textChanged, this);
-    this._textModel.resetUndoStack();
-    this._delegate = delegate;
-    this._url = url;
-    this.element.className = "text-editor monospace";
-
-    var enterTextChangeMode = this._enterInternalTextChangeMode.bind(this);
-    var exitTextChangeMode = this._exitInternalTextChangeMode.bind(this);
-    var syncScrollListener = this._syncScroll.bind(this);
-    var syncDecorationsForLineListener = this._syncDecorationsForLine.bind(this);
-    var syncLineHeightListener = this._syncLineHeight.bind(this);
-    this._mainPanel = new WebInspector.TextEditorMainPanel(this._textModel, url, syncScrollListener, syncDecorationsForLineListener, enterTextChangeMode, exitTextChangeMode);
-    this._gutterPanel = new WebInspector.TextEditorGutterPanel(this._textModel, syncDecorationsForLineListener, syncLineHeightListener);
-
-    this._mainPanel.element.addEventListener("scroll", this._handleScrollChanged.bind(this), false);
-    this._mainPanel._container.addEventListener("focus", this._handleFocused.bind(this), false);
-
-    this.element.appendChild(this._mainPanel.element);
-    this.element.appendChild(this._gutterPanel.element);
-
-    // Forward mouse wheel events from the unscrollable gutter to the main panel.
-    function forwardWheelEvent(event)
-    {
-        var clone = document.createEvent("WheelEvent");
-        clone.initWebKitWheelEvent(event.wheelDeltaX, event.wheelDeltaY,
-                                   event.view,
-                                   event.screenX, event.screenY,
-                                   event.clientX, event.clientY,
-                                   event.ctrlKey, event.altKey, event.shiftKey, event.metaKey);
-        this._mainPanel.element.dispatchEvent(clone);
-    }
-    this._gutterPanel.element.addEventListener("mousewheel", forwardWheelEvent.bind(this), false);
-
-    this.element.addEventListener("keydown", this._handleKeyDown.bind(this), false);
-    this.element.addEventListener("contextmenu", this._contextMenu.bind(this), true);
-
-    this._registerShortcuts();
-}
+WebInspector.TextEditor = function() { };
 
 WebInspector.TextEditor.prototype = {
+
     /**
      * @param {string} mimeType
      */
-    set mimeType(mimeType)
-    {
-        this._mainPanel.mimeType = mimeType;
-    },
+    set mimeType(mimeType) { },
 
     /**
      * @param {boolean} readOnly
      */
-    setReadOnly: function(readOnly)
-    {
-        if (this._mainPanel.readOnly() === readOnly)
-            return;
-        this._mainPanel.setReadOnly(readOnly, this.isShowing());
-        WebInspector.markBeingEdited(this.element, !readOnly);
-    },
+    setReadOnly: function(readOnly) { },
 
     /**
      * @return {boolean}
      */
-    readOnly: function()
-    {
-        return this._mainPanel.readOnly();
-    },
-
-    /**
-     * @return {WebInspector.TextEditorModel}
-     */
-    get textModel()
-    {
-        return this._textModel;
-    },
+    readOnly: function() { },
 
     /**
      * @return {Element}
      */
-    defaultFocusedElement: function()
-    {
-        return this._mainPanel.defaultFocusedElement();
-    },
+    defaultFocusedElement: function() { },
 
     /**
      * @param {number} lineNumber
      */
-    revealLine: function(lineNumber)
-    {
-        this._mainPanel.revealLine(lineNumber);
-    },
+    revealLine: function(lineNumber) { },
 
     /**
      * @param {number} lineNumber
      * @param {string|Element} decoration
      */
-    addDecoration: function(lineNumber, decoration)
-    {
-        this._mainPanel.addDecoration(lineNumber, decoration);
-        this._gutterPanel.addDecoration(lineNumber, decoration);
-    },
+    addDecoration: function(lineNumber, decoration) { },
 
     /**
      * @param {number} lineNumber
      * @param {string|Element} decoration
      */
-    removeDecoration: function(lineNumber, decoration)
-    {
-        this._mainPanel.removeDecoration(lineNumber, decoration);
-        this._gutterPanel.removeDecoration(lineNumber, decoration);
-    },
+    removeDecoration: function(lineNumber, decoration) { },
 
     /**
      * @param {WebInspector.TextRange} range
      */
-    markAndRevealRange: function(range)
-    {
-        if (range)
-            this.setSelection(range);
-        this._mainPanel.markAndRevealRange(range);
-    },
+    markAndRevealRange: function(range) { },
 
     /**
      * @param {number} lineNumber
      */
-    highlightLine: function(lineNumber)
-    {
-        if (typeof lineNumber !== "number" || lineNumber < 0)
-            return;
+    highlightLine: function(lineNumber) { },
 
-        lineNumber = Math.min(lineNumber, this._textModel.linesCount - 1);
-        this._mainPanel.highlightLine(lineNumber);
-    },
-
-    clearLineHighlight: function()
-    {
-        this._mainPanel.clearLineHighlight();
-    },
-
-    freeCachedElements: function()
-    {
-        this._mainPanel.freeCachedElements();
-        this._gutterPanel.freeCachedElements();
-    },
+    clearLineHighlight: function() { },
 
     /**
      * @return {Array.<Element>}
      */
-    elementsToRestoreScrollPositionsFor: function()
-    {
-        return [this._mainPanel.element];
-    },
+    elementsToRestoreScrollPositionsFor: function() { },
 
     /**
      * @param {WebInspector.TextEditor} textEditor
      */
-    inheritScrollPositions: function(textEditor)
-    {
-        this._mainPanel.element._scrollTop = textEditor._mainPanel.element.scrollTop;
-        this._mainPanel.element._scrollLeft = textEditor._mainPanel.element.scrollLeft;
-    },
+    inheritScrollPositions: function(textEditor) { },
 
-    beginUpdates: function()
-    {
-        this._mainPanel.beginUpdates();
-        this._gutterPanel.beginUpdates();
-    },
+    beginUpdates: function() { },
 
-    endUpdates: function()
-    {
-        this._mainPanel.endUpdates();
-        this._gutterPanel.endUpdates();
-        this._updatePanelOffsets();
-    },
+    endUpdates: function() { },
 
-    onResize: function()
-    {
-        this._mainPanel.resize();
-        this._gutterPanel.resize();
-        this._updatePanelOffsets();
-    },
-
-    _textChanged: function(event)
-    {
-        if (!this._internalTextChangeMode)
-            this._textModel.resetUndoStack();
-        this._mainPanel.textChanged(event.data.oldRange, event.data.newRange);
-        this._gutterPanel.textChanged(event.data.oldRange, event.data.newRange);
-        this._updatePanelOffsets();
-    },
+    onResize: function() { },
 
     /**
      * @param {WebInspector.TextRange} range
      * @param {string} text
      * @return {WebInspector.TextRange}
      */
-    editRange: function(range, text)
-    {
-        this._enterInternalTextChangeMode();
-        this._textModel.markUndoableState();
-        var newRange = this._textModel.editRange(range, text);
-        this._exitInternalTextChangeMode(range, newRange);
-        return newRange;
-    },
-
-    _enterInternalTextChangeMode: function()
-    {
-        this._internalTextChangeMode = true;
-        this._delegate.beforeTextChanged();
-    },
-
-    /**
-     * @param {WebInspector.TextRange} oldRange
-     * @param {WebInspector.TextRange} newRange
-     */
-    _exitInternalTextChangeMode: function(oldRange, newRange)
-    {
-        this._internalTextChangeMode = false;
-        this._delegate.afterTextChanged(oldRange, newRange);
-    },
-
-    _updatePanelOffsets: function()
-    {
-        var lineNumbersWidth = this._gutterPanel.element.offsetWidth;
-        if (lineNumbersWidth)
-            this._mainPanel.element.style.setProperty("left", (lineNumbersWidth + 2) + "px");
-        else
-            this._mainPanel.element.style.removeProperty("left"); // Use default value set in CSS.
-    },
-
-    _syncScroll: function()
-    {
-        var mainElement = this._mainPanel.element;
-        var gutterElement = this._gutterPanel.element;
-        // Handle horizontal scroll bar at the bottom of the main panel.
-        this._gutterPanel.syncClientHeight(mainElement.clientHeight);
-        gutterElement.scrollTop = mainElement.scrollTop;
-    },
-
-    /**
-     * @param {number} lineNumber
-     */
-    _syncDecorationsForLine: function(lineNumber)
-    {
-        if (lineNumber >= this._textModel.linesCount)
-            return;
-
-        var mainChunk = this._mainPanel.chunkForLine(lineNumber);
-        if (mainChunk.linesCount === 1 && mainChunk.decorated) {
-            var gutterChunk = this._gutterPanel.makeLineAChunk(lineNumber);
-            var height = mainChunk.height;
-            if (height)
-                gutterChunk.element.style.setProperty("height", height + "px");
-            else
-                gutterChunk.element.style.removeProperty("height");
-        } else {
-            var gutterChunk = this._gutterPanel.chunkForLine(lineNumber);
-            if (gutterChunk.linesCount === 1)
-                gutterChunk.element.style.removeProperty("height");
-        }
-    },
-
-    /**
-     * @param {Element} gutterRow
-     */
-    _syncLineHeight: function(gutterRow)
-    {
-        if (this._lineHeightSynced)
-            return;
-        if (gutterRow && gutterRow.offsetHeight) {
-            // Force equal line heights for the child panels.
-            this.element.style.setProperty("line-height", gutterRow.offsetHeight + "px");
-            this._lineHeightSynced = true;
-        }
-    },
-
-    _registerShortcuts: function()
-    {
-        var keys = WebInspector.KeyboardShortcut.Keys;
-        var modifiers = WebInspector.KeyboardShortcut.Modifiers;
-
-        this._shortcuts = {};
-        var commitEditing = this._commitEditing.bind(this);
-        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("s", modifiers.CtrlOrMeta)] = commitEditing;
-
-        var handleEnterKey = this._mainPanel.handleEnterKey.bind(this._mainPanel);
-        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(keys.Enter.code, WebInspector.KeyboardShortcut.Modifiers.None)] = handleEnterKey;
-
-        var handleUndo = this._mainPanel.handleUndoRedo.bind(this._mainPanel, false);
-        var handleRedo = this._mainPanel.handleUndoRedo.bind(this._mainPanel, true);
-        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("z", modifiers.CtrlOrMeta)] = handleUndo;
-        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("z", modifiers.Shift | modifiers.CtrlOrMeta)] = handleRedo;
-
-        var handleTabKey = this._mainPanel.handleTabKeyPress.bind(this._mainPanel, false);
-        var handleShiftTabKey = this._mainPanel.handleTabKeyPress.bind(this._mainPanel, true);
-        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(keys.Tab.code)] = handleTabKey;
-        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(keys.Tab.code, modifiers.Shift)] = handleShiftTabKey;
-    },
-
-    _handleKeyDown: function(e)
-    {
-        if (this.readOnly())
-            return;
-
-        var shortcutKey = WebInspector.KeyboardShortcut.makeKeyFromEvent(e);
-        var handler = this._shortcuts[shortcutKey];
-        if (handler && handler())
-            e.consume(true);
-    },
-
-    _contextMenu: function(event)
-    {
-        var contextMenu = new WebInspector.ContextMenu();
-        var target = event.target.enclosingNodeOrSelfWithClass("webkit-line-number");
-        if (target)
-            this._delegate.populateLineGutterContextMenu(contextMenu, target.lineNumber);
-        else {
-            target = this._mainPanel._enclosingLineRowOrSelf(event.target);
-            this._delegate.populateTextAreaContextMenu(contextMenu, target && target.lineNumber);
-        }
-        contextMenu.show(event);
-    },
-
-    _commitEditing: function()
-    {
-        if (this.readOnly())
-            return false;
-
-        this._delegate.commitEditing();
-        if (this._url && WebInspector.fileManager.isURLSaved(this._url))
-            WebInspector.fileManager.save(this._url, this._textModel.text(), false);
-        return true;
-    },
-
-    _handleScrollChanged: function(event)
-    {
-        var visibleFrom = this._mainPanel.element.scrollTop;
-        var firstVisibleLineNumber = this._mainPanel._findFirstVisibleLineNumber(visibleFrom);
-        this._delegate.scrollChanged(firstVisibleLineNumber);
-    },
+    editRange: function(range, text) { },
 
     /**
      * @param {number} lineNumber
      */
-    scrollToLine: function(lineNumber)
-    {
-        this._mainPanel.scrollToLine(lineNumber);
-    },
-
-    _handleSelectionChange: function(event)
-    {
-        var textRange = this._mainPanel._getSelection();
-        if (textRange) {
-            // We do not restore selection after focus lost to avoid selection blinking. We restore only cursor position instead.
-            // FIXME: consider adding selection decoration to blurred editor.
-            this._lastSelection = WebInspector.TextRange.createFromLocation(textRange.endLine, textRange.endColumn);
-        }
-        this._delegate.selectionChanged(textRange);
-    },
+    scrollToLine: function(lineNumber) { },
 
     /**
      * @return {WebInspector.TextRange}
      */
-    selection: function(textRange)
-    {
-        return this._mainPanel._getSelection();
-    },
+    selection: function(textRange) { },
 
     /**
      * @return {WebInspector.TextRange?}
      */
-    lastSelection: function()
-    {
-        return this._lastSelection;
-    },
-
-    /**
-     * @param {WebInspector.TextRange} textRange
-     */
-    setSelection: function(textRange)
-    {
-        this._lastSelection = textRange;
-        if (this.element.isAncestor(document.activeElement))
-            this._mainPanel._restoreSelection(textRange);
-    },
-
-    wasShown: function()
-    {
-        if (!this.readOnly())
-            WebInspector.markBeingEdited(this.element, true);
-
-        this._boundSelectionChangeListener = this._handleSelectionChange.bind(this);
-        document.addEventListener("selectionchange", this._boundSelectionChangeListener, false);
-    },
-
-    _handleFocused: function()
-    {
-        if (this._lastSelection)
-            this.setSelection(this._lastSelection);
-    },
-
-    willHide: function()
-    {
-        document.removeEventListener("selectionchange", this._boundSelectionChangeListener, false);
-        delete this._boundSelectionChangeListener;
-
-        if (!this.readOnly())
-            WebInspector.markBeingEdited(this.element, false);
-    }
-}
-
-WebInspector.TextEditor.prototype.__proto__ = WebInspector.View.prototype;
-
-/**
- * @interface
- */
-WebInspector.TextEditorDelegate = function()
-{
-}
-
-WebInspector.TextEditorDelegate.prototype = {
-    beforeTextChanged: function() { },
-
-    /**
-     * @param {WebInspector.TextRange} oldRange
-     * @param {WebInspector.TextRange} newRange
-     */
-    afterTextChanged: function(oldRange, newRange) { },
-
-    commitEditing: function() { },
+    lastSelection: function() { },
 
     /**
      * @param {WebInspector.TextRange} textRange
      */
-    selectionChanged: function(textRange) { },
-
-    /**
-     * @param {number} lineNumber
-     */
-    scrollChanged: function(lineNumber) { },
-
-    /**
-     * @param {WebInspector.ContextMenu} contextMenu
-     * @param {number} lineNumber
-     */
-    populateLineGutterContextMenu: function(contextMenu, lineNumber) { },
-
-    /**
-     * @param {WebInspector.ContextMenu} contextMenu
-     * @param {number} lineNumber
-     */
-    populateTextAreaContextMenu: function(contextMenu, lineNumber) { }
-}
-
-/**
- * @constructor
- * @param {WebInspector.TextEditorModel} textModel
- */
-WebInspector.TextEditorChunkedPanel = function(textModel)
-{
-    this._textModel = textModel;
-
-    this._defaultChunkSize = 50;
-    this._paintCoalescingLevel = 0;
-    this._domUpdateCoalescingLevel = 0;
-}
-
-WebInspector.TextEditorChunkedPanel.prototype = {
-    /**
-     * @return {WebInspector.TextEditorModel}
-     */
-    get textModel()
-    {
-        return this._textModel;
-    },
-
-    /**
-     * @param {number} lineNumber
-     */
-    scrollToLine: function(lineNumber)
-    {
-        if (lineNumber >= this._textModel.linesCount)
-            return;
-
-        var chunk = this.makeLineAChunk(lineNumber);
-        this.element.scrollTop = chunk.offsetTop;
-    },
-
-    /**
-     * @param {number} lineNumber
-     */
-    revealLine: function(lineNumber)
-    {
-        if (lineNumber >= this._textModel.linesCount)
-            return;
-
-        var chunk = this.makeLineAChunk(lineNumber);
-        chunk.element.scrollIntoViewIfNeeded();
-    },
-
-    /**
-     * @param {number} lineNumber
-     * @param {string|Element} decoration
-     */
-    addDecoration: function(lineNumber, decoration)
-    {
-        if (lineNumber >= this._textModel.linesCount)
-            return;
-
-        var chunk = this.makeLineAChunk(lineNumber);
-        chunk.addDecoration(decoration);
-    },
-
-    /**
-     * @param {number} lineNumber
-     * @param {string|Element} decoration
-     */
-    removeDecoration: function(lineNumber, decoration)
-    {
-        if (lineNumber >= this._textModel.linesCount)
-            return;
-
-        var chunk = this.chunkForLine(lineNumber);
-        chunk.removeDecoration(decoration);
-    },
-
-    _buildChunks: function()
-    {
-        this.beginDomUpdates();
-
-        this._container.removeChildren();
-
-        this._textChunks = [];
-        for (var i = 0; i < this._textModel.linesCount; i += this._defaultChunkSize) {
-            var chunk = this._createNewChunk(i, i + this._defaultChunkSize);
-            this._textChunks.push(chunk);
-            this._container.appendChild(chunk.element);
-        }
-
-        this._repaintAll();
-
-        this.endDomUpdates();
-    },
+    setSelection: function(textRange) { },
 
     /**
-     * @param {number} lineNumber
+     * @param {string} text 
      */
-    makeLineAChunk: function(lineNumber)
-    {
-        var chunkNumber = this._chunkNumberForLine(lineNumber);
-        var oldChunk = this._textChunks[chunkNumber];
-
-        if (!oldChunk) {
-            console.error("No chunk for line number: " + lineNumber);
-            return;
-        }
-
-        if (oldChunk.linesCount === 1)
-            return oldChunk;
-
-        return this._splitChunkOnALine(lineNumber, chunkNumber, true);
-    },
+    setText: function(text) { },
 
     /**
-     * @param {number} lineNumber
-     * @param {number} chunkNumber
-     * @param {boolean=} createSuffixChunk
+     * @return {string}
      */
-    _splitChunkOnALine: function(lineNumber, chunkNumber, createSuffixChunk)
-    {
-        this.beginDomUpdates();
-
-        var oldChunk = this._textChunks[chunkNumber];
-        var wasExpanded = oldChunk.expanded;
-        oldChunk.expanded = false;
-
-        var insertIndex = chunkNumber + 1;
-
-        // Prefix chunk.
-        if (lineNumber > oldChunk.startLine) {
-            var prefixChunk = this._createNewChunk(oldChunk.startLine, lineNumber);
-            prefixChunk.readOnly = oldChunk.readOnly;
-            this._textChunks.splice(insertIndex++, 0, prefixChunk);
-            this._container.insertBefore(prefixChunk.element, oldChunk.element);
-        }
-
-        // Line chunk.
-        var endLine = createSuffixChunk ? lineNumber + 1 : oldChunk.startLine + oldChunk.linesCount;
-        var lineChunk = this._createNewChunk(lineNumber, endLine);
-        lineChunk.readOnly = oldChunk.readOnly;
-        this._textChunks.splice(insertIndex++, 0, lineChunk);
-        this._container.insertBefore(lineChunk.element, oldChunk.element);
-
-        // Suffix chunk.
-        if (oldChunk.startLine + oldChunk.linesCount > endLine) {
-            var suffixChunk = this._createNewChunk(endLine, oldChunk.startLine + oldChunk.linesCount);
-            suffixChunk.readOnly = oldChunk.readOnly;
-            this._textChunks.splice(insertIndex, 0, suffixChunk);
-            this._container.insertBefore(suffixChunk.element, oldChunk.element);
-        }
-
-        // Remove enclosing chunk.
-        this._textChunks.splice(chunkNumber, 1);
-        this._container.removeChild(oldChunk.element);
-
-        if (wasExpanded) {
-            if (prefixChunk)
-                prefixChunk.expanded = true;
-            lineChunk.expanded = true;
-            if (suffixChunk)
-                suffixChunk.expanded = true;
-        }
-
-        this.endDomUpdates();
-
-        return lineChunk;
-    },
-
-    _scroll: function()
-    {
-        this._scheduleRepaintAll();
-        if (this._syncScrollListener)
-            this._syncScrollListener();
-    },
-
-    _scheduleRepaintAll: function()
-    {
-        if (this._repaintAllTimer)
-            clearTimeout(this._repaintAllTimer);
-        this._repaintAllTimer = setTimeout(this._repaintAll.bind(this), 50);
-    },
-
-    beginUpdates: function()
-    {
-        this._paintCoalescingLevel++;
-    },
-
-    endUpdates: function()
-    {
-        this._paintCoalescingLevel--;
-        if (!this._paintCoalescingLevel)
-            this._repaintAll();
-    },
-
-    beginDomUpdates: function()
-    {
-        this._domUpdateCoalescingLevel++;
-    },
-
-    endDomUpdates: function()
-    {
-        this._domUpdateCoalescingLevel--;
-    },
+    text: function() { },
 
     /**
-     * @param {number} lineNumber
+     * @return {WebInspector.TextRange}
      */
-    _chunkNumberForLine: function(lineNumber)
-    {
-        function compareLineNumbers(value, chunk)
-        {
-            return value < chunk.startLine ? -1 : 1;
-        }
-        var insertBefore = insertionIndexForObjectInListSortedByFunction(lineNumber, this._textChunks, compareLineNumbers);
-        return insertBefore - 1;
-    },
+    range: function() { },
 
     /**
      * @param {number} lineNumber
+     * @return {string}
      */
-    chunkForLine: function(lineNumber)
-    {
-        return this._textChunks[this._chunkNumberForLine(lineNumber)];
-    },
-
-    /**
-     * @param {number} visibleFrom
-     */
-    _findFirstVisibleChunkNumber: function(visibleFrom)
-    {
-        function compareOffsetTops(value, chunk)
-        {
-            return value < chunk.offsetTop ? -1 : 1;
-        }
-        var insertBefore = insertionIndexForObjectInListSortedByFunction(visibleFrom, this._textChunks, compareOffsetTops);
-        return insertBefore - 1;
-    },
+    line: function(lineNumber) { },
 
     /**
-     * @param {number} visibleFrom
-     * @param {number} visibleTo
+     * @return {number}
      */
-    _findVisibleChunks: function(visibleFrom, visibleTo)
-    {
-        var from = this._findFirstVisibleChunkNumber(visibleFrom);
-        for (var to = from + 1; to < this._textChunks.length; ++to) {
-            if (this._textChunks[to].offsetTop >= visibleTo)
-                break;
-        }
-        return { start: from, end: to };
-    },
+    get linesCount() { },
 
     /**
-     * @param {number} visibleFrom
+     * @param {number} line
+     * @param {string} name  
+     * @param {Object?} value  
      */
-    _findFirstVisibleLineNumber: function(visibleFrom)
-    {
-        var chunk = this._textChunks[this._findFirstVisibleChunkNumber(visibleFrom)];
-        if (!chunk.expanded)
-            return chunk.startLine;
-
-        var lineNumbers = [];
-        for (var i = 0; i < chunk.linesCount; ++i) {
-            lineNumbers.push(chunk.startLine + i);
-        }
-
-        function compareLineRowOffsetTops(value, lineNumber)
-        {
-            var lineRow = chunk.getExpandedLineRow(lineNumber);
-            return value < lineRow.offsetTop ? -1 : 1;
-        }
-        var insertBefore = insertionIndexForObjectInListSortedByFunction(visibleFrom, lineNumbers, compareLineRowOffsetTops);
-        return lineNumbers[insertBefore - 1];
-    },
-
-    _repaintAll: function()
-    {
-        delete this._repaintAllTimer;
-
-        if (this._paintCoalescingLevel || this._dirtyLines)
-            return;
-
-        var visibleFrom = this.element.scrollTop;
-        var visibleTo = this.element.scrollTop + this.element.clientHeight;
-
-        if (visibleTo) {
-            var result = this._findVisibleChunks(visibleFrom, visibleTo);
-            this._expandChunks(result.start, result.end);
-        }
-    },
+    setAttribute: function(line, name, value) { },
 
     /**
-     * @param {number} fromIndex
-     * @param {number} toIndex
+     * @param {number} line
+     * @param {string} name  
+     * @return {Object|null} value  
      */
-    _expandChunks: function(fromIndex, toIndex)
-    {
-        // First collapse chunks to collect the DOM elements into a cache to reuse them later.
-        for (var i = 0; i < fromIndex; ++i)
-            this._textChunks[i].expanded = false;
-        for (var i = toIndex; i < this._textChunks.length; ++i)
-            this._textChunks[i].expanded = false;
-        for (var i = fromIndex; i < toIndex; ++i)
-            this._textChunks[i].expanded = true;
-    },
+    getAttribute: function(line, name) { },
 
     /**
-     * @param {Element} firstElement
-     * @param {Element=} lastElement
+     * @param {number} line
+     * @param {string} name
      */
-    _totalHeight: function(firstElement, lastElement)
-    {
-        lastElement = (lastElement || firstElement).nextElementSibling;
-        if (lastElement)
-            return lastElement.offsetTop - firstElement.offsetTop;
-
-        var offsetParent = firstElement.offsetParent;
-        if (offsetParent && offsetParent.scrollHeight > offsetParent.clientHeight)
-            return offsetParent.scrollHeight - firstElement.offsetTop;
+    removeAttribute: function(line, name) { },
 
-        var total = 0;
-        while (firstElement && firstElement !== lastElement) {
-            total += firstElement.offsetHeight;
-            firstElement = firstElement.nextElementSibling;
-        }
-        return total;
-    },
+    wasShown: function() { },
 
-    resize: function()
-    {
-        this._repaintAll();
-    }
+    willHide: function() { }
 }
 
 /**
- * @constructor
- * @extends {WebInspector.TextEditorChunkedPanel}
- * @param {WebInspector.TextEditorModel} textModel
+ * @interface
  */
-WebInspector.TextEditorGutterPanel = function(textModel, syncDecorationsForLineListener, syncLineHeightListener)
+WebInspector.TextEditorDelegate = function()
 {
-    WebInspector.TextEditorChunkedPanel.call(this, textModel);
-
-    this._syncDecorationsForLineListener = syncDecorationsForLineListener;
-    this._syncLineHeightListener = syncLineHeightListener;
-
-    this.element = document.createElement("div");
-    this.element.className = "text-editor-lines";
-
-    this._container = document.createElement("div");
-    this._container.className = "inner-container";
-    this.element.appendChild(this._container);
-
-    this.element.addEventListener("scroll", this._scroll.bind(this), false);
-
-    this.freeCachedElements();
-    this._buildChunks();
-    this._decorations = {};
 }
 
-WebInspector.TextEditorGutterPanel.prototype = {
-    freeCachedElements: function()
-    {
-        this._cachedRows = [];
-    },
-
-    /**
-     * @param {number} startLine
-     * @param {number} endLine
-     */
-    _createNewChunk: function(startLine, endLine)
-    {
-        return new WebInspector.TextEditorGutterChunk(this, startLine, endLine);
-    },
+WebInspector.TextEditorDelegate.prototype = {
+    beforeTextChanged: function() { },
 
     /**
      * @param {WebInspector.TextRange} oldRange
      * @param {WebInspector.TextRange} newRange
      */
-    textChanged: function(oldRange, newRange)
-    {
-        this.beginDomUpdates();
-
-        var linesDiff = newRange.linesCount - oldRange.linesCount;
-        if (linesDiff) {
-            // Remove old chunks (if needed).
-            for (var chunkNumber = this._textChunks.length - 1; chunkNumber >= 0 ; --chunkNumber) {
-                var chunk = this._textChunks[chunkNumber];
-                if (chunk.startLine + chunk.linesCount <= this._textModel.linesCount)
-                    break;
-                chunk.expanded = false;
-                this._container.removeChild(chunk.element);
-            }
-            this._textChunks.length = chunkNumber + 1;
-
-            // Add new chunks (if needed).
-            var totalLines = 0;
-            if (this._textChunks.length) {
-                var lastChunk = this._textChunks[this._textChunks.length - 1];
-                totalLines = lastChunk.startLine + lastChunk.linesCount;
-            }
-
-            for (var i = totalLines; i < this._textModel.linesCount; i += this._defaultChunkSize) {
-                var chunk = this._createNewChunk(i, i + this._defaultChunkSize);
-                this._textChunks.push(chunk);
-                this._container.appendChild(chunk.element);
-            }
-
-            // Shift decorations if necessary
-            for (var lineNumber in this._decorations) {
-                lineNumber = parseInt(lineNumber, 10);
-
-                // Do not move decorations before the start position.
-                if (lineNumber < oldRange.startLine)
-                    continue;
-                // Decorations follow the first character of line.
-                if (lineNumber === oldRange.startLine && oldRange.startColumn)
-                    continue;
-
-                var lineDecorationsCopy = this._decorations[lineNumber].slice();
-                for (var i = 0; i < lineDecorationsCopy.length; ++i) {
-                    var decoration = lineDecorationsCopy[i];
-                    this.removeDecoration(lineNumber, decoration);
-
-                    // Do not restore the decorations before the end position.
-                    if (lineNumber < oldRange.endLine)
-                        continue;
-
-                    this.addDecoration(lineNumber + linesDiff, decoration);
-                }
-            }
-
-            this._repaintAll();
-        } else {
-            // Decorations may have been removed, so we may have to sync those lines.
-            var chunkNumber = this._chunkNumberForLine(newRange.startLine);
-            var chunk = this._textChunks[chunkNumber];
-            while (chunk && chunk.startLine <= newRange.endLine) {
-                if (chunk.linesCount === 1)
-                    this._syncDecorationsForLineListener(chunk.startLine);
-                chunk = this._textChunks[++chunkNumber];
-            }
-        }
-
-        this.endDomUpdates();
-    },
-
-    /**
-     * @param {number} clientHeight
-     */
-    syncClientHeight: function(clientHeight)
-    {
-        if (this.element.offsetHeight > clientHeight)
-            this._container.style.setProperty("padding-bottom", (this.element.offsetHeight - clientHeight) + "px");
-        else
-            this._container.style.removeProperty("padding-bottom");
-    },
-
-    /**
-     * @param {number} lineNumber
-     * @param {string|Element} decoration
-     */
-    addDecoration: function(lineNumber, decoration)
-    {
-        WebInspector.TextEditorChunkedPanel.prototype.addDecoration.call(this, lineNumber, decoration);
-        var decorations = this._decorations[lineNumber];
-        if (!decorations) {
-            decorations = [];
-            this._decorations[lineNumber] = decorations;
-        }
-        decorations.push(decoration);
-    },
-
-    /**
-     * @param {number} lineNumber
-     * @param {string|Element} decoration
-     */
-    removeDecoration: function(lineNumber, decoration)
-    {
-        WebInspector.TextEditorChunkedPanel.prototype.removeDecoration.call(this, lineNumber, decoration);
-        var decorations = this._decorations[lineNumber];
-        if (decorations) {
-            decorations.remove(decoration);
-            if (!decorations.length)
-                delete this._decorations[lineNumber];
-        }
-    }
-}
-
-WebInspector.TextEditorGutterPanel.prototype.__proto__ = WebInspector.TextEditorChunkedPanel.prototype;
-
-/**
- * @constructor
- */
-WebInspector.TextEditorGutterChunk = function(textEditor, startLine, endLine)
-{
-    this._textEditor = textEditor;
-    this._textModel = textEditor._textModel;
-
-    this.startLine = startLine;
-    endLine = Math.min(this._textModel.linesCount, endLine);
-    this.linesCount = endLine - startLine;
-
-    this._expanded = false;
-
-    this.element = document.createElement("div");
-    this.element.lineNumber = startLine;
-    this.element.className = "webkit-line-number";
-
-    if (this.linesCount === 1) {
-        // Single line chunks are typically created for decorations. Host line number in
-        // the sub-element in order to allow flexible border / margin management.
-        var innerSpan = document.createElement("span");
-        innerSpan.className = "webkit-line-number-inner";
-        innerSpan.textContent = startLine + 1;
-        var outerSpan = document.createElement("div");
-        outerSpan.className = "webkit-line-number-outer";
-        outerSpan.appendChild(innerSpan);
-        this.element.appendChild(outerSpan);
-    } else {
-        var lineNumbers = [];
-        for (var i = startLine; i < endLine; ++i)
-            lineNumbers.push(i + 1);
-        this.element.textContent = lineNumbers.join("\n");
-    }
-}
-
-WebInspector.TextEditorGutterChunk.prototype = {
-    /**
-     * @param {string} decoration
-     */
-    addDecoration: function(decoration)
-    {
-        this._textEditor.beginDomUpdates();
-        if (typeof decoration === "string")
-            this.element.addStyleClass(decoration);
-        this._textEditor.endDomUpdates();
-    },
-
-    /**
-     * @param {string} decoration
-     */
-    removeDecoration: function(decoration)
-    {
-        this._textEditor.beginDomUpdates();
-        if (typeof decoration === "string")
-            this.element.removeStyleClass(decoration);
-        this._textEditor.endDomUpdates();
-    },
-
-    /**
-     * @return {boolean}
-     */
-    get expanded()
-    {
-        return this._expanded;
-    },
-
-    set expanded(expanded)
-    {
-        if (this.linesCount === 1)
-            this._textEditor._syncDecorationsForLineListener(this.startLine);
-
-        if (this._expanded === expanded)
-            return;
-
-        this._expanded = expanded;
-
-        if (this.linesCount === 1)
-            return;
-
-        this._textEditor.beginDomUpdates();
-
-        if (expanded) {
-            this._expandedLineRows = [];
-            var parentElement = this.element.parentElement;
-            for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
-                var lineRow = this._createRow(i);
-                parentElement.insertBefore(lineRow, this.element);
-                this._expandedLineRows.push(lineRow);
-            }
-            parentElement.removeChild(this.element);
-            this._textEditor._syncLineHeightListener(this._expandedLineRows[0]);
-        } else {
-            var elementInserted = false;
-            for (var i = 0; i < this._expandedLineRows.length; ++i) {
-                var lineRow = this._expandedLineRows[i];
-                var parentElement = lineRow.parentElement;
-                if (parentElement) {
-                    if (!elementInserted) {
-                        elementInserted = true;
-                        parentElement.insertBefore(this.element, lineRow);
-                    }
-                    parentElement.removeChild(lineRow);
-                }
-                this._textEditor._cachedRows.push(lineRow);
-            }
-            delete this._expandedLineRows;
-        }
-
-        this._textEditor.endDomUpdates();
-    },
+    afterTextChanged: function(oldRange, newRange) { },
 
-    /**
-     * @return {number}
-     */
-    get height()
-    {
-        if (!this._expandedLineRows)
-            return this._textEditor._totalHeight(this.element);
-        return this._textEditor._totalHeight(this._expandedLineRows[0], this._expandedLineRows[this._expandedLineRows.length - 1]);
-    },
+    commitEditing: function() { },
 
     /**
-     * @return {number}
+     * @param {WebInspector.TextRange} textRange
      */
-    get offsetTop()
-    {
-        return (this._expandedLineRows && this._expandedLineRows.length) ? this._expandedLineRows[0].offsetTop : this.element.offsetTop;
-    },
+    selectionChanged: function(textRange) { },
 
     /**
      * @param {number} lineNumber
-     * @return {Element}
-     */
-    _createRow: function(lineNumber)
-    {
-        var lineRow = this._textEditor._cachedRows.pop() || document.createElement("div");
-        lineRow.lineNumber = lineNumber;
-        lineRow.className = "webkit-line-number";
-        lineRow.textContent = lineNumber + 1;
-        return lineRow;
-    }
-}
-
-/**
- * @constructor
- * @extends {WebInspector.TextEditorChunkedPanel}
- * @param {WebInspector.TextEditorModel} textModel
- * @param {?string} url
- */
-WebInspector.TextEditorMainPanel = function(textModel, url, syncScrollListener, syncDecorationsForLineListener, enterTextChangeMode, exitTextChangeMode)
-{
-    WebInspector.TextEditorChunkedPanel.call(this, textModel);
-
-    this._syncScrollListener = syncScrollListener;
-    this._syncDecorationsForLineListener = syncDecorationsForLineListener;
-    this._enterTextChangeMode = enterTextChangeMode;
-    this._exitTextChangeMode = exitTextChangeMode;
-
-    this._url = url;
-    this._highlighter = new WebInspector.TextEditorHighlighter(textModel, this._highlightDataReady.bind(this));
-    this._readOnly = true;
-
-    this.element = document.createElement("div");
-    this.element.className = "text-editor-contents";
-    this.element.tabIndex = 0;
-
-    this._container = document.createElement("div");
-    this._container.className = "inner-container";
-    this._container.tabIndex = 0;
-    this.element.appendChild(this._container);
-
-    this.element.addEventListener("scroll", this._scroll.bind(this), false);
-    this.element.addEventListener("focus", this._handleElementFocus.bind(this), false);
-
-    // In WebKit the DOMNodeRemoved event is fired AFTER the node is removed, thus it should be
-    // attached to all DOM nodes that we want to track. Instead, we attach the DOMNodeRemoved
-    // listeners only on the line rows, and use DOMSubtreeModified to track node removals inside
-    // the line rows. For more info see: https://bugs.webkit.org/show_bug.cgi?id=55666
-    //
-    // OPTIMIZATION. It is very expensive to listen to the DOM mutation events, thus we remove the
-    // listeners whenever we do any internal DOM manipulations (such as expand/collapse line rows)
-    // and set the listeners back when we are finished.
-    this._handleDOMUpdatesCallback = this._handleDOMUpdates.bind(this);
-    this._container.addEventListener("DOMCharacterDataModified", this._handleDOMUpdatesCallback, false);
-    this._container.addEventListener("DOMNodeInserted", this._handleDOMUpdatesCallback, false);
-    this._container.addEventListener("DOMSubtreeModified", this._handleDOMUpdatesCallback, false);
-
-    this.freeCachedElements();
-    this._buildChunks();
-}
-
-WebInspector.TextEditorMainPanel.prototype = {
-    /**
-     * @param {string} mimeType
-     */
-    set mimeType(mimeType)
-    {
-        this._highlighter.mimeType = mimeType;
-    },
-
-    /**
-     * @param {boolean} readOnly
-     * @param {boolean} requestFocus
-     */
-    setReadOnly: function(readOnly, requestFocus)
-    {
-        if (this._readOnly === readOnly)
-            return;
-
-        this.beginDomUpdates();
-        this._readOnly = readOnly;
-        if (this._readOnly)
-            this._container.removeStyleClass("text-editor-editable");
-        else {
-            this._container.addStyleClass("text-editor-editable");
-            if (requestFocus)
-                this._updateSelectionOnStartEditing();
-        }
-        this.endDomUpdates();
-    },
-
-    /**
-     * @return {boolean}
-     */
-    readOnly: function()
-    {
-        return this._readOnly;
-    },
-
-    _handleElementFocus: function()
-    {
-        if (!this._readOnly)
-            this._container.focus();
-    },
-
-    /**
-     * @return {Element}
-     */
-    defaultFocusedElement: function()
-    {
-        if (this._readOnly)
-            return this.element;
-        return this._container;
-    },
-
-    _updateSelectionOnStartEditing: function()
-    {
-        // focus() needs to go first for the case when the last selection was inside the editor and
-        // the "Edit" button was clicked. In this case we bail at the check below, but the
-        // editor does not receive the focus, thus "Esc" does not cancel editing until at least
-        // one change has been made to the editor contents.
-        this._container.focus();
-        var selection = window.getSelection();
-        if (selection.rangeCount) {
-            var commonAncestorContainer = selection.getRangeAt(0).commonAncestorContainer;
-            if (this._container.isSelfOrAncestor(commonAncestorContainer))
-                return;
-        }
-
-        selection.removeAllRanges();
-        var range = document.createRange();
-        range.setStart(this._container, 0);
-        range.setEnd(this._container, 0);
-        selection.addRange(range);
-    },
-
-    /**
-     * @param {number} startLine
-     * @param {number} endLine
-     */
-    setEditableRange: function(startLine, endLine)
-    {
-        this.beginDomUpdates();
-
-        var firstChunkNumber = this._chunkNumberForLine(startLine);
-        var firstChunk = this._textChunks[firstChunkNumber];
-        if (firstChunk.startLine !== startLine) {
-            this._splitChunkOnALine(startLine, firstChunkNumber);
-            firstChunkNumber += 1;
-        }
-
-        var lastChunkNumber = this._textChunks.length;
-        if (endLine !== this._textModel.linesCount) {
-            lastChunkNumber = this._chunkNumberForLine(endLine);
-            var lastChunk = this._textChunks[lastChunkNumber];
-            if (lastChunk && lastChunk.startLine !== endLine) {
-                this._splitChunkOnALine(endLine, lastChunkNumber);
-                lastChunkNumber += 1;
-            }
-        }
-
-        for (var chunkNumber = 0; chunkNumber < firstChunkNumber; ++chunkNumber)
-            this._textChunks[chunkNumber].readOnly = true;
-        for (var chunkNumber = firstChunkNumber; chunkNumber < lastChunkNumber; ++chunkNumber)
-            this._textChunks[chunkNumber].readOnly = false;
-        for (var chunkNumber = lastChunkNumber; chunkNumber < this._textChunks.length; ++chunkNumber)
-            this._textChunks[chunkNumber].readOnly = true;
-
-        this.endDomUpdates();
-    },
-
-    clearEditableRange: function()
-    {
-        for (var chunkNumber = 0; chunkNumber < this._textChunks.length; ++chunkNumber)
-            this._textChunks[chunkNumber].readOnly = false;
-    },
-
-    /**
-     * @param {WebInspector.TextRange} range
      */
-    markAndRevealRange: function(range)
-    {
-        if (this._rangeToMark) {
-            var markedLine = this._rangeToMark.startLine;
-            delete this._rangeToMark;
-            // Remove the marked region immediately.
-            if (!this._dirtyLines) {
-                this.beginDomUpdates();
-                var chunk = this.chunkForLine(markedLine);
-                var wasExpanded = chunk.expanded;
-                chunk.expanded = false;
-                chunk.updateCollapsedLineRow();
-                chunk.expanded = wasExpanded;
-                this.endDomUpdates();
-            } else
-                this._paintLines(markedLine, markedLine + 1);
-        }
-
-        if (range) {
-            this._rangeToMark = range;
-            this.revealLine(range.startLine);
-            var chunk = this.makeLineAChunk(range.startLine);
-            this._paintLine(chunk.element);
-            if (this._markedRangeElement)
-                this._markedRangeElement.scrollIntoViewIfNeeded();
-        }
-        delete this._markedRangeElement;
-    },
+    scrollChanged: function(lineNumber) { },
 
     /**
+     * @param {WebInspector.ContextMenu} contextMenu
      * @param {number} lineNumber
      */
-    highlightLine: function(lineNumber)
-    {
-        this.clearLineHighlight();
-        this._highlightedLine = lineNumber;
-        this.revealLine(lineNumber);
-
-        if (!this._readOnly)
-            this._restoreSelection(WebInspector.TextRange.createFromLocation(lineNumber, 0), false);
-
-        this.addDecoration(lineNumber, "webkit-highlighted-line");
-    },
-
-    clearLineHighlight: function()
-    {
-        if (typeof this._highlightedLine === "number") {
-            this.removeDecoration(this._highlightedLine, "webkit-highlighted-line");
-            delete this._highlightedLine;
-        }
-    },
-
-    freeCachedElements: function()
-    {
-        this._cachedSpans = [];
-        this._cachedTextNodes = [];
-        this._cachedRows = [];
-    },
-
-    /**
-     * @param {boolean} redo
-     */
-    handleUndoRedo: function(redo)
-    {
-        if (this._dirtyLines)
-            return false;
-
-        this.beginUpdates();
-
-        function before()
-        {
-            this._enterTextChangeMode();
-        }
-
-        function after(oldRange, newRange)
-        {
-            this._exitTextChangeMode(oldRange, newRange);
-        }
-
-        var range = redo ? this._textModel.redo(before.bind(this), after.bind(this)) : this._textModel.undo(before.bind(this), after.bind(this));
-
-        this.endUpdates();
-
-        // Restore location post-repaint.
-        if (range)
-            this._restoreSelection(range, true);
-
-        return true;
-    },
-
-    /**
-     * @param {boolean} shiftKey
-     */
-    handleTabKeyPress: function(shiftKey)
-    {
-        if (this._dirtyLines)
-            return false;
-
-        var selection = this._getSelection();
-        if (!selection)
-            return false;
-
-        var range = selection.normalize();
-
-        this.beginUpdates();
-        this._enterTextChangeMode();
-
-        var newRange;
-        var rangeWasEmpty = range.isEmpty();
-        if (shiftKey)
-            newRange = this._unindentLines(range);
-        else {
-            if (rangeWasEmpty)
-                newRange = this._editRange(range, WebInspector.settings.textEditorIndent.get());
-            else
-                newRange = this._indentLines(range);
-        }
-
-        this._exitTextChangeMode(range, newRange);
-        this.endUpdates();
-        if (rangeWasEmpty)
-            newRange.startColumn = newRange.endColumn;
-        this._restoreSelection(newRange, true);
-        return true;
-    },
-
-    /**
-     * @param {WebInspector.TextRange} range
-     */
-    _indentLines: function(range)
-    {
-        var indent = WebInspector.settings.textEditorIndent.get();
-
-        if (this._lastEditedRange)
-            this._textModel.markUndoableState();
-
-        var newRange = range.clone();
-
-        // Do not change a selection start position when it is at the beginning of a line
-        if (range.startColumn)
-            newRange.startColumn += indent.length;
-
-        var indentEndLine = range.endLine;
-        if (range.endColumn)
-            newRange.endColumn += indent.length;
-        else
-            indentEndLine--;
-
-        for (var lineNumber = range.startLine; lineNumber <= indentEndLine; lineNumber++)
-            this._textModel.editRange(WebInspector.TextRange.createFromLocation(lineNumber, 0), indent);
-
-        this._lastEditedRange = newRange;
-
-        return newRange;
-    },
-
-    /**
-     * @param {WebInspector.TextRange} range
-     */
-    _unindentLines: function(range)
-    {
-        if (this._lastEditedRange)
-            this._textModel.markUndoableState();
-
-        var indent = WebInspector.settings.textEditorIndent.get();
-        var indentLength = indent === WebInspector.TextEditorModel.Indent.TabCharacter ? 4 : indent.length;
-        var lineIndentRegex = new RegExp("^ {1," + indentLength + "}");
-        var newRange = range.clone();
-
-        var indentEndLine = range.endLine;
-        if (!range.endColumn)
-            indentEndLine--;
-
-        for (var lineNumber = range.startLine; lineNumber <= indentEndLine; lineNumber++) {
-            var line = this._textModel.line(lineNumber);
-            var firstCharacter = line.charAt(0);
-            var lineIndentLength;
-
-            if (firstCharacter === " ")
-                lineIndentLength = line.match(lineIndentRegex)[0].length;
-            else if (firstCharacter === "\t")
-                lineIndentLength = 1;
-            else
-                continue;
-
-            this._textModel.editRange(new WebInspector.TextRange(lineNumber, 0, lineNumber, lineIndentLength), "");
-
-            if (lineNumber === range.startLine)
-                newRange.startColumn = Math.max(0, newRange.startColumn - lineIndentLength);
-        }
-
-        if (lineIndentLength)
-            newRange.endColumn = Math.max(0, newRange.endColumn - lineIndentLength);
-
-        this._lastEditedRange = newRange;
-
-        return newRange;
-    },
-
-    handleEnterKey: function()
-    {
-        if (this._dirtyLines)
-            return false;
-
-        var range = this._getSelection();
-        if (!range)
-            return false;
-
-        range = range.normalize();
-
-        if (range.endColumn === 0)
-            return false;
-
-        var line = this._textModel.line(range.startLine);
-        var linePrefix = line.substring(0, range.startColumn);
-        var indentMatch = linePrefix.match(/^\s+/);
-        var currentIndent = indentMatch ? indentMatch[0] : "";
-
-        var textEditorIndent = WebInspector.settings.textEditorIndent.get();
-        var indent = WebInspector.TextEditorModel.endsWithBracketRegex.test(linePrefix) ? currentIndent + textEditorIndent : currentIndent;
-
-        if (!indent)
-            return false;
-
-        this.beginUpdates();
-        this._enterTextChangeMode();
-
-        var lineBreak = this._textModel.lineBreak;
-        var newRange;
-        if (range.isEmpty() && line.substr(range.endColumn - 1, 2) === '{}') {
-            // {|}
-            // becomes
-            // {
-            //     |
-            // }
-            newRange = this._editRange(range, lineBreak + indent + lineBreak + currentIndent);
-            newRange.endLine--;
-            newRange.endColumn += textEditorIndent.length;
-        } else
-            newRange = this._editRange(range, lineBreak + indent);
-
-        this._exitTextChangeMode(range, newRange);
-        this.endUpdates();
-        this._restoreSelection(newRange.collapseToEnd(), true);
-
-        return true;
-    },
+    populateLineGutterContextMenu: function(contextMenu, lineNumber) { },
 
     /**
+     * @param {WebInspector.ContextMenu} contextMenu
      * @param {number} lineNumber
-     * @param {number} chunkNumber
-     * @param {boolean=} createSuffixChunk
-     */
-    _splitChunkOnALine: function(lineNumber, chunkNumber, createSuffixChunk)
-    {
-        var selection = this._getSelection();
-        var chunk = WebInspector.TextEditorChunkedPanel.prototype._splitChunkOnALine.call(this, lineNumber, chunkNumber, createSuffixChunk);
-        this._restoreSelection(selection);
-        return chunk;
-    },
-
-    beginDomUpdates: function()
-    {
-        WebInspector.TextEditorChunkedPanel.prototype.beginDomUpdates.call(this);
-        if (this._domUpdateCoalescingLevel === 1) {
-            this._container.removeEventListener("DOMCharacterDataModified", this._handleDOMUpdatesCallback, false);
-            this._container.removeEventListener("DOMNodeInserted", this._handleDOMUpdatesCallback, false);
-            this._container.removeEventListener("DOMSubtreeModified", this._handleDOMUpdatesCallback, false);
-        }
-    },
-
-    endDomUpdates: function()
-    {
-        WebInspector.TextEditorChunkedPanel.prototype.endDomUpdates.call(this);
-        if (this._domUpdateCoalescingLevel === 0) {
-            this._container.addEventListener("DOMCharacterDataModified", this._handleDOMUpdatesCallback, false);
-            this._container.addEventListener("DOMNodeInserted", this._handleDOMUpdatesCallback, false);
-            this._container.addEventListener("DOMSubtreeModified", this._handleDOMUpdatesCallback, false);
-        }
-    },
-
-    /**
-     * @param {Element} lineRow
-     * @param {boolean} enable
-     */
-    _enableDOMNodeRemovedListener: function(lineRow, enable)
-    {
-        if (enable)
-            lineRow.addEventListener("DOMNodeRemoved", this._handleDOMUpdatesCallback, false);
-        else
-            lineRow.removeEventListener("DOMNodeRemoved", this._handleDOMUpdatesCallback, false);
-    },
-
-    _buildChunks: function()
-    {
-        for (var i = 0; i < this._textModel.linesCount; ++i)
-            this._textModel.removeAttribute(i, "highlight");
-
-        WebInspector.TextEditorChunkedPanel.prototype._buildChunks.call(this);
-    },
-
-    /**
-     * @param {number} startLine
-     * @param {number} endLine
-     */
-    _createNewChunk: function(startLine, endLine)
-    {
-        return new WebInspector.TextEditorMainChunk(this, startLine, endLine);
-    },
-
-    /**
-     * @param {number} fromIndex
-     * @param {number} toIndex
-     */
-    _expandChunks: function(fromIndex, toIndex)
-    {
-        var lastChunk = this._textChunks[toIndex - 1];
-        var lastVisibleLine = lastChunk.startLine + lastChunk.linesCount;
-
-        var selection = this._getSelection();
-
-        this._muteHighlightListener = true;
-        this._highlighter.highlight(lastVisibleLine);
-        delete this._muteHighlightListener;
-
-        this._restorePaintLinesOperationsCredit();
-        WebInspector.TextEditorChunkedPanel.prototype._expandChunks.call(this, fromIndex, toIndex);
-        this._adjustPaintLinesOperationsRefreshValue();
-
-        this._restoreSelection(selection);
-    },
-
-    /**
-     * @param {number} fromLine
-     * @param {number} toLine
-     */
-    _highlightDataReady: function(fromLine, toLine)
-    {
-        if (this._muteHighlightListener)
-            return;
-        this._restorePaintLinesOperationsCredit();
-        this._paintLines(fromLine, toLine, true /*restoreSelection*/);
-    },
-
-    /**
-     * @param {number} startLine
-     * @param {number} endLine
-     */
-    _schedulePaintLines: function(startLine, endLine)
-    {
-        if (startLine >= endLine)
-            return;
-
-        if (!this._scheduledPaintLines) {
-            this._scheduledPaintLines = [ { startLine: startLine, endLine: endLine } ];
-            this._paintScheduledLinesTimer = setTimeout(this._paintScheduledLines.bind(this), 0);
-        } else {
-            for (var i = 0; i < this._scheduledPaintLines.length; ++i) {
-                var chunk = this._scheduledPaintLines[i];
-                if (chunk.startLine <= endLine && chunk.endLine >= startLine) {
-                    chunk.startLine = Math.min(chunk.startLine, startLine);
-                    chunk.endLine = Math.max(chunk.endLine, endLine);
-                    return;
-                }
-                if (chunk.startLine > endLine) {
-                    this._scheduledPaintLines.splice(i, 0, { startLine: startLine, endLine: endLine });
-                    return;
-                }
-            }
-            this._scheduledPaintLines.push({ startLine: startLine, endLine: endLine });
-        }
-    },
-
-    /**
-     * @param {boolean} skipRestoreSelection
-     */
-    _paintScheduledLines: function(skipRestoreSelection)
-    {
-        if (this._paintScheduledLinesTimer)
-            clearTimeout(this._paintScheduledLinesTimer);
-        delete this._paintScheduledLinesTimer;
-
-        if (!this._scheduledPaintLines)
-            return;
-
-        // Reschedule the timer if we can not paint the lines yet, or the user is scrolling.
-        if (this._dirtyLines || this._repaintAllTimer) {
-            this._paintScheduledLinesTimer = setTimeout(this._paintScheduledLines.bind(this), 50);
-            return;
-        }
-
-        var scheduledPaintLines = this._scheduledPaintLines;
-        delete this._scheduledPaintLines;
-
-        this._restorePaintLinesOperationsCredit();
-        this._paintLineChunks(scheduledPaintLines, !skipRestoreSelection);
-        this._adjustPaintLinesOperationsRefreshValue();
-    },
-
-    _restorePaintLinesOperationsCredit: function()
-    {
-        if (!this._paintLinesOperationsRefreshValue)
-            this._paintLinesOperationsRefreshValue = 250;
-        this._paintLinesOperationsCredit = this._paintLinesOperationsRefreshValue;
-        this._paintLinesOperationsLastRefresh = Date.now();
-    },
-
-    _adjustPaintLinesOperationsRefreshValue: function()
-    {
-        var operationsDone = this._paintLinesOperationsRefreshValue - this._paintLinesOperationsCredit;
-        if (operationsDone <= 0)
-            return;
-        var timePast = Date.now() - this._paintLinesOperationsLastRefresh;
-        if (timePast <= 0)
-            return;
-        // Make the synchronous CPU chunk for painting the lines 50 msec.
-        var value = Math.floor(operationsDone / timePast * 50);
-        this._paintLinesOperationsRefreshValue = Number.constrain(value, 150, 1500);
-    },
-
-    /**
-     * @param {number} fromLine
-     * @param {number} toLine
-     * @param {boolean=} restoreSelection
-     */
-    _paintLines: function(fromLine, toLine, restoreSelection)
-    {
-        this._paintLineChunks([ { startLine: fromLine, endLine: toLine } ], restoreSelection);
-    },
-
-    /**
-     * @param {boolean=} restoreSelection
-     */
-    _paintLineChunks: function(lineChunks, restoreSelection)
-    {
-        // First, paint visible lines, so that in case of long lines we should start highlighting
-        // the visible area immediately, instead of waiting for the lines above the visible area.
-        var visibleFrom = this.element.scrollTop;
-        var firstVisibleLineNumber = this._findFirstVisibleLineNumber(visibleFrom);
-
-        var chunk;
-        var selection;
-        var invisibleLineRows = [];
-        for (var i = 0; i < lineChunks.length; ++i) {
-            var lineChunk = lineChunks[i];
-            if (this._dirtyLines || this._scheduledPaintLines) {
-                this._schedulePaintLines(lineChunk.startLine, lineChunk.endLine);
-                continue;
-            }
-            for (var lineNumber = lineChunk.startLine; lineNumber < lineChunk.endLine; ++lineNumber) {
-                if (!chunk || lineNumber < chunk.startLine || lineNumber >= chunk.startLine + chunk.linesCount)
-                    chunk = this.chunkForLine(lineNumber);
-                var lineRow = chunk.getExpandedLineRow(lineNumber);
-                if (!lineRow)
-                    continue;
-                if (lineNumber < firstVisibleLineNumber) {
-                    invisibleLineRows.push(lineRow);
-                    continue;
-                }
-                if (restoreSelection && !selection)
-                    selection = this._getSelection();
-                this._paintLine(lineRow);
-                if (this._paintLinesOperationsCredit < 0) {
-                    this._schedulePaintLines(lineNumber + 1, lineChunk.endLine);
-                    break;
-                }
-            }
-        }
-
-        for (var i = 0; i < invisibleLineRows.length; ++i) {
-            if (restoreSelection && !selection)
-                selection = this._getSelection();
-            this._paintLine(invisibleLineRows[i]);
-        }
-
-        if (restoreSelection)
-            this._restoreSelection(selection);
-    },
-
-    /**
-     * @param {Element} lineRow
-     */
-    _paintLine: function(lineRow)
-    {
-        var lineNumber = lineRow.lineNumber;
-        if (this._dirtyLines) {
-            this._schedulePaintLines(lineNumber, lineNumber + 1);
-            return;
-        }
-
-        this.beginDomUpdates();
-        try {
-            if (this._scheduledPaintLines || this._paintLinesOperationsCredit < 0) {
-                this._schedulePaintLines(lineNumber, lineNumber + 1);
-                return;
-            }
-
-            var highlight = this._textModel.getAttribute(lineNumber, "highlight");
-            if (!highlight)
-                return;
-
-            lineRow.removeChildren();
-            var line = this._textModel.line(lineNumber);
-            if (!line)
-                lineRow.appendChild(document.createElement("br"));
-
-            var plainTextStart = -1;
-            for (var j = 0; j < line.length;) {
-                if (j > 1000) {
-                    // This line is too long - do not waste cycles on minified js highlighting.
-                    if (plainTextStart === -1)
-                        plainTextStart = j;
-                    break;
-                }
-                var attribute = highlight[j];
-                if (!attribute || !attribute.tokenType) {
-                    if (plainTextStart === -1)
-                        plainTextStart = j;
-                    j++;
-                } else {
-                    if (plainTextStart !== -1) {
-                        this._appendTextNode(lineRow, line.substring(plainTextStart, j));
-                        plainTextStart = -1;
-                        --this._paintLinesOperationsCredit;
-                    }
-                    this._appendSpan(lineRow, line.substring(j, j + attribute.length), attribute.tokenType);
-                    j += attribute.length;
-                    --this._paintLinesOperationsCredit;
-                }
-            }
-            if (plainTextStart !== -1) {
-                this._appendTextNode(lineRow, line.substring(plainTextStart, line.length));
-                --this._paintLinesOperationsCredit;
-            }
-            if (lineRow.decorationsElement)
-                lineRow.appendChild(lineRow.decorationsElement);
-        } finally {
-            if (this._rangeToMark && this._rangeToMark.startLine === lineNumber)
-                this._markedRangeElement = WebInspector.highlightSearchResult(lineRow, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
-            this.endDomUpdates();
-        }
-    },
-
-    /**
-     * @param {Element} lineRow
-     */
-    _releaseLinesHighlight: function(lineRow)
-    {
-        if (!lineRow)
-            return;
-        if ("spans" in lineRow) {
-            var spans = lineRow.spans;
-            for (var j = 0; j < spans.length; ++j)
-                this._cachedSpans.push(spans[j]);
-            delete lineRow.spans;
-        }
-        if ("textNodes" in lineRow) {
-            var textNodes = lineRow.textNodes;
-            for (var j = 0; j < textNodes.length; ++j)
-                this._cachedTextNodes.push(textNodes[j]);
-            delete lineRow.textNodes;
-        }
-        this._cachedRows.push(lineRow);
-    },
-
-    /**
-     * @return {WebInspector.TextRange}
-     */
-    _getSelection: function()
-    {
-        var selection = window.getSelection();
-        if (!selection.rangeCount)
-            return null;
-        // Selection may be outside of the editor.
-        if (!this._container.isAncestor(selection.anchorNode) || !this._container.isAncestor(selection.focusNode))
-            return null;
-        var start = this._selectionToPosition(selection.anchorNode, selection.anchorOffset);
-        var end = selection.isCollapsed ? start : this._selectionToPosition(selection.focusNode, selection.focusOffset);
-        return new WebInspector.TextRange(start.line, start.column, end.line, end.column);
-    },
-
-    /**
-     * @param {boolean=} scrollIntoView
-     */
-    _restoreSelection: function(range, scrollIntoView)
-    {
-        if (!range)
-            return;
-        var start = this._positionToSelection(range.startLine, range.startColumn);
-        var end = range.isEmpty() ? start : this._positionToSelection(range.endLine, range.endColumn);
-        window.getSelection().setBaseAndExtent(start.container, start.offset, end.container, end.offset);
-
-        if (scrollIntoView) {
-            for (var node = end.container; node; node = node.parentElement) {
-                if (node.scrollIntoViewIfNeeded) {
-                    node.scrollIntoViewIfNeeded();
-                    break;
-                }
-            }
-        }
-    },
-
-    /**
-     * @param {Node} container
-     * @param {number} offset
-     */
-    _selectionToPosition: function(container, offset)
-    {
-        if (container === this._container && offset === 0)
-            return { line: 0, column: 0 };
-        if (container === this._container && offset === 1)
-            return { line: this._textModel.linesCount - 1, column: this._textModel.lineLength(this._textModel.linesCount - 1) };
-
-        var lineRow = this._enclosingLineRowOrSelf(container);
-        var lineNumber = lineRow.lineNumber;
-        if (container === lineRow && offset === 0)
-            return { line: lineNumber, column: 0 };
-
-        // This may be chunk and chunks may contain \n.
-        var column = 0;
-        var node = lineRow.nodeType === Node.TEXT_NODE ? lineRow : lineRow.traverseNextTextNode(lineRow);
-        while (node && node !== container) {
-            var text = node.textContent;
-            for (var i = 0; i < text.length; ++i) {
-                if (text.charAt(i) === "\n") {
-                    lineNumber++;
-                    column = 0;
-                } else
-                    column++;
-            }
-            node = node.traverseNextTextNode(lineRow);
-        }
-
-        if (node === container && offset) {
-            var text = node.textContent;
-            for (var i = 0; i < offset; ++i) {
-                if (text.charAt(i) === "\n") {
-                    lineNumber++;
-                    column = 0;
-                } else
-                    column++;
-            }
-        }
-        return { line: lineNumber, column: column };
-    },
-
-    /**
-     * @param {number} line
-     * @param {number} column
-     */
-    _positionToSelection: function(line, column)
-    {
-        var chunk = this.chunkForLine(line);
-        // One-lined collapsed chunks may still stay highlighted.
-        var lineRow = chunk.linesCount === 1 ? chunk.element : chunk.getExpandedLineRow(line);
-        if (lineRow)
-            var rangeBoundary = lineRow.rangeBoundaryForOffset(column);
-        else {
-            var offset = column;
-            for (var i = chunk.startLine; i < line; ++i)
-                offset += this._textModel.lineLength(i) + 1; // \n
-            lineRow = chunk.element;
-            if (lineRow.firstChild)
-                var rangeBoundary = { container: lineRow.firstChild, offset: offset };
-            else
-                var rangeBoundary = { container: lineRow, offset: 0 };
-        }
-        return rangeBoundary;
-    },
-
-    /**
-     * @param {Node} element
-     */
-    _enclosingLineRowOrSelf: function(element)
-    {
-        var lineRow = element.enclosingNodeOrSelfWithClass("webkit-line-content");
-        if (lineRow)
-            return lineRow;
-
-        for (lineRow = element; lineRow; lineRow = lineRow.parentElement) {
-            if (lineRow.parentElement === this._container)
-                return lineRow;
-        }
-        return null;
-    },
-
-    /**
-     * @param {Element} element
-     * @param {string} content
-     * @param {string} className
-     */
-    _appendSpan: function(element, content, className)
-    {
-        if (className === "html-resource-link" || className === "html-external-link") {
-            element.appendChild(this._createLink(content, className === "html-external-link"));
-            return;
-        }
-
-        var span = this._cachedSpans.pop() || document.createElement("span");
-        span.className = "webkit-" + className;
-        span.textContent = content;
-        element.appendChild(span);
-        if (!("spans" in element))
-            element.spans = [];
-        element.spans.push(span);
-    },
-
-    /**
-     * @param {Element} element
-     * @param {string} text
-     */
-    _appendTextNode: function(element, text)
-    {
-        var textNode = this._cachedTextNodes.pop();
-        if (textNode)
-            textNode.nodeValue = text;
-        else
-            textNode = document.createTextNode(text);
-        element.appendChild(textNode);
-        if (!("textNodes" in element))
-            element.textNodes = [];
-        element.textNodes.push(textNode);
-    },
-
-    /**
-     * @param {string} content
-     * @param {boolean} isExternal
-     */
-    _createLink: function(content, isExternal)
-    {
-        var quote = content.charAt(0);
-        if (content.length > 1 && (quote === "\"" ||   quote === "'"))
-            content = content.substring(1, content.length - 1);
-        else
-            quote = null;
-
-        var a = WebInspector.linkifyURLAsNode(this._rewriteHref(content), content, undefined, isExternal);
-        var span = document.createElement("span");
-        span.className = "webkit-html-attribute-value";
-        if (quote)
-            span.appendChild(document.createTextNode(quote));
-        span.appendChild(a);
-        if (quote)
-            span.appendChild(document.createTextNode(quote));
-        return span;
-    },
-
-    /**
-     * @param {string=} hrefValue
-     * @param {boolean=} isExternal
-     */
-    _rewriteHref: function(hrefValue, isExternal)
-    {
-        if (!this._url || !hrefValue || hrefValue.indexOf("://") > 0)
-            return hrefValue;
-        return WebInspector.completeURL(this._url, hrefValue);
-    },
-
-    _handleDOMUpdates: function(e)
-    {
-        if (this._domUpdateCoalescingLevel)
-            return;
-
-        var target = e.target;
-        if (target === this._container)
-            return;
-
-        var lineRow = this._enclosingLineRowOrSelf(target);
-        if (!lineRow)
-            return;
-
-        if (lineRow.decorationsElement && lineRow.decorationsElement.isSelfOrAncestor(target)) {
-            if (this._syncDecorationsForLineListener)
-                this._syncDecorationsForLineListener(lineRow.lineNumber);
-            return;
-        }
-
-        if (this._readOnly)
-            return;
-
-        if (target === lineRow && e.type === "DOMNodeInserted") {
-            // Ensure that the newly inserted line row has no lineNumber.
-            delete lineRow.lineNumber;
-        }
-
-        var startLine = 0;
-        for (var row = lineRow; row; row = row.previousSibling) {
-            if (typeof row.lineNumber === "number") {
-                startLine = row.lineNumber;
-                break;
-            }
-        }
-
-        var endLine = startLine + 1;
-        for (var row = lineRow.nextSibling; row; row = row.nextSibling) {
-            if (typeof row.lineNumber === "number" && row.lineNumber > startLine) {
-                endLine = row.lineNumber;
-                break;
-            }
-        }
-
-        if (target === lineRow && e.type === "DOMNodeRemoved") {
-            // Now this will no longer be valid.
-            delete lineRow.lineNumber;
-        }
-
-        if (this._dirtyLines) {
-            this._dirtyLines.start = Math.min(this._dirtyLines.start, startLine);
-            this._dirtyLines.end = Math.max(this._dirtyLines.end, endLine);
-        } else {
-            this._dirtyLines = { start: startLine, end: endLine };
-            setTimeout(this._applyDomUpdates.bind(this), 0);
-            // Remove marked ranges, if any.
-            this.markAndRevealRange(null);
-        }
-    },
-
-    _applyDomUpdates: function()
-    {
-        if (!this._dirtyLines)
-            return;
-
-        // Check if the editor had been set readOnly by the moment when this async callback got executed.
-        if (this._readOnly) {
-            delete this._dirtyLines;
-            return;
-        }
-
-        var dirtyLines = this._dirtyLines;
-
-        var firstChunkNumber = this._chunkNumberForLine(dirtyLines.start);
-        var startLine = this._textChunks[firstChunkNumber].startLine;
-        var endLine = this._textModel.linesCount;
-
-        // Collect lines.
-        var firstLineRow;
-        if (firstChunkNumber) {
-            var chunk = this._textChunks[firstChunkNumber - 1];
-            firstLineRow = chunk.expanded ? chunk.getExpandedLineRow(chunk.startLine + chunk.linesCount - 1) : chunk.element;
-            firstLineRow = firstLineRow.nextSibling;
-        } else
-            firstLineRow = this._container.firstChild;
-
-        var lines = [];
-        for (var lineRow = firstLineRow; lineRow; lineRow = lineRow.nextSibling) {
-            if (typeof lineRow.lineNumber === "number" && lineRow.lineNumber >= dirtyLines.end) {
-                endLine = lineRow.lineNumber;
-                break;
-            }
-            // Update with the newest lineNumber, so that the call to the _getSelection method below should work.
-            lineRow.lineNumber = startLine + lines.length;
-            this._collectLinesFromDiv(lines, lineRow);
-        }
-
-        // Try to decrease the range being replaced, if possible.
-        var startOffset = 0;
-        while (startLine < dirtyLines.start && startOffset < lines.length) {
-            if (this._textModel.line(startLine) !== lines[startOffset])
-                break;
-            ++startOffset;
-            ++startLine;
-        }
-
-        var endOffset = lines.length;
-        while (endLine > dirtyLines.end && endOffset > startOffset) {
-            if (this._textModel.line(endLine - 1) !== lines[endOffset - 1])
-                break;
-            --endOffset;
-            --endLine;
-        }
-
-        lines = lines.slice(startOffset, endOffset);
-
-        // Try to decrease the range being replaced by column offsets, if possible.
-        var startColumn = 0;
-        var endColumn = this._textModel.lineLength(endLine - 1);
-        if (lines.length > 0) {
-            var line1 = this._textModel.line(startLine);
-            var line2 = lines[0];
-            while (line1[startColumn] && line1[startColumn] === line2[startColumn])
-                ++startColumn;
-            lines[0] = line2.substring(startColumn);
-
-            line1 = this._textModel.line(endLine - 1);
-            line2 = lines[lines.length - 1];
-            for (var i = 0; i < endColumn && i < line2.length; ++i) {
-                if (startLine === endLine - 1 && endColumn - i <= startColumn)
-                    break;
-                if (line1[endColumn - i - 1] !== line2[line2.length - i - 1])
-                    break;
-            }
-            if (i) {
-                endColumn -= i;
-                lines[lines.length - 1] = line2.substring(0, line2.length - i);
-            }
-        }
-
-        var selection = this._getSelection();
-
-        if (lines.length === 0 && endLine < this._textModel.linesCount)
-            var oldRange = new WebInspector.TextRange(startLine, 0, endLine, 0);
-        else if (lines.length === 0 && startLine > 0)
-            var oldRange = new WebInspector.TextRange(startLine - 1, this._textModel.lineLength(startLine - 1), endLine - 1, this._textModel.lineLength(endLine - 1));
-        else
-            var oldRange = new WebInspector.TextRange(startLine, startColumn, endLine - 1, endColumn);
-
-        var newContent = lines.join("\n");
-        if (this._textModel.copyRange(oldRange) === newContent) {
-            delete this._dirtyLines;
-            return; // Noop
-        }
-
-        if (lines.length === 1 && lines[0] === "}" && oldRange.isEmpty() && selection.isEmpty() && !this._textModel.line(oldRange.endLine).trim())
-            this._unindentAfterBlock(oldRange, selection);
-        
-        // This is a "foreign" call outside of this class. Should be before we delete the dirty lines flag.
-        this._enterTextChangeMode();
-
-        delete this._dirtyLines;
-
-        var newRange = this._editRange(oldRange, newContent);
-
-        this._paintScheduledLines(true);
-        this._restoreSelection(selection);
-
-        this._exitTextChangeMode(oldRange, newRange);
-    },
-
-    /**
-     * @param {WebInspector.TextRange} oldRange
-     * @param {WebInspector.TextRange} selection
-     */
-    _unindentAfterBlock: function(oldRange, selection)
-    {
-        var nestingLevel = 1;
-        for (var i = oldRange.endLine; i >= 0; --i) {
-            var attribute = this._textModel.getAttribute(i, "highlight");
-            if (!attribute)
-                continue;
-            var columnNumbers = Object.keys(attribute).reverse();
-            for (var j = 0; j < columnNumbers.length; ++j) {
-                var column = columnNumbers[j];
-                if (attribute[column].tokenType === "block-start") {
-                    if (!(--nestingLevel)) {
-                        var lineContent = this._textModel.line(i);
-                        var blockOffset = lineContent.length - lineContent.trimLeft().length;
-                        if (blockOffset < oldRange.startColumn) {
-                            oldRange.startColumn = blockOffset;
-                            selection.startColumn = blockOffset + 1;
-                            selection.endColumn = blockOffset + 1;
-                        }
-                        return;
-                    }
-                }
-                if (attribute[column].tokenType === "block-end")
-                    ++nestingLevel;
-            }
-        }
-    },
-
-    /**
-     * @param {WebInspector.TextRange} oldRange
-     * @param {WebInspector.TextRange} newRange
-     */
-    textChanged: function(oldRange, newRange)
-    {
-        this.beginDomUpdates();
-        this._removeDecorationsInRange(oldRange);
-        this._updateChunksForRanges(oldRange, newRange);
-        this._updateHighlightsForRange(newRange);
-        this.endDomUpdates();
-    },
-
-    /**
-     * @param {WebInspector.TextRange} range
-     * @param {string} text
-     */
-    _editRange: function(range, text)
-    {
-        if (this._lastEditedRange && (!text || text.indexOf("\n") !== -1 || this._lastEditedRange.endLine !== range.startLine || this._lastEditedRange.endColumn !== range.startColumn))
-            this._textModel.markUndoableState();
-
-        var newRange = this._textModel.editRange(range, text);
-        this._lastEditedRange = newRange;
-
-        return newRange;
-    },
-
-    /**
-     * @param {WebInspector.TextRange} range
-     */
-    _removeDecorationsInRange: function(range)
-    {
-        for (var i = this._chunkNumberForLine(range.startLine); i < this._textChunks.length; ++i) {
-            var chunk = this._textChunks[i];
-            if (chunk.startLine > range.endLine)
-                break;
-            chunk.removeAllDecorations();
-        }
-    },
-
-    /**
-     * @param {WebInspector.TextRange} oldRange
-     * @param {WebInspector.TextRange} newRange
-     */
-    _updateChunksForRanges: function(oldRange, newRange)
-    {
-        // Update the chunks in range: firstChunkNumber <= index <= lastChunkNumber
-        var firstChunkNumber = this._chunkNumberForLine(oldRange.startLine);
-        var lastChunkNumber = firstChunkNumber;
-        while (lastChunkNumber + 1 < this._textChunks.length) {
-            if (this._textChunks[lastChunkNumber + 1].startLine > oldRange.endLine)
-                break;
-            ++lastChunkNumber;
-        }
-
-        var startLine = this._textChunks[firstChunkNumber].startLine;
-        var linesCount = this._textChunks[lastChunkNumber].startLine + this._textChunks[lastChunkNumber].linesCount - startLine;
-        var linesDiff = newRange.linesCount - oldRange.linesCount;
-        linesCount += linesDiff;
-
-        if (linesDiff) {
-            // Lines shifted, update the line numbers of the chunks below.
-            for (var chunkNumber = lastChunkNumber + 1; chunkNumber < this._textChunks.length; ++chunkNumber)
-                this._textChunks[chunkNumber].startLine += linesDiff;
-        }
-
-        var firstLineRow;
-        if (firstChunkNumber) {
-            var chunk = this._textChunks[firstChunkNumber - 1];
-            firstLineRow = chunk.expanded ? chunk.getExpandedLineRow(chunk.startLine + chunk.linesCount - 1) : chunk.element;
-            firstLineRow = firstLineRow.nextSibling;
-        } else
-            firstLineRow = this._container.firstChild;
-
-        // Most frequent case: a chunk remained the same.
-        for (var chunkNumber = firstChunkNumber; chunkNumber <= lastChunkNumber; ++chunkNumber) {
-            var chunk = this._textChunks[chunkNumber];
-            if (chunk.startLine + chunk.linesCount > this._textModel.linesCount)
-                break;
-            var lineNumber = chunk.startLine;
-            for (var lineRow = firstLineRow; lineRow && lineNumber < chunk.startLine + chunk.linesCount; lineRow = lineRow.nextSibling) {
-                if (lineRow.lineNumber !== lineNumber || lineRow !== chunk.getExpandedLineRow(lineNumber) || lineRow.textContent !== this._textModel.line(lineNumber) || !lineRow.firstChild)
-                    break;
-                ++lineNumber;
-            }
-            if (lineNumber < chunk.startLine + chunk.linesCount)
-                break;
-            chunk.updateCollapsedLineRow();
-            ++firstChunkNumber;
-            firstLineRow = lineRow;
-            startLine += chunk.linesCount;
-            linesCount -= chunk.linesCount;
-        }
-
-        if (firstChunkNumber > lastChunkNumber && linesCount === 0)
-            return;
-
-        // Maybe merge with the next chunk, so that we should not create 1-sized chunks when appending new lines one by one.
-        var chunk = this._textChunks[lastChunkNumber + 1];
-        var linesInLastChunk = linesCount % this._defaultChunkSize;
-        if (chunk && !chunk.decorated && linesInLastChunk > 0 && linesInLastChunk + chunk.linesCount <= this._defaultChunkSize) {
-            ++lastChunkNumber;
-            linesCount += chunk.linesCount;
-        }
-
-        var scrollTop = this.element.scrollTop;
-        var scrollLeft = this.element.scrollLeft;
-
-        // Delete all DOM elements that were either controlled by the old chunks, or have just been inserted.
-        var firstUnmodifiedLineRow = null;
-        chunk = this._textChunks[lastChunkNumber + 1];
-        if (chunk)
-            firstUnmodifiedLineRow = chunk.expanded ? chunk.getExpandedLineRow(chunk.startLine) : chunk.element;
-
-        while (firstLineRow && firstLineRow !== firstUnmodifiedLineRow) {
-            var lineRow = firstLineRow;
-            firstLineRow = firstLineRow.nextSibling;
-            this._container.removeChild(lineRow);
-        }
-
-        // Replace old chunks with the new ones.
-        for (var chunkNumber = firstChunkNumber; linesCount > 0; ++chunkNumber) {
-            var chunkLinesCount = Math.min(this._defaultChunkSize, linesCount);
-            var newChunk = this._createNewChunk(startLine, startLine + chunkLinesCount);
-            this._container.insertBefore(newChunk.element, firstUnmodifiedLineRow);
-
-            if (chunkNumber <= lastChunkNumber)
-                this._textChunks[chunkNumber] = newChunk;
-            else
-                this._textChunks.splice(chunkNumber, 0, newChunk);
-            startLine += chunkLinesCount;
-            linesCount -= chunkLinesCount;
-        }
-        if (chunkNumber <= lastChunkNumber)
-            this._textChunks.splice(chunkNumber, lastChunkNumber - chunkNumber + 1);
-
-        this.element.scrollTop = scrollTop;
-        this.element.scrollLeft = scrollLeft;
-    },
-
-    /**
-     * @param {WebInspector.TextRange} range
-     */
-    _updateHighlightsForRange: function(range)
-    {
-        var visibleFrom = this.element.scrollTop;
-        var visibleTo = this.element.scrollTop + this.element.clientHeight;
-
-        var result = this._findVisibleChunks(visibleFrom, visibleTo);
-        var chunk = this._textChunks[result.end - 1];
-        var lastVisibleLine = chunk.startLine + chunk.linesCount;
-
-        lastVisibleLine = Math.max(lastVisibleLine, range.endLine + 1);
-        lastVisibleLine = Math.min(lastVisibleLine, this._textModel.linesCount);
-
-        var updated = this._highlighter.updateHighlight(range.startLine, lastVisibleLine);
-        if (!updated) {
-            // Highlights for the chunks below are invalid, so just collapse them.
-            for (var i = this._chunkNumberForLine(range.startLine); i < this._textChunks.length; ++i)
-                this._textChunks[i].expanded = false;
-        }
-
-        this._repaintAll();
-    },
-
-    /**
-     * @param {Array.<string>} lines
-     * @param {Element} element
      */
-    _collectLinesFromDiv: function(lines, element)
-    {
-        var textContents = [];
-        var node = element.nodeType === Node.TEXT_NODE ? element : element.traverseNextNode(element);
-        while (node) {
-            if (element.decorationsElement === node) {
-                node = node.nextSibling;
-                continue;
-            }
-            if (node.nodeName.toLowerCase() === "br")
-                textContents.push("\n");
-            else if (node.nodeType === Node.TEXT_NODE)
-                textContents.push(node.textContent);
-            node = node.traverseNextNode(element);
-        }
-
-        var textContent = textContents.join("");
-        // The last \n (if any) does not "count" in a DIV.
-        textContent = textContent.replace(/\n$/, "");
-
-        textContents = textContent.split("\n");
-        for (var i = 0; i < textContents.length; ++i)
-            lines.push(textContents[i]);
-    }
-}
-
-WebInspector.TextEditorMainPanel.prototype.__proto__ = WebInspector.TextEditorChunkedPanel.prototype;
-
-/**
- * @constructor
- * @param {WebInspector.TextEditorChunkedPanel} chunkedPanel
- * @param {number} startLine
- * @param {number} endLine
-*/
-WebInspector.TextEditorMainChunk = function(chunkedPanel, startLine, endLine)
-{
-    this._chunkedPanel = chunkedPanel;
-    this._textModel = chunkedPanel._textModel;
-
-    this.element = document.createElement("div");
-    this.element.lineNumber = startLine;
-    this.element.className = "webkit-line-content";
-    this._chunkedPanel._enableDOMNodeRemovedListener(this.element, true);
-
-    this._startLine = startLine;
-    endLine = Math.min(this._textModel.linesCount, endLine);
-    this.linesCount = endLine - startLine;
-
-    this._expanded = false;
-    this._readOnly = false;
-
-    this.updateCollapsedLineRow();
+    populateTextAreaContextMenu: function(contextMenu, lineNumber) { }
 }
 
-WebInspector.TextEditorMainChunk.prototype = {
-    addDecoration: function(decoration)
-    {
-        this._chunkedPanel.beginDomUpdates();
-        if (typeof decoration === "string")
-            this.element.addStyleClass(decoration);
-        else {
-            if (!this.element.decorationsElement) {
-                this.element.decorationsElement = document.createElement("div");
-                this.element.decorationsElement.className = "webkit-line-decorations";
-                this.element.appendChild(this.element.decorationsElement);
-            }
-            this.element.decorationsElement.appendChild(decoration);
-        }
-        this._chunkedPanel.endDomUpdates();
-    },
-
-    /**
-     * @param {string|Element} decoration
-     */
-    removeDecoration: function(decoration)
-    {
-        this._chunkedPanel.beginDomUpdates();
-        if (typeof decoration === "string")
-            this.element.removeStyleClass(decoration);
-        else if (this.element.decorationsElement)
-            this.element.decorationsElement.removeChild(decoration);
-        this._chunkedPanel.endDomUpdates();
-    },
-
-    removeAllDecorations: function()
-    {
-        this._chunkedPanel.beginDomUpdates();
-        this.element.className = "webkit-line-content";
-        if (this.element.decorationsElement) {
-            this.element.removeChild(this.element.decorationsElement);
-            delete this.element.decorationsElement;
-        }
-        this._chunkedPanel.endDomUpdates();
-    },
-
-    /**
-     * @return {boolean}
-     */
-    get decorated()
-    {
-        return this.element.className !== "webkit-line-content" || !!(this.element.decorationsElement && this.element.decorationsElement.firstChild);
-    },
-
-    /**
-     * @return {number}
-     */
-    get startLine()
-    {
-        return this._startLine;
-    },
-
-    set startLine(startLine)
-    {
-        this._startLine = startLine;
-        this.element.lineNumber = startLine;
-        if (this._expandedLineRows) {
-            for (var i = 0; i < this._expandedLineRows.length; ++i)
-                this._expandedLineRows[i].lineNumber = startLine + i;
-        }
-    },
-
-    /**
-     * @return {boolean}
-     */
-    get expanded()
-    {
-        return this._expanded;
-    },
-
-    set expanded(expanded)
-    {
-        if (this._expanded === expanded)
-            return;
-
-        this._expanded = expanded;
-
-        if (this.linesCount === 1) {
-            if (expanded)
-                this._chunkedPanel._paintLine(this.element);
-            return;
-        }
-
-        this._chunkedPanel.beginDomUpdates();
-
-        if (expanded) {
-            this._expandedLineRows = [];
-            var parentElement = this.element.parentElement;
-            for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
-                var lineRow = this._createRow(i);
-                this._chunkedPanel._enableDOMNodeRemovedListener(lineRow, true);
-                this._updateElementReadOnlyState(lineRow);
-                parentElement.insertBefore(lineRow, this.element);
-                this._expandedLineRows.push(lineRow);
-            }
-            this._chunkedPanel._enableDOMNodeRemovedListener(this.element, false);
-            parentElement.removeChild(this.element);
-            this._chunkedPanel._paintLines(this.startLine, this.startLine + this.linesCount);
-        } else {
-            var elementInserted = false;
-            for (var i = 0; i < this._expandedLineRows.length; ++i) {
-                var lineRow = this._expandedLineRows[i];
-                this._chunkedPanel._enableDOMNodeRemovedListener(lineRow, false);
-                var parentElement = lineRow.parentElement;
-                if (parentElement) {
-                    if (!elementInserted) {
-                        elementInserted = true;
-                        this._chunkedPanel._enableDOMNodeRemovedListener(this.element, true);
-                        parentElement.insertBefore(this.element, lineRow);
-                    }
-                    parentElement.removeChild(lineRow);
-                }
-                this._chunkedPanel._releaseLinesHighlight(lineRow);
-            }
-            delete this._expandedLineRows;
-        }
-
-        this._chunkedPanel.endDomUpdates();
-    },
-
-    set readOnly(readOnly)
-    {
-        if (this._readOnly === readOnly)
-            return;
-
-        this._readOnly = readOnly;
-        this._updateElementReadOnlyState(this.element);
-        if (this._expandedLineRows) {
-            for (var i = 0; i < this._expandedLineRows.length; ++i)
-                this._updateElementReadOnlyState(this._expandedLineRows[i]);
-        }
-    },
-
-    /**
-     * @return {boolean}
-     */
-    get readOnly()
-    {
-        return this._readOnly;
-    },
-
-    _updateElementReadOnlyState: function(element)
-    {
-        if (this._readOnly)
-            element.addStyleClass("text-editor-read-only");
-        else
-            element.removeStyleClass("text-editor-read-only");
-    },
-
-    /**
-     * @return {number}
-     */
-    get height()
-    {
-        if (!this._expandedLineRows)
-            return this._chunkedPanel._totalHeight(this.element);
-        return this._chunkedPanel._totalHeight(this._expandedLineRows[0], this._expandedLineRows[this._expandedLineRows.length - 1]);
-    },
-
-    /**
-     * @return {number}
-     */
-    get offsetTop()
-    {
-        return (this._expandedLineRows && this._expandedLineRows.length) ? this._expandedLineRows[0].offsetTop : this.element.offsetTop;
-    },
-
-    /**
-     * @param {number} lineNumber
-     * @return {Element}
-     */
-    _createRow: function(lineNumber)
-    {
-        var lineRow = this._chunkedPanel._cachedRows.pop() || document.createElement("div");
-        lineRow.lineNumber = lineNumber;
-        lineRow.className = "webkit-line-content";
-        lineRow.textContent = this._textModel.line(lineNumber);
-        if (!lineRow.textContent)
-            lineRow.appendChild(document.createElement("br"));
-        return lineRow;
-    },
-
-    /**
-     * @param {number} lineNumber
-     * @return {Element}
-     */
-    getExpandedLineRow: function(lineNumber)
-    {
-        if (!this._expanded || lineNumber < this.startLine || lineNumber >= this.startLine + this.linesCount)
-            return null;
-        if (!this._expandedLineRows)
-            return this.element;
-        return this._expandedLineRows[lineNumber - this.startLine];
-    },
-
-    updateCollapsedLineRow: function()
-    {
-        if (this.linesCount === 1 && this._expanded)
-            return;
-
-        var lines = [];
-        for (var i = this.startLine; i < this.startLine + this.linesCount; ++i)
-            lines.push(this._textModel.line(i));
-
-        this.element.removeChildren();
-        this.element.textContent = lines.join("\n");
-
-        // The last empty line will get swallowed otherwise.
-        if (!lines[lines.length - 1])
-            this.element.appendChild(document.createElement("br"));
-    }
-}
diff --git a/Source/WebCore/inspector/front-end/TimelineModel.js b/Source/WebCore/inspector/front-end/TimelineModel.js
index a9c49e59a..91f9f95d2 100644
--- a/Source/WebCore/inspector/front-end/TimelineModel.js
+++ b/Source/WebCore/inspector/front-end/TimelineModel.js
@@ -159,26 +159,59 @@ WebInspector.TimelineModel.prototype = {
         this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordAdded, record);
     },
 
-    _loadNextChunk: function(data, index)
+    /**
+     * @param {WebInspector.Progress} progress
+     * @param {Array.<Object>} data
+     * @param {number} index
+     */
+    _loadNextChunk: function(progress, data, index)
     {
-        for (var i = 0; i < 20 && index < data.length; ++i, ++index)
+        if (progress.isCanceled()) {
+            this.reset();
+            progress.done();
+            return;
+        }
+        progress.setWorked(index);
+
+        for (var i = 0; i < 100 && index < data.length; ++i, ++index)
             this._addRecord(data[index]);
 
         if (index !== data.length)
-            setTimeout(this._loadNextChunk.bind(this, data, index), 0);
+            setTimeout(this._loadNextChunk.bind(this, progress, data, index), 0);
+        else
+            progress.done();
     },
 
-    loadFromFile: function(file)
+    /**
+     * @param {!Blob} file
+     * @param {WebInspector.Progress} progress
+     */
+    loadFromFile: function(file, progress)
     {
-        function onLoad(e)
+        var compositeProgress = new WebInspector.CompositeProgress(progress);
+        var loadingProgress = compositeProgress.createSubProgress(1);
+        var parsingProgress = compositeProgress.createSubProgress(1);
+        var processingProgress = compositeProgress.createSubProgress(1);
+
+        function parseAndImportData(data)
         {
-            var data = JSON.parse(e.target.result);
+            var records = JSON.parse(data);
+            parsingProgress.done();
             this.reset();
-            this._loadNextChunk(data, 1);
+            processingProgress.setTotalWork(records.length);
+            this._loadNextChunk(processingProgress, records, 1);
+        }
+
+        function onLoad(e)
+        {
+            loadingProgress.done();
+            parsingProgress.setTotalWork(1);
+            setTimeout(parseAndImportData.bind(this, e.target.result), 0);
         }
 
         function onError(e)
         {
+            progress.done();
             switch(e.target.error.code) {
             case e.target.error.NOT_FOUND_ERR:
                 WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: File "%s" not found.', file.name));
@@ -193,9 +226,18 @@ WebInspector.TimelineModel.prototype = {
             }
         }
 
+        function onProgress(e)
+        {
+            if (e.lengthComputable)
+                loadingProgress.setWorked(e.loaded / e.total);
+        }
+
         var reader = new FileReader();
         reader.onload = onLoad.bind(this);
         reader.onerror = onError;
+        reader.onprogress = onProgress;
+        loadingProgress.setTitle(WebInspector.UIString("Loading\u2026"));
+        loadingProgress.setTotalWork(1);
         reader.readAsText(file);
     },
 
diff --git a/Source/WebCore/inspector/front-end/TimelinePanel.js b/Source/WebCore/inspector/front-end/TimelinePanel.js
index f9a7f81a0..bf09bcf94 100644
--- a/Source/WebCore/inspector/front-end/TimelinePanel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePanel.js
@@ -45,7 +45,7 @@ WebInspector.TimelinePanel = function()
     this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._overviewModeChanged, this);
     this._overviewPane.show(this.element);
 
-    this.element.addEventListener("contextmenu", this._contextMenu.bind(this), true);
+    this.element.addEventListener("contextmenu", this._contextMenu.bind(this), false);
     this.element.tabIndex = 0;
 
     this._sidebarBackgroundElement = document.createElement("div");
@@ -102,7 +102,7 @@ WebInspector.TimelinePanel = function()
     var shortRecordThresholdTitle = Number.secondsToString(WebInspector.TimelinePresentationModel.shortRecordThreshold);
     this._showShortRecordsTitleText = WebInspector.UIString("Show the records that are shorter than %s", shortRecordThresholdTitle);
     this._hideShortRecordsTitleText = WebInspector.UIString("Hide the records that are shorter than %s", shortRecordThresholdTitle);
-    this._createStatusbarButtons();
+    this._createStatusBarItems();
 
     this._frameMode = false;
     this._boundariesAreValid = true;
@@ -202,16 +202,10 @@ WebInspector.TimelinePanel.prototype = {
 
     get statusBarItems()
     {
-        var statusBarItems = [
-            this.toggleFilterButton.element,
-            this.toggleTimelineButton.element,
-            this.clearButton.element, this.garbageCollectButton.element,
-            this._glueParentButton.element,
-            this.statusBarFilters,
+        return this._statusBarButtons.select("element").concat([
+            this._miscStatusBarItems,
             this.recordsCounter
-        ];
-
-        return statusBarItems;
+        ]);
     },
 
     defaultFocusedElement: function()
@@ -219,37 +213,46 @@ WebInspector.TimelinePanel.prototype = {
         return this.element;
     },
 
-    _createStatusbarButtons: function()
+    _createStatusBarItems: function()
     {
+        this._statusBarButtons = [];
+
+        this.toggleFilterButton = new WebInspector.StatusBarButton(this._hideShortRecordsTitleText, "timeline-filter-status-bar-item");
+        this.toggleFilterButton.addEventListener("click", this._toggleFilterButtonClicked, this);
+        this._statusBarButtons.push(this.toggleFilterButton);
+
         this.toggleTimelineButton = new WebInspector.StatusBarButton(WebInspector.UIString("Record"), "record-profile-status-bar-item");
         this.toggleTimelineButton.addEventListener("click", this._toggleTimelineButtonClicked, this);
+        this._statusBarButtons.push(this.toggleTimelineButton);
 
         this.clearButton = new WebInspector.StatusBarButton(WebInspector.UIString("Clear"), "clear-status-bar-item");
         this.clearButton.addEventListener("click", this._clearPanel, this);
-
-        this.toggleFilterButton = new WebInspector.StatusBarButton(this._hideShortRecordsTitleText, "timeline-filter-status-bar-item");
-        this.toggleFilterButton.addEventListener("click", this._toggleFilterButtonClicked, this);
+        this._statusBarButtons.push(this.clearButton);
 
         this.garbageCollectButton = new WebInspector.StatusBarButton(WebInspector.UIString("Collect Garbage"), "garbage-collect-status-bar-item");
         this.garbageCollectButton.addEventListener("click", this._garbageCollectButtonClicked, this);
-
-        this.recordsCounter = document.createElement("span");
-        this.recordsCounter.className = "timeline-records-counter";
+        this._statusBarButtons.push(this.garbageCollectButton);
 
         this._glueParentButton = new WebInspector.StatusBarButton(WebInspector.UIString("Glue asynchronous events to causes"), "glue-async-status-bar-item");
         this._glueParentButton.toggled = true;
         this._presentationModel.setGlueRecords(true);
         this._glueParentButton.addEventListener("click", this._glueParentButtonClicked, this);
+        this._statusBarButtons.push(this._glueParentButton);
 
-        this.statusBarFilters = document.createElement("div");
-        this.statusBarFilters.className = "status-bar-items";
+        this._miscStatusBarItems = document.createElement("div");
+        this._miscStatusBarItems.className = "status-bar-items";
+
+        this._statusBarFilters = this._miscStatusBarItems.createChild("div");
         var categories = WebInspector.TimelinePresentationModel.categories();
         for (var categoryName in categories) {
             var category = categories[categoryName];
             if (category.overviewStripGroupIndex < 0)
                 continue;
-            this.statusBarFilters.appendChild(this._createTimelineCategoryStatusBarCheckbox(category, this._onCategoryCheckboxClicked.bind(this, category)));
+            this._statusBarFilters.appendChild(this._createTimelineCategoryStatusBarCheckbox(category, this._onCategoryCheckboxClicked.bind(this, category)));
         }
+
+        this.recordsCounter = document.createElement("span");
+        this.recordsCounter.className = "timeline-records-counter";
     },
 
     _createTimelineCategoryStatusBarCheckbox: function(category, onCheckboxClicked)
@@ -282,6 +285,19 @@ WebInspector.TimelinePanel.prototype = {
         this._scheduleRefresh(true);
     },
 
+    /**
+     * @param {?WebInspector.ProgressIndicator} indicator
+     */
+    _setOperationInProgress: function(indicator)
+    {
+        this._operationInProgress = !!indicator;
+        for (var i = 0; i < this._statusBarButtons.length; ++i)
+            this._statusBarButtons[i].disabled = this._operationInProgress;
+        this._glueParentButton.disabled = this._operationInProgress || !!this._frameController;
+        this._miscStatusBarItems.removeChildren();
+        this._miscStatusBarItems.appendChild(indicator ? indicator.element : this._statusBarFilters);
+    },
+
     _registerShortcuts: function()
     {
         var shortcut = WebInspector.KeyboardShortcut;
@@ -318,23 +334,30 @@ WebInspector.TimelinePanel.prototype = {
     {
         var contextMenu = new WebInspector.ContextMenu();
         if (InspectorFrontendHost.canSave())
-            contextMenu.appendItem(WebInspector.UIString("Save Timeline data\u2026"), this._saveToFile.bind(this));
-        contextMenu.appendItem(WebInspector.UIString("Load Timeline data\u2026"), this._fileSelectorElement.click.bind(this._fileSelectorElement));
+            contextMenu.appendItem(WebInspector.UIString("Save Timeline data\u2026"), this._saveToFile.bind(this), this._operationInProgress);
+        contextMenu.appendItem(WebInspector.UIString("Load Timeline data\u2026"), this._fileSelectorElement.click.bind(this._fileSelectorElement), this._operationInProgress);
         contextMenu.show(event);
     },
 
     _saveToFile: function()
     {
+        if (this._operationInProgress)
+            return;
         this._model.saveToFile();
     },
 
     _loadFromFile: function()
     {
+        if (this._operationInProgress)
+            return;
         if (this.toggleTimelineButton.toggled) {
             this.toggleTimelineButton.toggled = false;
             this._model.stopRecord();
         }
-        this._model.loadFromFile(this._fileSelectorElement.files[0]);
+        var progressIndicator = new WebInspector.ProgressIndicator();
+        progressIndicator.addEventListener(WebInspector.ProgressIndicator.Events.Done, this._setOperationInProgress.bind(this, null));
+        this._setOperationInProgress(progressIndicator);
+        this._model.loadFromFile(this._fileSelectorElement.files[0], progressIndicator);
         this._createFileSelector();
     },
 
@@ -466,6 +489,8 @@ WebInspector.TimelinePanel.prototype = {
 
     _toggleTimelineButtonClicked: function()
     {
+        if (this._operationInProgress)
+            return;
         if (this.toggleTimelineButton.toggled)
             this._model.stopRecord();
         else {
@@ -548,7 +573,7 @@ WebInspector.TimelinePanel.prototype = {
         this.onResize();
         this._overviewPane.sidebarResized(width);
         // Min width = <number of buttons on the left> * 31
-        this.statusBarFilters.style.left = Math.max((this.statusBarItems.length + 2) * 31, width) + "px";
+        this._miscStatusBarItems.style.left = Math.max((this._statusBarButtons.length + 3) * 31, width) + "px";
         this._memoryStatistics.setSidebarWidth(width);
         this._timelineGrid.gridHeaderElement.style.left = width + "px";
     },
diff --git a/Source/WebCore/inspector/front-end/TimelinePresentationModel.js b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
index 50a9cae75..beb30073d 100644
--- a/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
@@ -128,7 +128,9 @@ WebInspector.TimelinePresentationModel.categoryForRecord = function(record)
 WebInspector.TimelinePresentationModel.isEventDivider = function(record)
 {
     var recordTypes = WebInspector.TimelineModel.RecordType;
-    if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad || record.type === recordTypes.TimeStamp) {
+    if (record.type === recordTypes.TimeStamp)
+        return true;
+    if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad) {
         var mainFrame = WebInspector.resourceTreeModel.mainFrame;
         if (mainFrame && mainFrame.id === record.frameId)
             return true;
diff --git a/Source/WebCore/inspector/front-end/UISourceCodeFrame.js b/Source/WebCore/inspector/front-end/UISourceCodeFrame.js
index db98df877..4a39f2155 100644
--- a/Source/WebCore/inspector/front-end/UISourceCodeFrame.js
+++ b/Source/WebCore/inspector/front-end/UISourceCodeFrame.js
@@ -61,7 +61,7 @@ WebInspector.UISourceCodeFrame.prototype = {
 
     afterTextChanged: function(oldRange, newRange)
     {
-        this._uiSourceCode.setWorkingCopy(this.textModel.text());
+        this._uiSourceCode.setWorkingCopy(this._textEditor.text());
     },
 
     _didEditContent: function(error)
diff --git a/Source/WebCore/inspector/front-end/UIUtils.js b/Source/WebCore/inspector/front-end/UIUtils.js
index ce5b3dbdf..7f93f0d22 100644
--- a/Source/WebCore/inspector/front-end/UIUtils.js
+++ b/Source/WebCore/inspector/front-end/UIUtils.js
@@ -50,8 +50,8 @@ WebInspector.installDragHandle = function(element, elementDragStart, elementDrag
  */
 WebInspector._elementDragStart = function(elementDragStart, elementDrag, elementDragEnd, cursor, event)
 {
-    // Only drag upon left button. Right will likely cause a context menu.
-    if (event.button)
+    // Only drag upon left button. Right will likely cause a context menu. So will ctrl-click on mac.
+    if (event.button || (WebInspector.isMac() && event.ctrlKey))
         return;
 
     if (WebInspector._elementDraggingEventListener)
diff --git a/Source/WebCore/inspector/front-end/UserAgentSupport.js b/Source/WebCore/inspector/front-end/UserAgentSupport.js
index 4eabd7b70..794d11a96 100644
--- a/Source/WebCore/inspector/front-end/UserAgentSupport.js
+++ b/Source/WebCore/inspector/front-end/UserAgentSupport.js
@@ -38,6 +38,7 @@ WebInspector.UserAgentSupport = function()
     WebInspector.settings.deviceMetrics.addChangeListener(this._deviceMetricsChanged, this);
     WebInspector.settings.deviceFitWindow.addChangeListener(this._deviceMetricsChanged, this);
     WebInspector.settings.geolocationOverride.addChangeListener(this._geolocationPositionChanged, this);
+    WebInspector.settings.deviceOrientationOverride.addChangeListener(this._deviceOrientationChanged, this);
 }
 
 /**
@@ -234,6 +235,75 @@ WebInspector.UserAgentSupport.GeolocationPosition.clearGeolocationOverride = fun
     PageAgent.clearGeolocationOverride();
 }
 
+/**
+ * @constructor
+ * @param {number} alpha
+ * @param {number} beta
+ * @param {number} gamma
+ */
+WebInspector.UserAgentSupport.DeviceOrientation = function(alpha, beta, gamma)
+{
+    this.alpha = alpha;
+    this.beta = beta;
+    this.gamma = gamma;
+}
+
+WebInspector.UserAgentSupport.DeviceOrientation.prototype = {
+    /**
+     * @return {string}
+     */
+    toSetting: function()
+    {
+        return JSON.stringify(this);
+    }
+}
+
+/**
+ * @return {WebInspector.UserAgentSupport.DeviceOrientation}
+ */
+WebInspector.UserAgentSupport.DeviceOrientation.parseSetting = function(value)
+{
+    if (value) {
+        var jsonObject = JSON.parse(value);
+        return new WebInspector.UserAgentSupport.DeviceOrientation(jsonObject.alpha, jsonObject.beta, jsonObject.gamma);
+    }
+    return new WebInspector.UserAgentSupport.DeviceOrientation(0, 0, 0);
+}
+
+/**
+ * @return {?WebInspector.UserAgentSupport.DeviceOrientation}
+ */
+WebInspector.UserAgentSupport.DeviceOrientation.parseUserInput = function(alphaString, betaString, gammaString)
+{
+    function isUserInputValid(value)
+    {
+        if (!value)
+            return true;
+        return /^[-]?[0-9]*[.]?[0-9]*$/.test(value);
+    }
+
+    if (!alphaString ^ !betaString ^ !gammaString)
+        return null;
+
+    var isAlphaValid = isUserInputValid(alphaString);
+    var isBetaValid = isUserInputValid(betaString);
+    var isGammaValid = isUserInputValid(gammaString);
+
+    if (!isAlphaValid && !isBetaValid && !isGammaValid)
+        return null;
+
+    var alpha = isAlphaValid ? parseFloat(alphaString) : -1;
+    var beta = isBetaValid ? parseFloat(betaString) : -1;
+    var gamma = isGammaValid ? parseFloat(gammaString) : -1;
+
+    return new WebInspector.UserAgentSupport.DeviceOrientation(alpha, beta, gamma);
+}
+
+WebInspector.UserAgentSupport.DeviceOrientation.clearDeviceOrientationOverride = function()
+{
+    PageAgent.clearDeviceOrientationOverride();
+}
+
 WebInspector.UserAgentSupport.prototype = {
     _deviceMetricsChanged: function()
     {
@@ -249,6 +319,15 @@ WebInspector.UserAgentSupport.prototype = {
             PageAgent.setGeolocationOverride();
         else
             PageAgent.setGeolocationOverride(geolocation.latitude, geolocation.longitude, 150);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _deviceOrientationChanged: function(event)
+    {
+        var deviceOrientation = WebInspector.UserAgentSupport.DeviceOrientation.parseSetting(WebInspector.settings.deviceOrientationOverride.get());
+        PageAgent.setDeviceOrientationOverride(deviceOrientation.alpha, deviceOrientation.beta, deviceOrientation.gamma);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index b028fd9e1..6e745be6f 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -15,6 +15,7 @@
     <file>BreakpointsSidebarPane.js</file>
     <file>CallStackSidebarPane.js</file>
     <file>Checkbox.js</file>
+    <file>CodeMirrorTextEditor.js</file>
     <file>Color.js</file>
     <file>CompilerScriptMapping.js</file>
     <file>ConsoleMessage.js</file>
@@ -32,12 +33,19 @@
     <file>CSSKeywordCompletions.js</file>
     <file>CSSSelectorProfileView.js</file>
     <file>CSSStyleModel.js</file>
+    <file>cm/codemirror.css</file>
+    <file>cm/codemirror.js</file>
+    <file>cm/css.js</file>
+    <file>cm/htmlmixed.js</file>
+    <file>cm/javascript.js</file>
+    <file>cm/xml.js</file>
     <file>Database.js</file>
     <file>DatabaseQueryView.js</file>
     <file>DatabaseTableView.js</file>
     <file>DataGrid.js</file>
     <file>DebuggerModel.js</file>
     <file>DebuggerScriptMapping.js</file>
+    <file>DefaultTextEditor.js</file>
     <file>Dialog.js</file>
     <file>DirectoryContentView.js</file>
     <file>DOMAgent.js</file>
@@ -62,6 +70,7 @@
     <file>FileManager.js</file>
     <file>FileSystemModel.js</file>
     <file>FileSystemView.js</file>
+    <file>FileUtils.js</file>
     <file>FilteredItemSelectionDialog.js</file>
     <file>FontView.js</file>
     <file>GoToLineDialog.js</file>
@@ -112,6 +121,7 @@
     <file>ProfileDataGridTree.js</file>
     <file>ProfileLauncherView.js</file>
     <file>ProfilesPanel.js</file>
+    <file>ProgressBar.js</file>
     <file>PropertiesSection.js</file>
     <file>PropertiesSidebarPane.js</file>
     <file>RawSourceCode.js</file>
@@ -195,6 +205,7 @@
     <file>UglifyJS/parse-js.js</file>
     <file>auditsPanel.css</file>
     <file>dataGrid.css</file>
+    <file>cmdevtools.css</file>
     <file>dialog.css</file>
     <file>elementsPanel.css</file>
     <file>filteredItemSelectionDialog.css</file>
diff --git a/Source/WebCore/inspector/front-end/WorkerManager.js b/Source/WebCore/inspector/front-end/WorkerManager.js
index 37f4678f7..ec295d449 100644
--- a/Source/WebCore/inspector/front-end/WorkerManager.js
+++ b/Source/WebCore/inspector/front-end/WorkerManager.js
@@ -44,6 +44,11 @@ WebInspector.WorkerManager.isWorkerFrontend = function()
            !!WebInspector.queryParamsObject["isSharedWorker"];
 }
 
+WebInspector.WorkerManager.isDedicatedWorkerFrontend = function()
+{
+    return !!WebInspector.queryParamsObject["dedicatedWorkerId"];
+}
+
 WebInspector.WorkerManager.loaded = function()
 {
     var workerId = WebInspector.queryParamsObject["dedicatedWorkerId"];
diff --git a/Source/WebCore/inspector/front-end/cm/LICENSE b/Source/WebCore/inspector/front-end/cm/LICENSE
new file mode 100644
index 000000000..3916e96b2
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/cm/LICENSE
@@ -0,0 +1,23 @@
+Copyright (C) 2012 by Marijn Haverbeke <marijnh@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+Please note that some subdirectories of the CodeMirror distribution
+include their own LICENSE files, and are released under different
+licences.
diff --git a/Source/WebCore/inspector/front-end/cm/codemirror.css b/Source/WebCore/inspector/front-end/cm/codemirror.css
new file mode 100644
index 000000000..f0e91b2d7
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/cm/codemirror.css
@@ -0,0 +1,173 @@
+.CodeMirror {
+  line-height: 1em;
+  font-family: monospace;
+
+  /* Necessary so the scrollbar can be absolutely positioned within the wrapper on Lion. */
+  position: relative;
+  /* This prevents unwanted scrollbars from showing up on the body and wrapper in IE. */
+  overflow: hidden;
+}
+
+.CodeMirror-scroll {
+  overflow: auto;
+  height: 300px;
+  /* This is needed to prevent an IE[67] bug where the scrolled content
+     is visible outside of the scrolling box. */
+  position: relative;
+  outline: none;
+}
+
+/* Vertical scrollbar */
+.CodeMirror-scrollbar {
+  position: absolute;
+  right: 0; top: 0;
+  overflow-x: hidden;
+  overflow-y: scroll;
+  z-index: 5;
+}
+.CodeMirror-scrollbar-inner {
+  /* This needs to have a nonzero width in order for the scrollbar to appear
+     in Firefox and IE9. */
+  width: 1px;
+}
+.CodeMirror-scrollbar.cm-sb-overlap {
+  /* Ensure that the scrollbar appears in Lion, and that it overlaps the content
+     rather than sitting to the right of it. */
+  position: absolute;
+  z-index: 1;
+  float: none;
+  right: 0;
+  min-width: 12px;
+}
+.CodeMirror-scrollbar.cm-sb-nonoverlap {
+  min-width: 12px;
+}
+.CodeMirror-scrollbar.cm-sb-ie7 {
+  min-width: 18px;
+}
+
+.CodeMirror-gutter {
+  position: absolute; left: 0; top: 0;
+  z-index: 10;
+  background-color: #f7f7f7;
+  border-right: 1px solid #eee;
+  min-width: 2em;
+  height: 100%;
+}
+.CodeMirror-gutter-text {
+  color: #aaa;
+  text-align: right;
+  padding: .4em .2em .4em .4em;
+  white-space: pre !important;
+  cursor: default;
+}
+.CodeMirror-lines {
+  padding: .4em;
+  white-space: pre;
+  cursor: text;
+}
+
+.CodeMirror pre {
+  -moz-border-radius: 0;
+  -webkit-border-radius: 0;
+  -o-border-radius: 0;
+  border-radius: 0;
+  border-width: 0; margin: 0; padding: 0; background: transparent;
+  font-family: inherit;
+  font-size: inherit;
+  padding: 0; margin: 0;
+  white-space: pre;
+  word-wrap: normal;
+  line-height: inherit;
+  color: inherit;
+}
+
+.CodeMirror-wrap pre {
+  word-wrap: break-word;
+  white-space: pre-wrap;
+  word-break: normal;
+}
+.CodeMirror-wrap .CodeMirror-scroll {
+  overflow-x: hidden;
+}
+
+.CodeMirror textarea {
+  outline: none !important;
+}
+
+.CodeMirror pre.CodeMirror-cursor {
+  z-index: 10;
+  position: absolute;
+  visibility: hidden;
+  border-left: 1px solid black;
+  border-right: none;
+  width: 0;
+}
+.cm-keymap-fat-cursor pre.CodeMirror-cursor {
+  width: auto;
+  border: 0;
+  background: transparent;
+  background: rgba(0, 200, 0, .4);
+  filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=#6600c800, endColorstr=#4c00c800);
+}
+/* Kludge to turn off filter in ie9+, which also accepts rgba */
+.cm-keymap-fat-cursor pre.CodeMirror-cursor:not(#nonsense_id) {
+  filter: progid:DXImageTransform.Microsoft.gradient(enabled=false);
+}
+.CodeMirror pre.CodeMirror-cursor.CodeMirror-overwrite {}
+.CodeMirror-focused pre.CodeMirror-cursor {
+  visibility: visible;
+}
+
+div.CodeMirror-selected { background: #d9d9d9; }
+.CodeMirror-focused div.CodeMirror-selected { background: #d7d4f0; }
+
+.CodeMirror-searching {
+  background: #ffa;
+  background: rgba(255, 255, 0, .4);
+}
+
+/* Default theme */
+
+.cm-s-default span.cm-keyword {color: #708;}
+.cm-s-default span.cm-atom {color: #219;}
+.cm-s-default span.cm-number {color: #164;}
+.cm-s-default span.cm-def {color: #00f;}
+.cm-s-default span.cm-variable {color: black;}
+.cm-s-default span.cm-variable-2 {color: #05a;}
+.cm-s-default span.cm-variable-3 {color: #085;}
+.cm-s-default span.cm-property {color: black;}
+.cm-s-default span.cm-operator {color: black;}
+.cm-s-default span.cm-comment {color: #a50;}
+.cm-s-default span.cm-string {color: #a11;}
+.cm-s-default span.cm-string-2 {color: #f50;}
+.cm-s-default span.cm-meta {color: #555;}
+.cm-s-default span.cm-error {color: #f00;}
+.cm-s-default span.cm-qualifier {color: #555;}
+.cm-s-default span.cm-builtin {color: #30a;}
+.cm-s-default span.cm-bracket {color: #cc7;}
+.cm-s-default span.cm-tag {color: #170;}
+.cm-s-default span.cm-attribute {color: #00c;}
+.cm-s-default span.cm-header {color: blue;}
+.cm-s-default span.cm-quote {color: #090;}
+.cm-s-default span.cm-hr {color: #999;}
+.cm-s-default span.cm-link {color: #00c;}
+
+span.cm-header, span.cm-strong {font-weight: bold;}
+span.cm-em {font-style: italic;}
+span.cm-emstrong {font-style: italic; font-weight: bold;}
+span.cm-link {text-decoration: underline;}
+
+span.cm-invalidchar {color: #f00;}
+
+div.CodeMirror span.CodeMirror-matchingbracket {color: #0f0;}
+div.CodeMirror span.CodeMirror-nonmatchingbracket {color: #f22;}
+
+@media print {
+
+  /* Hide the cursor when printing */
+  .CodeMirror pre.CodeMirror-cursor {
+    visibility: hidden;
+  }
+
+}
\ No newline at end of file
diff --git a/Source/WebCore/inspector/front-end/cm/codemirror.js b/Source/WebCore/inspector/front-end/cm/codemirror.js
new file mode 100644
index 000000000..d7b8f8c99
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/cm/codemirror.js
@@ -0,0 +1,3220 @@
+// All functions that need access to the editor's state live inside
+// the CodeMirror function. Below that, at the bottom of the file,
+// some utilities are defined.
+
+// CodeMirror is the only global var we claim
+var CodeMirror = (function() {
+  "use strict";
+  // This is the function that produces an editor instance. Its
+  // closure is used to store the editor state.
+  function CodeMirror(place, givenOptions) {
+    // Determine effective options based on given values and defaults.
+    var options = {}, defaults = CodeMirror.defaults;
+    for (var opt in defaults)
+      if (defaults.hasOwnProperty(opt))
+        options[opt] = (givenOptions && givenOptions.hasOwnProperty(opt) ? givenOptions : defaults)[opt];
+
+    var input = elt("textarea", null, null, "position: absolute; padding: 0; width: 1px; height: 1em");
+    input.setAttribute("wrap", "off"); input.setAttribute("autocorrect", "off"); input.setAttribute("autocapitalize", "off");
+    // Wraps and hides input textarea
+    var inputDiv = elt("div", [input], null, "overflow: hidden; position: relative; width: 3px; height: 0px;");
+    // The empty scrollbar content, used solely for managing the scrollbar thumb.
+    var scrollbarInner = elt("div", null, "CodeMirror-scrollbar-inner");
+    // The vertical scrollbar. Horizontal scrolling is handled by the scroller itself.
+    var scrollbar = elt("div", [scrollbarInner], "CodeMirror-scrollbar");
+    // DIVs containing the selection and the actual code
+    var lineDiv = elt("div"), selectionDiv = elt("div", null, null, "position: relative; z-index: -1");
+    // Blinky cursor, and element used to ensure cursor fits at the end of a line
+    var cursor = elt("pre", "\u00a0", "CodeMirror-cursor"), widthForcer = elt("pre", "\u00a0", "CodeMirror-cursor", "visibility: hidden");
+    // Used to measure text size
+    var measure = elt("div", null, null, "position: absolute; width: 100%; height: 0px; overflow: hidden; visibility: hidden;");
+    var lineSpace = elt("div", [measure, cursor, widthForcer, selectionDiv, lineDiv], null, "position: relative; z-index: 0");
+    var gutterText = elt("div", null, "CodeMirror-gutter-text"), gutter = elt("div", [gutterText], "CodeMirror-gutter");
+    // Moved around its parent to cover visible view
+    var mover = elt("div", [gutter, elt("div", [lineSpace], "CodeMirror-lines")], null, "position: relative");
+    // Set to the height of the text, causes scrolling
+    var sizer = elt("div", [mover], null, "position: relative");
+    // Provides scrolling
+    var scroller = elt("div", [sizer], "CodeMirror-scroll");
+    scroller.setAttribute("tabIndex", "-1");
+    // The element in which the editor lives.
+    var wrapper = elt("div", [inputDiv, scrollbar, scroller], "CodeMirror" + (options.lineWrapping ? " CodeMirror-wrap" : ""));
+    if (place.appendChild) place.appendChild(wrapper); else place(wrapper);
+
+    themeChanged(); keyMapChanged();
+    // Needed to hide big blue blinking cursor on Mobile Safari
+    if (ios) input.style.width = "0px";
+    if (!webkit) scroller.draggable = true;
+    lineSpace.style.outline = "none";
+    if (options.tabindex != null) input.tabIndex = options.tabindex;
+    if (options.autofocus) focusInput();
+    if (!options.gutter && !options.lineNumbers) gutter.style.display = "none";
+    // Needed to handle Tab key in KHTML
+    if (khtml) inputDiv.style.height = "1px", inputDiv.style.position = "absolute";
+
+    // Check for OS X >= 10.7. If so, we need to force a width on the scrollbar, and
+    // make it overlap the content. (But we only do this if the scrollbar doesn't already
+    // have a natural width. If the mouse is plugged in or the user sets the system pref
+    // to always show scrollbars, the scrollbar shouldn't overlap.)
+    if (mac_geLion) {
+      scrollbar.className += (overlapScrollbars() ? " cm-sb-overlap" : " cm-sb-nonoverlap");
+    } else if (ie_lt8) {
+      // Need to set a minimum width to see the scrollbar on IE7 (but must not set it on IE8).
+      scrollbar.className += " cm-sb-ie7";
+    }
+
+    // Check for problem with IE innerHTML not working when we have a
+    // P (or similar) parent node.
+    try { charWidth(); }
+    catch (e) {
+      if (e.message.match(/runtime/i))
+        e = new Error("A CodeMirror inside a P-style element does not work in Internet Explorer. (innerHTML bug)");
+      throw e;
+    }
+
+    // Delayed object wrap timeouts, making sure only one is active. blinker holds an interval.
+    var poll = new Delayed(), highlight = new Delayed(), blinker;
+
+    // mode holds a mode API object. doc is the tree of Line objects,
+    // work an array of lines that should be parsed, and history the
+    // undo history (instance of History constructor).
+    var mode, doc = new BranchChunk([new LeafChunk([new Line("")])]), work, focused;
+    loadMode();
+    // The selection. These are always maintained to point at valid
+    // positions. Inverted is used to remember that the user is
+    // selecting bottom-to-top.
+    var sel = {from: {line: 0, ch: 0}, to: {line: 0, ch: 0}, inverted: false};
+    // Selection-related flags. shiftSelecting obviously tracks
+    // whether the user is holding shift.
+    var shiftSelecting, lastClick, lastDoubleClick, lastScrollTop = 0, draggingText,
+        overwrite = false, suppressEdits = false;
+    // Variables used by startOperation/endOperation to track what
+    // happened during the operation.
+    var updateInput, userSelChange, changes, textChanged, selectionChanged, leaveInputAlone,
+        gutterDirty, callbacks;
+    // Current visible range (may be bigger than the view window).
+    var displayOffset = 0, showingFrom = 0, showingTo = 0, lastSizeC = 0;
+    // bracketHighlighted is used to remember that a bracket has been
+    // marked.
+    var bracketHighlighted;
+    // Tracks the maximum line length so that the horizontal scrollbar
+    // can be kept static when scrolling.
+    var maxLine = getLine(0), updateMaxLine = false, maxLineChanged = true;
+    var tabCache = {};
+    var pollingFast = false; // Ensures slowPoll doesn't cancel fastPoll
+    var goalColumn = null;
+
+    // Initialize the content.
+    operation(function(){setValue(options.value || ""); updateInput = false;})();
+    var history = new History();
+
+    // Register our event handlers.
+    connect(scroller, "mousedown", operation(onMouseDown));
+    connect(scroller, "dblclick", operation(onDoubleClick));
+    connect(lineSpace, "selectstart", e_preventDefault);
+    // Gecko browsers fire contextmenu *after* opening the menu, at
+    // which point we can't mess with it anymore. Context menu is
+    // handled in onMouseDown for Gecko.
+    if (!gecko) connect(scroller, "contextmenu", onContextMenu);
+    connect(scroller, "scroll", onScrollMain);
+    connect(scrollbar, "scroll", onScrollBar);
+    connect(scrollbar, "mousedown", function() {if (focused) setTimeout(focusInput, 0);});
+    connect(window, "resize", function() {updateDisplay(true);});
+    connect(input, "keyup", operation(onKeyUp));
+    connect(input, "input", fastPoll);
+    connect(input, "keydown", operation(onKeyDown));
+    connect(input, "keypress", operation(onKeyPress));
+    connect(input, "focus", onFocus);
+    connect(input, "blur", onBlur);
+
+    function drag_(e) {
+      if (options.onDragEvent && options.onDragEvent(instance, addStop(e))) return;
+      e_stop(e);
+    }
+    if (options.dragDrop) {
+      connect(scroller, "dragstart", onDragStart);
+      connect(scroller, "dragenter", drag_);
+      connect(scroller, "dragover", drag_);
+      connect(scroller, "drop", operation(onDrop));
+    }
+    connect(scroller, "paste", function(){focusInput(); fastPoll();});
+    connect(input, "paste", fastPoll);
+    connect(input, "cut", operation(function(){
+      if (!options.readOnly) replaceSelection("");
+    }));
+
+    // Needed to handle Tab key in KHTML
+    if (khtml) connect(sizer, "mouseup", function() {
+        if (document.activeElement == input) input.blur();
+        focusInput();
+    });
+
+    // IE throws unspecified error in certain cases, when
+    // trying to access activeElement before onload
+    var hasFocus; try { hasFocus = (document.activeElement == input); } catch(e) { }
+    if (hasFocus || options.autofocus) setTimeout(onFocus, 20);
+    else onBlur();
+
+    function isLine(l) {return l >= 0 && l < doc.size;}
+    // The instance object that we'll return. Mostly calls out to
+    // local functions in the CodeMirror function. Some do some extra
+    // range checking and/or clipping. operation is used to wrap the
+    // call so that changes it makes are tracked, and the display is
+    // updated afterwards.
+    var instance = wrapper.CodeMirror = {
+      getValue: getValue,
+      setValue: operation(setValue),
+      getSelection: getSelection,
+      replaceSelection: operation(replaceSelection),
+      focus: function(){window.focus(); focusInput(); onFocus(); fastPoll();},
+      setOption: function(option, value) {
+        var oldVal = options[option];
+        options[option] = value;
+        if (option == "mode" || option == "indentUnit") loadMode();
+        else if (option == "readOnly" && value == "nocursor") {onBlur(); input.blur();}
+        else if (option == "readOnly" && !value) {resetInput(true);}
+        else if (option == "theme") themeChanged();
+        else if (option == "lineWrapping" && oldVal != value) operation(wrappingChanged)();
+        else if (option == "tabSize") updateDisplay(true);
+        else if (option == "keyMap") keyMapChanged();
+        if (option == "lineNumbers" || option == "gutter" || option == "firstLineNumber" ||
+            option == "theme" || option == "lineNumberFormatter") {
+          gutterChanged();
+          updateDisplay(true);
+        }
+      },
+      getOption: function(option) {return options[option];},
+      undo: operation(undo),
+      redo: operation(redo),
+      indentLine: operation(function(n, dir) {
+        if (typeof dir != "string") {
+          if (dir == null) dir = options.smartIndent ? "smart" : "prev";
+          else dir = dir ? "add" : "subtract";
+        }
+        if (isLine(n)) indentLine(n, dir);
+      }),
+      indentSelection: operation(indentSelected),
+      historySize: function() {return {undo: history.done.length, redo: history.undone.length};},
+      clearHistory: function() {history = new History();},
+      setHistory: function(histData) {
+        history = new History();
+        history.done = histData.done;
+        history.undone = histData.undone;
+      },
+      getHistory: function() {
+        history.time = 0;
+        return {done: history.done.concat([]), undone: history.undone.concat([])};
+      },
+      matchBrackets: operation(function(){matchBrackets(true);}),
+      getTokenAt: operation(function(pos) {
+        pos = clipPos(pos);
+        return getLine(pos.line).getTokenAt(mode, getStateBefore(pos.line), options.tabSize, pos.ch);
+      }),
+      getStateAfter: function(line) {
+        line = clipLine(line == null ? doc.size - 1: line);
+        return getStateBefore(line + 1);
+      },
+      cursorCoords: function(start, mode) {
+        if (start == null) start = sel.inverted;
+        return this.charCoords(start ? sel.from : sel.to, mode);
+      },
+      charCoords: function(pos, mode) {
+        pos = clipPos(pos);
+        if (mode == "local") return localCoords(pos, false);
+        if (mode == "div") return localCoords(pos, true);
+        return pageCoords(pos);
+      },
+      coordsChar: function(coords) {
+        var off = eltOffset(lineSpace);
+        return coordsChar(coords.x - off.left, coords.y - off.top);
+      },
+      markText: operation(markText),
+      setBookmark: setBookmark,
+      findMarksAt: findMarksAt,
+      setMarker: operation(addGutterMarker),
+      clearMarker: operation(removeGutterMarker),
+      setLineClass: operation(setLineClass),
+      hideLine: operation(function(h) {return setLineHidden(h, true);}),
+      showLine: operation(function(h) {return setLineHidden(h, false);}),
+      onDeleteLine: function(line, f) {
+        if (typeof line == "number") {
+          if (!isLine(line)) return null;
+          line = getLine(line);
+        }
+        (line.handlers || (line.handlers = [])).push(f);
+        return line;
+      },
+      lineInfo: lineInfo,
+      addWidget: function(pos, node, scroll, vert, horiz) {
+        pos = localCoords(clipPos(pos));
+        var top = pos.yBot, left = pos.x;
+        node.style.position = "absolute";
+        sizer.appendChild(node);
+        if (vert == "over") top = pos.y;
+        else if (vert == "near") {
+          var vspace = Math.max(scroller.offsetHeight, doc.height * textHeight()),
+              hspace = Math.max(sizer.clientWidth, lineSpace.clientWidth) - paddingLeft();
+          if (pos.yBot + node.offsetHeight > vspace && pos.y > node.offsetHeight)
+            top = pos.y - node.offsetHeight;
+          if (left + node.offsetWidth > hspace)
+            left = hspace - node.offsetWidth;
+        }
+        node.style.top = (top + paddingTop()) + "px";
+        node.style.left = node.style.right = "";
+        if (horiz == "right") {
+          left = sizer.clientWidth - node.offsetWidth;
+          node.style.right = "0px";
+        } else {
+          if (horiz == "left") left = 0;
+          else if (horiz == "middle") left = (sizer.clientWidth - node.offsetWidth) / 2;
+          node.style.left = (left + paddingLeft()) + "px";
+        }
+        if (scroll)
+          scrollIntoView(left, top, left + node.offsetWidth, top + node.offsetHeight);
+      },
+
+      lineCount: function() {return doc.size;},
+      clipPos: clipPos,
+      getCursor: function(start) {
+        if (start == null) start = sel.inverted;
+        return copyPos(start ? sel.from : sel.to);
+      },
+      somethingSelected: function() {return !posEq(sel.from, sel.to);},
+      setCursor: operation(function(line, ch, user) {
+        if (ch == null && typeof line.line == "number") setCursor(line.line, line.ch, user);
+        else setCursor(line, ch, user);
+      }),
+      setSelection: operation(function(from, to, user) {
+        (user ? setSelectionUser : setSelection)(clipPos(from), clipPos(to || from));
+      }),
+      getLine: function(line) {if (isLine(line)) return getLine(line).text;},
+      getLineHandle: function(line) {if (isLine(line)) return getLine(line);},
+      setLine: operation(function(line, text) {
+        if (isLine(line)) replaceRange(text, {line: line, ch: 0}, {line: line, ch: getLine(line).text.length});
+      }),
+      removeLine: operation(function(line) {
+        if (isLine(line)) replaceRange("", {line: line, ch: 0}, clipPos({line: line+1, ch: 0}));
+      }),
+      replaceRange: operation(replaceRange),
+      getRange: function(from, to, lineSep) {return getRange(clipPos(from), clipPos(to), lineSep);},
+
+      triggerOnKeyDown: operation(onKeyDown),
+      execCommand: function(cmd) {return commands[cmd](instance);},
+      // Stuff used by commands, probably not much use to outside code.
+      moveH: operation(moveH),
+      deleteH: operation(deleteH),
+      moveV: operation(moveV),
+      toggleOverwrite: function() {
+        if(overwrite){
+          overwrite = false;
+          cursor.className = cursor.className.replace(" CodeMirror-overwrite", "");
+        } else {
+          overwrite = true;
+          cursor.className += " CodeMirror-overwrite";
+        }
+      },
+
+      posFromIndex: function(off) {
+        var lineNo = 0, ch;
+        doc.iter(0, doc.size, function(line) {
+          var sz = line.text.length + 1;
+          if (sz > off) { ch = off; return true; }
+          off -= sz;
+          ++lineNo;
+        });
+        return clipPos({line: lineNo, ch: ch});
+      },
+      indexFromPos: function (coords) {
+        if (coords.line < 0 || coords.ch < 0) return 0;
+        var index = coords.ch;
+        doc.iter(0, coords.line, function (line) {
+          index += line.text.length + 1;
+        });
+        return index;
+      },
+      scrollTo: function(x, y) {
+        if (x != null) scroller.scrollLeft = x;
+        if (y != null) scrollbar.scrollTop = scroller.scrollTop = y;
+        updateDisplay([]);
+      },
+      getScrollInfo: function() {
+        return {x: scroller.scrollLeft, y: scrollbar.scrollTop,
+                height: scrollbar.scrollHeight, width: scroller.scrollWidth};
+      },
+      setSize: function(width, height) {
+        function interpret(val) {
+          val = String(val);
+          return /^\d+$/.test(val) ? val + "px" : val;
+        }
+        if (width != null) wrapper.style.width = interpret(width);
+        if (height != null) scroller.style.height = interpret(height);
+        instance.refresh();
+      },
+
+      operation: function(f){return operation(f)();},
+      compoundChange: function(f){return compoundChange(f);},
+      refresh: function(){
+        updateDisplay(true, null, lastScrollTop);
+        if (scrollbar.scrollHeight > lastScrollTop)
+          scrollbar.scrollTop = lastScrollTop;
+      },
+      getInputField: function(){return input;},
+      getWrapperElement: function(){return wrapper;},
+      getScrollerElement: function(){return scroller;},
+      getGutterElement: function(){return gutter;}
+    };
+
+    function getLine(n) { return getLineAt(doc, n); }
+    function updateLineHeight(line, height) {
+      gutterDirty = true;
+      var diff = height - line.height;
+      for (var n = line; n; n = n.parent) n.height += diff;
+    }
+
+    function setValue(code) {
+      var top = {line: 0, ch: 0};
+      updateLines(top, {line: doc.size - 1, ch: getLine(doc.size-1).text.length},
+                  splitLines(code), top, top);
+      updateInput = true;
+    }
+    function getValue(lineSep) {
+      var text = [];
+      doc.iter(0, doc.size, function(line) { text.push(line.text); });
+      return text.join(lineSep || "\n");
+    }
+
+    function onScrollBar(e) {
+      if (scrollbar.scrollTop != lastScrollTop) {
+        lastScrollTop = scroller.scrollTop = scrollbar.scrollTop;
+        updateDisplay([]);
+      }
+    }
+
+    function onScrollMain(e) {
+      if (options.fixedGutter && gutter.style.left != scroller.scrollLeft + "px")
+        gutter.style.left = scroller.scrollLeft + "px";
+      if (scroller.scrollTop != lastScrollTop) {
+        lastScrollTop = scroller.scrollTop;
+        if (scrollbar.scrollTop != lastScrollTop)
+          scrollbar.scrollTop = lastScrollTop;
+        updateDisplay([]);
+      }
+      if (options.onScroll) options.onScroll(instance);
+    }
+
+    function onMouseDown(e) {
+      setShift(e_prop(e, "shiftKey"));
+      // Check whether this is a click in a widget
+      for (var n = e_target(e); n != wrapper; n = n.parentNode)
+        if (n.parentNode == sizer && n != mover) return;
+
+      // See if this is a click in the gutter
+      for (var n = e_target(e); n != wrapper; n = n.parentNode)
+        if (n.parentNode == gutterText) {
+          if (options.onGutterClick)
+            options.onGutterClick(instance, indexOf(gutterText.childNodes, n) + showingFrom, e);
+          return e_preventDefault(e);
+        }
+
+      var start = posFromMouse(e);
+
+      switch (e_button(e)) {
+      case 3:
+        if (gecko) onContextMenu(e);
+        return;
+      case 2:
+        if (start) setCursor(start.line, start.ch, true);
+        setTimeout(focusInput, 20);
+        e_preventDefault(e);
+        return;
+      }
+      // For button 1, if it was clicked inside the editor
+      // (posFromMouse returning non-null), we have to adjust the
+      // selection.
+      if (!start) {if (e_target(e) == scroller) e_preventDefault(e); return;}
+
+      if (!focused) onFocus();
+
+      var now = +new Date, type = "single";
+      if (lastDoubleClick && lastDoubleClick.time > now - 400 && posEq(lastDoubleClick.pos, start)) {
+        type = "triple";
+        e_preventDefault(e);
+        setTimeout(focusInput, 20);
+        selectLine(start.line);
+      } else if (lastClick && lastClick.time > now - 400 && posEq(lastClick.pos, start)) {
+        type = "double";
+        lastDoubleClick = {time: now, pos: start};
+        e_preventDefault(e);
+        var word = findWordAt(start);
+        setSelectionUser(word.from, word.to);
+      } else { lastClick = {time: now, pos: start}; }
+
+      function dragEnd(e2) {
+        if (webkit) scroller.draggable = false;
+        draggingText = false;
+        up(); drop();
+        if (Math.abs(e.clientX - e2.clientX) + Math.abs(e.clientY - e2.clientY) < 10) {
+          e_preventDefault(e2);
+          setCursor(start.line, start.ch, true);
+          focusInput();
+        }
+      }
+      var last = start, going;
+      if (options.dragDrop && dragAndDrop && !options.readOnly && !posEq(sel.from, sel.to) &&
+          !posLess(start, sel.from) && !posLess(sel.to, start) && type == "single") {
+        // Let the drag handler handle this.
+        if (webkit) scroller.draggable = true;
+        var up = connect(document, "mouseup", operation(dragEnd), true);
+        var drop = connect(scroller, "drop", operation(dragEnd), true);
+        draggingText = true;
+        // IE's approach to draggable
+        if (scroller.dragDrop) scroller.dragDrop();
+        return;
+      }
+      e_preventDefault(e);
+      if (type == "single") setCursor(start.line, start.ch, true);
+
+      var startstart = sel.from, startend = sel.to;
+
+      function doSelect(cur) {
+        if (type == "single") {
+          setSelectionUser(start, cur);
+        } else if (type == "double") {
+          var word = findWordAt(cur);
+          if (posLess(cur, startstart)) setSelectionUser(word.from, startend);
+          else setSelectionUser(startstart, word.to);
+        } else if (type == "triple") {
+          if (posLess(cur, startstart)) setSelectionUser(startend, clipPos({line: cur.line, ch: 0}));
+          else setSelectionUser(startstart, clipPos({line: cur.line + 1, ch: 0}));
+        }
+      }
+
+      function extend(e) {
+        var cur = posFromMouse(e, true);
+        if (cur && !posEq(cur, last)) {
+          if (!focused) onFocus();
+          last = cur;
+          doSelect(cur);
+          updateInput = false;
+          var visible = visibleLines();
+          if (cur.line >= visible.to || cur.line < visible.from)
+            going = setTimeout(operation(function(){extend(e);}), 150);
+        }
+      }
+
+      function done(e) {
+        clearTimeout(going);
+        var cur = posFromMouse(e);
+        if (cur) doSelect(cur);
+        e_preventDefault(e);
+        focusInput();
+        updateInput = true;
+        move(); up();
+      }
+      var move = connect(document, "mousemove", operation(function(e) {
+        clearTimeout(going);
+        e_preventDefault(e);
+        if (!ie && !e_button(e)) done(e);
+        else extend(e);
+      }), true);
+      var up = connect(document, "mouseup", operation(done), true);
+    }
+    function onDoubleClick(e) {
+      for (var n = e_target(e); n != wrapper; n = n.parentNode)
+        if (n.parentNode == gutterText) return e_preventDefault(e);
+      e_preventDefault(e);
+    }
+    function onDrop(e) {
+      if (options.onDragEvent && options.onDragEvent(instance, addStop(e))) return;
+      e_preventDefault(e);
+      var pos = posFromMouse(e, true), files = e.dataTransfer.files;
+      if (!pos || options.readOnly) return;
+      if (files && files.length && window.FileReader && window.File) {
+        var n = files.length, text = Array(n), read = 0;
+        var loadFile = function(file, i) {
+          var reader = new FileReader;
+          reader.onload = function() {
+            text[i] = reader.result;
+            if (++read == n) {
+              pos = clipPos(pos);
+              operation(function() {
+                var end = replaceRange(text.join(""), pos, pos);
+                setSelectionUser(pos, end);
+              })();
+            }
+          };
+          reader.readAsText(file);
+        };
+        for (var i = 0; i < n; ++i) loadFile(files[i], i);
+      } else {
+        // Don't do a replace if the drop happened inside of the selected text.
+        if (draggingText && !(posLess(pos, sel.from) || posLess(sel.to, pos))) return;
+        try {
+          var text = e.dataTransfer.getData("Text");
+          if (text) {
+            compoundChange(function() {
+              var curFrom = sel.from, curTo = sel.to;
+              setSelectionUser(pos, pos);
+              if (draggingText) replaceRange("", curFrom, curTo);
+              replaceSelection(text);
+              focusInput();
+            });
+          }
+        }
+        catch(e){}
+      }
+    }
+    function onDragStart(e) {
+      var txt = getSelection();
+      e.dataTransfer.setData("Text", txt);
+
+      // Use dummy image instead of default browsers image.
+      if (gecko || chrome || opera) {
+        var img = elt('img');
+        img.scr = 'data:image/gif;base64,R0lGODdhAgACAIAAAAAAAP///ywAAAAAAgACAAACAoRRADs='; //1x1 image
+        e.dataTransfer.setDragImage(img, 0, 0);
+      }
+    }
+
+    function doHandleBinding(bound, dropShift) {
+      if (typeof bound == "string") {
+        bound = commands[bound];
+        if (!bound) return false;
+      }
+      var prevShift = shiftSelecting;
+      try {
+        if (options.readOnly) suppressEdits = true;
+        if (dropShift) shiftSelecting = null;
+        bound(instance);
+      } catch(e) {
+        if (e != Pass) throw e;
+        return false;
+      } finally {
+        shiftSelecting = prevShift;
+        suppressEdits = false;
+      }
+      return true;
+    }
+    var maybeTransition;
+    function handleKeyBinding(e) {
+      // Handle auto keymap transitions
+      var startMap = getKeyMap(options.keyMap), next = startMap.auto;
+      clearTimeout(maybeTransition);
+      if (next && !isModifierKey(e)) maybeTransition = setTimeout(function() {
+        if (getKeyMap(options.keyMap) == startMap) {
+          options.keyMap = (next.call ? next.call(null, instance) : next);
+        }
+      }, 50);
+
+      var name = keyNames[e_prop(e, "keyCode")], handled = false;
+      if (name == null || e.altGraphKey) return false;
+      if (e_prop(e, "altKey")) name = "Alt-" + name;
+      if (e_prop(e, "ctrlKey")) name = "Ctrl-" + name;
+      if (e_prop(e, "metaKey")) name = "Cmd-" + name;
+
+      var stopped = false;
+      function stop() { stopped = true; }
+
+      if (e_prop(e, "shiftKey")) {
+        handled = lookupKey("Shift-" + name, options.extraKeys, options.keyMap,
+                            function(b) {return doHandleBinding(b, true);}, stop)
+               || lookupKey(name, options.extraKeys, options.keyMap, function(b) {
+                 if (typeof b == "string" && /^go[A-Z]/.test(b)) return doHandleBinding(b);
+               }, stop);
+      } else {
+        handled = lookupKey(name, options.extraKeys, options.keyMap, doHandleBinding, stop);
+      }
+      if (stopped) handled = false;
+      if (handled) {
+        e_preventDefault(e);
+        restartBlink();
+        if (ie) { e.oldKeyCode = e.keyCode; e.keyCode = 0; }
+      }
+      return handled;
+    }
+    function handleCharBinding(e, ch) {
+      var handled = lookupKey("'" + ch + "'", options.extraKeys,
+                              options.keyMap, function(b) { return doHandleBinding(b, true); });
+      if (handled) {
+        e_preventDefault(e);
+        restartBlink();
+      }
+      return handled;
+    }
+
+    var lastStoppedKey = null;
+    function onKeyDown(e) {
+      if (!focused) onFocus();
+      if (ie && e.keyCode == 27) { e.returnValue = false; }
+      if (pollingFast) { if (readInput()) pollingFast = false; }
+      if (options.onKeyEvent && options.onKeyEvent(instance, addStop(e))) return;
+      var code = e_prop(e, "keyCode");
+      // IE does strange things with escape.
+      setShift(code == 16 || e_prop(e, "shiftKey"));
+      // First give onKeyEvent option a chance to handle this.
+      var handled = handleKeyBinding(e);
+      if (opera) {
+        lastStoppedKey = handled ? code : null;
+        // Opera has no cut event... we try to at least catch the key combo
+        if (!handled && code == 88 && e_prop(e, mac ? "metaKey" : "ctrlKey"))
+          replaceSelection("");
+      }
+    }
+    function onKeyPress(e) {
+      if (pollingFast) readInput();
+      if (options.onKeyEvent && options.onKeyEvent(instance, addStop(e))) return;
+      var keyCode = e_prop(e, "keyCode"), charCode = e_prop(e, "charCode");
+      if (opera && keyCode == lastStoppedKey) {lastStoppedKey = null; e_preventDefault(e); return;}
+      if (((opera && (!e.which || e.which < 10)) || khtml) && handleKeyBinding(e)) return;
+      var ch = String.fromCharCode(charCode == null ? keyCode : charCode);
+      if (options.electricChars && mode.electricChars && options.smartIndent && !options.readOnly) {
+        if (mode.electricChars.indexOf(ch) > -1)
+          setTimeout(operation(function() {indentLine(sel.to.line, "smart");}), 75);
+      }
+      if (handleCharBinding(e, ch)) return;
+      fastPoll();
+    }
+    function onKeyUp(e) {
+      if (options.onKeyEvent && options.onKeyEvent(instance, addStop(e))) return;
+      if (e_prop(e, "keyCode") == 16) shiftSelecting = null;
+    }
+
+    function onFocus() {
+      if (options.readOnly == "nocursor") return;
+      if (!focused) {
+        if (options.onFocus) options.onFocus(instance);
+        focused = true;
+        if (scroller.className.search(/\bCodeMirror-focused\b/) == -1)
+          scroller.className += " CodeMirror-focused";
+        if (!leaveInputAlone) resetInput(true);
+      }
+      slowPoll();
+      restartBlink();
+    }
+    function onBlur() {
+      if (focused) {
+        if (options.onBlur) options.onBlur(instance);
+        focused = false;
+        if (bracketHighlighted)
+          operation(function(){
+            if (bracketHighlighted) { bracketHighlighted(); bracketHighlighted = null; }
+          })();
+        scroller.className = scroller.className.replace(" CodeMirror-focused", "");
+      }
+      clearInterval(blinker);
+      setTimeout(function() {if (!focused) shiftSelecting = null;}, 150);
+    }
+
+    // Replace the range from from to to by the strings in newText.
+    // Afterwards, set the selection to selFrom, selTo.
+    function updateLines(from, to, newText, selFrom, selTo) {
+      if (suppressEdits) return;
+      if (history) {
+        var old = [];
+        doc.iter(from.line, to.line + 1, function(line) { old.push(line.text); });
+        history.addChange(from.line, newText.length, old);
+        while (history.done.length > options.undoDepth) history.done.shift();
+      }
+      updateLinesNoUndo(from, to, newText, selFrom, selTo);
+    }
+    function unredoHelper(from, to) {
+      if (!from.length) return;
+      var set = from.pop(), out = [];
+      for (var i = set.length - 1; i >= 0; i -= 1) {
+        var change = set[i];
+        var replaced = [], end = change.start + change.added;
+        doc.iter(change.start, end, function(line) { replaced.push(line.text); });
+        out.push({start: change.start, added: change.old.length, old: replaced});
+        var pos = {line: change.start + change.old.length - 1,
+                   ch: editEnd(replaced[replaced.length-1], change.old[change.old.length-1])};
+        updateLinesNoUndo({line: change.start, ch: 0}, {line: end - 1, ch: getLine(end-1).text.length}, change.old, pos, pos);
+      }
+      updateInput = true;
+      to.push(out);
+    }
+    function undo() {unredoHelper(history.done, history.undone);}
+    function redo() {unredoHelper(history.undone, history.done);}
+
+    function updateLinesNoUndo(from, to, newText, selFrom, selTo) {
+      if (suppressEdits) return;
+      var recomputeMaxLength = false, maxLineLength = maxLine.text.length;
+      if (!options.lineWrapping)
+        doc.iter(from.line, to.line + 1, function(line) {
+          if (!line.hidden && line.text.length == maxLineLength) {recomputeMaxLength = true; return true;}
+        });
+      if (from.line != to.line || newText.length > 1) gutterDirty = true;
+
+      var nlines = to.line - from.line, firstLine = getLine(from.line), lastLine = getLine(to.line);
+      // First adjust the line structure, taking some care to leave highlighting intact.
+      if (from.ch == 0 && to.ch == 0 && newText[newText.length - 1] == "") {
+        // This is a whole-line replace. Treated specially to make
+        // sure line objects move the way they are supposed to.
+        var added = [], prevLine = null;
+        if (from.line) {
+          prevLine = getLine(from.line - 1);
+          prevLine.fixMarkEnds(lastLine);
+        } else lastLine.fixMarkStarts();
+        for (var i = 0, e = newText.length - 1; i < e; ++i)
+          added.push(Line.inheritMarks(newText[i], prevLine));
+        if (nlines) doc.remove(from.line, nlines, callbacks);
+        if (added.length) doc.insert(from.line, added);
+      } else if (firstLine == lastLine) {
+        if (newText.length == 1)
+          firstLine.replace(from.ch, to.ch, newText[0]);
+        else {
+          lastLine = firstLine.split(to.ch, newText[newText.length-1]);
+          firstLine.replace(from.ch, null, newText[0]);
+          firstLine.fixMarkEnds(lastLine);
+          var added = [];
+          for (var i = 1, e = newText.length - 1; i < e; ++i)
+            added.push(Line.inheritMarks(newText[i], firstLine));
+          added.push(lastLine);
+          doc.insert(from.line + 1, added);
+        }
+      } else if (newText.length == 1) {
+        firstLine.replace(from.ch, null, newText[0]);
+        lastLine.replace(null, to.ch, "");
+        firstLine.append(lastLine);
+        doc.remove(from.line + 1, nlines, callbacks);
+      } else {
+        var added = [];
+        firstLine.replace(from.ch, null, newText[0]);
+        lastLine.replace(null, to.ch, newText[newText.length-1]);
+        firstLine.fixMarkEnds(lastLine);
+        for (var i = 1, e = newText.length - 1; i < e; ++i)
+          added.push(Line.inheritMarks(newText[i], firstLine));
+        if (nlines > 1) doc.remove(from.line + 1, nlines - 1, callbacks);
+        doc.insert(from.line + 1, added);
+      }
+      if (options.lineWrapping) {
+        var perLine = Math.max(5, scroller.clientWidth / charWidth() - 3);
+        doc.iter(from.line, from.line + newText.length, function(line) {
+          if (line.hidden) return;
+          var guess = Math.ceil(line.text.length / perLine) || 1;
+          if (guess != line.height) updateLineHeight(line, guess);
+        });
+      } else {
+        doc.iter(from.line, from.line + newText.length, function(line) {
+          var l = line.text;
+          if (!line.hidden && l.length > maxLineLength) {
+            maxLine = line; maxLineLength = l.length; maxLineChanged = true;
+            recomputeMaxLength = false;
+          }
+        });
+        if (recomputeMaxLength) updateMaxLine = true;
+      }
+
+      // Add these lines to the work array, so that they will be
+      // highlighted. Adjust work lines if lines were added/removed.
+      var newWork = [], lendiff = newText.length - nlines - 1;
+      for (var i = 0, l = work.length; i < l; ++i) {
+        var task = work[i];
+        if (task < from.line) newWork.push(task);
+        else if (task > to.line) newWork.push(task + lendiff);
+      }
+      var hlEnd = from.line + Math.min(newText.length, 500);
+      highlightLines(from.line, hlEnd);
+      newWork.push(hlEnd);
+      work = newWork;
+      startWorker(100);
+      // Remember that these lines changed, for updating the display
+      changes.push({from: from.line, to: to.line + 1, diff: lendiff});
+      var changeObj = {from: from, to: to, text: newText};
+      if (textChanged) {
+        for (var cur = textChanged; cur.next; cur = cur.next) {}
+        cur.next = changeObj;
+      } else textChanged = changeObj;
+
+      // Update the selection
+      function updateLine(n) {return n <= Math.min(to.line, to.line + lendiff) ? n : n + lendiff;}
+      setSelection(clipPos(selFrom), clipPos(selTo),
+                   updateLine(sel.from.line), updateLine(sel.to.line));
+    }
+
+    function needsScrollbar() {
+      var realHeight = doc.height * textHeight() + 2 * paddingTop();
+      return realHeight - 1 > scroller.offsetHeight ? realHeight : false;
+    }
+
+    function updateVerticalScroll(scrollTop) {
+      var scrollHeight = needsScrollbar();
+      scrollbar.style.display = scrollHeight ? "block" : "none";
+      if (scrollHeight) {
+        scrollbarInner.style.height = sizer.style.minHeight = scrollHeight + "px";
+        scrollbar.style.height = scroller.clientHeight + "px";
+        if (scrollTop != null) scrollbar.scrollTop = scroller.scrollTop = scrollTop;
+      } else {
+        sizer.style.minHeight = "";
+      }
+      // Position the mover div to align with the current virtual scroll position
+      mover.style.top = displayOffset * textHeight() + "px";
+    }
+
+    // On Mac OS X Lion and up, detect whether the mouse is plugged in by measuring
+    // the width of a div with a scrollbar in it. If the width is <= 1, then
+    // the mouse isn't plugged in and scrollbars should overlap the content.
+    function overlapScrollbars() {
+      var tmpSbInner = elt("div", null, "CodeMirror-scrollbar-inner", "height: 200px");
+      var tmpSb = elt("div", [tmpSbInner], "CodeMirror-scrollbar", "position: absolute; left: -9999px; height: 100px;");
+      document.body.appendChild(tmpSb);
+      var result = (tmpSb.offsetWidth <= 1);
+      document.body.removeChild(tmpSb);
+      return result;
+    }
+
+    function computeMaxLength() {
+      maxLine = getLine(0); maxLineChanged = true;
+      var maxLineLength = maxLine.text.length;
+      doc.iter(1, doc.size, function(line) {
+        var l = line.text;
+        if (!line.hidden && l.length > maxLineLength) {
+          maxLineLength = l.length; maxLine = line;
+        }
+      });
+      updateMaxLine = false;
+    }
+
+    function replaceRange(code, from, to) {
+      from = clipPos(from);
+      if (!to) to = from; else to = clipPos(to);
+      code = splitLines(code);
+      function adjustPos(pos) {
+        if (posLess(pos, from)) return pos;
+        if (!posLess(to, pos)) return end;
+        var line = pos.line + code.length - (to.line - from.line) - 1;
+        var ch = pos.ch;
+        if (pos.line == to.line)
+          ch += code[code.length-1].length - (to.ch - (to.line == from.line ? from.ch : 0));
+        return {line: line, ch: ch};
+      }
+      var end;
+      replaceRange1(code, from, to, function(end1) {
+        end = end1;
+        return {from: adjustPos(sel.from), to: adjustPos(sel.to)};
+      });
+      return end;
+    }
+    function replaceSelection(code, collapse) {
+      replaceRange1(splitLines(code), sel.from, sel.to, function(end) {
+        if (collapse == "end") return {from: end, to: end};
+        else if (collapse == "start") return {from: sel.from, to: sel.from};
+        else return {from: sel.from, to: end};
+      });
+    }
+    function replaceRange1(code, from, to, computeSel) {
+      var endch = code.length == 1 ? code[0].length + from.ch : code[code.length-1].length;
+      var newSel = computeSel({line: from.line + code.length - 1, ch: endch});
+      updateLines(from, to, code, newSel.from, newSel.to);
+    }
+
+    function getRange(from, to, lineSep) {
+      var l1 = from.line, l2 = to.line;
+      if (l1 == l2) return getLine(l1).text.slice(from.ch, to.ch);
+      var code = [getLine(l1).text.slice(from.ch)];
+      doc.iter(l1 + 1, l2, function(line) { code.push(line.text); });
+      code.push(getLine(l2).text.slice(0, to.ch));
+      return code.join(lineSep || "\n");
+    }
+    function getSelection(lineSep) {
+      return getRange(sel.from, sel.to, lineSep);
+    }
+
+    function slowPoll() {
+      if (pollingFast) return;
+      poll.set(options.pollInterval, function() {
+        startOperation();
+        readInput();
+        if (focused) slowPoll();
+        endOperation();
+      });
+    }
+    function fastPoll() {
+      var missed = false;
+      pollingFast = true;
+      function p() {
+        startOperation();
+        var changed = readInput();
+        if (!changed && !missed) {missed = true; poll.set(60, p);}
+        else {pollingFast = false; slowPoll();}
+        endOperation();
+      }
+      poll.set(20, p);
+    }
+
+    // Previnput is a hack to work with IME. If we reset the textarea
+    // on every change, that breaks IME. So we look for changes
+    // compared to the previous content instead. (Modern browsers have
+    // events that indicate IME taking place, but these are not widely
+    // supported or compatible enough yet to rely on.)
+    var prevInput = "";
+    function readInput() {
+      if (leaveInputAlone || !focused || hasSelection(input) || options.readOnly) return false;
+      var text = input.value;
+      if (text == prevInput) return false;
+      shiftSelecting = null;
+      var same = 0, l = Math.min(prevInput.length, text.length);
+      while (same < l && prevInput[same] == text[same]) ++same;
+      if (same < prevInput.length)
+        sel.from = {line: sel.from.line, ch: sel.from.ch - (prevInput.length - same)};
+      else if (overwrite && posEq(sel.from, sel.to))
+        sel.to = {line: sel.to.line, ch: Math.min(getLine(sel.to.line).text.length, sel.to.ch + (text.length - same))};
+      replaceSelection(text.slice(same), "end");
+      if (text.length > 1000) { input.value = prevInput = ""; }
+      else prevInput = text;
+      return true;
+    }
+    function resetInput(user) {
+      if (!posEq(sel.from, sel.to)) {
+        prevInput = "";
+        input.value = getSelection();
+        selectInput(input);
+      } else if (user) prevInput = input.value = "";
+    }
+
+    function focusInput() {
+      if (options.readOnly != "nocursor") input.focus();
+    }
+
+    function scrollEditorIntoView() {
+      var rect = cursor.getBoundingClientRect();
+      // IE returns bogus coordinates when the instance sits inside of an iframe and the cursor is hidden
+      if (ie && rect.top == rect.bottom) return;
+      var winH = window.innerHeight || Math.max(document.body.offsetHeight, document.documentElement.offsetHeight);
+      if (rect.top < 0 || rect.bottom > winH) scrollCursorIntoView();
+    }
+    function scrollCursorIntoView() {
+      var coords = calculateCursorCoords();
+      scrollIntoView(coords.x, coords.y, coords.x, coords.yBot);
+    }
+    function calculateCursorCoords() {
+      var cursor = localCoords(sel.inverted ? sel.from : sel.to);
+      var x = options.lineWrapping ? Math.min(cursor.x, lineSpace.offsetWidth) : cursor.x;
+      return {x: x, y: cursor.y, yBot: cursor.yBot};
+    }
+    function scrollIntoView(x1, y1, x2, y2) {
+      var scrollPos = calculateScrollPos(x1, y1, x2, y2);
+      if (scrollPos.scrollLeft != null) {scroller.scrollLeft = scrollPos.scrollLeft;}
+      if (scrollPos.scrollTop != null) {scrollbar.scrollTop = scroller.scrollTop = scrollPos.scrollTop;}
+    }
+    function calculateScrollPos(x1, y1, x2, y2) {
+      var pl = paddingLeft(), pt = paddingTop();
+      y1 += pt; y2 += pt; x1 += pl; x2 += pl;
+      var screen = scroller.clientHeight, screentop = scrollbar.scrollTop, result = {};
+      var docBottom = needsScrollbar() || Infinity;
+      var atTop = y1 < pt + 10, atBottom = y2 + pt > docBottom - 10;
+      if (y1 < screentop) result.scrollTop = atTop ? 0 : Math.max(0, y1);
+      else if (y2 > screentop + screen) result.scrollTop = (atBottom ? docBottom : y2) - screen;
+
+      var screenw = scroller.clientWidth, screenleft = scroller.scrollLeft;
+      var gutterw = options.fixedGutter ? gutter.clientWidth : 0;
+      var atLeft = x1 < gutterw + pl + 10;
+      if (x1 < screenleft + gutterw || atLeft) {
+        if (atLeft) x1 = 0;
+        result.scrollLeft = Math.max(0, x1 - 10 - gutterw);
+      } else if (x2 > screenw + screenleft - 3) {
+        result.scrollLeft = x2 + 10 - screenw;
+      }
+      return result;
+    }
+
+    function visibleLines(scrollTop) {
+      var lh = textHeight(), top = (scrollTop != null ? scrollTop : scrollbar.scrollTop) - paddingTop();
+      var fromHeight = Math.max(0, Math.floor(top / lh));
+      var toHeight = Math.ceil((top + scroller.clientHeight) / lh);
+      return {from: lineAtHeight(doc, fromHeight),
+              to: lineAtHeight(doc, toHeight)};
+    }
+    // Uses a set of changes plus the current scroll position to
+    // determine which DOM updates have to be made, and makes the
+    // updates.
+    function updateDisplay(changes, suppressCallback, scrollTop) {
+      if (!scroller.clientWidth) {
+        showingFrom = showingTo = displayOffset = 0;
+        return;
+      }
+      // Compute the new visible window
+      // If scrollTop is specified, use that to determine which lines
+      // to render instead of the current scrollbar position.
+      var visible = visibleLines(scrollTop);
+      // Bail out if the visible area is already rendered and nothing changed.
+      if (changes !== true && changes.length == 0 && visible.from > showingFrom && visible.to < showingTo) {
+        updateVerticalScroll(scrollTop);
+        return;
+      }
+      var from = Math.max(visible.from - 100, 0), to = Math.min(doc.size, visible.to + 100);
+      if (showingFrom < from && from - showingFrom < 20) from = showingFrom;
+      if (showingTo > to && showingTo - to < 20) to = Math.min(doc.size, showingTo);
+
+      // Create a range of theoretically intact lines, and punch holes
+      // in that using the change info.
+      var intact = changes === true ? [] :
+        computeIntact([{from: showingFrom, to: showingTo, domStart: 0}], changes);
+      // Clip off the parts that won't be visible
+      var intactLines = 0;
+      for (var i = 0; i < intact.length; ++i) {
+        var range = intact[i];
+        if (range.from < from) {range.domStart += (from - range.from); range.from = from;}
+        if (range.to > to) range.to = to;
+        if (range.from >= range.to) intact.splice(i--, 1);
+        else intactLines += range.to - range.from;
+      }
+      if (intactLines == to - from && from == showingFrom && to == showingTo) {
+        updateVerticalScroll(scrollTop);
+        return;
+      }
+      intact.sort(function(a, b) {return a.domStart - b.domStart;});
+
+      var th = textHeight(), gutterDisplay = gutter.style.display;
+      lineDiv.style.display = "none";
+      patchDisplay(from, to, intact);
+      lineDiv.style.display = gutter.style.display = "";
+
+      var different = from != showingFrom || to != showingTo || lastSizeC != scroller.clientHeight + th;
+      // This is just a bogus formula that detects when the editor is
+      // resized or the font size changes.
+      if (different) lastSizeC = scroller.clientHeight + th;
+      showingFrom = from; showingTo = to;
+      displayOffset = heightAtLine(doc, from);
+
+      // Since this is all rather error prone, it is honoured with the
+      // only assertion in the whole file.
+      if (lineDiv.childNodes.length != showingTo - showingFrom)
+        throw new Error("BAD PATCH! " + JSON.stringify(intact) + " size=" + (showingTo - showingFrom) +
+                        " nodes=" + lineDiv.childNodes.length);
+
+      function checkHeights() {
+        var curNode = lineDiv.firstChild, heightChanged = false;
+        doc.iter(showingFrom, showingTo, function(line) {
+          // Work around bizarro IE7 bug where, sometimes, our curNode
+          // is magically replaced with a new node in the DOM, leaving
+          // us with a reference to an orphan (nextSibling-less) node.
+          if (!curNode) return;
+          if (!line.hidden) {
+            var height = Math.round(curNode.offsetHeight / th) || 1;
+            if (line.height != height) {
+              updateLineHeight(line, height);
+              gutterDirty = heightChanged = true;
+            }
+          }
+          curNode = curNode.nextSibling;
+        });
+        return heightChanged;
+      }
+
+      if (options.lineWrapping) {
+        checkHeights();
+        var scrollHeight = needsScrollbar();
+        var shouldHaveScrollbar = scrollHeight ? "block" : "none";
+        if (scrollbar.style.display != shouldHaveScrollbar) {
+          scrollbar.style.display = shouldHaveScrollbar;
+          if (scrollHeight) scrollbarInner.style.height = scrollHeight + "px";
+          checkHeights();
+        }
+      }
+
+      gutter.style.display = gutterDisplay;
+      if (different || gutterDirty) {
+        // If the gutter grew in size, re-check heights. If those changed, re-draw gutter.
+        updateGutter() && options.lineWrapping && checkHeights() && updateGutter();
+      }
+      updateVerticalScroll(scrollTop);
+      updateSelection();
+      if (!suppressCallback && options.onUpdate) options.onUpdate(instance);
+      return true;
+    }
+
+    function computeIntact(intact, changes) {
+      for (var i = 0, l = changes.length || 0; i < l; ++i) {
+        var change = changes[i], intact2 = [], diff = change.diff || 0;
+        for (var j = 0, l2 = intact.length; j < l2; ++j) {
+          var range = intact[j];
+          if (change.to <= range.from && change.diff)
+            intact2.push({from: range.from + diff, to: range.to + diff,
+                          domStart: range.domStart});
+          else if (change.to <= range.from || change.from >= range.to)
+            intact2.push(range);
+          else {
+            if (change.from > range.from)
+              intact2.push({from: range.from, to: change.from, domStart: range.domStart});
+            if (change.to < range.to)
+              intact2.push({from: change.to + diff, to: range.to + diff,
+                            domStart: range.domStart + (change.to - range.from)});
+          }
+        }
+        intact = intact2;
+      }
+      return intact;
+    }
+
+    function patchDisplay(from, to, intact) {
+      function killNode(node) {
+        var tmp = node.nextSibling;
+        node.parentNode.removeChild(node);
+        return tmp;
+      }
+      // The first pass removes the DOM nodes that aren't intact.
+      if (!intact.length) removeChildren(lineDiv);
+      else {
+        var domPos = 0, curNode = lineDiv.firstChild, n;
+        for (var i = 0; i < intact.length; ++i) {
+          var cur = intact[i];
+          while (cur.domStart > domPos) {curNode = killNode(curNode); domPos++;}
+          for (var j = 0, e = cur.to - cur.from; j < e; ++j) {curNode = curNode.nextSibling; domPos++;}
+        }
+        while (curNode) curNode = killNode(curNode);
+      }
+      // This pass fills in the lines that actually changed.
+      var nextIntact = intact.shift(), curNode = lineDiv.firstChild, j = from;
+      doc.iter(from, to, function(line) {
+        if (nextIntact && nextIntact.to == j) nextIntact = intact.shift();
+        if (!nextIntact || nextIntact.from > j) {
+          if (line.hidden) var lineElement = elt("pre");
+          else {
+            var lineElement = line.getElement(makeTab);
+            if (line.className) lineElement.className = line.className;
+            // Kludge to make sure the styled element lies behind the selection (by z-index)
+            if (line.bgClassName) {
+              var pre = elt("pre", "\u00a0", line.bgClassName, "position: absolute; left: 0; right: 0; top: 0; bottom: 0; z-index: -2");
+              lineElement = elt("div", [pre, lineElement], null, "position: relative");
+            }
+          }
+          lineDiv.insertBefore(lineElement, curNode);
+        } else {
+          curNode = curNode.nextSibling;
+        }
+        ++j;
+      });
+    }
+
+    function updateGutter() {
+      if (!options.gutter && !options.lineNumbers) return;
+      var hText = mover.offsetHeight, hEditor = scroller.clientHeight;
+      gutter.style.height = (hText - hEditor < 2 ? hEditor : hText) + "px";
+      var fragment = document.createDocumentFragment(), i = showingFrom, normalNode;
+      doc.iter(showingFrom, Math.max(showingTo, showingFrom + 1), function(line) {
+        if (line.hidden) {
+          fragment.appendChild(elt("pre"));
+        } else {
+          var marker = line.gutterMarker;
+          var text = options.lineNumbers ? options.lineNumberFormatter(i + options.firstLineNumber) : null;
+          if (marker && marker.text)
+            text = marker.text.replace("%N%", text != null ? text : "");
+          else if (text == null)
+            text = "\u00a0";
+          var markerElement = fragment.appendChild(elt("pre", null, marker && marker.style));
+          markerElement.innerHTML = text;
+          for (var j = 1; j < line.height; ++j) {
+            markerElement.appendChild(elt("br"));
+            markerElement.appendChild(document.createTextNode("\u00a0"));
+          }
+          if (!marker) normalNode = i;
+        }
+        ++i;
+      });
+      gutter.style.display = "none";
+      removeChildrenAndAdd(gutterText, fragment);
+      // Make sure scrolling doesn't cause number gutter size to pop
+      if (normalNode != null && options.lineNumbers) {
+        var node = gutterText.childNodes[normalNode - showingFrom];
+        var minwidth = String(doc.size).length, val = eltText(node.firstChild), pad = "";
+        while (val.length + pad.length < minwidth) pad += "\u00a0";
+        if (pad) node.insertBefore(document.createTextNode(pad), node.firstChild);
+      }
+      gutter.style.display = "";
+      var resized = Math.abs((parseInt(lineSpace.style.marginLeft) || 0) - gutter.offsetWidth) > 2;
+      lineSpace.style.marginLeft = gutter.offsetWidth + "px";
+      gutterDirty = false;
+      return resized;
+    }
+    function updateSelection() {
+      var collapsed = posEq(sel.from, sel.to);
+      var fromPos = localCoords(sel.from, true);
+      var toPos = collapsed ? fromPos : localCoords(sel.to, true);
+      var headPos = sel.inverted ? fromPos : toPos, th = textHeight();
+      var wrapOff = eltOffset(wrapper), lineOff = eltOffset(lineDiv);
+      inputDiv.style.top = Math.max(0, Math.min(scroller.offsetHeight, headPos.y + lineOff.top - wrapOff.top)) + "px";
+      inputDiv.style.left = Math.max(0, Math.min(scroller.offsetWidth, headPos.x + lineOff.left - wrapOff.left)) + "px";
+      if (collapsed) {
+        cursor.style.top = headPos.y + "px";
+        cursor.style.left = (options.lineWrapping ? Math.min(headPos.x, lineSpace.offsetWidth) : headPos.x) + "px";
+        cursor.style.display = "";
+        selectionDiv.style.display = "none";
+      } else {
+        var sameLine = fromPos.y == toPos.y, fragment = document.createDocumentFragment();
+        var clientWidth = lineSpace.clientWidth || lineSpace.offsetWidth;
+        var clientHeight = lineSpace.clientHeight || lineSpace.offsetHeight;
+        var add = function(left, top, right, height) {
+          var rstyle = quirksMode ? "width: " + (!right ? clientWidth : clientWidth - right - left) + "px"
+                                  : "right: " + right + "px";
+          fragment.appendChild(elt("div", null, "CodeMirror-selected", "position: absolute; left: " + left +
+                                   "px; top: " + top + "px; " + rstyle + "; height: " + height + "px"));
+        };
+        if (sel.from.ch && fromPos.y >= 0) {
+          var right = sameLine ? clientWidth - toPos.x : 0;
+          add(fromPos.x, fromPos.y, right, th);
+        }
+        var middleStart = Math.max(0, fromPos.y + (sel.from.ch ? th : 0));
+        var middleHeight = Math.min(toPos.y, clientHeight) - middleStart;
+        if (middleHeight > 0.2 * th)
+          add(0, middleStart, 0, middleHeight);
+        if ((!sameLine || !sel.from.ch) && toPos.y < clientHeight - .5 * th)
+          add(0, toPos.y, clientWidth - toPos.x, th);
+        removeChildrenAndAdd(selectionDiv, fragment);
+        cursor.style.display = "none";
+        selectionDiv.style.display = "";
+      }
+    }
+
+    function setShift(val) {
+      if (val) shiftSelecting = shiftSelecting || (sel.inverted ? sel.to : sel.from);
+      else shiftSelecting = null;
+    }
+    function setSelectionUser(from, to) {
+      var sh = shiftSelecting && clipPos(shiftSelecting);
+      if (sh) {
+        if (posLess(sh, from)) from = sh;
+        else if (posLess(to, sh)) to = sh;
+      }
+      setSelection(from, to);
+      userSelChange = true;
+    }
+    // Update the selection. Last two args are only used by
+    // updateLines, since they have to be expressed in the line
+    // numbers before the update.
+    function setSelection(from, to, oldFrom, oldTo) {
+      goalColumn = null;
+      if (oldFrom == null) {oldFrom = sel.from.line; oldTo = sel.to.line;}
+      if (posEq(sel.from, from) && posEq(sel.to, to)) return;
+      if (posLess(to, from)) {var tmp = to; to = from; from = tmp;}
+
+      // Skip over hidden lines.
+      if (from.line != oldFrom) {
+        var from1 = skipHidden(from, oldFrom, sel.from.ch);
+        // If there is no non-hidden line left, force visibility on current line
+        if (!from1) setLineHidden(from.line, false);
+        else from = from1;
+      }
+      if (to.line != oldTo) to = skipHidden(to, oldTo, sel.to.ch);
+
+      if (posEq(from, to)) sel.inverted = false;
+      else if (posEq(from, sel.to)) sel.inverted = false;
+      else if (posEq(to, sel.from)) sel.inverted = true;
+
+      if (options.autoClearEmptyLines && posEq(sel.from, sel.to)) {
+        var head = sel.inverted ? from : to;
+        if (head.line != sel.from.line && sel.from.line < doc.size) {
+          var oldLine = getLine(sel.from.line);
+          if (/^\s+$/.test(oldLine.text))
+            setTimeout(operation(function() {
+              if (oldLine.parent && /^\s+$/.test(oldLine.text)) {
+                var no = lineNo(oldLine);
+                replaceRange("", {line: no, ch: 0}, {line: no, ch: oldLine.text.length});
+              }
+            }, 10));
+        }
+      }
+
+      sel.from = from; sel.to = to;
+      selectionChanged = true;
+    }
+    function skipHidden(pos, oldLine, oldCh) {
+      function getNonHidden(dir) {
+        var lNo = pos.line + dir, end = dir == 1 ? doc.size : -1;
+        while (lNo != end) {
+          var line = getLine(lNo);
+          if (!line.hidden) {
+            var ch = pos.ch;
+            if (toEnd || ch > oldCh || ch > line.text.length) ch = line.text.length;
+            return {line: lNo, ch: ch};
+          }
+          lNo += dir;
+        }
+      }
+      var line = getLine(pos.line);
+      var toEnd = pos.ch == line.text.length && pos.ch != oldCh;
+      if (!line.hidden) return pos;
+      if (pos.line >= oldLine) return getNonHidden(1) || getNonHidden(-1);
+      else return getNonHidden(-1) || getNonHidden(1);
+    }
+    function setCursor(line, ch, user) {
+      var pos = clipPos({line: line, ch: ch || 0});
+      (user ? setSelectionUser : setSelection)(pos, pos);
+    }
+
+    function clipLine(n) {return Math.max(0, Math.min(n, doc.size-1));}
+    function clipPos(pos) {
+      if (pos.line < 0) return {line: 0, ch: 0};
+      if (pos.line >= doc.size) return {line: doc.size-1, ch: getLine(doc.size-1).text.length};
+      var ch = pos.ch, linelen = getLine(pos.line).text.length;
+      if (ch == null || ch > linelen) return {line: pos.line, ch: linelen};
+      else if (ch < 0) return {line: pos.line, ch: 0};
+      else return pos;
+    }
+
+    function findPosH(dir, unit) {
+      var end = sel.inverted ? sel.from : sel.to, line = end.line, ch = end.ch;
+      var lineObj = getLine(line);
+      function findNextLine() {
+        for (var l = line + dir, e = dir < 0 ? -1 : doc.size; l != e; l += dir) {
+          var lo = getLine(l);
+          if (!lo.hidden) { line = l; lineObj = lo; return true; }
+        }
+      }
+      function moveOnce(boundToLine) {
+        if (ch == (dir < 0 ? 0 : lineObj.text.length)) {
+          if (!boundToLine && findNextLine()) ch = dir < 0 ? lineObj.text.length : 0;
+          else return false;
+        } else ch += dir;
+        return true;
+      }
+      if (unit == "char") moveOnce();
+      else if (unit == "column") moveOnce(true);
+      else if (unit == "word") {
+        var sawWord = false;
+        for (;;) {
+          if (dir < 0) if (!moveOnce()) break;
+          if (isWordChar(lineObj.text.charAt(ch))) sawWord = true;
+          else if (sawWord) {if (dir < 0) {dir = 1; moveOnce();} break;}
+          if (dir > 0) if (!moveOnce()) break;
+        }
+      }
+      return {line: line, ch: ch};
+    }
+    function moveH(dir, unit) {
+      var pos = dir < 0 ? sel.from : sel.to;
+      if (shiftSelecting || posEq(sel.from, sel.to)) pos = findPosH(dir, unit);
+      setCursor(pos.line, pos.ch, true);
+    }
+    function deleteH(dir, unit) {
+      if (!posEq(sel.from, sel.to)) replaceRange("", sel.from, sel.to);
+      else if (dir < 0) replaceRange("", findPosH(dir, unit), sel.to);
+      else replaceRange("", sel.from, findPosH(dir, unit));
+      userSelChange = true;
+    }
+    function moveV(dir, unit) {
+      var dist = 0, pos = localCoords(sel.inverted ? sel.from : sel.to, true);
+      if (goalColumn != null) pos.x = goalColumn;
+      if (unit == "page") dist = Math.min(scroller.clientHeight, window.innerHeight || document.documentElement.clientHeight);
+      else if (unit == "line") dist = textHeight();
+      var target = coordsChar(pos.x, pos.y + dist * dir + 2);
+      if (unit == "page") scrollbar.scrollTop += localCoords(target, true).y - pos.y;
+      setCursor(target.line, target.ch, true);
+      goalColumn = pos.x;
+    }
+
+    function findWordAt(pos) {
+      var line = getLine(pos.line).text;
+      var start = pos.ch, end = pos.ch;
+      if (line) {
+        if (pos.after === false || end == line.length) --start; else ++end;
+        var startChar = line.charAt(start);
+        var check = isWordChar(startChar) ? isWordChar :
+                    /\s/.test(startChar) ? function(ch) {return /\s/.test(ch);} :
+                    function(ch) {return !/\s/.test(ch) && !isWordChar(ch);};
+        while (start > 0 && check(line.charAt(start - 1))) --start;
+        while (end < line.length && check(line.charAt(end))) ++end;
+      }
+      return {from: {line: pos.line, ch: start}, to: {line: pos.line, ch: end}};
+    }
+    function selectLine(line) {
+      setSelectionUser({line: line, ch: 0}, clipPos({line: line + 1, ch: 0}));
+    }
+    function indentSelected(mode) {
+      if (posEq(sel.from, sel.to)) return indentLine(sel.from.line, mode);
+      var e = sel.to.line - (sel.to.ch ? 0 : 1);
+      for (var i = sel.from.line; i <= e; ++i) indentLine(i, mode);
+    }
+
+    function indentLine(n, how) {
+      if (!how) how = "add";
+      if (how == "smart") {
+        if (!mode.indent) how = "prev";
+        else var state = getStateBefore(n);
+      }
+
+      var line = getLine(n), curSpace = line.indentation(options.tabSize),
+          curSpaceString = line.text.match(/^\s*/)[0], indentation;
+      if (how == "smart") {
+        indentation = mode.indent(state, line.text.slice(curSpaceString.length), line.text);
+        if (indentation == Pass) how = "prev";
+      }
+      if (how == "prev") {
+        if (n) indentation = getLine(n-1).indentation(options.tabSize);
+        else indentation = 0;
+      }
+      else if (how == "add") indentation = curSpace + options.indentUnit;
+      else if (how == "subtract") indentation = curSpace - options.indentUnit;
+      indentation = Math.max(0, indentation);
+      var diff = indentation - curSpace;
+
+      var indentString = "", pos = 0;
+      if (options.indentWithTabs)
+        for (var i = Math.floor(indentation / options.tabSize); i; --i) {pos += options.tabSize; indentString += "\t";}
+      while (pos < indentation) {++pos; indentString += " ";}
+
+      replaceRange(indentString, {line: n, ch: 0}, {line: n, ch: curSpaceString.length});
+    }
+
+    function loadMode() {
+      mode = CodeMirror.getMode(options, options.mode);
+      doc.iter(0, doc.size, function(line) { line.stateAfter = null; });
+      work = [0];
+      startWorker();
+    }
+    function gutterChanged() {
+      var visible = options.gutter || options.lineNumbers;
+      gutter.style.display = visible ? "" : "none";
+      if (visible) gutterDirty = true;
+      else lineDiv.parentNode.style.marginLeft = 0;
+    }
+    function wrappingChanged(from, to) {
+      if (options.lineWrapping) {
+        wrapper.className += " CodeMirror-wrap";
+        var perLine = scroller.clientWidth / charWidth() - 3;
+        doc.iter(0, doc.size, function(line) {
+          if (line.hidden) return;
+          var guess = Math.ceil(line.text.length / perLine) || 1;
+          if (guess != 1) updateLineHeight(line, guess);
+        });
+        lineSpace.style.minWidth = widthForcer.style.left = "";
+      } else {
+        wrapper.className = wrapper.className.replace(" CodeMirror-wrap", "");
+        computeMaxLength();
+        doc.iter(0, doc.size, function(line) {
+          if (line.height != 1 && !line.hidden) updateLineHeight(line, 1);
+        });
+      }
+      changes.push({from: 0, to: doc.size});
+    }
+    function makeTab(col) {
+      var w = options.tabSize - col % options.tabSize, cached = tabCache[w];
+      if (cached) return cached;
+      for (var str = "", i = 0; i < w; ++i) str += " ";
+      var span = elt("span", str, "cm-tab");
+      return (tabCache[w] = {element: span, width: w});
+    }
+    function themeChanged() {
+      scroller.className = scroller.className.replace(/\s*cm-s-\S+/g, "") +
+        options.theme.replace(/(^|\s)\s*/g, " cm-s-");
+    }
+    function keyMapChanged() {
+      var style = keyMap[options.keyMap].style;
+      wrapper.className = wrapper.className.replace(/\s*cm-keymap-\S+/g, "") +
+        (style ? " cm-keymap-" + style : "");
+    }
+
+    function TextMarker() { this.set = []; }
+    TextMarker.prototype.clear = operation(function() {
+      var min = Infinity, max = -Infinity;
+      for (var i = 0, e = this.set.length; i < e; ++i) {
+        var line = this.set[i], mk = line.marked;
+        if (!mk || !line.parent) continue;
+        var lineN = lineNo(line);
+        min = Math.min(min, lineN); max = Math.max(max, lineN);
+        for (var j = 0; j < mk.length; ++j)
+          if (mk[j].marker == this) mk.splice(j--, 1);
+      }
+      if (min != Infinity)
+        changes.push({from: min, to: max + 1});
+    });
+    TextMarker.prototype.find = function() {
+      var from, to;
+      for (var i = 0, e = this.set.length; i < e; ++i) {
+        var line = this.set[i], mk = line.marked;
+        for (var j = 0; j < mk.length; ++j) {
+          var mark = mk[j];
+          if (mark.marker == this) {
+            if (mark.from != null || mark.to != null) {
+              var found = lineNo(line);
+              if (found != null) {
+                if (mark.from != null) from = {line: found, ch: mark.from};
+                if (mark.to != null) to = {line: found, ch: mark.to};
+              }
+            }
+          }
+        }
+      }
+      return {from: from, to: to};
+    };
+
+    function markText(from, to, className) {
+      from = clipPos(from); to = clipPos(to);
+      var tm = new TextMarker();
+      if (!posLess(from, to)) return tm;
+      function add(line, from, to, className) {
+        getLine(line).addMark(new MarkedText(from, to, className, tm));
+      }
+      if (from.line == to.line) add(from.line, from.ch, to.ch, className);
+      else {
+        add(from.line, from.ch, null, className);
+        for (var i = from.line + 1, e = to.line; i < e; ++i)
+          add(i, null, null, className);
+        add(to.line, null, to.ch, className);
+      }
+      changes.push({from: from.line, to: to.line + 1});
+      return tm;
+    }
+
+    function setBookmark(pos) {
+      pos = clipPos(pos);
+      var bm = new Bookmark(pos.ch);
+      getLine(pos.line).addMark(bm);
+      return bm;
+    }
+
+    function findMarksAt(pos) {
+      pos = clipPos(pos);
+      var markers = [], marked = getLine(pos.line).marked;
+      if (!marked) return markers;
+      for (var i = 0, e = marked.length; i < e; ++i) {
+        var m = marked[i];
+        if ((m.from == null || m.from <= pos.ch) &&
+            (m.to == null || m.to >= pos.ch))
+          markers.push(m.marker || m);
+      }
+      return markers;
+    }
+
+    function addGutterMarker(line, text, className) {
+      if (typeof line == "number") line = getLine(clipLine(line));
+      line.gutterMarker = {text: text, style: className};
+      gutterDirty = true;
+      return line;
+    }
+    function removeGutterMarker(line) {
+      if (typeof line == "number") line = getLine(clipLine(line));
+      line.gutterMarker = null;
+      gutterDirty = true;
+    }
+
+    function changeLine(handle, op) {
+      var no = handle, line = handle;
+      if (typeof handle == "number") line = getLine(clipLine(handle));
+      else no = lineNo(handle);
+      if (no == null) return null;
+      if (op(line, no)) changes.push({from: no, to: no + 1});
+      else return null;
+      return line;
+    }
+    function setLineClass(handle, className, bgClassName) {
+      return changeLine(handle, function(line) {
+        if (line.className != className || line.bgClassName != bgClassName) {
+          line.className = className;
+          line.bgClassName = bgClassName;
+          return true;
+        }
+      });
+    }
+    function setLineHidden(handle, hidden) {
+      return changeLine(handle, function(line, no) {
+        if (line.hidden != hidden) {
+          line.hidden = hidden;
+          if (!options.lineWrapping) {
+            if (hidden && line.text.length == maxLine.text.length) {
+              updateMaxLine = true;
+            } else if (!hidden && line.text.length > maxLine.text.length) {
+              maxLine = line; updateMaxLine = false;
+            }
+          }
+          updateLineHeight(line, hidden ? 0 : 1);
+          var fline = sel.from.line, tline = sel.to.line;
+          if (hidden && (fline == no || tline == no)) {
+            var from = fline == no ? skipHidden({line: fline, ch: 0}, fline, 0) : sel.from;
+            var to = tline == no ? skipHidden({line: tline, ch: 0}, tline, 0) : sel.to;
+            // Can't hide the last visible line, we'd have no place to put the cursor
+            if (!to) return;
+            setSelection(from, to);
+          }
+          return (gutterDirty = true);
+        }
+      });
+    }
+
+    function lineInfo(line) {
+      if (typeof line == "number") {
+        if (!isLine(line)) return null;
+        var n = line;
+        line = getLine(line);
+        if (!line) return null;
+      } else {
+        var n = lineNo(line);
+        if (n == null) return null;
+      }
+      var marker = line.gutterMarker;
+      return {line: n, handle: line, text: line.text, markerText: marker && marker.text,
+              markerClass: marker && marker.style, lineClass: line.className, bgClass: line.bgClassName};
+    }
+
+    // These are used to go from pixel positions to character
+    // positions, taking varying character widths into account.
+    function charFromX(line, x) {
+      if (x <= 0) return 0;
+      var lineObj = getLine(line), text = lineObj.text;
+      function getX(len) {
+        return measureLine(lineObj, len).left;
+      }
+      var from = 0, fromX = 0, to = text.length, toX;
+      // Guess a suitable upper bound for our search.
+      var estimated = Math.min(to, Math.ceil(x / charWidth()));
+      for (;;) {
+        var estX = getX(estimated);
+        if (estX <= x && estimated < to) estimated = Math.min(to, Math.ceil(estimated * 1.2));
+        else {toX = estX; to = estimated; break;}
+      }
+      if (x > toX) return to;
+      // Try to guess a suitable lower bound as well.
+      estimated = Math.floor(to * 0.8); estX = getX(estimated);
+      if (estX < x) {from = estimated; fromX = estX;}
+      // Do a binary search between these bounds.
+      for (;;) {
+        if (to - from <= 1) return (toX - x > x - fromX) ? from : to;
+        var middle = Math.ceil((from + to) / 2), middleX = getX(middle);
+        if (middleX > x) {to = middle; toX = middleX;}
+        else {from = middle; fromX = middleX;}
+      }
+    }
+
+    function measureLine(line, ch) {
+      if (ch == 0) return {top: 0, left: 0};
+      var wbr = options.lineWrapping && ch < line.text.length &&
+                spanAffectsWrapping.test(line.text.slice(ch - 1, ch + 1));
+      var pre = line.getElement(makeTab, ch, wbr);
+      removeChildrenAndAdd(measure, pre);
+      var anchor = pre.anchor;
+      var top = anchor.offsetTop, left = anchor.offsetLeft;
+      // Older IEs report zero offsets for spans directly after a wrap
+      if (ie && top == 0 && left == 0) {
+        var backup = elt("span", "x");
+        anchor.parentNode.insertBefore(backup, anchor.nextSibling);
+        top = backup.offsetTop;
+      }
+      return {top: top, left: left};
+    }
+    function localCoords(pos, inLineWrap) {
+      var x, lh = textHeight(), y = lh * (heightAtLine(doc, pos.line) - (inLineWrap ? displayOffset : 0));
+      if (pos.ch == 0) x = 0;
+      else {
+        var sp = measureLine(getLine(pos.line), pos.ch);
+        x = sp.left;
+        if (options.lineWrapping) y += Math.max(0, sp.top);
+      }
+      return {x: x, y: y, yBot: y + lh};
+    }
+    // Coords must be lineSpace-local
+    function coordsChar(x, y) {
+      if (y < 0) return {line: 0, ch: 0};
+      var th = textHeight(), cw = charWidth(), heightPos = displayOffset + Math.floor(y / th);
+      var lineNo = lineAtHeight(doc, heightPos);
+      if (lineNo >= doc.size) return {line: doc.size - 1, ch: getLine(doc.size - 1).text.length};
+      var lineObj = getLine(lineNo), text = lineObj.text;
+      var tw = options.lineWrapping, innerOff = tw ? heightPos - heightAtLine(doc, lineNo) : 0;
+      if (x <= 0 && innerOff == 0) return {line: lineNo, ch: 0};
+      var wrongLine = false;
+      function getX(len) {
+        var sp = measureLine(lineObj, len);
+        if (tw) {
+          var off = Math.round(sp.top / th);
+          wrongLine = off != innerOff;
+          return Math.max(0, sp.left + (off - innerOff) * scroller.clientWidth);
+        }
+        return sp.left;
+      }
+      var from = 0, fromX = 0, to = text.length, toX;
+      // Guess a suitable upper bound for our search.
+      var estimated = Math.min(to, Math.ceil((x + innerOff * scroller.clientWidth * .9) / cw));
+      for (;;) {
+        var estX = getX(estimated);
+        if (estX <= x && estimated < to) estimated = Math.min(to, Math.ceil(estimated * 1.2));
+        else {toX = estX; to = estimated; break;}
+      }
+      if (x > toX) return {line: lineNo, ch: to};
+      // Try to guess a suitable lower bound as well.
+      estimated = Math.floor(to * 0.8); estX = getX(estimated);
+      if (estX < x) {from = estimated; fromX = estX;}
+      // Do a binary search between these bounds.
+      for (;;) {
+        if (to - from <= 1) {
+          var after = x - fromX < toX - x;
+          return {line: lineNo, ch: after ? from : to, after: after};
+        }
+        var middle = Math.ceil((from + to) / 2), middleX = getX(middle);
+        if (middleX > x) {to = middle; toX = middleX; if (wrongLine) toX += 1000; }
+        else {from = middle; fromX = middleX;}
+      }
+    }
+    function pageCoords(pos) {
+      var local = localCoords(pos, true), off = eltOffset(lineSpace);
+      return {x: off.left + local.x, y: off.top + local.y, yBot: off.top + local.yBot};
+    }
+
+    var cachedHeight, cachedHeightFor, measurePre;
+    function textHeight() {
+      if (measurePre == null) {
+        measurePre = elt("pre");
+        for (var i = 0; i < 49; ++i) {
+          measurePre.appendChild(document.createTextNode("x"));
+          measurePre.appendChild(elt("br"));
+        }
+        measurePre.appendChild(document.createTextNode("x"));
+      }
+      var offsetHeight = lineDiv.clientHeight;
+      if (offsetHeight == cachedHeightFor) return cachedHeight;
+      cachedHeightFor = offsetHeight;
+      removeChildrenAndAdd(measure, measurePre.cloneNode(true));
+      cachedHeight = measure.firstChild.offsetHeight / 50 || 1;
+      removeChildren(measure);
+      return cachedHeight;
+    }
+    var cachedWidth, cachedWidthFor = 0;
+    function charWidth() {
+      if (scroller.clientWidth == cachedWidthFor) return cachedWidth;
+      cachedWidthFor = scroller.clientWidth;
+      var anchor = elt("span", "x");
+      var pre = elt("pre", [anchor]);
+      removeChildrenAndAdd(measure, pre);
+      return (cachedWidth = anchor.offsetWidth || 10);
+    }
+    function paddingTop() {return lineSpace.offsetTop;}
+    function paddingLeft() {return lineSpace.offsetLeft;}
+
+    function posFromMouse(e, liberal) {
+      var offW = eltOffset(scroller, true), x, y;
+      // Fails unpredictably on IE[67] when mouse is dragged around quickly.
+      try { x = e.clientX; y = e.clientY; } catch (e) { return null; }
+      // This is a mess of a heuristic to try and determine whether a
+      // scroll-bar was clicked or not, and to return null if one was
+      // (and !liberal).
+      if (!liberal && (x - offW.left > scroller.clientWidth || y - offW.top > scroller.clientHeight))
+        return null;
+      var offL = eltOffset(lineSpace, true);
+      return coordsChar(x - offL.left, y - offL.top);
+    }
+    function onContextMenu(e) {
+      var pos = posFromMouse(e), scrollPos = scrollbar.scrollTop;
+      if (!pos || opera) return; // Opera is difficult.
+      if (posEq(sel.from, sel.to) || posLess(pos, sel.from) || !posLess(pos, sel.to))
+        operation(setCursor)(pos.line, pos.ch);
+
+      var oldCSS = input.style.cssText;
+      inputDiv.style.position = "absolute";
+      input.style.cssText = "position: fixed; width: 30px; height: 30px; top: " + (e.clientY - 5) +
+        "px; left: " + (e.clientX - 5) + "px; z-index: 1000; background: white; " +
+        "border-width: 0; outline: none; overflow: hidden; opacity: .05; filter: alpha(opacity=5);";
+      leaveInputAlone = true;
+      var val = input.value = getSelection();
+      focusInput();
+      selectInput(input);
+      function rehide() {
+        var newVal = splitLines(input.value).join("\n");
+        if (newVal != val && !options.readOnly) operation(replaceSelection)(newVal, "end");
+        inputDiv.style.position = "relative";
+        input.style.cssText = oldCSS;
+        if (ie_lt9) scrollbar.scrollTop = scrollPos;
+        leaveInputAlone = false;
+        resetInput(true);
+        slowPoll();
+      }
+
+      if (gecko) {
+        e_stop(e);
+        var mouseup = connect(window, "mouseup", function() {
+          mouseup();
+          setTimeout(rehide, 20);
+        }, true);
+      } else {
+        setTimeout(rehide, 50);
+      }
+    }
+
+    // Cursor-blinking
+    function restartBlink() {
+      clearInterval(blinker);
+      var on = true;
+      cursor.style.visibility = "";
+      blinker = setInterval(function() {
+        cursor.style.visibility = (on = !on) ? "" : "hidden";
+      }, 650);
+    }
+
+    var matching = {"(": ")>", ")": "(<", "[": "]>", "]": "[<", "{": "}>", "}": "{<"};
+    function matchBrackets(autoclear) {
+      var head = sel.inverted ? sel.from : sel.to, line = getLine(head.line), pos = head.ch - 1;
+      var match = (pos >= 0 && matching[line.text.charAt(pos)]) || matching[line.text.charAt(++pos)];
+      if (!match) return;
+      var ch = match.charAt(0), forward = match.charAt(1) == ">", d = forward ? 1 : -1, st = line.styles;
+      for (var off = pos + 1, i = 0, e = st.length; i < e; i+=2)
+        if ((off -= st[i].length) <= 0) {var style = st[i+1]; break;}
+
+      var stack = [line.text.charAt(pos)], re = /[(){}[\]]/;
+      function scan(line, from, to) {
+        if (!line.text) return;
+        var st = line.styles, pos = forward ? 0 : line.text.length - 1, cur;
+        for (var i = forward ? 0 : st.length - 2, e = forward ? st.length : -2; i != e; i += 2*d) {
+          var text = st[i];
+          if (st[i+1] != style) {pos += d * text.length; continue;}
+          for (var j = forward ? 0 : text.length - 1, te = forward ? text.length : -1; j != te; j += d, pos+=d) {
+            if (pos >= from && pos < to && re.test(cur = text.charAt(j))) {
+              var match = matching[cur];
+              if (match.charAt(1) == ">" == forward) stack.push(cur);
+              else if (stack.pop() != match.charAt(0)) return {pos: pos, match: false};
+              else if (!stack.length) return {pos: pos, match: true};
+            }
+          }
+        }
+      }
+      for (var i = head.line, e = forward ? Math.min(i + 100, doc.size) : Math.max(-1, i - 100); i != e; i+=d) {
+        var line = getLine(i), first = i == head.line;
+        var found = scan(line, first && forward ? pos + 1 : 0, first && !forward ? pos : line.text.length);
+        if (found) break;
+      }
+      if (!found) found = {pos: null, match: false};
+      var style = found.match ? "CodeMirror-matchingbracket" : "CodeMirror-nonmatchingbracket";
+      var one = markText({line: head.line, ch: pos}, {line: head.line, ch: pos+1}, style),
+          two = found.pos != null && markText({line: i, ch: found.pos}, {line: i, ch: found.pos + 1}, style);
+      var clear = operation(function(){one.clear(); two && two.clear();});
+      if (autoclear) setTimeout(clear, 800);
+      else bracketHighlighted = clear;
+    }
+
+    // Finds the line to start with when starting a parse. Tries to
+    // find a line with a stateAfter, so that it can start with a
+    // valid state. If that fails, it returns the line with the
+    // smallest indentation, which tends to need the least context to
+    // parse correctly.
+    function findStartLine(n) {
+      var minindent, minline;
+      for (var search = n, lim = n - 40; search > lim; --search) {
+        if (search == 0) return 0;
+        var line = getLine(search-1);
+        if (line.stateAfter) return search;
+        var indented = line.indentation(options.tabSize);
+        if (minline == null || minindent > indented) {
+          minline = search - 1;
+          minindent = indented;
+        }
+      }
+      return minline;
+    }
+    function getStateBefore(n) {
+      var start = findStartLine(n), state = start && getLine(start-1).stateAfter;
+      if (!state) state = startState(mode);
+      else state = copyState(mode, state);
+      doc.iter(start, n, function(line) {
+        line.highlight(mode, state, options.tabSize);
+        line.stateAfter = copyState(mode, state);
+      });
+      if (start < n) changes.push({from: start, to: n});
+      if (n < doc.size && !getLine(n).stateAfter) work.push(n);
+      return state;
+    }
+    function highlightLines(start, end) {
+      var state = getStateBefore(start);
+      doc.iter(start, end, function(line) {
+        line.highlight(mode, state, options.tabSize);
+        line.stateAfter = copyState(mode, state);
+      });
+    }
+    function highlightWorker() {
+      var end = +new Date + options.workTime;
+      var foundWork = work.length;
+      while (work.length) {
+        if (!getLine(showingFrom).stateAfter) var task = showingFrom;
+        else var task = work.pop();
+        if (task >= doc.size) continue;
+        var start = findStartLine(task), state = start && getLine(start-1).stateAfter;
+        if (state) state = copyState(mode, state);
+        else state = startState(mode);
+
+        var unchanged = 0, compare = mode.compareStates, realChange = false,
+            i = start, bail = false;
+        doc.iter(i, doc.size, function(line) {
+          var hadState = line.stateAfter;
+          if (+new Date > end) {
+            work.push(i);
+            startWorker(options.workDelay);
+            if (realChange) changes.push({from: task, to: i + 1});
+            return (bail = true);
+          }
+          var changed = line.highlight(mode, state, options.tabSize);
+          if (changed) realChange = true;
+          line.stateAfter = copyState(mode, state);
+          var done = null;
+          if (compare) {
+            var same = hadState && compare(hadState, state);
+            if (same != Pass) done = !!same;
+          }
+          if (done == null) {
+            if (changed !== false || !hadState) unchanged = 0;
+            else if (++unchanged > 3 && (!mode.indent || mode.indent(hadState, "") == mode.indent(state, "")))
+              done = true;
+          }
+          if (done) return true;
+          ++i;
+        });
+        if (bail) return;
+        if (realChange) changes.push({from: task, to: i + 1});
+      }
+      if (foundWork && options.onHighlightComplete)
+        options.onHighlightComplete(instance);
+    }
+    function startWorker(time) {
+      if (!work.length) return;
+      highlight.set(time, operation(highlightWorker));
+    }
+
+    // Operations are used to wrap changes in such a way that each
+    // change won't have to update the cursor and display (which would
+    // be awkward, slow, and error-prone), but instead updates are
+    // batched and then all combined and executed at once.
+    function startOperation() {
+      updateInput = userSelChange = textChanged = null;
+      changes = []; selectionChanged = false; callbacks = [];
+    }
+    function endOperation() {
+      if (updateMaxLine) computeMaxLength();
+      if (maxLineChanged && !options.lineWrapping) {
+        var cursorWidth = widthForcer.offsetWidth, left = measureLine(maxLine, maxLine.text.length).left;
+        widthForcer.style.left = left + "px";
+        lineSpace.style.minWidth = (left + cursorWidth) + "px";
+        maxLineChanged = false;
+      }
+      var newScrollPos, updated;
+      if (selectionChanged) {
+        var coords = calculateCursorCoords();
+        newScrollPos = calculateScrollPos(coords.x, coords.y, coords.x, coords.yBot);
+      }
+      if (changes.length || newScrollPos && newScrollPos.scrollTop != null)
+        updated = updateDisplay(changes, true, newScrollPos && newScrollPos.scrollTop);
+      if (!updated) {
+        if (selectionChanged) updateSelection();
+        if (gutterDirty) updateGutter();
+      }
+      if (newScrollPos) scrollCursorIntoView();
+      if (selectionChanged) {scrollEditorIntoView(); restartBlink();}
+
+      if (focused && !leaveInputAlone &&
+          (updateInput === true || (updateInput !== false && selectionChanged)))
+        resetInput(userSelChange);
+
+      if (selectionChanged && options.matchBrackets)
+        setTimeout(operation(function() {
+          if (bracketHighlighted) {bracketHighlighted(); bracketHighlighted = null;}
+          if (posEq(sel.from, sel.to)) matchBrackets(false);
+        }), 20);
+      var sc = selectionChanged, cbs = callbacks; // these can be reset by callbacks
+      if (textChanged && options.onChange && instance)
+        options.onChange(instance, textChanged);
+      if (sc && options.onCursorActivity)
+        options.onCursorActivity(instance);
+      for (var i = 0; i < cbs.length; ++i) cbs[i](instance);
+      if (updated && options.onUpdate) options.onUpdate(instance);
+    }
+    var nestedOperation = 0;
+    function operation(f) {
+      return function() {
+        if (!nestedOperation++) startOperation();
+        try {var result = f.apply(this, arguments);}
+        finally {if (!--nestedOperation) endOperation();}
+        return result;
+      };
+    }
+
+    function compoundChange(f) {
+      history.startCompound();
+      try { return f(); } finally { history.endCompound(); }
+    }
+
+    for (var ext in extensions)
+      if (extensions.propertyIsEnumerable(ext) &&
+          !instance.propertyIsEnumerable(ext))
+        instance[ext] = extensions[ext];
+    return instance;
+  } // (end of function CodeMirror)
+
+  // The default configuration options.
+  CodeMirror.defaults = {
+    value: "",
+    mode: null,
+    theme: "default",
+    indentUnit: 2,
+    indentWithTabs: false,
+    smartIndent: true,
+    tabSize: 4,
+    keyMap: "default",
+    extraKeys: null,
+    electricChars: true,
+    autoClearEmptyLines: false,
+    onKeyEvent: null,
+    onDragEvent: null,
+    lineWrapping: false,
+    lineNumbers: false,
+    gutter: false,
+    fixedGutter: false,
+    firstLineNumber: 1,
+    readOnly: false,
+    dragDrop: true,
+    onChange: null,
+    onCursorActivity: null,
+    onGutterClick: null,
+    onHighlightComplete: null,
+    onUpdate: null,
+    onFocus: null, onBlur: null, onScroll: null,
+    matchBrackets: false,
+    workTime: 100,
+    workDelay: 200,
+    pollInterval: 100,
+    undoDepth: 40,
+    tabindex: null,
+    autofocus: null,
+    lineNumberFormatter: function(integer) { return integer; }
+  };
+
+  var ios = /AppleWebKit/.test(navigator.userAgent) && /Mobile\/\w+/.test(navigator.userAgent);
+  var mac = ios || /Mac/.test(navigator.platform);
+  var win = /Win/.test(navigator.platform);
+
+  // Known modes, by name and by MIME
+  var modes = CodeMirror.modes = {}, mimeModes = CodeMirror.mimeModes = {};
+  CodeMirror.defineMode = function(name, mode) {
+    if (!CodeMirror.defaults.mode && name != "null") CodeMirror.defaults.mode = name;
+    if (arguments.length > 2) {
+      mode.dependencies = [];
+      for (var i = 2; i < arguments.length; ++i) mode.dependencies.push(arguments[i]);
+    }
+    modes[name] = mode;
+  };
+  CodeMirror.defineMIME = function(mime, spec) {
+    mimeModes[mime] = spec;
+  };
+  CodeMirror.resolveMode = function(spec) {
+    if (typeof spec == "string" && mimeModes.hasOwnProperty(spec))
+      spec = mimeModes[spec];
+    else if (typeof spec == "string" && /^[\w\-]+\/[\w\-]+\+xml$/.test(spec))
+      return CodeMirror.resolveMode("application/xml");
+    if (typeof spec == "string") return {name: spec};
+    else return spec || {name: "null"};
+  };
+  CodeMirror.getMode = function(options, spec) {
+    var spec = CodeMirror.resolveMode(spec);
+    var mfactory = modes[spec.name];
+    if (!mfactory) return CodeMirror.getMode(options, "text/plain");
+    return mfactory(options, spec);
+  };
+  CodeMirror.listModes = function() {
+    var list = [];
+    for (var m in modes)
+      if (modes.propertyIsEnumerable(m)) list.push(m);
+    return list;
+  };
+  CodeMirror.listMIMEs = function() {
+    var list = [];
+    for (var m in mimeModes)
+      if (mimeModes.propertyIsEnumerable(m)) list.push({mime: m, mode: mimeModes[m]});
+    return list;
+  };
+
+  var extensions = CodeMirror.extensions = {};
+  CodeMirror.defineExtension = function(name, func) {
+    extensions[name] = func;
+  };
+
+  var commands = CodeMirror.commands = {
+    selectAll: function(cm) {cm.setSelection({line: 0, ch: 0}, {line: cm.lineCount() - 1});},
+    killLine: function(cm) {
+      var from = cm.getCursor(true), to = cm.getCursor(false), sel = !posEq(from, to);
+      if (!sel && cm.getLine(from.line).length == from.ch) cm.replaceRange("", from, {line: from.line + 1, ch: 0});
+      else cm.replaceRange("", from, sel ? to : {line: from.line});
+    },
+    deleteLine: function(cm) {var l = cm.getCursor().line; cm.replaceRange("", {line: l, ch: 0}, {line: l});},
+    undo: function(cm) {cm.undo();},
+    redo: function(cm) {cm.redo();},
+    goDocStart: function(cm) {cm.setCursor(0, 0, true);},
+    goDocEnd: function(cm) {cm.setSelection({line: cm.lineCount() - 1}, null, true);},
+    goLineStart: function(cm) {cm.setCursor(cm.getCursor().line, 0, true);},
+    goLineStartSmart: function(cm) {
+      var cur = cm.getCursor();
+      var text = cm.getLine(cur.line), firstNonWS = Math.max(0, text.search(/\S/));
+      cm.setCursor(cur.line, cur.ch <= firstNonWS && cur.ch ? 0 : firstNonWS, true);
+    },
+    goLineEnd: function(cm) {cm.setSelection({line: cm.getCursor().line}, null, true);},
+    goLineUp: function(cm) {cm.moveV(-1, "line");},
+    goLineDown: function(cm) {cm.moveV(1, "line");},
+    goPageUp: function(cm) {cm.moveV(-1, "page");},
+    goPageDown: function(cm) {cm.moveV(1, "page");},
+    goCharLeft: function(cm) {cm.moveH(-1, "char");},
+    goCharRight: function(cm) {cm.moveH(1, "char");},
+    goColumnLeft: function(cm) {cm.moveH(-1, "column");},
+    goColumnRight: function(cm) {cm.moveH(1, "column");},
+    goWordLeft: function(cm) {cm.moveH(-1, "word");},
+    goWordRight: function(cm) {cm.moveH(1, "word");},
+    delCharLeft: function(cm) {cm.deleteH(-1, "char");},
+    delCharRight: function(cm) {cm.deleteH(1, "char");},
+    delWordLeft: function(cm) {cm.deleteH(-1, "word");},
+    delWordRight: function(cm) {cm.deleteH(1, "word");},
+    indentAuto: function(cm) {cm.indentSelection("smart");},
+    indentMore: function(cm) {cm.indentSelection("add");},
+    indentLess: function(cm) {cm.indentSelection("subtract");},
+    insertTab: function(cm) {cm.replaceSelection("\t", "end");},
+    defaultTab: function(cm) {
+      if (cm.somethingSelected()) cm.indentSelection("add");
+      else cm.replaceSelection("\t", "end");
+    },
+    transposeChars: function(cm) {
+      var cur = cm.getCursor(), line = cm.getLine(cur.line);
+      if (cur.ch > 0 && cur.ch < line.length - 1)
+        cm.replaceRange(line.charAt(cur.ch) + line.charAt(cur.ch - 1),
+                        {line: cur.line, ch: cur.ch - 1}, {line: cur.line, ch: cur.ch + 1});
+    },
+    newlineAndIndent: function(cm) {
+      cm.replaceSelection("\n", "end");
+      cm.indentLine(cm.getCursor().line);
+    },
+    toggleOverwrite: function(cm) {cm.toggleOverwrite();}
+  };
+
+  var keyMap = CodeMirror.keyMap = {};
+  keyMap.basic = {
+    "Left": "goCharLeft", "Right": "goCharRight", "Up": "goLineUp", "Down": "goLineDown",
+    "End": "goLineEnd", "Home": "goLineStartSmart", "PageUp": "goPageUp", "PageDown": "goPageDown",
+    "Delete": "delCharRight", "Backspace": "delCharLeft", "Tab": "defaultTab", "Shift-Tab": "indentAuto",
+    "Enter": "newlineAndIndent", "Insert": "toggleOverwrite"
+  };
+  // Note that the save and find-related commands aren't defined by
+  // default. Unknown commands are simply ignored.
+  keyMap.pcDefault = {
+    "Ctrl-A": "selectAll", "Ctrl-D": "deleteLine", "Ctrl-Z": "undo", "Shift-Ctrl-Z": "redo", "Ctrl-Y": "redo",
+    "Ctrl-Home": "goDocStart", "Alt-Up": "goDocStart", "Ctrl-End": "goDocEnd", "Ctrl-Down": "goDocEnd",
+    "Ctrl-Left": "goWordLeft", "Ctrl-Right": "goWordRight", "Alt-Left": "goLineStart", "Alt-Right": "goLineEnd",
+    "Ctrl-Backspace": "delWordLeft", "Ctrl-Delete": "delWordRight", "Ctrl-S": "save", "Ctrl-F": "find",
+    "Ctrl-G": "findNext", "Shift-Ctrl-G": "findPrev", "Shift-Ctrl-F": "replace", "Shift-Ctrl-R": "replaceAll",
+    "Ctrl-[": "indentLess", "Ctrl-]": "indentMore",
+    fallthrough: "basic"
+  };
+  keyMap.macDefault = {
+    "Cmd-A": "selectAll", "Cmd-D": "deleteLine", "Cmd-Z": "undo", "Shift-Cmd-Z": "redo", "Cmd-Y": "redo",
+    "Cmd-Up": "goDocStart", "Cmd-End": "goDocEnd", "Cmd-Down": "goDocEnd", "Alt-Left": "goWordLeft",
+    "Alt-Right": "goWordRight", "Cmd-Left": "goLineStart", "Cmd-Right": "goLineEnd", "Alt-Backspace": "delWordLeft",
+    "Ctrl-Alt-Backspace": "delWordRight", "Alt-Delete": "delWordRight", "Cmd-S": "save", "Cmd-F": "find",
+    "Cmd-G": "findNext", "Shift-Cmd-G": "findPrev", "Cmd-Alt-F": "replace", "Shift-Cmd-Alt-F": "replaceAll",
+    "Cmd-[": "indentLess", "Cmd-]": "indentMore",
+    fallthrough: ["basic", "emacsy"]
+  };
+  keyMap["default"] = mac ? keyMap.macDefault : keyMap.pcDefault;
+  keyMap.emacsy = {
+    "Ctrl-F": "goCharRight", "Ctrl-B": "goCharLeft", "Ctrl-P": "goLineUp", "Ctrl-N": "goLineDown",
+    "Alt-F": "goWordRight", "Alt-B": "goWordLeft", "Ctrl-A": "goLineStart", "Ctrl-E": "goLineEnd",
+    "Ctrl-V": "goPageUp", "Shift-Ctrl-V": "goPageDown", "Ctrl-D": "delCharRight", "Ctrl-H": "delCharLeft",
+    "Alt-D": "delWordRight", "Alt-Backspace": "delWordLeft", "Ctrl-K": "killLine", "Ctrl-T": "transposeChars"
+  };
+
+  function getKeyMap(val) {
+    if (typeof val == "string") return keyMap[val];
+    else return val;
+  }
+  function lookupKey(name, extraMap, map, handle, stop) {
+    function lookup(map) {
+      map = getKeyMap(map);
+      var found = map[name];
+      if (found === false) {
+        if (stop) stop();
+        return true;
+      }
+      if (found != null && handle(found)) return true;
+      if (map.nofallthrough) {
+        if (stop) stop();
+        return true;
+      }
+      var fallthrough = map.fallthrough;
+      if (fallthrough == null) return false;
+      if (Object.prototype.toString.call(fallthrough) != "[object Array]")
+        return lookup(fallthrough);
+      for (var i = 0, e = fallthrough.length; i < e; ++i) {
+        if (lookup(fallthrough[i])) return true;
+      }
+      return false;
+    }
+    if (extraMap && lookup(extraMap)) return true;
+    return lookup(map);
+  }
+  function isModifierKey(event) {
+    var name = keyNames[e_prop(event, "keyCode")];
+    return name == "Ctrl" || name == "Alt" || name == "Shift" || name == "Mod";
+  }
+
+  CodeMirror.fromTextArea = function(textarea, options) {
+    if (!options) options = {};
+    options.value = textarea.value;
+    if (!options.tabindex && textarea.tabindex)
+      options.tabindex = textarea.tabindex;
+    if (options.autofocus == null && textarea.getAttribute("autofocus") != null)
+      options.autofocus = true;
+
+    function save() {textarea.value = instance.getValue();}
+    if (textarea.form) {
+      // Deplorable hack to make the submit method do the right thing.
+      var rmSubmit = connect(textarea.form, "submit", save, true);
+      if (typeof textarea.form.submit == "function") {
+        var realSubmit = textarea.form.submit;
+        textarea.form.submit = function wrappedSubmit() {
+          save();
+          textarea.form.submit = realSubmit;
+          textarea.form.submit();
+          textarea.form.submit = wrappedSubmit;
+        };
+      }
+    }
+
+    textarea.style.display = "none";
+    var instance = CodeMirror(function(node) {
+      textarea.parentNode.insertBefore(node, textarea.nextSibling);
+    }, options);
+    instance.save = save;
+    instance.getTextArea = function() { return textarea; };
+    instance.toTextArea = function() {
+      save();
+      textarea.parentNode.removeChild(instance.getWrapperElement());
+      textarea.style.display = "";
+      if (textarea.form) {
+        rmSubmit();
+        if (typeof textarea.form.submit == "function")
+          textarea.form.submit = realSubmit;
+      }
+    };
+    return instance;
+  };
+
+  var gecko = /gecko\/\d{7}/i.test(navigator.userAgent);
+  var ie = /MSIE \d/.test(navigator.userAgent);
+  var ie_lt8 = /MSIE [1-7]\b/.test(navigator.userAgent);
+  var ie_lt9 = /MSIE [1-8]\b/.test(navigator.userAgent);
+  var quirksMode = ie && document.documentMode == 5;
+  var webkit = /WebKit\//.test(navigator.userAgent);
+  var chrome = /Chrome\//.test(navigator.userAgent);
+  var opera = /Opera\//.test(navigator.userAgent);
+  var safari = /Apple Computer/.test(navigator.vendor);
+  var khtml = /KHTML\//.test(navigator.userAgent);
+  var mac_geLion = /Mac OS X 10\D([7-9]|\d\d)\D/.test(navigator.userAgent);
+
+  // Utility functions for working with state. Exported because modes
+  // sometimes need to do this.
+  function copyState(mode, state) {
+    if (state === true) return state;
+    if (mode.copyState) return mode.copyState(state);
+    var nstate = {};
+    for (var n in state) {
+      var val = state[n];
+      if (val instanceof Array) val = val.concat([]);
+      nstate[n] = val;
+    }
+    return nstate;
+  }
+  CodeMirror.copyState = copyState;
+  function startState(mode, a1, a2) {
+    return mode.startState ? mode.startState(a1, a2) : true;
+  }
+  CodeMirror.startState = startState;
+
+  // The character stream used by a mode's parser.
+  function StringStream(string, tabSize) {
+    this.pos = this.start = 0;
+    this.string = string;
+    this.tabSize = tabSize || 8;
+  }
+  StringStream.prototype = {
+    eol: function() {return this.pos >= this.string.length;},
+    sol: function() {return this.pos == 0;},
+    peek: function() {return this.string.charAt(this.pos);},
+    next: function() {
+      if (this.pos < this.string.length)
+        return this.string.charAt(this.pos++);
+    },
+    eat: function(match) {
+      var ch = this.string.charAt(this.pos);
+      if (typeof match == "string") var ok = ch == match;
+      else var ok = ch && (match.test ? match.test(ch) : match(ch));
+      if (ok) {++this.pos; return ch;}
+    },
+    eatWhile: function(match) {
+      var start = this.pos;
+      while (this.eat(match)){}
+      return this.pos > start;
+    },
+    eatSpace: function() {
+      var start = this.pos;
+      while (/[\s\u00a0]/.test(this.string.charAt(this.pos))) ++this.pos;
+      return this.pos > start;
+    },
+    skipToEnd: function() {this.pos = this.string.length;},
+    skipTo: function(ch) {
+      var found = this.string.indexOf(ch, this.pos);
+      if (found > -1) {this.pos = found; return true;}
+    },
+    backUp: function(n) {this.pos -= n;},
+    column: function() {return countColumn(this.string, this.start, this.tabSize);},
+    indentation: function() {return countColumn(this.string, null, this.tabSize);},
+    match: function(pattern, consume, caseInsensitive) {
+      if (typeof pattern == "string") {
+        var cased = function(str) {return caseInsensitive ? str.toLowerCase() : str;};
+        if (cased(this.string).indexOf(cased(pattern), this.pos) == this.pos) {
+          if (consume !== false) this.pos += pattern.length;
+          return true;
+        }
+      } else {
+        var match = this.string.slice(this.pos).match(pattern);
+        if (match && consume !== false) this.pos += match[0].length;
+        return match;
+      }
+    },
+    current: function(){return this.string.slice(this.start, this.pos);}
+  };
+  CodeMirror.StringStream = StringStream;
+
+  function MarkedText(from, to, className, marker) {
+    this.from = from; this.to = to; this.style = className; this.marker = marker;
+  }
+  MarkedText.prototype = {
+    attach: function(line) { this.marker.set.push(line); },
+    detach: function(line) {
+      var ix = indexOf(this.marker.set, line);
+      if (ix > -1) this.marker.set.splice(ix, 1);
+    },
+    split: function(pos, lenBefore) {
+      if (this.to <= pos && this.to != null) return null;
+      var from = this.from < pos || this.from == null ? null : this.from - pos + lenBefore;
+      var to = this.to == null ? null : this.to - pos + lenBefore;
+      return new MarkedText(from, to, this.style, this.marker);
+    },
+    dup: function() { return new MarkedText(null, null, this.style, this.marker); },
+    clipTo: function(fromOpen, from, toOpen, to, diff) {
+      if (fromOpen && to > this.from && (to < this.to || this.to == null))
+        this.from = null;
+      else if (this.from != null && this.from >= from)
+        this.from = Math.max(to, this.from) + diff;
+      if (toOpen && (from < this.to || this.to == null) && (from > this.from || this.from == null))
+        this.to = null;
+      else if (this.to != null && this.to > from)
+        this.to = to < this.to ? this.to + diff : from;
+    },
+    isDead: function() { return this.from != null && this.to != null && this.from >= this.to; },
+    sameSet: function(x) { return this.marker == x.marker; }
+  };
+
+  function Bookmark(pos) {
+    this.from = pos; this.to = pos; this.line = null;
+  }
+  Bookmark.prototype = {
+    attach: function(line) { this.line = line; },
+    detach: function(line) { if (this.line == line) this.line = null; },
+    split: function(pos, lenBefore) {
+      if (pos < this.from) {
+        this.from = this.to = (this.from - pos) + lenBefore;
+        return this;
+      }
+    },
+    isDead: function() { return this.from > this.to; },
+    clipTo: function(fromOpen, from, toOpen, to, diff) {
+      if ((fromOpen || from < this.from) && (toOpen || to > this.to)) {
+        this.from = 0; this.to = -1;
+      } else if (this.from > from) {
+        this.from = this.to = Math.max(to, this.from) + diff;
+      }
+    },
+    sameSet: function(x) { return false; },
+    find: function() {
+      if (!this.line || !this.line.parent) return null;
+      return {line: lineNo(this.line), ch: this.from};
+    },
+    clear: function() {
+      if (this.line) {
+        var found = indexOf(this.line.marked, this);
+        if (found != -1) this.line.marked.splice(found, 1);
+        this.line = null;
+      }
+    }
+  };
+
+  // When measuring the position of the end of a line, different
+  // browsers require different approaches. If an empty span is added,
+  // many browsers report bogus offsets. Of those, some (Webkit,
+  // recent IE) will accept a space without moving the whole span to
+  // the next line when wrapping it, others work with a zero-width
+  // space.
+  var eolSpanContent = " ";
+  if (gecko || (ie && !ie_lt8)) eolSpanContent = "\u200b";
+  else if (opera) eolSpanContent = "";
+
+  // Line objects. These hold state related to a line, including
+  // highlighting info (the styles array).
+  function Line(text, styles) {
+    this.styles = styles || [text, null];
+    this.text = text;
+    this.height = 1;
+  }
+  Line.inheritMarks = function(text, orig) {
+    var ln = new Line(text), mk = orig && orig.marked;
+    if (mk) {
+      for (var i = 0; i < mk.length; ++i) {
+        if (mk[i].to == null && mk[i].style) {
+          var newmk = ln.marked || (ln.marked = []), mark = mk[i];
+          var nmark = mark.dup(); newmk.push(nmark); nmark.attach(ln);
+        }
+      }
+    }
+    return ln;
+  };
+  Line.prototype = {
+    // Replace a piece of a line, keeping the styles around it intact.
+    replace: function(from, to_, text) {
+      var st = [], mk = this.marked, to = to_ == null ? this.text.length : to_;
+      copyStyles(0, from, this.styles, st);
+      if (text) st.push(text, null);
+      copyStyles(to, this.text.length, this.styles, st);
+      this.styles = st;
+      this.text = this.text.slice(0, from) + text + this.text.slice(to);
+      this.stateAfter = null;
+      if (mk) {
+        var diff = text.length - (to - from);
+        for (var i = 0; i < mk.length; ++i) {
+          var mark = mk[i];
+          mark.clipTo(from == null, from || 0, to_ == null, to, diff);
+          if (mark.isDead()) {mark.detach(this); mk.splice(i--, 1);}
+        }
+      }
+    },
+    // Split a part off a line, keeping styles and markers intact.
+    split: function(pos, textBefore) {
+      var st = [textBefore, null], mk = this.marked;
+      copyStyles(pos, this.text.length, this.styles, st);
+      var taken = new Line(textBefore + this.text.slice(pos), st);
+      if (mk) {
+        for (var i = 0; i < mk.length; ++i) {
+          var mark = mk[i];
+          var newmark = mark.split(pos, textBefore.length);
+          if (newmark) {
+            if (!taken.marked) taken.marked = [];
+            taken.marked.push(newmark); newmark.attach(taken);
+            if (newmark == mark) mk.splice(i--, 1);
+          }
+        }
+      }
+      return taken;
+    },
+    append: function(line) {
+      var mylen = this.text.length, mk = line.marked, mymk = this.marked;
+      this.text += line.text;
+      copyStyles(0, line.text.length, line.styles, this.styles);
+      if (mymk) {
+        for (var i = 0; i < mymk.length; ++i)
+          if (mymk[i].to == null) mymk[i].to = mylen;
+      }
+      if (mk && mk.length) {
+        if (!mymk) this.marked = mymk = [];
+        outer: for (var i = 0; i < mk.length; ++i) {
+          var mark = mk[i];
+          if (!mark.from) {
+            for (var j = 0; j < mymk.length; ++j) {
+              var mymark = mymk[j];
+              if (mymark.to == mylen && mymark.sameSet(mark)) {
+                mymark.to = mark.to == null ? null : mark.to + mylen;
+                if (mymark.isDead()) {
+                  mymark.detach(this);
+                  mk.splice(i--, 1);
+                }
+                continue outer;
+              }
+            }
+          }
+          mymk.push(mark);
+          mark.attach(this);
+          mark.from += mylen;
+          if (mark.to != null) mark.to += mylen;
+        }
+      }
+    },
+    fixMarkEnds: function(other) {
+      var mk = this.marked, omk = other.marked;
+      if (!mk) return;
+      outer: for (var i = 0; i < mk.length; ++i) {
+        var mark = mk[i], close = mark.to == null;
+        if (close && omk) {
+          for (var j = 0; j < omk.length; ++j) {
+            var om = omk[j];
+            if (!om.sameSet(mark) || om.from != null) continue;
+            if (mark.from == this.text.length && om.to == 0) {
+              omk.splice(j, 1);
+              mk.splice(i--, 1);
+              continue outer;
+            } else {
+              close = false; break;
+            }
+          }
+        }
+        if (close) mark.to = this.text.length;
+      }
+    },
+    fixMarkStarts: function() {
+      var mk = this.marked;
+      if (!mk) return;
+      for (var i = 0; i < mk.length; ++i)
+        if (mk[i].from == null) mk[i].from = 0;
+    },
+    addMark: function(mark) {
+      mark.attach(this);
+      if (this.marked == null) this.marked = [];
+      this.marked.push(mark);
+      this.marked.sort(function(a, b){return (a.from || 0) - (b.from || 0);});
+    },
+    // Run the given mode's parser over a line, update the styles
+    // array, which contains alternating fragments of text and CSS
+    // classes.
+    highlight: function(mode, state, tabSize) {
+      var stream = new StringStream(this.text, tabSize), st = this.styles, pos = 0;
+      var changed = false, curWord = st[0], prevWord;
+      if (this.text == "" && mode.blankLine) mode.blankLine(state);
+      while (!stream.eol()) {
+        var style = mode.token(stream, state);
+        var substr = this.text.slice(stream.start, stream.pos);
+        stream.start = stream.pos;
+        if (pos && st[pos-1] == style)
+          st[pos-2] += substr;
+        else if (substr) {
+          if (!changed && (st[pos+1] != style || (pos && st[pos-2] != prevWord))) changed = true;
+          st[pos++] = substr; st[pos++] = style;
+          prevWord = curWord; curWord = st[pos];
+        }
+        // Give up when line is ridiculously long
+        if (stream.pos > 5000) {
+          st[pos++] = this.text.slice(stream.pos); st[pos++] = null;
+          break;
+        }
+      }
+      if (st.length != pos) {st.length = pos; changed = true;}
+      if (pos && st[pos-2] != prevWord) changed = true;
+      // Short lines with simple highlights return null, and are
+      // counted as changed by the driver because they are likely to
+      // highlight the same way in various contexts.
+      return changed || (st.length < 5 && this.text.length < 10 ? null : false);
+    },
+    // Fetch the parser token for a given character. Useful for hacks
+    // that want to inspect the mode state (say, for completion).
+    getTokenAt: function(mode, state, tabSize, ch) {
+      var txt = this.text, stream = new StringStream(txt, tabSize);
+      while (stream.pos < ch && !stream.eol()) {
+        stream.start = stream.pos;
+        var style = mode.token(stream, state);
+      }
+      return {start: stream.start,
+              end: stream.pos,
+              string: stream.current(),
+              className: style || null,
+              state: state};
+    },
+    indentation: function(tabSize) {return countColumn(this.text, null, tabSize);},
+    // Produces an HTML fragment for the line, taking selection,
+    // marking, and highlighting into account.
+    getElement: function(makeTab, wrapAt, wrapWBR) {
+      var first = true, col = 0, specials = /[\t\u0000-\u0019\u200b\u2028\u2029\uFEFF]/g;
+      var pre = elt("pre");
+      function span_(html, text, style) {
+        if (!text) return;
+        // Work around a bug where, in some compat modes, IE ignores leading spaces
+        if (first && ie && text.charAt(0) == " ") text = "\u00a0" + text.slice(1);
+        first = false;
+        if (!specials.test(text)) {
+          col += text.length;
+          var content = document.createTextNode(text);
+        } else {
+          var content = document.createDocumentFragment(), pos = 0;
+          while (true) {
+            specials.lastIndex = pos;
+            var m = specials.exec(text);
+            var skipped = m ? m.index - pos : text.length - pos;
+            if (skipped) {
+              content.appendChild(document.createTextNode(text.slice(pos, pos + skipped)));
+              col += skipped;
+            }
+            if (!m) break;
+            pos += skipped + 1;
+            if (m[0] == "\t") {
+              var tab = makeTab(col);
+              content.appendChild(tab.element.cloneNode(true));
+              col += tab.width;
+            } else {
+              var token = elt("span", "\u2022", "cm-invalidchar");
+              token.title = "\\u" + m[0].charCodeAt(0).toString(16);
+              content.appendChild(token);
+              col += 1;
+            }
+          }
+        }
+        if (style) html.appendChild(elt("span", [content], style));
+        else html.appendChild(content);
+      }
+      var span = span_;
+      if (wrapAt != null) {
+        var outPos = 0, anchor = pre.anchor = elt("span");
+        span = function(html, text, style) {
+          var l = text.length;
+          if (wrapAt >= outPos && wrapAt < outPos + l) {
+            if (wrapAt > outPos) {
+              span_(html, text.slice(0, wrapAt - outPos), style);
+              // See comment at the definition of spanAffectsWrapping
+              if (wrapWBR) html.appendChild(elt("wbr"));
+            }
+            html.appendChild(anchor);
+            var cut = wrapAt - outPos;
+            span_(anchor, opera ? text.slice(cut, cut + 1) : text.slice(cut), style);
+            if (opera) span_(html, text.slice(cut + 1), style);
+            wrapAt--;
+            outPos += l;
+          } else {
+            outPos += l;
+            span_(html, text, style);
+            if (outPos == wrapAt && outPos == len) {
+              setTextContent(anchor, eolSpanContent);
+              html.appendChild(anchor);
+            }
+            // Stop outputting HTML when gone sufficiently far beyond measure
+            else if (outPos > wrapAt + 10 && /\s/.test(text)) span = function(){};
+          }
+        };
+      }
+
+      var st = this.styles, allText = this.text, marked = this.marked;
+      var len = allText.length;
+      function styleToClass(style) {
+        if (!style) return null;
+        return "cm-" + style.replace(/ +/g, " cm-");
+      }
+      if (!allText && wrapAt == null) {
+        span(pre, " ");
+      } else if (!marked || !marked.length) {
+        for (var i = 0, ch = 0; ch < len; i+=2) {
+          var str = st[i], style = st[i+1], l = str.length;
+          if (ch + l > len) str = str.slice(0, len - ch);
+          ch += l;
+          span(pre, str, styleToClass(style));
+        }
+      } else {
+        var pos = 0, i = 0, text = "", style, sg = 0;
+        var nextChange = marked[0].from || 0, marks = [], markpos = 0;
+        var advanceMarks = function() {
+          var m;
+          while (markpos < marked.length &&
+                 ((m = marked[markpos]).from == pos || m.from == null)) {
+            if (m.style != null) marks.push(m);
+            ++markpos;
+          }
+          nextChange = markpos < marked.length ? marked[markpos].from : Infinity;
+          for (var i = 0; i < marks.length; ++i) {
+            var to = marks[i].to;
+            if (to == null) to = Infinity;
+            if (to == pos) marks.splice(i--, 1);
+            else nextChange = Math.min(to, nextChange);
+          }
+        };
+        var m = 0;
+        while (pos < len) {
+          if (nextChange == pos) advanceMarks();
+          var upto = Math.min(len, nextChange);
+          while (true) {
+            if (text) {
+              var end = pos + text.length;
+              var appliedStyle = style;
+              for (var j = 0; j < marks.length; ++j)
+                appliedStyle = (appliedStyle ? appliedStyle + " " : "") + marks[j].style;
+              span(pre, end > upto ? text.slice(0, upto - pos) : text, appliedStyle);
+              if (end >= upto) {text = text.slice(upto - pos); pos = upto; break;}
+              pos = end;
+            }
+            text = st[i++]; style = styleToClass(st[i++]);
+          }
+        }
+      }
+      return pre;
+    },
+    cleanUp: function() {
+      this.parent = null;
+      if (this.marked)
+        for (var i = 0, e = this.marked.length; i < e; ++i) this.marked[i].detach(this);
+    }
+  };
+  // Utility used by replace and split above
+  function copyStyles(from, to, source, dest) {
+    for (var i = 0, pos = 0, state = 0; pos < to; i+=2) {
+      var part = source[i], end = pos + part.length;
+      if (state == 0) {
+        if (end > from) dest.push(part.slice(from - pos, Math.min(part.length, to - pos)), source[i+1]);
+        if (end >= from) state = 1;
+      } else if (state == 1) {
+        if (end > to) dest.push(part.slice(0, to - pos), source[i+1]);
+        else dest.push(part, source[i+1]);
+      }
+      pos = end;
+    }
+  }
+
+  // Data structure that holds the sequence of lines.
+  function LeafChunk(lines) {
+    this.lines = lines;
+    this.parent = null;
+    for (var i = 0, e = lines.length, height = 0; i < e; ++i) {
+      lines[i].parent = this;
+      height += lines[i].height;
+    }
+    this.height = height;
+  }
+  LeafChunk.prototype = {
+    chunkSize: function() { return this.lines.length; },
+    remove: function(at, n, callbacks) {
+      for (var i = at, e = at + n; i < e; ++i) {
+        var line = this.lines[i];
+        this.height -= line.height;
+        line.cleanUp();
+        if (line.handlers)
+          for (var j = 0; j < line.handlers.length; ++j) callbacks.push(line.handlers[j]);
+      }
+      this.lines.splice(at, n);
+    },
+    collapse: function(lines) {
+      lines.splice.apply(lines, [lines.length, 0].concat(this.lines));
+    },
+    insertHeight: function(at, lines, height) {
+      this.height += height;
+      this.lines = this.lines.slice(0, at).concat(lines).concat(this.lines.slice(at));
+      for (var i = 0, e = lines.length; i < e; ++i) lines[i].parent = this;
+    },
+    iterN: function(at, n, op) {
+      for (var e = at + n; at < e; ++at)
+        if (op(this.lines[at])) return true;
+    }
+  };
+  function BranchChunk(children) {
+    this.children = children;
+    var size = 0, height = 0;
+    for (var i = 0, e = children.length; i < e; ++i) {
+      var ch = children[i];
+      size += ch.chunkSize(); height += ch.height;
+      ch.parent = this;
+    }
+    this.size = size;
+    this.height = height;
+    this.parent = null;
+  }
+  BranchChunk.prototype = {
+    chunkSize: function() { return this.size; },
+    remove: function(at, n, callbacks) {
+      this.size -= n;
+      for (var i = 0; i < this.children.length; ++i) {
+        var child = this.children[i], sz = child.chunkSize();
+        if (at < sz) {
+          var rm = Math.min(n, sz - at), oldHeight = child.height;
+          child.remove(at, rm, callbacks);
+          this.height -= oldHeight - child.height;
+          if (sz == rm) { this.children.splice(i--, 1); child.parent = null; }
+          if ((n -= rm) == 0) break;
+          at = 0;
+        } else at -= sz;
+      }
+      if (this.size - n < 25) {
+        var lines = [];
+        this.collapse(lines);
+        this.children = [new LeafChunk(lines)];
+        this.children[0].parent = this;
+      }
+    },
+    collapse: function(lines) {
+      for (var i = 0, e = this.children.length; i < e; ++i) this.children[i].collapse(lines);
+    },
+    insert: function(at, lines) {
+      var height = 0;
+      for (var i = 0, e = lines.length; i < e; ++i) height += lines[i].height;
+      this.insertHeight(at, lines, height);
+    },
+    insertHeight: function(at, lines, height) {
+      this.size += lines.length;
+      this.height += height;
+      for (var i = 0, e = this.children.length; i < e; ++i) {
+        var child = this.children[i], sz = child.chunkSize();
+        if (at <= sz) {
+          child.insertHeight(at, lines, height);
+          if (child.lines && child.lines.length > 50) {
+            while (child.lines.length > 50) {
+              var spilled = child.lines.splice(child.lines.length - 25, 25);
+              var newleaf = new LeafChunk(spilled);
+              child.height -= newleaf.height;
+              this.children.splice(i + 1, 0, newleaf);
+              newleaf.parent = this;
+            }
+            this.maybeSpill();
+          }
+          break;
+        }
+        at -= sz;
+      }
+    },
+    maybeSpill: function() {
+      if (this.children.length <= 10) return;
+      var me = this;
+      do {
+        var spilled = me.children.splice(me.children.length - 5, 5);
+        var sibling = new BranchChunk(spilled);
+        if (!me.parent) { // Become the parent node
+          var copy = new BranchChunk(me.children);
+          copy.parent = me;
+          me.children = [copy, sibling];
+          me = copy;
+        } else {
+          me.size -= sibling.size;
+          me.height -= sibling.height;
+          var myIndex = indexOf(me.parent.children, me);
+          me.parent.children.splice(myIndex + 1, 0, sibling);
+        }
+        sibling.parent = me.parent;
+      } while (me.children.length > 10);
+      me.parent.maybeSpill();
+    },
+    iter: function(from, to, op) { this.iterN(from, to - from, op); },
+    iterN: function(at, n, op) {
+      for (var i = 0, e = this.children.length; i < e; ++i) {
+        var child = this.children[i], sz = child.chunkSize();
+        if (at < sz) {
+          var used = Math.min(n, sz - at);
+          if (child.iterN(at, used, op)) return true;
+          if ((n -= used) == 0) break;
+          at = 0;
+        } else at -= sz;
+      }
+    }
+  };
+
+  function getLineAt(chunk, n) {
+    while (!chunk.lines) {
+      for (var i = 0;; ++i) {
+        var child = chunk.children[i], sz = child.chunkSize();
+        if (n < sz) { chunk = child; break; }
+        n -= sz;
+      }
+    }
+    return chunk.lines[n];
+  }
+  function lineNo(line) {
+    if (line.parent == null) return null;
+    var cur = line.parent, no = indexOf(cur.lines, line);
+    for (var chunk = cur.parent; chunk; cur = chunk, chunk = chunk.parent) {
+      for (var i = 0, e = chunk.children.length; ; ++i) {
+        if (chunk.children[i] == cur) break;
+        no += chunk.children[i].chunkSize();
+      }
+    }
+    return no;
+  }
+  function lineAtHeight(chunk, h) {
+    var n = 0;
+    outer: do {
+      for (var i = 0, e = chunk.children.length; i < e; ++i) {
+        var child = chunk.children[i], ch = child.height;
+        if (h < ch) { chunk = child; continue outer; }
+        h -= ch;
+        n += child.chunkSize();
+      }
+      return n;
+    } while (!chunk.lines);
+    for (var i = 0, e = chunk.lines.length; i < e; ++i) {
+      var line = chunk.lines[i], lh = line.height;
+      if (h < lh) break;
+      h -= lh;
+    }
+    return n + i;
+  }
+  function heightAtLine(chunk, n) {
+    var h = 0;
+    outer: do {
+      for (var i = 0, e = chunk.children.length; i < e; ++i) {
+        var child = chunk.children[i], sz = child.chunkSize();
+        if (n < sz) { chunk = child; continue outer; }
+        n -= sz;
+        h += child.height;
+      }
+      return h;
+    } while (!chunk.lines);
+    for (var i = 0; i < n; ++i) h += chunk.lines[i].height;
+    return h;
+  }
+
+  // The history object 'chunks' changes that are made close together
+  // and at almost the same time into bigger undoable units.
+  function History() {
+    this.time = 0;
+    this.done = []; this.undone = [];
+    this.compound = 0;
+    this.closed = false;
+  }
+  History.prototype = {
+    addChange: function(start, added, old) {
+      this.undone.length = 0;
+      var time = +new Date, cur = this.done[this.done.length - 1], last = cur && cur[cur.length - 1];
+      var dtime = time - this.time;
+
+      if (this.compound && cur && !this.closed) {
+        cur.push({start: start, added: added, old: old});
+      } else if (dtime > 400 || !last || this.closed ||
+                 last.start > start + old.length || last.start + last.added < start) {
+        this.done.push([{start: start, added: added, old: old}]);
+        this.closed = false;
+      } else {
+        var startBefore = Math.max(0, last.start - start),
+            endAfter = Math.max(0, (start + old.length) - (last.start + last.added));
+        for (var i = startBefore; i > 0; --i) last.old.unshift(old[i - 1]);
+        for (var i = endAfter; i > 0; --i) last.old.push(old[old.length - i]);
+        if (startBefore) last.start = start;
+        last.added += added - (old.length - startBefore - endAfter);
+      }
+      this.time = time;
+    },
+    startCompound: function() {
+      if (!this.compound++) this.closed = true;
+    },
+    endCompound: function() {
+      if (!--this.compound) this.closed = true;
+    }
+  };
+
+  function stopMethod() {e_stop(this);}
+  // Ensure an event has a stop method.
+  function addStop(event) {
+    if (!event.stop) event.stop = stopMethod;
+    return event;
+  }
+
+  function e_preventDefault(e) {
+    if (e.preventDefault) e.preventDefault();
+    else e.returnValue = false;
+  }
+  function e_stopPropagation(e) {
+    if (e.stopPropagation) e.stopPropagation();
+    else e.cancelBubble = true;
+  }
+  function e_stop(e) {e_preventDefault(e); e_stopPropagation(e);}
+  CodeMirror.e_stop = e_stop;
+  CodeMirror.e_preventDefault = e_preventDefault;
+  CodeMirror.e_stopPropagation = e_stopPropagation;
+
+  function e_target(e) {return e.target || e.srcElement;}
+  function e_button(e) {
+    var b = e.which;
+    if (b == null) {
+      if (e.button & 1) b = 1;
+      else if (e.button & 2) b = 3;
+      else if (e.button & 4) b = 2;
+    }
+    if (mac && e.ctrlKey && b == 1) b = 3;
+    return b;
+  }
+
+  // Allow 3rd-party code to override event properties by adding an override
+  // object to an event object.
+  function e_prop(e, prop) {
+    var overridden = e.override && e.override.hasOwnProperty(prop);
+    return overridden ? e.override[prop] : e[prop];
+  }
+
+  // Event handler registration. If disconnect is true, it'll return a
+  // function that unregisters the handler.
+  function connect(node, type, handler, disconnect) {
+    if (typeof node.addEventListener == "function") {
+      node.addEventListener(type, handler, false);
+      if (disconnect) return function() {node.removeEventListener(type, handler, false);};
+    } else {
+      var wrapHandler = function(event) {handler(event || window.event);};
+      node.attachEvent("on" + type, wrapHandler);
+      if (disconnect) return function() {node.detachEvent("on" + type, wrapHandler);};
+    }
+  }
+  CodeMirror.connect = connect;
+
+  function Delayed() {this.id = null;}
+  Delayed.prototype = {set: function(ms, f) {clearTimeout(this.id); this.id = setTimeout(f, ms);}};
+
+  var Pass = CodeMirror.Pass = {toString: function(){return "CodeMirror.Pass";}};
+
+  // Detect drag-and-drop
+  var dragAndDrop = function() {
+    // There is *some* kind of drag-and-drop support in IE6-8, but I
+    // couldn't get it to work yet.
+    if (ie_lt9) return false;
+    var div = elt('div');
+    return "draggable" in div || "dragDrop" in div;
+  }();
+
+  // Feature-detect whether newlines in textareas are converted to \r\n
+  var lineSep = function () {
+    var te = elt("textarea");
+    te.value = "foo\nbar";
+    if (te.value.indexOf("\r") > -1) return "\r\n";
+    return "\n";
+  }();
+
+  // For a reason I have yet to figure out, some browsers disallow
+  // word wrapping between certain characters *only* if a new inline
+  // element is started between them. This makes it hard to reliably
+  // measure the position of things, since that requires inserting an
+  // extra span. This terribly fragile set of regexps matches the
+  // character combinations that suffer from this phenomenon on the
+  // various browsers.
+  var spanAffectsWrapping = /^$/; // Won't match any two-character string
+  if (gecko) spanAffectsWrapping = /$'/;
+  else if (safari) spanAffectsWrapping = /\-[^ \-?]|\?[^ !'\"\),.\-\/:;\?\]\}]/;
+  else if (chrome) spanAffectsWrapping = /\-[^ \-\.?]|\?[^ \-\.?\]\}:;!'\"\),\/]|[\.!\"#&%\)*+,:;=>\]|\}~][\(\{\[<]|\$'/;
+
+  // Counts the column offset in a string, taking tabs into account.
+  // Used mostly to find indentation.
+  function countColumn(string, end, tabSize) {
+    if (end == null) {
+      end = string.search(/[^\s\u00a0]/);
+      if (end == -1) end = string.length;
+    }
+    for (var i = 0, n = 0; i < end; ++i) {
+      if (string.charAt(i) == "\t") n += tabSize - (n % tabSize);
+      else ++n;
+    }
+    return n;
+  }
+
+  function computedStyle(elt) {
+    if (elt.currentStyle) return elt.currentStyle;
+    return window.getComputedStyle(elt, null);
+  }
+
+  function eltOffset(node, screen) {
+    // Take the parts of bounding client rect that we are interested in so we are able to edit if need be,
+    // since the returned value cannot be changed externally (they are kept in sync as the element moves within the page)
+    try { var box = node.getBoundingClientRect(); box = { top: box.top, left: box.left }; }
+    catch(e) { box = {top: 0, left: 0}; }
+    if (!screen) {
+      // Get the toplevel scroll, working around browser differences.
+      if (window.pageYOffset == null) {
+        var t = document.documentElement || document.body.parentNode;
+        if (t.scrollTop == null) t = document.body;
+        box.top += t.scrollTop; box.left += t.scrollLeft;
+      } else {
+        box.top += window.pageYOffset; box.left += window.pageXOffset;
+      }
+    }
+    return box;
+  }
+
+  // Get a node's text content.
+  function eltText(node) {
+    return node.textContent || node.innerText || node.nodeValue || "";
+  }
+  function selectInput(node) {
+    if (ios) { // Mobile Safari apparently has a bug where select() is broken.
+      node.selectionStart = 0;
+      node.selectionEnd = node.value.length;
+    } else node.select();
+  }
+
+  // Operations on {line, ch} objects.
+  function posEq(a, b) {return a.line == b.line && a.ch == b.ch;}
+  function posLess(a, b) {return a.line < b.line || (a.line == b.line && a.ch < b.ch);}
+  function copyPos(x) {return {line: x.line, ch: x.ch};}
+
+  function elt(tag, content, className, style) {
+    var e = document.createElement(tag);
+    if (className) e.className = className;
+    if (style) e.style.cssText = style;
+    if (typeof content == "string") setTextContent(e, content);
+    else if (content) for (var i = 0; i < content.length; ++i) e.appendChild(content[i]);
+    return e;
+  }
+  function removeChildren(e) {
+    e.innerHTML = "";
+    return e;
+  }
+  function removeChildrenAndAdd(parent, e) {
+    removeChildren(parent).appendChild(e);
+  }
+  function setTextContent(e, str) {
+    if (ie_lt9) {
+      e.innerHTML = "";
+      e.appendChild(document.createTextNode(str));
+    } else e.textContent = str;
+  }
+  CodeMirror.setTextContent = setTextContent;
+
+  // Used to position the cursor after an undo/redo by finding the
+  // last edited character.
+  function editEnd(from, to) {
+    if (!to) return 0;
+    if (!from) return to.length;
+    for (var i = from.length, j = to.length; i >= 0 && j >= 0; --i, --j)
+      if (from.charAt(i) != to.charAt(j)) break;
+    return j + 1;
+  }
+
+  function indexOf(collection, elt) {
+    if (collection.indexOf) return collection.indexOf(elt);
+    for (var i = 0, e = collection.length; i < e; ++i)
+      if (collection[i] == elt) return i;
+    return -1;
+  }
+  function isWordChar(ch) {
+    return /\w/.test(ch) || ch.toUpperCase() != ch.toLowerCase();
+  }
+
+  // See if "".split is the broken IE version, if so, provide an
+  // alternative way to split lines.
+  var splitLines = "\n\nb".split(/\n/).length != 3 ? function(string) {
+    var pos = 0, result = [], l = string.length;
+    while (pos <= l) {
+      var nl = string.indexOf("\n", pos);
+      if (nl == -1) nl = string.length;
+      var line = string.slice(pos, string.charAt(nl - 1) == "\r" ? nl - 1 : nl);
+      var rt = line.indexOf("\r");
+      if (rt != -1) {
+        result.push(line.slice(0, rt));
+        pos += rt + 1;
+      } else {
+        result.push(line);
+        pos = nl + 1;
+      }
+    }
+    return result;
+  } : function(string){return string.split(/\r\n?|\n/);};
+  CodeMirror.splitLines = splitLines;
+
+  var hasSelection = window.getSelection ? function(te) {
+    try { return te.selectionStart != te.selectionEnd; }
+    catch(e) { return false; }
+  } : function(te) {
+    try {var range = te.ownerDocument.selection.createRange();}
+    catch(e) {}
+    if (!range || range.parentElement() != te) return false;
+    return range.compareEndPoints("StartToEnd", range) != 0;
+  };
+
+  CodeMirror.defineMode("null", function() {
+    return {token: function(stream) {stream.skipToEnd();}};
+  });
+  CodeMirror.defineMIME("text/plain", "null");
+
+  var keyNames = {3: "Enter", 8: "Backspace", 9: "Tab", 13: "Enter", 16: "Shift", 17: "Ctrl", 18: "Alt",
+                  19: "Pause", 20: "CapsLock", 27: "Esc", 32: "Space", 33: "PageUp", 34: "PageDown", 35: "End",
+                  36: "Home", 37: "Left", 38: "Up", 39: "Right", 40: "Down", 44: "PrintScrn", 45: "Insert",
+                  46: "Delete", 59: ";", 91: "Mod", 92: "Mod", 93: "Mod", 109: "-", 107: "=", 127: "Delete",
+                  186: ";", 187: "=", 188: ",", 189: "-", 190: ".", 191: "/", 192: "`", 219: "[", 220: "\\",
+                  221: "]", 222: "'", 63276: "PageUp", 63277: "PageDown", 63275: "End", 63273: "Home",
+                  63234: "Left", 63232: "Up", 63235: "Right", 63233: "Down", 63302: "Insert", 63272: "Delete"};
+  CodeMirror.keyNames = keyNames;
+  (function() {
+    // Number keys
+    for (var i = 0; i < 10; i++) keyNames[i + 48] = String(i);
+    // Alphabetic keys
+    for (var i = 65; i <= 90; i++) keyNames[i] = String.fromCharCode(i);
+    // Function keys
+    for (var i = 1; i <= 12; i++) keyNames[i + 111] = keyNames[i + 63235] = "F" + i;
+  })();
+
+  return CodeMirror;
+})();
diff --git a/Source/WebCore/inspector/front-end/cm/css.js b/Source/WebCore/inspector/front-end/cm/css.js
new file mode 100644
index 000000000..6bb3bcd19
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/cm/css.js
@@ -0,0 +1,174 @@
+CodeMirror.defineMode("css", function(config) {
+  var indentUnit = config.indentUnit, type;
+
+  var keywords = keySet(["above", "absolute", "activeborder", "activecaption", "afar", "after-white-space", "ahead", "alias", "all", "all-scroll",
+    "alternate", "always", "amharic", "amharic-abegede", "antialiased", "appworkspace", "arabic-indic", "armenian", "asterisks",
+    "auto", "avoid", "background", "backwards", "baseline", "below", "bidi-override", "binary", "bengali", "blink",
+    "block", "block-axis", "bold", "bolder", "border", "border-box", "both", "bottom", "break-all", "break-word", "button",
+    "button-bevel", "buttonface", "buttonhighlight", "buttonshadow", "buttontext", "cambodian", "capitalize", "caps-lock-indicator",
+    "caption", "captiontext", "caret", "cell", "center", "checkbox", "circle", "cjk-earthly-branch", "cjk-heavenly-stem", "cjk-ideographic",
+    "clear", "clip", "close-quote", "col-resize", "collapse", "compact", "condensed", "contain", "content", "content-box", "context-menu",
+    "continuous", "copy", "cover", "crop", "cross", "crosshair", "currentcolor", "cursive", "dashed", "decimal", "decimal-leading-zero", "default",
+    "default-button", "destination-atop", "destination-in", "destination-out", "destination-over", "devanagari", "disc", "discard", "document",
+    "dot-dash", "dot-dot-dash", "dotted", "double", "down", "e-resize", "ease", "ease-in", "ease-in-out", "ease-out", "element",
+    "ellipsis", "embed", "end", "ethiopic", "ethiopic-abegede", "ethiopic-abegede-am-et", "ethiopic-abegede-gez",
+    "ethiopic-abegede-ti-er", "ethiopic-abegede-ti-et", "ethiopic-halehame-aa-er", "ethiopic-halehame-aa-et",
+    "ethiopic-halehame-am-et", "ethiopic-halehame-gez", "ethiopic-halehame-om-et", "ethiopic-halehame-sid-et",
+    "ethiopic-halehame-so-et", "ethiopic-halehame-ti-er", "ethiopic-halehame-ti-et", "ethiopic-halehame-tig", "ew-resize", "expanded",
+    "extra-condensed", "extra-expanded", "fantasy", "fast", "fill", "fixed", "flat", "footnotes", "forwards", "from", "geometricPrecision",
+    "georgian", "graytext", "groove", "gujarati", "gurmukhi", "hand", "hangul", "hangul-consonant", "hebrew", "help",
+    "hidden", "hide", "higher", "highlight", "highlighttext", "hiragana", "hiragana-iroha", "horizontal", "hsl", "hsla", "icon", "ignore",
+    "inactiveborder", "inactivecaption", "inactivecaptiontext", "infinite", "infobackground", "infotext", "inherit", "initial", "inline",
+    "inline-axis", "inline-block", "inline-table", "inset", "inside", "intrinsic", "invert", "italic", "justify", "kannada", "katakana",
+    "katakana-iroha", "khmer", "landscape", "lao", "large", "larger", "left", "level", "lighter", "line-through", "linear", "lines",
+    "list-item", "listbox", "listitem", "local", "logical", "loud", "lower", "lower-alpha", "lower-armenian", "lower-greek",
+    "lower-hexadecimal", "lower-latin", "lower-norwegian", "lower-roman", "lowercase", "ltr", "malayalam", "match", "media-controls-background",
+    "media-current-time-display", "media-fullscreen-button", "media-mute-button", "media-play-button", "media-return-to-realtime-button",
+    "media-rewind-button", "media-seek-back-button", "media-seek-forward-button", "media-slider", "media-sliderthumb", "media-time-remaining-display",
+    "media-volume-slider", "media-volume-slider-container", "media-volume-sliderthumb", "medium", "menu", "menulist", "menulist-button",
+    "menulist-text", "menulist-textfield", "menutext", "message-box", "middle", "min-intrinsic", "mix", "mongolian", "monospace", "move", "multiple",
+    "myanmar", "n-resize", "narrower", "navy", "ne-resize", "nesw-resize", "no-close-quote", "no-drop", "no-open-quote", "no-repeat", "none",
+    "normal", "not-allowed", "nowrap", "ns-resize", "nw-resize", "nwse-resize", "oblique", "octal", "open-quote", "optimizeLegibility",
+    "optimizeSpeed", "oriya", "oromo", "outset", "outside", "overlay", "overline", "padding", "padding-box", "painted", "paused",
+    "persian", "plus-darker", "plus-lighter", "pointer", "portrait", "pre", "pre-line", "pre-wrap", "preserve-3d", "progress",
+    "push-button", "radio", "read-only", "read-write", "read-write-plaintext-only", "relative", "repeat", "repeat-x",
+    "repeat-y", "reset", "reverse", "rgb", "rgba", "ridge", "right", "round", "row-resize", "rtl", "run-in", "running", "s-resize", "sans-serif",
+    "scroll", "scrollbar", "se-resize", "searchfield", "searchfield-cancel-button", "searchfield-decoration", "searchfield-results-button",
+    "searchfield-results-decoration", "semi-condensed", "semi-expanded", "separate", "serif", "show", "sidama", "single",
+    "skip-white-space", "slide", "slider-horizontal", "slider-vertical", "sliderthumb-horizontal", "sliderthumb-vertical", "slow",
+    "small", "small-caps", "small-caption", "smaller", "solid", "somali", "source-atop", "source-in", "source-out", "source-over",
+    "space", "square", "square-button", "start", "static", "status-bar", "stretch", "stroke", "sub", "subpixel-antialiased", "super",
+    "sw-resize", "table", "table-caption", "table-cell", "table-column", "table-column-group", "table-footer-group", "table-header-group",
+    "table-row", "table-row-group", "telugu", "text", "text-bottom", "text-top", "textarea", "textfield", "thai", "thick", "thin",
+    "threeddarkshadow", "threedface", "threedhighlight", "threedlightshadow", "threedshadow", "tibetan", "tigre", "tigrinya-er", "tigrinya-er-abegede",
+    "tigrinya-et", "tigrinya-et-abegede", "to", "top", "transparent", "ultra-condensed", "ultra-expanded", "underline", "up", "upper-alpha", "upper-armenian",
+    "upper-greek", "upper-hexadecimal", "upper-latin", "upper-norwegian", "upper-roman", "uppercase", "urdu", "url", "vertical", "vertical-text", "visible",
+    "visibleFill", "visiblePainted", "visibleStroke", "visual", "w-resize", "wait", "wave", "white", "wider", "window", "windowframe", "windowtext",
+    "x-large", "x-small", "xor", "xx-large", "xx-small", "yellow", "-wap-marquee", "-webkit-activelink", "-webkit-auto", "-webkit-baseline-middle",
+    "-webkit-body", "-webkit-box", "-webkit-center", "-webkit-control", "-webkit-focus-ring-color", "-webkit-grab", "-webkit-grabbing",
+    "-webkit-gradient", "-webkit-inline-box", "-webkit-left", "-webkit-link", "-webkit-marquee", "-webkit-mini-control", "-webkit-nowrap", "-webkit-pictograph",
+    "-webkit-right", "-webkit-small-control", "-webkit-text", "-webkit-xxx-large", "-webkit-zoom-in", "-webkit-zoom-out"]);
+
+  function keySet(array) { var keys = {}; for (var i = 0; i < array.length; ++i) keys[array[i]] = true; return keys; }
+  function ret(style, tp) {type = tp; return style;}
+
+  function tokenBase(stream, state) {
+    var ch = stream.next();
+    if (ch == "@") {stream.eatWhile(/[\w\\\-]/); return ret("meta", stream.current());}
+    else if (ch == "/" && stream.eat("*")) {
+      state.tokenize = tokenCComment;
+      return tokenCComment(stream, state);
+    }
+    else if (ch == "<" && stream.eat("!")) {
+      state.tokenize = tokenSGMLComment;
+      return tokenSGMLComment(stream, state);
+    }
+    else if (ch == "=") ret(null, "compare");
+    else if ((ch == "~" || ch == "|") && stream.eat("=")) return ret(null, "compare");
+    else if (ch == "\"" || ch == "'") {
+      state.tokenize = tokenString(ch);
+      return state.tokenize(stream, state);
+    }
+    else if (ch == "#") {
+      stream.eatWhile(/[\w\\\-]/);
+      return ret("atom", "hash");
+    }
+    else if (ch == "!") {
+      stream.match(/^\s*\w*/);
+      return ret("keyword", "important");
+    }
+    else if (/\d/.test(ch)) {
+      stream.eatWhile(/[\w.%]/);
+      return ret("number", "unit");
+    }
+    else if (/[,.+>*\/]/.test(ch)) {
+      return ret(null, "select-op");
+    }
+    else if (/[;{}:\[\]]/.test(ch)) {
+      return ret(null, ch);
+    }
+    else {
+      stream.eatWhile(/[\w\\\-]/);
+      return ret("variable", "variable");
+    }
+  }
+
+  function tokenCComment(stream, state) {
+    var maybeEnd = false, ch;
+    while ((ch = stream.next()) != null) {
+      if (maybeEnd && ch == "/") {
+        state.tokenize = tokenBase;
+        break;
+      }
+      maybeEnd = (ch == "*");
+    }
+    return ret("comment", "comment");
+  }
+
+  function tokenSGMLComment(stream, state) {
+    var dashes = 0, ch;
+    while ((ch = stream.next()) != null) {
+      if (dashes >= 2 && ch == ">") {
+        state.tokenize = tokenBase;
+        break;
+      }
+      dashes = (ch == "-") ? dashes + 1 : 0;
+    }
+    return ret("comment", "comment");
+  }
+
+  function tokenString(quote) {
+    return function(stream, state) {
+      var escaped = false, ch;
+      while ((ch = stream.next()) != null) {
+        if (ch == quote && !escaped)
+          break;
+        escaped = !escaped && ch == "\\";
+      }
+      if (!escaped) state.tokenize = tokenBase;
+      return ret("string", "string");
+    };
+  }
+
+  return {
+    startState: function(base) {
+      return {tokenize: tokenBase,
+              baseIndent: base || 0,
+              stack: []};
+    },
+
+    token: function(stream, state) {
+      if (stream.eatSpace()) return null;
+      var style = state.tokenize(stream, state);
+
+      var context = state.stack[state.stack.length-1];
+      if (type == "hash" && context != "rule") style = "string-2";
+      else if (style == "variable") {
+        if (context == "rule") style = keywords[stream.current()] ? "keyword" : "number";
+        else if (!context || context == "@media{") style = "tag";
+      }
+
+      if (context == "rule" && /^[\{\};]$/.test(type))
+        state.stack.pop();
+      if (type == "{") {
+        if (context == "@media") state.stack[state.stack.length-1] = "@media{";
+        else state.stack.push("{");
+      }
+      else if (type == "}") state.stack.pop();
+      else if (type == "@media") state.stack.push("@media");
+      else if (context == "{" && type != "comment") state.stack.push("rule");
+      return style;
+    },
+
+    indent: function(state, textAfter) {
+      var n = state.stack.length;
+      if (/^\}/.test(textAfter))
+        n -= state.stack[state.stack.length-1] == "rule" ? 2 : 1;
+      return state.baseIndent + n * indentUnit;
+    },
+
+    electricChars: "}"
+  };
+});
+
+CodeMirror.defineMIME("text/css", "css");
diff --git a/Source/WebCore/inspector/front-end/cm/htmlmixed.js b/Source/WebCore/inspector/front-end/cm/htmlmixed.js
new file mode 100644
index 000000000..c47caa717
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/cm/htmlmixed.js
@@ -0,0 +1,85 @@
+CodeMirror.defineMode("htmlmixed", function(config, parserConfig) {
+  var htmlMode = CodeMirror.getMode(config, {name: "xml", htmlMode: true});
+  var jsMode = CodeMirror.getMode(config, "javascript");
+  var cssMode = CodeMirror.getMode(config, "css");
+
+  function html(stream, state) {
+    var style = htmlMode.token(stream, state.htmlState);
+    if (style == "tag" && stream.current() == ">" && state.htmlState.context) {
+      if (/^script$/i.test(state.htmlState.context.tagName)) {
+        state.token = javascript;
+        state.localState = jsMode.startState(htmlMode.indent(state.htmlState, ""));
+        state.mode = "javascript";
+      }
+      else if (/^style$/i.test(state.htmlState.context.tagName)) {
+        state.token = css;
+        state.localState = cssMode.startState(htmlMode.indent(state.htmlState, ""));
+        state.mode = "css";
+      }
+    }
+    return style;
+  }
+  function maybeBackup(stream, pat, style) {
+    var cur = stream.current();
+    var close = cur.search(pat);
+    if (close > -1) stream.backUp(cur.length - close);
+    return style;
+  }
+  function javascript(stream, state) {
+    if (stream.match(/^<\/\s*script\s*>/i, false)) {
+      state.token = html;
+      state.localState = null;
+      state.mode = "html";
+      return html(stream, state);
+    }
+    return maybeBackup(stream, /<\/\s*script\s*>/,
+                       jsMode.token(stream, state.localState));
+  }
+  function css(stream, state) {
+    if (stream.match(/^<\/\s*style\s*>/i, false)) {
+      state.token = html;
+      state.localState = null;
+      state.mode = "html";
+      return html(stream, state);
+    }
+    return maybeBackup(stream, /<\/\s*style\s*>/,
+                       cssMode.token(stream, state.localState));
+  }
+
+  return {
+    startState: function() {
+      var state = htmlMode.startState();
+      return {token: html, localState: null, mode: "html", htmlState: state};
+    },
+
+    copyState: function(state) {
+      if (state.localState)
+        var local = CodeMirror.copyState(state.token == css ? cssMode : jsMode, state.localState);
+      return {token: state.token, localState: local, mode: state.mode,
+              htmlState: CodeMirror.copyState(htmlMode, state.htmlState)};
+    },
+
+    token: function(stream, state) {
+      return state.token(stream, state);
+    },
+
+    indent: function(state, textAfter) {
+      if (state.token == html || /^\s*<\//.test(textAfter))
+        return htmlMode.indent(state.htmlState, textAfter);
+      else if (state.token == javascript)
+        return jsMode.indent(state.localState, textAfter);
+      else
+        return cssMode.indent(state.localState, textAfter);
+    },
+
+    compareStates: function(a, b) {
+      if (a.mode != b.mode) return false;
+      if (a.localState) return CodeMirror.Pass;
+      return htmlMode.compareStates(a.htmlState, b.htmlState);
+    },
+
+    electricChars: "/{}:"
+  };
+}, "xml", "javascript", "css");
+
+CodeMirror.defineMIME("text/html", "htmlmixed");
diff --git a/Source/WebCore/inspector/front-end/cm/javascript.js b/Source/WebCore/inspector/front-end/cm/javascript.js
new file mode 100644
index 000000000..6ece1befc
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/cm/javascript.js
@@ -0,0 +1,361 @@
+CodeMirror.defineMode("javascript", function(config, parserConfig) {
+  var indentUnit = config.indentUnit;
+  var jsonMode = parserConfig.json;
+
+  // Tokenizer
+
+  var keywords = function(){
+    function kw(type) {return {type: type, style: "keyword"};}
+    var A = kw("keyword a"), B = kw("keyword b"), C = kw("keyword c");
+    var operator = kw("operator"), atom = {type: "atom", style: "atom"};
+    return {
+      "if": A, "while": A, "with": A, "else": B, "do": B, "try": B, "finally": B,
+      "return": C, "break": C, "continue": C, "new": C, "delete": C, "throw": C,
+      "var": kw("var"), "const": kw("var"), "let": kw("var"),
+      "function": kw("function"), "catch": kw("catch"),
+      "for": kw("for"), "switch": kw("switch"), "case": kw("case"), "default": kw("default"),
+      "in": operator, "typeof": operator, "instanceof": operator,
+      "true": atom, "false": atom, "null": atom, "undefined": atom, "NaN": atom, "Infinity": atom
+    };
+  }();
+
+  var isOperatorChar = /[+\-*&%=<>!?|]/;
+
+  function chain(stream, state, f) {
+    state.tokenize = f;
+    return f(stream, state);
+  }
+
+  function nextUntilUnescaped(stream, end) {
+    var escaped = false, next;
+    while ((next = stream.next()) != null) {
+      if (next == end && !escaped)
+        return false;
+      escaped = !escaped && next == "\\";
+    }
+    return escaped;
+  }
+
+  // Used as scratch variables to communicate multiple values without
+  // consing up tons of objects.
+  var type, content;
+  function ret(tp, style, cont) {
+    type = tp; content = cont;
+    return style;
+  }
+
+  function jsTokenBase(stream, state) {
+    var ch = stream.next();
+    if (ch == '"' || ch == "'")
+      return chain(stream, state, jsTokenString(ch));
+    else if (/[\[\]{}\(\),;\:\.]/.test(ch))
+      return ret(ch);
+    else if (ch == "0" && stream.eat(/x/i)) {
+      stream.eatWhile(/[\da-f]/i);
+      return ret("number", "number");
+    }      
+    else if (/\d/.test(ch) || ch == "-" && stream.eat(/\d/)) {
+      stream.match(/^\d*(?:\.\d*)?(?:[eE][+\-]?\d+)?/);
+      return ret("number", "number");
+    }
+    else if (ch == "/") {
+      if (stream.eat("*")) {
+        return chain(stream, state, jsTokenComment);
+      }
+      else if (stream.eat("/")) {
+        stream.skipToEnd();
+        return ret("comment", "comment");
+      }
+      else if (state.reAllowed) {
+        nextUntilUnescaped(stream, "/");
+        stream.eatWhile(/[gimy]/); // 'y' is "sticky" option in Mozilla
+        return ret("regexp", "string-2");
+      }
+      else {
+        stream.eatWhile(isOperatorChar);
+        return ret("operator", null, stream.current());
+      }
+    }
+    else if (ch == "#") {
+        stream.skipToEnd();
+        return ret("error", "error");
+    }
+    else if (isOperatorChar.test(ch)) {
+      stream.eatWhile(isOperatorChar);
+      return ret("operator", null, stream.current());
+    }
+    else {
+      stream.eatWhile(/[\w\$_]/);
+      var word = stream.current(), known = keywords.propertyIsEnumerable(word) && keywords[word];
+      return (known && state.kwAllowed) ? ret(known.type, known.style, word) :
+                     ret("variable", "variable", word);
+    }
+  }
+
+  function jsTokenString(quote) {
+    return function(stream, state) {
+      if (!nextUntilUnescaped(stream, quote))
+        state.tokenize = jsTokenBase;
+      return ret("string", "string");
+    };
+  }
+
+  function jsTokenComment(stream, state) {
+    var maybeEnd = false, ch;
+    while (ch = stream.next()) {
+      if (ch == "/" && maybeEnd) {
+        state.tokenize = jsTokenBase;
+        break;
+      }
+      maybeEnd = (ch == "*");
+    }
+    return ret("comment", "comment");
+  }
+
+  // Parser
+
+  var atomicTypes = {"atom": true, "number": true, "variable": true, "string": true, "regexp": true};
+
+  function JSLexical(indented, column, type, align, prev, info) {
+    this.indented = indented;
+    this.column = column;
+    this.type = type;
+    this.prev = prev;
+    this.info = info;
+    if (align != null) this.align = align;
+  }
+
+  function inScope(state, varname) {
+    for (var v = state.localVars; v; v = v.next)
+      if (v.name == varname) return true;
+  }
+
+  function parseJS(state, style, type, content, stream) {
+    var cc = state.cc;
+    // Communicate our context to the combinators.
+    // (Less wasteful than consing up a hundred closures on every call.)
+    cx.state = state; cx.stream = stream; cx.marked = null, cx.cc = cc;
+  
+    if (!state.lexical.hasOwnProperty("align"))
+      state.lexical.align = true;
+
+    while(true) {
+      var combinator = cc.length ? cc.pop() : jsonMode ? expression : statement;
+      if (combinator(type, content)) {
+        while(cc.length && cc[cc.length - 1].lex)
+          cc.pop()();
+        if (cx.marked) return cx.marked;
+        if (type == "variable" && inScope(state, content)) return "variable-2";
+        return style;
+      }
+    }
+  }
+
+  // Combinator utils
+
+  var cx = {state: null, column: null, marked: null, cc: null};
+  function pass() {
+    for (var i = arguments.length - 1; i >= 0; i--) cx.cc.push(arguments[i]);
+  }
+  function cont() {
+    pass.apply(null, arguments);
+    return true;
+  }
+  function register(varname) {
+    var state = cx.state;
+    if (state.context) {
+      cx.marked = "def";
+      for (var v = state.localVars; v; v = v.next)
+        if (v.name == varname) return;
+      state.localVars = {name: varname, next: state.localVars};
+    }
+  }
+
+  // Combinators
+
+  var defaultVars = {name: "this", next: {name: "arguments"}};
+  function pushcontext() {
+    if (!cx.state.context) cx.state.localVars = defaultVars;
+    cx.state.context = {prev: cx.state.context, vars: cx.state.localVars};
+  }
+  function popcontext() {
+    cx.state.localVars = cx.state.context.vars;
+    cx.state.context = cx.state.context.prev;
+  }
+  function pushlex(type, info) {
+    var result = function() {
+      var state = cx.state;
+      state.lexical = new JSLexical(state.indented, cx.stream.column(), type, null, state.lexical, info);
+    };
+    result.lex = true;
+    return result;
+  }
+  function poplex() {
+    var state = cx.state;
+    if (state.lexical.prev) {
+      if (state.lexical.type == ")")
+        state.indented = state.lexical.indented;
+      state.lexical = state.lexical.prev;
+    }
+  }
+  poplex.lex = true;
+
+  function expect(wanted) {
+    return function expecting(type) {
+      if (type == wanted) return cont();
+      else if (wanted == ";") return pass();
+      else return cont(arguments.callee);
+    };
+  }
+
+  function statement(type) {
+    if (type == "var") return cont(pushlex("vardef"), vardef1, expect(";"), poplex);
+    if (type == "keyword a") return cont(pushlex("form"), expression, statement, poplex);
+    if (type == "keyword b") return cont(pushlex("form"), statement, poplex);
+    if (type == "{") return cont(pushlex("}"), block, poplex);
+    if (type == ";") return cont();
+    if (type == "function") return cont(functiondef);
+    if (type == "for") return cont(pushlex("form"), expect("("), pushlex(")"), forspec1, expect(")"),
+                                      poplex, statement, poplex);
+    if (type == "variable") return cont(pushlex("stat"), maybelabel);
+    if (type == "switch") return cont(pushlex("form"), expression, pushlex("}", "switch"), expect("{"),
+                                         block, poplex, poplex);
+    if (type == "case") return cont(expression, expect(":"));
+    if (type == "default") return cont(expect(":"));
+    if (type == "catch") return cont(pushlex("form"), pushcontext, expect("("), funarg, expect(")"),
+                                        statement, poplex, popcontext);
+    return pass(pushlex("stat"), expression, expect(";"), poplex);
+  }
+  function expression(type) {
+    if (atomicTypes.hasOwnProperty(type)) return cont(maybeoperator);
+    if (type == "function") return cont(functiondef);
+    if (type == "keyword c") return cont(maybeexpression);
+    if (type == "(") return cont(pushlex(")"), maybeexpression, expect(")"), poplex, maybeoperator);
+    if (type == "operator") return cont(expression);
+    if (type == "[") return cont(pushlex("]"), commasep(expression, "]"), poplex, maybeoperator);
+    if (type == "{") return cont(pushlex("}"), commasep(objprop, "}"), poplex, maybeoperator);
+    return cont();
+  }
+  function maybeexpression(type) {
+    if (type.match(/[;\}\)\],]/)) return pass();
+    return pass(expression);
+  }
+    
+  function maybeoperator(type, value) {
+    if (type == "operator" && /\+\+|--/.test(value)) return cont(maybeoperator);
+    if (type == "operator" && value == "?") return cont(expression, expect(":"), expression);
+    if (type == ";") return;
+    if (type == "(") return cont(pushlex(")"), commasep(expression, ")"), poplex, maybeoperator);
+    if (type == ".") return cont(property, maybeoperator);
+    if (type == "[") return cont(pushlex("]"), expression, expect("]"), poplex, maybeoperator);
+  }
+  function maybelabel(type) {
+    if (type == ":") return cont(poplex, statement);
+    return pass(maybeoperator, expect(";"), poplex);
+  }
+  function property(type) {
+    if (type == "variable") {cx.marked = "property"; return cont();}
+  }
+  function objprop(type) {
+    if (type == "variable") cx.marked = "property";
+    if (atomicTypes.hasOwnProperty(type)) return cont(expect(":"), expression);
+  }
+  function commasep(what, end) {
+    function proceed(type) {
+      if (type == ",") return cont(what, proceed);
+      if (type == end) return cont();
+      return cont(expect(end));
+    }
+    return function commaSeparated(type) {
+      if (type == end) return cont();
+      else return pass(what, proceed);
+    };
+  }
+  function block(type) {
+    if (type == "}") return cont();
+    return pass(statement, block);
+  }
+  function vardef1(type, value) {
+    if (type == "variable"){register(value); return cont(vardef2);}
+    return cont();
+  }
+  function vardef2(type, value) {
+    if (value == "=") return cont(expression, vardef2);
+    if (type == ",") return cont(vardef1);
+  }
+  function forspec1(type) {
+    if (type == "var") return cont(vardef1, forspec2);
+    if (type == ";") return pass(forspec2);
+    if (type == "variable") return cont(formaybein);
+    return pass(forspec2);
+  }
+  function formaybein(type, value) {
+    if (value == "in") return cont(expression);
+    return cont(maybeoperator, forspec2);
+  }
+  function forspec2(type, value) {
+    if (type == ";") return cont(forspec3);
+    if (value == "in") return cont(expression);
+    return cont(expression, expect(";"), forspec3);
+  }
+  function forspec3(type) {
+    if (type != ")") cont(expression);
+  }
+  function functiondef(type, value) {
+    if (type == "variable") {register(value); return cont(functiondef);}
+    if (type == "(") return cont(pushlex(")"), pushcontext, commasep(funarg, ")"), poplex, statement, popcontext);
+  }
+  function funarg(type, value) {
+    if (type == "variable") {register(value); return cont();}
+  }
+
+  // Interface
+
+  return {
+    startState: function(basecolumn) {
+      return {
+        tokenize: jsTokenBase,
+        reAllowed: true,
+        kwAllowed: true,
+        cc: [],
+        lexical: new JSLexical((basecolumn || 0) - indentUnit, 0, "block", false),
+        localVars: parserConfig.localVars,
+        context: parserConfig.localVars && {vars: parserConfig.localVars},
+        indented: 0
+      };
+    },
+
+    token: function(stream, state) {
+      if (stream.sol()) {
+        if (!state.lexical.hasOwnProperty("align"))
+          state.lexical.align = false;
+        state.indented = stream.indentation();
+      }
+      if (stream.eatSpace()) return null;
+      var style = state.tokenize(stream, state);
+      if (type == "comment") return style;
+      state.reAllowed = !!(type == "operator" || type == "keyword c" || type.match(/^[\[{}\(,;:]$/));
+      state.kwAllowed = type != '.';
+      return parseJS(state, style, type, content, stream);
+    },
+
+    indent: function(state, textAfter) {
+      if (state.tokenize != jsTokenBase) return 0;
+      var firstChar = textAfter && textAfter.charAt(0), lexical = state.lexical;
+      if (lexical.type == "stat" && firstChar == "}") lexical = lexical.prev;
+      var type = lexical.type, closing = firstChar == type;
+      if (type == "vardef") return lexical.indented + 4;
+      else if (type == "form" && firstChar == "{") return lexical.indented;
+      else if (type == "stat" || type == "form") return lexical.indented + indentUnit;
+      else if (lexical.info == "switch" && !closing)
+        return lexical.indented + (/^(?:case|default)\b/.test(textAfter) ? indentUnit : 2 * indentUnit);
+      else if (lexical.align) return lexical.column + (closing ? 0 : 1);
+      else return lexical.indented + (closing ? 0 : indentUnit);
+    },
+
+    electricChars: ":{}"
+  };
+});
+
+CodeMirror.defineMIME("text/javascript", "javascript");
+CodeMirror.defineMIME("application/json", {name: "javascript", json: true});
diff --git a/Source/WebCore/inspector/front-end/cm/xml.js b/Source/WebCore/inspector/front-end/cm/xml.js
new file mode 100644
index 000000000..cd69f62fd
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/cm/xml.js
@@ -0,0 +1,326 @@
+CodeMirror.defineMode("xml", function(config, parserConfig) {
+  var indentUnit = config.indentUnit;
+  var Kludges = parserConfig.htmlMode ? {
+    autoSelfClosers: {'area': true, 'base': true, 'br': true, 'col': true, 'command': true,
+                      'embed': true, 'frame': true, 'hr': true, 'img': true, 'input': true,
+                      'keygen': true, 'link': true, 'meta': true, 'param': true, 'source': true,
+                      'track': true, 'wbr': true},
+    implicitlyClosed: {'dd': true, 'li': true, 'optgroup': true, 'option': true, 'p': true,
+                       'rp': true, 'rt': true, 'tbody': true, 'td': true, 'tfoot': true,
+                       'th': true, 'tr': true},
+    contextGrabbers: {
+      'dd': {'dd': true, 'dt': true},
+      'dt': {'dd': true, 'dt': true},
+      'li': {'li': true},
+      'option': {'option': true, 'optgroup': true},
+      'optgroup': {'optgroup': true},
+      'p': {'address': true, 'article': true, 'aside': true, 'blockquote': true, 'dir': true,
+            'div': true, 'dl': true, 'fieldset': true, 'footer': true, 'form': true,
+            'h1': true, 'h2': true, 'h3': true, 'h4': true, 'h5': true, 'h6': true,
+            'header': true, 'hgroup': true, 'hr': true, 'menu': true, 'nav': true, 'ol': true,
+            'p': true, 'pre': true, 'section': true, 'table': true, 'ul': true},
+      'rp': {'rp': true, 'rt': true},
+      'rt': {'rp': true, 'rt': true},
+      'tbody': {'tbody': true, 'tfoot': true},
+      'td': {'td': true, 'th': true},
+      'tfoot': {'tbody': true},
+      'th': {'td': true, 'th': true},
+      'thead': {'tbody': true, 'tfoot': true},
+      'tr': {'tr': true}
+    },
+    doNotIndent: {"pre": true},
+    allowUnquoted: true,
+    allowMissing: true
+  } : {
+    autoSelfClosers: {},
+    implicitlyClosed: {},
+    contextGrabbers: {},
+    doNotIndent: {},
+    allowUnquoted: false,
+    allowMissing: false
+  };
+  var alignCDATA = parserConfig.alignCDATA;
+
+  // Return variables for tokenizers
+  var tagName, type;
+
+  function inText(stream, state) {
+    function chain(parser) {
+      state.tokenize = parser;
+      return parser(stream, state);
+    }
+
+    var ch = stream.next();
+    if (ch == "<") {
+      if (stream.eat("!")) {
+        if (stream.eat("[")) {
+          if (stream.match("CDATA[")) return chain(inBlock("atom", "]]>"));
+          else return null;
+        }
+        else if (stream.match("--")) return chain(inBlock("comment", "-->"));
+        else if (stream.match("DOCTYPE", true, true)) {
+          stream.eatWhile(/[\w\._\-]/);
+          return chain(doctype(1));
+        }
+        else return null;
+      }
+      else if (stream.eat("?")) {
+        stream.eatWhile(/[\w\._\-]/);
+        state.tokenize = inBlock("meta", "?>");
+        return "meta";
+      }
+      else {
+        type = stream.eat("/") ? "closeTag" : "openTag";
+        stream.eatSpace();
+        tagName = "";
+        var c;
+        while ((c = stream.eat(/[^\s\u00a0=<>\"\'\/?]/))) tagName += c;
+        state.tokenize = inTag;
+        return "tag";
+      }
+    }
+    else if (ch == "&") {
+      var ok;
+      if (stream.eat("#")) {
+        if (stream.eat("x")) {
+          ok = stream.eatWhile(/[a-fA-F\d]/) && stream.eat(";");          
+        } else {
+          ok = stream.eatWhile(/[\d]/) && stream.eat(";");
+        }
+      } else {
+        ok = stream.eatWhile(/[\w\.\-:]/) && stream.eat(";");
+      }
+      return ok ? "atom" : "error";
+    }
+    else {
+      stream.eatWhile(/[^&<]/);
+      return null;
+    }
+  }
+
+  function inTag(stream, state) {
+    var ch = stream.next();
+    if (ch == ">" || (ch == "/" && stream.eat(">"))) {
+      state.tokenize = inText;
+      type = ch == ">" ? "endTag" : "selfcloseTag";
+      return "tag";
+    }
+    else if (ch == "=") {
+      type = "equals";
+      return null;
+    }
+    else if (/[\'\"]/.test(ch)) {
+      state.tokenize = inAttribute(ch);
+      return state.tokenize(stream, state);
+    }
+    else {
+      stream.eatWhile(/[^\s\u00a0=<>\"\'\/?]/);
+      return "word";
+    }
+  }
+
+  function inAttribute(quote) {
+    return function(stream, state) {
+      while (!stream.eol()) {
+        if (stream.next() == quote) {
+          state.tokenize = inTag;
+          break;
+        }
+      }
+      return "string";
+    };
+  }
+
+  function inBlock(style, terminator) {
+    return function(stream, state) {
+      while (!stream.eol()) {
+        if (stream.match(terminator)) {
+          state.tokenize = inText;
+          break;
+        }
+        stream.next();
+      }
+      return style;
+    };
+  }
+  function doctype(depth) {
+    return function(stream, state) {
+      var ch;
+      while ((ch = stream.next()) != null) {
+        if (ch == "<") {
+          state.tokenize = doctype(depth + 1);
+          return state.tokenize(stream, state);
+        } else if (ch == ">") {
+          if (depth == 1) {
+            state.tokenize = inText;
+            break;
+          } else {
+            state.tokenize = doctype(depth - 1);
+            return state.tokenize(stream, state);
+          }
+        }
+      }
+      return "meta";
+    };
+  }
+
+  var curState, setStyle;
+  function pass() {
+    for (var i = arguments.length - 1; i >= 0; i--) curState.cc.push(arguments[i]);
+  }
+  function cont() {
+    pass.apply(null, arguments);
+    return true;
+  }
+
+  function pushContext(tagName, startOfLine) {
+    var noIndent = Kludges.doNotIndent.hasOwnProperty(tagName) || (curState.context && curState.context.noIndent);
+    curState.context = {
+      prev: curState.context,
+      tagName: tagName,
+      indent: curState.indented,
+      startOfLine: startOfLine,
+      noIndent: noIndent
+    };
+  }
+  function popContext() {
+    if (curState.context) curState.context = curState.context.prev;
+  }
+
+  function element(type) {
+    if (type == "openTag") {
+      curState.tagName = tagName;
+      return cont(attributes, endtag(curState.startOfLine));
+    } else if (type == "closeTag") {
+      var err = false;
+      if (curState.context) {
+        if (curState.context.tagName != tagName) {
+          if (Kludges.implicitlyClosed.hasOwnProperty(curState.context.tagName.toLowerCase())) {
+            popContext();
+          }
+          err = !curState.context || curState.context.tagName != tagName;
+        }
+      } else {
+        err = true;
+      }
+      if (err) setStyle = "error";
+      return cont(endclosetag(err));
+    }
+    return cont();
+  }
+  function endtag(startOfLine) {
+    return function(type) {
+      if (type == "selfcloseTag" ||
+          (type == "endTag" && Kludges.autoSelfClosers.hasOwnProperty(curState.tagName.toLowerCase()))) {
+        maybePopContext(curState.tagName.toLowerCase());
+        return cont();
+      }
+      if (type == "endTag") {
+        maybePopContext(curState.tagName.toLowerCase());
+        pushContext(curState.tagName, startOfLine);
+        return cont();
+      }
+      return cont();
+    };
+  }
+  function endclosetag(err) {
+    return function(type) {
+      if (err) setStyle = "error";
+      if (type == "endTag") { popContext(); return cont(); }
+      setStyle = "error";
+      return cont(arguments.callee);
+    };
+  }
+  function maybePopContext(nextTagName) {
+    var parentTagName;
+    while (true) {
+      if (!curState.context) {
+        return;
+      }
+      parentTagName = curState.context.tagName.toLowerCase();
+      if (!Kludges.contextGrabbers.hasOwnProperty(parentTagName) ||
+          !Kludges.contextGrabbers[parentTagName].hasOwnProperty(nextTagName)) {
+        return;
+      }
+      popContext();
+    }
+  }
+
+  function attributes(type) {
+    if (type == "word") {setStyle = "attribute"; return cont(attribute, attributes);}
+    if (type == "endTag" || type == "selfcloseTag") return pass();
+    setStyle = "error";
+    return cont(attributes);
+  }
+  function attribute(type) {
+    if (type == "equals") return cont(attvalue, attributes);
+    if (!Kludges.allowMissing) setStyle = "error";
+    return (type == "endTag" || type == "selfcloseTag") ? pass() : cont();
+  }
+  function attvalue(type) {
+    if (type == "string") return cont(attvaluemaybe);
+    if (type == "word" && Kludges.allowUnquoted) {setStyle = "string"; return cont();}
+    setStyle = "error";
+    return (type == "endTag" || type == "selfCloseTag") ? pass() : cont();
+  }
+  function attvaluemaybe(type) {
+    if (type == "string") return cont(attvaluemaybe);
+    else return pass();
+  }
+
+  return {
+    startState: function() {
+      return {tokenize: inText, cc: [], indented: 0, startOfLine: true, tagName: null, context: null};
+    },
+
+    token: function(stream, state) {
+      if (stream.sol()) {
+        state.startOfLine = true;
+        state.indented = stream.indentation();
+      }
+      if (stream.eatSpace()) return null;
+
+      setStyle = type = tagName = null;
+      var style = state.tokenize(stream, state);
+      state.type = type;
+      if ((style || type) && style != "comment") {
+        curState = state;
+        while (true) {
+          var comb = state.cc.pop() || element;
+          if (comb(type || style)) break;
+        }
+      }
+      state.startOfLine = false;
+      return setStyle || style;
+    },
+
+    indent: function(state, textAfter, fullLine) {
+      var context = state.context;
+      if ((state.tokenize != inTag && state.tokenize != inText) ||
+          context && context.noIndent)
+        return fullLine ? fullLine.match(/^(\s*)/)[0].length : 0;
+      if (alignCDATA && /<!\[CDATA\[/.test(textAfter)) return 0;
+      if (context && /^<\//.test(textAfter))
+        context = context.prev;
+      while (context && !context.startOfLine)
+        context = context.prev;
+      if (context) return context.indent + indentUnit;
+      else return 0;
+    },
+
+    compareStates: function(a, b) {
+      if (a.indented != b.indented || a.tokenize != b.tokenize) return false;
+      for (var ca = a.context, cb = b.context; ; ca = ca.prev, cb = cb.prev) {
+        if (!ca || !cb) return ca == cb;
+        if (ca.tagName != cb.tagName || ca.indent != cb.indent) return false;
+      }
+    },
+
+    electricChars: "/"
+  };
+});
+
+CodeMirror.defineMIME("text/xml", "xml");
+CodeMirror.defineMIME("application/xml", "xml");
+if (!CodeMirror.mimeModes.hasOwnProperty("text/html"))
+  CodeMirror.defineMIME("text/html", {name: "xml", htmlMode: true});
diff --git a/Source/WebCore/inspector/front-end/cmdevtools.css b/Source/WebCore/inspector/front-end/cmdevtools.css
new file mode 100644
index 000000000..9f330b15c
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/cmdevtools.css
@@ -0,0 +1,28 @@
+.CodeMirror-scroll {
+  height: 100% !important;
+}
+
+.CodeMirror {
+  line-height: 1.2em !important;
+}
+
+.cm-s-web-inspector-js span.cm-keyword {color: rgb(170, 13, 145);}
+.cm-s-web-inspector-js span.cm-number {color: rgb(28, 0, 207);}
+.cm-s-web-inspector-js span.cm-comment {color: rgb(0, 116, 0);}
+.cm-s-web-inspector-js span.cm-string {color: rgb(196, 26, 22);}
+.cm-s-web-inspector-js span.cm-string-2 {color: rgb(196, 26, 22);}
+
+.cm-s-web-inspector-css span.cm-keyword { color: rgb(7, 144, 154);}
+.cm-s-web-inspector-css span.cm-number {color: rgb(50, 0, 255);}
+.cm-s-web-inspector-css span.cm-comment {color: rgb(0, 116, 0);}
+.cm-s-web-inspector-css span.cm-string {color: rgb(7, 144, 154);}
+.cm-s-web-inspector-css span.cm-string-2 {color: rgb(7, 144, 154);}
+.cm-s-web-inspector-css span.cm-link {color: rgb(7, 144, 154);}
+.cm-s-web-inspector-css span.cm-variable {color: rgb(200, 0, 0);}
+
+.cm-s-web-inspector-html span.cm-meta {color: rgb(192, 192, 192);}
+.cm-s-web-inspector-html span.cm-comment {color: rgb(35, 110, 37);}
+.cm-s-web-inspector-html span.cm-string {color: rgb(26, 26, 166);}
+.cm-s-web-inspector-html span.cm-tag {color: rgb(136, 18, 128);}
+.cm-s-web-inspector-html span.cm-attribute {color: rgb(153, 69, 0);}
+.cm-s-web-inspector-html span.cm-link {color: #00e;}
diff --git a/Source/WebCore/inspector/front-end/externs.js b/Source/WebCore/inspector/front-end/externs.js
index 3f179751d..4b2f80754 100644
--- a/Source/WebCore/inspector/front-end/externs.js
+++ b/Source/WebCore/inspector/front-end/externs.js
@@ -236,3 +236,6 @@ difflib.stringAsLines = function(text) { return []; }
 /** @constructor */
 difflib.SequenceMatcher = function(baseText, newText) { }
 difflib.SequenceMatcher.prototype.get_opcodes = function() { return []; }
+
+/** @constructor */
+WebInspector.CodeMirrorTextEditor = function(url, delegate) { }
diff --git a/Source/WebCore/inspector/front-end/filteredItemSelectionDialog.css b/Source/WebCore/inspector/front-end/filteredItemSelectionDialog.css
index b6ed580ef..bea008c44 100644
--- a/Source/WebCore/inspector/front-end/filteredItemSelectionDialog.css
+++ b/Source/WebCore/inspector/front-end/filteredItemSelectionDialog.css
@@ -35,7 +35,7 @@
     background-color: rgb(224, 224, 224);
 }
 
-.js-outline-dialog > .container > div.item > span.highlight {
+.js-outline-dialog > .container > div.item span.highlight {
     color: black;
     font-weight: bold;
 }
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index 7d1065c70..2e27c0b4c 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -366,8 +366,9 @@ body.detached.platform-mac-snowleopard #toolbar-dropdown {
 
 .search-results-matches {
     display: inline-block;
-    min-width: 70px;
+    min-width: 50px;
     min-height: 10px;
+    margin-right: 36px;
     text-align: right;
     font-size: 11px;
     padding: 0 4px;
@@ -1025,6 +1026,7 @@ body.platform-linux .monospace, body.platform-linux .source-code {
 .console-group-messages .section .header .title {
     color: black;
     font-weight: normal;
+    line-height: 13px;
 }
 
 .console-group-messages .section .properties li .info {
@@ -1087,6 +1089,15 @@ body.platform-linux .monospace, body.platform-linux .source-code {
     color: rgb(128, 128, 128);
 }
 
+.console-formatted-preview-node,
+.section .console-formatted-node {
+    color: rgb(136, 18, 128);
+}
+
+.console-object-preview {
+    font-style: italic;
+}
+
 .error-message {
     color: red;
 }
@@ -1580,7 +1591,7 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     display: inline;
 }
 
-.section .properties .name, .event-properties .name {
+.section .properties .name, .event-properties .name, .console-formatted-object .name {
     color: rgb(136, 19, 145);
 }
 
@@ -2579,27 +2590,13 @@ body.platform-mac .search-drawer-header input[type="checkbox"].search-config-che
     float:left;
 }
 
-.search-status-bar-progress {
-    height: 11px;
-    width: 100px;
-    float: left;
-}
-
-body:not(.platform-mac) .search-status-bar-progress {
-    margin-top: 7px;
-}
-
-body.platform-mac .search-status-bar-progress {
-    margin-top: 6px;
-}
-
-.search-status-bar-stop-button-item {
+.progress-bar-stop-button-item {
     width: 19px;
     height: 24px;
     overflow: hidden;
 }
 
-.search-status-bar-stop-button .glyph {
+.progress-bar-stop-button .glyph {
     -webkit-mask-position: -96px -48px;
     background-color: rgb(216, 0, 0) !important;
 }
@@ -2876,3 +2873,27 @@ body.platform-mac .search-status-bar-progress {
     font-size: 11px;
     height: auto;
 }
+
+.progress-bar-container {
+    display: -webkit-flex;
+    margin: 0 8px;
+    -webkit-flex: 1 0;
+}
+
+.progress-bar-container span {
+    padding: 6px;
+}
+
+.progress-bar-container progress {
+    margin-top: 7px;
+    -webkit-flex: 1 0;
+}
+
+body.platform-mac .progress-bar-container progress {
+    margin-top: 6px;
+}
+
+.progress-bar-container button.status-bar-item {
+    border-left: none;
+    margin-top: 1px;
+}
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index b4c36e104..70ea41524 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -119,6 +119,8 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ElementsPanel.js"></script>
     <script type="text/javascript" src="NetworkPanel.js"></script>
     <script type="text/javascript" src="TextEditor.js"></script>
+    <script type="text/javascript" src="DefaultTextEditor.js"></script>
+    <script type="text/javascript" src="CodeMirrorTextEditor.js"></script>
     <script type="text/javascript" src="SourceFrame.js"></script>
     <script type="text/javascript" src="UISourceCodeFrame.js"></script>
     <script type="text/javascript" src="ResourceView.js"></script>
@@ -165,6 +167,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="FileContentView.js"></script>
     <script type="text/javascript" src="FileSystemModel.js"></script>
     <script type="text/javascript" src="FileSystemView.js"></script>
+    <script type="text/javascript" src="FileUtils.js"></script>
     <script type="text/javascript" src="FontView.js"></script>
     <script type="text/javascript" src="ImageView.js"></script>
     <script type="text/javascript" src="DatabaseTableView.js"></script>
@@ -223,6 +226,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="SnippetStorage.js"></script>
     <script type="text/javascript" src="ScriptSnippetModel.js"></script>
     <script type="text/javascript" src="StylesPanel.js"></script>
+    <script type="text/javascript" src="ProgressBar.js"></script>
 </head>
 <body class="detached" id="-webkit-web-inspector">
     <div id="toolbar">
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index e4b6dc16d..a39246bb8 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -389,6 +389,12 @@ WebInspector.loaded = function()
 {
     InspectorBackend.loadFromJSONIfNeeded();
 
+    if (WebInspector.WorkerManager.isDedicatedWorkerFrontend()) {
+        // Do not create socket for the worker front-end.
+        WebInspector.doLoadedDone();
+        return;
+    }
+
     var ws;
     if ("ws" in WebInspector.queryParamsObject)
         ws = "ws://" + WebInspector.queryParamsObject.ws;
@@ -431,7 +437,8 @@ WebInspector.doLoadedDone = function()
     ProfilerAgent.hasHeapProfiler(WebInspector._initializeCapability.bind(WebInspector, "heapProfilerPresent", null));
     TimelineAgent.supportsFrameInstrumentation(WebInspector._initializeCapability.bind(WebInspector, "timelineSupportsFrameInstrumentation", null));
     PageAgent.canOverrideDeviceMetrics(WebInspector._initializeCapability.bind(WebInspector, "canOverrideDeviceMetrics", null));
-    PageAgent.canOverrideGeolocation(WebInspector._initializeCapability.bind(WebInspector, "canOverrideGeolocation", WebInspector._doLoadedDoneWithCapabilities.bind(WebInspector)));
+    PageAgent.canOverrideGeolocation(WebInspector._initializeCapability.bind(WebInspector, "canOverrideGeolocation", null));
+    PageAgent.canOverrideDeviceOrientation(WebInspector._initializeCapability.bind(WebInspector, "canOverrideDeviceOrientation", WebInspector._doLoadedDoneWithCapabilities.bind(WebInspector)));
 }
 
 WebInspector._doLoadedDoneWithCapabilities = function()
diff --git a/Source/WebCore/inspector/front-end/utilities.js b/Source/WebCore/inspector/front-end/utilities.js
index 35e0620e9..46898bf31 100644
--- a/Source/WebCore/inspector/front-end/utilities.js
+++ b/Source/WebCore/inspector/front-end/utilities.js
@@ -384,6 +384,22 @@ Object.defineProperty(Array.prototype, "binaryIndexOf",
     }
 });
 
+Object.defineProperty(Array.prototype, "select",
+{
+    /**
+     * @this {Array.<*>}
+     * @param {string} field
+     * @return {Array.<*>}
+     */
+    value: function(field)
+    {
+        var result = new Array(this.length);
+        for (var i = 0; i < this.length; ++i)
+            result[i] = this[i][field];
+        return result;
+    }
+});
+
 /**
  * @param {*} anObject
  * @param {Array.<*>} aList
diff --git a/Source/WebCore/inspector/generate-inspector-protocol-version b/Source/WebCore/inspector/generate-inspector-protocol-version
index 0e5fe3512..e7d633c04 100755
--- a/Source/WebCore/inspector/generate-inspector-protocol-version
+++ b/Source/WebCore/inspector/generate-inspector-protocol-version
@@ -363,7 +363,7 @@ bool supportsInspectorProtocolVersion(const String& version)
         return false;
 
     int minor = tokens[1].toInt(&ok);
-    if (!ok || minor < %s)
+    if (!ok || minor > %s)
         return false;
 
     return true;
diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
index 3f493c1ec..32ff28c32 100644
--- a/Source/WebCore/loader/DocumentLoader.cpp
+++ b/Source/WebCore/loader/DocumentLoader.cpp
@@ -357,19 +357,19 @@ void DocumentLoader::commitData(const char* bytes, size_t length)
 
 void DocumentLoader::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<DocumentLoader> info(memoryObjectInfo, this, MemoryInstrumentation::Loader);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Loader);
     info.addInstrumentedMember(m_frame);
     info.addInstrumentedMember(m_mainResourceLoader);
     info.addInstrumentedHashSet(m_subresourceLoaders);
     info.addInstrumentedHashSet(m_multipartSubresourceLoaders);
     info.addInstrumentedHashSet(m_plugInStreamLoaders);
-    info.addString(m_pageTitle.string());
-    info.addString(m_overrideEncoding);
+    info.addMember(m_pageTitle.string());
+    info.addMember(m_overrideEncoding);
     info.addVector(m_responses);
     info.addHashMap(m_pendingSubstituteResources);
     info.addHashSet(m_resourcesClientKnowsAbout);
     info.addVector(m_resourcesLoadedFromMemoryCacheForClientNotification);
-    info.addString(m_clientRedirectSourceForHistory);
+    info.addMember(m_clientRedirectSourceForHistory);
     info.addInstrumentedMember(m_mainResourceData);
 }
 
diff --git a/Source/WebCore/loader/EmptyClients.cpp b/Source/WebCore/loader/EmptyClients.cpp
index b2dbeced8..d8bc06f33 100644
--- a/Source/WebCore/loader/EmptyClients.cpp
+++ b/Source/WebCore/loader/EmptyClients.cpp
@@ -47,6 +47,9 @@ namespace WebCore {
 
 void fillWithEmptyClients(Page::PageClients& pageClients)
 {
+    static ChromeClient* dummyChromeClient = adoptPtr(new EmptyChromeClient).leakPtr();
+    pageClients.chromeClient = dummyChromeClient;
+
 #if ENABLE(CONTEXT_MENUS)
     static ContextMenuClient* dummyContextMenuClient = adoptPtr(new EmptyContextMenuClient).leakPtr();
     pageClients.contextMenuClient = dummyContextMenuClient;
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 1efbcdf5f..0dcb3b24f 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -1501,6 +1501,10 @@ void FrameLoader::stopAllLoaders(ClearProvisionalItemPolicy clearProvisionalItem
     // If this method is called from within this method, infinite recursion can occur (3442218). Avoid this.
     if (m_inStopAllLoaders)
         return;
+    
+    // Calling stopLoading() on the provisional document loader can blow away
+    // the frame from underneath.
+    RefPtr<Frame> protect(m_frame);
 
     m_inStopAllLoaders = true;
 
@@ -3225,11 +3229,11 @@ NetworkingContext* FrameLoader::networkingContext() const
 
 void FrameLoader::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<FrameLoader> info(memoryObjectInfo, this, MemoryInstrumentation::Loader);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Loader);
     info.addInstrumentedMember(m_documentLoader.get());
     info.addInstrumentedMember(m_provisionalDocumentLoader.get());
     info.addInstrumentedMember(m_policyDocumentLoader.get());
-    info.addString(m_outgoingReferrer);
+    info.addMember(m_outgoingReferrer);
     info.addInstrumentedHashSet(m_openedFrames);
 }
 
diff --git a/Source/WebCore/loader/ImageLoader.h b/Source/WebCore/loader/ImageLoader.h
index 4f02c4154..d3b76692c 100644
--- a/Source/WebCore/loader/ImageLoader.h
+++ b/Source/WebCore/loader/ImageLoader.h
@@ -24,6 +24,7 @@
 #define ImageLoader_h
 
 #include "CachedImage.h"
+#include "CachedImageClient.h"
 #include "CachedResourceHandle.h"
 #include "Element.h"
 #include <wtf/OwnPtr.h>
diff --git a/Source/WebCore/loader/MainResourceLoader.cpp b/Source/WebCore/loader/MainResourceLoader.cpp
index fe7d1f9f2..74aa3afc1 100644
--- a/Source/WebCore/loader/MainResourceLoader.cpp
+++ b/Source/WebCore/loader/MainResourceLoader.cpp
@@ -544,6 +544,15 @@ void MainResourceLoader::didFail(const ResourceError& error)
     receivedError(error);
 }
 
+void MainResourceLoader::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Loader);
+    ResourceLoader::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_initialRequest);
+    info.addInstrumentedMember(m_substituteData);
+    info.addMember(m_dataLoadTimer);
+}
+
 void MainResourceLoader::handleEmptyLoad(const KURL& url, bool forURLScheme)
 {
     String mimeType;
diff --git a/Source/WebCore/loader/MainResourceLoader.h b/Source/WebCore/loader/MainResourceLoader.h
index d526a2373..25027fdb2 100644
--- a/Source/WebCore/loader/MainResourceLoader.h
+++ b/Source/WebCore/loader/MainResourceLoader.h
@@ -73,6 +73,8 @@ namespace WebCore {
 
         bool isLoadingMultipartContent() const { return m_loadingMultipartContent; }
 
+        virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
     private:
         explicit MainResourceLoader(Frame*);
 
diff --git a/Source/WebCore/loader/ResourceLoader.cpp b/Source/WebCore/loader/ResourceLoader.cpp
index 9315108ae..0175b16b8 100644
--- a/Source/WebCore/loader/ResourceLoader.cpp
+++ b/Source/WebCore/loader/ResourceLoader.cpp
@@ -530,7 +530,7 @@ AsyncFileStream* ResourceLoader::createAsyncFileStream(FileStreamClient* client)
 
 void ResourceLoader::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<ResourceLoader> info(memoryObjectInfo, this, MemoryInstrumentation::Loader);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Loader);
     info.addMember(m_handle.get());
     info.addInstrumentedMember(m_frame);
     info.addInstrumentedMember(m_documentLoader);
diff --git a/Source/WebCore/loader/SubframeLoader.cpp b/Source/WebCore/loader/SubframeLoader.cpp
index 63cfb3b64..410bfe368 100644
--- a/Source/WebCore/loader/SubframeLoader.cpp
+++ b/Source/WebCore/loader/SubframeLoader.cpp
@@ -104,51 +104,103 @@ bool SubframeLoader::resourceWillUsePlugin(const String& url, const String& mime
     return shouldUsePlugin(completedURL, mimeType, shouldPreferPlugInsForImages, false, useFallback);
 }
 
-bool SubframeLoader::requestPlugin(HTMLPlugInImageElement* ownerElement, const KURL& url, const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback)
+bool SubframeLoader::pluginIsLoadable(HTMLPlugInImageElement* pluginElement, const KURL& url, const String& mimeType)
 {
     Settings* settings = m_frame->settings();
     if (!settings)
         return false;
 
-    // Application plug-ins are plug-ins implemented by the user agent, for example Qt plug-ins,
-    // as opposed to third-party code such as Flash. The user agent decides whether or not they are
-    // permitted, rather than WebKit.
-    if ((!allowPlugins(AboutToInstantiatePlugin) && !MIMETypeRegistry::isApplicationPluginMIMEType(mimeType)))
-        return false;
-
     if (MIMETypeRegistry::isJavaAppletMIMEType(mimeType)) {
         if (!settings->isJavaEnabled())
             return false;
-        if (m_frame->document() && m_frame->document()->securityOrigin()->isLocal() && !settings->isJavaEnabledForLocalFiles())
+        if (document() && document()->securityOrigin()->isLocal() && !settings->isJavaEnabledForLocalFiles())
             return false;
     }
 
-    if (m_frame->document()) {
-        if (m_frame->document()->isSandboxed(SandboxPlugins))
+    if (document()) {
+        if (document()->isSandboxed(SandboxPlugins))
             return false;
-        if (!m_frame->document()->contentSecurityPolicy()->allowObjectFromSource(url))
+
+        if (!document()->securityOrigin()->canDisplay(url)) {
+            FrameLoader::reportLocalLoadFailed(m_frame, url.string());
+            return false;
+        }
+
+        if (!document()->contentSecurityPolicy()->allowObjectFromSource(url)) {
+            RenderEmbeddedObject* renderer = pluginElement->renderEmbeddedObject();
+            renderer->setPluginUnavailabilityReason(RenderEmbeddedObject::PluginBlockedByContentSecurityPolicy);
+            return false;
+        }
+
+        if (m_frame->loader() && !m_frame->loader()->checkIfRunInsecureContent(document()->securityOrigin(), url))
             return false;
     }
 
+    return true;
+}
+
+bool SubframeLoader::requestPlugin(HTMLPlugInImageElement* ownerElement, const KURL& url, const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback)
+{
+
+    // Application plug-ins are plug-ins implemented by the user agent, for example Qt plug-ins,
+    // as opposed to third-party code such as Flash. The user agent decides whether or not they are
+    // permitted, rather than WebKit.
+    if ((!allowPlugins(AboutToInstantiatePlugin) && !MIMETypeRegistry::isApplicationPluginMIMEType(mimeType)))
+        return false;
+
+    if (!pluginIsLoadable(ownerElement, url, mimeType))
+        return false;
+
     ASSERT(ownerElement->hasTagName(objectTag) || ownerElement->hasTagName(embedTag));
     return loadPlugin(ownerElement, url, mimeType, paramNames, paramValues, useFallback);
 }
 
-static void logPluginRequest(Page* page, const String& mimeType, bool success)
+static String findPluginMIMETypeFromURL(Page* page, const String& url)
+{
+    if (!url)
+        return String();
+
+    size_t dotIndex = url.reverseFind('.');
+    if (dotIndex == notFound)
+        return String();
+
+    String extension = url.substring(dotIndex + 1);
+
+    PluginData* pluginData = page->pluginData();
+    for (size_t i = 0; i < pluginData->mimes().size(); ++i) {
+        const MimeClassInfo& mimeClassInfo = pluginData->mimes()[i];
+        for (size_t j = 0; j < mimeClassInfo.extensions.size(); ++j) {
+            if (equalIgnoringCase(extension, mimeClassInfo.extensions[j]))
+                return mimeClassInfo.type;
+        }
+    }
+
+    return String();
+}
+
+static void logPluginRequest(Page* page, const String& mimeType, const String& url, bool success)
 {
     if (!page || !page->settings()->diagnosticLoggingEnabled())
         return;
-    
+
+    String newMIMEType = mimeType;
+    if (!newMIMEType) {
+        // Try to figure out the MIME type from the URL extension.
+        newMIMEType = findPluginMIMETypeFromURL(page, url);
+        if (!newMIMEType)
+            return;
+    }
+
     ChromeClient* client = page->chrome()->client();
-    client->logDiagnosticMessage(success ? DiagnosticLoggingKeys::pluginLoadedKey() : DiagnosticLoggingKeys::pluginLoadingFailedKey(), mimeType, DiagnosticLoggingKeys::noopKey());
+    client->logDiagnosticMessage(success ? DiagnosticLoggingKeys::pluginLoadedKey() : DiagnosticLoggingKeys::pluginLoadingFailedKey(), newMIMEType, DiagnosticLoggingKeys::noopKey());
     
     if (!page->hasSeenAnyPlugin())
         client->logDiagnosticMessage(DiagnosticLoggingKeys::pageContainsAtLeastOnePluginKey(), emptyString(), DiagnosticLoggingKeys::noopKey());
     
-    if (!page->hasSeenPlugin(mimeType))
-        client->logDiagnosticMessage(DiagnosticLoggingKeys::pageContainsPluginKey(), mimeType, DiagnosticLoggingKeys::noopKey());
+    if (!page->hasSeenPlugin(newMIMEType))
+        client->logDiagnosticMessage(DiagnosticLoggingKeys::pageContainsPluginKey(), newMIMEType, DiagnosticLoggingKeys::noopKey());
 
-    page->sawPlugin(mimeType);
+    page->sawPlugin(newMIMEType);
 }
 
 bool SubframeLoader::requestObject(HTMLPlugInImageElement* ownerElement, const String& url, const AtomicString& frameName, const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues)
@@ -169,7 +221,7 @@ bool SubframeLoader::requestObject(HTMLPlugInImageElement* ownerElement, const S
     bool useFallback;
     if (shouldUsePlugin(completedURL, mimeType, ownerElement->shouldPreferPlugInsForImages(), renderer->hasFallbackContent(), useFallback)) {
         bool success = requestPlugin(ownerElement, completedURL, mimeType, paramNames, paramValues, useFallback);
-        logPluginRequest(document()->page(), mimeType, success);
+        logPluginRequest(document()->page(), mimeType, completedURL, success);
         return success;
     }
 
@@ -253,7 +305,7 @@ PassRefPtr<Widget> SubframeLoader::createJavaAppletWidget(const IntSize& size, H
     if (allowPlugins(AboutToInstantiatePlugin))
         widget = m_frame->loader()->client()->createJavaAppletWidget(size, element, baseURL, paramNames, paramValues);
 
-    logPluginRequest(document()->page(), element->serviceType(), widget);
+    logPluginRequest(document()->page(), element->serviceType(), String(), widget);
 
     if (!widget) {
         RenderEmbeddedObject* renderer = element->renderEmbeddedObject();
@@ -385,21 +437,9 @@ bool SubframeLoader::loadPlugin(HTMLPlugInImageElement* pluginElement, const KUR
     if (!renderer || useFallback)
         return false;
 
-    if (!document()->securityOrigin()->canDisplay(url)) {
-        FrameLoader::reportLocalLoadFailed(m_frame, url.string());
-        return false;
-    }
-
-    if (!document()->contentSecurityPolicy()->allowObjectFromSource(url))
-        return false;
-
-    FrameLoader* frameLoader = m_frame->loader();
-    if (!frameLoader->checkIfRunInsecureContent(document()->securityOrigin(), url))
-        return false;
-
     IntSize contentSize = roundedIntSize(LayoutSize(renderer->contentWidth(), renderer->contentHeight()));
     bool loadManually = document()->isPluginDocument() && !m_containsPlugins && toPluginDocument(document())->shouldLoadPluginManually();
-    RefPtr<Widget> widget = frameLoader->client()->createPlugin(contentSize,
+    RefPtr<Widget> widget = m_frame->loader()->client()->createPlugin(contentSize,
         pluginElement, url, paramNames, paramValues, mimeType, loadManually);
 
     if (!widget) {
diff --git a/Source/WebCore/loader/SubframeLoader.h b/Source/WebCore/loader/SubframeLoader.h
index bcc89025d..74a166872 100644
--- a/Source/WebCore/loader/SubframeLoader.h
+++ b/Source/WebCore/loader/SubframeLoader.h
@@ -88,6 +88,7 @@ private:
         const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
 
     bool shouldUsePlugin(const KURL&, const String& mimeType, bool shouldPreferPlugInsForImages, bool hasFallback, bool& useFallback);
+    bool pluginIsLoadable(HTMLPlugInImageElement*, const KURL&, const String& mimeType);
 
     Document* document() const;
 
diff --git a/Source/WebCore/loader/SubresourceLoader.cpp b/Source/WebCore/loader/SubresourceLoader.cpp
index 34b7065ef..eaf1f5a81 100644
--- a/Source/WebCore/loader/SubresourceLoader.cpp
+++ b/Source/WebCore/loader/SubresourceLoader.cpp
@@ -36,6 +36,7 @@
 #include "FrameLoader.h"
 #include "Logging.h"
 #include "MemoryCache.h"
+#include "MemoryInstrumentation.h"
 #include "SecurityOrigin.h"
 #include "SecurityPolicy.h"
 #include <wtf/RefCountedLeakCounter.h>
@@ -129,6 +130,15 @@ void SubresourceLoader::cancelIfNotFinishing()
     ResourceLoader::cancel();
 }
 
+void SubresourceLoader::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Loader);
+    ResourceLoader::reportMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_resource);
+    info.addInstrumentedMember(m_document);
+    info.addMember(m_requestCountTracker);
+}
+
 bool SubresourceLoader::init(const ResourceRequest& request)
 {
     if (!ResourceLoader::init(request))
diff --git a/Source/WebCore/loader/SubresourceLoader.h b/Source/WebCore/loader/SubresourceLoader.h
index 9f00bf4f4..a2de2cb41 100644
--- a/Source/WebCore/loader/SubresourceLoader.h
+++ b/Source/WebCore/loader/SubresourceLoader.h
@@ -47,6 +47,8 @@ public:
 
     void cancelIfNotFinishing();
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 private:
     SubresourceLoader(Frame*, CachedResource*, const ResourceLoaderOptions&);
     virtual ~SubresourceLoader();
diff --git a/Source/WebCore/loader/SubstituteData.cpp b/Source/WebCore/loader/SubstituteData.cpp
new file mode 100644
index 000000000..806bd1d8e
--- /dev/null
+++ b/Source/WebCore/loader/SubstituteData.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SubstituteData.h"
+
+#include "MemoryInstrumentation.h"
+
+namespace WebCore {
+
+void SubstituteData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Loader);
+    info.addInstrumentedMember(m_content);
+    info.addMember(m_mimeType);
+    info.addMember(m_textEncoding);
+    info.addMember(m_failingURL);
+    info.addMember(m_responseURL);
+}
+
+}
diff --git a/Source/WebCore/loader/SubstituteData.h b/Source/WebCore/loader/SubstituteData.h
index 0b87b625d..8da894820 100644
--- a/Source/WebCore/loader/SubstituteData.h
+++ b/Source/WebCore/loader/SubstituteData.h
@@ -34,6 +34,8 @@
 
 namespace WebCore {
 
+    class MemoryObjectInfo;
+
     class SubstituteData {
     public:
         SubstituteData() { }
@@ -54,6 +56,8 @@ namespace WebCore {
         const String& textEncoding() const { return m_textEncoding; }
         const KURL& failingURL() const { return m_failingURL; }
         const KURL& responseURL() const { return m_responseURL; }
+
+        void reportMemoryUsage(MemoryObjectInfo*) const;
         
     private:
         RefPtr<SharedBuffer> m_content;
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 5d103b2ff..778e4e388 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -92,7 +92,7 @@ static unsigned urlHostHash(const KURL& url)
     unsigned hostStart = url.hostStart();
     unsigned hostEnd = url.hostEnd();
     
-    return AlreadyHashed::avoidDeletedValue(StringHasher::computeHash(url.string().characters() + hostStart, hostEnd - hostStart));
+    return AlreadyHashed::avoidDeletedValue(StringHasher::computeHashAndMaskTop8Bits(url.string().characters() + hostStart, hostEnd - hostStart));
 }
 
 ApplicationCacheGroup* ApplicationCacheStorage::loadCacheGroup(const KURL& manifestURL)
diff --git a/Source/WebCore/loader/archive/mhtml/MHTMLArchive.cpp b/Source/WebCore/loader/archive/mhtml/MHTMLArchive.cpp
index cffbef9b3..5567746c3 100644
--- a/Source/WebCore/loader/archive/mhtml/MHTMLArchive.cpp
+++ b/Source/WebCore/loader/archive/mhtml/MHTMLArchive.cpp
@@ -45,6 +45,7 @@
 
 #include <wtf/CryptographicallyRandomNumber.h>
 #include <wtf/DateMath.h>
+#include <wtf/GregorianDateTime.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/Base64.h>
 #include <wtf/text/StringBuilder.h>
@@ -150,9 +151,9 @@ PassRefPtr<SharedBuffer> MHTMLArchive::generateMHTMLData(Page* page, bool useBin
     String boundary = generateRandomBoundary();
     String endOfResourceBoundary = makeString("--", boundary, "\r\n");
 
-    tm localTM;
-    getCurrentLocalTime(&localTM);
-    String dateString = makeRFC2822DateString(localTM.tm_wday, localTM.tm_mday, localTM.tm_mon, 1900 + localTM.tm_year, localTM.tm_hour, localTM.tm_min, localTM.tm_sec, calculateUTCOffset() / (1000 * 60));
+    GregorianDateTime now;
+    now.setToCurrentLocalTime();
+    String dateString = makeRFC2822DateString(now.weekDay(), now.monthDay(), now.month(), now.year(), now.hour(), now.minute(), now.second(), now.utcOffset() / 60);
 
     StringBuilder stringBuilder;
     stringBuilder.append("From: <Saved by WebKit>\r\n");
diff --git a/Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp b/Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp
index e1fb02cfa..7e44ebc28 100644
--- a/Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp
+++ b/Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp
@@ -32,6 +32,7 @@
 #include "CachedStyleSheetClient.h"
 #include "HTTPParsers.h"
 #include "MemoryCache.h"
+#include "MemoryInstrumentation.h"
 #include "SharedBuffer.h"
 #include "StyleSheetContents.h"
 #include "TextResourceDecoder.h"
@@ -58,10 +59,13 @@ CachedCSSStyleSheet::~CachedCSSStyleSheet()
 void CachedCSSStyleSheet::didAddClient(CachedResourceClient* c)
 {
     ASSERT(c->resourceClientType() == CachedStyleSheetClient::expectedType());
+    // CachedResource::didAddClient() must be before setCSSStyleSheet(),
+    // because setCSSStyleSheet() may cause scripts to be executed, which could destroy 'c' if it is an instance of HTMLLinkElement.
+    // see the comment of HTMLLinkElement::setCSSStyleSheet.
+    CachedResource::didAddClient(c);
+
     if (!isLoading())
         static_cast<CachedStyleSheetClient*>(c)->setCSSStyleSheet(m_resourceRequest.url(), m_response.url(), m_decoder->encoding().name(), this);
-
-    CachedResource::didAddClient(c);
 }
 
 void CachedCSSStyleSheet::setEncoding(const String& chs)
@@ -168,6 +172,12 @@ PassRefPtr<StyleSheetContents> CachedCSSStyleSheet::restoreParsedStyleSheet(cons
 {
     if (!m_parsedStyleSheetCache)
         return 0;
+    if (m_parsedStyleSheetCache->hasFailedOrCanceledSubresources()) {
+        m_parsedStyleSheetCache->removedFromMemoryCache();
+        m_parsedStyleSheetCache.clear();
+        return 0;
+    }
+
     ASSERT(m_parsedStyleSheetCache->isCacheable());
     ASSERT(m_parsedStyleSheetCache->isInMemoryCache());
 
@@ -192,4 +202,13 @@ void CachedCSSStyleSheet::saveParsedStyleSheet(PassRefPtr<StyleSheetContents> sh
     setDecodedSize(m_parsedStyleSheetCache->estimatedSizeInBytes());
 }
 
+void CachedCSSStyleSheet::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CachedResourceCSS);
+    CachedResource::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_decoder);
+    info.addInstrumentedMember(m_parsedStyleSheetCache);
+    info.addMember(m_decodedSheetText);
+}
+
 }
diff --git a/Source/WebCore/loader/cache/CachedCSSStyleSheet.h b/Source/WebCore/loader/cache/CachedCSSStyleSheet.h
index 9ad6f14ba..434ba4561 100644
--- a/Source/WebCore/loader/cache/CachedCSSStyleSheet.h
+++ b/Source/WebCore/loader/cache/CachedCSSStyleSheet.h
@@ -32,6 +32,7 @@
 namespace WebCore {
 
     class CachedResourceClient;
+    class MemoryObjectInfo;
     class SharedBuffer;
     class StyleSheetContents;
     class TextResourceDecoder;
@@ -58,6 +59,8 @@ namespace WebCore {
         PassRefPtr<StyleSheetContents> restoreParsedStyleSheet(const CSSParserContext&);
         void saveParsedStyleSheet(PassRefPtr<StyleSheetContents>);
     
+        virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
     private:
         bool canUseSheet(bool enforceMIMEType, bool* hasValidMIMEType) const;
         virtual PurgePriority purgePriority() const { return PurgeLast; }
diff --git a/Source/WebCore/loader/cache/CachedFont.cpp b/Source/WebCore/loader/cache/CachedFont.cpp
index fddd79d47..27ffd9574 100644
--- a/Source/WebCore/loader/cache/CachedFont.cpp
+++ b/Source/WebCore/loader/cache/CachedFont.cpp
@@ -36,6 +36,7 @@
 #include "CachedResourceLoader.h"
 #include "FontPlatformData.h"
 #include "MemoryCache.h"
+#include "MemoryInstrumentation.h"
 #include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
 #include <wtf/Vector.h>
@@ -206,4 +207,16 @@ void CachedFont::error(CachedResource::Status status)
     checkNotify();
 }
 
+void CachedFont::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CachedResourceFont);
+    CachedResource::reportMemoryUsage(memoryObjectInfo);
+#if ENABLE(SVG_FONTS)
+    info.addInstrumentedMember(m_externalSVGDocument);
+#endif
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
+    info.addMember(m_fontData);
+#endif
+}
+
 }
diff --git a/Source/WebCore/loader/cache/CachedFont.h b/Source/WebCore/loader/cache/CachedFont.h
index 3cafc1e50..cff342a25 100644
--- a/Source/WebCore/loader/cache/CachedFont.h
+++ b/Source/WebCore/loader/cache/CachedFont.h
@@ -70,6 +70,8 @@ public:
     SVGFontElement* getSVGFontById(const String&) const;
 #endif
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 private:
     FontCustomPlatformData* m_fontData;
     bool m_loadInitiated;
diff --git a/Source/WebCore/loader/cache/CachedImage.cpp b/Source/WebCore/loader/cache/CachedImage.cpp
index 313475ce1..72647c6b7 100644
--- a/Source/WebCore/loader/cache/CachedImage.cpp
+++ b/Source/WebCore/loader/cache/CachedImage.cpp
@@ -25,7 +25,7 @@
 #include "CachedImage.h"
 
 #include "BitmapImage.h"
-#include "MemoryCache.h"
+#include "CachedImageClient.h"
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
 #include "CachedResourceLoader.h"
@@ -33,6 +33,7 @@
 #include "FrameLoaderClient.h"
 #include "FrameLoaderTypes.h"
 #include "FrameView.h"
+#include "MemoryCache.h"
 #include "Page.h"
 #include "RenderObject.h"
 #include "Settings.h"
@@ -467,4 +468,18 @@ void CachedImage::changedInRect(const Image* image, const IntRect& rect)
     notifyObservers(&rect);
 }
 
+void CachedImage::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CachedResourceImage);
+    CachedResource::reportMemoryUsage(memoryObjectInfo);
+    if (m_image) {
+        if (m_image->data())
+            info.addRawBuffer(m_image->data(), m_image->data()->size());
+        info.addRawBuffer(m_image.get(), decodedSize());
+    }
+#if ENABLE(SVG)
+    info.addMember(m_svgImageCache);
+#endif
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/loader/cache/CachedImage.h b/Source/WebCore/loader/cache/CachedImage.h
index b99215173..4865c7e24 100644
--- a/Source/WebCore/loader/cache/CachedImage.h
+++ b/Source/WebCore/loader/cache/CachedImage.h
@@ -24,7 +24,6 @@
 #define CachedImage_h
 
 #include "CachedResource.h"
-#include "CachedResourceClient.h"
 #include "SVGImageCache.h"
 #include "ImageObserver.h"
 #include "IntRect.h"
@@ -32,6 +31,7 @@
 
 namespace WebCore {
 
+class CachedImageClient;
 class CachedResourceLoader;
 class FloatSize;
 class MemoryCache;
@@ -93,6 +93,8 @@ public:
     virtual void animationAdvanced(const Image*);
     virtual void changedInRect(const Image*, const IntRect&);
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 private:
     Image* lookupOrCreateImageForRenderer(const RenderObject*);
 
@@ -113,23 +115,6 @@ private:
     bool m_shouldPaintBrokenImage;
 };
 
-class CachedImageClient : public CachedResourceClient {
-public:
-    virtual ~CachedImageClient() { }
-    static CachedResourceClientType expectedType() { return ImageType; }
-    virtual CachedResourceClientType resourceClientType() const { return expectedType(); }
-
-    // Called whenever a frame of an image changes, either because we got more data from the network or
-    // because we are animating. If not null, the IntRect is the changed rect of the image.
-    virtual void imageChanged(CachedImage*, const IntRect* = 0) { }
-
-    // Called to find out if this client wants to actually display the image. Used to tell when we
-    // can halt animation. Content nodes that hold image refs for example would not render the image,
-    // but RenderImages would (assuming they have visibility: visible and their render tree isn't hidden
-    // e.g., in the b/f cache or in a background tab).
-    virtual bool willRenderImage(CachedImage*) { return false; }
-};
-
 }
 
 #endif
diff --git a/Source/WebCore/loader/cache/CachedImageClient.h b/Source/WebCore/loader/cache/CachedImageClient.h
new file mode 100644
index 000000000..765cd63fb
--- /dev/null
+++ b/Source/WebCore/loader/cache/CachedImageClient.h
@@ -0,0 +1,52 @@
+/*
+    Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
+    Copyright (C) 2001 Dirk Mueller <mueller@kde.org>
+    Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
+    Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef CachedImageClient_h
+#define CachedImageClient_h
+
+#include "CachedResourceClient.h"
+
+namespace WebCore {
+
+class CachedImage;
+class IntRect;
+
+class CachedImageClient : public CachedResourceClient {
+public:
+    virtual ~CachedImageClient() { }
+    static CachedResourceClientType expectedType() { return ImageType; }
+    virtual CachedResourceClientType resourceClientType() const { return expectedType(); }
+
+    // Called whenever a frame of an image changes, either because we got more data from the network or
+    // because we are animating. If not null, the IntRect is the changed rect of the image.
+    virtual void imageChanged(CachedImage*, const IntRect* = 0) { }
+
+    // Called to find out if this client wants to actually display the image. Used to tell when we
+    // can halt animation. Content nodes that hold image refs for example would not render the image,
+    // but RenderImages would (assuming they have visibility: visible and their render tree isn't hidden
+    // e.g., in the b/f cache or in a background tab).
+    virtual bool willRenderImage(CachedImage*) { return false; }
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/loader/cache/CachedRawResource.cpp b/Source/WebCore/loader/cache/CachedRawResource.cpp
index b0a703304..4e43131b1 100644
--- a/Source/WebCore/loader/cache/CachedRawResource.cpp
+++ b/Source/WebCore/loader/cache/CachedRawResource.cpp
@@ -29,6 +29,7 @@
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
 #include "CachedResourceLoader.h"
+#include "MemoryInstrumentation.h"
 #include "SharedBuffer.h"
 #include "SubresourceLoader.h"
 #include <wtf/PassRefPtr.h>
@@ -159,4 +160,11 @@ bool CachedRawResource::canReuse(const ResourceRequest& newRequest) const
     return true;
 }
 
+void CachedRawResource::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CachedResource);
+    CachedResource::reportMemoryUsage(memoryObjectInfo);
+}
+
+
 } // namespace WebCore
diff --git a/Source/WebCore/loader/cache/CachedRawResource.h b/Source/WebCore/loader/cache/CachedRawResource.h
index e296ab87e..c349b866a 100644
--- a/Source/WebCore/loader/cache/CachedRawResource.h
+++ b/Source/WebCore/loader/cache/CachedRawResource.h
@@ -29,6 +29,7 @@
 namespace WebCore {
 class CachedRawResourceCallback;
 class CachedRawResourceClient;
+class MemoryObjectInfo;
 
 class CachedRawResource : public CachedResource {
 public:
@@ -44,6 +45,8 @@ public:
 
     bool canReuse(const ResourceRequest&) const;
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 private:
     virtual void didAddClient(CachedResourceClient*);
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
index 41cd60189..c619ddad6 100755
--- a/Source/WebCore/loader/cache/CachedResource.cpp
+++ b/Source/WebCore/loader/cache/CachedResource.cpp
@@ -37,6 +37,7 @@
 #include "InspectorInstrumentation.h"
 #include "KURL.h"
 #include "Logging.h"
+#include "MemoryInstrumentation.h"
 #include "PurgeableBuffer.h"
 #include "ResourceHandle.h"
 #include "ResourceLoadScheduler.h"
@@ -800,4 +801,27 @@ void CachedResource::CachedResourceCallback::timerFired(Timer<CachedResourceCall
     m_resource->didAddClient(m_client);
 }
 
+void CachedResource::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CachedResource);
+    info.addMember(m_resourceRequest);
+    info.addHashSet(m_clients);
+    info.addMember(m_accept);
+    info.addInstrumentedMember(m_loader);
+    info.addMember(m_response);
+    info.addInstrumentedMember(m_data);
+    info.addMember(m_cachedMetadata.get());
+    info.addInstrumentedMember(m_nextInAllResourcesList);
+    info.addInstrumentedMember(m_prevInAllResourcesList);
+    info.addInstrumentedMember(m_nextInLiveResourcesList);
+    info.addInstrumentedMember(m_prevInLiveResourcesList);
+    info.addInstrumentedMember(m_owningCachedResourceLoader);
+    info.addInstrumentedMember(m_resourceToRevalidate);
+    info.addInstrumentedMember(m_proxyResource);
+    info.addInstrumentedHashSet(m_handlesToRevalidate);
+
+    if (m_purgeableData && !m_purgeableData->wasPurged())
+        info.addRawBuffer(m_purgeableData.get(), m_purgeableData->size());
+}
+
 }
diff --git a/Source/WebCore/loader/cache/CachedResource.h b/Source/WebCore/loader/cache/CachedResource.h
index fe3e1fc63..f61ad5834 100644
--- a/Source/WebCore/loader/cache/CachedResource.h
+++ b/Source/WebCore/loader/cache/CachedResource.h
@@ -47,6 +47,7 @@ class CachedResourceHandleBase;
 class CachedResourceLoader;
 class Frame;
 class InspectorResource;
+class MemoryObjectInfo;
 class PurgeableBuffer;
 class SecurityOrigin;
 class SubresourceLoader;
@@ -205,6 +206,7 @@ public:
 
     bool wasCanceled() const { return m_status == Canceled; }
     bool errorOccurred() const { return (m_status == LoadError || m_status == DecodeError); }
+    bool loadFailedOrCanceled() { return m_status == Canceled || m_status == LoadError; }
 
     bool sendResourceLoadCallbacks() const { return m_options.sendLoadCallbacks == SendCallbacks; }
     
@@ -249,6 +251,8 @@ public:
     void setLoadFinishTime(double finishTime) { m_loadFinishTime = finishTime; }
     double loadFinishTime() const { return m_loadFinishTime; }
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
     void checkNotify();
 
diff --git a/Source/WebCore/loader/cache/CachedResourceHandle.cpp b/Source/WebCore/loader/cache/CachedResourceHandle.cpp
index 871292c62..ea1631814 100644
--- a/Source/WebCore/loader/cache/CachedResourceHandle.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceHandle.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "CachedResourceHandle.h"
 
+#include "MemoryInstrumentation.h"
+
 namespace WebCore {
 
 void CachedResourceHandleBase::setResource(CachedResource* resource) 
@@ -39,4 +41,11 @@ void CachedResourceHandleBase::setResource(CachedResource* resource)
         m_resource->registerHandle(this);
 }
 
+void CachedResourceHandleBase::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CachedResource);
+    info.addInstrumentedMember(m_resource);
+}
+
+
 }
diff --git a/Source/WebCore/loader/cache/CachedResourceHandle.h b/Source/WebCore/loader/cache/CachedResourceHandle.h
index 95cd0ff7f..15d44c757 100644
--- a/Source/WebCore/loader/cache/CachedResourceHandle.h
+++ b/Source/WebCore/loader/cache/CachedResourceHandle.h
@@ -30,6 +30,8 @@
 
 namespace WebCore {
 
+class MemoryObjectInfo;
+
     class CachedResourceHandleBase {
     public:
         ~CachedResourceHandleBase() { if (m_resource) m_resource->unregisterHandle(this); }
@@ -41,6 +43,8 @@ namespace WebCore {
         typedef CachedResource* CachedResourceHandleBase::*UnspecifiedBoolType;
         operator UnspecifiedBoolType() const { return m_resource ? &CachedResourceHandleBase::m_resource : 0; }
 
+        void reportMemoryUsage(MemoryObjectInfo*) const;
+
     protected:
         CachedResourceHandleBase() : m_resource(0) {}
         CachedResourceHandleBase(CachedResource* res) { m_resource = res; if (m_resource) m_resource->registerHandle(this); }
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index 9a88724a1..69ffb928f 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -877,5 +877,19 @@ void CachedResourceLoader::printPreloadStats()
         printf("IMAGES:  %d (%d hits, hit rate %d%%)\n", images, images - imageMisses, (images - imageMisses) * 100 / images);
 }
 #endif
-    
+
+void CachedResourceLoader::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Loader);
+    info.addHashMap(m_documentResources);
+    for (DocumentResourceMap::const_iterator i = m_documentResources.begin(); i != m_documentResources.end(); ++i) {
+        info.addMember(i->first);
+        info.addInstrumentedMember(i->second);
+    }
+    info.addHashSet(m_validatedURLs);
+    if (m_preloads)
+        info.addListHashSet(*m_preloads);
+    info.addMember(m_pendingPreloads);
+}
+
 }
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.h b/Source/WebCore/loader/cache/CachedResourceLoader.h
index 5eeb3871f..3f1c233b0 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.h
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.h
@@ -52,6 +52,7 @@ class Document;
 class Frame;
 class ImageLoader;
 class KURL;
+class MemoryObjectInfo;
 
 // The CachedResourceLoader manages the loading of scripts/images/stylesheets for a single document.
 class CachedResourceLoader {
@@ -119,6 +120,8 @@ public:
     void printPreloadStats();
     bool canRequest(CachedResource::Type, const KURL&, bool forPreload = false);
     
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     CachedResourceHandle<CachedResource> requestResource(CachedResource::Type, ResourceRequest&, const String& charset, const ResourceLoaderOptions&, ResourceLoadPriority = ResourceLoadPriorityUnresolved, bool isPreload = false);
     CachedResourceHandle<CachedResource> revalidateResource(CachedResource*, ResourceLoadPriority, const ResourceLoaderOptions&);
diff --git a/Source/WebCore/loader/cache/CachedSVGDocument.cpp b/Source/WebCore/loader/cache/CachedSVGDocument.cpp
index f03fadb57..423008e8b 100644
--- a/Source/WebCore/loader/cache/CachedSVGDocument.cpp
+++ b/Source/WebCore/loader/cache/CachedSVGDocument.cpp
@@ -71,6 +71,14 @@ void CachedSVGDocument::data(PassRefPtr<SharedBuffer> data, bool allDataReceived
     checkNotify();
 }
 
+void CachedSVGDocument::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CachedResourceSVG);
+    CachedResource::reportMemoryUsage(memoryObjectInfo);
+    info.addInstrumentedMember(m_document);
+    info.addMember(m_decoder);
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/loader/cache/CachedSVGDocument.h b/Source/WebCore/loader/cache/CachedSVGDocument.h
index b05ef67d1..54d5a8881 100644
--- a/Source/WebCore/loader/cache/CachedSVGDocument.h
+++ b/Source/WebCore/loader/cache/CachedSVGDocument.h
@@ -43,6 +43,8 @@ public:
     virtual String encoding() const;
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 protected:
     RefPtr<SVGDocument> m_document;
     RefPtr<TextResourceDecoder> m_decoder;
diff --git a/Source/WebCore/loader/cache/CachedScript.cpp b/Source/WebCore/loader/cache/CachedScript.cpp
index a2da74489..7e7f26905 100644
--- a/Source/WebCore/loader/cache/CachedScript.cpp
+++ b/Source/WebCore/loader/cache/CachedScript.cpp
@@ -30,6 +30,7 @@
 #include "MemoryCache.h"
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
+#include "MemoryInstrumentation.h"
 #include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
 #include <wtf/Vector.h>
@@ -71,7 +72,7 @@ const String& CachedScript::script()
     if (!m_script && m_data) {
         m_script = m_decoder->decode(m_data->data(), encodedSize());
         m_script += m_decoder->flush();
-        setDecodedSize(m_script.length() * sizeof(UChar));
+        setDecodedSize(m_script.sizeInBytes());
     }
     m_decodedDataDeletionTimer.startOneShot(0);
     
@@ -126,4 +127,15 @@ void CachedScript::sourceProviderCacheSizeChanged(int delta)
 }
 #endif
 
+void CachedScript::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CachedResourceScript);
+    CachedResource::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_script);
+    info.addMember(m_decoder);
+#if USE(JSC)
+    info.addMember(m_sourceProviderCache);
+#endif
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/loader/cache/CachedScript.h b/Source/WebCore/loader/cache/CachedScript.h
index 9a4f38ad0..3df6be938 100644
--- a/Source/WebCore/loader/cache/CachedScript.h
+++ b/Source/WebCore/loader/cache/CachedScript.h
@@ -37,6 +37,7 @@ namespace JSC {
 namespace WebCore {
 
     class CachedResourceLoader;
+    class MemoryObjectInfo;
     class TextResourceDecoder;
 
     class CachedScript : public CachedResource {
@@ -57,6 +58,9 @@ namespace WebCore {
         JSC::SourceProviderCache* sourceProviderCache() const;
         void sourceProviderCacheSizeChanged(int delta);
 #endif
+
+        virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
     private:
         virtual PurgePriority purgePriority() const { return PurgeLast; }
 
diff --git a/Source/WebCore/loader/cache/CachedShader.cpp b/Source/WebCore/loader/cache/CachedShader.cpp
index b8d7c5f9a..72eb5c053 100644
--- a/Source/WebCore/loader/cache/CachedShader.cpp
+++ b/Source/WebCore/loader/cache/CachedShader.cpp
@@ -32,6 +32,7 @@
 #if ENABLE(CSS_SHADERS)
 
 #include "CachedShader.h"
+#include "MemoryInstrumentation.h"
 #include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
 #include <wtf/text/StringBuilder.h>
@@ -67,6 +68,14 @@ void CachedShader::data(PassRefPtr<SharedBuffer> data, bool allDataReceived)
     CachedResource::data(data, allDataReceived);
 }
 
+void CachedShader::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CachedResourceShader);
+    CachedResource::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_decoder);
+    info.addMember(m_shaderString);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(CSS_SHADERS)
diff --git a/Source/WebCore/loader/cache/CachedShader.h b/Source/WebCore/loader/cache/CachedShader.h
index d1de14d77..4286770ad 100644
--- a/Source/WebCore/loader/cache/CachedShader.h
+++ b/Source/WebCore/loader/cache/CachedShader.h
@@ -36,6 +36,7 @@
 
 namespace WebCore {
 
+class MemoryObjectInfo;
 class TextResourceDecoder;
 
 class CachedShader : public CachedResource {
@@ -46,6 +47,8 @@ public:
     const String& shaderString();
     void data(PassRefPtr<SharedBuffer>, bool allDataReceived);
     
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 private:
     RefPtr<TextResourceDecoder> m_decoder;
     String m_shaderString;
diff --git a/Source/WebCore/loader/cache/CachedXSLStyleSheet.cpp b/Source/WebCore/loader/cache/CachedXSLStyleSheet.cpp
index 336fce4ac..d14d5f2a3 100644
--- a/Source/WebCore/loader/cache/CachedXSLStyleSheet.cpp
+++ b/Source/WebCore/loader/cache/CachedXSLStyleSheet.cpp
@@ -29,6 +29,7 @@
 
 #include "CachedResourceClientWalker.h"
 #include "CachedStyleSheetClient.h"
+#include "MemoryInstrumentation.h"
 #include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
 #include <wtf/Vector.h>
@@ -96,6 +97,14 @@ void CachedXSLStyleSheet::error(CachedResource::Status status)
     checkNotify();
 }
 
+void CachedXSLStyleSheet::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CachedResourceXSLT);
+    CachedResource::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_sheet);
+    info.addMember(m_decoder);
+}
+
 #endif
 
 }
diff --git a/Source/WebCore/loader/cache/CachedXSLStyleSheet.h b/Source/WebCore/loader/cache/CachedXSLStyleSheet.h
index b8f7283d3..2aa8dfa25 100644
--- a/Source/WebCore/loader/cache/CachedXSLStyleSheet.h
+++ b/Source/WebCore/loader/cache/CachedXSLStyleSheet.h
@@ -32,6 +32,7 @@
 namespace WebCore {
 
     class CachedResourceLoader;
+    class MemoryObjectInfo;
     class TextResourceDecoder;
 
 #if ENABLE(XSLT)
@@ -50,6 +51,8 @@ namespace WebCore {
         
         void checkNotify();
         
+        virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
     protected:
         String m_sheet;
         RefPtr<TextResourceDecoder> m_decoder;
diff --git a/Source/WebCore/loader/cache/MemoryCache.cpp b/Source/WebCore/loader/cache/MemoryCache.cpp
index 5dc047402..50f45cd12 100644
--- a/Source/WebCore/loader/cache/MemoryCache.cpp
+++ b/Source/WebCore/loader/cache/MemoryCache.cpp
@@ -36,6 +36,7 @@
 #include "FrameView.h"
 #include "Image.h"
 #include "Logging.h"
+#include "MemoryInstrumentation.h"
 #include "ResourceHandle.h"
 #include "SecurityOrigin.h"
 #include "SecurityOriginHash.h"
@@ -714,6 +715,19 @@ MemoryCache::Statistics MemoryCache::getStatistics()
     return stats;
 }
 
+void MemoryCache::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::MemoryCacheStructures);
+    info.addHashMap(m_resources);
+    CachedResourceMap::const_iterator e = m_resources.end();
+    for (CachedResourceMap::const_iterator i = m_resources.begin(); i != e; ++i) {
+        info.addMember(i->first);
+        info.addInstrumentedMember(i->second);
+    }
+    info.addVector(m_allResources);
+    info.addMember(m_liveDecodedResources);
+}
+
 void MemoryCache::setDisabled(bool disabled)
 {
     m_disabled = disabled;
diff --git a/Source/WebCore/loader/cache/MemoryCache.h b/Source/WebCore/loader/cache/MemoryCache.h
index 6f9832662..5a2f9495e 100644
--- a/Source/WebCore/loader/cache/MemoryCache.h
+++ b/Source/WebCore/loader/cache/MemoryCache.h
@@ -39,6 +39,7 @@ class CachedCSSStyleSheet;
 class CachedResource;
 class CachedResourceLoader;
 class KURL;
+class MemoryObjectInfo;
 class ScriptExecutionContext;
 class SecurityOrigin;
 struct SecurityOriginHash;
@@ -168,6 +169,8 @@ public:
     unsigned liveSize() const { return m_liveSize; }
     unsigned deadSize() const { return m_deadSize; }
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     MemoryCache();
     ~MemoryCache(); // Not implemented to make sure nobody accidentally calls delete -- WebCore does not delete singletons.
diff --git a/Source/WebCore/page/Chrome.cpp b/Source/WebCore/page/Chrome.cpp
index f9fa194ae..436222d88 100644
--- a/Source/WebCore/page/Chrome.cpp
+++ b/Source/WebCore/page/Chrome.cpp
@@ -489,7 +489,7 @@ void Chrome::scheduleAnimation()
 
 // --------
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 void ChromeClient::dashboardRegionsChanged()
 {
 }
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index a9c86ed40..dd6afcfe1 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -203,7 +203,7 @@ namespace WebCore {
         // the new cache.
         virtual void reachedApplicationCacheOriginQuota(SecurityOrigin*, int64_t totalSpaceNeeded) = 0;
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
         virtual void dashboardRegionsChanged();
 #endif
 
@@ -351,6 +351,8 @@ namespace WebCore {
 
         virtual void logDiagnosticMessage(const String& message, const String& description, const String& status) { UNUSED_PARAM(message); UNUSED_PARAM(description); UNUSED_PARAM(status); }
 
+        virtual FloatSize minimumWindowSize() const { return FloatSize(100, 100); };
+
     protected:
         virtual ~ChromeClient() { }
     };
diff --git a/Source/WebCore/page/Console.cpp b/Source/WebCore/page/Console.cpp
index 1e67f3093..d0e5e4fe7 100644
--- a/Source/WebCore/page/Console.cpp
+++ b/Source/WebCore/page/Console.cpp
@@ -262,7 +262,7 @@ void Console::count(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCall
 
 void Console::markTimeline(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack>)
 {
-    InspectorInstrumentation::consoleTimeStamp(page(), arguments);
+    InspectorInstrumentation::consoleTimeStamp(m_frame, arguments);
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -308,7 +308,7 @@ void Console::profileEnd(const String& title, ScriptState* state, PassRefPtr<Scr
 
 void Console::time(const String& title)
 {
-    InspectorInstrumentation::startConsoleTiming(page(), title);
+    InspectorInstrumentation::startConsoleTiming(m_frame, title);
 #if PLATFORM(CHROMIUM)
     TRACE_EVENT_COPY_ASYNC_BEGIN0("webkit", title.utf8().data(), this);
 #endif
@@ -319,12 +319,12 @@ void Console::timeEnd(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack> c
 #if PLATFORM(CHROMIUM)
     TRACE_EVENT_COPY_ASYNC_END0("webkit", title.utf8().data(), this);
 #endif
-    InspectorInstrumentation::stopConsoleTiming(page(), title, callStack);
+    InspectorInstrumentation::stopConsoleTiming(m_frame, title, callStack);
 }
 
 void Console::timeStamp(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack>)
 {
-    InspectorInstrumentation::consoleTimeStamp(page(), arguments);
+    InspectorInstrumentation::consoleTimeStamp(m_frame, arguments);
 }
 
 void Console::group(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
index 8431b4c25..55faf8738 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.cpp
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -185,7 +185,7 @@ private:
 
 class CSPSourceList {
 public:
-    explicit CSPSourceList(SecurityOrigin*);
+    CSPSourceList(ContentSecurityPolicy*, const String& directiveName);
 
     void parse(const String&);
     bool matches(const KURL&);
@@ -195,7 +195,7 @@ public:
 private:
     void parse(const UChar* begin, const UChar* end);
 
-    bool parseSource(const UChar* begin, const UChar* end, String& scheme, String& host, int& port, bool& hostHasWildcard, bool& portHasWildcard);
+    bool parseSource(const UChar* begin, const UChar* end, String& scheme, String& host, int& port, String& path, bool& hostHasWildcard, bool& portHasWildcard);
     bool parseScheme(const UChar* begin, const UChar* end, String& scheme);
     bool parseHost(const UChar* begin, const UChar* end, String& host, bool& hostHasWildcard);
     bool parsePort(const UChar* begin, const UChar* end, int& port, bool& portHasWildcard);
@@ -206,15 +206,17 @@ private:
     void addSourceUnsafeInline();
     void addSourceUnsafeEval();
 
-    SecurityOrigin* m_origin;
+    ContentSecurityPolicy* m_policy;
     Vector<CSPSource> m_list;
+    String m_directiveName;
     bool m_allowStar;
     bool m_allowInline;
     bool m_allowEval;
 };
 
-CSPSourceList::CSPSourceList(SecurityOrigin* origin)
-    : m_origin(origin)
+CSPSourceList::CSPSourceList(ContentSecurityPolicy* policy, const String& directiveName)
+    : m_policy(policy)
+    , m_directiveName(directiveName)
     , m_allowStar(false)
     , m_allowInline(false)
     , m_allowEval(false)
@@ -256,16 +258,24 @@ void CSPSourceList::parse(const UChar* begin, const UChar* end)
             return; // We represent 'none' as an empty m_list.
         isFirstSourceInList = false;
 
-        String scheme, host;
+        String scheme, host, path;
         int port = 0;
         bool hostHasWildcard = false;
         bool portHasWildcard = false;
 
-        if (parseSource(beginSource, position, scheme, host, port, hostHasWildcard, portHasWildcard)) {
+        if (parseSource(beginSource, position, scheme, host, port, path, hostHasWildcard, portHasWildcard)) {
+            // Wildcard hosts and keyword sources ('self', 'unsafe-inline',
+            // etc.) aren't stored in m_list, but as attributes on the source
+            // list itself.
+            if (scheme.isEmpty() && host.isEmpty())
+                continue;
             if (scheme.isEmpty())
-                scheme = m_origin->protocol();
+                scheme = m_policy->securityOrigin()->protocol();
+            if (!path.isEmpty())
+                m_policy->reportIgnoredPathComponent(m_directiveName, String(beginSource, position - beginSource), path);
             m_list.append(CSPSource(scheme, host, port, hostHasWildcard, portHasWildcard));
-        }
+        } else
+            m_policy->reportInvalidSourceExpression(m_directiveName, String(beginSource, position - beginSource));
 
         ASSERT(position == end || isASCIISpace(*position));
      }
@@ -276,32 +286,30 @@ void CSPSourceList::parse(const UChar* begin, const UChar* end)
 //                   / "'self'"
 //
 bool CSPSourceList::parseSource(const UChar* begin, const UChar* end,
-                                String& scheme, String& host, int& port,
+                                String& scheme, String& host, int& port, String& path,
                                 bool& hostHasWildcard, bool& portHasWildcard)
 {
-    String path; // FIXME: We're ignoring the path component for now.
-
     if (begin == end)
         return false;
 
     if (end - begin == 1 && *begin == '*') {
         addSourceStar();
-        return false;
+        return true;
     }
 
     if (equalIgnoringCase("'self'", begin, end - begin)) {
         addSourceSelf();
-        return false;
+        return true;
     }
 
     if (equalIgnoringCase("'unsafe-inline'", begin, end - begin)) {
         addSourceUnsafeInline();
-        return false;
+        return true;
     }
 
     if (equalIgnoringCase("'unsafe-eval'", begin, end - begin)) {
         addSourceUnsafeEval();
-        return false;
+        return true;
     }
 
     const UChar* position = begin;
@@ -496,7 +504,7 @@ bool CSPSourceList::parsePort(const UChar* begin, const UChar* end, int& port, b
 
 void CSPSourceList::addSourceSelf()
 {
-    m_list.append(CSPSource(m_origin->protocol(), m_origin->host(), m_origin->port(), false, false));
+    m_list.append(CSPSource(m_policy->securityOrigin()->protocol(), m_policy->securityOrigin()->host(), m_policy->securityOrigin()->port(), false, false));
 }
 
 void CSPSourceList::addSourceStar()
@@ -516,10 +524,10 @@ void CSPSourceList::addSourceUnsafeEval()
 
 class CSPDirective {
 public:
-    CSPDirective(const String& name, const String& value, ScriptExecutionContext* context)
-        : m_sourceList(context->securityOrigin())
+    CSPDirective(const String& name, const String& value, ContentSecurityPolicy* policy)
+        : m_sourceList(policy, name)
         , m_text(name + ' ' + value)
-        , m_selfURL(context->url())
+        , m_selfURL(policy->url())
     {
         m_sourceList.parse(value);
     }
@@ -542,7 +550,7 @@ private:
 
 class CSPDirectiveList {
 public:
-    static PassOwnPtr<CSPDirectiveList> create(ScriptExecutionContext*, const String&, ContentSecurityPolicy::HeaderType);
+    static PassOwnPtr<CSPDirectiveList> create(ContentSecurityPolicy*, const String&, ContentSecurityPolicy::HeaderType);
 
     const String& header() const { return m_header; }
     ContentSecurityPolicy::HeaderType headerType() const { return m_reportOnly ? ContentSecurityPolicy::ReportOnly : ContentSecurityPolicy::EnforcePolicy; }
@@ -566,7 +574,7 @@ public:
     void gatherReportURIs(DOMStringList&) const;
 
 private:
-    explicit CSPDirectiveList(ScriptExecutionContext*);
+    explicit CSPDirectiveList(ContentSecurityPolicy*);
 
     void parse(const String&);
 
@@ -580,9 +588,6 @@ private:
 
     CSPDirective* operativeDirective(CSPDirective*) const;
     void reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL = KURL(), const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), PassRefPtr<ScriptCallStack> = 0) const;
-    void logUnrecognizedDirective(const String& name) const;
-    void logDuplicateDirective(const String& name) const;
-    void logInvalidNonce(const String& nonce) const;
 
     bool checkEval(CSPDirective*) const;
     bool checkInline(CSPDirective*) const;
@@ -596,7 +601,7 @@ private:
 
     bool denyIfEnforcingPolicy() const { return m_reportOnly; }
 
-    ScriptExecutionContext* m_scriptExecutionContext;
+    ContentSecurityPolicy* m_policy;
     String m_header;
 
     bool m_reportOnly;
@@ -616,97 +621,35 @@ private:
     String m_scriptNonce;
 };
 
-CSPDirectiveList::CSPDirectiveList(ScriptExecutionContext* scriptExecutionContext)
-    : m_scriptExecutionContext(scriptExecutionContext)
+CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy)
+    : m_policy(policy)
     , m_reportOnly(false)
     , m_haveSandboxPolicy(false)
 {
 }
 
-PassOwnPtr<CSPDirectiveList> CSPDirectiveList::create(ScriptExecutionContext* scriptExecutionContext, const String& header, ContentSecurityPolicy::HeaderType type)
+PassOwnPtr<CSPDirectiveList> CSPDirectiveList::create(ContentSecurityPolicy* policy, const String& header, ContentSecurityPolicy::HeaderType type)
 {
-    OwnPtr<CSPDirectiveList> policy = adoptPtr(new CSPDirectiveList(scriptExecutionContext));
-    policy->parse(header);
-    policy->m_header = header;
+    OwnPtr<CSPDirectiveList> directives = adoptPtr(new CSPDirectiveList(policy));
+    directives->parse(header);
+    directives->m_header = header;
 
     switch (type) {
     case ContentSecurityPolicy::ReportOnly:
-        policy->m_reportOnly = true;
-        return policy.release();
+        directives->m_reportOnly = true;
+        return directives.release();
     case ContentSecurityPolicy::EnforcePolicy:
-        ASSERT(!policy->m_reportOnly);
+        ASSERT(!directives->m_reportOnly);
         break;
     }
 
-    if (!policy->checkEval(policy->operativeDirective(policy->m_scriptSrc.get())))
-        scriptExecutionContext->disableEval();
-
-    return policy.release();
+    return directives.release();
 }
 
 void CSPDirectiveList::reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL, const String& contextURL, const WTF::OrdinalNumber& contextLine, PassRefPtr<ScriptCallStack> callStack) const
 {
     String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleMessage;
-    m_scriptExecutionContext->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, contextURL, contextLine.oneBasedInt(), callStack);
-
-    if (m_reportURIs.isEmpty())
-        return;
-
-    // FIXME: Support sending reports from worker.
-    if (!m_scriptExecutionContext->isDocument())
-        return;
-
-    Document* document = static_cast<Document*>(m_scriptExecutionContext);
-    Frame* frame = document->frame();
-    if (!frame)
-        return;
-
-    // We need to be careful here when deciding what information to send to the
-    // report-uri. Currently, we send only the current document's URL and the
-    // directive that was violated. The document's URL is safe to send because
-    // it's the document itself that's requesting that it be sent. You could
-    // make an argument that we shouldn't send HTTPS document URLs to HTTP
-    // report-uris (for the same reasons that we supress the Referer in that
-    // case), but the Referer is sent implicitly whereas this request is only
-    // sent explicitly. As for which directive was violated, that's pretty
-    // harmless information.
-
-    RefPtr<InspectorObject> cspReport = InspectorObject::create();
-    cspReport->setString("document-uri", document->url().strippedForUseAsReferrer());
-    String referrer = document->referrer();
-    if (!referrer.isEmpty())
-        cspReport->setString("referrer", referrer);
-    if (!directiveText.isEmpty())
-        cspReport->setString("violated-directive", directiveText);
-    cspReport->setString("original-policy", m_header);
-    if (blockedURL.isValid())
-        cspReport->setString("blocked-uri", document->securityOrigin()->canRequest(blockedURL) ? blockedURL.strippedForUseAsReferrer() : SecurityOrigin::create(blockedURL)->toString());
-
-    RefPtr<InspectorObject> reportObject = InspectorObject::create();
-    reportObject->setObject("csp-report", cspReport.release());
-
-    RefPtr<FormData> report = FormData::create(reportObject->toJSONString().utf8());
-
-    for (size_t i = 0; i < m_reportURIs.size(); ++i)
-        PingLoader::reportContentSecurityPolicyViolation(frame, m_reportURIs[i], report);
-}
-
-void CSPDirectiveList::logUnrecognizedDirective(const String& name) const
-{
-    String message = makeString("Unrecognized Content-Security-Policy directive '", name, "'.\n");
-    m_scriptExecutionContext->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message);
-}
-
-void CSPDirectiveList::logDuplicateDirective(const String& name) const
-{
-    String message = makeString("Ignoring duplicate Content-Security-Policy directive '", name, "'.\n");
-    m_scriptExecutionContext->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message);
-}
-
-void CSPDirectiveList::logInvalidNonce(const String& nonce) const
-{
-    String message = makeString("Ignoring invalid Content Security Policy script nonce: '", nonce, "'.\n");
-    m_scriptExecutionContext->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message);
+    m_policy->reportViolation(directiveText, message, blockedURL, m_reportURIs, m_header, contextURL, contextLine, callStack);
 }
 
 bool CSPDirectiveList::checkEval(CSPDirective* directive) const
@@ -937,12 +880,19 @@ bool CSPDirectiveList::parseDirective(const UChar* begin, const UChar* end, Stri
     const UChar* position = begin;
     skipWhile<isASCIISpace>(position, end);
 
+    // Empty directive (e.g. ";;;"). Exit early.
+    if (position == end)
+        return false;
+
     const UChar* nameBegin = position;
     skipWhile<isDirectiveNameCharacter>(position, end);
 
     // The directive-name must be non-empty.
-    if (nameBegin == position)
+    if (nameBegin == position) {
+        skipWhile<isNotASCIISpace>(position, end);
+        m_policy->reportUnrecognizedDirective(String(nameBegin, position - nameBegin));
         return false;
+    }
 
     name = String(nameBegin, position - nameBegin);
 
@@ -951,7 +901,7 @@ bool CSPDirectiveList::parseDirective(const UChar* begin, const UChar* end, Stri
 
     if (!skipExactly<isASCIISpace>(position, end)) {
         skipWhile<isNotASCIISpace>(position, end);
-        logUnrecognizedDirective(String(nameBegin, position - nameBegin));
+        m_policy->reportUnrecognizedDirective(String(nameBegin, position - nameBegin));
         return false;
     }
 
@@ -974,7 +924,7 @@ bool CSPDirectiveList::parseDirective(const UChar* begin, const UChar* end, Stri
 void CSPDirectiveList::parseReportURI(const String& name, const String& value)
 {
     if (!m_reportURIs.isEmpty()) {
-        logDuplicateDirective(name);
+        m_policy->reportDuplicateDirective(name);
         return;
     }
     const UChar* position = value.characters();
@@ -988,7 +938,7 @@ void CSPDirectiveList::parseReportURI(const String& name, const String& value)
 
         if (urlBegin < position) {
             String url = String(urlBegin, position - urlBegin);
-            m_reportURIs.append(m_scriptExecutionContext->completeURL(url));
+            m_reportURIs.append(m_policy->completeURL(url));
         }
     }
 }
@@ -996,7 +946,7 @@ void CSPDirectiveList::parseReportURI(const String& name, const String& value)
 void CSPDirectiveList::parseScriptNonce(const String& name, const String& value)
 {
     if (!m_scriptNonce.isNull()) {
-        logDuplicateDirective(name);
+        m_policy->reportDuplicateDirective(name);
         return;
     }
 
@@ -1007,7 +957,7 @@ void CSPDirectiveList::parseScriptNonce(const String& name, const String& value)
     skipWhile<isASCIISpace>(position, end);
     const UChar* nonceBegin = position;
     if (position == end) {
-        logInvalidNonce(String());
+        m_policy->reportInvalidNonce(String());
         m_scriptNonce = "";
         return;
     }
@@ -1019,7 +969,7 @@ void CSPDirectiveList::parseScriptNonce(const String& name, const String& value)
     // an error.
     skipWhile<isASCIISpace>(position, end);
     if (position < end) {
-        logInvalidNonce(value);
+        m_policy->reportInvalidNonce(value);
         m_scriptNonce = "";
     } else
         m_scriptNonce = nonce;
@@ -1028,20 +978,20 @@ void CSPDirectiveList::parseScriptNonce(const String& name, const String& value)
 void CSPDirectiveList::setCSPDirective(const String& name, const String& value, OwnPtr<CSPDirective>& directive)
 {
     if (directive) {
-        logDuplicateDirective(name);
+        m_policy->reportDuplicateDirective(name);
         return;
     }
-    directive = adoptPtr(new CSPDirective(name, value, m_scriptExecutionContext));
+    directive = adoptPtr(new CSPDirective(name, value, m_policy));
 }
 
 void CSPDirectiveList::applySandboxPolicy(const String& name, const String& sandboxPolicy)
 {
     if (m_haveSandboxPolicy) {
-        logDuplicateDirective(name);
+        m_policy->reportDuplicateDirective(name);
         return;
     }
     m_haveSandboxPolicy = true;
-    m_scriptExecutionContext->enforceSandboxFlags(SecurityContext::parseSandboxPolicy(sandboxPolicy));
+    m_policy->enforceSandboxFlags(SecurityContext::parseSandboxPolicy(sandboxPolicy));
 }
 
 void CSPDirectiveList::addDirective(const String& name, const String& value)
@@ -1090,7 +1040,7 @@ void CSPDirectiveList::addDirective(const String& name, const String& value)
         parseScriptNonce(name, value);
 #endif
     else
-        logUnrecognizedDirective(name);
+        m_policy->reportUnrecognizedDirective(name);
 }
 
 ContentSecurityPolicy::ContentSecurityPolicy(ScriptExecutionContext* scriptExecutionContext)
@@ -1123,13 +1073,16 @@ void ContentSecurityPolicy::didReceiveHeader(const String& header, HeaderType ty
 
         // header1,header2 OR header1
         //        ^                  ^
-        m_policies.append(CSPDirectiveList::create(m_scriptExecutionContext, String(begin, position - begin), type));
+        m_policies.append(CSPDirectiveList::create(this, String(begin, position - begin), type));
 
         // Skip the comma, and begin the next header from the current position.
         ASSERT(position == end || *position == ',');
         skipExactly(position, end, ',');
         begin = position;
     }
+
+    if (!allowEval(0, SuppressReport))
+        m_scriptExecutionContext->disableEval();
 }
 
 void ContentSecurityPolicy::setOverrideAllowInlineStyle(bool value)
@@ -1273,4 +1226,105 @@ void ContentSecurityPolicy::gatherReportURIs(DOMStringList& list) const
         m_policies[i].get()->gatherReportURIs(list);
 }
 
+SecurityOrigin* ContentSecurityPolicy::securityOrigin() const
+{
+    return m_scriptExecutionContext->securityOrigin();
+}
+
+const KURL& ContentSecurityPolicy::url() const
+{
+    return m_scriptExecutionContext->url();
+}
+
+KURL ContentSecurityPolicy::completeURL(const String& url) const
+{
+    return m_scriptExecutionContext->completeURL(url);
+}
+
+void ContentSecurityPolicy::enforceSandboxFlags(SandboxFlags mask) const
+{
+    m_scriptExecutionContext->enforceSandboxFlags(mask);
+}
+
+void ContentSecurityPolicy::reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL, const Vector<KURL>& reportURIs, const String& header, const String& contextURL, const WTF::OrdinalNumber& contextLine, PassRefPtr<ScriptCallStack> callStack) const
+{
+    logToConsole(consoleMessage, contextURL, contextLine, callStack);
+
+    if (reportURIs.isEmpty())
+        return;
+
+    // FIXME: Support sending reports from worker.
+    if (!m_scriptExecutionContext->isDocument())
+        return;
+
+    Document* document = static_cast<Document*>(m_scriptExecutionContext);
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+
+    // We need to be careful here when deciding what information to send to the
+    // report-uri. Currently, we send only the current document's URL and the
+    // directive that was violated. The document's URL is safe to send because
+    // it's the document itself that's requesting that it be sent. You could
+    // make an argument that we shouldn't send HTTPS document URLs to HTTP
+    // report-uris (for the same reasons that we supress the Referer in that
+    // case), but the Referer is sent implicitly whereas this request is only
+    // sent explicitly. As for which directive was violated, that's pretty
+    // harmless information.
+
+    RefPtr<InspectorObject> cspReport = InspectorObject::create();
+    cspReport->setString("document-uri", document->url().strippedForUseAsReferrer());
+    String referrer = document->referrer();
+    if (!referrer.isEmpty())
+        cspReport->setString("referrer", referrer);
+    if (!directiveText.isEmpty())
+        cspReport->setString("violated-directive", directiveText);
+    cspReport->setString("original-policy", header);
+    if (blockedURL.isValid())
+        cspReport->setString("blocked-uri", document->securityOrigin()->canRequest(blockedURL) ? blockedURL.strippedForUseAsReferrer() : SecurityOrigin::create(blockedURL)->toString());
+
+    RefPtr<InspectorObject> reportObject = InspectorObject::create();
+    reportObject->setObject("csp-report", cspReport.release());
+
+    RefPtr<FormData> report = FormData::create(reportObject->toJSONString().utf8());
+
+    for (size_t i = 0; i < reportURIs.size(); ++i)
+        PingLoader::reportContentSecurityPolicyViolation(frame, reportURIs[i], report);
+}
+
+void ContentSecurityPolicy::reportUnrecognizedDirective(const String& name) const
+{
+    String message = makeString("Unrecognized Content-Security-Policy directive '", name, "'.\n");
+    logToConsole(message);
+}
+
+void ContentSecurityPolicy::reportDuplicateDirective(const String& name) const
+{
+    String message = makeString("Ignoring duplicate Content-Security-Policy directive '", name, "'.\n");
+    logToConsole(message);
+}
+
+void ContentSecurityPolicy::reportInvalidNonce(const String& nonce) const
+{
+    String message = makeString("Ignoring invalid Content Security Policy script nonce: '", nonce, "'.\n");
+    logToConsole(message);
+}
+
+void ContentSecurityPolicy::reportIgnoredPathComponent(const String& directiveName, const String& completeSource, const String& path) const
+{
+    String message = makeString("The source list for Content Security Policy directive '", directiveName, "' contains the source '", completeSource, "'. Content Security Policy 1.0 supports only schemes, hosts, and ports. Paths might be supported in the future, but for now, '", path, "' is being ignored. Be careful.");
+    logToConsole(message);
+}
+
+void ContentSecurityPolicy::reportInvalidSourceExpression(const String& directiveName, const String& source) const
+{
+    String message = makeString("The source list for Content Security Policy directive '", directiveName, "' contains an invalid source: '", source, "'. It will be ignored.");
+    logToConsole(message);
+}
+
+void ContentSecurityPolicy::logToConsole(const String& message, const String& contextURL, const WTF::OrdinalNumber& contextLine, PassRefPtr<ScriptCallStack> callStack) const
+{
+    m_scriptExecutionContext->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, contextURL, contextLine.oneBasedInt(), callStack);
+}
+
 }
diff --git a/Source/WebCore/page/ContentSecurityPolicy.h b/Source/WebCore/page/ContentSecurityPolicy.h
index cdb6b5f89..51f3869a2 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.h
+++ b/Source/WebCore/page/ContentSecurityPolicy.h
@@ -30,6 +30,7 @@
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
+#include <wtf/text/TextPosition.h>
 #include <wtf/text/WTFString.h>
 
 namespace WTF {
@@ -42,7 +43,9 @@ class CSPDirectiveList;
 class ScriptCallStack;
 class DOMStringList;
 class ScriptExecutionContext;
+class SecurityOrigin;
 
+typedef int SandboxFlags;
 typedef Vector<OwnPtr<CSPDirectiveList> > CSPDirectiveListVector;
 
 class ContentSecurityPolicy {
@@ -93,9 +96,23 @@ public:
     bool isActive() const;
     void gatherReportURIs(DOMStringList&) const;
 
+    void reportDuplicateDirective(const String&) const;
+    void reportIgnoredPathComponent(const String& directiveName, const String& completeSource, const String& path) const;
+    void reportInvalidNonce(const String&) const;
+    void reportInvalidSourceExpression(const String& directiveName, const String& source) const;
+    void reportUnrecognizedDirective(const String&) const;
+    void reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL, const Vector<KURL>& reportURIs, const String& header, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), PassRefPtr<ScriptCallStack> = 0) const;
+
+    const KURL& url() const;
+    KURL completeURL(const String&) const;
+    SecurityOrigin* securityOrigin() const;
+    void enforceSandboxFlags(SandboxFlags) const;
+
 private:
     explicit ContentSecurityPolicy(ScriptExecutionContext*);
 
+    void logToConsole(const String& message, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), PassRefPtr<ScriptCallStack> = 0) const;
+
     ScriptExecutionContext* m_scriptExecutionContext;
     bool m_overrideInlineStyleAllowed;
     CSPDirectiveListVector m_policies;
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 2e198373e..448150363 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -34,6 +34,7 @@
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSRuleList.h"
 #include "Chrome.h"
+#include "ChromeClient.h"
 #include "Console.h"
 #include "Crypto.h"
 #include "DOMApplicationCache.h"
@@ -308,14 +309,14 @@ void DOMWindow::dispatchAllPendingUnloadEvents()
 
 // This function:
 // 1) Validates the pending changes are not changing to NaN
-// 2) Constrains the window rect to no smaller than 100 in each dimension and no
-//    bigger than the the float rect's dimensions.
+// 2) Constrains the window rect to the minimum window size and no bigger than
+//    the the float rect's dimensions.
 // 3) Constrain window rect to within the top and left boundaries of the screen rect
 // 4) Constraint the window rect to within the bottom and right boundaries of the
 //    screen rect.
 // 5) Translate the window rect coordinates to be within the coordinate space of
 //    the screen rect.
-void DOMWindow::adjustWindowRect(const FloatRect& screen, FloatRect& window, const FloatRect& pendingChanges)
+void DOMWindow::adjustWindowRect(const FloatRect& screen, FloatRect& window, const FloatRect& pendingChanges) const
 {
     // Make sure we're in a valid state before adjusting dimensions.
     ASSERT(isfinite(screen.x()));
@@ -336,11 +337,13 @@ void DOMWindow::adjustWindowRect(const FloatRect& screen, FloatRect& window, con
         window.setWidth(pendingChanges.width());
     if (!isnan(pendingChanges.height()))
         window.setHeight(pendingChanges.height());
-    
-    // Resize the window to between 100 and the screen width and height.
-    window.setWidth(min(max(100.0f, window.width()), screen.width()));
-    window.setHeight(min(max(100.0f, window.height()), screen.height()));
-    
+
+    ASSERT(m_frame);
+    Page* page = m_frame->page();
+    FloatSize minimumSize = page ? m_frame->page()->chrome()->client()->minimumWindowSize() : FloatSize(100, 100);
+    window.setWidth(min(max(minimumSize.width(), window.width()), screen.width()));
+    window.setHeight(min(max(minimumSize.height(), window.height()), screen.height()));
+
     // Constrain the window position to the screen.
     window.setX(max(screen.x(), min(window.x(), screen.maxX() - window.width())));
     window.setY(max(screen.y(), min(window.y(), screen.maxY() - window.height())));
@@ -418,9 +421,6 @@ DOMWindow::~DOMWindow()
         ASSERT(!m_sessionStorage);
         ASSERT(!m_localStorage);
         ASSERT(!m_applicationCache);
-#if ENABLE(BLOB)
-        ASSERT(!m_domURL);
-#endif
     }
 #endif
 
@@ -587,9 +587,6 @@ void DOMWindow::clearDOMWindowProperties()
     m_sessionStorage = 0;
     m_localStorage = 0;
     m_applicationCache = 0;
-#if ENABLE(BLOB)
-    m_domURL = 0;
-#endif
 }
 
 bool DOMWindow::isCurrentlyDisplayedInFrame() const
@@ -746,7 +743,7 @@ Storage* DOMWindow::sessionStorage(ExceptionCode& ec) const
     if (!document)
         return 0;
 
-    if (!document->securityOrigin()->canAccessLocalStorage()) {
+    if (!document->securityOrigin()->canAccessLocalStorage(document->topDocument()->securityOrigin())) {
         ec = SECURITY_ERR;
         return 0;
     }
@@ -773,7 +770,7 @@ Storage* DOMWindow::localStorage(ExceptionCode& ec) const
     if (!document)
         return 0;
 
-    if (!document->securityOrigin()->canAccessLocalStorage()) {
+    if (!document->securityOrigin()->canAccessLocalStorage(document->topDocument()->securityOrigin())) {
         ec = SECURITY_ERR;
         return 0;
     }
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index 1f82fdb1f..0b7ff93f0 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -111,7 +111,7 @@ namespace WebCore {
         static bool dispatchAllPendingBeforeUnloadEvents();
         static void dispatchAllPendingUnloadEvents();
 
-        static void adjustWindowRect(const FloatRect& screen, FloatRect& window, const FloatRect& pendingChanges);
+        void adjustWindowRect(const FloatRect& screen, FloatRect& window, const FloatRect& pendingChanges) const;
 
         // FIXME: We can remove this function once V8 showModalDialog is changed to use DOMWindow.
         static void parseModalDialogFeatures(const String&, HashMap<String, String>&);
@@ -353,6 +353,10 @@ namespace WebCore {
         DEFINE_ATTRIBUTE_EVENT_LISTENER(deviceorientation);
 #endif
 
+#if ENABLE(PROXIMITY_EVENTS)
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitdeviceproximity);
+#endif
+
         // HTML 5 key/value storage
         Storage* sessionStorage(ExceptionCode&) const;
         Storage* localStorage(ExceptionCode&) const;
@@ -448,10 +452,6 @@ namespace WebCore {
 #if ENABLE(WEB_TIMING)
         mutable RefPtr<Performance> m_performance;
 #endif
-
-#if ENABLE(BLOB)
-        mutable RefPtr<DOMURL> m_domURL;
-#endif
     };
 
     inline String DOMWindow::status() const
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index a53336a1d..53495918d 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -313,6 +313,8 @@ module window {
         attribute [Conditional=DEVICE_ORIENTATION,V8EnabledAtRuntime] EventListener ondevicemotion;
         attribute [Conditional=DEVICE_ORIENTATION,V8EnabledAtRuntime] EventListener ondeviceorientation;
 
+        attribute [Conditional=PROXIMITY_EVENTS] EventListener onwebkitdeviceproximity;
+
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type,
                                       in EventListener listener,
@@ -551,6 +553,7 @@ module window {
         attribute StorageEventConstructor StorageEvent;
         attribute [Conditional=INPUT_SPEECH] SpeechInputEventConstructor SpeechInputEvent;
         attribute [Conditional=WEBGL] WebGLContextEventConstructor WebGLContextEvent;
+        attribute [Conditional=PROXIMITY_EVENTS] DeviceProximityEventConstructor DeviceProximityEvent;
 
         attribute EventExceptionConstructor EventException;
 
@@ -778,10 +781,12 @@ module window {
 
         attribute [Conditional=BLOB&LEGACY_WEBKIT_BLOB_BUILDER] WebKitBlobBuilderConstructor WebKitBlobBuilder;
 
-        attribute [Conditional=BLOB] DOMURLConstructor webkitURL;
+        attribute [Conditional=BLOB] DOMURLConstructor URL;
+        attribute [Conditional=BLOB] DOMURLConstructor webkitURL; // FIXME: deprecate this.
 
         attribute [Conditional=MUTATION_OBSERVERS] MutationObserverConstructor WebKitMutationObserver;
 
+        attribute [Conditional=MEDIA_SOURCE, V8EnabledAtRuntime=mediaSource] MediaSourceConstructor MediaSource;
         attribute [Conditional=MEDIA_SOURCE, V8EnabledAtRuntime=mediaSource] SourceBufferConstructor SourceBuffer;
         attribute [Conditional=MEDIA_SOURCE, V8EnabledAtRuntime=mediaSource] SourceBufferListConstructor SourceBufferList;
 
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 1ac1ed338..b8205751b 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -254,7 +254,7 @@ void DragController::mouseMovedIntoDocument(Document* newDocument)
 DragSession DragController::dragEnteredOrUpdated(DragData* dragData)
 {
     ASSERT(dragData);
-    ASSERT(m_page->mainFrame()); // It is not possible in Mac WebKit to have a Page without a mainFrame()
+    ASSERT(m_page->mainFrame());
     mouseMovedIntoDocument(m_page->mainFrame()->documentAtPoint(dragData->clientPosition()));
 
     m_dragDestinationAction = m_client->actionMaskForDrag(dragData);
@@ -892,6 +892,9 @@ void DragController::doSystemDrag(DragImageRef image, const IntPoint& dragLoc, c
     RefPtr<FrameView> viewProtector = frameProtector->view();
     m_client->startDrag(image, viewProtector->rootViewToContents(frame->view()->contentsToRootView(dragLoc)),
         viewProtector->rootViewToContents(frame->view()->contentsToRootView(eventPos)), clipboard, frameProtector.get(), forLink);
+    // DragClient::startDrag can cause our Page to dispear, deallocating |this|.
+    if (!frameProtector->page())
+        return;
 
     cleanupAfterSystemDrag();
 }
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 8eea3fa65..7a078e852 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -367,10 +367,11 @@ void EventHandler::clear()
 #if ENABLE(TOUCH_EVENTS)
     m_originatingTouchPointTargets.clear();
 #endif
-    m_maxMouseMovedDuration = 0;
 #if ENABLE(GESTURE_EVENTS)
-    m_baseEventType = PlatformEvent::NoType;
+    m_scrollGestureHandlingNode = 0;
 #endif
+    m_maxMouseMovedDuration = 0;
+    m_baseEventType = PlatformEvent::NoType;
 }
 
 void EventHandler::nodeWillBeRemoved(Node* nodeToBeRemoved)
@@ -2413,6 +2414,34 @@ bool EventHandler::handleGestureTapDown()
 
 bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
 {
+    // We don't use DoubleTap at the moment, it's mostly redundant with tap since tap now contains
+    // a tap count. FIXME: We should probably remove GestureDoubleTap (http://wkb.ug/93045).
+    if (gestureEvent.type() == PlatformEvent::GestureDoubleTap)
+        return false;
+
+    Node* eventTarget = 0;
+    if (gestureEvent.type() == PlatformEvent::GestureScrollEnd || gestureEvent.type() == PlatformEvent::GestureScrollUpdate)
+        eventTarget = m_scrollGestureHandlingNode.get();
+
+    if (!eventTarget) {
+        HitTestResult result = hitTestResultAtPoint(gestureEvent.position(), false, false, DontHitTestScrollbars, HitTestRequest::ReadOnly | HitTestRequest::Active);
+        eventTarget = targetNode(result);
+    }
+
+    if (eventTarget) {
+        bool eventSwallowed = eventTarget->dispatchGestureEvent(gestureEvent);
+
+        if (gestureEvent.type() == PlatformEvent::GestureScrollBegin) {
+            if (eventSwallowed)
+                m_scrollGestureHandlingNode = eventTarget;
+            else
+                m_scrollGestureHandlingNode = 0;
+        }
+
+        if (eventSwallowed)
+            return true;
+    }
+
     // FIXME: A more general scroll system (https://bugs.webkit.org/show_bug.cgi?id=80596) will
     // eliminate the need for this.
     TemporaryChange<PlatformEvent::Type> baseEventType(m_baseEventType, gestureEvent.type());
@@ -2443,25 +2472,35 @@ bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
 
 bool EventHandler::handleGestureTap(const PlatformGestureEvent& gestureEvent)
 {
-    // FIXME: Refactor this code to not hit test multiple times.
+    // FIXME: Refactor this code to not hit test multiple times. We use the adjusted position to ensure that the correct node is targeted by the later redundant hit tests.
     IntPoint adjustedPoint = gestureEvent.position();
 #if ENABLE(TOUCH_ADJUSTMENT)
-    if (!gestureEvent.area().isEmpty()) {
-        Node* targetNode = 0;
-        // For now we use the adjusted position to ensure the later redundant hit-tests hits the right node.
-        bestClickableNodeForTouchPoint(gestureEvent.position(), IntSize(gestureEvent.area().width() / 2, gestureEvent.area().height() / 2), adjustedPoint, targetNode);
-        if (!targetNode)
-            return false;
-    }
+    if (!gestureEvent.area().isEmpty() && !adjustGesturePosition(gestureEvent, adjustedPoint))
+        return false;
 #endif
 
-    bool defaultPrevented = false;
-    PlatformMouseEvent fakeMouseMove(adjustedPoint, gestureEvent.globalPosition(), NoButton, PlatformEvent::MouseMoved, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
-    PlatformMouseEvent fakeMouseDown(adjustedPoint, gestureEvent.globalPosition(), LeftButton, PlatformEvent::MousePressed, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
-    PlatformMouseEvent fakeMouseUp(adjustedPoint, gestureEvent.globalPosition(), LeftButton, PlatformEvent::MouseReleased, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
+    PlatformMouseEvent fakeMouseMove(adjustedPoint, gestureEvent.globalPosition(),
+        NoButton, PlatformEvent::MouseMoved, /* clickCount */ 0,
+        gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
     mouseMoved(fakeMouseMove);
+
+    int tapCount = 1;
+    // FIXME: deletaX is overloaded to mean different things for different gestures.
+    // http://wkb.ug/93123
+    if (gestureEvent.deltaX() > 0)
+        tapCount = static_cast<int>(gestureEvent.deltaX());
+
+    bool defaultPrevented = false;
+    PlatformMouseEvent fakeMouseDown(adjustedPoint, gestureEvent.globalPosition(),
+        LeftButton, PlatformEvent::MousePressed, tapCount,
+        gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
     defaultPrevented |= handleMousePressEvent(fakeMouseDown);
+
+    PlatformMouseEvent fakeMouseUp(adjustedPoint, gestureEvent.globalPosition(),
+        LeftButton, PlatformEvent::MouseReleased, tapCount,
+        gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
     defaultPrevented |= handleMouseReleaseEvent(fakeMouseUp);
+
     return defaultPrevented;
 }
 
@@ -2514,6 +2553,13 @@ bool EventHandler::bestZoomableAreaForTouchPoint(const IntPoint& touchCenter, co
     RefPtr<StaticHashSetNodeList> nodeList = StaticHashSetNodeList::adopt(result.rectBasedTestResult());
     return findBestZoomableArea(targetNode, targetArea, touchCenter, touchRect, *nodeList.get());
 }
+
+bool EventHandler::adjustGesturePosition(const PlatformGestureEvent& gestureEvent, IntPoint& adjustedPoint)
+{
+    Node* targetNode = 0;
+    bestClickableNodeForTouchPoint(gestureEvent.position(), IntSize(gestureEvent.area().width() / 2, gestureEvent.area().height() / 2), adjustedPoint, targetNode);
+    return targetNode;
+}
 #endif
 
 #if ENABLE(CONTEXT_MENUS)
@@ -2625,7 +2671,13 @@ bool EventHandler::sendContextMenuEventForGesture(const PlatformGestureEvent& ev
 #else
     PlatformEvent::Type eventType = PlatformEvent::MousePressed;
 #endif
-    PlatformMouseEvent mouseEvent(event.position(), event.globalPosition(), RightButton, eventType, 1, false, false, false, false, WTF::currentTime());
+
+    IntPoint adjustedPoint = event.position();
+#if ENABLE(TOUCH_ADJUSTMENT)
+    if (!event.area().isEmpty())
+        adjustGesturePosition(event, adjustedPoint);
+#endif
+    PlatformMouseEvent mouseEvent(adjustedPoint, event.globalPosition(), RightButton, eventType, 1, false, false, false, false, WTF::currentTime());
     return sendContextMenuEvent(mouseEvent);
 }
 #endif // ENABLE(GESTURE_EVENTS)
diff --git a/Source/WebCore/page/EventHandler.h b/Source/WebCore/page/EventHandler.h
index 1d2d375c3..29dd9ce38 100644
--- a/Source/WebCore/page/EventHandler.h
+++ b/Source/WebCore/page/EventHandler.h
@@ -170,6 +170,10 @@ public:
 #if ENABLE(TOUCH_ADJUSTMENT)
     bool bestClickableNodeForTouchPoint(const IntPoint& touchCenter, const IntSize& touchRadius, IntPoint& targetPoint, Node*& targetNode);
     bool bestZoomableAreaForTouchPoint(const IntPoint& touchCenter, const IntSize& touchRadius, IntRect& targetArea, Node*& targetNode);
+
+    // FIXME: Add a gesture type parameter so that different candidate selection criteria may be used for
+    // different gesture types. Currently TouchAdjustment::nodeRespondsToTapGesture is used for all types.
+    bool adjustGesturePosition(const PlatformGestureEvent&, IntPoint& adjustedPoint);
 #endif
 
 #if ENABLE(CONTEXT_MENUS)
@@ -226,6 +230,8 @@ public:
     bool handleTouchEvent(const PlatformTouchEvent&);
 #endif
 
+    static Node* targetNode(const HitTestResult&);
+
 private:
 #if ENABLE(DRAG_SUPPORT)
     static DragState& dragState();
@@ -242,7 +248,6 @@ private:
     bool handleMouseDoubleClickEvent(const PlatformMouseEvent&);
 
     static Node* targetNode(const MouseEventWithHitTestResults&);
-    static Node* targetNode(const HitTestResult&);
 
     bool handleMousePressEvent(const MouseEventWithHitTestResults&);
     bool handleMousePressEventSingleClick(const MouseEventWithHitTestResults&);
@@ -446,6 +451,11 @@ private:
     TouchTargetMap m_originatingTouchPointTargets;
     bool m_touchPressed;
 #endif
+
+#if ENABLE(GESTURE_EVENTS)
+    RefPtr<Node> m_scrollGestureHandlingNode;
+#endif
+
     double m_maxMouseMovedDuration;
     PlatformEvent::Type m_baseEventType;
 };
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index bf582b473..bf9512bd2 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -352,7 +352,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
         // FIXME: May need a way to focus a document here.
         return false;
 
-    if (node->isFrameOwnerElement()) {
+    if (node->isFrameOwnerElement() && (!node->isPluginElement() || !node->isKeyboardFocusable(event))) {
         // We focus frames rather than frame owners.
         // FIXME: We should not focus frames that have no scrollbars, as focusing them isn't useful to the user.
         HTMLFrameOwnerElement* owner = static_cast<HTMLFrameOwnerElement*>(node.get());
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 569208fec..098810dcd 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -690,7 +690,7 @@ void Frame::dispatchVisibilityStateChangeEvent()
 
 void Frame::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<Frame> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
     info.addInstrumentedMember(m_doc.get());
     info.addInstrumentedMember(m_loader);
 }
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 931999495..cc53d99b0 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -1153,7 +1153,7 @@ void FrameView::layout(bool allowSubtree)
     if (AXObjectCache::accessibilityEnabled())
         root->document()->axObjectCache()->postNotification(root, AXObjectCache::AXLayoutComplete, true);
 #endif
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     updateDashboardRegions();
 #endif
 
@@ -1491,10 +1491,6 @@ bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
             regionToUpdate.unite(updateRect);
     }
 
-    // The area to be painted by fixed objects exceeds 50% of the area of the view, we cannot use the fast path.
-    if (regionToUpdate.totalArea() > (clipRect.width() * clipRect.height() * 0.5))
-        return false;
-
     // 1) scroll
     hostWindow()->scroll(scrollDelta, rectToScroll, clipRect);
 
@@ -2776,7 +2772,7 @@ bool FrameView::scrollAnimatorEnabled() const
     return false;
 }
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 void FrameView::updateDashboardRegions()
 {
     Document* document = m_frame->document();
@@ -3118,7 +3114,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
     m_paintBehavior = oldPaintBehavior;
     m_lastPaintTime = currentTime();
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     // Regions may have changed as a result of the visibility/z-index of element changing.
     if (document->dashboardRegionsDirty())
         updateDashboardRegions();
@@ -3150,6 +3146,36 @@ void FrameView::setNodeToDraw(Node* node)
     m_nodeToDraw = node;
 }
 
+void FrameView::paintContentsForSnapshot(GraphicsContext* context, const IntRect& imageRect, SelectionInSnaphot shouldPaintSelection)
+{
+    updateLayoutAndStyleIfNeededRecursive();
+
+    // Cache paint behavior and set a new behavior appropriate for snapshots.
+    PaintBehavior oldBehavior = paintBehavior();
+    setPaintBehavior(oldBehavior | PaintBehaviorFlattenCompositingLayers);
+
+    // If the snapshot should exclude selection, then we'll clear the current selection
+    // in the render tree only. This will allow us to restore the selection from the DOM
+    // after we paint the snapshot.
+    if (shouldPaintSelection == ExcludeSelection) {
+        for (Frame* frame = m_frame.get(); frame; frame = frame->tree()->traverseNext(m_frame.get())) {
+            if (RenderView* root = frame->contentRenderer())
+                root->clearSelection();
+        }
+    }
+
+    paintContents(context, imageRect);
+
+    // Restore selection.
+    if (shouldPaintSelection == ExcludeSelection) {
+        for (Frame* frame = m_frame.get(); frame; frame = frame->tree()->traverseNext(m_frame.get()))
+            frame->selection()->updateAppearance();
+    }
+
+    // Restore cached paint behavior.
+    setPaintBehavior(oldBehavior);
+}
+
 void FrameView::paintOverhangAreas(GraphicsContext* context, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect)
 {
     if (context->paintingDisabled())
@@ -3575,4 +3601,12 @@ AXObjectCache* FrameView::axObjectCache() const
     return 0;
 }
     
+void FrameView::setScrollingPerformanceLoggingEnabled(bool flag)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (TiledBacking* tiledBacking = this->tiledBacking())
+        tiledBacking->setScrollingPerformanceLoggingEnabled(flag);
+#endif
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index c6b50b73e..5ef006471 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -217,7 +217,7 @@ public:
     void endDisableRepaints();
     bool repaintsDisabled() { return m_disableRepaints > 0; }
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     void updateDashboardRegions();
 #endif
     void updateControlTints();
@@ -246,6 +246,9 @@ public:
     void setLastPaintTime(double lastPaintTime) { m_lastPaintTime = lastPaintTime; }
     void setNodeToDraw(Node*);
 
+    enum SelectionInSnaphot { IncludeSelection, ExcludeSelection };
+    void paintContentsForSnapshot(GraphicsContext*, const IntRect& imageRect, SelectionInSnaphot shouldPaintSelection);
+
     virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
     virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
     virtual void paintScrollbar(GraphicsContext*, Scrollbar*, const IntRect&) OVERRIDE;
@@ -339,6 +342,8 @@ public:
     // we need this function in order to do the scroll ourselves.
     bool wheelEvent(const PlatformWheelEvent&);
 
+    void setScrollingPerformanceLoggingEnabled(bool);
+
 protected:
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
     virtual void scrollContentsSlowPath(const IntRect& updateRect);
diff --git a/Source/WebCore/page/GestureTapHighlighter.h b/Source/WebCore/page/GestureTapHighlighter.h
index 1a47d71fd..e8015fe5c 100644
--- a/Source/WebCore/page/GestureTapHighlighter.h
+++ b/Source/WebCore/page/GestureTapHighlighter.h
@@ -43,4 +43,4 @@ Path pathForNodeHighlight(const Node*);
 
 } // namespace WebCore
 
-#endif // DOMNodeHighlighter_h
+#endif // GestureTapHighlighter__h
diff --git a/Source/WebCore/page/Navigator.cpp b/Source/WebCore/page/Navigator.cpp
index 1af15be49..7bf2b5b4b 100644
--- a/Source/WebCore/page/Navigator.cpp
+++ b/Source/WebCore/page/Navigator.cpp
@@ -34,7 +34,6 @@
 #include "Language.h"
 #include "Page.h"
 #include "PluginData.h"
-#include "PointerLock.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "StorageNamespace.h"
@@ -135,15 +134,6 @@ bool Navigator::javaEnabled() const
     return true;
 }
 
-#if ENABLE(POINTER_LOCK)
-PointerLock* Navigator::webkitPointer() const
-{
-    if (!m_pointer && m_frame && m_frame->page())
-        m_pointer = PointerLock::create(m_frame);
-    return m_pointer.get();
-}
-#endif
-
 void Navigator::getStorageUpdates()
 {
     // FIXME: Remove this method or rename to yieldForStorageUpdates.
diff --git a/Source/WebCore/page/Navigator.h b/Source/WebCore/page/Navigator.h
index b362b16f8..81e458a97 100644
--- a/Source/WebCore/page/Navigator.h
+++ b/Source/WebCore/page/Navigator.h
@@ -34,7 +34,6 @@ namespace WebCore {
 class DOMMimeTypeArray;
 class DOMPluginArray;
 class Frame;
-class PointerLock;
 class PluginData;
 
 typedef int ExceptionCode;
@@ -53,10 +52,6 @@ public:
 
     virtual String userAgent() const;
 
-#if ENABLE(POINTER_LOCK)
-    PointerLock* webkitPointer() const;
-#endif
-
     // Relinquishes the storage lock, if one exists.
     void getStorageUpdates();
 
@@ -65,9 +60,6 @@ private:
 
     mutable RefPtr<DOMPluginArray> m_plugins;
     mutable RefPtr<DOMMimeTypeArray> m_mimeTypes;
-#if ENABLE(POINTER_LOCK)
-    mutable RefPtr<PointerLock> m_pointer;
-#endif
 };
 
 }
diff --git a/Source/WebCore/page/Navigator.idl b/Source/WebCore/page/Navigator.idl
index 8f380a187..3c2af01c9 100644
--- a/Source/WebCore/page/Navigator.idl
+++ b/Source/WebCore/page/Navigator.idl
@@ -40,10 +40,6 @@ module window {
 
         readonly attribute boolean onLine;
 
-#if defined(ENABLE_POINTER_LOCK) && ENABLE_POINTER_LOCK // FIXME: Remove reliance on PointerLock.idl when removing old Pointer Lock API. (https://bugs.webkit.org/show_bug.cgi?id=84402)
-        readonly attribute [Conditional=POINTER_LOCK, V8EnabledAtRuntime=pointerLock] PointerLock webkitPointer;
-#endif
-
         void getStorageUpdates(); // FIXME: Remove this method or rename to yieldForStorageUpdates.
     };
 
diff --git a/Source/WebCore/page/Page.cpp b/Source/WebCore/page/Page.cpp
index f10677c23..8c70f7854 100644
--- a/Source/WebCore/page/Page.cpp
+++ b/Source/WebCore/page/Page.cpp
@@ -709,13 +709,11 @@ unsigned Page::pageCount() const
         return 0;
 
     FrameView* frameView = mainFrame()->view();
-    if (!frameView->didFirstLayout())
-        return 0;
-
-    mainFrame()->view()->forceLayout();
+    if (frameView->needsLayout())
+        frameView->layout();
 
     RenderView* contentRenderer = mainFrame()->contentRenderer();
-    return contentRenderer->columnCount(contentRenderer->columnInfo());
+    return contentRenderer ? contentRenderer->columnCount(contentRenderer->columnInfo()) : 0;
 }
 
 void Page::didMoveOnscreen()
diff --git a/Source/WebCore/page/PointerLock.idl b/Source/WebCore/page/PointerLock.idl
deleted file mode 100644
index 3054bcf20..000000000
--- a/Source/WebCore/page/PointerLock.idl
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-module core {
-
-    interface [
-        Conditional=POINTER_LOCK,
-        OmitConstructor
-    ] PointerLock {
-        void lock(in Element target, in [Callback, Optional] VoidCallback successCallback, in [Callback, Optional] VoidCallback failureCallback);
-        void unlock();
-        readonly attribute boolean isLocked;
-    };
-
-}
diff --git a/Source/WebCore/page/PointerLockController.cpp b/Source/WebCore/page/PointerLockController.cpp
index abbfc80f4..ad7960962 100644
--- a/Source/WebCore/page/PointerLockController.cpp
+++ b/Source/WebCore/page/PointerLockController.cpp
@@ -46,40 +46,25 @@ PassOwnPtr<PointerLockController> PointerLockController::create(Page* page)
     return adoptPtr(new PointerLockController(page));
 }
 
-void PointerLockController::requestPointerLock(Element* target, PassRefPtr<VoidCallback> successCallback, PassRefPtr<VoidCallback> failureCallback)
+void PointerLockController::requestPointerLock(Element* target)
 {
-    if (!target || !target->inDocument() || m_documentOfRemovedElementWhileWaitingForUnlock) {
+    if (!target || !target->inDocument() || m_documentOfRemovedElementWhileWaitingForUnlock
+        || target->document()->isSandboxed(SandboxPointerLock)) {
         enqueueEvent(eventNames().webkitpointerlockerrorEvent, target);
         return;
     }
 
     if (m_element) {
-        // FIXME: Keep enqueueEvent usage. (https://bugs.webkit.org/show_bug.cgi?id=84402)
-        enqueueEvent(eventNames().webkitpointerlockchangeEvent, target);
-        if (m_element->document() != target->document())
-            enqueueEvent(eventNames().webkitpointerlockchangeEvent, m_element.get());
-
-        // FIXME: Remove callback usage, keep assignment of m_element = target. (https://bugs.webkit.org/show_bug.cgi?id=84402)
-        if (m_element == target) {
-            if (successCallback)
-                successCallback->handleEvent();
-        } else {
-            didLosePointerLock(false);
-            m_element = target;
-            if (successCallback)
-                successCallback->handleEvent();
+        if (m_element->document() != target->document()) {
+            enqueueEvent(eventNames().webkitpointerlockerrorEvent, target);
+            return;
         }
+        enqueueEvent(eventNames().webkitpointerlockchangeEvent, target);
+        m_element = target;
     } else if (m_page->chrome()->client()->requestPointerLock()) {
         m_element = target;
-        m_successCallback = successCallback;
-        m_failureCallback = failureCallback;
     } else {
-        // FIXME: Keep enqueueEvent usage. (https://bugs.webkit.org/show_bug.cgi?id=84402)
         enqueueEvent(eventNames().webkitpointerlockerrorEvent, target);
-
-        // FIXME: Remove callback usage. (https://bugs.webkit.org/show_bug.cgi?id=84402)
-        if (failureCallback)
-            failureCallback->handleEvent();
     }
 }
 
@@ -107,11 +92,6 @@ void PointerLockController::documentDetached(Document* document)
     }
 }
 
-bool PointerLockController::isLocked()
-{
-    return m_page->chrome()->client()->isPointerLocked();
-}
-
 Element* PointerLockController::element() const
 {
     return m_element.get();
@@ -119,49 +99,20 @@ Element* PointerLockController::element() const
 
 void PointerLockController::didAcquirePointerLock()
 {
-    // FIXME: Keep enqueueEvent usage. (https://bugs.webkit.org/show_bug.cgi?id=84402)
     enqueueEvent(eventNames().webkitpointerlockchangeEvent, m_element.get());
-
-    // FIXME: Remove callback usage. (https://bugs.webkit.org/show_bug.cgi?id=84402)
-    RefPtr<Element> elementToNotify(m_element);
-    RefPtr<VoidCallback> callbackToIssue(m_successCallback);
-    m_successCallback = 0;
-    m_failureCallback = 0;
-
-    if (callbackToIssue && elementToNotify && elementToNotify->document()->frame())
-        callbackToIssue->handleEvent();
 }
 
 void PointerLockController::didNotAcquirePointerLock()
 {
-    // FIXME: Keep enqueueEvent usage. (https://bugs.webkit.org/show_bug.cgi?id=84402)
     enqueueEvent(eventNames().webkitpointerlockerrorEvent, m_element.get());
-
-    // FIXME: Remove callback usage. (https://bugs.webkit.org/show_bug.cgi?id=84402)
-    RefPtr<Element> elementToNotify(m_element);
-    RefPtr<VoidCallback> callbackToIssue(m_failureCallback);
     m_element = 0;
-    m_successCallback = 0;
-    m_failureCallback = 0;
-
-    if (callbackToIssue && elementToNotify && elementToNotify->document()->frame())
-        callbackToIssue->handleEvent();
 }
 
-void PointerLockController::didLosePointerLock(bool sendChangeEvent)
+void PointerLockController::didLosePointerLock()
 {
-    // FIXME: Keep enqueueEvent usage. (https://bugs.webkit.org/show_bug.cgi?id=84402)
-    if (sendChangeEvent)
-        enqueueEvent(eventNames().webkitpointerlockchangeEvent, m_element ? m_element->document() : m_documentOfRemovedElementWhileWaitingForUnlock.get());
-
-    // FIXME: Remove callback usage. (https://bugs.webkit.org/show_bug.cgi?id=84402)
-    RefPtr<Element> elementToNotify(m_element);
+    enqueueEvent(eventNames().webkitpointerlockchangeEvent, m_element ? m_element->document() : m_documentOfRemovedElementWhileWaitingForUnlock.get());
     m_element = 0;
     m_documentOfRemovedElementWhileWaitingForUnlock = 0;
-    m_successCallback = 0;
-    m_failureCallback = 0;
-    if (elementToNotify && elementToNotify->document()->frame())
-        elementToNotify->dispatchEvent(Event::create(eventNames().webkitpointerlocklostEvent, true, false));
 }
 
 void PointerLockController::dispatchLockedMouseEvent(const PlatformMouseEvent& event, const AtomicString& eventType)
diff --git a/Source/WebCore/page/PointerLockController.h b/Source/WebCore/page/PointerLockController.h
index 991754e45..a942f9368 100644
--- a/Source/WebCore/page/PointerLockController.h
+++ b/Source/WebCore/page/PointerLockController.h
@@ -44,16 +44,15 @@ class PointerLockController {
 public:
     static PassOwnPtr<PointerLockController> create(Page*);
 
-    void requestPointerLock(Element* target, PassRefPtr<VoidCallback> successCallback, PassRefPtr<VoidCallback> failureCallback);
+    void requestPointerLock(Element* target);
     void requestPointerUnlock();
     void elementRemoved(Element*);
     void documentDetached(Document*);
-    bool isLocked(); // FIXME: Rename to isClientLocked and move to private when removing old API. (https://bugs.webkit.org/show_bug.cgi?id=84402)
     Element* element() const;
 
     void didAcquirePointerLock();
     void didNotAcquirePointerLock();
-    void didLosePointerLock(bool sendChangeEvent = true); // FIXME: Remove sendChangeEvent parameter when removing old API. (https://bugs.webkit.org/show_bug.cgi?id=84402)
+    void didLosePointerLock();
     void dispatchLockedMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType);
 
 private:
@@ -63,10 +62,6 @@ private:
     Page* m_page;
     RefPtr<Element> m_element;
     RefPtr<Document> m_documentOfRemovedElementWhileWaitingForUnlock;
-
-    // FIXME: Remove callback usage. (https://bugs.webkit.org/show_bug.cgi?id=84402)
-    RefPtr<VoidCallback> m_successCallback;
-    RefPtr<VoidCallback> m_failureCallback;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/SecurityOrigin.cpp b/Source/WebCore/page/SecurityOrigin.cpp
index 91b41c09b..6f7e344ae 100644
--- a/Source/WebCore/page/SecurityOrigin.cpp
+++ b/Source/WebCore/page/SecurityOrigin.cpp
@@ -133,6 +133,7 @@ SecurityOrigin::SecurityOrigin(const KURL& url)
     , m_isUnique(false)
     , m_universalAccess(false)
     , m_domainWasSetInDOM(false)
+    , m_blockThirdPartyStorage(false)
     , m_enforceFilePathSeparation(false)
     , m_needsDatabaseIdentifierQuirkForFiles(false)
 {
@@ -158,6 +159,7 @@ SecurityOrigin::SecurityOrigin()
     , m_universalAccess(false)
     , m_domainWasSetInDOM(false)
     , m_canLoadLocalResources(false)
+    , m_blockThirdPartyStorage(false)
     , m_enforceFilePathSeparation(false)
     , m_needsDatabaseIdentifierQuirkForFiles(false)
 {
@@ -174,6 +176,7 @@ SecurityOrigin::SecurityOrigin(const SecurityOrigin* other)
     , m_universalAccess(other->m_universalAccess)
     , m_domainWasSetInDOM(other->m_domainWasSetInDOM)
     , m_canLoadLocalResources(other->m_canLoadLocalResources)
+    , m_blockThirdPartyStorage(other->m_blockThirdPartyStorage)
     , m_enforceFilePathSeparation(other->m_enforceFilePathSeparation)
     , m_needsDatabaseIdentifierQuirkForFiles(other->m_needsDatabaseIdentifierQuirkForFiles)
 {
@@ -388,6 +391,17 @@ bool SecurityOrigin::canDisplay(const KURL& url) const
     return true;
 }
 
+bool SecurityOrigin::canAccessLocalStorage(const SecurityOrigin* topOrigin) const
+{
+    if (isUnique())
+        return false;
+
+    if (m_blockThirdPartyStorage && topOrigin->isThirdParty(this))
+        return false;
+
+    return true;
+}
+
 SecurityOrigin::Policy SecurityOrigin::canShowNotifications() const
 {
     if (m_universalAccess)
@@ -397,6 +411,20 @@ SecurityOrigin::Policy SecurityOrigin::canShowNotifications() const
     return Ask;
 }
 
+bool SecurityOrigin::isThirdParty(const SecurityOrigin* child) const
+{
+    if (child->m_universalAccess)
+        return false;
+
+    if (this == child)
+        return false;
+
+    if (isUnique() || child->isUnique())
+        return true;
+
+    return !isSameSchemeHostPort(child);
+}
+
 void SecurityOrigin::grantLoadLocalResources()
 {
     // Granting privileges to some, but not all, documents in a SecurityOrigin
diff --git a/Source/WebCore/page/SecurityOrigin.h b/Source/WebCore/page/SecurityOrigin.h
index 2a50ba7e3..93b868160 100644
--- a/Source/WebCore/page/SecurityOrigin.h
+++ b/Source/WebCore/page/SecurityOrigin.h
@@ -121,8 +121,10 @@ public:
     // WARNING: This is an extremely powerful ability. Use with caution!
     void grantUniversalAccess();
 
+    void blockThirdPartyStorage() { m_blockThirdPartyStorage = true; }
+
     bool canAccessDatabase() const { return !isUnique(); }
-    bool canAccessLocalStorage() const { return !isUnique(); }
+    bool canAccessLocalStorage(const SecurityOrigin* topOrigin) const;
     bool canAccessCookies() const { return !isUnique(); }
     bool canAccessPasswordManager() const { return !isUnique(); }
     bool canAccessFileSystem() const { return !isUnique(); }
@@ -189,6 +191,7 @@ private:
 
     // FIXME: Rename this function to something more semantic.
     bool passesFileCheck(const SecurityOrigin*) const;
+    bool isThirdParty(const SecurityOrigin*) const;
 
     String m_protocol;
     String m_host;
@@ -200,6 +203,7 @@ private:
     bool m_universalAccess;
     bool m_domainWasSetInDOM;
     bool m_canLoadLocalResources;
+    bool m_blockThirdPartyStorage;
     bool m_enforceFilePathSeparation;
     bool m_needsDatabaseIdentifierQuirkForFiles;
 };
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index dd5550139..e97c64f73 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -139,6 +139,7 @@ Settings::Settings(Page* page)
     , m_editingBehaviorType(editingBehaviorTypeForPlatform())
     , m_maximumHTMLParserDOMTreeDepth(defaultMaximumHTMLParserDOMTreeDepth)
 #if ENABLE(TEXT_AUTOSIZING)
+    , m_textAutosizingFontScaleFactor(1)
 #if HACK_FORCE_TEXT_AUTOSIZING_ON_DESKTOP
     , m_textAutosizingWindowSizeOverride(320, 480)
     , m_textAutosizingEnabled(true)
@@ -283,6 +284,8 @@ Settings::Settings(Page* page)
     , m_cookieEnabled(true)
     , m_windowFocusRestricted(true)
     , m_diagnosticLoggingEnabled(false)
+    , m_thirdPartyStorageBlockingEnabled(false)
+    , m_scrollingPerformanceLoggingEnabled(false)
     , m_loadsImagesAutomaticallyTimer(this, &Settings::loadsImagesAutomaticallyTimerFired)
     , m_incrementalRenderingSuppressionTimeoutInSeconds(defaultIncrementalRenderingSuppressionTimeoutInSeconds)
 {
@@ -429,6 +432,13 @@ void Settings::setTextAutosizingWindowSizeOverride(const IntSize& textAutosizing
     m_textAutosizingWindowSizeOverride = textAutosizingWindowSizeOverride;
     m_page->setNeedsRecalcStyleInAllFrames();
 }
+
+void Settings::setTextAutosizingFontScaleFactor(float fontScaleFactor)
+{
+    m_textAutosizingFontScaleFactor = fontScaleFactor;
+    m_page->setNeedsRecalcStyleInAllFrames();
+}
+
 #endif
 
 void Settings::setLoadsImagesAutomatically(bool loadsImagesAutomatically)
@@ -930,6 +940,14 @@ void Settings::setTiledBackingStoreEnabled(bool enabled)
 #endif
 }
 
+void Settings::setScrollingPerformanceLoggingEnabled(bool enabled)
+{
+    m_scrollingPerformanceLoggingEnabled = enabled;
+
+    if (m_page->mainFrame() && m_page->mainFrame()->view())
+        m_page->mainFrame()->view()->setScrollingPerformanceLoggingEnabled(enabled);
+}
+
 void Settings::setMockScrollbarsEnabled(bool flag)
 {
     gMockScrollbarsEnabled = flag;
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index 83f64eccc..fd4d9a992 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -111,6 +111,9 @@ namespace WebCore {
         void setTextAutosizingEnabled(bool);
         bool textAutosizingEnabled() const { return m_textAutosizingEnabled; }
 
+        void setTextAutosizingFontScaleFactor(float);
+        float textAutosizingFontScaleFactor() const { return m_textAutosizingFontScaleFactor; }
+
         // Only set by Layout Tests, and only used if textAutosizingEnabled() returns true.
         void setTextAutosizingWindowSizeOverride(const IntSize&);
         const IntSize& textAutosizingWindowSizeOverride() const { return m_textAutosizingWindowSizeOverride; }
@@ -598,6 +601,12 @@ namespace WebCore {
         void setWindowFocusRestricted(bool restricted) { m_windowFocusRestricted = restricted; }
         bool windowFocusRestricted() const { return m_windowFocusRestricted; }
 
+        void setThirdPartyStorageBlockingEnabled(bool enabled) { m_thirdPartyStorageBlockingEnabled = enabled; }
+        bool thirdPartyStorageBlockingEnabled() const { return m_thirdPartyStorageBlockingEnabled; }
+
+        void setScrollingPerformanceLoggingEnabled(bool);
+        bool scrollingPerformanceLoggingEnabled() { return m_scrollingPerformanceLoggingEnabled; }
+
 #if USE(JSC)
         static void setShouldRespectPriorityInCSSAttributeSetters(bool);
         static bool shouldRespectPriorityInCSSAttributeSetters();
@@ -644,6 +653,7 @@ namespace WebCore {
         unsigned m_editingBehaviorType;
         unsigned m_maximumHTMLParserDOMTreeDepth;
 #if ENABLE(TEXT_AUTOSIZING)
+        float m_textAutosizingFontScaleFactor;
         IntSize m_textAutosizingWindowSizeOverride;
         bool m_textAutosizingEnabled : 1;
 #endif
@@ -785,6 +795,10 @@ namespace WebCore {
 
         bool m_diagnosticLoggingEnabled : 1;
 
+        bool m_thirdPartyStorageBlockingEnabled : 1;
+
+        bool m_scrollingPerformanceLoggingEnabled : 1;
+
         Timer<Settings> m_loadsImagesAutomaticallyTimer;
         void loadsImagesAutomaticallyTimerFired(Timer<Settings>*);
         
diff --git a/Source/WebCore/page/TouchAdjustment.cpp b/Source/WebCore/page/TouchAdjustment.cpp
index 85cb61ed2..6abadcfb2 100644
--- a/Source/WebCore/page/TouchAdjustment.cpp
+++ b/Source/WebCore/page/TouchAdjustment.cpp
@@ -67,32 +67,9 @@ typedef float (*DistanceFunction)(const IntPoint&, const IntRect&, const Subtarg
 // Takes non-const Node* because isContentEditable is a non-const function.
 bool nodeRespondsToTapGesture(Node* node)
 {
-    if (node->isLink()
-        || node->isContentEditable()
-        || node->isMouseFocusable())
+    if (node->isMouseFocusable())
         return true;
-    if (node->isElementNode()) {
-        Element* element =  static_cast<Element*>(node);
-        if (element->hasTagName(HTMLNames::labelTag) && static_cast<HTMLLabelElement*>(element)->control())
-            return true;
-    }
-    Element* shadowHost = node->shadowHost();
-    if (shadowHost && shadowHost->hasTagName(HTMLNames::inputTag)) {
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost);
-        if (!input->readOnly() && !input->disabled())
-            return true;
-    }
-
-    // FIXME: Implement hasDefaultEventHandler and use that instead of all of the above checks.
-    if (node->hasEventListeners()
-        && (node->hasEventListeners(eventNames().clickEvent)
-            || node->hasEventListeners(eventNames().DOMActivateEvent)
-            || node->hasEventListeners(eventNames().mousedownEvent)
-            || node->hasEventListeners(eventNames().mouseupEvent)
-            || node->hasEventListeners(eventNames().mousemoveEvent)
-            // Checking for focus events is not necessary since they can only fire on
-            // focusable elements which have already been captured above.
-        ))
+    if (node->willRespondToMouseClickEvents() || node->willRespondToMouseMoveEvents())
         return true;
     if (node->renderStyle()) {
         // Accept nodes that has a CSS effect when touched.
diff --git a/Source/WebCore/page/qt/EventHandlerQt.cpp b/Source/WebCore/page/qt/EventHandlerQt.cpp
index d52222950..ab759496f 100644
--- a/Source/WebCore/page/qt/EventHandlerQt.cpp
+++ b/Source/WebCore/page/qt/EventHandlerQt.cpp
@@ -50,12 +50,6 @@
 #include "RenderWidget.h"
 #include "Scrollbar.h"
 
-#if !HAVE(QT5)
-QT_BEGIN_NAMESPACE
-Q_GUI_EXPORT extern bool qt_tab_all_widgets; // from qapplication.cpp
-QT_END_NAMESPACE
-#endif
-
 namespace WebCore {
 
 #if defined(Q_WS_MAC)
@@ -66,11 +60,7 @@ const double EventHandler::TextDragDelay = 0.0;
 
 bool EventHandler::tabsToAllFormControls(KeyboardEvent* event) const
 {
-#if HAVE(QT5)
     return !isKeyboardOptionTab(event);
-#else
-    return (isKeyboardOptionTab(event) ? !qt_tab_all_widgets : qt_tab_all_widgets);
-#endif
 }
 
 void EventHandler::focusDocumentView()
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
index 6d1f2a60d..40feed77c 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
@@ -288,6 +288,23 @@ void ScrollingCoordinator::updateMainFrameScrollPosition(const IntPoint& scrollP
     frameView->setConstrainsScrollingToContentEdge(true);
 }
 
+void ScrollingCoordinator::updateMainFrameScrollLayerPosition()
+{
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(THREADED_SCROLLING)
+    ASSERT(isMainThread());
+
+    if (!m_page)
+        return;
+
+    FrameView* frameView = m_page->mainFrame()->view();
+    if (!frameView)
+        return;
+
+    if (GraphicsLayer* scrollLayer = scrollLayerForFrameView(frameView))
+        scrollLayer->setPosition(-frameView->scrollPosition());
+#endif
+}
+
 void ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition()
 {
 #if USE(ACCELERATED_COMPOSITING) && ENABLE(THREADED_SCROLLING)
@@ -415,6 +432,11 @@ void ScrollingCoordinator::setWheelEventHandlerCount(unsigned wheelEventHandlerC
 
 void ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(bool shouldUpdateScrollLayerPositionOnMainThread)
 {
+    // The FrameView's GraphicsLayer is likely to be out-of-synch with the PlatformLayer
+    // at this point. So we'll update it before we switch back to main thread scrolling
+    // in order to avoid layer positioning bugs.
+    if (shouldUpdateScrollLayerPositionOnMainThread)
+        updateMainFrameScrollLayerPosition();
     m_scrollingTreeState->setShouldUpdateScrollLayerPositionOnMainThread(shouldUpdateScrollLayerPositionOnMainThread);
     scheduleTreeStateCommit();
 }
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.h b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
index 35649a91f..5d45eb620 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.h
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
@@ -153,6 +153,8 @@ private:
     void setWheelEventHandlerCount(unsigned);
     void setShouldUpdateScrollLayerPositionOnMainThread(bool);
 
+    void updateMainFrameScrollLayerPosition();
+
     Page* m_page;
 
     bool m_forceMainThreadScrollLayerPositionUpdates;
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.cpp b/Source/WebCore/page/scrolling/ScrollingTree.cpp
index 36e6aaea3..ba6a52ac7 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingTree.cpp
@@ -50,6 +50,7 @@ ScrollingTree::ScrollingTree(ScrollingCoordinator* scrollingCoordinator)
     , m_canGoForward(false)
     , m_mainFramePinnedToTheLeft(false)
     , m_mainFramePinnedToTheRight(false)
+    , m_scrollingPerformanceLoggingEnabled(false)
 {
 }
 
@@ -218,6 +219,16 @@ bool ScrollingTree::willWheelEventStartSwipeGesture(const PlatformWheelEvent& wh
     return false;
 }
 
+void ScrollingTree::setScrollingPerformanceLoggingEnabled(bool flag)
+{
+    m_scrollingPerformanceLoggingEnabled = flag;
+}
+
+bool ScrollingTree::scrollingPeformanceLoggingEnabled()
+{
+    return m_scrollingPerformanceLoggingEnabled;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.h b/Source/WebCore/page/scrolling/ScrollingTree.h
index ef7792637..4120e9eac 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.h
+++ b/Source/WebCore/page/scrolling/ScrollingTree.h
@@ -97,6 +97,9 @@ public:
     void setDebugRootLayer(CALayer *);
 #endif
 
+    void setScrollingPerformanceLoggingEnabled(bool flag);
+    bool scrollingPeformanceLoggingEnabled();
+
 private:
     explicit ScrollingTree(ScrollingCoordinator*);
 
@@ -116,6 +119,8 @@ private:
     bool m_mainFramePinnedToTheLeft;
     bool m_mainFramePinnedToTheRight;
 
+    bool m_scrollingPerformanceLoggingEnabled;
+
 #if PLATFORM(MAC)
     RetainPtr<CALayer> m_debugInfoLayer;
 #endif
diff --git a/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
index 99726087c..1db759404 100644
--- a/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
+++ b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
@@ -29,17 +29,22 @@
 
 #include "Frame.h"
 #include "FrameView.h"
-#include "LayerChromium.h"
 #include "Region.h"
 #include "RenderLayerCompositor.h"
 #include "RenderView.h"
-#include "ScrollbarLayerChromium.h"
-#include "ScrollbarTheme.h"
-#include "cc/CCProxy.h"
+#include "ScrollbarThemeComposite.h"
+#include "WebScrollbarThemeGeometryNative.h"
 #include <public/WebScrollableLayer.h>
+#include <public/WebScrollbar.h>
+#include <public/WebScrollbarLayer.h>
+#include <public/WebScrollbarThemeGeometry.h>
+#include <public/WebScrollbarThemePainter.h>
 
 using WebKit::WebLayer;
+using WebKit::WebRect;
 using WebKit::WebScrollableLayer;
+using WebKit::WebScrollbarLayer;
+using WebKit::WebVector;
 
 namespace WebCore {
 
@@ -53,19 +58,18 @@ public:
     {
         m_scrollLayer = layer;
 
-        int id = layer.isNull() ? 0 : layer.unwrap<LayerChromium>()->id();
         if (!m_horizontalScrollbarLayer.isNull())
-            m_horizontalScrollbarLayer.unwrap<ScrollbarLayerChromium>()->setScrollLayerId(id);
+            m_horizontalScrollbarLayer.setScrollLayer(layer);
         if (!m_verticalScrollbarLayer.isNull())
-            m_verticalScrollbarLayer.unwrap<ScrollbarLayerChromium>()->setScrollLayerId(id);
+            m_verticalScrollbarLayer.setScrollLayer(layer);
     }
 
-    void setHorizontalScrollbarLayer(WebLayer layer)
+    void setHorizontalScrollbarLayer(WebScrollbarLayer layer)
     {
         m_horizontalScrollbarLayer = layer;
     }
 
-    void setVerticalScrollbarLayer(WebLayer layer)
+    void setVerticalScrollbarLayer(WebScrollbarLayer layer)
     {
         m_verticalScrollbarLayer = layer;
     }
@@ -75,8 +79,8 @@ public:
 
 private:
     WebScrollableLayer m_scrollLayer;
-    WebLayer m_horizontalScrollbarLayer;
-    WebLayer m_verticalScrollbarLayer;
+    WebScrollbarLayer m_horizontalScrollbarLayer;
+    WebScrollbarLayer m_verticalScrollbarLayer;
 };
 
 PassRefPtr<ScrollingCoordinator> ScrollingCoordinator::create(Page* page)
@@ -108,14 +112,14 @@ static GraphicsLayer* scrollLayerForFrameView(FrameView* frameView)
 #endif
 }
 
-static WebLayer createScrollbarLayer(Scrollbar* scrollbar, WebScrollableLayer scrollLayer, GraphicsLayer* scrollbarGraphicsLayer, FrameView* frameView)
+static WebScrollbarLayer createScrollbarLayer(Scrollbar* scrollbar, WebScrollableLayer scrollLayer, GraphicsLayer* scrollbarGraphicsLayer, FrameView* frameView)
 {
     ASSERT(scrollbar);
     ASSERT(scrollbarGraphicsLayer);
 
     if (scrollLayer.isNull()) {
         // FIXME: sometimes we get called before setScrollLayer, workaround by finding the scroll layout ourselves.
-        scrollLayer = WebScrollableLayer(scrollLayerForFrameView(frameView)->platformLayer());
+        scrollLayer = scrollLayerForFrameView(frameView)->platformLayer()->to<WebScrollableLayer>();
         ASSERT(!scrollLayer.isNull());
     }
 
@@ -126,26 +130,30 @@ static WebLayer createScrollbarLayer(Scrollbar* scrollbar, WebScrollableLayer sc
         scrollbarGraphicsLayer->setContentsOpaque(isOpaqueRootScrollbar);
 
     // FIXME: Mac scrollbar themes are not thread-safe to paint.
-    // FIXME: Win scrollbars on XP Classic themes do not paint valid alpha
-    // values due to GDI. This needs to be fixed in theme code before it
-    // can be turned on here.
     bool platformSupported = true;
-#if OS(DARWIN) || OS(WINDOWS)
+#if OS(DARWIN)
     platformSupported = false;
 #endif
 
-    if (!platformSupported || scrollbar->isOverlayScrollbar()) {
+    if (!platformSupported || scrollbar->isCustomScrollbar()) {
         scrollbarGraphicsLayer->setContentsToMedia(0);
         scrollbarGraphicsLayer->setDrawsContent(true);
-        return WebLayer();
+        return WebScrollbarLayer();
     }
 
-    RefPtr<ScrollbarLayerChromium> scrollbarLayer = ScrollbarLayerChromium::create(scrollbar, scrollLayer.unwrap<LayerChromium>()->id());
-    scrollbarGraphicsLayer->setContentsToMedia(scrollbarLayer.get());
+    // All Chromium scrollbar themes derive from ScrollbarThemeComposite.
+    ScrollbarThemeComposite* themeComposite = static_cast<ScrollbarThemeComposite*>(scrollbar->theme());
+    WebKit::WebScrollbarThemePainter painter(themeComposite, scrollbar);
+    OwnPtr<WebKit::WebScrollbarThemeGeometry> geometry(WebKit::WebScrollbarThemeGeometryNative::create(themeComposite));
+
+    WebScrollbarLayer scrollbarLayer = WebScrollbarLayer::create(scrollbar, painter, geometry.release());
+    scrollbarLayer.setScrollLayer(scrollLayer);
+
+    scrollbarGraphicsLayer->setContentsToMedia(&scrollbarLayer);
     scrollbarGraphicsLayer->setDrawsContent(false);
-    scrollbarLayer->setOpaque(scrollbarGraphicsLayer->contentsOpaque());
+    scrollbarLayer.setOpaque(scrollbarGraphicsLayer->contentsOpaque());
 
-    return WebLayer(scrollbarLayer.release());
+    return scrollbarLayer;
 }
 
 void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView* frameView, GraphicsLayer* horizontalScrollbarLayer)
@@ -166,13 +174,21 @@ void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView* f
 
 void ScrollingCoordinator::setScrollLayer(GraphicsLayer* scrollLayer)
 {
-    m_private->setScrollLayer(WebScrollableLayer(scrollLayer ? scrollLayer->platformLayer() : 0));
+    WebScrollableLayer layer;
+    if (scrollLayer)
+        layer = scrollLayer->platformLayer()->to<WebScrollableLayer>();
+    m_private->setScrollLayer(layer);
 }
 
 void ScrollingCoordinator::setNonFastScrollableRegion(const Region& region)
 {
-    if (m_private->hasScrollLayer())
-        m_private->scrollLayer().unwrap<LayerChromium>()->setNonFastScrollableRegion(region);
+    if (m_private->hasScrollLayer()) {
+        Vector<IntRect> rects = region.rects();
+        WebVector<WebRect> webRects(rects.size());
+        for (size_t i = 0; i < rects.size(); ++i)
+            webRects[i] = rects[i];
+        m_private->scrollLayer().setNonFastScrollableRegion(webRects);
+    }
 }
 
 void ScrollingCoordinator::setScrollParameters(const ScrollParameters&)
@@ -199,14 +215,14 @@ bool ScrollingCoordinator::supportsFixedPositionLayers() const
 
 void ScrollingCoordinator::setLayerIsContainerForFixedPositionLayers(GraphicsLayer* layer, bool enable)
 {
-    if (LayerChromium* platformLayer = layer->platformLayer())
-        platformLayer->setIsContainerForFixedPositionLayers(enable);
+    if (WebLayer* platformLayer = layer->platformLayer())
+        platformLayer->to<WebScrollableLayer>().setIsContainerForFixedPositionLayers(enable);
 }
 
 void ScrollingCoordinator::setLayerIsFixedToContainerLayer(GraphicsLayer* layer, bool enable)
 {
-    if (LayerChromium* platformLayer = layer->platformLayer())
-        platformLayer->setFixedToContainerLayer(enable);
+    if (WebLayer* platformLayer = layer->platformLayer())
+        platformLayer->to<WebScrollableLayer>().setFixedToContainerLayer(enable);
 }
 
 }
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
index 8a1576e7a..4304b61bb 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
@@ -74,6 +74,8 @@ private:
 
     void updateMainFramePinState(const IntPoint& scrollPosition);
 
+    void logExposedUnfilledArea();
+
     ScrollElasticityController m_scrollElasticityController;
     RetainPtr<CFRunLoopTimerRef> m_snapRubberbandTimer;
 
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
index a37bf40c1..38dd9e53e 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
@@ -31,6 +31,12 @@
 #include "PlatformWheelEvent.h"
 #include "ScrollingTree.h"
 #include "ScrollingTreeState.h"
+#include "Settings.h"
+#include "TileCache.h"
+#include "WebTileLayer.h"
+
+#include <wtf/CurrentTime.h>
+#include <wtf/Deque.h>
 
 namespace WebCore {
 
@@ -233,6 +239,9 @@ void ScrollingTreeNodeMac::setScrollPosition(const IntPoint& scrollPosition)
     newScrollPosition = newScrollPosition.expandedTo(minimumScrollPosition());
 
     setScrollPositionWithoutContentEdgeConstraints(newScrollPosition);
+
+    if (scrollingTree()->scrollingPeformanceLoggingEnabled())
+        logExposedUnfilledArea();
 }
 
 void ScrollingTreeNodeMac::setScrollPositionWithoutContentEdgeConstraints(const IntPoint& scrollPosition)
@@ -288,6 +297,39 @@ void ScrollingTreeNodeMac::updateMainFramePinState(const IntPoint& scrollPositio
     scrollingTree()->setMainFramePinState(pinnedToTheLeft, pinnedToTheRight);
 }
 
+void ScrollingTreeNodeMac::logExposedUnfilledArea()
+{
+    Region paintedVisibleTiles;
+
+    Deque<CALayer*> layerQueue;
+    layerQueue.append(m_scrollLayer.get());
+    WebTileLayerList tiles;
+
+    while(!layerQueue.isEmpty() && tiles.isEmpty()) {
+        CALayer* layer = layerQueue.takeFirst();
+        NSArray* sublayers = [[layer sublayers] copy];
+
+        // If this layer is the parent of a tile, it is the parent of all of the tiles and nothing else.
+        if ([[sublayers objectAtIndex:0] isKindOfClass:[WebTileLayer class]]) {
+            for (CALayer* sublayer in sublayers) {
+                ASSERT([sublayer isKindOfClass:[WebTileLayer class]]);
+                tiles.append(static_cast<WebTileLayer*>(sublayer));
+            }
+        } else {
+            for (CALayer* sublayer in sublayers)
+                layerQueue.append(sublayer);
+        }
+
+        [sublayers release];
+    }
+
+    IntPoint scrollPosition = this->scrollPosition();
+    unsigned unfilledArea = TileCache::blankPixelCountForTiles(tiles, viewportRect(), IntPoint(-scrollPosition.x(), -scrollPosition.y()));
+
+    if (unfilledArea)
+        printf("SCROLLING: Exposed tileless area. Time: %f Unfilled Pixels: %u\n", WTF::monotonicallyIncreasingTime(), unfilledArea);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/platform/FractionalLayoutUnit.h b/Source/WebCore/platform/FractionalLayoutUnit.h
index b8909167b..d81aef24b 100644
--- a/Source/WebCore/platform/FractionalLayoutUnit.h
+++ b/Source/WebCore/platform/FractionalLayoutUnit.h
@@ -35,6 +35,7 @@
 #include <limits>
 #include <math.h>
 #include <stdlib.h>
+#include <wtf/MathExtras.h>
 
 #if PLATFORM(QT)
 #include <QDataStream>
@@ -94,6 +95,14 @@ public:
         return v;
     }
 
+    static FractionalLayoutUnit fromFloatFloor(float value)
+    {
+        REPORT_OVERFLOW(isInBounds(value));
+        FractionalLayoutUnit v;
+        v.m_value = floorf(value * kFixedPointDenominator);
+        return v;
+    }
+
     static FractionalLayoutUnit fromFloatRound(float value)
     {
         if (value >= 0)
@@ -145,9 +154,9 @@ public:
 #endif
     {
 #if ENABLE(SUBPIXEL_LAYOUT)
-        if (m_value > 0)
+        if (m_value >= 0)
             return (m_value + kFixedPointDenominator - 1) / kFixedPointDenominator;
-        return (m_value - kFixedPointDenominator + 1) / kFixedPointDenominator;
+        return toInt();
 #else
         return m_value;
 #endif
@@ -165,7 +174,13 @@ public:
 
     int floor() const
     {
-        return toInt();
+#if ENABLE(SUBPIXEL_LAYOUT)
+        if (m_value >= 0)
+            return toInt();
+        return (m_value - kFixedPointDenominator + 1) / kFixedPointDenominator;
+#else
+        return m_value;
+#endif
     }
 
     static float epsilon() { return 1.0f / kFixedPointDenominator; }
@@ -181,6 +196,10 @@ public:
         m.m_value = std::numeric_limits<int>::min();
         return m;
     }
+    static FractionalLayoutUnit clamp(double value)
+    {
+        return clampTo<FractionalLayoutUnit>(value, FractionalLayoutUnit::min(), FractionalLayoutUnit::max());
+    }
     
 private:
     static bool isInBounds(int value)
@@ -556,6 +575,42 @@ inline FractionalLayoutUnit operator-(const FractionalLayoutUnit& a)
     return returnVal;
 }
 
+// For returning the remainder after a division with integer results.
+inline FractionalLayoutUnit intMod(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+#if ENABLE(SUBPIXEL_LAYOUT)
+    // This calculates the modulo so that: a = static_cast<int>(a / b) * b + intMod(a, b).
+    FractionalLayoutUnit returnVal;
+    returnVal.setRawValue(a.rawValue() % b.rawValue());
+    return returnVal;
+#else
+    return a.rawValue() % b.rawValue();
+#endif
+}
+
+inline FractionalLayoutUnit operator%(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+#if ENABLE(SUBPIXEL_LAYOUT)
+    // This calculates the modulo so that: a = (a / b) * b + a % b.
+    FractionalLayoutUnit returnVal;
+    long long rawVal = (static_cast<long long>(kFixedPointDenominator) * a.rawValue()) % b.rawValue();
+    returnVal.setRawValue(rawVal / kFixedPointDenominator);
+    return returnVal;
+#else
+    return a.rawValue() % b.rawValue();
+#endif
+}
+
+inline FractionalLayoutUnit operator%(const FractionalLayoutUnit& a, int b)
+{
+    return a % FractionalLayoutUnit(b);
+}
+
+inline FractionalLayoutUnit operator%(int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) % b;
+}
+
 inline FractionalLayoutUnit& operator+=(FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
 {
     a = a + b;
@@ -592,17 +647,24 @@ inline FractionalLayoutUnit& operator-=(FractionalLayoutUnit& a, const Fractiona
     return a;
 }
 
+inline FractionalLayoutUnit& operator-=(FractionalLayoutUnit& a, float b)
+{
+    a = a - b;
+    return a;
+}
+
 inline float& operator-=(float& a, const FractionalLayoutUnit& b)
 {
     a = a - b;
     return a;
 }
 
-inline FractionalLayoutUnit& operator*=(FractionalLayoutUnit& a, int b)
+inline FractionalLayoutUnit& operator*=(FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
 {
     a = a * b;
     return a;
 }
+// operator*=(FractionalLayoutUnit& a, int b) is supported by the operator above plus FractionalLayoutUnit(int).
 
 inline FractionalLayoutUnit& operator*=(FractionalLayoutUnit& a, float b)
 {
@@ -610,6 +672,31 @@ inline FractionalLayoutUnit& operator*=(FractionalLayoutUnit& a, float b)
     return a;
 }
 
+inline float& operator*=(float& a, const FractionalLayoutUnit& b)
+{
+    a = a * b;
+    return a;
+}
+
+inline FractionalLayoutUnit& operator/=(FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    a = a / b;
+    return a;
+}
+// operator/=(FractionalLayoutUnit& a, int b) is supported by the operator above plus FractionalLayoutUnit(int).
+
+inline FractionalLayoutUnit& operator/=(FractionalLayoutUnit& a, float b)
+{
+    a = a / b;
+    return a;
+}
+
+inline float& operator/=(float& a, const FractionalLayoutUnit& b)
+{
+    a = a / b;
+    return a;
+}
+
 inline int snapSizeToPixel(FractionalLayoutUnit size, FractionalLayoutUnit location) 
 {
     return (location + size).round() - location.round();
diff --git a/Source/WebCore/platform/LocalizedStrings.cpp b/Source/WebCore/platform/LocalizedStrings.cpp
index e79b518e9..bc54b61aa 100644
--- a/Source/WebCore/platform/LocalizedStrings.cpp
+++ b/Source/WebCore/platform/LocalizedStrings.cpp
@@ -673,6 +673,11 @@ String crashedPluginText()
     return WEB_UI_STRING("Plug-in Failure", "Label text to be used if plugin host process has crashed");
 }
 
+String blockedPluginByContentSecurityPolicyText()
+{
+    return WEB_UI_STRING("Blocked Plug-in", "Label text to be used if plugin is blocked by a page's Content Security Policy");
+}
+
 String insecurePluginVersionText()
 {
     return WEB_UI_STRING("Blocked Plug-in", "Label text to be used when an insecure plug-in version was blocked from loading");
diff --git a/Source/WebCore/platform/LocalizedStrings.h b/Source/WebCore/platform/LocalizedStrings.h
index fe6686dba..c1180c66a 100644
--- a/Source/WebCore/platform/LocalizedStrings.h
+++ b/Source/WebCore/platform/LocalizedStrings.h
@@ -167,6 +167,7 @@ namespace WebCore {
 
     String missingPluginText();
     String crashedPluginText();
+    String blockedPluginByContentSecurityPolicyText();
     String insecurePluginVersionText();
     String multipleFileUploadText(unsigned numberOfFiles);
     String unknownFileSizeText();
@@ -219,6 +220,9 @@ namespace WebCore {
     String dateFormatMonthText();
     String dateFormatDayInMonthText();
 #endif
+#if USE(SOUP)
+    String unacceptableTLSCertificate();
+#endif
 
 #if !PLATFORM(CHROMIUM)
 #define WEB_UI_STRING(string, description) WebCore::localizedString(string)
diff --git a/Source/WebCore/platform/MemoryUsageSupport.cpp b/Source/WebCore/platform/MemoryUsageSupport.cpp
index 77eb4f46f..6ed435697 100644
--- a/Source/WebCore/platform/MemoryUsageSupport.cpp
+++ b/Source/WebCore/platform/MemoryUsageSupport.cpp
@@ -63,4 +63,8 @@ bool MemoryUsageSupport::processMemorySizesInBytes(size_t*, size_t*)
     return false;
 }
 
+void MemoryUsageSupport::memoryUsageByComponents(Vector<ComponentInfo>&)
+{
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/MemoryUsageSupport.h b/Source/WebCore/platform/MemoryUsageSupport.h
index 4f1a0bdd7..823fe83a1 100644
--- a/Source/WebCore/platform/MemoryUsageSupport.h
+++ b/Source/WebCore/platform/MemoryUsageSupport.h
@@ -31,6 +31,9 @@
 #ifndef MemoryUsageSupport_h
 #define MemoryUsageSupport_h
 
+#include <wtf/Forward.h>
+#include <wtf/text/WTFString.h>
+
 namespace WebCore {
 
 class MemoryUsageSupport {
@@ -57,6 +60,17 @@ public:
     // memory currently allocated to this process that cannot be shared. Returns
     // false on platform specific error conditions.
     static bool processMemorySizesInBytes(size_t* privateBytes, size_t* sharedBytes);
+
+    class ComponentInfo {
+    public:
+        ComponentInfo(const String& name, size_t size) : m_name(name), m_sizeInBytes(size) { }
+
+        const String m_name;
+        size_t m_sizeInBytes;
+    };
+
+    // Reports private memory used by components in bytes.
+    static void memoryUsageByComponents(Vector<ComponentInfo>&);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/Pasteboard.h b/Source/WebCore/platform/Pasteboard.h
index cc0809c67..bfdb01ca2 100644
--- a/Source/WebCore/platform/Pasteboard.h
+++ b/Source/WebCore/platform/Pasteboard.h
@@ -76,6 +76,11 @@ class SharedBuffer;
 class Pasteboard {
     WTF_MAKE_NONCOPYABLE(Pasteboard); WTF_MAKE_FAST_ALLOCATED;
 public:
+    enum SmartReplaceOption {
+        CanSmartReplace,
+        CannotSmartReplace
+    };
+
 #if PLATFORM(MAC)
     // This is required to support OS X services.
     void writeSelectionForTypes(const Vector<String>& pasteboardTypes, bool canSmartCopyOrDelete, Frame*);
@@ -86,7 +91,7 @@ public:
     
     static Pasteboard* generalPasteboard();
     void writeSelection(Range*, bool canSmartCopyOrDelete, Frame*);
-    void writePlainText(const String&);
+    void writePlainText(const String&, SmartReplaceOption);
     void writeURL(const KURL&, const String&, Frame* = 0);
     void writeImage(Node*, const KURL&, const String& title);
     void writeClipboard(Clipboard*);
diff --git a/Source/WebCore/platform/PlatformTouchEvent.h b/Source/WebCore/platform/PlatformTouchEvent.h
index dbfec22da..8784da587 100644
--- a/Source/WebCore/platform/PlatformTouchEvent.h
+++ b/Source/WebCore/platform/PlatformTouchEvent.h
@@ -32,10 +32,6 @@ class QTouchEvent;
 QT_END_NAMESPACE
 #endif
 
-#if PLATFORM(EFL)
-typedef struct _Eina_List Eina_List;
-#endif
-
 #if PLATFORM(BLACKBERRY)
 namespace BlackBerry {
 namespace Platform {
@@ -60,9 +56,7 @@ public:
     {
     }
 
-#if PLATFORM(EFL)
-    PlatformTouchEvent(const Eina_List*, const IntPoint, PlatformEvent::Type, PlatformEvent::Modifiers);
-#elif PLATFORM(BLACKBERRY)
+#if PLATFORM(BLACKBERRY)
     explicit PlatformTouchEvent(BlackBerry::Platform::TouchEvent*);
 #endif
 
diff --git a/Source/WebCore/platform/PlatformTouchPoint.h b/Source/WebCore/platform/PlatformTouchPoint.h
index 0b6514073..eb4201507 100644
--- a/Source/WebCore/platform/PlatformTouchPoint.h
+++ b/Source/WebCore/platform/PlatformTouchPoint.h
@@ -62,9 +62,7 @@ public:
     {
     }
 
-#if PLATFORM(EFL)
-    PlatformTouchPoint(unsigned id, const IntPoint& windowPos, State);
-#elif PLATFORM(BLACKBERRY)
+#if PLATFORM(BLACKBERRY)
     PlatformTouchPoint(const BlackBerry::Platform::TouchPoint&);
 #endif
 
diff --git a/Source/WebCore/platform/PurgeableBuffer.h b/Source/WebCore/platform/PurgeableBuffer.h
index 468b92b25..8342241d4 100644
--- a/Source/WebCore/platform/PurgeableBuffer.h
+++ b/Source/WebCore/platform/PurgeableBuffer.h
@@ -31,7 +31,7 @@
 #include <wtf/Vector.h>
 
 namespace WebCore {
-    
+
     class PurgeableBuffer {
         WTF_MAKE_NONCOPYABLE(PurgeableBuffer);
     public:
@@ -50,7 +50,7 @@ namespace WebCore {
         bool wasPurged() const;
 
         bool makePurgeable(bool purgeable);
-        
+
     private:
         PurgeableBuffer(char* data, size_t);
     
diff --git a/Source/WebCore/platform/ScrollAnimatorNone.cpp b/Source/WebCore/platform/ScrollAnimatorNone.cpp
index b804a9281..45cc1e587 100644
--- a/Source/WebCore/platform/ScrollAnimatorNone.cpp
+++ b/Source/WebCore/platform/ScrollAnimatorNone.cpp
@@ -417,7 +417,7 @@ bool ScrollAnimatorNone::scroll(ScrollbarOrientation orientation, ScrollGranular
         return ScrollAnimator::scroll(orientation, granularity, step, multiplier);
 
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("ScrollAnimatorNone::scroll", this, 0);
+    TRACE_EVENT0("webkit", "ScrollAnimatorNone::scroll");
 #endif
 
     // FIXME: get the type passed in. MouseWheel could also be by line, but should still have different
@@ -532,7 +532,7 @@ void ScrollAnimatorNone::animationTimerFired(Timer<ScrollAnimatorNone>* timer)
 void ScrollAnimatorNone::animationTimerFired()
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("ScrollAnimatorNone::animationTimerFired", this, 0);
+    TRACE_EVENT0("webkit", "ScrollAnimatorNone::animationTimerFired");
 #endif
 
     double currentTime = WTF::monotonicallyIncreasingTime();
@@ -562,7 +562,7 @@ void ScrollAnimatorNone::animationTimerFired()
 #endif
 
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("ScrollAnimatorNone::notifyPositionChanged", this, 0);
+    TRACE_EVENT0("webkit", "ScrollAnimatorNone::notifyPositionChanged");
 #endif
     notifyPositionChanged();
 
diff --git a/Source/WebCore/platform/ScrollView.cpp b/Source/WebCore/platform/ScrollView.cpp
index 94ee3f9c3..85d75da25 100644
--- a/Source/WebCore/platform/ScrollView.cpp
+++ b/Source/WebCore/platform/ScrollView.cpp
@@ -501,16 +501,16 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
         bool sendContentResizedNotification = false;
         
         IntSize docSize = contentsSize();
-        IntSize frameSize = frameRect().size();
+        IntSize fullVisibleSize = visibleContentRect(true /*includeScrollbars*/).size();
 
         if (hScroll == ScrollbarAuto) {
             newHasHorizontalScrollbar = docSize.width() > visibleWidth();
-            if (newHasHorizontalScrollbar && !m_updateScrollbarsPass && docSize.width() <= frameSize.width() && docSize.height() <= frameSize.height())
+            if (newHasHorizontalScrollbar && !m_updateScrollbarsPass && docSize.width() <= fullVisibleSize.width() && docSize.height() <= fullVisibleSize.height())
                 newHasHorizontalScrollbar = false;
         }
         if (vScroll == ScrollbarAuto) {
             newHasVerticalScrollbar = docSize.height() > visibleHeight();
-            if (newHasVerticalScrollbar && !m_updateScrollbarsPass && docSize.width() <= frameSize.width() && docSize.height() <= frameSize.height())
+            if (newHasVerticalScrollbar && !m_updateScrollbarsPass && docSize.width() <= fullVisibleSize.width() && docSize.height() <= fullVisibleSize.height())
                 newHasVerticalScrollbar = false;
         }
 
diff --git a/Source/WebCore/platform/ScrollableArea.cpp b/Source/WebCore/platform/ScrollableArea.cpp
index 3506e5592..103e03899 100644
--- a/Source/WebCore/platform/ScrollableArea.cpp
+++ b/Source/WebCore/platform/ScrollableArea.cpp
@@ -142,6 +142,7 @@ void ScrollableArea::notifyScrollPositionChanged(const IntPoint& position)
 
 void ScrollableArea::scrollPositionChanged(const IntPoint& position)
 {
+    IntPoint oldPosition = scrollPosition();
     // Tell the derived class to scroll its contents.
     setScrollOffset(position);
 
@@ -168,7 +169,8 @@ void ScrollableArea::scrollPositionChanged(const IntPoint& position)
             verticalScrollbar->invalidate();
     }
 
-    scrollAnimator()->notifyContentAreaScrolled();
+    if (scrollPosition() != oldPosition)
+        scrollAnimator()->notifyContentAreaScrolled();
 }
 
 bool ScrollableArea::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
diff --git a/Source/WebCore/platform/ScrollbarThemeClient.h b/Source/WebCore/platform/ScrollbarThemeClient.h
index 871c52e90..eba409469 100644
--- a/Source/WebCore/platform/ScrollbarThemeClient.h
+++ b/Source/WebCore/platform/ScrollbarThemeClient.h
@@ -83,6 +83,8 @@ public:
     virtual bool enabled() const = 0;
     virtual void setEnabled(bool) = 0;
 
+    virtual bool isOverlayScrollbar() const = 0;
+
 protected:
     virtual ~ScrollbarThemeClient() { }
 };
diff --git a/Source/WebCore/platform/SharedBuffer.cpp b/Source/WebCore/platform/SharedBuffer.cpp
index 9b8d503bf..bc6c309da 100644
--- a/Source/WebCore/platform/SharedBuffer.cpp
+++ b/Source/WebCore/platform/SharedBuffer.cpp
@@ -248,7 +248,7 @@ const Vector<char>& SharedBuffer::buffer() const
 
 void SharedBuffer::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo<SharedBuffer> info(memoryObjectInfo, this, MemoryInstrumentation::Other);
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Other);
     info.addVector(m_buffer);
     info.addVector(m_segments);
     for (unsigned i = 0; i < m_segments.size(); ++i)
diff --git a/Source/WebCore/platform/TreeShared.h b/Source/WebCore/platform/TreeShared.h
index d4d53eaee..fbefeb159 100644
--- a/Source/WebCore/platform/TreeShared.h
+++ b/Source/WebCore/platform/TreeShared.h
@@ -113,7 +113,7 @@ public:
 
     void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo<TreeShared<NodeType, ParentNodeType> > info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
         info.addInstrumentedMember(m_parent);
     }
 
diff --git a/Source/WebCore/platform/audio/AudioDestination.h b/Source/WebCore/platform/audio/AudioDestination.h
index 75882c0a6..73cdb3248 100644
--- a/Source/WebCore/platform/audio/AudioDestination.h
+++ b/Source/WebCore/platform/audio/AudioDestination.h
@@ -34,14 +34,15 @@
 
 namespace WebCore {
 
-class AudioSourceProvider;
+class AudioIOCallback;
 
-// Abstraction for an audio output to the audio hardware
-// An AudioSourceProvider is called back periodically to provide the rendered audio stream.
+// AudioDestination is an abstraction for audio hardware I/O.
+// The audio hardware periodically calls the AudioIOCallback render() method asking it to render/output the next render quantum of audio.
+// It optionally will pass in local/live audio input when it calls render().
 
 class AudioDestination {
 public:
-    static PassOwnPtr<AudioDestination> create(AudioSourceProvider&, float sampleRate);
+    static PassOwnPtr<AudioDestination> create(AudioIOCallback&, float sampleRate);
 
     virtual ~AudioDestination() { }
 
diff --git a/Source/WebCore/platform/audio/AudioIOCallback.h b/Source/WebCore/platform/audio/AudioIOCallback.h
new file mode 100644
index 000000000..2cc3a9df2
--- /dev/null
+++ b/Source/WebCore/platform/audio/AudioIOCallback.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AudioIOCallback_h
+#define AudioIOCallback_h
+
+namespace WebCore {
+
+class AudioBus;
+
+// Abstract base-class for isochronous audio I/O client.
+class AudioIOCallback {
+public:
+    // render() is called periodically to get the next render quantum of audio into destinationBus.
+    // Optional audio input is given in sourceBus (if it's not 0).
+    virtual void render(AudioBus* sourceBus, AudioBus* destinationBus, size_t framesToProcess) = 0;
+
+    virtual ~AudioIOCallback() { }
+};
+
+} // WebCore
+
+#endif // AudioIOCallback_h
diff --git a/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp b/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp
index 5611bdb67..01aa371cf 100644
--- a/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp
+++ b/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp
@@ -36,9 +36,9 @@ namespace WebCore {
 // needs to handle this number of frames per cycle as well.
 const unsigned framesToPull = 128;
 
-PassOwnPtr<AudioDestination> AudioDestination::create(AudioSourceProvider& provider, float sampleRate)
+PassOwnPtr<AudioDestination> AudioDestination::create(AudioIOCallback& callback, float sampleRate)
 {
-    return adoptPtr(new AudioDestinationGStreamer(provider, sampleRate));
+    return adoptPtr(new AudioDestinationGStreamer(callback, sampleRate));
 }
 
 float AudioDestination::hardwareSampleRate()
@@ -51,8 +51,8 @@ static void onGStreamerWavparsePadAddedCallback(GstElement* element, GstPad* pad
     destination->finishBuildingPipelineAfterWavParserPadReady(pad);
 }
 
-AudioDestinationGStreamer::AudioDestinationGStreamer(AudioSourceProvider& provider, float sampleRate)
-    : m_provider(provider)
+AudioDestinationGStreamer::AudioDestinationGStreamer(AudioIOCallback& callback, float sampleRate)
+    : m_callback(callback)
     , m_renderBus(2, framesToPull, true)
     , m_sampleRate(sampleRate)
     , m_isPlaying(false)
@@ -62,7 +62,7 @@ AudioDestinationGStreamer::AudioDestinationGStreamer(AudioSourceProvider& provid
     GstElement* webkitAudioSrc = reinterpret_cast<GstElement*>(g_object_new(WEBKIT_TYPE_WEB_AUDIO_SRC,
                                                                             "rate", sampleRate,
                                                                             "bus", &m_renderBus,
-                                                                            "provider", &m_provider,
+                                                                            "provider", &m_callback,
                                                                             "frames", framesToPull, NULL));
 
     GstElement* wavParser = gst_element_factory_make("wavparse", 0);
diff --git a/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.h b/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.h
index 4e8cdf58c..8bebb5af7 100644
--- a/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.h
+++ b/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.h
@@ -29,7 +29,7 @@ namespace WebCore {
 
 class AudioDestinationGStreamer : public AudioDestination {
 public:
-    AudioDestinationGStreamer(AudioSourceProvider&, float sampleRate);
+    AudioDestinationGStreamer(AudioIOCallback&, float sampleRate);
     virtual ~AudioDestinationGStreamer();
 
     virtual void start();
@@ -37,12 +37,12 @@ public:
 
     bool isPlaying() { return m_isPlaying; }
     float sampleRate() const { return m_sampleRate; }
-    AudioSourceProvider& sourceProvider() const { return m_provider; }
+    AudioIOCallback& callback() const { return m_callback; }
 
     void finishBuildingPipelineAfterWavParserPadReady(GstPad*);
 
 private:
-    AudioSourceProvider& m_provider;
+    AudioIOCallback& m_callback;
     AudioBus m_renderBus;
 
     float m_sampleRate;
diff --git a/Source/WebCore/platform/audio/gstreamer/AudioFileReaderGStreamer.cpp b/Source/WebCore/platform/audio/gstreamer/AudioFileReaderGStreamer.cpp
index 5b92eb7bd..18372fc0b 100644
--- a/Source/WebCore/platform/audio/gstreamer/AudioFileReaderGStreamer.cpp
+++ b/Source/WebCore/platform/audio/gstreamer/AudioFileReaderGStreamer.cpp
@@ -305,7 +305,7 @@ void AudioFileReader::decodeAudioForBusCreation()
     if (m_data) {
         ASSERT(m_dataSize);
         source = gst_element_factory_make("giostreamsrc", 0);
-        GRefPtr<GInputStream> memoryStream = g_memory_input_stream_new_from_data(m_data, m_dataSize, 0);
+        GRefPtr<GInputStream> memoryStream = adoptGRef(g_memory_input_stream_new_from_data(m_data, m_dataSize, 0));
         g_object_set(source, "stream", memoryStream.get(), NULL);
     } else {
         source = gst_element_factory_make("filesrc", 0);
diff --git a/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp b/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp
index 00e4491e6..c3bcbbeea 100644
--- a/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp
+++ b/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp
@@ -23,7 +23,7 @@
 #if ENABLE(WEB_AUDIO) && USE(GSTREAMER)
 
 #include "AudioBus.h"
-#include "AudioSourceProvider.h"
+#include "AudioIOCallback.h"
 #include <wtf/gobject/GOwnPtr.h>
 #include "GRefPtrGStreamer.h"
 #include <gst/audio/multichannel.h>
@@ -47,7 +47,7 @@ struct _WebKitWebAudioSrcClass {
 struct _WebKitWebAudioSourcePrivate {
     gfloat sampleRate;
     AudioBus* bus;
-    AudioSourceProvider* provider;
+    AudioIOCallback* provider;
     guint framesToPull;
     guint64 currentBufferOffset;
 
@@ -279,7 +279,7 @@ static void webKitWebAudioSrcSetProperty(GObject* object, guint propertyId, cons
         priv->bus = static_cast<AudioBus*>(g_value_get_pointer(value));
         break;
     case PROP_PROVIDER:
-        priv->provider = static_cast<AudioSourceProvider*>(g_value_get_pointer(value));
+        priv->provider = static_cast<AudioIOCallback*>(g_value_get_pointer(value));
         break;
     case PROP_FRAMES:
         priv->framesToPull = g_value_get_uint(value);
@@ -323,7 +323,8 @@ static void webKitWebAudioSrcLoop(WebKitWebAudioSrc* src)
     if (!priv->provider || !priv->bus)
         return;
 
-    priv->provider->provideInput(priv->bus, priv->framesToPull);
+    // FIXME: Add support for local/live audio input.
+    priv->provider->render(0, priv->bus, priv->framesToPull);
 
     unsigned bufferSize = priv->framesToPull * sizeof(float);
     for (unsigned index = 0; index < g_slist_length(priv->pads); index++) {
diff --git a/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp b/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp
index 5fb164dd2..95d2eb33e 100644
--- a/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp
+++ b/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp
@@ -32,7 +32,7 @@
 
 #include "AudioDestinationMac.h"
 
-#include "AudioSourceProvider.h"
+#include "AudioIOCallback.h"
 #include "FloatConversion.h"
 #include <CoreAudio/AudioHardware.h>
 
@@ -41,9 +41,9 @@ namespace WebCore {
 const int kBufferSize = 128;
 
 // Factory method: Mac-implementation
-PassOwnPtr<AudioDestination> AudioDestination::create(AudioSourceProvider& provider, float sampleRate)
+PassOwnPtr<AudioDestination> AudioDestination::create(AudioIOCallback& callback, float sampleRate)
 {
-    return adoptPtr(new AudioDestinationMac(provider, sampleRate));
+    return adoptPtr(new AudioDestinationMac(callback, sampleRate));
 }
 
 float AudioDestination::hardwareSampleRate()
@@ -68,9 +68,9 @@ float AudioDestination::hardwareSampleRate()
     return narrowPrecisionToFloat(nominalSampleRate);
 }
 
-AudioDestinationMac::AudioDestinationMac(AudioSourceProvider& provider, float sampleRate)
+AudioDestinationMac::AudioDestinationMac(AudioIOCallback& callback, float sampleRate)
     : m_outputUnit(0)
-    , m_provider(provider)
+    , m_callback(callback)
     , m_renderBus(2, kBufferSize, false)
     , m_sampleRate(sampleRate)
     , m_isPlaying(false)
@@ -155,7 +155,8 @@ OSStatus AudioDestinationMac::render(UInt32 numberOfFrames, AudioBufferList* ioD
     m_renderBus.setChannelMemory(0, (float*)buffers[0].mData, numberOfFrames);
     m_renderBus.setChannelMemory(1, (float*)buffers[1].mData, numberOfFrames);
 
-    m_provider.provideInput(&m_renderBus, numberOfFrames);
+    // FIXME: Add support for local/live audio input.
+    m_callback.render(0, &m_renderBus, numberOfFrames);
 
     return noErr;
 }
diff --git a/Source/WebCore/platform/audio/mac/AudioDestinationMac.h b/Source/WebCore/platform/audio/mac/AudioDestinationMac.h
index 963f7c735..1f0108f63 100644
--- a/Source/WebCore/platform/audio/mac/AudioDestinationMac.h
+++ b/Source/WebCore/platform/audio/mac/AudioDestinationMac.h
@@ -39,7 +39,7 @@ namespace WebCore {
 
 class AudioDestinationMac : public AudioDestination {
 public:
-    AudioDestinationMac(AudioSourceProvider&, float sampleRate);
+    AudioDestinationMac(AudioIOCallback&, float sampleRate);
     virtual ~AudioDestinationMac();
 
     virtual void start();
@@ -57,7 +57,7 @@ private:
     OSStatus render(UInt32 numberOfFrames, AudioBufferList* ioData);
 
     AudioUnit m_outputUnit;
-    AudioSourceProvider& m_provider;
+    AudioIOCallback& m_callback;
     AudioBus m_renderBus;
 
     float m_sampleRate;
diff --git a/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp b/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
index 9d362dbf1..732c4df73 100644
--- a/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
@@ -572,6 +572,12 @@ String crashedPluginText()
     return String();
 }
 
+String blockedPluginByContentSecurityPolicyText()
+{
+    notImplemented();
+    return String();
+}
+
 String insecurePluginVersionText()
 {
     notImplemented();
diff --git a/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp b/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp
index 9159c12a4..24d200774 100644
--- a/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp
@@ -76,7 +76,7 @@ void Pasteboard::writeURL(KURL const& url, String const&, Frame*)
     BlackBerry::Platform::Clipboard::writeURL(url.string().utf8().data());
 }
 
-void Pasteboard::writePlainText(const String& text)
+void Pasteboard::writePlainText(const String& text, SmartReplaceOption)
 {
     BlackBerry::Platform::Clipboard::writePlainText(text.utf8().data());
 }
diff --git a/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp
index 7e258816f..26928accb 100644
--- a/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp
@@ -24,10 +24,12 @@
 #include "CSSValueKeywords.h"
 #include "Frame.h"
 #include "HTMLMediaElement.h"
+#include "HostWindow.h"
 #include "MediaControlElements.h"
 #include "MediaPlayerPrivateBlackBerry.h"
 #include "Page.h"
 #include "PaintInfo.h"
+#include "RenderFullScreen.h"
 #include "RenderProgress.h"
 #include "RenderSlider.h"
 #include "RenderView.h"
@@ -39,13 +41,13 @@ namespace WebCore {
 const unsigned smallRadius = 1;
 const unsigned largeRadius = 3;
 const unsigned lineWidth = 1;
-const int marginSize = 4;
-const int mediaControlsHeight = 32;
-const int mediaSliderThumbWidth = 40;
-const int mediaSliderThumbHeight = 13;
-const int mediaSliderThumbRadius = 5;
-const int sliderThumbWidth = 15;
-const int sliderThumbHeight = 25;
+const float marginSize = 4;
+const float mediaControlsHeight = 32;
+const float mediaSliderThumbWidth = 40;
+const float mediaSliderThumbHeight = 13;
+const float mediaSliderThumbRadius = 5;
+const float sliderThumbWidth = 15;
+const float sliderThumbHeight = 25;
 
 // Checkbox check scalers
 const float checkboxLeftX = 7 / 40.0;
@@ -158,13 +160,23 @@ static RenderSlider* determineRenderSlider(RenderObject* object)
     return toRenderSlider(object);
 }
 
-static int determineFullScreenMultiplier(Element* element)
+static float determineFullScreenMultiplier(Element* element)
 {
-    int fullScreenMultiplier = 1;
+    float fullScreenMultiplier = 1.0;
 #if ENABLE(FULLSCREEN_API) && ENABLE(VIDEO)
     if (element && element->document()->webkitIsFullScreen() && element->document()->webkitCurrentFullScreenElement() == toParentMediaElement(element)) {
         if (element->document()->page()->deviceScaleFactor() < scaleFactorThreshold)
             fullScreenMultiplier = fullScreenEnlargementFactor;
+
+        // The way the BlackBerry port implements the FULLSCREEN_API for media elements
+        // might result in the controls being oversized, proportionally to the current page
+        // scale. That happens because the fullscreen element gets sized to be as big as the
+        // viewport size, and the viewport size might get outstretched to fit to the screen dimensions.
+        // To fix that, lets strips out the Page scale factor from the media controls multiplier.
+        float scaleFactor = element->document()->view()->hostWindow()->platformPageClient()->currentZoomFactor();
+        static ViewportArguments defaultViewportArguments;
+        float scaleFactorFudge = 1 / element->document()->page()->deviceScaleFactor();
+        fullScreenMultiplier /= scaleFactor * scaleFactorFudge;
     }
 #endif
     return fullScreenMultiplier;
@@ -629,7 +641,7 @@ bool RenderThemeBlackBerry::paintMenuListButton(RenderObject* object, const Pain
 
 void RenderThemeBlackBerry::adjustSliderThumbSize(RenderStyle* style, Element* element) const
 {
-    int fullScreenMultiplier = 1;
+    float fullScreenMultiplier = 1;
     ControlPart part = style->appearance();
 
     if (part == MediaSliderThumbPart || part == MediaVolumeSliderThumbPart) {
@@ -750,14 +762,15 @@ bool RenderThemeBlackBerry::paintSliderThumb(RenderObject* object, const PaintIn
 
 void RenderThemeBlackBerry::adjustMediaControlStyle(StyleResolver*, RenderStyle* style, Element* element) const
 {
-    int fullScreenMultiplier = determineFullScreenMultiplier(element);
+    float fullScreenMultiplier = determineFullScreenMultiplier(element);
 
     // We use multiples of mediaControlsHeight to make all objects scale evenly
     Length controlsHeight(mediaControlsHeight * fullScreenMultiplier, Fixed);
     Length timeWidth(mediaControlsHeight * 3 / 2 * fullScreenMultiplier, Fixed);
     Length volumeHeight(mediaControlsHeight * 4 * fullScreenMultiplier, Fixed);
     Length padding(mediaControlsHeight / 8 * fullScreenMultiplier, Fixed);
-    int fontSize = mediaControlsHeight / 2 * fullScreenMultiplier;
+    float fontSize = mediaControlsHeight / 2 * fullScreenMultiplier;
+
     switch (style->appearance()) {
     case MediaPlayButtonPart:
     case MediaEnterFullscreenButtonPart:
@@ -785,7 +798,7 @@ void RenderThemeBlackBerry::adjustMediaControlStyle(StyleResolver*, RenderStyle*
 
 void RenderThemeBlackBerry::adjustSliderTrackStyle(StyleResolver*, RenderStyle* style, Element* element) const
 {
-    int fullScreenMultiplier = determineFullScreenMultiplier(element);
+    float fullScreenMultiplier = determineFullScreenMultiplier(element);
 
     // We use multiples of mediaControlsHeight to make all objects scale evenly
     Length controlsHeight(mediaControlsHeight * fullScreenMultiplier, Fixed);
@@ -881,23 +894,23 @@ bool RenderThemeBlackBerry::paintMediaSliderTrack(RenderObject* object, const Pa
     if (!mediaElement)
         return false;
 
-    int fullScreenMultiplier = determineFullScreenMultiplier(mediaElement);
+    float fullScreenMultiplier = determineFullScreenMultiplier(mediaElement);
     float loaded = 0;
     // FIXME: replace loaded with commented out one when buffer bug is fixed (see comment in
     // MediaPlayerPrivateMMrenderer::percentLoaded).
     // loaded = mediaElement->percentLoaded();
-    if (mediaElement->player())
+    if (mediaElement->player() && mediaElement->player()->implementation())
         loaded = static_cast<MediaPlayerPrivate *>(mediaElement->player()->implementation())->percentLoaded();
     float position = mediaElement->duration() > 0 ? (mediaElement->currentTime() / mediaElement->duration()) : 0;
 
-    int x = rect.x() + 2 * fullScreenMultiplier - fullScreenMultiplier / 2;
-    int y = rect.y() + 14 * fullScreenMultiplier + fullScreenMultiplier / 2;
-    int w = rect.width() - 4 * fullScreenMultiplier + fullScreenMultiplier / 2;
-    int h = 2 * fullScreenMultiplier;
+    int x = ceil(rect.x() + 2 * fullScreenMultiplier - fullScreenMultiplier / 2);
+    int y = ceil(rect.y() + 14 * fullScreenMultiplier + fullScreenMultiplier / 2);
+    int w = ceil(rect.width() - 4 * fullScreenMultiplier + fullScreenMultiplier / 2);
+    int h = ceil(2 * fullScreenMultiplier);
     IntRect rect2(x, y, w, h);
 
-    int wPlayed = (w * position);
-    int wLoaded = (w - mediaSliderThumbWidth * fullScreenMultiplier) * loaded + mediaSliderThumbWidth * fullScreenMultiplier;
+    int wPlayed = ceil(w * position);
+    int wLoaded = ceil((w - mediaSliderThumbWidth * fullScreenMultiplier) * loaded + mediaSliderThumbWidth * fullScreenMultiplier);
 
     IntRect played(x, y, wPlayed, h);
     IntRect buffered(x, y, wLoaded, h);
@@ -929,7 +942,7 @@ bool RenderThemeBlackBerry::paintMediaSliderThumb(RenderObject* object, const Pa
     if (!slider)
         return false;
 
-    int fullScreenMultiplier = determineFullScreenMultiplier(toElement(slider->node()));
+    float fullScreenMultiplier = determineFullScreenMultiplier(toElement(slider->node()));
 
     paintInfo.context->save();
     Path mediaThumbRoundedRectangle;
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.h b/Source/WebCore/platform/chromium/ClipboardChromium.h
index 526cfa8d5..a5cbf53eb 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.h
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.h
@@ -30,7 +30,7 @@
 #ifndef ClipboardChromium_h
 #define ClipboardChromium_h
 
-#include "CachedImage.h"
+#include "CachedImageClient.h"
 #include "ChromiumDataObject.h"
 #include "Clipboard.h"
 #include "DataTransferItem.h"
diff --git a/Source/WebCore/platform/chromium/MemoryUsageSupportChromium.cpp b/Source/WebCore/platform/chromium/MemoryUsageSupportChromium.cpp
index d21dece90..0fb570f3f 100644
--- a/Source/WebCore/platform/chromium/MemoryUsageSupportChromium.cpp
+++ b/Source/WebCore/platform/chromium/MemoryUsageSupportChromium.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "MemoryUsageSupport.h"
 
+#include <SkGraphics.h>
 #include <public/Platform.h>
 
 namespace WebCore {
@@ -65,4 +66,10 @@ bool MemoryUsageSupport::processMemorySizesInBytes(size_t* privateBytes, size_t*
     return WebKit::Platform::current()->processMemorySizesInBytes(privateBytes, sharedBytes);
 }
 
+void MemoryUsageSupport::memoryUsageByComponents(Vector<ComponentInfo>& components)
+{
+    size_t size = SkGraphics::GetFontCacheUsed();
+    components.append(ComponentInfo("GlyphCache", size));
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/PasteboardChromium.cpp b/Source/WebCore/platform/chromium/PasteboardChromium.cpp
index da8f16eea..94cc4f11e 100644
--- a/Source/WebCore/platform/chromium/PasteboardChromium.cpp
+++ b/Source/WebCore/platform/chromium/PasteboardChromium.cpp
@@ -98,8 +98,9 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     WebKit::Platform::current()->clipboard()->writeHTML(html, url, plainText, canSmartCopyOrDelete);
 }
 
-void Pasteboard::writePlainText(const String& text)
+void Pasteboard::writePlainText(const String& text, SmartReplaceOption)
 {
+    // FIXME: add support for smart replace
 #if OS(WINDOWS)
     String plainText(text);
     replaceNewlinesWithWindowsStyleNewlines(plainText);
diff --git a/Source/WebCore/platform/chromium/TraceEvent.h b/Source/WebCore/platform/chromium/TraceEvent.h
index f784a596d..89ef85ecd 100644
--- a/Source/WebCore/platform/chromium/TraceEvent.h
+++ b/Source/WebCore/platform/chromium/TraceEvent.h
@@ -168,9 +168,6 @@
 #include <wtf/DynamicAnnotations.h>
 #include <wtf/text/CString.h>
 
-// Issues begin trace event here and end trace event when the current scope ends.
-#define TRACE_EVENT(name, id, extra) TRACE_EVENT2("webkit", name, "id", id, "extra", extra)
-
 // By default, const char* argument values are assumed to have long-lived scope
 // and will not be copied. Use this macro to force a const char* to be copied.
 #define TRACE_STR_COPY(str) \
diff --git a/Source/WebKit/chromium/src/CCThreadImpl.cpp b/Source/WebCore/platform/chromium/support/CCThreadImpl.cpp
index ef7bb5cb3..a81df1b09 100644
--- a/Source/WebKit/chromium/src/CCThreadImpl.cpp
+++ b/Source/WebCore/platform/chromium/support/CCThreadImpl.cpp
@@ -25,13 +25,12 @@
 #include "config.h"
 #include "CCThreadImpl.h"
 
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebThread.h"
 #include "cc/CCCompletionEvent.h"
-#include <stdint.h>
+#include <public/Platform.h>
+#include <public/WebThread.h>
 
-using namespace WebCore;
+using WebCore::CCThread;
+using WebCore::CCCompletionEvent;
 
 namespace WebKit {
 
diff --git a/Source/WebKit/chromium/src/CCThreadImpl.h b/Source/WebCore/platform/chromium/support/CCThreadImpl.h
index 9b9900602..d69b8015a 100644
--- a/Source/WebKit/chromium/src/CCThreadImpl.h
+++ b/Source/WebCore/platform/chromium/support/CCThreadImpl.h
@@ -26,7 +26,6 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/Threading.h>
 
-
 #ifndef CCThreadImpl_h
 #define CCThreadImpl_h
 
diff --git a/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp b/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
index e7b1a22cf..bfc145dde 100644
--- a/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
+++ b/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
@@ -29,6 +29,7 @@
 
 #include "GraphicsContext3D.h"
 #include "GraphicsContext3DPrivate.h"
+#include "NotImplemented.h"
 #include <public/WebGraphicsContext3D.h>
 
 namespace WebCore {
@@ -181,4 +182,20 @@ void Extensions3DChromium::shallowFlushCHROMIUM()
     return m_private->webContext()->shallowFlushCHROMIUM();
 }
 
+void Extensions3DChromium::readnPixelsEXT(int x, int y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, GC3Dsizei bufSize, void *data)
+{
+    notImplemented();
+}
+
+void Extensions3DChromium::getnUniformfvEXT(GC3Duint program, int location, GC3Dsizei bufSize, float *params)
+{
+    notImplemented();
+}
+
+void Extensions3DChromium::getnUniformivEXT(GC3Duint program, int location, GC3Dsizei bufSize, int *params)
+{
+    notImplemented();
+}
+
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/support/PlatformGestureCurveFactory.cpp b/Source/WebCore/platform/chromium/support/PlatformGestureCurveFactory.cpp
new file mode 100644
index 000000000..50dccf39f
--- /dev/null
+++ b/Source/WebCore/platform/chromium/support/PlatformGestureCurveFactory.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformGestureCurveFactory.h"
+
+#include "FloatPoint.h"
+#include "IntRect.h"
+#include "TouchpadFlingPlatformGestureCurve.h"
+#include "WebFlingAnimatorToGestureCurveAdapter.h"
+
+namespace WebKit {
+
+PlatformGestureCurveFactory* PlatformGestureCurveFactory::get()
+{
+    DEFINE_STATIC_LOCAL(PlatformGestureCurveFactory, factory, ());
+    return &factory;
+}
+
+PassOwnPtr<WebCore::PlatformGestureCurve> PlatformGestureCurveFactory::createCurve(const WebCore::FloatPoint& point, const WebCore::IntRect& range)
+{
+    OwnPtr<WebFlingAnimator> flingAnimator = m_mockFlingAnimator.release();
+    if (!flingAnimator)
+        flingAnimator = adoptPtr(Platform::current()->createFlingAnimator());
+    if (!flingAnimator)
+        return WebCore::TouchpadFlingPlatformGestureCurve::create(point);
+
+    return WebFlingAnimatorToGestureCurveAdapter::create(point, range, flingAnimator.release());
+}
+
+void PlatformGestureCurveFactory::setWebFlingAnimatorForTest(PassOwnPtr<WebFlingAnimator> mockFlingAnimator)
+{
+    m_mockFlingAnimator = mockFlingAnimator;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/ColorChooserProxy.h b/Source/WebCore/platform/chromium/support/PlatformGestureCurveFactory.h
index 987f67b3c..85f7ecc59 100644
--- a/Source/WebKit/chromium/src/ColorChooserProxy.h
+++ b/Source/WebCore/platform/chromium/support/PlatformGestureCurveFactory.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,32 +23,28 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ColorChooserProxy_h
-#define ColorChooserProxy_h
+#ifndef PlatformGestureCurveFactory_h
+#define PlatformGestureCurveFactory_h
 
-#include "ColorChooser.h"
-#include "WebColorChooser.h"
-#include <wtf/OwnPtr.h>
+#include "PlatformGestureCurve.h"
+#include <public/WebFlingAnimator.h>
 #include <wtf/PassOwnPtr.h>
 
-#if ENABLE(INPUT_TYPE_COLOR)
-
 namespace WebKit {
 
-class ColorChooserProxy : public WebCore::ColorChooser {
+class PlatformGestureCurveFactory {
 public:
-    ColorChooserProxy(PassOwnPtr<WebColorChooser>);
-    virtual ~ColorChooserProxy();
+    static PlatformGestureCurveFactory* get();
 
-    virtual void setSelectedColor(const WebCore::Color&);
-    virtual void endChooser();
+    PassOwnPtr<WebCore::PlatformGestureCurve> createCurve(const WebCore::FloatPoint&, const WebCore::IntRect& range);
+    void setWebFlingAnimatorForTest(PassOwnPtr<WebFlingAnimator>);
 
 private:
-    OwnPtr<WebColorChooser> m_chooser;
+    ~PlatformGestureCurveFactory();
+
+    OwnPtr<WebFlingAnimator> m_mockFlingAnimator;
 };
 
 } // namespace WebKit
 
-#endif // ENABLE(INPUT_TYPE_COLOR)
-
-#endif // ColorChooserProxy_h
+#endif // PlatformGestureCurveFactory_h
diff --git a/Source/WebKit/chromium/src/WebCompositorImpl.cpp b/Source/WebCore/platform/chromium/support/WebCompositorImpl.cpp
index 369ae555a..e757c4076 100644
--- a/Source/WebKit/chromium/src/WebCompositorImpl.cpp
+++ b/Source/WebCore/platform/chromium/support/WebCompositorImpl.cpp
@@ -28,14 +28,10 @@
 #include "WebCompositorImpl.h"
 
 #include "CCThreadImpl.h"
-#include "GraphicsContext3D.h"
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "WebCompositorClient.h"
-#include "WebInputEvent.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCProxy.h"
 #include "cc/CCSettings.h"
+#include <public/Platform.h>
 #include <wtf/ThreadingPrimitives.h>
 
 using namespace WebCore;
@@ -50,6 +46,12 @@ void WebCompositor::initialize(WebThread* implThread)
 {
     WebCompositorImpl::initialize(implThread);
 }
+
+bool WebCompositor::threadingEnabled()
+{
+    return WebCompositorImpl::threadingEnabled();
+}
+
 void WebCompositor::shutdown()
 {
     WebCompositorImpl::shutdown();
@@ -88,6 +90,11 @@ void WebCompositorImpl::initialize(WebThread* implThread)
         CCProxy::setImplThread(0);
 }
 
+bool WebCompositorImpl::threadingEnabled()
+{
+    return s_implThread;
+}
+
 bool WebCompositorImpl::initialized()
 {
     return s_initialized;
diff --git a/Source/WebKit/chromium/src/WebCompositorImpl.h b/Source/WebCore/platform/chromium/support/WebCompositorImpl.h
index 34c6bd0fd..a1a49c25b 100644
--- a/Source/WebKit/chromium/src/WebCompositorImpl.h
+++ b/Source/WebCore/platform/chromium/support/WebCompositorImpl.h
@@ -26,7 +26,7 @@
 #ifndef WebCompositorImpl_h
 #define WebCompositorImpl_h
 
-#include "WebCompositor.h"
+#include <public/WebCompositor.h>
 
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
@@ -49,6 +49,7 @@ private:
 
     friend class WebCompositor;
     static void initialize(WebThread* implThread);
+    static bool threadingEnabled();
     static void shutdown();
 
     static bool s_initialized;
diff --git a/Source/WebCore/platform/chromium/support/WebCompositorSharedQuadState.cpp b/Source/WebCore/platform/chromium/support/WebCompositorSharedQuadState.cpp
deleted file mode 100644
index 91ef3eaf9..000000000
--- a/Source/WebCore/platform/chromium/support/WebCompositorSharedQuadState.cpp
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <public/WebCompositorSharedQuadState.h>
-
-#include "FloatQuad.h"
-#include "cc/CCMathUtil.h"
-
-using WebCore::FloatQuad;
-using WebCore::IntRect;
-
-namespace WebKit {
-
-WebCompositorSharedQuadState::WebCompositorSharedQuadState()
-    : id(0)
-    , opacity(0)
-    , opaque(false)
-{
-}
-
-PassOwnPtr<WebCompositorSharedQuadState> WebCompositorSharedQuadState::create(int id, const WebTransformationMatrix& quadTransform, const IntRect& visibleContentRect, const IntRect& scissorRect, float opacity, bool opaque)
-{
-    return adoptPtr(new WebCompositorSharedQuadState(id, quadTransform, visibleContentRect, scissorRect, opacity, opaque));
-}
-
-WebCompositorSharedQuadState::WebCompositorSharedQuadState(int id, const WebTransformationMatrix& quadTransform, const IntRect& visibleContentRect, const IntRect& scissorRect, float opacity, bool opaque)
-    : id(id)
-    , quadTransform(quadTransform)
-    , visibleContentRect(visibleContentRect)
-    , scissorRect(scissorRect)
-    , opacity(opacity)
-    , opaque(opaque)
-{
-}
-
-bool WebCompositorSharedQuadState::isLayerAxisAlignedIntRect() const
-{
-    // Note: this doesn't consider window or projection matrices.
-    // Assume that they're orthonormal and have integer scales and translations.
-    bool clipped = false;
-    FloatQuad quad = WebCore::CCMathUtil::mapQuad(quadTransform, FloatQuad(IntRect(visibleContentRect)), clipped);
-    return !clipped && quad.isRectilinear() && quad.boundingBox().isExpressibleAsIntRect();
-}
-
-}
diff --git a/Source/WebCore/platform/chromium/support/WebFlingAnimatorToGestureCurveAdapter.h b/Source/WebCore/platform/chromium/support/WebFlingAnimatorToGestureCurveAdapter.h
new file mode 100644
index 000000000..56f83bd2a
--- /dev/null
+++ b/Source/WebCore/platform/chromium/support/WebFlingAnimatorToGestureCurveAdapter.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFlingAnimatorToGestureCurveAdapter_h
+#define WebFlingAnimatorToGestureCurveAdapter_h
+
+#include "FloatPoint.h"
+#include "IntPoint.h"
+#include "IntRect.h"
+#include "PlatformGestureCurve.h"
+#include "PlatformGestureCurveTarget.h"
+#include <public/Platform.h>
+#include <public/WebFlingAnimator.h>
+
+namespace WebKit {
+
+class WebFlingAnimatorToGestureCurveAdapter : public WebCore::PlatformGestureCurve {
+public:
+    static PassOwnPtr<PlatformGestureCurve> create(const WebCore::FloatPoint& velocity, const WebCore::IntRect& range, PassOwnPtr<WebFlingAnimator> animator)
+    {
+        return adoptPtr(new WebFlingAnimatorToGestureCurveAdapter(velocity, range, animator));
+    }
+
+    // WebCore::PlatformGestureCurve implementation:
+    virtual const char* debugName() const OVERRIDE { return "WebFlingAnimatorToGestureCurveAdapter"; }
+    virtual bool apply(double time, WebCore::PlatformGestureCurveTarget* target) OVERRIDE
+    {
+        if (!m_animator->updatePosition())
+            return false;
+
+        WebCore::IntPoint currentPosition = m_animator->getCurrentPosition();
+        target->scrollBy(WebCore::IntPoint(currentPosition - m_lastPosition));
+        m_lastPosition = currentPosition;
+        return true;
+    }
+
+private:
+    WebFlingAnimatorToGestureCurveAdapter(const WebCore::FloatPoint& velocity, const WebCore::IntRect& range, PassOwnPtr<WebFlingAnimator> animator)
+        : m_animator(animator)
+    {
+        m_animator->startFling(velocity, range);
+    }
+
+    OwnPtr<WebFlingAnimator> m_animator;
+    WebCore::IntPoint m_lastPosition;
+};
+
+}
+
+#endif // WebFlingAnimatorToGestureCurveAdapter_h
diff --git a/Source/WebCore/platform/chromium/support/WebMediaStreamSource.cpp b/Source/WebCore/platform/chromium/support/WebMediaStreamSource.cpp
index 70ef70809..a51693610 100644
--- a/Source/WebCore/platform/chromium/support/WebMediaStreamSource.cpp
+++ b/Source/WebCore/platform/chromium/support/WebMediaStreamSource.cpp
@@ -36,6 +36,7 @@
 
 #include "MediaStreamSource.h"
 #include <public/WebString.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 using namespace WebCore;
@@ -108,6 +109,29 @@ WebMediaStreamSource::ReadyState WebMediaStreamSource::readyState() const
     return static_cast<ReadyState>(m_private->readyState());
 }
 
+class ExtraDataContainer : public WebCore::MediaStreamSource::ExtraData {
+public:
+    ExtraDataContainer(WebMediaStreamSource::ExtraData* extraData) : m_extraData(WTF::adoptPtr(extraData)) { }
+
+    WebMediaStreamSource::ExtraData* extraData() { return m_extraData.get(); }
+
+private:
+    OwnPtr<WebMediaStreamSource::ExtraData> m_extraData;
+};
+
+WebMediaStreamSource::ExtraData* WebMediaStreamSource::extraData() const
+{
+    RefPtr<MediaStreamSource::ExtraData> data = m_private->extraData();
+    if (!data)
+        return 0;
+    return static_cast<ExtraDataContainer*>(data.get())->extraData();
+}
+
+void WebMediaStreamSource::setExtraData(ExtraData* extraData)
+{
+    m_private->setExtraData(adoptRef(new ExtraDataContainer(extraData)));
+}
+
 } // namespace WebKit
 
 #endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/platform/chromium/support/WebRTCConfiguration.cpp b/Source/WebCore/platform/chromium/support/WebRTCConfiguration.cpp
new file mode 100644
index 000000000..5047ca28e
--- /dev/null
+++ b/Source/WebCore/platform/chromium/support/WebRTCConfiguration.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MEDIA_STREAM)
+
+#include <public/WebRTCConfiguration.h>
+
+#include "RTCConfiguration.h"
+#include <public/WebString.h>
+#include <public/WebURL.h>
+#include <public/WebVector.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebRTCICEServer::WebRTCICEServer(const PassRefPtr<RTCIceServer>& iceServer)
+    : m_private(iceServer)
+{
+}
+
+void WebRTCICEServer::assign(const WebRTCICEServer& other)
+{
+    m_private = other.m_private;
+}
+
+void WebRTCICEServer::reset()
+{
+    m_private.reset();
+}
+
+WebURL WebRTCICEServer::uri() const
+{
+    ASSERT(!isNull());
+    return m_private->uri();
+}
+
+WebString WebRTCICEServer::credential() const
+{
+    ASSERT(!isNull());
+    return m_private->credential();
+}
+
+WebRTCConfiguration::WebRTCConfiguration(const PassRefPtr<RTCConfiguration>& configuration)
+    : m_private(configuration)
+{
+}
+
+void WebRTCConfiguration::assign(const WebRTCConfiguration& other)
+{
+    m_private = other.m_private;
+}
+
+void WebRTCConfiguration::reset()
+{
+    m_private.reset();
+}
+
+size_t WebRTCConfiguration::numberOfServers() const
+{
+    ASSERT(!isNull());
+    return m_private->numberOfServers();
+}
+
+WebRTCICEServer WebRTCConfiguration::server(size_t index) const
+{
+    ASSERT(!isNull());
+    return WebRTCICEServer(m_private->server(index));
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/platform/chromium/support/WebScrollbarThemeGeometryNative.cpp b/Source/WebCore/platform/chromium/support/WebScrollbarThemeGeometryNative.cpp
new file mode 100644
index 000000000..e5eab359e
--- /dev/null
+++ b/Source/WebCore/platform/chromium/support/WebScrollbarThemeGeometryNative.cpp
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WebScrollbarThemeGeometryNative.h"
+
+#include "ScrollbarThemeComposite.h"
+#include "WebScrollbarThemeClientImpl.h"
+#include <public/WebScrollbar.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+PassOwnPtr<WebKit::WebScrollbarThemeGeometryNative> WebScrollbarThemeGeometryNative::create(WebCore::ScrollbarThemeComposite* theme)
+{
+    return adoptPtr(new WebScrollbarThemeGeometryNative(theme));
+}
+
+WebScrollbarThemeGeometryNative::WebScrollbarThemeGeometryNative(WebCore::ScrollbarThemeComposite* theme)
+    : m_theme(theme)
+{
+}
+
+WebScrollbarThemeGeometryNative* WebScrollbarThemeGeometryNative::clone() const
+{
+    return new WebScrollbarThemeGeometryNative(m_theme);
+}
+
+int WebScrollbarThemeGeometryNative::thumbPosition(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->thumbPosition(&client);
+}
+
+int WebScrollbarThemeGeometryNative::thumbLength(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->thumbLength(&client);
+}
+
+int WebScrollbarThemeGeometryNative::trackPosition(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->trackPosition(&client);
+}
+
+int WebScrollbarThemeGeometryNative::trackLength(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->trackLength(&client);
+}
+
+bool WebScrollbarThemeGeometryNative::hasButtons(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->hasButtons(&client);
+}
+
+bool WebScrollbarThemeGeometryNative::hasThumb(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->hasThumb(&client);
+}
+
+WebRect WebScrollbarThemeGeometryNative::trackRect(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->trackRect(&client);
+}
+
+WebRect WebScrollbarThemeGeometryNative::thumbRect(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->thumbRect(&client);
+}
+
+int WebScrollbarThemeGeometryNative::minimumThumbLength(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->minimumThumbLength(&client);
+}
+
+int WebScrollbarThemeGeometryNative::scrollbarThickness(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->scrollbarThickness(client.controlSize());
+}
+
+WebRect WebScrollbarThemeGeometryNative::backButtonStartRect(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->backButtonRect(&client, BackButtonStartPart, false);
+}
+
+WebRect WebScrollbarThemeGeometryNative::backButtonEndRect(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->backButtonRect(&client, BackButtonEndPart, false);
+}
+
+WebRect WebScrollbarThemeGeometryNative::forwardButtonStartRect(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->forwardButtonRect(&client, ForwardButtonStartPart, false);
+}
+
+WebRect WebScrollbarThemeGeometryNative::forwardButtonEndRect(WebScrollbar* scrollbar)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->forwardButtonRect(&client, ForwardButtonEndPart, false);
+}
+
+WebRect WebScrollbarThemeGeometryNative::constrainTrackRectToTrackPieces(WebScrollbar* scrollbar, const WebRect& rect)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    return m_theme->constrainTrackRectToTrackPieces(&client, IntRect(rect));
+}
+
+void WebScrollbarThemeGeometryNative::splitTrack(WebScrollbar* scrollbar, const WebRect& webTrack, WebRect& webStartTrack, WebRect& webThumb, WebRect& webEndTrack)
+{
+    WebScrollbarThemeClientImpl client(scrollbar);
+    IntRect track(webTrack);
+    IntRect startTrack;
+    IntRect thumb;
+    IntRect endTrack;
+    m_theme->splitTrack(&client, track, startTrack, thumb, endTrack);
+
+    webStartTrack = startTrack;
+    webThumb = thumb;
+    webEndTrack = endTrack;
+}
+
+} // namespace WebKit
diff --git a/Source/WebCore/platform/chromium/support/WebScrollbarThemeGeometryNative.h b/Source/WebCore/platform/chromium/support/WebScrollbarThemeGeometryNative.h
new file mode 100644
index 000000000..80233601d
--- /dev/null
+++ b/Source/WebCore/platform/chromium/support/WebScrollbarThemeGeometryNative.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScrollbarThemeGeometryNative_h
+#define WebScrollbarThemeGeometryNative_h
+
+#include <public/WebRect.h>
+#include <public/WebScrollbarThemeGeometry.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+class ScrollbarThemeComposite;
+}
+
+namespace WebKit {
+
+class WebScrollbar;
+
+class WebScrollbarThemeGeometryNative : public WebScrollbarThemeGeometry {
+public:
+    static PassOwnPtr<WebScrollbarThemeGeometryNative> create(WebCore::ScrollbarThemeComposite*);
+
+    // WebScrollbarThemeGeometry overrides
+    virtual WebScrollbarThemeGeometryNative* clone() const OVERRIDE;
+    virtual int thumbPosition(WebScrollbar*) OVERRIDE;
+    virtual int thumbLength(WebScrollbar*) OVERRIDE;
+    virtual int trackPosition(WebScrollbar*) OVERRIDE;
+    virtual int trackLength(WebScrollbar*) OVERRIDE;
+    virtual bool hasButtons(WebScrollbar*) OVERRIDE;
+    virtual bool hasThumb(WebScrollbar*) OVERRIDE;
+    virtual WebRect trackRect(WebScrollbar*) OVERRIDE;
+    virtual WebRect thumbRect(WebScrollbar*) OVERRIDE;
+    virtual int minimumThumbLength(WebScrollbar*) OVERRIDE;
+    virtual int scrollbarThickness(WebScrollbar*) OVERRIDE;
+    virtual WebRect backButtonStartRect(WebScrollbar*) OVERRIDE;
+    virtual WebRect backButtonEndRect(WebScrollbar*) OVERRIDE;
+    virtual WebRect forwardButtonStartRect(WebScrollbar*) OVERRIDE;
+    virtual WebRect forwardButtonEndRect(WebScrollbar*) OVERRIDE;
+    virtual WebRect constrainTrackRectToTrackPieces(WebScrollbar*, const WebRect&) OVERRIDE;
+    virtual void splitTrack(WebScrollbar*, const WebRect& track, WebRect& startTrack, WebRect& thumb, WebRect& endTrack) OVERRIDE;
+
+private:
+    explicit WebScrollbarThemeGeometryNative(WebCore::ScrollbarThemeComposite*);
+
+    // The theme is not owned by this class. It is assumed that the theme is a
+    // static pointer and its lifetime is essentially infinite. Only thread-safe
+    // functions on the theme can be called by this theme.
+    WebCore::ScrollbarThemeComposite* m_theme;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebCore/platform/chromium/support/WebSharedGraphicsContext3D.cpp b/Source/WebCore/platform/chromium/support/WebSharedGraphicsContext3D.cpp
new file mode 100644
index 000000000..52d054de0
--- /dev/null
+++ b/Source/WebCore/platform/chromium/support/WebSharedGraphicsContext3D.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <public/WebSharedGraphicsContext3D.h>
+
+#include "GraphicsContext3DPrivate.h"
+#include "SharedGraphicsContext3D.h"
+
+using WebCore::GraphicsContext3DPrivate;
+using WebCore::SharedGraphicsContext3D;
+
+namespace WebKit {
+
+WebGraphicsContext3D* WebSharedGraphicsContext3D::mainThreadContext()
+{
+    return GraphicsContext3DPrivate::extractWebGraphicsContext3D(SharedGraphicsContext3D::get().get());
+}
+
+GrContext* WebSharedGraphicsContext3D::mainThreadGrContext()
+{
+    return SharedGraphicsContext3D::get() ? SharedGraphicsContext3D::get()->grContext() : 0;
+}
+
+
+WebGraphicsContext3D* WebSharedGraphicsContext3D::compositorThreadContext()
+{
+    return GraphicsContext3DPrivate::extractWebGraphicsContext3D(SharedGraphicsContext3D::getForImplThread().get());
+}
+
+GrContext* WebSharedGraphicsContext3D::compositorThreadGrContext()
+{
+    return SharedGraphicsContext3D::getForImplThread() ? SharedGraphicsContext3D::getForImplThread()->grContext() : 0;
+}
+
+bool WebSharedGraphicsContext3D::haveCompositorThreadContext()
+{
+    return SharedGraphicsContext3D::haveForImplThread();
+}
+
+bool WebSharedGraphicsContext3D::createCompositorThreadContext()
+{
+    return SharedGraphicsContext3D::createForImplThread();
+}
+
+}
+
diff --git a/Source/WebCore/platform/chromium/support/WebTransformationMatrix.cpp b/Source/WebCore/platform/chromium/support/WebTransformationMatrix.cpp
index cb259f051..6d99440d5 100644
--- a/Source/WebCore/platform/chromium/support/WebTransformationMatrix.cpp
+++ b/Source/WebCore/platform/chromium/support/WebTransformationMatrix.cpp
@@ -422,19 +422,4 @@ TransformationMatrix WebTransformationMatrix::toWebCoreTransform() const
     return m_private;
 }
 
-FloatPoint3D WebTransformationMatrix::mapPoint(const FloatPoint3D& p) const
-{
-    return m_private.mapPoint(p);
-}
-
-FloatPoint WebTransformationMatrix::mapPoint(const FloatPoint& p) const
-{
-    return m_private.mapPoint(p);
-}
-
-IntPoint WebTransformationMatrix::mapPoint(const IntPoint& p) const
-{
-    return m_private.mapPoint(p);
-}
-
 } // namespace WebKit
diff --git a/Source/WebCore/platform/efl/BatteryProviderEfl.cpp b/Source/WebCore/platform/efl/BatteryProviderEfl.cpp
index c5d030a3d..2c15efa42 100644
--- a/Source/WebCore/platform/efl/BatteryProviderEfl.cpp
+++ b/Source/WebCore/platform/efl/BatteryProviderEfl.cpp
@@ -152,15 +152,14 @@ void BatteryProviderEfl::setBatteryClient(void* data, void* replyData, DBusError
         dischargingTime = property->val.x;
     }
 
-    double level = 0;
     bool levelChanged = false;
-
     property = static_cast<E_Ukit_Property*>(eina_hash_find(eukitPropertyNames->properties, "Percentage"));
     if (!property)
         return;
-    if (!clientBatteryStatus || clientBatteryStatus->level() != property->val.d)
+
+    double level = property->val.d / 100;
+    if (!clientBatteryStatus || clientBatteryStatus->level() != level)
         levelChanged = true;
-    level = property->val.d;
 
     WTF::RefPtr<BatteryStatus> batteryStatus = BatteryStatus::create(charging, chargingTime, dischargingTime, level);
     if (chargingChanged)
diff --git a/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp b/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
index 263b5b3bc..21aa5f23e 100644
--- a/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
+++ b/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
@@ -560,12 +560,23 @@ String crashedPluginText()
     return String::fromUTF8("plugin crashed");
 }
 
+String blockedPluginByContentSecurityPolicyText()
+{
+    notImplemented();
+    return String();
+}
+
 String insecurePluginVersionText()
 {
     notImplemented();
     return String();
 }
 
+String unacceptableTLSCertificate()
+{
+    return String::fromUTF8("Unacceptable TLS certificate");
+}
+
 String localizedString(const char* key)
 {
     return String::fromUTF8(key, strlen(key));
diff --git a/Source/WebCore/platform/efl/PasteboardEfl.cpp b/Source/WebCore/platform/efl/PasteboardEfl.cpp
index 08004a53a..95b2a3426 100644
--- a/Source/WebCore/platform/efl/PasteboardEfl.cpp
+++ b/Source/WebCore/platform/efl/PasteboardEfl.cpp
@@ -46,7 +46,7 @@ Pasteboard::Pasteboard()
     notImplemented();
 }
 
-void Pasteboard::writePlainText(const String&)
+void Pasteboard::writePlainText(const String&, SmartReplaceOption)
 {
     notImplemented();
 }
diff --git a/Source/WebCore/platform/efl/PlatformTouchEventEfl.cpp b/Source/WebCore/platform/efl/PlatformTouchEventEfl.cpp
deleted file mode 100644
index 61316d27d..000000000
--- a/Source/WebCore/platform/efl/PlatformTouchEventEfl.cpp
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) 2009-2010 Samsung Electronics
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "PlatformTouchEvent.h"
-
-#include "ewk_frame.h"
-#include <wtf/CurrentTime.h>
-
-#if ENABLE(TOUCH_EVENTS)
-
-namespace WebCore {
-
-PlatformTouchEvent::PlatformTouchEvent(const Eina_List* points, const IntPoint pos, PlatformEvent::Type type, PlatformEvent::Modifiers modifiers)
-    : PlatformEvent(type, modifiers, currentTime())
-{
-    const Eina_List* list;
-    void* item;
-
-    EINA_LIST_FOREACH(points, list, item) {
-        Ewk_Touch_Point* point = static_cast<Ewk_Touch_Point*>(item);
-        IntPoint pnt = IntPoint(point->x - pos.x(), point->y - pos.y());
-        m_touchPoints.append(PlatformTouchPoint(point->id, pnt, static_cast<PlatformTouchPoint::State>(point->state)));
-    }
-}
-
-}
-
-#endif
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.cpp b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
index b466cbf0f..8edc2aafa 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -29,6 +29,7 @@
 #include "CSSValueKeywords.h"
 #include "GraphicsContext.h"
 #include "HTMLInputElement.h"
+#include "InputType.h"
 #include "NotImplemented.h"
 #include "Page.h"
 #include "PaintInfo.h"
@@ -326,6 +327,9 @@ bool RenderThemeEfl::paintThemePart(RenderObject* object, FormType type, const P
     // Currently, only sliders needs this message; if other widget ever needs special
     // treatment, move them to special functions.
     if (type == SliderVertical || type == SliderHorizontal) {
+        if (!object->isSlider())
+            return true; // probably have -webkit-appearance: slider..
+
         RenderSlider* renderSlider = toRenderSlider(object);
         HTMLInputElement* input = renderSlider->node()->toInputElement();
         Edje_Message_Float_Set* msg;
@@ -744,8 +748,15 @@ LayoutUnit RenderThemeEfl::baselinePosition(const RenderObject* object) const
 bool RenderThemeEfl::paintSliderTrack(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
     if (object->style()->appearance() == SliderHorizontalPart)
-        return paintThemePart(object, SliderHorizontal, info, rect);
-    return paintThemePart(object, SliderVertical, info, rect);
+        paintThemePart(object, SliderHorizontal, info, rect);
+    else
+        paintThemePart(object, SliderVertical, info, rect);
+
+#if ENABLE(DATALIST_ELEMENT)
+    paintSliderTicks(object, info, rect);
+#endif
+
+    return false;
 }
 
 void RenderThemeEfl::adjustSliderTrackStyle(StyleResolver* styleResolver, RenderStyle* style, Element* element) const
@@ -789,17 +800,27 @@ void RenderThemeEfl::adjustSliderThumbSize(RenderStyle* style, Element*) const
 #if ENABLE(DATALIST_ELEMENT)
 IntSize RenderThemeEfl::sliderTickSize() const
 {
-    // FIXME: We need to set this to the size of one tick mark.
-    return IntSize(0, 0);
+    return IntSize(1, 6);
 }
 
 int RenderThemeEfl::sliderTickOffsetFromTrackCenter() const
 {
-    // FIXME: We need to set this to the position of the tick marks.
-    return 0;
+    static const int sliderTickOffset = -12;
+
+    return sliderTickOffset;
 }
 #endif
 
+bool RenderThemeEfl::supportsDataListUI(const AtomicString& type) const
+{
+#if ENABLE(DATALIST_ELEMENT)
+    // FIXME: We need to support other types.
+    return type == InputTypeNames::range();
+#else
+    return false;
+#endif
+}
+
 bool RenderThemeEfl::paintSliderThumb(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
     // We've already painted it in paintSliderTrack(), no need to do anything here.
@@ -1052,6 +1073,9 @@ double RenderThemeEfl::animationDurationForProgressBar(RenderProgress*) const
 
 bool RenderThemeEfl::paintProgressBar(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
+    if (!object->isProgress())
+        return true;
+
     return paintThemePart(object, ProgressBar, info, rect);
 }
 #endif
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.h b/Source/WebCore/platform/efl/RenderThemeEfl.h
index 594377ab8..641e52619 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.h
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.h
@@ -166,6 +166,8 @@ public:
     virtual int sliderTickOffsetFromTrackCenter() const OVERRIDE;
 #endif
 
+    virtual bool supportsDataListUI(const AtomicString&) const OVERRIDE;
+
     virtual bool paintSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustInnerSpinButtonStyle(StyleResolver*, RenderStyle*, Element*) const;
diff --git a/Source/WebCore/platform/graphics/BitmapImage.cpp b/Source/WebCore/platform/graphics/BitmapImage.cpp
index 45460f8d3..e286a7c8b 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.cpp
+++ b/Source/WebCore/platform/graphics/BitmapImage.cpp
@@ -322,11 +322,13 @@ NativeImagePtr BitmapImage::nativeImageForCurrentFrame()
 
 bool BitmapImage::frameHasAlphaAtIndex(size_t index)
 {
-    // When a frame has not finished decoding, always mark it as having alpha.
-    // See ImageSource::framehasAlphaAtIndex for explanation of why incomplete images claim to have alpha.
-    if (!ensureFrameIsCached(index))
+    if (m_frames.size() <= index)
         return true;
-    return m_frames[index].m_hasAlpha;
+
+    if (m_frames[index].m_haveMetadata)
+        return m_frames[index].m_hasAlpha;
+
+    return m_source.frameHasAlphaAtIndex(index);
 }
 
 bool BitmapImage::currentFrameHasAlpha()
@@ -341,9 +343,13 @@ ImageOrientation BitmapImage::currentFrameOrientation()
 
 ImageOrientation BitmapImage::frameOrientationAtIndex(size_t index)
 {
-    if (!ensureFrameIsCached(index))
+    if (m_frames.size() <= index)
         return DefaultImageOrientation;
-    return m_frames[index].m_orientation;
+
+    if (m_frames[index].m_haveMetadata)
+        return m_frames[index].m_orientation;
+
+    return m_source.orientationAtIndex(index);
 }
 
 #if !ASSERT_DISABLED
diff --git a/Source/WebCore/platform/graphics/BitmapImage.h b/Source/WebCore/platform/graphics/BitmapImage.h
index f5bfeb145..05212804e 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.h
+++ b/Source/WebCore/platform/graphics/BitmapImage.h
@@ -31,6 +31,7 @@
 #include "Image.h"
 #include "Color.h"
 #include "ImageOrientation.h"
+#include "ImageSource.h"
 #include "IntSize.h"
 
 #if PLATFORM(MAC)
diff --git a/Source/WebCore/platform/graphics/Color.cpp b/Source/WebCore/platform/graphics/Color.cpp
index 73d8e95ed..a90fcd4e0 100644
--- a/Source/WebCore/platform/graphics/Color.cpp
+++ b/Source/WebCore/platform/graphics/Color.cpp
@@ -182,9 +182,6 @@ Color::Color(const char* name)
 
 String Color::serialized() const
 {
-    DEFINE_STATIC_LOCAL(const String, commaSpace, (", "));
-    DEFINE_STATIC_LOCAL(const String, rgbaParen, ("rgba("));
-
     if (!hasAlpha()) {
         StringBuilder builder;
         builder.reserveCapacity(7);
@@ -195,21 +192,23 @@ String Color::serialized() const
         return builder.toString();
     }
 
-    Vector<UChar> result;
+    Vector<LChar> result;
     result.reserveInitialCapacity(28);
+    const char commaSpace[] = ", ";
+    const char rgbaParen[] = "rgba(";
 
-    append(result, rgbaParen);
+    result.append(rgbaParen, 5);
     appendNumber(result, red());
-    append(result, commaSpace);
+    result.append(commaSpace, 2);
     appendNumber(result, green());
-    append(result, commaSpace);
+    result.append(commaSpace, 2);
     appendNumber(result, blue());
-    append(result, commaSpace);
+    result.append(commaSpace, 2);
 
     if (!alpha())
         result.append('0');
     else {
-        NumberToUStringBuffer buffer;
+        NumberToLStringBuffer buffer;
         unsigned length = DecimalNumber(alpha() / 255.0).toStringDecimal(buffer, WTF::NumberToStringBufferLength);
         result.append(buffer, length);
     }
diff --git a/Source/WebCore/platform/graphics/Extensions3D.h b/Source/WebCore/platform/graphics/Extensions3D.h
index 7cf9420fc..05f30fd47 100644
--- a/Source/WebCore/platform/graphics/Extensions3D.h
+++ b/Source/WebCore/platform/graphics/Extensions3D.h
@@ -177,6 +177,11 @@ public:
 
     // GL_CHROMIUM_copy_texture
     virtual void copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum) = 0;
+
+    // EXT Robustness - uses getGraphicsResetStatusARB
+    virtual void readnPixelsEXT(int x, int y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, GC3Dsizei bufSize, void *data) = 0;
+    virtual void getnUniformfvEXT(GC3Duint program, int location, GC3Dsizei bufSize, float *params) = 0;
+    virtual void getnUniformivEXT(GC3Duint program, int location, GC3Dsizei bufSize, int *params) = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/FloatPoint.h b/Source/WebCore/platform/graphics/FloatPoint.h
index a601a9dff..90e6c4b6d 100644
--- a/Source/WebCore/platform/graphics/FloatPoint.h
+++ b/Source/WebCore/platform/graphics/FloatPoint.h
@@ -77,6 +77,7 @@ public:
     FloatPoint(float x, float y) : m_x(x), m_y(y) { }
     FloatPoint(const IntPoint&);
     FloatPoint(const FractionalLayoutPoint&);
+    explicit FloatPoint(const FloatSize& size) : m_x(size.width()), m_y(size.height()) { }
 
     static FloatPoint zero() { return FloatPoint(); }
 
@@ -243,17 +244,22 @@ inline float operator*(const FloatPoint& a, const FloatPoint& b)
 
 inline IntPoint roundedIntPoint(const FloatPoint& p)
 {
-    return IntPoint(static_cast<int>(roundf(p.x())), static_cast<int>(roundf(p.y())));
+    return IntPoint(clampToInteger(roundf(p.x())), clampToInteger(roundf(p.y())));
 }
 
 inline IntPoint flooredIntPoint(const FloatPoint& p)
 {
-    return IntPoint(static_cast<int>(p.x()), static_cast<int>(p.y()));
+    return IntPoint(clampToInteger(floorf(p.x())), clampToInteger(floorf(p.y())));
+}
+
+inline IntPoint ceiledIntPoint(const FloatPoint& p)
+{
+    return IntPoint(clampToInteger(ceilf(p.x())), clampToInteger(ceilf(p.y())));
 }
 
 inline IntSize flooredIntSize(const FloatPoint& p)
 {
-    return IntSize(static_cast<int>(p.x()), static_cast<int>(p.y()));
+    return IntSize(clampToInteger(floorf(p.x())), clampToInteger(floorf(p.y())));
 }
 
 float findSlope(const FloatPoint& p1, const FloatPoint& p2, float& c);
diff --git a/Source/WebCore/platform/graphics/FloatRect.cpp b/Source/WebCore/platform/graphics/FloatRect.cpp
index b43fc74a2..f31c6ccdf 100644
--- a/Source/WebCore/platform/graphics/FloatRect.cpp
+++ b/Source/WebCore/platform/graphics/FloatRect.cpp
@@ -214,26 +214,20 @@ void FloatRect::fitToPoints(const FloatPoint& p0, const FloatPoint& p1, const Fl
 
 IntRect enclosingIntRect(const FloatRect& rect)
 {
-    float left = floorf(rect.x());
-    float top = floorf(rect.y());
-    float width = ceilf(rect.maxX()) - left;
-    float height = ceilf(rect.maxY()) - top;
-    
-    return IntRect(clampToInteger(left), clampToInteger(top), 
-                   clampToInteger(width), clampToInteger(height));
+    IntPoint location = flooredIntPoint(rect.minXMinYCorner());
+    IntPoint maxPoint = ceiledIntPoint(rect.maxXMaxYCorner());
+
+    return IntRect(location, maxPoint - location);
 }
 
 IntRect enclosedIntRect(const FloatRect& rect)
 {
-    int x = clampToInteger(ceilf(rect.x()));
-    int y = clampToInteger(ceilf(rect.y()));
-    float maxX = clampToInteger(floorf(rect.maxX()));
-    float maxY = clampToInteger(floorf(rect.maxY()));
-    // A rect of width 0 should not become a rect of width -1 due to ceil/floor.
-    int width = max(clampToInteger(maxX - x), 0);
-    int height = max(clampToInteger(maxY - y), 0);
-
-    return IntRect(x, y, width, height);
+    IntPoint location = ceiledIntPoint(rect.minXMinYCorner());
+    IntPoint maxPoint = flooredIntPoint(rect.maxXMaxYCorner());
+    IntSize size = maxPoint - location;
+    size.clampNegativeToZero();
+
+    return IntRect(location, size);
 }
 
 IntRect roundedIntRect(const FloatRect& rect)
diff --git a/Source/WebCore/platform/graphics/FloatSize.h b/Source/WebCore/platform/graphics/FloatSize.h
index 5f01fbb12..b1d72a58d 100644
--- a/Source/WebCore/platform/graphics/FloatSize.h
+++ b/Source/WebCore/platform/graphics/FloatSize.h
@@ -186,12 +186,12 @@ inline bool operator!=(const FloatSize& a, const FloatSize& b)
 
 inline IntSize roundedIntSize(const FloatSize& p)
 {
-    return IntSize(static_cast<int>(roundf(p.width())), static_cast<int>(roundf(p.height())));
+    return IntSize(clampToInteger(roundf(p.width())), clampToInteger(roundf(p.height())));
 }
 
 inline IntSize flooredIntSize(const FloatSize& p)
 {
-    return IntSize(static_cast<int>(p.width()), static_cast<int>(p.height()));
+    return IntSize(clampToInteger(floorf(p.width())), clampToInteger(floorf(p.height())));
 }
 
 inline IntSize expandedIntSize(const FloatSize& p)
@@ -201,7 +201,7 @@ inline IntSize expandedIntSize(const FloatSize& p)
 
 inline IntPoint flooredIntPoint(const FloatSize& p)
 {
-    return IntPoint(static_cast<int>(p.width()), static_cast<int>(p.height()));
+    return IntPoint(clampToInteger(floorf(p.width())), clampToInteger(floorf(p.height())));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/FontCache.cpp b/Source/WebCore/platform/graphics/FontCache.cpp
index 47f251c84..b46263a96 100644
--- a/Source/WebCore/platform/graphics/FontCache.cpp
+++ b/Source/WebCore/platform/graphics/FontCache.cpp
@@ -35,10 +35,12 @@
 #include "FontPlatformData.h"
 #include "FontSelector.h"
 #include "GlyphPageTreeNode.h"
+#include "OpenTypeVerticalData.h"
 #include "WebKitFontFamilyNames.h"
 #include <wtf/HashMap.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/text/AtomicStringHash.h>
 #include <wtf/text/StringHash.h>
 
 using namespace WTF;
@@ -179,10 +181,20 @@ static const AtomicString& alternateFamilyName(const AtomicString& familyName)
     return emptyAtom;
 }
 
-FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& fontDescription, 
-                                                       const AtomicString& familyName,
+FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& fontDescription,
+                                                       const AtomicString& passedFamilyName,
                                                        bool checkingAlternateName)
 {
+#if OS(WINDOWS) && ENABLE(OPENTYPE_VERTICAL)
+    // Leading "@" in the font name enables Windows vertical flow flag for the font.
+    // Because we do vertical flow by ourselves, we don't want to use the Windows feature.
+    // IE disregards "@" regardless of the orientatoin, so we follow the behavior.
+    const AtomicString& familyName = (passedFamilyName.isEmpty() || passedFamilyName[0] != '@') ?
+        passedFamilyName : AtomicString(passedFamilyName.impl()->substring(1));
+#else
+    const AtomicString& familyName = passedFamilyName;
+#endif
+
     if (!gFontPlatformDataCache) {
         gFontPlatformDataCache = new FontPlatformDataCache;
         platformInit();
@@ -216,6 +228,32 @@ FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& fo
     return result;
 }
 
+#if ENABLE(OPENTYPE_VERTICAL)
+typedef HashMap<FontCache::FontFileKey, OwnPtr<OpenTypeVerticalData>> FontVerticalDataCache;
+
+FontVerticalDataCache& fontVerticalDataCacheInstance()
+{
+    DEFINE_STATIC_LOCAL(FontVerticalDataCache, fontVerticalDataCache, ());
+    return fontVerticalDataCache;
+}
+
+OpenTypeVerticalData* FontCache::getVerticalData(const FontFileKey& key, const FontPlatformData& platformData)
+{
+    FontVerticalDataCache& fontVerticalDataCache = fontVerticalDataCacheInstance();
+    FontVerticalDataCache::iterator result = fontVerticalDataCache.find(key);
+    if (result != fontVerticalDataCache.end())
+        return result.get()->second.get();
+
+    OpenTypeVerticalData* verticalData = new OpenTypeVerticalData(platformData);
+    if (!verticalData->isOpenType()) {
+        delete verticalData;
+        verticalData = 0; // Put 0 in cache to mark that this isn't an OpenType font.
+    }
+    fontVerticalDataCache.set(key, adoptPtr(verticalData));
+    return verticalData;
+}
+#endif
+
 struct FontDataCacheKeyHash {
     static unsigned hash(const FontPlatformData& platformData)
     {
@@ -381,6 +419,32 @@ void FontCache::purgeInactiveFontData(int count)
             delete gFontPlatformDataCache->take(keysToRemove[i]);
     }
 
+#if ENABLE(OPENTYPE_VERTICAL)
+    FontVerticalDataCache& fontVerticalDataCache = fontVerticalDataCacheInstance();
+    if (!fontVerticalDataCache.isEmpty()) {
+        // Mark & sweep unused verticalData
+        FontVerticalDataCache::iterator verticalDataEnd = fontVerticalDataCache.end();
+        for (FontVerticalDataCache::iterator verticalData = fontVerticalDataCache.begin(); verticalData != verticalDataEnd; ++verticalData) {
+            if (verticalData->second)
+                verticalData->second->m_inFontCache = false;
+        }
+        FontDataCache::iterator fontDataEnd = gFontDataCache->end();
+        for (FontDataCache::iterator fontData = gFontDataCache->begin(); fontData != fontDataEnd; ++fontData) {
+            OpenTypeVerticalData* verticalData = const_cast<OpenTypeVerticalData*>(fontData->second.first->verticalData());
+            if (verticalData)
+                verticalData->m_inFontCache = true;
+        }
+        Vector<FontFileKey> keysToRemove;
+        keysToRemove.reserveInitialCapacity(fontVerticalDataCache.size());
+        for (FontVerticalDataCache::iterator verticalData = fontVerticalDataCache.begin(); verticalData != verticalDataEnd; ++verticalData) {
+            if (!verticalData->second || !verticalData->second->m_inFontCache)
+                keysToRemove.append(verticalData->first);
+        }
+        for (size_t i = 0, count = keysToRemove.size(); i < count; ++i)
+            fontVerticalDataCache.take(keysToRemove[i]);
+    }
+#endif
+
     isPurging = false;
 }
 
diff --git a/Source/WebCore/platform/graphics/FontCache.h b/Source/WebCore/platform/graphics/FontCache.h
index c71e41fe3..858db21e8 100644
--- a/Source/WebCore/platform/graphics/FontCache.h
+++ b/Source/WebCore/platform/graphics/FontCache.h
@@ -49,6 +49,7 @@ class FontPlatformData;
 class FontData;
 class FontDescription;
 class FontSelector;
+class OpenTypeVerticalData;
 class SimpleFontData;
 
 class FontCache {
@@ -104,6 +105,11 @@ public:
     SimpleFontData* fontDataFromDescriptionAndLogFont(const FontDescription&, ShouldRetain, const LOGFONT& font, wchar_t* outFontFamilyName);
 #endif
 
+#if ENABLE(OPENTYPE_VERTICAL)
+    typedef AtomicString FontFileKey;
+    OpenTypeVerticalData* getVerticalData(const FontFileKey&, const FontPlatformData&);
+#endif
+
 private:
     FontCache();
     ~FontCache();
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutPoint.h b/Source/WebCore/platform/graphics/FractionalLayoutPoint.h
index 26550b96b..fc830e68d 100644
--- a/Source/WebCore/platform/graphics/FractionalLayoutPoint.h
+++ b/Source/WebCore/platform/graphics/FractionalLayoutPoint.h
@@ -159,7 +159,7 @@ inline FractionalLayoutSize toSize(const FractionalLayoutPoint& a)
 
 inline IntPoint flooredIntPoint(const FractionalLayoutPoint& point)
 {
-    return IntPoint(point.x().toInt(), point.y().toInt());
+    return IntPoint(point.x().floor(), point.y().floor());
 }
 
 inline IntPoint roundedIntPoint(const FractionalLayoutPoint& point)
@@ -177,6 +177,16 @@ inline IntPoint ceiledIntPoint(const FractionalLayoutPoint& point)
     return IntPoint(point.x().ceil(), point.y().ceil());
 }
 
+inline FractionalLayoutPoint flooredFractionalLayoutPoint(const FloatPoint& p)
+{
+    return FractionalLayoutPoint(FractionalLayoutUnit::fromFloatFloor(p.x()), FractionalLayoutUnit::fromFloatFloor(p.y()));
+}
+
+inline FractionalLayoutPoint ceiledFractionalLayoutPoint(const FloatPoint& p)
+{
+    return FractionalLayoutPoint(FractionalLayoutUnit::fromFloatCeil(p.x()), FractionalLayoutUnit::fromFloatCeil(p.y()));
+}
+
 } // namespace WebCore
 
 #endif // FractionalLayoutPoint_h
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutRect.cpp b/Source/WebCore/platform/graphics/FractionalLayoutRect.cpp
index 7c925564e..76c002601 100644
--- a/Source/WebCore/platform/graphics/FractionalLayoutRect.cpp
+++ b/Source/WebCore/platform/graphics/FractionalLayoutRect.cpp
@@ -128,21 +128,19 @@ FractionalLayoutRect unionRect(const Vector<FractionalLayoutRect>& rects)
 
 IntRect enclosingIntRect(const FractionalLayoutRect& rect)
 {
-    float x = floorf(rect.x().toFloat());
-    float y = floorf(rect.y().toFloat());
-    float width = ceilf(rect.maxX().toFloat()) - x;
-    float height = ceilf(rect.maxY().toFloat()) - y;
+    IntPoint location = flooredIntPoint(rect.minXMinYCorner());
+    IntPoint maxPoint = ceiledIntPoint(rect.maxXMaxYCorner());
 
-    return IntRect(clampToInteger(x), clampToInteger(y), 
-                   clampToInteger(width), clampToInteger(height));
+    return IntRect(location, maxPoint - location);
 }
 
 FractionalLayoutRect enclosingFractionalLayoutRect(const FloatRect& rect)
 {
 #if ENABLE(SUBPIXEL_LAYOUT)
-    return FractionalLayoutRect(rect.x(), rect.y(),
-                     rect.maxX() - rect.x() + FractionalLayoutUnit::epsilon(),
-                     rect.maxY() - rect.y() + FractionalLayoutUnit::epsilon());
+    FractionalLayoutPoint location = flooredFractionalLayoutPoint(rect.minXMinYCorner());
+    FractionalLayoutPoint maxPoint = ceiledFractionalLayoutPoint(rect.maxXMaxYCorner());
+
+    return FractionalLayoutRect(location, maxPoint - location);
 #else
     return enclosingIntRect(rect);
 #endif
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutSize.h b/Source/WebCore/platform/graphics/FractionalLayoutSize.h
index 49bd9fdc7..1071d8ae3 100644
--- a/Source/WebCore/platform/graphics/FractionalLayoutSize.h
+++ b/Source/WebCore/platform/graphics/FractionalLayoutSize.h
@@ -74,8 +74,8 @@ public:
     
     void scale(float scale)
     {
-        m_width = static_cast<int>(static_cast<float>(m_width) * scale);
-        m_height = static_cast<int>(static_cast<float>(m_height) * scale);
+        m_width *= scale;
+        m_height *= scale;
     }
     
     FractionalLayoutSize expandedTo(const FractionalLayoutSize& other) const
@@ -151,7 +151,7 @@ inline bool operator!=(const FractionalLayoutSize& a, const FractionalLayoutSize
 
 inline IntSize flooredIntSize(const FractionalLayoutSize& s)
 {
-    return IntSize(s.width().toInt(), s.height().toInt());
+    return IntSize(s.width().floor(), s.height().floor());
 }
 
 inline IntSize roundedIntSize(const FractionalLayoutSize& s)
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index fe1223d78..e1373f091 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -68,14 +68,9 @@ typedef unsigned int GLuint;
 #if PLATFORM(MAC)
 typedef CGLContextObj PlatformGraphicsContext3D;
 #elif PLATFORM(QT)
-#if HAVE(QT5)
 typedef QOpenGLContext* PlatformGraphicsContext3D;
 typedef QSurface* PlatformGraphicsSurface3D;
 #else
-typedef QGLContext* PlatformGraphicsContext3D;
-typedef QGLWidget* PlatformGraphicsSurface3D;
-#endif
-#else
 typedef void* PlatformGraphicsContext3D;
 #endif
 
diff --git a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
index fc74d4551..e0813dfec 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
@@ -155,10 +155,11 @@ static TransformationMatrix applyTransformAnimation(const TransformOperations* f
 }
 
 
-GraphicsLayerAnimation::GraphicsLayerAnimation(const KeyframeValueList& keyframes, const IntSize& boxSize, const Animation* animation, double timeOffset, bool listsMatch)
+GraphicsLayerAnimation::GraphicsLayerAnimation(const String& name, const KeyframeValueList& keyframes, const IntSize& boxSize, const Animation* animation, double timeOffset, bool listsMatch)
     : m_keyframes(keyframes)
     , m_boxSize(boxSize)
     , m_animation(Animation::create(animation))
+    , m_name(name)
     , m_listsMatch(listsMatch)
     , m_startTime(WTF::currentTime() - timeOffset)
     , m_pauseTime(0)
@@ -190,26 +191,18 @@ bool GraphicsLayerAnimation::isActive() const
 
 bool GraphicsLayerAnimations::hasActiveAnimationsOfType(AnimatedPropertyID type) const
 {
-    HashMap<String, Vector<GraphicsLayerAnimation> >::const_iterator end = m_animations.end();
-    for (HashMap<String, Vector<GraphicsLayerAnimation> >::const_iterator it = m_animations.begin(); it != end; ++it) {
-        const Vector<GraphicsLayerAnimation>& animations = it->second;
-        for (size_t i = 0; i < animations.size(); ++i) {
-            if (animations[i].isActive() && animations[i].property() == type)
-                return true;
-        }
+    for (size_t i = 0; i < m_animations.size(); ++i) {
+        if (m_animations[i].isActive() && m_animations[i].property() == type)
+            return true;
     }
     return false;
 }
 
 bool GraphicsLayerAnimations::hasRunningAnimations() const
 {
-    HashMap<String, Vector<GraphicsLayerAnimation> >::const_iterator end = m_animations.end();
-    for (HashMap<String, Vector<GraphicsLayerAnimation> >::const_iterator it = m_animations.begin(); it != end; ++it) {
-        const Vector<GraphicsLayerAnimation>& animations = it->second;
-        for (size_t i = 0; i < animations.size(); ++i) {
-            if (animations[i].state() == GraphicsLayerAnimation::PlayingState)
-                return true;
-        }
+    for (size_t i = 0; i < m_animations.size(); ++i) {
+        if (m_animations[i].state() == GraphicsLayerAnimation::PlayingState)
+            return true;
     }
 
     return false;
@@ -264,36 +257,31 @@ void GraphicsLayerAnimation::pause(double offset)
     m_pauseTime = WTF::currentTime() - offset;
 }
 
-void GraphicsLayerAnimations::add(const String& name, const GraphicsLayerAnimation& animation)
+void GraphicsLayerAnimations::add(const GraphicsLayerAnimation& animation)
 {
-    HashMap<String, Vector<GraphicsLayerAnimation> >::iterator it = m_animations.find(name);
-    if (it != m_animations.end()) {
-        it->second.append(animation);
-        return;
-    }
-
-    Vector<GraphicsLayerAnimation> animations;
-    animations.append(animation);
-    m_animations.add(name, animations);
+    m_animations.append(animation);
 }
 
 void GraphicsLayerAnimations::pause(const String& name, double offset)
 {
-    HashMap<String, Vector<GraphicsLayerAnimation> >::iterator it = m_animations.find(name);
-    if (it == m_animations.end())
-        return;
+    for (size_t i = 0; i < m_animations.size(); ++i) {
+        if (m_animations[i].name() == name)
+            m_animations[i].pause(offset);
+    }
+}
 
-    for (size_t i = 0; i < it->second.size(); i++) 
-        it->second[i].pause(offset);
+void GraphicsLayerAnimations::remove(const String& name)
+{
+    for (int i = m_animations.size() - 1; i >= 0; --i) {
+        if (m_animations[i].name() == name)
+            m_animations.remove(i);
+    }
 }
 
 void GraphicsLayerAnimations::apply(GraphicsLayerAnimation::Client* client)
 {
-    HashMap<String, Vector<GraphicsLayerAnimation> >::iterator end = m_animations.end();
-    for (HashMap<String, Vector<GraphicsLayerAnimation> >::iterator it = m_animations.begin(); it != end; ++it) {
-        for (size_t i = 0; i < it->second.size(); ++i)
-            it->second[i].apply(client);
-    }
+    for (size_t i = 0; i < m_animations.size(); ++i)
+        m_animations[i].apply(client);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.h b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.h
index e49832ef3..e58279c6a 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.h
@@ -41,13 +41,14 @@ public:
     GraphicsLayerAnimation()
         : m_keyframes(AnimatedPropertyInvalid)
     { }
-    GraphicsLayerAnimation(const KeyframeValueList&, const IntSize&, const Animation*, double, bool);
+    GraphicsLayerAnimation(const String&, const KeyframeValueList&, const IntSize&, const Animation*, double, bool);
     void apply(Client*);
     void pause(double);
     AnimationState state() const { return m_state; }
     void setState(AnimationState s) { m_state = s; }
     AnimatedPropertyID property() const { return m_keyframes.property(); }
     bool isActive() const;
+    String name() const { return m_name; }
 
 private:
     void applyInternal(Client*, const AnimationValue* from, const AnimationValue* to, float progress);
@@ -66,8 +67,8 @@ class GraphicsLayerAnimations {
 public:
     GraphicsLayerAnimations() { }
 
-    void add(const String&, const GraphicsLayerAnimation&);
-    void remove(const String& name) { m_animations.remove(name); }
+    void add(const GraphicsLayerAnimation&);
+    void remove(const String& name);
     void pause(const String&, double);
     void apply(GraphicsLayerAnimation::Client*);
     bool isEmpty() const { return m_animations.isEmpty(); }
@@ -76,7 +77,7 @@ public:
     bool hasActiveAnimationsOfType(AnimatedPropertyID type) const;
 
 private:
-    HashMap<String, Vector<GraphicsLayerAnimation> > m_animations;
+    Vector<GraphicsLayerAnimation> m_animations;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/GraphicsLayerClient.h b/Source/WebCore/platform/graphics/GraphicsLayerClient.h
index 7049e4226..902a2573d 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayerClient.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayerClient.h
@@ -84,6 +84,10 @@ public:
     // while painting.
     virtual void verifyNotPainting() { }
 #endif
+
+#if PLATFORM(BLACKBERRY)
+    virtual bool contentsVisible(const GraphicsLayer*, const IntRect& contentRect) const { return false; }
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/GraphicsTypes.h b/Source/WebCore/platform/graphics/GraphicsTypes.h
index e6596d95c..1d1b7e09d 100644
--- a/Source/WebCore/platform/graphics/GraphicsTypes.h
+++ b/Source/WebCore/platform/graphics/GraphicsTypes.h
@@ -47,6 +47,25 @@ namespace WebCore {
         CompositeDifference
     };
 
+    enum BlendMode {
+        BlendModeNormal,
+        BlendModeMultiply,
+        BlendModeScreen,
+        BlendModeOverlay,
+        BlendModeDarken,
+        BlendModeLighten,
+        BlendModeColorDodge,
+        BlendModeColorBurn,
+        BlendModeHardLight,
+        BlendModeSoftLight,
+        BlendModeDifference,
+        BlendModeExclusion,
+        BlendModeHue,
+        BlendModeSaturation,
+        BlendModeColor,
+        BlendModeLuminosity
+    };
+
     enum GradientSpreadMethod {
         SpreadMethodPad,
         SpreadMethodReflect,
diff --git a/Source/WebCore/platform/graphics/Image.h b/Source/WebCore/platform/graphics/Image.h
index ba953f5e0..7c7ba9b95 100644
--- a/Source/WebCore/platform/graphics/Image.h
+++ b/Source/WebCore/platform/graphics/Image.h
@@ -30,8 +30,9 @@
 #include "Color.h"
 #include "ColorSpace.h"
 #include "GraphicsTypes.h"
-#include "ImageSource.h"
+#include "ImageOrientation.h"
 #include "IntRect.h"
+#include "NativeImagePtr.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
diff --git a/Source/WebCore/platform/graphics/ImageSource.cpp b/Source/WebCore/platform/graphics/ImageSource.cpp
index 75ed5a1a2..c433de401 100644
--- a/Source/WebCore/platform/graphics/ImageSource.cpp
+++ b/Source/WebCore/platform/graphics/ImageSource.cpp
@@ -184,14 +184,9 @@ ImageOrientation ImageSource::orientationAtIndex(size_t index) const
 
 bool ImageSource::frameHasAlphaAtIndex(size_t index)
 {
-    // When a frame has not finished decoding, always mark it as having alpha.
-    // Ports that check the result of this function to determine their
-    // compositing op need this in order to not draw the undecoded portion as
-    // black.
-    // TODO: Perhaps we should ensure that each individual decoder returns true
-    // in this case.
-    return !frameIsCompleteAtIndex(index)
-        || m_decoder->frameBufferAtIndex(index)->hasAlpha();
+    if (!m_decoder)
+        return true;
+    return m_decoder->frameHasAlphaAtIndex(index);
 }
 
 bool ImageSource::frameIsCompleteAtIndex(size_t index)
diff --git a/Source/WebCore/platform/graphics/ImageSource.h b/Source/WebCore/platform/graphics/ImageSource.h
index 913a3e7dc..40d757fa0 100644
--- a/Source/WebCore/platform/graphics/ImageSource.h
+++ b/Source/WebCore/platform/graphics/ImageSource.h
@@ -28,31 +28,15 @@
 #define ImageSource_h
 
 #include "ImageOrientation.h"
+#include "NativeImagePtr.h"
 
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(WX)
-class wxBitmap;
-class wxGraphicsBitmap;
-#elif USE(CG)
+#if USE(CG)
 typedef struct CGImageSource* CGImageSourceRef;
-typedef struct CGImage* CGImageRef;
 typedef const struct __CFData* CFDataRef;
-#elif PLATFORM(QT)
-#include <qglobal.h>
-QT_BEGIN_NAMESPACE
-class QImage;
-QT_END_NAMESPACE
-#elif USE(CAIRO)
-#include "NativeImageCairo.h"
-#elif USE(SKIA)
-namespace WebCore {
-class NativeImageSkia;
-}
-#elif OS(WINCE)
-#include "SharedBitmap.h"
 #endif
 
 namespace WebCore {
@@ -64,34 +48,9 @@ class SharedBuffer;
 
 #if USE(CG)
 typedef CGImageSourceRef NativeImageSourcePtr;
-typedef CGImageRef NativeImagePtr;
-#elif PLATFORM(OPENVG)
-class ImageDecoder;
-class TiledImageOpenVG;
-typedef ImageDecoder* NativeImageSourcePtr;
-typedef TiledImageOpenVG* NativeImagePtr;
 #else
 class ImageDecoder;
 typedef ImageDecoder* NativeImageSourcePtr;
-#if PLATFORM(WX)
-#if USE(WXGC)
-typedef wxGraphicsBitmap* NativeImagePtr;
-#else
-typedef wxBitmap* NativeImagePtr;
-#endif
-#elif USE(CAIRO)
-typedef WebCore::NativeImageCairo* NativeImagePtr;
-#elif USE(SKIA)
-typedef WebCore::NativeImageSkia* NativeImagePtr;
-#elif OS(WINCE)
-typedef RefPtr<SharedBitmap> NativeImagePtr;
-#elif PLATFORM(BLACKBERRY)
-class ImageDecoder;
-typedef ImageDecoder* NativeImageSourcePtr;
-typedef void* NativeImagePtr;
-#elif PLATFORM(QT)
-typedef QImage* NativeImagePtr;
-#endif
 #endif
 
 // Right now GIFs are the only recognized image format that supports animation.
diff --git a/Source/WebCore/platform/graphics/IntRect.cpp b/Source/WebCore/platform/graphics/IntRect.cpp
index dfa2f91f1..fd1e50949 100644
--- a/Source/WebCore/platform/graphics/IntRect.cpp
+++ b/Source/WebCore/platform/graphics/IntRect.cpp
@@ -36,14 +36,14 @@ using std::min;
 namespace WebCore {
 
 IntRect::IntRect(const FloatRect& r)
-    : m_location(IntPoint(static_cast<int>(r.x()), static_cast<int>(r.y())))
-    , m_size(IntSize(static_cast<int>(r.width()), static_cast<int>(r.height())))
+    : m_location(clampToInteger(r.x()), clampToInteger(r.y()))
+    , m_size(clampToInteger(r.width()), clampToInteger(r.height()))
 {
 }
 
 IntRect::IntRect(const FractionalLayoutRect& r)
-    : m_location(flooredIntPoint(r.location()))
-    , m_size(flooredIntSize(r.size()))
+    : m_location(r.x(), r.y())
+    , m_size(r.width(), r.height())
 {
 }
 
diff --git a/Source/WebCore/bindings/js/JSInt32ArrayCustom.cpp b/Source/WebCore/platform/graphics/NativeImagePtr.h
index d85287f44..3cc8d744c 100644
--- a/Source/WebCore/bindings/js/JSInt32ArrayCustom.cpp
+++ b/Source/WebCore/platform/graphics/NativeImagePtr.h
@@ -1,5 +1,7 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
+ * Copyright (C) 2012 Company 100 Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,39 +25,54 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "config.h"
-#include "JSInt32Array.h"
-
-#include "JSArrayBufferViewHelper.h"
-#include <wtf/Int32Array.h>
-
-using namespace JSC;
+#ifndef NativeImagePtr_h
+#define NativeImagePtr_h
 
+#if PLATFORM(WX)
+class wxBitmap;
+class wxGraphicsBitmap;
+#elif USE(CG)
+typedef struct CGImage* CGImageRef;
+#elif PLATFORM(QT)
+#include <qglobal.h>
+QT_BEGIN_NAMESPACE
+class QImage;
+QT_END_NAMESPACE
+#elif USE(CAIRO)
+#include "NativeImageCairo.h"
+#elif USE(SKIA)
 namespace WebCore {
-
-void JSInt32Array::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+class NativeImageSkia;
 }
+#elif OS(WINCE)
+#include "SharedBitmap.h"
+#endif
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Int32Array* object)
-{
-    return toJSArrayBufferView<JSInt32Array>(exec, globalObject, object);
-}
+namespace WebCore {
 
-JSC::JSValue JSInt32Array::set(JSC::ExecState* exec)
-{
-    return setWebGLArrayHelper(exec, impl(), toInt32Array);
-}
+#if USE(CG)
+typedef CGImageRef NativeImagePtr;
+#elif PLATFORM(OPENVG)
+class TiledImageOpenVG;
+typedef TiledImageOpenVG* NativeImagePtr;
+#elif PLATFORM(WX)
+#if USE(WXGC)
+typedef wxGraphicsBitmap* NativeImagePtr;
+#else
+typedef wxBitmap* NativeImagePtr;
+#endif
+#elif USE(CAIRO)
+typedef WebCore::NativeImageCairo* NativeImagePtr;
+#elif USE(SKIA)
+typedef WebCore::NativeImageSkia* NativeImagePtr;
+#elif OS(WINCE)
+typedef RefPtr<SharedBitmap> NativeImagePtr;
+#elif PLATFORM(BLACKBERRY)
+typedef void* NativeImagePtr;
+#elif PLATFORM(QT)
+typedef QImage* NativeImagePtr;
+#endif
 
-EncodedJSValue JSC_HOST_CALL JSInt32ArrayConstructor::constructJSInt32Array(ExecState* exec)
-{
-    JSInt32ArrayConstructor* jsConstructor = jsCast<JSInt32ArrayConstructor*>(exec->callee());
-    RefPtr<Int32Array> array = constructArrayBufferView<Int32Array, int>(exec);
-    if (!array.get())
-        // Exception has already been thrown.
-        return JSValue::encode(JSValue());
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), array.get())));
 }
 
-} // namespace WebCore
+#endif
diff --git a/Source/WebCore/platform/graphics/OpenGLESShims.h b/Source/WebCore/platform/graphics/OpenGLESShims.h
index 4e0951201..40187004a 100644
--- a/Source/WebCore/platform/graphics/OpenGLESShims.h
+++ b/Source/WebCore/platform/graphics/OpenGLESShims.h
@@ -54,7 +54,6 @@
 #define GL_READ_FRAMEBUFFER_EXT 0x8CA8
 #define GL_DRAW_FRAMEBUFFER_EXT 0x8CA9
 #define FRAMEBUFFER_INCOMPLETE_MULTISAMPLE_EXT 0x9134
-#define GL_MAX_SAMPLES_EXT 0x8D57
 #endif // PLATFORM(BLACKBERRY)
 
 #endif // OpenGLESShims_h
diff --git a/Source/WebCore/platform/graphics/OpenGLShims.cpp b/Source/WebCore/platform/graphics/OpenGLShims.cpp
index 82cc21c6d..8e54ee452 100644
--- a/Source/WebCore/platform/graphics/OpenGLShims.cpp
+++ b/Source/WebCore/platform/graphics/OpenGLShims.cpp
@@ -42,11 +42,7 @@ OpenGLFunctionTable* openGLFunctionTable()
 #if PLATFORM(QT)
 static void* getProcAddress(const char* procName)
 {
-#if HAVE(QT5)
     return reinterpret_cast<void*>(QOpenGLContext::currentContext()->getProcAddress(procName));
-#else
-    return reinterpret_cast<void*>(QGLContext::currentContext()->getProcAddress(QString::fromLatin1(procName)));
-#endif
 }
 #else
 typedef void* (*glGetProcAddressType) (const char* procName);
diff --git a/Source/WebCore/platform/graphics/OpenGLShims.h b/Source/WebCore/platform/graphics/OpenGLShims.h
index 706f17d9b..fffa502e5 100644
--- a/Source/WebCore/platform/graphics/OpenGLShims.h
+++ b/Source/WebCore/platform/graphics/OpenGLShims.h
@@ -22,14 +22,10 @@
 
 #if PLATFORM(QT)
 #include <qglobal.h>
-#if HAVE(QT5)
 #include <qopenglfunctions.h>
 #include <QOpenGLContext>
 #include <QSurface>
 #else
-#include <QGLContext>
-#endif
-#else
 #include <GL/gl.h>
 #endif
 
diff --git a/Source/WebCore/platform/graphics/Path.h b/Source/WebCore/platform/graphics/Path.h
index a33ab4c8b..0e58d3399 100644
--- a/Source/WebCore/platform/graphics/Path.h
+++ b/Source/WebCore/platform/graphics/Path.h
@@ -119,6 +119,11 @@ namespace WebCore {
         float normalAngleAtLength(float length, bool& ok) const;
 
         void clear();
+#if PLATFORM(QT)
+        bool isNull() const { return false; }
+#else
+        bool isNull() const { return !m_path; }
+#endif
         bool isEmpty() const;
         // Gets the current point of the current path, which is conceptually the final point reached by the path so far.
         // Note the Path can be empty (isEmpty() == true) and still have a current point.
@@ -147,7 +152,15 @@ namespace WebCore {
 
         void translate(const FloatSize&);
 
+        // To keep Path() cheap, it does not allocate a PlatformPath immediately
+        // meaning Path::platformPath() can return null (except on Qt).
         PlatformPathPtr platformPath() const { return m_path; }
+#if PLATFORM(QT)
+        PlatformPathPtr ensurePlatformPath() { return platformPath(); }
+#else
+        // ensurePlatformPath() will allocate a PlatformPath if it has not yet been and will never return null.
+        PlatformPathPtr ensurePlatformPath();
+#endif
 
         void apply(void* info, PathApplierFunction) const;
         void transform(const AffineTransform&);
diff --git a/Source/WebCore/platform/graphics/PlatformLayer.h b/Source/WebCore/platform/graphics/PlatformLayer.h
index 015406e11..b2a2505ce 100644
--- a/Source/WebCore/platform/graphics/PlatformLayer.h
+++ b/Source/WebCore/platform/graphics/PlatformLayer.h
@@ -39,9 +39,11 @@ class TextureMapperPlatformLayer;
 typedef TextureMapperPlatformLayer PlatformLayer;
 };
 #elif PLATFORM(CHROMIUM)
+namespace WebKit {
+class WebLayer;
+}
 namespace WebCore {
-class LayerChromium;
-typedef LayerChromium PlatformLayer;
+typedef WebKit::WebLayer PlatformLayer;
 }
 #elif PLATFORM(GTK)
 #if USE(TEXTURE_MAPPER_CAIRO) || USE(TEXTURE_MAPPER_GL)
diff --git a/Source/WebCore/platform/graphics/RoundedRect.cpp b/Source/WebCore/platform/graphics/RoundedRect.cpp
index 4121f9915..99ab8aaa9 100644
--- a/Source/WebCore/platform/graphics/RoundedRect.cpp
+++ b/Source/WebCore/platform/graphics/RoundedRect.cpp
@@ -162,4 +162,14 @@ bool RoundedRect::isRenderable() const
         && m_radii.bottomLeft().height() + m_radii.bottomRight().height() <= m_rect.height();
 }
 
+void RoundedRect::adjustRadii()
+{
+    int maxRadiusWidth = std::max(m_radii.topLeft().width() + m_radii.topRight().width(), m_radii.bottomLeft().width() + m_radii.bottomRight().width());
+    int maxRadiusHeight = std::max(m_radii.topLeft().height() + m_radii.bottomLeft().height(), m_radii.topRight().height() + m_radii.bottomRight().height());
+    if (maxRadiusWidth > maxRadiusHeight)
+        m_radii.scale(static_cast<float>(m_rect.width()) / maxRadiusWidth);
+    else
+        m_radii.scale(static_cast<float>(m_rect.height()) / maxRadiusHeight);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/RoundedRect.h b/Source/WebCore/platform/graphics/RoundedRect.h
index 6eae8b7f1..0fd082d44 100644
--- a/Source/WebCore/platform/graphics/RoundedRect.h
+++ b/Source/WebCore/platform/graphics/RoundedRect.h
@@ -94,6 +94,7 @@ public:
     void excludeLogicalEdges(bool isHorizontal, bool excludeLogicalLeftEdge, bool excludeLogicalRightEdge);
 
     bool isRenderable() const;
+    void adjustRadii();
 
 private:
     IntRect m_rect;
diff --git a/Source/WebCore/platform/graphics/SimpleFontData.cpp b/Source/WebCore/platform/graphics/SimpleFontData.cpp
index 222e43312..7951425c8 100644
--- a/Source/WebCore/platform/graphics/SimpleFontData.cpp
+++ b/Source/WebCore/platform/graphics/SimpleFontData.cpp
@@ -148,6 +148,14 @@ const SimpleFontData* SimpleFontData::fontDataForCharacter(UChar32) const
     return this;
 }
 
+#if !(PLATFORM(QT) && !HAVE(QRAWFONT))
+Glyph SimpleFontData::glyphForCharacter(UChar32 character) const
+{
+    GlyphPageTreeNode* node = GlyphPageTreeNode::getRootChild(this, character / GlyphPage::size);
+    return node->page() ? node->page()->glyphAt(character % GlyphPage::size) : 0;
+}
+#endif
+
 bool SimpleFontData::isSegmented() const
 {
     return false;
diff --git a/Source/WebCore/platform/graphics/SimpleFontData.h b/Source/WebCore/platform/graphics/SimpleFontData.h
index 425cf7302..0a389cd92 100644
--- a/Source/WebCore/platform/graphics/SimpleFontData.h
+++ b/Source/WebCore/platform/graphics/SimpleFontData.h
@@ -31,6 +31,9 @@
 #include "FloatRect.h"
 #include "GlyphMetricsMap.h"
 #include "GlyphPageTreeNode.h"
+#if ENABLE(OPENTYPE_VERTICAL)
+#include "OpenTypeVerticalData.h"
+#endif
 #include "TypesettingFeatures.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -88,6 +91,9 @@ public:
     virtual ~SimpleFontData();
 
     const FontPlatformData& platformData() const { return m_platformData; }
+#if ENABLE(OPENTYPE_VERTICAL)
+    const OpenTypeVerticalData* verticalData() const { return 0; } // FIXME: implement
+#endif
 
     SimpleFontData* smallCapsFontData(const FontDescription&) const;
     SimpleFontData* emphasisMarkFontData(const FontDescription&) const;
@@ -147,6 +153,8 @@ public:
     virtual const SimpleFontData* fontDataForCharacter(UChar32) const;
     virtual bool containsCharacters(const UChar*, int length) const;
 
+    Glyph glyphForCharacter(UChar32) const;
+
     void determinePitch();
     Pitch pitch() const { return m_treatAsFixedPitch ? FixedPitch : VariablePitch; }
 
diff --git a/Source/WebCore/platform/graphics/TiledBacking.h b/Source/WebCore/platform/graphics/TiledBacking.h
index acdcf5e78..cfa36b19f 100644
--- a/Source/WebCore/platform/graphics/TiledBacking.h
+++ b/Source/WebCore/platform/graphics/TiledBacking.h
@@ -32,11 +32,20 @@ class IntRect;
 
 class TiledBacking {
 public:
+    TiledBacking()
+        : m_scrollingPerformanceLoggingEnabled(0)
+    { }
     virtual ~TiledBacking() { }
 
     virtual void visibleRectChanged(const IntRect&) = 0;
     virtual void setIsInWindow(bool) = 0;
     virtual void setCanHaveScrollbars(bool) = 0;
+
+    void setScrollingPerformanceLoggingEnabled(bool flag)  { m_scrollingPerformanceLoggingEnabled = flag; }
+    bool scrollingPerformanceLoggingEnabled() const { return m_scrollingPerformanceLoggingEnabled; }
+
+private:
+    bool m_scrollingPerformanceLoggingEnabled;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
index 6e1999277..fc2a2177c 100644
--- a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
@@ -116,6 +116,10 @@ void MediaPlayerPrivateAVFoundation::setUpVideoRendering()
 
     MediaRenderingMode currentMode = currentRenderingMode();
     MediaRenderingMode preferredMode = preferredRenderingMode();
+
+    if (preferredMode == MediaRenderingNone)
+        preferredMode = MediaRenderingToContext;
+
     if (currentMode == preferredMode && currentMode != MediaRenderingNone)
         return;
 
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h
index e5cfcb445..0fe6131d6 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h
@@ -33,6 +33,7 @@
 OBJC_CLASS AVAsset;
 OBJC_CLASS AVPlayer;
 OBJC_CLASS AVPlayerItem;
+OBJC_CLASS AVPlayerItemVideoOutput;
 OBJC_CLASS AVPlayerLayer;
 OBJC_CLASS AVAssetImageGenerator;
 OBJC_CLASS WebCoreAVFMovieObserver;
@@ -42,6 +43,7 @@ typedef struct objc_object *id;
 #endif
 
 typedef struct CGImage *CGImageRef;
+typedef struct __CVBuffer *CVPixelBufferRef;
 
 namespace WebCore {
 
@@ -110,7 +112,17 @@ private:
 
     virtual bool hasSingleSecurityOrigin() const;
 
+#if __MAC_OS_X_VERSION_MIN_REQUIRED < 1080
+    void createImageGenerator();
+    void destroyImageGenerator();
     RetainPtr<CGImageRef> createImageForTimeInRect(float, const IntRect&);
+    void paintWithImageGenerator(GraphicsContext*, const IntRect&);
+#else
+    void createVideoOutput();
+    void destroyVideoOutput();
+    RetainPtr<CVPixelBufferRef> createPixelBuffer();
+    void paintWithVideoOutput(GraphicsContext*, const IntRect&);
+#endif
 
     MediaPlayer* m_player;
     RetainPtr<AVAsset> m_avAsset;
@@ -118,10 +130,16 @@ private:
     RetainPtr<AVPlayerItem> m_avPlayerItem;
     RetainPtr<AVPlayerLayer> m_videoLayer;
     RetainPtr<WebCoreAVFMovieObserver> m_objcObserver;
-    RetainPtr<AVAssetImageGenerator> m_imageGenerator;
     RetainPtr<id> m_timeObserver;
     bool m_videoFrameHasDrawn;
     bool m_haveCheckedPlayability;
+
+#if __MAC_OS_X_VERSION_MIN_REQUIRED < 1080
+    RetainPtr<AVAssetImageGenerator> m_imageGenerator;
+#else
+    RetainPtr<AVPlayerItemVideoOutput> m_videoOutput;
+    RetainPtr<CVPixelBufferRef> m_lastImage;
+#endif
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
index 59a72f789..cf75d0cf6 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
@@ -56,6 +56,7 @@ SOFT_LINK(CoreMedia, CMTimeRangeGetEnd, CMTime, (CMTimeRange range), (range))
 
 SOFT_LINK_CLASS(AVFoundation, AVPlayer)
 SOFT_LINK_CLASS(AVFoundation, AVPlayerItem)
+SOFT_LINK_CLASS(AVFoundation, AVPlayerItemVideoOutput)
 SOFT_LINK_CLASS(AVFoundation, AVPlayerLayer)
 SOFT_LINK_CLASS(AVFoundation, AVURLAsset)
 SOFT_LINK_CLASS(AVFoundation, AVAssetImageGenerator)
@@ -73,6 +74,7 @@ SOFT_LINK_CONSTANT(CoreMedia, kCMTimeZero, CMTime)
 
 #define AVPlayer getAVPlayerClass()
 #define AVPlayerItem getAVPlayerItemClass()
+#define AVPlayerItemVideoOutput getAVPlayerItemVideoOutputClass()
 #define AVPlayerLayer getAVPlayerLayerClass()
 #define AVURLAsset getAVURLAssetClass()
 #define AVAssetImageGenerator getAVAssetImageGeneratorClass()
@@ -183,12 +185,26 @@ bool MediaPlayerPrivateAVFoundationObjC::hasLayerRenderer() const
 
 bool MediaPlayerPrivateAVFoundationObjC::hasContextRenderer() const
 {
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1080
+    return m_videoOutput;
+#else
     return m_imageGenerator;
+#endif
 }
 
 void MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer()
 {
-    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer(%p)", this);
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1080
+    createVideoOutput();
+#else
+    createImageGenerator();
+#endif
+}
+
+#if __MAC_OS_X_VERSION_MIN_REQUIRED < 1080
+void MediaPlayerPrivateAVFoundationObjC::createImageGenerator()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createImageGenerator(%p)", this);
 
     if (!m_avAsset || m_imageGenerator)
         return;
@@ -202,16 +218,28 @@ void MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer()
 
     LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createImageGenerator(%p) - returning %p", this, m_imageGenerator.get());
 }
+#endif
 
 void MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer()
 {
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1080
+    destroyVideoOutput();
+#else
+    destroyImageGenerator();
+#endif
+}
+
+#if __MAC_OS_X_VERSION_MIN_REQUIRED < 1080
+void MediaPlayerPrivateAVFoundationObjC::destroyImageGenerator()
+{
     if (!m_imageGenerator)
         return;
 
-    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer(%p) - destroying  %p", this, m_imageGenerator.get());
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::destroyImageGenerator(%p) - destroying  %p", this, m_imageGenerator.get());
 
     m_imageGenerator = 0;
 }
+#endif
 
 void MediaPlayerPrivateAVFoundationObjC::createVideoLayer()
 {
@@ -611,6 +639,21 @@ void MediaPlayerPrivateAVFoundationObjC::paint(GraphicsContext* context, const I
     setDelayCallbacks(true);
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1080
+    paintWithVideoOutput(context, rect);
+#else
+    paintWithImageGenerator(context, rect);
+#endif
+
+    END_BLOCK_OBJC_EXCEPTIONS;
+    setDelayCallbacks(false);
+
+    m_videoFrameHasDrawn = true;
+}
+
+#if __MAC_OS_X_VERSION_MIN_REQUIRED < 1080
+void MediaPlayerPrivateAVFoundationObjC::paintWithImageGenerator(GraphicsContext* context, const IntRect& rect)
+{
     RetainPtr<CGImageRef> image = createImageForTimeInRect(currentTime(), rect);
     if (image) {
         GraphicsContextStateSaver stateSaver(*context);
@@ -621,12 +664,8 @@ void MediaPlayerPrivateAVFoundationObjC::paint(GraphicsContext* context, const I
         CGContextDrawImage(context->platformContext(), CGRectMake(0, 0, paintRect.width(), paintRect.height()), image.get());
         image = 0;
     }
-
-    END_BLOCK_OBJC_EXCEPTIONS;
-    setDelayCallbacks(false);
-
-    m_videoFrameHasDrawn = true;
 }
+#endif
 
 static HashSet<String> mimeTypeCache()
 {
@@ -644,10 +683,11 @@ static HashSet<String> mimeTypeCache()
     return cache;
 } 
 
+#if __MAC_OS_X_VERSION_MIN_REQUIRED < 1080
 RetainPtr<CGImageRef> MediaPlayerPrivateAVFoundationObjC::createImageForTimeInRect(float time, const IntRect& rect)
 {
     if (!m_imageGenerator)
-        createContextVideoRenderer();
+        createImageGenerator();
     ASSERT(m_imageGenerator);
 
 #if !LOG_DISABLED
@@ -664,6 +704,7 @@ RetainPtr<CGImageRef> MediaPlayerPrivateAVFoundationObjC::createImageForTimeInRe
 
     return image;
 }
+#endif
 
 void MediaPlayerPrivateAVFoundationObjC::getSupportedTypes(HashSet<String>& supportedTypes)
 {
@@ -781,6 +822,81 @@ bool MediaPlayerPrivateAVFoundationObjC::hasSingleSecurityOrigin() const
     return resolvedOrigin->isSameSchemeHostPort(requestedOrigin.get());
 }
 
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1080
+void MediaPlayerPrivateAVFoundationObjC::createVideoOutput()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createVideoOutput(%p)", this);
+
+    if (!m_avPlayerItem || m_videoOutput)
+        return;
+
+    NSDictionary* attributes = [NSDictionary dictionaryWithObjectsAndKeys:[NSNumber numberWithUnsignedInt:k32BGRAPixelFormat], kCVPixelBufferPixelFormatTypeKey,
+                                nil];
+    m_videoOutput.adoptNS([[AVPlayerItemVideoOutput alloc] initWithPixelBufferAttributes:attributes]);
+    ASSERT(m_videoOutput);
+
+    [m_avPlayerItem.get() addOutput:m_videoOutput.get()];
+
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createVideoOutput(%p) - returning %p", this, m_videoOutput.get());
+}
+
+void MediaPlayerPrivateAVFoundationObjC::destroyVideoOutput()
+{
+    if (!m_videoOutput)
+        return;
+
+    if (m_avPlayerItem)
+        [m_avPlayerItem.get() removeOutput:m_videoOutput.get()];
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::destroyVideoOutput(%p) - destroying  %p", this, m_videoOutput.get());
+
+    m_videoOutput = 0;
+}
+
+RetainPtr<CVPixelBufferRef> MediaPlayerPrivateAVFoundationObjC::createPixelBuffer()
+{
+    if (!m_videoOutput)
+        createVideoOutput();
+    ASSERT(m_videoOutput);
+
+#if !LOG_DISABLED
+    double start = WTF::currentTime();
+#endif
+
+    RetainPtr<CVPixelBufferRef> buffer = adoptCF([m_videoOutput.get() copyPixelBufferForItemTime:[m_avPlayerItem.get() currentTime] itemTimeForDisplay:nil]);
+
+#if !LOG_DISABLED
+    double duration = WTF::currentTime() - start;
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createPixelBuffer() - creating buffer took %.4f", this, narrowPrecisionToFloat(duration));
+#endif
+
+    return buffer;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::paintWithVideoOutput(GraphicsContext* context, const IntRect& rect)
+{
+    RetainPtr<CVPixelBufferRef> pixelBuffer = createPixelBuffer();
+
+    // Calls to copyPixelBufferForItemTime:itemTimeForDisplay: may return nil if the pixel buffer
+    // for the requested time has already been retrieved. In this case, the last valid image (if any)
+    // should be displayed.
+    if (pixelBuffer)
+        m_lastImage = pixelBuffer;
+
+    if (m_lastImage) {
+        GraphicsContextStateSaver stateSaver(*context);
+        context->translate(rect.x(), rect.y() + rect.height());
+        context->scale(FloatSize(1.0f, -1.0f));
+        RetainPtr<CIImage> image(AdoptNS, [[CIImage alloc] initWithCVImageBuffer:m_lastImage.get()]);
+
+        // ciContext does not use a RetainPtr for results of contextWithCGContext:, as the returned value
+        // is autoreleased, and there is no non-autoreleased version of that function.
+        CIContext* ciContext = [CIContext contextWithCGContext:context->platformContext() options:nil];
+        [ciContext drawImage:image.get() inRect:rect fromRect:rect];
+    }
+}
+
+#endif
+
 NSArray* assetMetadataKeyNames()
 {
     static NSArray* keys;
diff --git a/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp
index 3698fd25f..234e68f5d 100644
--- a/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp
@@ -388,8 +388,9 @@ void GraphicsContext3D::paintToCanvas(const unsigned char* imagePixels, int imag
     context->drawImage(bitmapImage.get(), ColorSpaceDeviceRGB, dst, src, CompositeCopy, RespectImageOrientation, false);
 }
 
-void GraphicsContext3D::setContextLostCallback(PassOwnPtr<ContextLostCallback>)
+void GraphicsContext3D::setContextLostCallback(PassOwnPtr<ContextLostCallback> callback)
 {
+    static_cast<Extensions3DOpenGLES*>(getExtensions())->setEXTContextLostCallback(callback);
 }
 
 void GraphicsContext3D::setErrorMessageCallback(PassOwnPtr<ErrorMessageCallback>)
diff --git a/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp
index 1b81f54dd..fbfef2076 100644
--- a/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp
@@ -51,6 +51,7 @@
 #include "Image.h"
 #include "LayerAnimation.h"
 #include "LayerWebKitThread.h"
+#include "NotImplemented.h"
 
 namespace WebCore {
 
@@ -292,6 +293,36 @@ void GraphicsLayerBlackBerry::setHasFixedAncestorInDOMTree(bool hasFixedAncestor
     updateHasFixedAncestorInDOMTree();
 }
 
+#if ENABLE(CSS_FILTERS)
+bool GraphicsLayerBlackBerry::setFilters(const FilterOperations& filters)
+{
+    if (m_filters == filters)
+        return true;
+
+    bool canCompositeFilters = LayerWebKitThread::filtersCanBeComposited(filters);
+    if (canCompositeFilters) {
+        m_filters = filters;
+        GraphicsLayer::setFilters(filters);
+        updateFilters();
+    } else {
+        m_filters.clear();
+        notImplemented();
+    }
+
+    return canCompositeFilters;
+}
+#endif
+
+void GraphicsLayerBlackBerry::setBoundsOrigin(const FloatPoint& origin)
+{
+    if (origin == m_boundsOrigin)
+        return;
+
+    GraphicsLayer::setBoundsOrigin(origin);
+    updateBoundsOrigin();
+
+}
+
 void GraphicsLayerBlackBerry::setBackgroundColor(const Color& color)
 {
     if (m_backgroundColorSet && m_backgroundColor == color)
@@ -677,6 +708,11 @@ void GraphicsLayerBlackBerry::updateAnchorPoint()
     updateLayerPosition();
 }
 
+void GraphicsLayerBlackBerry::updateBoundsOrigin()
+{
+    primaryLayer()->setBoundsOrigin(m_boundsOrigin);
+}
+
 void GraphicsLayerBlackBerry::updateTransform()
 {
     primaryLayer()->setTransform(m_transform);
@@ -803,6 +839,16 @@ void GraphicsLayerBlackBerry::updateLayerBackgroundColor()
         clearLayerBackgroundColor(*m_contentsLayer);
 }
 
+#if ENABLE(CSS_FILTERS)
+void GraphicsLayerBlackBerry::updateFilters()
+{
+    if (!m_filters.size())
+        return;
+
+    primaryLayer()->setFilters(m_filters);
+}
+#endif
+
 void GraphicsLayerBlackBerry::updateAnimations()
 {
     // When there is a transform layer, the transform must be set on that layer
diff --git a/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.h b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.h
index c266947af..811dd88ba 100644
--- a/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.h
+++ b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.h
@@ -29,13 +29,15 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "Platform.h"
+
 #ifndef GraphicsLayerBlackBerry_h
 #define GraphicsLayerBlackBerry_h
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "FilterOperations.h"
 #include "GraphicsLayer.h"
-
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -77,6 +79,14 @@ public:
     virtual void setHasFixedContainer(bool);
     virtual void setHasFixedAncestorInDOMTree(bool);
 
+#if ENABLE(CSS_FILTERS)
+    // Returns true if filter can be rendered by the compositor
+    virtual bool setFilters(const FilterOperations &);
+    const FilterOperations& filters() const { return m_filters; }
+#endif
+
+    virtual void setBoundsOrigin(const FloatPoint&);
+
     virtual void setBackgroundColor(const Color&);
     virtual void clearBackgroundColor();
 
@@ -135,6 +145,7 @@ private:
     void updateLayerPosition();
     void updateLayerSize();
     void updateAnchorPoint();
+    void updateBoundsOrigin();
     void updateTransform();
     void updateChildrenTransform();
     void updateMasksToBounds();
@@ -146,6 +157,9 @@ private:
     void updateHasFixedContainer();
     void updateHasFixedAncestorInDOMTree();
     void updateLayerBackgroundColor();
+#if ENABLE(CSS_FILTERS)
+    void updateFilters();
+#endif
     void updateAnimations();
 
     void updateContentsImage(Image*);
@@ -159,6 +173,10 @@ private:
     RefPtr<LayerWebKitThread> m_transformLayer;
     RefPtr<LayerWebKitThread> m_contentsLayer;
 
+#if ENABLE(CSS_FILTERS)
+    FilterOperations m_filters;
+#endif
+
     Vector<RefPtr<LayerAnimation> > m_runningAnimations;
     Vector<RefPtr<LayerAnimation> > m_suspendedAnimations;
     double m_suspendTime;
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerCompositingThread.cpp b/Source/WebCore/platform/graphics/blackberry/LayerCompositingThread.cpp
index c750ebd28..cef2e5d7b 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerCompositingThread.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/LayerCompositingThread.cpp
@@ -79,6 +79,9 @@ LayerCompositingThread::LayerCompositingThread(LayerType type, LayerCompositingT
     , m_visible(false)
     , m_commitScheduled(false)
     , m_client(client)
+#if ENABLE(CSS_FILTERS)
+    , m_filterOperationsChanged(false)
+#endif
 {
 }
 
@@ -266,7 +269,6 @@ void LayerCompositingThread::drawTextures(double scale, int positionLocation, in
         m_layerRenderer->addLayerToReleaseTextureResourcesList(this);
         pthread_mutex_lock(m_frontBufferLock);
 
-        glDisable(GL_SCISSOR_TEST);
         glBindTexture(GL_TEXTURE_2D, m_texID);
         glVertexAttribPointer(positionLocation, 2, GL_FLOAT, GL_FALSE, 0, &m_transformedBounds);
         float upsideDown[4 * 2] = { 0, 1,  0, 0,  1, 0,  1, 1 };
@@ -517,6 +519,8 @@ bool LayerCompositingThread::updateAnimations(double currentTime)
             m_transform = m_override->transform();
         if (m_override->isOpacitySet())
             m_opacity = m_override->opacity();
+        if (m_override->isBoundsOriginSet())
+            m_boundsOrigin = m_override->boundsOrigin();
 
         for (size_t i = 0; i < m_override->animations().size(); ++i) {
             LayerAnimation* animation = m_override->animations()[i].get();
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerCompositingThread.h b/Source/WebCore/platform/graphics/blackberry/LayerCompositingThread.h
index b33560669..b7223b14d 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerCompositingThread.h
+++ b/Source/WebCore/platform/graphics/blackberry/LayerCompositingThread.h
@@ -35,9 +35,11 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "FilterOperations.h"
 #include "FloatQuad.h"
 #include "LayerAnimation.h"
 #include "LayerData.h"
+#include "LayerFilterRenderer.h"
 #include "LayerRendererSurface.h"
 #include "LayerTiler.h"
 
@@ -81,6 +83,10 @@ public:
     float opacity() const { return m_opacity; }
     void setOpacity(float) { m_opacity = opacity; m_opacitySet = true; }
 
+    bool isBoundsOriginSet() const { return m_boundsOriginSet; }
+    FloatPoint boundsOrigin() const { return m_boundsOrigin; }
+    void setBoundsOrigin(const FloatPoint& origin) { m_boundsOrigin = origin; m_boundsOriginSet = true; }
+
     const Vector<RefPtr<LayerAnimation> >& animations() const { return m_animations; }
     void addAnimation(PassRefPtr<LayerAnimation> animation) { m_animations.append(animation); }
     void removeAnimation(const String& name);
@@ -93,6 +99,7 @@ private:
         , m_boundsSet(false)
         , m_transformSet(false)
         , m_opacitySet(false)
+        , m_boundsOriginSet(false)
     {
     }
 
@@ -101,6 +108,8 @@ private:
     IntSize m_bounds;
     TransformationMatrix m_transform;
     float m_opacity;
+    FloatPoint m_boundsOrigin;
+
     Vector<RefPtr<LayerAnimation> > m_animations;
 
     unsigned m_positionSet : 1;
@@ -108,8 +117,11 @@ private:
     unsigned m_boundsSet : 1;
     unsigned m_transformSet : 1;
     unsigned m_opacitySet : 1;
+    unsigned m_boundsOriginSet : 1;
 };
 
+class LayerFilterRendererAction;
+
 class LayerCompositingThread : public ThreadSafeRefCounted<LayerCompositingThread>, public LayerData, public BlackBerry::Platform::GuardedPointerBase {
 public:
     static PassRefPtr<LayerCompositingThread> create(LayerType, LayerCompositingThreadClient*);
@@ -128,6 +140,7 @@ public:
     // These functions can also be used to update animated properties in LayerAnimation.
     void setPosition(const FloatPoint& position) { m_position = position; }
     void setAnchorPoint(const FloatPoint& anchorPoint) { m_anchorPoint = anchorPoint; }
+    void setBoundsOrigin(const FloatPoint& boundsOrigin) { m_boundsOrigin = boundsOrigin; }
     void setBounds(const IntSize& bounds) { m_bounds = bounds; }
     void setSizeIsScaleInvariant(bool invariant) { m_sizeIsScaleInvariant = invariant; }
     void setTransform(const TransformationMatrix& matrix) { m_transform = matrix; }
@@ -207,6 +220,14 @@ public:
     LayerOverride* override();
     void clearOverride();
 
+#if ENABLE(CSS_FILTERS)
+    bool filterOperationsChanged() const { return m_filterOperationsChanged; }
+    void setFilterOperationsChanged(bool changed) { m_filterOperationsChanged = changed; }
+
+    Vector<RefPtr<LayerFilterRendererAction> > filterActions() const { return m_filterActions; }
+    void setFilterActions(const Vector<RefPtr<LayerFilterRendererAction> >& actions) { m_filterActions = actions; }
+#endif
+
 protected:
     virtual ~LayerCompositingThread();
 
@@ -251,6 +272,11 @@ private:
 
     OwnPtr<LayerOverride> m_override;
     LayerCompositingThreadClient* m_client;
+
+#if ENABLE(CSS_FILTERS)
+    bool m_filterOperationsChanged;
+    Vector<RefPtr<LayerFilterRendererAction> > m_filterActions;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerData.h b/Source/WebCore/platform/graphics/blackberry/LayerData.h
index d99121551..4eb11e31f 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerData.h
+++ b/Source/WebCore/platform/graphics/blackberry/LayerData.h
@@ -34,6 +34,7 @@
 #define LayerData_h
 
 #include "Color.h"
+#include "FilterOperations.h"
 #include "FloatPoint.h"
 #include "FloatRect.h"
 #include "IntRect.h"
@@ -59,6 +60,25 @@ public:
                               LayerProgramShaderBGRA,
                               NumberOfLayerProgramShaders };
 
+#if ENABLE(CSS_FILTERS)
+    enum CSSFilterShaders { CSSFilterShaderGrayscale = 0,
+                            CSSFilterShaderSepia,
+                            CSSFilterShaderSaturate,
+                            CSSFilterShaderHueRotate,
+                            CSSFilterShaderInvert,
+                            CSSFilterShaderBrightness,
+                            CSSFilterShaderContrast,
+                            CSSFilterShaderOpacity,
+                            CSSFilterShaderBlurY,
+                            CSSFilterShaderBlurX,
+                            CSSFilterShaderShadow,
+                            CSSFilterShaderPassthrough,
+#if ENABLE(CSS_SHADERS)
+                            CSSFilterShaderCustom,
+#endif
+                            NumberOfCSSFilterShaders };
+#endif
+
     LayerData(LayerType type)
         : m_layerType(type)
         , m_anchorPoint(0.5, 0.5)
@@ -115,10 +135,16 @@ public:
 
     float opacity() const { return m_opacity; }
 
+#if ENABLE(CSS_FILTERS)
+    FilterOperations filters() const { return m_filters; }
+#endif
+
     bool isOpaque() const { return m_isOpaque; }
 
     FloatPoint position() const { return m_position; }
 
+    FloatPoint boundsOrigin() const { return m_boundsOrigin; }
+
     // This is currently only used for perspective transform, see GraphicsLayer::setChildrenTransform()
     const TransformationMatrix& sublayerTransform() const { return m_sublayerTransform; }
 
@@ -169,6 +195,7 @@ protected:
     IntSize m_bounds;
     FloatPoint m_position;
     FloatPoint m_anchorPoint;
+    FloatPoint m_boundsOrigin;
     Color m_backgroundColor;
     Color m_borderColor;
 
@@ -177,6 +204,9 @@ protected:
     TransformationMatrix m_sublayerTransform;
 
     float m_opacity;
+#if ENABLE(CSS_FILTERS)
+    FilterOperations m_filters;
+#endif
     float m_anchorPointZ;
     float m_borderWidth;
 
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerFilterRenderer.cpp b/Source/WebCore/platform/graphics/blackberry/LayerFilterRenderer.cpp
new file mode 100644
index 000000000..8797c10f3
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerFilterRenderer.cpp
@@ -0,0 +1,591 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(CSS_FILTERS)
+
+#include "LayerFilterRenderer.h"
+
+#include "FilterOperation.h"
+#include "LayerCompositingThread.h"
+#include "LayerRenderer.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+#include "TextureCacheCompositingThread.h"
+
+#include <BlackBerryPlatformGraphics.h>
+#include <BlackBerryPlatformLog.h>
+#include <Vector.h>
+
+#include <cstring>
+#include <limits>
+
+namespace WebCore {
+
+static int operationTypeToProgramID(const FilterOperation::OperationType& t)
+{
+    switch (t) {
+    case FilterOperation::GRAYSCALE:
+        return LayerData::CSSFilterShaderGrayscale;
+    case FilterOperation::SEPIA:
+        return LayerData::CSSFilterShaderSepia;
+    case FilterOperation::SATURATE:
+        return LayerData::CSSFilterShaderSaturate;
+    case FilterOperation::HUE_ROTATE:
+        return LayerData::CSSFilterShaderHueRotate;
+    case FilterOperation::INVERT:
+        return LayerData::CSSFilterShaderInvert;
+    case FilterOperation::OPACITY:
+        return LayerData::CSSFilterShaderOpacity;
+    case FilterOperation::BRIGHTNESS:
+        return LayerData::CSSFilterShaderBrightness;
+    case FilterOperation::CONTRAST:
+        return LayerData::CSSFilterShaderContrast;
+    case FilterOperation::BLUR:
+        return LayerData::CSSFilterShaderBlurY;
+    case FilterOperation::DROP_SHADOW:
+        return LayerData::CSSFilterShaderShadow;
+#if ENABLE(CSS_SHADERS)
+    case FilterOperation::CUSTOM:
+        return LayerData::CSSFilterCustom;
+#endif
+    default:
+        ASSERT_NOT_REACHED();
+        return -1;
+    }
+}
+
+Uniformf::Uniformf(int c_location)
+    : m_location(c_location)
+{
+}
+
+void Uniform1f::apply()
+{
+    glUniform1f(location(), m_val);
+}
+
+PassRefPtr<Uniformf> Uniform1f::create(int location, float val)
+{
+    return adoptRef(new Uniform1f(location, val));
+}
+
+Uniform1f::Uniform1f(int c_location, float c_val)
+    : Uniformf(c_location)
+    , m_val(c_val)
+{
+}
+
+void Uniform2f::apply()
+{
+    glUniform2f(location(), m_val[0], m_val[1]);
+}
+
+PassRefPtr<Uniformf> Uniform2f::create(int location, float val0, float val1)
+{
+    return adoptRef(new Uniform2f(location, val0, val1));
+}
+
+Uniform2f::Uniform2f(int c_location, float c_val0, float c_val1)
+    : Uniformf(c_location)
+{
+    m_val[0] = c_val0;
+    m_val[1] = c_val1;
+}
+
+void Uniform3f::apply()
+{
+    glUniform3f(location(), m_val[0], m_val[1], m_val[2]);
+}
+
+PassRefPtr<Uniformf> Uniform3f::create(int location, float val0, float val1, float val2)
+{
+    return adoptRef(new Uniform3f(location, val0, val1, val2));
+}
+
+Uniform3f::Uniform3f(int c_location, float c_val0, float c_val1, float c_val2)
+    : Uniformf(c_location)
+{
+    m_val[0] = c_val0;
+    m_val[1] = c_val1;
+    m_val[2] = c_val2;
+}
+
+PassRefPtr<LayerFilterRendererAction> LayerFilterRendererAction::create(int programId)
+{
+    return adoptRef(new LayerFilterRendererAction(programId));
+}
+
+LayerFilterRendererAction::LayerFilterRendererAction(int c_programId)
+    , m_programId(c_programId)
+    , m_pushSnapshot(false)
+    , m_popSnapshot(false)
+{
+}
+
+void LayerFilterRendererAction::useActionOn(LayerFilterRenderer* renderer)
+{
+    ASSERT(m_programId != -1);
+    if (m_programId == -1) {
+        glUseProgram(renderer->m_cssFilterProgramObject[LayerData::CSSFilterShaderPassthrough]);
+        return;
+    }
+    glUseProgram(renderer->m_cssFilterProgramObject[m_programId]);
+    for (unsigned i = 0; i < m_uniforms.size(); ++i)
+        m_uniforms[i]->apply();
+}
+
+PassOwnPtr<LayerFilterRenderer> LayerFilterRenderer::create(const int& positionLocation, const int& texCoordLocation)
+{
+    return adoptPtr(new LayerFilterRenderer(positionLocation, texCoordLocation));
+}
+
+LayerFilterRenderer::LayerFilterRenderer(const int& positionLocation, const int& texCoordLocation)
+    : m_positionLocation(positionLocation)
+    , m_texCoordLocation(texCoordLocation)
+{
+    for (int i = 0; i < LayerData::NumberOfCSSFilterShaders; ++i)
+        m_cssFilterProgramObject[i] = 0;
+
+    if (!(m_enabled = initializeSharedGLObjects()))
+        BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelWarn, "CSS Filters are not enabled due to failed initialization.");
+}
+
+// Binds the given attribute name to a common location across all programs
+// used by the compositor. This allows the code to bind the attributes only once
+// even when switching between programs.
+//
+// This is an extension of LayerRenderer::bindCommonAttribLocation and the locations
+// will match those of LayerRenderer. See LayerFilterRenderer::LayerFilterRenderer()
+void LayerFilterRenderer::bindCommonAttribLocation(int location, const char* attribName)
+{
+    for (int i = 0; i < LayerData::NumberOfCSSFilterShaders; ++i)
+        glBindAttribLocation(m_cssFilterProgramObject[i], location, attribName);
+}
+
+bool LayerFilterRenderer::initializeSharedGLObjects()
+{
+    // See also TextureMapperShaderManager.cpp
+
+    char vertexShaderString[] =
+        "attribute vec4 a_position;   \n"
+        "attribute vec2 a_texCoord;   \n"
+        "varying vec2 v_texCoord;     \n"
+        "void main()                  \n"
+        "{                            \n"
+        "  gl_Position = a_position;  \n"
+        "  v_texCoord = a_texCoord;   \n"
+        "}                            \n";
+
+#define STANDARD_FILTER(x...) \
+        "precision mediump float; \n"\
+        "\n"\
+        "varying mediump vec2 v_texCoord;\n"\
+        "uniform lowp sampler2D s_texture;\n"\
+        "uniform highp float u_amount;\n"\
+        #x\
+        "void main(void)\n { gl_FragColor = shade(texture2D(s_texture, v_texCoord)); }"
+
+#define OFFSET_FILTER(x...) \
+        "precision mediump float; \n"\
+        "\n"\
+        "varying mediump vec2 v_texCoord;\n"\
+        "uniform lowp sampler2D s_texture;\n"\
+        "uniform highp float u_amount;\n"\
+        "uniform mediump vec2 u_offset;\n"\
+        #x\
+        "void main(void)\n { gl_FragColor = shade(texture2D(s_texture, v_texCoord - u_offset)); }"
+
+#define BLUR_FILTER(x...) \
+        "precision highp float; \n"\
+        "\n"\
+        "varying mediump vec2 v_texCoord;\n"\
+        "uniform lowp sampler2D s_texture;\n"\
+        "uniform highp float u_amount;\n"\
+        "uniform highp float u_blurSize;\n"\
+        "const float pi = 3.1415927;\n"\
+        #x\
+        "void main(void)\n"\
+        "{\n"\
+        "vec3 incr;\n"\
+        "incr.x = 1.0 / (sqrt(2.0 * pi) * u_amount);\n"\
+        "incr.y = exp(-0.5 / (u_amount * u_amount));\n"\
+        "incr.z = incr.y * incr.y;\n"\
+        "\n"\
+        "vec4 avg = vec4(0.0, 0.0, 0.0, 0.0);\n"\
+        "float coefficientSum = 0.0;\n"\
+        "\n"\
+        "avg += texture2D(s_texture, v_texCoord.xy) * incr.x;\n"\
+        "coefficientSum += incr.x;\n"\
+        "incr.xy *= incr.yz;\n"\
+        "\n"\
+        "for (float i = 1.0; i <= numBlurPixelsPerSide; i++) {\n"\
+        "    avg += texture2D(s_texture, v_texCoord.xy - i * u_blurSize * blurMultiplyVec) * incr.x;\n"\
+        "    avg += texture2D(s_texture, v_texCoord.xy + i * u_blurSize * blurMultiplyVec) * incr.x;\n"\
+        "    coefficientSum += 2.0 * incr.x;\n"\
+        "    incr.xy *= incr.yz;\n"\
+        "}\n"\
+        "\n"\
+        "gl_FragColor = avg / coefficientSum;\n"\
+        "}"
+
+    const char* shaderStrs[LayerData::NumberOfCSSFilterShaders];
+
+    shaderStrs[LayerData::CSSFilterShaderGrayscale] = STANDARD_FILTER(
+        lowp vec4 shade(lowp vec4 color)
+        {
+            lowp float amount = 1.0 - u_amount;
+            return vec4((0.2126 + 0.7874 * amount) * color.r + (0.7152 - 0.7152 * amount) * color.g + (0.0722 - 0.0722 * amount) * color.b,
+                        (0.2126 - 0.2126 * amount) * color.r + (0.7152 + 0.2848 * amount) * color.g + (0.0722 - 0.0722 * amount) * color.b,
+                        (0.2126 - 0.2126 * amount) * color.r + (0.7152 - 0.7152 * amount) * color.g + (0.0722 + 0.9278 * amount) * color.b,
+                        color.a);
+        }
+    );
+
+    shaderStrs[LayerData::CSSFilterShaderSepia] = STANDARD_FILTER(
+        lowp vec4 shade(lowp vec4 color)
+        {
+            lowp float amount = 1.0 - u_amount;
+            return vec4((0.393 + 0.607 * amount) * color.r + (0.769 - 0.769 * amount) * color.g + (0.189 - 0.189 * amount) * color.b,
+                        (0.349 - 0.349 * amount) * color.r + (0.686 + 0.314 * amount) * color.g + (0.168 - 0.168 * amount) * color.b,
+                        (0.272 - 0.272 * amount) * color.r + (0.534 - 0.534 * amount) * color.g + (0.131 + 0.869 * amount) * color.b,
+                        color.a);
+         }
+    );
+
+    shaderStrs[LayerData::CSSFilterShaderSaturate] = STANDARD_FILTER(
+        lowp vec4 shade(lowp vec4 color)
+        {
+            return vec4((0.213 + 0.787 * u_amount) * color.r + (0.715 - 0.715 * u_amount) * color.g + (0.072 - 0.072 * u_amount) * color.b,
+                        (0.213 - 0.213 * u_amount) * color.r + (0.715 + 0.285 * u_amount) * color.g + (0.072 - 0.072 * u_amount) * color.b,
+                        (0.213 - 0.213 * u_amount) * color.r + (0.715 - 0.715 * u_amount) * color.g + (0.072 + 0.928 * u_amount) * color.b,
+                        color.a);
+        }
+    );
+
+    shaderStrs[LayerData::CSSFilterShaderHueRotate] = STANDARD_FILTER(
+        lowp vec4 shade(lowp vec4 color)
+        {
+            highp float pi = 3.14159265358979323846;
+            highp float c = cos(u_amount * pi / 180.0);
+            highp float s = sin(u_amount * pi / 180.0);
+            return vec4(color.r * (0.213 + c * 0.787 - s * 0.213) + color.g * (0.715 - c * 0.715 - s * 0.715) + color.b * (0.072 - c * 0.072 + s * 0.928),
+                        color.r * (0.213 - c * 0.213 + s * 0.143) + color.g * (0.715 + c * 0.285 + s * 0.140) + color.b * (0.072 - c * 0.072 - s * 0.283),
+                        color.r * (0.213 - c * 0.213 - s * 0.787) +  color.g * (0.715 - c * 0.715 + s * 0.715) + color.b * (0.072 + c * 0.928 + s * 0.072),
+                        color.a);
+        }
+    );
+
+    shaderStrs[LayerData::CSSFilterShaderInvert] = STANDARD_FILTER(
+        lowp float invert(lowp float n) { return (1.0 - n) * u_amount + n * (1.0 - u_amount); }
+        lowp vec4 shade(lowp vec4 color)
+        {
+            return vec4(invert(color.r), invert(color.g), invert(color.b), color.a);
+        }
+    );
+
+    shaderStrs[LayerData::CSSFilterShaderBrightness] = STANDARD_FILTER(
+        lowp vec4 shade(lowp vec4 color)
+        {
+            return vec4(color.rgb * (1.0 + u_amount), color.a);
+        }
+    );
+
+    shaderStrs[LayerData::CSSFilterShaderContrast] = STANDARD_FILTER(
+        lowp float contrast(lowp float n) { return (n - 0.5) * u_amount + 0.5; }
+        lowp vec4 shade(lowp vec4 color)
+        {
+            return vec4(contrast(color.r), contrast(color.g), contrast(color.b), color.a);
+        }
+    );
+
+    shaderStrs[LayerData::CSSFilterShaderOpacity] = STANDARD_FILTER(
+        lowp vec4 shade(lowp vec4 color)
+        {
+            return vec4(color.r, color.g, color.b, color.a * u_amount);
+        }
+    );
+
+    shaderStrs[LayerData::CSSFilterShaderBlurX] = BLUR_FILTER(
+        const float numBlurPixelsPerSide = 2.0;
+        const vec2  blurMultiplyVec      = vec2(1.0, 0.0);
+    );
+
+    shaderStrs[LayerData::CSSFilterShaderBlurY] = BLUR_FILTER(
+        const float numBlurPixelsPerSide = 2.0;
+        const vec2  blurMultiplyVec      = vec2(0.0, 1.0);
+    );
+
+    shaderStrs[LayerData::CSSFilterShaderShadow] = OFFSET_FILTER(
+        uniform lowp vec3 u_color;
+        lowp vec4 shade(lowp vec4 color)
+        {
+            if (color.a > 0.5)
+                return vec4(u_color.r, u_color.g, u_color.b, color.a);
+            return color;
+        }
+    );
+
+    shaderStrs[LayerData::CSSFilterShaderPassthrough] = STANDARD_FILTER(
+        lowp vec4 shade(lowp vec4 color)
+        {
+            return color;
+        }
+    );
+
+    for (int i = 0; i < LayerData::NumberOfCSSFilterShaders; i++) {
+        m_cssFilterProgramObject[i] = LayerRenderer::loadShaderProgram(vertexShaderString, shaderStrs[i]);
+        if (!m_cssFilterProgramObject[i]) {
+            BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelWarn, "Could not load CSS Filter Shader %i", i);
+            return false;
+        }
+    }
+
+    // Set ATTRIB locations - these will be the same as the programs in LayerRenderer.cpp
+    bindCommonAttribLocation(m_positionLocation, "a_position");
+    bindCommonAttribLocation(m_texCoordLocation, "a_texCoord");
+
+    // Re-link to take effect
+    for (int i = 0; i < LayerData::NumberOfCSSFilterShaders; ++i)
+        glLinkProgram(m_cssFilterProgramObject[i]);
+
+    // Get UNIFORM locations
+    for (int i = 0; i < LayerData::NumberOfCSSFilterShaders; ++i)
+        m_amountLocation[i] = glGetUniformLocation(m_cssFilterProgramObject[i], "u_amount");
+
+    m_blurAmountLocation[0] = glGetUniformLocation(m_cssFilterProgramObject[LayerData::CSSFilterShaderBlurY], "u_blurSize");
+    m_blurAmountLocation[1] = glGetUniformLocation(m_cssFilterProgramObject[LayerData::CSSFilterShaderBlurX], "u_blurSize");
+
+    m_shadowColorLocation = glGetUniformLocation(m_cssFilterProgramObject[LayerData::CSSFilterShaderShadow], "u_color");
+    m_offsetLocation = glGetUniformLocation(m_cssFilterProgramObject[LayerData::CSSFilterShaderShadow], "u_offset");
+
+    return true;
+}
+
+void LayerFilterRenderer::ping(LayerRendererSurface* surface)
+{
+    glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, m_texture->textureId(), 0);
+    glBindTexture(GL_TEXTURE_2D, surface->texture()->textureId());
+}
+
+void LayerFilterRenderer::pong(LayerRendererSurface* surface)
+{
+    glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, surface->texture()->textureId(), 0);
+    glBindTexture(GL_TEXTURE_2D, m_texture->textureId());
+}
+
+void LayerFilterRenderer::pushSnapshot(LayerRendererSurface* surface, int sourceId)
+{
+    glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, m_snapshotTexture->textureId(), 0);
+
+    glBindTexture(GL_TEXTURE_2D, sourceId);
+    glClear(GL_COLOR_BUFFER_BIT); // to transparency
+
+    glViewport(0, 0, surface->size().width(), surface->size().height());
+
+    glUseProgram(m_cssFilterProgramObject[LayerData::CSSFilterShaderPassthrough]);
+    glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+}
+
+void LayerFilterRenderer::popSnapshot()
+{
+    // The name is slightly misleading.
+    // This DRAWS the previous texture using the current LayerFilterRendererAction, then sets the texture
+    // to the snapshot texture. Next time glDrawArrays is called, the snapshot will be drawn.
+
+    glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+    glBindTexture(GL_TEXTURE_2D, m_snapshotTexture->textureId());
+}
+
+Vector<RefPtr<LayerFilterRendererAction> > LayerFilterRenderer::actionsForOperations(LayerRendererSurface* surface, const Vector<RefPtr<FilterOperation> >& ops)
+{
+    Vector<RefPtr<LayerFilterRendererAction> > ret;
+    for (unsigned int i = 0; i < ops.size(); ++i) {
+        const FilterOperation& operation = *ops[i].get();
+        if (operation.getOperationType() == FilterOperation::BLUR && static_cast<const BlurFilterOperation&>(operation).stdDeviation().value() < 0.1)
+            continue;
+
+        int programId = operationTypeToProgramID(operation.getOperationType());
+        ret.append(LayerFilterRendererAction::create(programId));
+
+        switch (operation.getOperationType()) {
+        case FilterOperation::GRAYSCALE:
+        case FilterOperation::SEPIA:
+        case FilterOperation::SATURATE:
+        case FilterOperation::HUE_ROTATE:
+            ret.last()->appendUniform(Uniform1f::create(m_amountLocation[programId]
+                , static_cast<const BasicColorMatrixFilterOperation&>(operation).amount()));
+            break;
+        case FilterOperation::INVERT:
+        case FilterOperation::BRIGHTNESS:
+        case FilterOperation::CONTRAST:
+        case FilterOperation::OPACITY:
+            ret.last()->appendUniform(Uniform1f::create(m_amountLocation[programId]
+                , static_cast<const BasicComponentTransferFilterOperation&>(operation).amount()));
+            break;
+        case FilterOperation::BLUR:
+            {
+            // Blur is a two-step process:
+            //     1. blur X
+            //     2. blur Y
+            // This way we can have 2n time instead of n^2 time)
+
+            double amount = static_cast<const BlurFilterOperation&>(operation).stdDeviation().value();
+
+            // BLUR Y:
+            ret.last()->appendUniform(Uniform1f::create(m_amountLocation[LayerData::CSSFilterShaderBlurY], amount));
+            ret.last()->appendUniform(Uniform1f::create(m_blurAmountLocation[0]
+                , 1.0f / float(surface->size().height())));
+
+            // BLUR X:
+            ret.append(LayerFilterRendererAction::create(LayerData::CSSFilterShaderBlurX));
+            ret.last()->appendUniform(Uniform1f::create(m_amountLocation[LayerData::CSSFilterShaderBlurX], amount));
+            ret.last()->appendUniform(Uniform1f::create(m_blurAmountLocation[1]
+                , 1.0f / float(surface->size().width())));
+
+            }
+            break;
+        case FilterOperation::DROP_SHADOW:
+            {
+            // Shadow is a four-step process:
+            //     1. capture snapshot
+            //        turn into a solid offset mask
+            //     2. blur X
+            //     3. blur Y
+            //     4. repaint original on top of mask
+            const DropShadowFilterOperation& dsfo = static_cast<const DropShadowFilterOperation&>(operation);
+            ret.last()->setPushSnapshot();
+            ret.last()->appendUniform(Uniform2f::create(m_offsetLocation
+                , float(dsfo.x()) / float(surface->size().width())
+                , float(dsfo.y()) / float(surface->size().height())));
+            ret.last()->appendUniform(Uniform3f::create(m_shadowColorLocation
+                , float(dsfo.color().red()) / 255.0f
+                , float(dsfo.color().green()) / 255.0f
+                , float(dsfo.color().blue()) / 255.0f));
+
+            // BLUR Y
+            ret.append(LayerFilterRendererAction::create(LayerData::CSSFilterShaderBlurY));
+            ret.last()->appendUniform(Uniform1f::create(m_amountLocation[LayerData::CSSFilterShaderBlurY]
+                , dsfo.stdDeviation()));
+            ret.last()->appendUniform(Uniform1f::create(m_blurAmountLocation[0]
+                , 1.0f / float(surface->size().height())));
+
+            // BLUR X
+            ret.append(LayerFilterRendererAction::create(LayerData::CSSFilterShaderBlurX));
+            ret.last()->appendUniform(Uniform1f::create(m_amountLocation[LayerData::CSSFilterShaderBlurX]
+                , dsfo.stdDeviation()));
+            ret.last()->appendUniform(Uniform1f::create(m_blurAmountLocation[1]
+                , 1.0f / float(surface->size().width())));
+
+            // Repaint original image
+            ret.append(LayerFilterRendererAction::create(LayerData::CSSFilterShaderPassthrough));
+            ret.last()->setPopSnapshot();
+            }
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+
+    if (ret.size() % 2) // We need an even number of actions. See ping-pong note in applyLayerFilters().
+        ret.append(LayerFilterRendererAction::create(LayerData::CSSFilterShaderPassthrough));
+
+    return ret;
+}
+
+static float texcoords[4 * 2] = { 0, 0,  0, 1,  1, 1,  1, 0 };
+
+void LayerFilterRenderer::applyActions(unsigned& fbo, LayerCompositingThread* layer, Vector<RefPtr<LayerFilterRendererAction> > actions)
+{
+    glClearColor(0.0f, 0.0f, 0.0f, 0.0f);
+    ASSERT(!(actions.size() % 2)); // See ping-ponging note below.
+
+    if (!m_enabled)
+        return;
+
+    if (!layer->filters().size())
+        return;
+
+    if (!m_texture)
+        m_texture = textureCacheCompositingThread()->createTexture();
+
+    bool requireSnapshot = false;
+    for (unsigned i = 0; i < actions.size(); ++i) {
+        if (actions[i]->shouldPushSnapshot())
+            requireSnapshot = true;
+    }
+
+    if (!m_snapshotTexture && requireSnapshot)
+        m_snapshotTexture = textureCacheCompositingThread()->createTexture();
+
+    LayerRendererSurface* surface = layer->layerRendererSurface();
+
+    glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, &layer->getTransformedBounds() );
+    glVertexAttribPointer(m_texCoordLocation, 2, GL_FLOAT, GL_FALSE, 0, texcoords);
+
+    m_texture->protect(surface->texture()->size());
+    if (requireSnapshot)
+        m_snapshotTexture->protect(surface->texture()->size());
+
+    if (!fbo)
+        glGenFramebuffers(1, &fbo);
+
+    glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+
+    for (unsigned int i = 0; i < actions.size(); ++i) {
+        // NOTE ABOUT PING-PONGING
+        // =======================
+        // Under OpenGL ES 2.0, we cannot use the fbo we are writting to as a texture, so we need to play ping-pong:
+        //  1) Draw parent surface to our texture with effect.
+        //  2) Draw our surface to parent texture with effect.
+        //  3) Repeat.
+        // Because we eventually have to end on the parent texture, we need an even number of actions.
+        // actionsForOperations takes care of that.
+
+        if (actions[i]->shouldPushSnapshot())
+            pushSnapshot(surface, (!(i % 2) ? surface->texture()->textureId() : m_texture->textureId()));
+
+        if (!(i % 2))
+            ping(surface); // Set framebuffer to ours, and texture to parent
+        else
+            pong(surface); // Set texture to parent, and framebuffer to us
+
+        glClear(GL_COLOR_BUFFER_BIT); // to transparency
+        glViewport(0, 0, surface->size().width(), surface->size().height());
+
+        actions[i]->useActionOn(this);
+
+        if (actions[i]->shouldPopSnapshot())
+            popSnapshot();
+
+        glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+    }
+
+    m_texture->unprotect();
+    if (requireSnapshot)
+        m_snapshotTexture->unprotect();
+    glBindTexture(GL_TEXTURE_2D, 0);
+
+    glClearColor(0.0f, 0.0f, 0.0f, 0.0f);
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING) && USE(CSS_FILTERS)
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerFilterRenderer.h b/Source/WebCore/platform/graphics/blackberry/LayerFilterRenderer.h
new file mode 100644
index 000000000..1c1f06e03
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerFilterRenderer.h
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef LayerFilterRenderer_h
+#define LayerFilterRenderer_h
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(CSS_FILTERS)
+
+#include "IntRect.h"
+#include "LayerData.h"
+#include "OwnPtr.h"
+#include "Texture.h"
+#include "TransformationMatrix.h"
+
+#include <BlackBerryPlatformGLES2Context.h>
+#include <BlackBerryPlatformIntRectRegion.h>
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class LayerCompositingThread;
+class LayerFilterRenderer;
+class LayerFilterRendererAction;
+class LayerRendererSurface;
+
+class Uniformf : public RefCounted<Uniformf> {
+    WTF_MAKE_NONCOPYABLE(Uniformf);
+public:
+    virtual void apply() = 0;
+
+protected:
+    Uniformf(int location);
+    const int& location() const { return m_location; }
+
+private:
+    int m_location;
+};
+
+class Uniform1f : public Uniformf {
+public:
+    static PassRefPtr<Uniformf> create(int location, float val);
+
+protected:
+    Uniform1f(int location, float val);
+
+private:
+    virtual void apply();
+    float m_val;
+};
+
+class Uniform2f : public Uniformf {
+public:
+    static PassRefPtr<Uniformf> create(int location, float val0, float val1);
+
+protected:
+    Uniform2f(int location, float val0, float val1);
+
+private:
+    virtual void apply();
+    float m_val[2];
+};
+
+class Uniform3f : public Uniformf {
+public:
+    static PassRefPtr<Uniformf> create(int location, float val0, float val1, float val2);
+
+protected:
+    Uniform3f(int location, float val0, float val1, float val2);
+
+private:
+    virtual void apply();
+    float m_val[3];
+};
+
+class LayerFilterRendererAction : public RefCounted<LayerFilterRendererAction> {
+public:
+    static PassRefPtr<LayerFilterRendererAction> create(int programId);
+        // A vector of actions must have an even count, so if you have an odd count, add a passthrough event at the end.
+        // See the ping-pong note in LayerFilterRenderer::applyActions.
+    ~LayerFilterRendererAction();
+
+    bool shouldPushSnapshot() const { return m_pushSnapshot; }
+    void setPushSnapshot() { m_pushSnapshot = true; }
+
+    bool shouldPopSnapshot() const { return m_popSnapshot; }
+    void setPopSnapshot() { m_popSnapshot = true; }
+
+    void appendUniform(const RefPtr<Uniformf>& uniform) { m_uniforms.append(uniform); }
+    void useActionOn(LayerFilterRenderer*);
+
+protected:
+    int m_programId;
+    bool m_pushSnapshot;
+    bool m_popSnapshot;
+
+    Vector<RefPtr<Uniformf> > m_uniforms;
+private:
+    LayerFilterRendererAction(int programId);
+};
+
+class LayerFilterRenderer {
+    WTF_MAKE_NONCOPYABLE(LayerFilterRenderer);
+
+public:
+    static PassOwnPtr<LayerFilterRenderer> create(const int& positionLocation, const int& texCoordLocation);
+    void applyActions(unsigned& fbo, LayerCompositingThread*, Vector<RefPtr<LayerFilterRendererAction> >);
+    Vector<RefPtr<LayerFilterRendererAction> > actionsForOperations(LayerRendererSurface*, const Vector<RefPtr<FilterOperation> >&);
+
+    // If initialization fails, or disable() is called, this is false.
+    bool isEnabled() const { return m_enabled; }
+    void disable() { m_enabled = false; }
+
+private:
+    LayerFilterRenderer(const int& positionLocation, const int& texCoordLocation);
+    void bindCommonAttribLocation(int location, const char* attribName);
+    bool initializeSharedGLObjects();
+
+    // See note about ping-ponging in applyActions()
+    void ping(LayerRendererSurface*);
+    void pong(LayerRendererSurface*);
+
+    // This is for shadows, where we need to create a shadow, and then repaint the original image
+    // on top of the shadow.
+    void pushSnapshot(LayerRendererSurface*, int sourceId);
+    void popSnapshot();
+
+    bool m_enabled;
+
+    // ESSL attributes shared with LayerRenderer - see constructor:
+    const int m_positionLocation;
+    const int m_texCoordLocation;
+
+    // ESSL program object IDs:
+    unsigned m_cssFilterProgramObject[LayerData::NumberOfCSSFilterShaders];
+
+    // ESSL uniform locations:
+    int m_amountLocation[LayerData::NumberOfCSSFilterShaders];
+    int m_blurAmountLocation[2]; // 0 = Y, 1 = X
+    int m_shadowColorLocation;
+    int m_offsetLocation;
+
+    // Textures for playing ping-pong - see note in applyActions()
+    RefPtr<Texture> m_texture;
+    RefPtr<Texture> m_snapshotTexture;
+
+    friend class LayerFilterRendererAction;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(CSS_FILTERS)
+
+#endif // LayerFilterRenderer_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp
index 77623e58c..db218a54e 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp
@@ -37,11 +37,13 @@
 #include "LayerRenderer.h"
 
 #include "LayerCompositingThread.h"
+#include "LayerFilterRenderer.h"
 #include "PlatformString.h"
 #include "TextureCacheCompositingThread.h"
 
 #include <BlackBerryPlatformGraphics.h>
 #include <BlackBerryPlatformLog.h>
+#include <EGL/egl.h>
 #include <limits>
 #include <wtf/text/CString.h>
 
@@ -64,7 +66,7 @@ static void checkGLError()
 #endif
 }
 
-static GLuint loadShader(GLenum type, const char* shaderSource)
+GLuint LayerRenderer::loadShader(GLenum type, const char* shaderSource)
 {
     GLuint shader = glCreateShader(type);
     if (!shader)
@@ -86,7 +88,7 @@ static GLuint loadShader(GLenum type, const char* shaderSource)
     return shader;
 }
 
-static GLuint loadShaderProgram(const char* vertexShaderSource, const char* fragmentShaderSource)
+GLuint LayerRenderer::loadShaderProgram(const char* vertexShaderSource, const char* fragmentShaderSource)
 {
     GLuint vertexShader;
     GLuint fragmentShader;
@@ -158,8 +160,15 @@ LayerRenderer::LayerRenderer(GLES2Context* context)
     , m_currentLayerRendererSurface(0)
     , m_clearSurfaceOnDrawLayers(true)
     , m_context(context)
+    , m_isRobustnessSupported(false)
     , m_needsCommit(false)
 {
+    if (makeContextCurrent()) {
+        m_isRobustnessSupported = String(reinterpret_cast<const char*>(::glGetString(GL_EXTENSIONS))).contains("GL_EXT_robustness");
+        if (m_isRobustnessSupported)
+            m_glGetGraphicsResetStatusEXT = reinterpret_cast<PFNGLGETGRAPHICSRESETSTATUSEXTPROC>(eglGetProcAddress("glGetGraphicsResetStatusEXT"));
+    }
+
     for (int i = 0; i < LayerData::NumberOfLayerProgramShaders; ++i)
         m_layerProgramObject[i] = 0;
 
@@ -500,6 +509,17 @@ void LayerRenderer::drawLayersOnSurfaces(const Vector<RefPtr<LayerCompositingThr
         int currentStencilValue = 0;
         FloatRect clipRect(-1, -1, 2, 2);
         compositeLayersRecursive(surfaceLayers[i].get(), currentStencilValue, clipRect);
+
+#if ENABLE(CSS_FILTERS)
+        if (!m_filterRenderer)
+            m_filterRenderer = LayerFilterRenderer::create(m_positionLocation, m_texCoordLocation);
+        if (layer->filterOperationsChanged()) {
+            layer->setFilterOperationsChanged(false);
+            layer->setFilterActions(m_filterRenderer->actionsForOperations(surface, layer->filters().operations()));
+        }
+        m_filterRenderer->applyActions(m_fbo, layer, layer->filterActions());
+        glClearColor(0, 0, 0, 0);
+#endif
     }
 
     // If there are layers drawed on surfaces, we need to switch to default framebuffer.
@@ -712,7 +732,11 @@ void LayerRenderer::updateLayersRecursive(LayerCompositingThread* layer, const T
     // Calculate the layer's opacity.
     opacity *= layer->opacity();
 
+#if ENABLE(CSS_FILTERS)
+    bool useLayerRendererSurface = layer->maskLayer() || layer->replicaLayer() || layer->filters().size();
+#else
     bool useLayerRendererSurface = layer->maskLayer() || layer->replicaLayer();
+#endif
     if (!useLayerRendererSurface) {
         layer->setDrawOpacity(opacity);
         layer->clearLayerRendererSurface();
@@ -784,6 +808,7 @@ void LayerRenderer::updateLayersRecursive(LayerCompositingThread* layer, const T
     // The matrix passed down to the sublayers is therefore:
     // M[s] = M * Tr[-center]
     localMatrix.translate3d(-bounds.width() * 0.5, -bounds.height() * 0.5, 0);
+    localMatrix.translate(-layer->boundsOrigin().x(), -layer->boundsOrigin().y());
 
     const Vector<RefPtr<LayerCompositingThread> >& sublayers = layer->getSublayers();
     for (size_t i = 0; i < sublayers.size(); i++)
@@ -981,10 +1006,17 @@ void LayerRenderer::updateScissorIfNeeded(const FloatRect& clipRect)
 
 bool LayerRenderer::makeContextCurrent()
 {
-    return m_context->makeCurrent();
+    bool ret = m_context->makeCurrent();
+    if (ret && m_isRobustnessSupported) {
+        if (m_glGetGraphicsResetStatusEXT() != GL_NO_ERROR) {
+            BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelCritical, "Robust OpenGL context has been reset. Aborting.");
+            CRASH();
+        }
+    }
+    return ret;
 }
 
-// Binds the given attribute name to a common location across all three programs
+// Binds the given attribute name to a common location across all programs
 // used by the compositor. This allows the code to bind the attributes only once
 // even when switching between programs.
 void LayerRenderer::bindCommonAttribLocation(int location, const char* attribName)
@@ -1053,7 +1085,6 @@ bool LayerRenderer::initializeSharedGLObjects()
         "  gl_FragColor = vec4(texColor.x, texColor.y, texColor.z, texColor.w) * alpha * maskColor.w;         \n"
         "}                                                               \n";
 
-
     // Shaders for drawing the debug borders around the layers.
     char colorVertexShaderString[] =
         "attribute vec4 a_position;   \n"
@@ -1139,7 +1170,7 @@ bool LayerRenderer::initializeSharedGLObjects()
         return false;
     }
 
-    // Specify the attrib location for the position and make it the same for all three programs to
+    // Specify the attrib location for the position and make it the same for all programs to
     // avoid binding re-binding the vertex attributes.
     bindCommonAttribLocation(m_positionLocation, "a_position");
     bindCommonAttribLocation(m_texCoordLocation, "a_texCoord");
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h
index f6c3be878..353b7eca8 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h
@@ -29,14 +29,15 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #ifndef LayerRenderer_h
 #define LayerRenderer_h
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "Extensions3DOpenGLES.h"
 #include "IntRect.h"
 #include "LayerData.h"
+#include "LayerFilterRenderer.h"
 #include "TransformationMatrix.h"
 
 #include <BlackBerryPlatformGLES2Context.h>
@@ -134,6 +135,9 @@ public:
     // If the layer has already been drawed on a surface.
     bool layerAlreadyOnSurface(LayerCompositingThread*) const;
 
+    static GLuint loadShader(GLenum type, const char* shaderSource);
+    static GLuint loadShaderProgram(const char* vertexShaderSource, const char* fragmentShaderSource);
+
 private:
     void prepareFrameRecursive(LayerCompositingThread*, double animationTime, bool isContextCurrent);
     void updateLayersRecursive(LayerCompositingThread*, const TransformationMatrix& parentMatrix, Vector<RefPtr<LayerCompositingThread> >& surfaceLayers, float opacity, FloatRect clipRect);
@@ -164,6 +168,10 @@ private:
     // Shader uniform and attribute locations.
     const int m_positionLocation;
     const int m_texCoordLocation;
+#if ENABLE(CSS_FILTERS)
+    OwnPtr<LayerFilterRenderer> m_filterRenderer;
+#endif
+
     int m_samplerLocation[LayerData::NumberOfLayerProgramShaders];
     int m_alphaLocation[LayerData::NumberOfLayerProgramShaders];
     int m_maskSamplerLocation[LayerData::NumberOfLayerProgramShaders];
@@ -199,6 +207,9 @@ private:
 
     BlackBerry::Platform::Graphics::GLES2Context* m_context;
 
+    bool m_isRobustnessSupported;
+    PFNGLGETGRAPHICSRESETSTATUSEXTPROC m_glGetGraphicsResetStatusEXT;
+
     LayerRenderingResults m_lastRenderingResults;
     bool m_needsCommit;
 };
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTile.cpp b/Source/WebCore/platform/graphics/blackberry/LayerTile.cpp
index dec19d48b..9eb6f836b 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerTile.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTile.cpp
@@ -28,6 +28,7 @@ namespace WebCore {
 
 LayerTile::LayerTile()
     : m_contentsDirty(false)
+    , m_visible(false)
 {
 }
 
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTile.h b/Source/WebCore/platform/graphics/blackberry/LayerTile.h
index af4403dff..ce97d21e9 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerTile.h
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTile.h
@@ -33,20 +33,7 @@ class Color;
 class IntRect;
 class TileIndex;
 
-class LayerTileData {
-public:
-    LayerTileData()
-        : m_visible(false)
-    {
-    }
-
-    bool isVisible() const { return m_visible; }
-
-protected:
-    bool m_visible;
-};
-
-class LayerTile : public LayerTileData {
+class LayerTile {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     LayerTile();
@@ -76,7 +63,8 @@ private:
 
     // Never assign to m_texture directly, use setTexture() above.
     RefPtr<Texture> m_texture;
-    bool m_contentsDirty;
+    bool m_contentsDirty : 1;
+    bool m_visible : 1;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTiler.cpp b/Source/WebCore/platform/graphics/blackberry/LayerTiler.cpp
index db6e75c2f..9f5c6af3e 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerTiler.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTiler.cpp
@@ -83,7 +83,7 @@ LayerTiler::~LayerTiler()
     // Someone should have called LayerTiler::deleteTextures()
     // before now. We can't call it here because we have no
     // OpenGL context.
-    ASSERT(m_tilesCompositingThread.isEmpty());
+    ASSERT(m_tiles.isEmpty());
 }
 
 void LayerTiler::layerWebKitThreadDestroyed()
@@ -167,16 +167,21 @@ void LayerTiler::updateTextureContentsIfNeeded(double scale)
         dirtyRect = IntRect(IntPoint::zero(), requiredTextureSize);
     }
 
+    // If the new size is empty, clear the visibility jobs
+    if (requiredTextureSize.isEmpty() && renderJobs.size()) {
+        renderJobs.clear();
+
+        MutexLocker locker(m_renderJobsMutex);
+        m_renderJobs.clear();
+    }
+
     // If we need display because we no longer need to be displayed, due to texture size becoming 0 x 0,
     // or if we're re-rendering the whole thing anyway, clear old texture jobs.
-    HashSet<TileIndex> finishedJobs;
-    if (requiredTextureSize.isEmpty() || dirtyRect == IntRect(IntPoint::zero(), requiredTextureSize)) {
-        {
-            MutexLocker locker(m_renderJobsMutex);
-            m_renderJobs.clear();
-        }
+    if (requiredTextureSize.isEmpty() || dirtyRect == IntRect(IntPoint::zero(), requiredTextureSize))
         clearTextureJobs();
-    } else if (!renderJobs.isEmpty()) {
+
+    HashSet<TileIndex> finishedJobs;
+    if (!renderJobs.isEmpty()) {
         if (Image* image = m_layer->contents()) {
             bool isOpaque = false;
             if (image->isBitmapImage())
@@ -218,6 +223,7 @@ void LayerTiler::updateTextureContentsIfNeeded(double scale)
     }
 
     bool didResize = false;
+    IntRect previousTextureRect(IntPoint::zero(), m_pendingTextureSize);
     if (m_pendingTextureSize != requiredTextureSize) {
         didResize = true;
         m_pendingTextureSize = requiredTextureSize;
@@ -245,9 +251,10 @@ void LayerTiler::updateTextureContentsIfNeeded(double scale)
     IntPoint topLeft = dirtyRect.minXMinYCorner();
     IntPoint bottomRight = dirtyRect.maxXMaxYCorner(); // This is actually a pixel below and to the right of the dirtyRect.
 
-    IntSize tileMaximumSize = tileSize();
-    bool wasOneTile = m_tilesWebKitThread.size() == 1;
-    bool isOneTile = m_pendingTextureSize.width() <= tileMaximumSize.width() && m_pendingTextureSize.height() <= tileMaximumSize.height();
+    IntSize tileMaximumSize(tileSize());
+    IntRect rectForOneTile(IntPoint::zero(), tileMaximumSize);
+    bool wasOneTile = rectForOneTile.contains(previousTextureRect);
+    bool isOneTile = rectForOneTile.contains(IntRect(IntPoint::zero(), m_pendingTextureSize));
     IntPoint origin = originOfTile(indexOfTile(topLeft));
     IntRect tileRect;
     for (tileRect.setX(origin.x()); tileRect.x() < bottomRight.x(); tileRect.setX(tileRect.x() + tileMaximumSize.width())) {
@@ -312,17 +319,9 @@ void LayerTiler::updateTextureContentsIfNeeded(double scale)
 
 bool LayerTiler::shouldPerformRenderJob(const TileIndex& index, bool allowPrefill)
 {
-    // If the visibility information was propagated from the compositing
-    // thread, use that information.
-    // However, we are about to commit new layer properties that may make
-    // currently hidden layers visible. To avoid false negatives, we only allow
-    // the current state to be used to accept render jobs, not to reject them.
-    if (m_tilesWebKitThread.get(index).isVisible())
-        return true;
-
     // Tiles that are not currently visible on the compositing thread may still
     // deserve to be rendered if they should be prefilled...
-    if (allowPrefill && !m_tilesWebKitThread.contains(index) && shouldPrefillTile(index))
+    if (allowPrefill && shouldPrefillTile(index))
         return true;
 
     // Or if they are visible according to the state that's about to be
@@ -369,7 +368,7 @@ void LayerTiler::layerVisibilityChanged(LayerCompositingThread*, bool visible)
         m_renderJobs.clear();
     }
 
-    for (TileMap::iterator it = m_tilesCompositingThread.begin(); it != m_tilesCompositingThread.end(); ++it) {
+    for (TileMap::iterator it = m_tiles.begin(); it != m_tiles.end(); ++it) {
         TileIndex index = (*it).first;
         LayerTile* tile = (*it).second;
         tile->setVisible(false);
@@ -387,12 +386,12 @@ void LayerTiler::uploadTexturesIfNeeded(LayerCompositingThread*)
     for (TileJobsMap::const_iterator tileJobsIter = tileJobsMap.begin(); tileJobsIter != tileJobsIterEnd; ++tileJobsIter) {
         IntPoint origin = originOfTile(tileJobsIter->first);
 
-        LayerTile* tile = m_tilesCompositingThread.get(tileJobsIter->first);
+        LayerTile* tile = m_tiles.get(tileJobsIter->first);
         if (!tile) {
             if (origin.x() >= m_requiredTextureSize.width() || origin.y() >= m_requiredTextureSize.height())
                 continue;
             tile = new LayerTile();
-            m_tilesCompositingThread.add(tileJobsIter->first, tile);
+            m_tiles.add(tileJobsIter->first, tile);
         }
 
         IntRect tileRect(origin, tileSize());
@@ -516,10 +515,10 @@ void LayerTiler::drawTexturesInternal(LayerCompositingThread* layer, double scal
     for (tileRect.setX(0); tileRect.x() < m_requiredTextureSize.width(); tileRect.setX(tileRect.x() + maxw)) {
         for (tileRect.setY(0); tileRect.y() < m_requiredTextureSize.height(); tileRect.setY(tileRect.y() + maxh)) {
             TileIndex index = indexOfTile(tileRect.location());
-            LayerTile* tile = m_tilesCompositingThread.get(index);
+            LayerTile* tile = m_tiles.get(index);
             if (!tile) {
                 tile = new LayerTile();
-                m_tilesCompositingThread.add(index, tile);
+                m_tiles.add(index, tile);
             }
 
             float x = index.i() * maxw * sx;
@@ -629,12 +628,10 @@ void LayerTiler::deleteTextures(LayerCompositingThread*)
     // from WebKit thread to compositing thread, we don't need
     // any synchronization mechanism here, even though we are
     // touching some WebKit thread state.
-    m_tilesWebKitThread.clear();
-
-    if (m_tilesCompositingThread.size()) {
-        for (TileMap::iterator it = m_tilesCompositingThread.begin(); it != m_tilesCompositingThread.end(); ++it)
+    if (m_tiles.size()) {
+        for (TileMap::iterator it = m_tiles.begin(); it != m_tiles.end(); ++it)
             (*it).second->discardContents();
-        m_tilesCompositingThread.clear();
+        m_tiles.clear();
 
         m_contentsDirty = true;
     }
@@ -649,7 +646,7 @@ void LayerTiler::pruneTextures()
 {
     // Prune tiles that are no longer needed.
     Vector<TileIndex> tilesToDelete;
-    for (TileMap::iterator it = m_tilesCompositingThread.begin(); it != m_tilesCompositingThread.end(); ++it) {
+    for (TileMap::iterator it = m_tiles.begin(); it != m_tiles.end(); ++it) {
         TileIndex index = (*it).first;
 
         IntPoint origin = originOfTile(index);
@@ -658,7 +655,7 @@ void LayerTiler::pruneTextures()
     }
 
     for (Vector<TileIndex>::iterator it = tilesToDelete.begin(); it != tilesToDelete.end(); ++it) {
-        LayerTile* tile = m_tilesCompositingThread.take(*it);
+        LayerTile* tile = m_tiles.take(*it);
         tile->discardContents();
         delete tile;
     }
@@ -738,11 +735,11 @@ IntRect LayerTiler::rectForTile(const TileIndex& index, const IntSize& bounds)
 
 void LayerTiler::bindContentsTexture(LayerCompositingThread*)
 {
-    ASSERT(m_tilesCompositingThread.size() == 1);
-    if (m_tilesCompositingThread.size() != 1)
+    ASSERT(m_tiles.size() == 1);
+    if (m_tiles.size() != 1)
         return;
 
-    const LayerTile* tile = m_tilesCompositingThread.begin()->second;
+    const LayerTile* tile = m_tiles.begin()->second;
 
     ASSERT(tile->hasTexture());
     if (!tile->hasTexture())
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTiler.h b/Source/WebCore/platform/graphics/blackberry/LayerTiler.h
index 7694dec70..04e40ee5f 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerTiler.h
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTiler.h
@@ -138,7 +138,6 @@ private:
     };
 
     typedef HashMap<TileIndex, LayerTile*> TileMap;
-    typedef HashMap<TileIndex, LayerTileData> VisibilityMap;
     typedef HashMap<TileIndex, const TextureJob*> TileJobsMap;
 
     IntSize tileSize() const { return m_tileSize; }
@@ -176,9 +175,7 @@ private:
 
     LayerWebKitThread* m_layer;
 
-    TileMap m_tilesCompositingThread;
-
-    VisibilityMap m_tilesWebKitThread;
+    TileMap m_tiles; // Compositing thread only
 
     bool m_tilingDisabled;
 
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp
index 15bbe0a8f..e9d3dff42 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp
@@ -65,6 +65,9 @@ LayerWebKitThread::LayerWebKitThread(LayerType type, GraphicsLayerBlackBerry* ow
     , m_isMask(false)
     , m_animationsChanged(false)
     , m_clearOverrideOnCommit(false)
+#if ENABLE(CSS_FILTERS)
+    , m_filtersChanged(false)
+#endif
 {
     if (type == Layer)
         m_tiler = LayerTiler::create(this);
@@ -284,6 +287,12 @@ void LayerWebKitThread::commitOnCompositingThread()
     m_position += m_absoluteOffset;
     // Copy the base variables from this object into m_layerCompositingThread
     replicate(m_layerCompositingThread.get());
+#if ENABLE(CSS_FILTERS)
+    if (m_filtersChanged) {
+        m_filtersChanged = false;
+        m_layerCompositingThread->setFilterOperationsChanged(true);
+    }
+#endif
     if (m_animationsChanged) {
         m_layerCompositingThread->setRunningAnimations(m_runningAnimations);
         m_layerCompositingThread->setSuspendedAnimations(m_suspendedAnimations);
@@ -405,6 +414,31 @@ void LayerWebKitThread::setFrame(const FloatRect& rect)
     setNeedsDisplay();
 }
 
+#if ENABLE(CSS_FILTERS)
+bool LayerWebKitThread::filtersCanBeComposited(const FilterOperations& filters)
+{
+    // There is work associated with compositing filters, even if there are zero filters,
+    // so if there are no filters, claim we can't composite them.
+    if (!filters.size())
+        return false;
+
+    for (unsigned i = 0; i < filters.size(); ++i) {
+        const FilterOperation* filterOperation = filters.at(i);
+        switch (filterOperation->getOperationType()) {
+        case FilterOperation::REFERENCE:
+#if ENABLE(CSS_SHADERS)
+        case FilterOperation::CUSTOM:
+#endif
+            return false;
+        default:
+            break;
+        }
+    }
+
+    return true;
+}
+#endif
+
 const LayerWebKitThread* LayerWebKitThread::rootLayer() const
 {
     const LayerWebKitThread* layer = this;
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.h b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.h
index 49a49be5f..564942da4 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.h
+++ b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.h
@@ -98,10 +98,17 @@ public:
 
     void setOpacity(float opacity) { m_opacity = opacity; setNeedsCommit(); }
 
+#if ENABLE(CSS_FILTERS)
+    void setFilters(const FilterOperations& filters) { m_filters = filters; m_filtersChanged = true; setNeedsCommit(); }
+    static bool filtersCanBeComposited(const FilterOperations& filters);
+#endif
+
     void setOpaque(bool isOpaque) { m_isOpaque = isOpaque; setNeedsCommit(); }
 
     void setPosition(const FloatPoint& position) { m_position = position; setNeedsCommit(); }
 
+    void setBoundsOrigin(const FloatPoint& boundsOrigin) { m_boundsOrigin = boundsOrigin; setNeedsCommit(); }
+
     const LayerWebKitThread* rootLayer() const;
 
     void removeAllSublayers();
@@ -202,6 +209,9 @@ private:
     unsigned m_isMask : 1;
     unsigned m_animationsChanged : 1;
     unsigned m_clearOverrideOnCommit : 1;
+#if ENABLE(CSS_FILTERS)
+    unsigned m_filtersChanged : 1;
+#endif
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.h b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
index 61f30500b..9c56d676f 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.h
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
@@ -45,6 +45,8 @@ class FloatRect;
 class IntPoint;
 class IntRect;
 
+typedef Vector<RetainPtr<WebTileLayer> > WebTileLayerList;
+
 class TileCache : public TiledBacking {
     WTF_MAKE_NONCOPYABLE(TileCache);
 
@@ -68,6 +70,11 @@ public:
     void setTileDebugBorderWidth(float);
     void setTileDebugBorderColor(CGColorRef);
 
+    IntRect visibleRect() const { return m_visibleRect; }
+
+    unsigned blankPixelCount() const;
+    static unsigned blankPixelCountForTiles(const WebTileLayerList&, IntRect, IntPoint);
+
 private:
     TileCache(WebTileCacheLayer*, const IntSize& tileSize);
 
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
index f79c63b29..67027979d 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
@@ -28,6 +28,7 @@
 
 #import "IntRect.h"
 #import "PlatformCALayer.h"
+#import "Region.h"
 #import "WebLayer.h"
 #import "WebTileCacheLayer.h"
 #import "WebTileLayer.h"
@@ -73,6 +74,11 @@ TileCache::TileCache(WebTileCacheLayer* tileCacheLayer, const IntSize& tileSize)
 TileCache::~TileCache()
 {
     ASSERT(isMainThread());
+
+    for (TileMap::iterator it = m_tiles.begin(), end = m_tiles.end(); it != end; ++it) {
+        WebTileLayer* tileLayer = it->second.get();
+        [tileLayer setTileCache:0];
+    }
 }
 
 void TileCache::tileCacheLayerBoundsChanged()
@@ -306,6 +312,34 @@ void TileCache::tileRevalidationTimerFired(Timer<TileCache>*)
     revalidateTiles();
 }
 
+unsigned TileCache::blankPixelCount() const
+{
+    WebTileLayerList tiles(m_tiles.size());
+    tiles.appendRange(m_tiles.begin().values(), m_tiles.end().values());
+
+    return blankPixelCountForTiles(tiles, m_visibleRect, IntPoint(0,0));
+}
+
+unsigned TileCache::blankPixelCountForTiles(const WebTileLayerList& tiles, IntRect visibleRect, IntPoint tileTranslation)
+{
+    Region paintedVisibleTiles;
+
+    for (WebTileLayerList::const_iterator it = tiles.begin(), end = tiles.end(); it != end; ++it) {
+        const WebTileLayer* tileLayer = it->get();
+
+        IntRect visiblePart(CGRectOffset([tileLayer frame], tileTranslation.x(), tileTranslation.y()));
+        visiblePart.intersect(visibleRect);
+
+        if (!visiblePart.isEmpty() && [tileLayer repaintCount])
+            paintedVisibleTiles.unite(visiblePart);
+    }
+
+    Region uncoveredRegion(visibleRect);
+    uncoveredRegion.subtract(paintedVisibleTiles);
+
+    return uncoveredRegion.totalArea();
+}
+
 void TileCache::revalidateTiles()
 {
     // If the underlying PlatformLayer has been destroyed, but the WebTileCacheLayer hasn't
diff --git a/Source/WebCore/platform/graphics/ca/mac/WebTileLayer.h b/Source/WebCore/platform/graphics/ca/mac/WebTileLayer.h
index 577e34a39..4a2d5c102 100644
--- a/Source/WebCore/platform/graphics/ca/mac/WebTileLayer.h
+++ b/Source/WebCore/platform/graphics/ca/mac/WebTileLayer.h
@@ -37,6 +37,7 @@ namespace WebCore {
 
 - (void)setTileCache:(WebCore::TileCache*)tileCache;
 - (unsigned)incrementRepaintCount;
+- (unsigned)repaintCount;
 @end
 
 
diff --git a/Source/WebCore/platform/graphics/ca/mac/WebTileLayer.mm b/Source/WebCore/platform/graphics/ca/mac/WebTileLayer.mm
index 6f7c85c08..2e2bb268b 100644
--- a/Source/WebCore/platform/graphics/ca/mac/WebTileLayer.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/WebTileLayer.mm
@@ -27,10 +27,15 @@
 #import "WebTileLayer.h"
 
 #import "TileCache.h"
+#import <wtf/CurrentTime.h>
 #import <wtf/UnusedParam.h>
 
 using namespace WebCore;
 
+@interface WebTileLayer (ScrollingPerformanceLoggingInternal)
+- (void)logFilledFreshTile;
+@end
+
 @implementation WebTileLayer
 
 - (id<CAAction>)actionForKey:(NSString *)key
@@ -43,8 +48,12 @@ using namespace WebCore;
 
 - (void)drawInContext:(CGContextRef)context
 {
-    if (_tileCache)
+    if (_tileCache) {
         _tileCache->drawLayer(self, context);
+
+        if (_tileCache->scrollingPerformanceLoggingEnabled())
+            [self logFilledFreshTile];
+    }
 }
 
 - (void)setTileCache:(WebCore::TileCache*)tileCache
@@ -57,5 +66,19 @@ using namespace WebCore;
     return ++_repaintCount;
 }
 
+- (unsigned)repaintCount
+{
+    return _repaintCount;
+}
+
+- (void)logFilledFreshTile
+{
+    IntRect visiblePart(enclosingIntRect([self frame]));
+    visiblePart.intersect(_tileCache->visibleRect());
+
+    if ([self repaintCount] == 1 && !visiblePart.isEmpty())
+        printf("SCROLLING: Filled visible fresh tile. Time: %f Unfilled Pixels: %u\n", WTF::monotonicallyIncreasingTime(), _tileCache->blankPixelCount());
+}
+
 @end
 
diff --git a/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp b/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp
index ad5388e0b..94bf970bd 100644
--- a/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp
+++ b/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp
@@ -78,6 +78,8 @@ void setPathOnCairoContext(cairo_t* to, cairo_t* from)
 
 void appendWebCorePathToCairoContext(cairo_t* context, const Path& path)
 {
+    if (path.isEmpty())
+        return;
     appendPathToCairoContext(context, path.platformPath()->context());
 }
 
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
index 62da1a16c..9822d4e24 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
@@ -33,6 +33,7 @@
 #include "Extensions3DOpenGL.h"
 #include "GraphicsContext3DPrivate.h"
 #include "Image.h"
+#include "ImageSource.h"
 #include "NotImplemented.h"
 #include "OpenGLShims.h"
 #include "PlatformContextCairo.h"
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index 74f0c3a60..203d8f3f7 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -481,7 +481,7 @@ void GraphicsContext::clipConvexPolygon(size_t numPoints, const FloatPoint* poin
 
 void GraphicsContext::fillPath(const Path& path)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || path.isEmpty())
         return;
 
     cairo_t* cr = platformContext()->cr();
@@ -491,7 +491,7 @@ void GraphicsContext::fillPath(const Path& path)
 
 void GraphicsContext::strokePath(const Path& path)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || path.isEmpty())
         return;
 
     cairo_t* cr = platformContext()->cr();
@@ -548,7 +548,8 @@ void GraphicsContext::clipPath(const Path& path, WindRule clipRule)
         return;
 
     cairo_t* cr = platformContext()->cr();
-    setPathOnCairoContext(cr, path.platformPath()->context());
+    if (!path.isNull())
+        setPathOnCairoContext(cr, path.platformPath()->context());
     cairo_set_fill_rule(cr, clipRule == RULE_EVENODD ? CAIRO_FILL_RULE_EVEN_ODD : CAIRO_FILL_RULE_WINDING);
     cairo_clip(cr);
 }
@@ -1017,8 +1018,11 @@ void GraphicsContext::clip(const Path& path)
         return;
 
     cairo_t* cr = platformContext()->cr();
-    OwnPtr<cairo_path_t> pathCopy = adoptPtr(cairo_copy_path(path.platformPath()->context()));
-    cairo_append_path(cr, pathCopy.get());
+    OwnPtr<cairo_path_t> pathCopy;
+    if (!path.isNull()) {
+        pathCopy = adoptPtr(cairo_copy_path(path.platformPath()->context()));
+        cairo_append_path(cr, pathCopy.get());
+    }
     cairo_fill_rule_t savedFillRule = cairo_get_fill_rule(cr);
     cairo_set_fill_rule(cr, CAIRO_FILL_RULE_WINDING);
     cairo_clip(cr);
diff --git a/Source/WebCore/platform/graphics/cairo/PathCairo.cpp b/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
index c2bfb05f6..2022777ba 100644
--- a/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
@@ -40,44 +40,66 @@
 namespace WebCore {
 
 Path::Path()
-    : m_path(new CairoPath())
+    : m_path(0)
 {
 }
 
 Path::~Path()
 {
-    delete m_path;
+    if (m_path)
+        delete m_path;
 }
 
 Path::Path(const Path& other)
-    : m_path(new CairoPath())
+    : m_path(0)
 {
-    cairo_t* cr = platformPath()->context();
+    if (other.isNull())
+        return;
+
+    cairo_t* cr = ensurePlatformPath()->context();
     OwnPtr<cairo_path_t> pathCopy = adoptPtr(cairo_copy_path(other.platformPath()->context()));
     cairo_append_path(cr, pathCopy.get());
 }
 
+PlatformPathPtr Path::ensurePlatformPath()
+{
+    if (!m_path)
+        m_path = new CairoPath();
+    return m_path;
+}
+
 Path& Path::operator=(const Path& other)
 {
     if (&other == this)
         return *this;
 
-    clear();
-    cairo_t* cr = platformPath()->context();
-    OwnPtr<cairo_path_t> pathCopy = adoptPtr(cairo_copy_path(other.platformPath()->context()));
-    cairo_append_path(cr, pathCopy.get());
+    if (other.isNull()) {
+        if (m_path) {
+            delete m_path;
+            m_path = 0;
+        }
+    } else {
+        clear();
+        cairo_t* cr = ensurePlatformPath()->context();
+        OwnPtr<cairo_path_t> pathCopy = adoptPtr(cairo_copy_path(other.platformPath()->context()));
+        cairo_append_path(cr, pathCopy.get());
+    }
+
     return *this;
 }
 
 void Path::clear()
 {
+    if (isNull())
+        return;
+
     cairo_t* cr = platformPath()->context();
     cairo_new_path(cr);
 }
 
 bool Path::isEmpty() const
 {
-    return !cairo_has_current_point(platformPath()->context());
+    return isNull() || !cairo_has_current_point(platformPath()->context());
 }
 
 bool Path::hasCurrentPoint() const
@@ -87,6 +109,9 @@ bool Path::hasCurrentPoint() const
 
 FloatPoint Path::currentPoint() const 
 {
+    if (isNull())
+        return FloatPoint();
+
     // FIXME: Is this the correct way?
     double x;
     double y;
@@ -96,25 +121,25 @@ FloatPoint Path::currentPoint() const
 
 void Path::translate(const FloatSize& p)
 {
-    cairo_t* cr = platformPath()->context();
+    cairo_t* cr = ensurePlatformPath()->context();
     cairo_translate(cr, -p.width(), -p.height());
 }
 
 void Path::moveTo(const FloatPoint& p)
 {
-    cairo_t* cr = platformPath()->context();
+    cairo_t* cr = ensurePlatformPath()->context();
     cairo_move_to(cr, p.x(), p.y());
 }
 
 void Path::addLineTo(const FloatPoint& p)
 {
-    cairo_t* cr = platformPath()->context();
+    cairo_t* cr = ensurePlatformPath()->context();
     cairo_line_to(cr, p.x(), p.y());
 }
 
 void Path::addRect(const FloatRect& rect)
 {
-    cairo_t* cr = platformPath()->context();
+    cairo_t* cr = ensurePlatformPath()->context();
     cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
 }
 
@@ -123,7 +148,7 @@ void Path::addRect(const FloatRect& rect)
  */
 void Path::addQuadCurveTo(const FloatPoint& controlPoint, const FloatPoint& point)
 {
-    cairo_t* cr = platformPath()->context();
+    cairo_t* cr = ensurePlatformPath()->context();
     double x, y;
     double x1 = controlPoint.x();
     double y1 = controlPoint.y();
@@ -138,7 +163,7 @@ void Path::addQuadCurveTo(const FloatPoint& controlPoint, const FloatPoint& poin
 
 void Path::addBezierCurveTo(const FloatPoint& controlPoint1, const FloatPoint& controlPoint2, const FloatPoint& controlPoint3)
 {
-    cairo_t* cr = platformPath()->context();
+    cairo_t* cr = ensurePlatformPath()->context();
     cairo_curve_to(cr, controlPoint1.x(), controlPoint1.y(),
                    controlPoint2.x(), controlPoint2.y(),
                    controlPoint3.x(), controlPoint3.y());
@@ -151,7 +176,7 @@ void Path::addArc(const FloatPoint& p, float r, float startAngle, float endAngle
     if (!isfinite(r) || !isfinite(startAngle) || !isfinite(endAngle))
         return;
 
-    cairo_t* cr = platformPath()->context();
+    cairo_t* cr = ensurePlatformPath()->context();
     float sweep = endAngle - startAngle;
     const float twoPI = 2 * piFloat;
     if ((sweep <= -twoPI || sweep >= twoPI)
@@ -177,6 +202,7 @@ static inline float areaOfTriangleFormedByPoints(const FloatPoint& p1, const Flo
 
 void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
 {
+    // FIXME: Why do we return if the path is empty? Can't a path start with an arc?
     if (isEmpty())
         return;
 
@@ -257,7 +283,7 @@ void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
 
 void Path::addEllipse(const FloatRect& rect)
 {
-    cairo_t* cr = platformPath()->context();
+    cairo_t* cr = ensurePlatformPath()->context();
     cairo_save(cr);
     float yRadius = .5 * rect.height();
     float xRadius = .5 * rect.width();
@@ -269,12 +295,16 @@ void Path::addEllipse(const FloatRect& rect)
 
 void Path::closeSubpath()
 {
-    cairo_t* cr = platformPath()->context();
+    cairo_t* cr = ensurePlatformPath()->context();
     cairo_close_path(cr);
 }
 
 FloatRect Path::boundingRect() const
 {
+    // Should this be isEmpty() or can an empty path have a non-zero origin?
+    if (isNull())
+        return FloatRect();
+
     cairo_t* cr = platformPath()->context();
     double x0, x1, y0, y1;
     cairo_path_extents(cr, &x0, &y0, &x1, &y1);
@@ -283,6 +313,10 @@ FloatRect Path::boundingRect() const
 
 FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
+    // Should this be isEmpty() or can an empty path have a non-zero origin?
+    if (isNull())
+        return FloatRect();
+
     cairo_t* cr = platformPath()->context();
     if (applier) {
         GraphicsContext gc(cr);
@@ -296,7 +330,7 @@ FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 
 bool Path::contains(const FloatPoint& point, WindRule rule) const
 {
-    if (!isfinite(point.x()) || !isfinite(point.y()))
+    if (isNull() || !isfinite(point.x()) || !isfinite(point.y()))
         return false;
     cairo_t* cr = platformPath()->context();
     cairo_fill_rule_t cur = cairo_get_fill_rule(cr);
@@ -308,6 +342,9 @@ bool Path::contains(const FloatPoint& point, WindRule rule) const
 
 bool Path::strokeContains(StrokeStyleApplier* applier, const FloatPoint& point) const
 {
+    if (isNull())
+        return false;
+
     ASSERT(applier);
     cairo_t* cr = platformPath()->context();
     GraphicsContext gc(cr);
@@ -318,6 +355,9 @@ bool Path::strokeContains(StrokeStyleApplier* applier, const FloatPoint& point)
 
 void Path::apply(void* info, PathApplierFunction function) const
 {
+    if (isNull())
+        return;
+
     cairo_t* cr = platformPath()->context();
     OwnPtr<cairo_path_t> pathCopy = adoptPtr(cairo_copy_path(cr));
     cairo_path_data_t* data;
@@ -355,7 +395,7 @@ void Path::apply(void* info, PathApplierFunction function) const
 
 void Path::transform(const AffineTransform& trans)
 {
-    cairo_t* cr = platformPath()->context();
+    cairo_t* cr = ensurePlatformPath()->context();
     cairo_matrix_t c_matrix = cairo_matrix_t(trans);
     cairo_matrix_invert(&c_matrix);
     cairo_transform(cr, &c_matrix);
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index 4d781a94c..befadb940 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -732,7 +732,7 @@ static inline bool calculateDrawingMode(const GraphicsContextState& state, CGPat
 
 void GraphicsContext::drawPath(const Path& path)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || path.isEmpty())
         return;
 
     CGContextRef context = platformContext();
@@ -769,7 +769,7 @@ static inline void fillPathWithFillRule(CGContextRef context, WindRule fillRule)
 
 void GraphicsContext::fillPath(const Path& path)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || path.isEmpty())
         return;
 
     CGContextRef context = platformContext();
@@ -824,7 +824,7 @@ void GraphicsContext::fillPath(const Path& path)
 
 void GraphicsContext::strokePath(const Path& path)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || path.isEmpty())
         return;
 
     CGContextRef context = platformContext();
@@ -1085,6 +1085,8 @@ void GraphicsContext::clipPath(const Path& path, WindRule clipRule)
     if (paintingDisabled())
         return;
 
+    // Why does clipping to an empty path do nothing?
+    // Why is this different from GraphicsContext::clip(const Path&).
     if (path.isEmpty())
         return;
 
@@ -1362,7 +1364,8 @@ void GraphicsContext::clipOut(const Path& path)
 
     CGContextBeginPath(platformContext());
     CGContextAddRect(platformContext(), CGContextGetClipBoundingBox(platformContext()));
-    CGContextAddPath(platformContext(), path.platformPath());
+    if (!path.isEmpty())
+        CGContextAddPath(platformContext(), path.platformPath());
     CGContextEOClip(platformContext());
 }
 
diff --git a/Source/WebCore/platform/graphics/cg/ImageCG.cpp b/Source/WebCore/platform/graphics/cg/ImageCG.cpp
index 2c0cca22b..88adabfbf 100644
--- a/Source/WebCore/platform/graphics/cg/ImageCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageCG.cpp
@@ -77,6 +77,7 @@ BitmapImage::BitmapImage(CGImageRef cgImage, ImageObserver* observer)
     , m_repetitionCountStatus(Unknown)
     , m_repetitionsComplete(0)
     , m_decodedSize(0)
+    , m_decodedPropertiesSize(0)
     , m_frameCount(1)
     , m_isSolidColor(false)
     , m_checkedForSolidColor(false)
diff --git a/Source/WebCore/platform/graphics/cg/PathCG.cpp b/Source/WebCore/platform/graphics/cg/PathCG.cpp
index e7dee39d3..b150c57c5 100644
--- a/Source/WebCore/platform/graphics/cg/PathCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/PathCG.cpp
@@ -74,24 +74,33 @@ static inline CGContextRef scratchContext()
 }
 
 Path::Path()
-    : m_path(CGPathCreateMutable())
+    : m_path(0)
 {
 }
 
 Path::~Path()
 {
-    CGPathRelease(m_path);
+    if (m_path)
+        CGPathRelease(m_path);
+}
+
+PlatformPathPtr Path::ensurePlatformPath()
+{
+    if (!m_path)
+        m_path = CGPathCreateMutable();
+    return m_path;
 }
 
 Path::Path(const Path& other)
-    : m_path(CGPathCreateMutableCopy(other.m_path))
 {
+    m_path = other.m_path ? CGPathCreateMutableCopy(other.m_path) : 0;
 }
 
 Path& Path::operator=(const Path& other)
 {
-    CGMutablePathRef path = CGPathCreateMutableCopy(other.m_path);
-    CGPathRelease(m_path);
+    CGMutablePathRef path = other.m_path ? CGPathCreateMutableCopy(other.m_path) : 0;
+    if (m_path)
+        CGPathRelease(m_path);
     m_path = path;
     return *this;
 }
@@ -132,6 +141,9 @@ static CGMutablePathRef copyCGPathClosingSubpaths(CGPathRef originalPath)
 
 bool Path::contains(const FloatPoint &point, WindRule rule) const
 {
+    if (isNull())
+        return false;
+
     if (!fastBoundingRect().contains(point))
         return false;
 
@@ -143,6 +155,9 @@ bool Path::contains(const FloatPoint &point, WindRule rule) const
 
 bool Path::strokeContains(StrokeStyleApplier* applier, const FloatPoint& point) const
 {
+    if (isNull())
+        return false;
+
     ASSERT(applier);
 
     CGContextRef context = scratchContext();
@@ -164,13 +179,17 @@ void Path::translate(const FloatSize& size)
 {
     CGAffineTransform translation = CGAffineTransformMake(1, 0, 0, 1, size.width(), size.height());
     CGMutablePathRef newPath = CGPathCreateMutable();
-    CGPathAddPath(newPath, &translation, m_path);
+    // FIXME: This is potentially wasteful to allocate an empty path only to create a transformed copy.
+    CGPathAddPath(newPath, &translation, ensurePlatformPath());
     CGPathRelease(m_path);
     m_path = newPath;
 }
 
 FloatRect Path::boundingRect() const
 {
+    if (isNull())
+        return CGRectZero;
+
     // CGPathGetBoundingBox includes the path's control points, CGPathGetPathBoundingBox
     // does not, but only exists on 10.6 and above.
 
@@ -185,12 +204,17 @@ FloatRect Path::boundingRect() const
 
 FloatRect Path::fastBoundingRect() const
 {
+    if (isNull())
+        return CGRectZero;
     CGRect bound = CGPathGetBoundingBox(m_path);
     return CGRectIsNull(bound) ? CGRectZero : bound;
 }
 
 FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
+    if (isNull())
+        return CGRectZero;
+
     CGContextRef context = scratchContext();
 
     CGContextSaveGState(context);
@@ -211,27 +235,27 @@ FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 
 void Path::moveTo(const FloatPoint& point)
 {
-    CGPathMoveToPoint(m_path, 0, point.x(), point.y());
+    CGPathMoveToPoint(ensurePlatformPath(), 0, point.x(), point.y());
 }
 
 void Path::addLineTo(const FloatPoint& p)
 {
-    CGPathAddLineToPoint(m_path, 0, p.x(), p.y());
+    CGPathAddLineToPoint(ensurePlatformPath(), 0, p.x(), p.y());
 }
 
 void Path::addQuadCurveTo(const FloatPoint& cp, const FloatPoint& p)
 {
-    CGPathAddQuadCurveToPoint(m_path, 0, cp.x(), cp.y(), p.x(), p.y());
+    CGPathAddQuadCurveToPoint(ensurePlatformPath(), 0, cp.x(), cp.y(), p.x(), p.y());
 }
 
 void Path::addBezierCurveTo(const FloatPoint& cp1, const FloatPoint& cp2, const FloatPoint& p)
 {
-    CGPathAddCurveToPoint(m_path, 0, cp1.x(), cp1.y(), cp2.x(), cp2.y(), p.x(), p.y());
+    CGPathAddCurveToPoint(ensurePlatformPath(), 0, cp1.x(), cp1.y(), cp2.x(), cp2.y(), p.x(), p.y());
 }
 
 void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
 {
-    CGPathAddArcToPoint(m_path, 0, p1.x(), p1.y(), p2.x(), p2.y(), radius);
+    CGPathAddArcToPoint(ensurePlatformPath(), 0, p1.x(), p1.y(), p2.x(), p2.y(), radius);
 }
 
 void Path::platformAddPathForRoundedRect(const FloatRect& rect, const FloatSize& topLeftRadius, const FloatSize& topRightRadius, const FloatSize& bottomLeftRadius, const FloatSize& bottomRightRadius)
@@ -241,7 +265,7 @@ void Path::platformAddPathForRoundedRect(const FloatRect& rect, const FloatSize&
     bool equalHeights = (topLeftRadius.height() == bottomLeftRadius.height() && bottomLeftRadius.height() == topRightRadius.height() && topRightRadius.height() == bottomRightRadius.height());
 
     if (equalWidths && equalHeights) {
-        wkCGPathAddRoundedRect(m_path, 0, rect, topLeftRadius.width(), topLeftRadius.height());
+        wkCGPathAddRoundedRect(ensurePlatformPath(), 0, rect, topLeftRadius.width(), topLeftRadius.height());
         return;
     }
 #endif
@@ -251,6 +275,10 @@ void Path::platformAddPathForRoundedRect(const FloatRect& rect, const FloatSize&
 
 void Path::closeSubpath()
 {
+    // FIXME: Unclear if close commands should have meaning for a null path.
+    if (isNull())
+        return;
+
     CGPathCloseSubpath(m_path);
 }
 
@@ -258,28 +286,31 @@ void Path::addArc(const FloatPoint& p, float r, float sa, float ea, bool clockwi
 {
     // Workaround for <rdar://problem/5189233> CGPathAddArc hangs or crashes when passed inf as start or end angle
     if (isfinite(sa) && isfinite(ea))
-        CGPathAddArc(m_path, 0, p.x(), p.y(), r, sa, ea, clockwise);
+        CGPathAddArc(ensurePlatformPath(), 0, p.x(), p.y(), r, sa, ea, clockwise);
 }
 
 void Path::addRect(const FloatRect& r)
 {
-    CGPathAddRect(m_path, 0, r);
+    CGPathAddRect(ensurePlatformPath(), 0, r);
 }
 
 void Path::addEllipse(const FloatRect& r)
 {
-    CGPathAddEllipseInRect(m_path, 0, r);
+    CGPathAddEllipseInRect(ensurePlatformPath(), 0, r);
 }
 
 void Path::clear()
 {
+    if (isNull())
+        return;
+
     CGPathRelease(m_path);
     m_path = CGPathCreateMutable();
 }
 
 bool Path::isEmpty() const
 {
-    return CGPathIsEmpty(m_path);
+    return isNull() || CGPathIsEmpty(m_path);
 }
 
 bool Path::hasCurrentPoint() const
@@ -289,6 +320,8 @@ bool Path::hasCurrentPoint() const
     
 FloatPoint Path::currentPoint() const 
 {
+    if (isNull())
+        return FloatPoint();
     return CGPathGetCurrentPoint(m_path);
 }
 
@@ -330,6 +363,9 @@ static void CGPathApplierToPathApplier(void *info, const CGPathElement *element)
 
 void Path::apply(void* info, PathApplierFunction function) const
 {
+    if (isNull())
+        return;
+
     PathApplierInfo pinfo;
     pinfo.info = info;
     pinfo.function = function;
diff --git a/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.cpp b/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.cpp
index 69e632b71..f93695e04 100644
--- a/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.cpp
+++ b/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.cpp
@@ -40,9 +40,10 @@
 #include "TransformOperations.h"
 #include "TranslateTransformOperation.h"
 
-#include "cc/CCActiveAnimation.h"
-#include "cc/CCKeyframedAnimationCurve.h"
-
+#include <public/WebAnimation.h>
+#include <public/WebAnimationCurve.h>
+#include <public/WebFloatAnimationCurve.h>
+#include <public/WebTransformAnimationCurve.h>
 #include <public/WebTransformOperations.h>
 #include <public/WebTransformationMatrix.h>
 
@@ -122,9 +123,16 @@ WebTransformOperations toWebTransformOperations(const TransformOperations& trans
 }
 
 template <class Value, class Keyframe, class Curve>
-bool appendKeyframe(Curve& curve, double keyTime, const Value* value, const Value* lastValue, PassOwnPtr<CCTimingFunction> timingFunction, const FloatSize&)
+bool appendKeyframeWithStandardTimingFunction(Curve& curve, double keyTime, const Value* value, const Value* lastValue, WebKit::WebAnimationCurve::TimingFunctionType timingFunctionType, const FloatSize&)
 {
-    curve.addKeyframe(Keyframe::create(keyTime, value->value(), timingFunction));
+    curve.add(Keyframe(keyTime, value->value()), timingFunctionType);
+    return true;
+}
+
+template <class Value, class Keyframe, class Curve>
+bool appendKeyframeWithCustomBezierTimingFunction(Curve& curve, double keyTime, const Value* value, const Value* lastValue, double x1, double y1, double x2, double y2, const FloatSize&)
+{
+    curve.add(Keyframe(keyTime, value->value()), x1, y1, x2, y2);
     return true;
 }
 
@@ -165,21 +173,35 @@ bool causesRotationOfAtLeast180Degrees(const TransformAnimationValue* value, con
 }
 
 template <>
-bool appendKeyframe<TransformAnimationValue, CCTransformKeyframe, CCKeyframedTransformAnimationCurve>(CCKeyframedTransformAnimationCurve& curve, double keyTime, const TransformAnimationValue* value, const TransformAnimationValue* lastValue, PassOwnPtr<CCTimingFunction> timingFunction, const FloatSize& boxSize)
+bool appendKeyframeWithStandardTimingFunction<TransformAnimationValue, WebTransformKeyframe, WebTransformAnimationCurve>(WebTransformAnimationCurve& curve, double keyTime, const TransformAnimationValue* value, const TransformAnimationValue* lastValue, WebKit::WebAnimationCurve::TimingFunctionType timingFunctionType, const FloatSize& boxSize)
 {
     if (causesRotationOfAtLeast180Degrees(value, lastValue))
         return false;
 
     WebTransformOperations operations = toWebTransformOperations(*value->value(), boxSize);
     if (operations.apply().isInvertible()) {
-        curve.addKeyframe(CCTransformKeyframe::create(keyTime, operations, timingFunction));
+        curve.add(WebTransformKeyframe(keyTime, operations), timingFunctionType);
+        return true;
+    }
+    return false;
+}
+
+template <>
+bool appendKeyframeWithCustomBezierTimingFunction<TransformAnimationValue, WebTransformKeyframe, WebTransformAnimationCurve>(WebTransformAnimationCurve& curve, double keyTime, const TransformAnimationValue* value, const TransformAnimationValue* lastValue, double x1, double y1, double x2, double y2, const FloatSize& boxSize)
+{
+    if (causesRotationOfAtLeast180Degrees(value, lastValue))
+        return false;
+
+    WebTransformOperations operations = toWebTransformOperations(*value->value(), boxSize);
+    if (operations.apply().isInvertible()) {
+        curve.add(WebTransformKeyframe(keyTime, operations), x1, y1, x2, y2);
         return true;
     }
     return false;
 }
 
 template <class Value, class Keyframe, class Curve>
-PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& valueList, const Animation* animation, size_t animationId, size_t groupId, double timeOffset, CCActiveAnimation::TargetProperty targetProperty, const FloatSize& boxSize)
+PassOwnPtr<WebKit::WebAnimation> createWebAnimation(const KeyframeValueList& valueList, const Animation* animation, size_t animationId, size_t groupId, double timeOffset, WebKit::WebAnimation::TargetProperty targetProperty, const FloatSize& boxSize)
 {
     bool alternate = false;
     bool reverse = false;
@@ -191,18 +213,15 @@ PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& val
             reverse = true;
     }
 
-    OwnPtr<Curve> curve = Curve::create();
-    Vector<Keyframe> keyframes;
+    Curve curve;
 
     for (size_t i = 0; i < valueList.size(); i++) {
         size_t index = reverse ? valueList.size() - i - 1 : i;
-
         const Value* originalValue = static_cast<const Value*>(valueList.at(index));
         const Value* lastOriginalValue = 0;
         if (valueList.size() > 1 && ((reverse && index + 1 < valueList.size()) || (!reverse && index > 0)))
             lastOriginalValue = static_cast<const Value*>(valueList.at(reverse ? index + 1 : index - 1));
 
-        OwnPtr<CCTimingFunction> timingFunction;
         const TimingFunction* originalTimingFunction = originalValue->timingFunction();
 
         // If there hasn't been a timing function associated with this keyframe, use the
@@ -210,21 +229,33 @@ PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& val
         if (!originalTimingFunction && animation->isTimingFunctionSet())
             originalTimingFunction = animation->timingFunction().get();
 
+        // Ease is the default timing function.
+        WebKit::WebAnimationCurve::TimingFunctionType timingFunctionType = WebKit::WebAnimationCurve::TimingFunctionTypeEase;
+
+        bool isUsingCustomBezierTimingFunction = false;
+        double x1 = 0;
+        double y1 = 0;
+        double x2 = 1;
+        double y2 = 1;
+
         if (originalTimingFunction) {
             switch (originalTimingFunction->type()) {
             case TimingFunction::StepsFunction:
                 // FIXME: add support for steps timing function.
                 return nullptr;
             case TimingFunction::LinearFunction:
-                // Don't set the timing function. Keyframes are interpolated linearly if there is no timing function.
+                timingFunctionType = WebKit::WebAnimationCurve::TimingFunctionTypeLinear;
                 break;
             case TimingFunction::CubicBezierFunction:
                 const CubicBezierTimingFunction* originalBezierTimingFunction = static_cast<const CubicBezierTimingFunction*>(originalTimingFunction);
-                timingFunction = CCCubicBezierTimingFunction::create(originalBezierTimingFunction->x1(), originalBezierTimingFunction->y1(), originalBezierTimingFunction->x2(), originalBezierTimingFunction->y2());
+                isUsingCustomBezierTimingFunction = true;
+                x1 = originalBezierTimingFunction->x1();
+                y1 = originalBezierTimingFunction->y1();
+                x2 = originalBezierTimingFunction->x2();
+                y2 = originalBezierTimingFunction->y2();
                 break;
             } // switch
-        } else
-            timingFunction = CCEaseTimingFunction::create();
+        }
 
         double duration = (animation && animation->isDurationSet()) ? animation->duration() : 1;
         double keyTime = originalValue->keyTime() * duration;
@@ -232,24 +263,20 @@ PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& val
         if (reverse)
             keyTime = duration - keyTime;
 
-        bool addedKeyframe = appendKeyframe<Value, Keyframe, Curve>(*curve, keyTime, originalValue, lastOriginalValue, timingFunction.release(), boxSize);
+        bool addedKeyframe = false;
+        if (isUsingCustomBezierTimingFunction)
+            addedKeyframe = appendKeyframeWithCustomBezierTimingFunction<Value, Keyframe, Curve>(curve, keyTime, originalValue, lastOriginalValue, x1, y1, x2, y2, boxSize);
+        else
+            addedKeyframe = appendKeyframeWithStandardTimingFunction<Value, Keyframe, Curve>(curve, keyTime, originalValue, lastOriginalValue, timingFunctionType, boxSize);
         if (!addedKeyframe)
             return nullptr;
     }
 
-    OwnPtr<CCActiveAnimation> anim = CCActiveAnimation::create(curve.release(), animationId, groupId, targetProperty);
-
-    ASSERT(anim.get());
-
-    if (anim.get()) {
-        int iterations = (animation && animation->isIterationCountSet()) ? animation->iterationCount() : 1;
-        anim->setIterations(iterations);
-        anim->setAlternatesDirection(alternate);
-    }
+    OwnPtr<WebKit::WebAnimation> anim(adoptPtr(new WebKit::WebAnimation(curve, animationId, groupId, targetProperty)));
 
-    // In order to avoid skew, the main thread animation cannot tick until it has received the start time of
-    // the corresponding impl thread animation.
-    anim->setNeedsSynchronizedStartTime(true);
+    int iterations = (animation && animation->isIterationCountSet()) ? animation->iterationCount() : 1;
+    anim->setIterations(iterations);
+    anim->setAlternatesDirection(alternate);
 
     // If timeOffset > 0, then the animation has started in the past.
     anim->setTimeOffset(timeOffset);
@@ -257,13 +284,13 @@ PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& val
     return anim.release();
 }
 
-PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& values, const Animation* animation, size_t animationId, size_t groupId, double timeOffset, const FloatSize& boxSize)
+PassOwnPtr<WebKit::WebAnimation> createWebAnimation(const KeyframeValueList& values, const Animation* animation, size_t animationId, size_t groupId, double timeOffset, const FloatSize& boxSize)
 {
     if (values.property() == AnimatedPropertyWebkitTransform)
-        return createActiveAnimation<TransformAnimationValue, CCTransformKeyframe, CCKeyframedTransformAnimationCurve>(values, animation, animationId, groupId, timeOffset, CCActiveAnimation::Transform, FloatSize(boxSize));
+        return createWebAnimation<TransformAnimationValue, WebTransformKeyframe, WebTransformAnimationCurve>(values, animation, animationId, groupId, timeOffset, WebKit::WebAnimation::TargetPropertyTransform, FloatSize(boxSize));
 
     if (values.property() == AnimatedPropertyOpacity)
-        return createActiveAnimation<FloatAnimationValue, CCFloatKeyframe, CCKeyframedFloatAnimationCurve>(values, animation, animationId, groupId, timeOffset, CCActiveAnimation::Opacity, FloatSize());
+        return createWebAnimation<FloatAnimationValue, WebFloatKeyframe, WebFloatAnimationCurve>(values, animation, animationId, groupId, timeOffset, WebKit::WebAnimation::TargetPropertyOpacity, FloatSize());
 
     return nullptr;
 }
diff --git a/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.h b/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.h
index 6fe1a873d..5d88a2ed8 100644
--- a/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.h
+++ b/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.h
@@ -33,19 +33,23 @@
 
 #include <wtf/PassOwnPtr.h>
 
+namespace WebKit {
+class WebAnimation;
+}
+
 namespace WebCore {
 
 class KeyframeValueList;
 class Animation;
 class FloatSize;
-class CCActiveAnimation;
 
-// Translates WebCore animation data into a CCActiveAnimation. If we are unable
+
+// Translates WebCore animation data into a WebAnimation. If we are unable
 // to perform this translation, we return nullptr. This can happen if
 //   - a steps timing function is used,
 //   - a property other than AnimatedPropertyWebkitTransform, or AnimatedPropertyOpacity is animated, or
 //   - a transform animation involves a non-invertable transform.
-PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList&, const Animation*, size_t animationId, size_t groupId, double timeOffset, const FloatSize& boxSize);
+PassOwnPtr<WebKit::WebAnimation> createWebAnimation(const KeyframeValueList&, const Animation*, size_t animationId, size_t groupId, double timeOffset, const FloatSize& boxSize);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp
index c7f95346d..c92ce061d 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp
@@ -32,7 +32,6 @@
 
 #include "LayerPainterChromium.h"
 #include "PlatformColor.h"
-#include "PlatformContextSkia.h"
 #include "skia/ext/platform_canvas.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h
index a2e6d45cb..8450e1f35 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h
@@ -58,8 +58,8 @@ public:
     static PassRefPtr<BitmapCanvasLayerTextureUpdater> create(PassOwnPtr<LayerPainterChromium>);
     virtual ~BitmapCanvasLayerTextureUpdater();
 
-    virtual PassOwnPtr<LayerTextureUpdater::Texture> createTexture(CCPrioritizedTextureManager*);
-    virtual SampledTexelFormat sampledTexelFormat(GC3Denum textureFormat);
+    virtual PassOwnPtr<LayerTextureUpdater::Texture> createTexture(CCPrioritizedTextureManager*) OVERRIDE;
+    virtual SampledTexelFormat sampledTexelFormat(GC3Denum textureFormat) OVERRIDE;
     virtual void prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsWidthScale, float contentsHeightScale, IntRect& resultingOpaqueRect, CCRenderingStats&) OVERRIDE;
     void updateTextureRect(CCResourceProvider*, CCPrioritizedTexture*, const IntRect& sourceRect, const IntRect& destRect);
 
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp
index 200c80a47..821e8ec8a 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp
@@ -34,7 +34,7 @@
 #include "SkCanvas.h"
 #include "SkDeferredCanvas.h"
 #include "TraceEvent.h"
-#include "cc/CCProxy.h"
+#include <public/WebCompositor.h>
 #include <public/WebGraphicsContext3D.h>
 
 using WebKit::WebExternalTextureLayer;
@@ -74,7 +74,7 @@ Canvas2DLayerBridge::Canvas2DLayerBridge(PassRefPtr<GraphicsContext3D> context,
     // deferred. What we should be doing is to use a smarter heuristic based
     // on GPU resource monitoring and other factors to chose between single
     // and double buffering.
-    , m_useDoubleBuffering(CCProxy::hasImplThread() && deferralMode == NonDeferred)
+    , m_useDoubleBuffering(WebKit::WebCompositor::threadingEnabled() && deferralMode == NonDeferred)
     , m_frontBufferTexture(0)
     , m_backBufferTexture(textureId)
     , m_size(size)
@@ -98,7 +98,7 @@ Canvas2DLayerBridge::Canvas2DLayerBridge(PassRefPtr<GraphicsContext3D> context,
 
     m_layer = WebExternalTextureLayer::create(this);
     m_layer.setTextureId(textureId);
-    m_layer.setRateLimitContext(!CCProxy::hasImplThread() || m_useDoubleBuffering);
+    m_layer.setRateLimitContext(!WebKit::WebCompositor::threadingEnabled() || m_useDoubleBuffering);
 }
 
 
@@ -155,9 +155,9 @@ WebGraphicsContext3D* Canvas2DLayerBridge::context()
     return GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_context.get());
 }
 
-LayerChromium* Canvas2DLayerBridge::layer() const
+WebKit::WebLayer* Canvas2DLayerBridge::layer()
 {
-    return m_layer.unwrap<LayerChromium>();
+    return &m_layer;
 }
 
 void Canvas2DLayerBridge::contextAcquired()
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h
index b207a2b3c..08f401ce0 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h
@@ -60,7 +60,7 @@ public:
     virtual WebKit::WebGraphicsContext3D* context() OVERRIDE;
 
     SkCanvas* skCanvas(SkDevice*);
-    LayerChromium* layer() const;
+    WebKit::WebLayer* layer();
     void contextAcquired();
 
     unsigned backBufferTexture();
diff --git a/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.cpp
index 3f9ee36aa..b5c651c7b 100644
--- a/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.cpp
@@ -70,8 +70,9 @@ void CanvasLayerTextureUpdater::paintContents(SkCanvas* canvas, const IntRect& c
     SkPaint paint;
     paint.setAntiAlias(false);
     paint.setXfermodeMode(SkXfermode::kClear_Mode);
-    canvas->drawRect(layerRect, paint);
-    canvas->clipRect(layerRect);
+    SkRect layerSkRect = SkRect::MakeXYWH(layerRect.x(), layerRect.y(), layerRect.width(), layerRect.height());
+    canvas->drawRect(layerSkRect, paint);
+    canvas->clipRect(layerSkRect);
 
     FloatRect opaqueLayerRect;
     double paintBeginTime = monotonicallyIncreasingTime();
diff --git a/Source/WebCore/platform/graphics/chromium/CompositorHUDFontAtlas.cpp b/Source/WebCore/platform/graphics/chromium/CompositorHUDFontAtlas.cpp
new file mode 100644
index 000000000..b53c12922
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/CompositorHUDFontAtlas.cpp
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "CompositorHUDFontAtlas.h"
+
+#include "Font.h"
+#include "FontCache.h"
+#include "FontDescription.h"
+#include "GraphicsContext.h"
+#include "PlatformContextSkia.h"
+#include "SkCanvas.h"
+#include "SkDevice.h"
+#include "TextRun.h"
+#include "skia/ext/platform_canvas.h"
+
+using WebKit::WebRect;
+
+namespace WebCore {
+
+#define ATLAS_SIZE 128
+
+static void wrapPositionIfNeeded(IntPoint& position, int textWidth, int textHeight)
+{
+    if (position.x() + textWidth > ATLAS_SIZE)
+        position = IntPoint(0, position.y() + textHeight);
+}
+
+// Paints the font into the atlas, from left-to-right, top-to-bottom, starting at
+// startingPosition. At the same time, it updates the ascii-to-WebRect mapping for
+// each character. By doing things this way, it is possible to support variable-width
+// fonts and multiple fonts on the same atlas.
+SkBitmap CompositorHUDFontAtlas::generateFontAtlas(WebRect asciiToRectTable[128], int& fontHeight)
+{
+    fontHeight = 14;
+
+    OwnPtr<SkCanvas> canvas = adoptPtr(skia::CreateBitmapCanvas(ATLAS_SIZE, ATLAS_SIZE, false /* opaque */));
+
+    PlatformContextSkia platformContext(canvas.get());
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext atlasContext(&platformContext);
+
+    // Clear the entire texture atlas to transparent before drawing fonts.
+    atlasContext.setFillColor(Color(0, 0, 0, 0), ColorSpaceDeviceRGB);
+    atlasContext.fillRect(FloatRect(0, 0, ATLAS_SIZE, ATLAS_SIZE));
+
+    // FIXME: monospace font does not work as expected.
+    FontDescription fontDescription;
+    fontDescription.setGenericFamily(FontDescription::MonospaceFamily);
+    fontDescription.setComputedSize(fontHeight);
+
+    FontCachePurgePreventer fontCachePurgePreventer;
+
+    int textHeight = fontDescription.computedPixelSize();
+    IntPoint position(0, textHeight);
+    // This is a dirty little trick to account for overhang letters like g, p, j.
+    int inflation = textHeight / 3;
+
+    Font font(fontDescription, 0, 0);
+    font.update(0);
+
+    Color fontColor(255, 0, 0);
+    atlasContext.setStrokeColor(fontColor, ColorSpaceDeviceRGB);
+    atlasContext.setFillColor(fontColor, ColorSpaceDeviceRGB);
+
+    // First, draw a generic rect that will be used for special and unknown characters that have nothing else to render.
+    {
+        int textWidth = textHeight / 2;
+        wrapPositionIfNeeded(position, textWidth, textHeight + inflation);
+        atlasContext.strokeRect(FloatRect(FloatPoint(position.x() + 1, position.y() - textHeight + 1 + inflation), FloatSize(textWidth - 2, textHeight - 2 - inflation)), 1);
+
+        // Initialize the rect that would be copied when drawing this glyph from the atlas.
+        asciiToRectTable[0] = WebRect(position.x(), position.y() - textHeight, textWidth, textHeight + inflation);
+
+        // Increment to the position where the next glyph will be placed.
+        position.setX(position.x() + textWidth);
+    }
+
+    // Then, draw the ASCII characters.
+    for (LChar i = 1; i < 128; ++i) {
+        if (i < 32) {
+            // Special characters will simply use the the default glyph.
+            asciiToRectTable[i] = asciiToRectTable[0];
+            continue;
+        }
+
+        String str;
+        str.append(i);
+        TextRun text(str);
+
+        int textWidth = round(font.width(text));
+        wrapPositionIfNeeded(position, textWidth, textHeight + inflation);
+        atlasContext.drawText(font, text, position);
+
+        // Initialize the rect that would be copied when drawing this glyph from the atlas.
+        asciiToRectTable[i] = WebRect(position.x(), position.y() - textHeight, textWidth, textHeight + inflation);
+
+        // Increment to the position where the next glyph will be placed.
+        position.setX(position.x() + textWidth);
+    }
+
+    SkBitmap copy;
+    const SkBitmap& source = canvas->getDevice()->accessBitmap(false);
+    source.copyTo(&copy, source.config());
+    return copy;
+}
+
+} // namespace WebCore
diff --git a/Source/WebKit/chromium/public/platform/WebContentLayer.h b/Source/WebCore/platform/graphics/chromium/CompositorHUDFontAtlas.h
index 90a16ed91..91bab5d62 100644
--- a/Source/WebKit/chromium/public/platform/WebContentLayer.h
+++ b/Source/WebCore/platform/graphics/chromium/CompositorHUDFontAtlas.h
@@ -23,4 +23,23 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "../../../../Platform/chromium/public/WebContentLayer.h"
+#ifndef CompositorHUDFontAtlas_h
+#define CompositorHUDFontAtlas_h
+
+#include "SkBitmap.h"
+#include <public/WebRect.h>
+
+namespace WebCore {
+
+class CompositorHUDFontAtlas {
+public:
+    // This is a helper function that can generate a font atlas suitable for the compositor's heads up display.
+    // Returns a bitmap containing glyphs and populates asciiToRectTable with the
+    // location of each glyph.
+    static SkBitmap generateFontAtlas(WebKit::WebRect asciiToRectTable[128], int& fontHeight);
+};
+
+} // namespace WebCore
+
+#endif // CompositorHUDFontAtlas_h
+
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index 03d343e80..1f9ad216e 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -93,7 +93,7 @@ void ContentLayerChromium::setTexturePriorities(const CCPriorityCalculator& prio
     TiledLayerChromium::setTexturePriorities(priorityCalc);
 }
 
-void ContentLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
+void ContentLayerChromium::update(CCTextureUpdateQueue& queue, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
 {
     createTextureUpdaterIfNeeded();
 
@@ -104,7 +104,7 @@ void ContentLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTr
     if (drawsContent())
         contentRect = visibleContentRect();
 
-    updateContentRect(updater, contentRect, occlusion, stats);
+    updateContentRect(queue, contentRect, occlusion, stats);
     m_needsDisplay = false;
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
index f83993892..6c068b30c 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
@@ -77,7 +77,7 @@ public:
 
     virtual bool drawsContent() const OVERRIDE;
     virtual void setTexturePriorities(const CCPriorityCalculator&) OVERRIDE;
-    virtual void update(CCTextureUpdater&, const CCOcclusionTracker*, CCRenderingStats&) OVERRIDE;
+    virtual void update(CCTextureUpdateQueue&, const CCOcclusionTracker*, CCRenderingStats&) OVERRIDE;
     virtual bool needMoreUpdates() OVERRIDE;
 
     virtual void setOpaque(bool) OVERRIDE;
diff --git a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
index 2fdaee6b6..1d167a556 100644
--- a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
@@ -36,8 +36,8 @@
 #include "Extensions3DChromium.h"
 #include "GraphicsContext3D.h"
 #include "GraphicsContext3DPrivate.h"
-#include "cc/CCProxy.h"
 #include <algorithm>
+#include <public/WebCompositor.h>
 #include <public/WebExternalTextureLayer.h>
 #include <public/WebExternalTextureLayerClient.h>
 #include <public/WebGraphicsContext3D.h>
@@ -81,7 +81,7 @@ DrawingBuffer::DrawingBuffer(GraphicsContext3D* context,
     , m_fbo(0)
     , m_colorBuffer(0)
     , m_frontColorBuffer(0)
-    , m_separateFrontTexture(m_preserveDrawingBuffer == Preserve || CCProxy::implThread())
+    , m_separateFrontTexture(m_preserveDrawingBuffer == Preserve || WebKit::WebCompositor::threadingEnabled())
     , m_depthStencilBuffer(0)
     , m_depthBuffer(0)
     , m_stencilBuffer(0)
@@ -187,7 +187,7 @@ public:
         return GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_drawingBuffer->graphicsContext3D());
     }
 
-    LayerChromium* layer() const { return m_layer.unwrap<LayerChromium>(); }
+    WebKit::WebLayer* layer() { return &m_layer; }
 
 private:
     DrawingBuffer* m_drawingBuffer;
diff --git a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
index 805e20a79..2df315672 100644
--- a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
@@ -126,6 +126,11 @@ public:
     // GL_CHROMIUM_shallow_flush
     virtual void shallowFlushCHROMIUM();
 
+    // GL_EXT_robustness
+    virtual void readnPixelsEXT(int x, int y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, GC3Dsizei bufSize, void *data);
+    virtual void getnUniformfvEXT(GC3Duint program, int location, GC3Dsizei bufSize, float *params);
+    virtual void getnUniformivEXT(GC3Duint program, int location, GC3Dsizei bufSize, int *params);
+
 private:
     // Instances of this class are strictly owned by the GraphicsContext3D implementation and do not
     // need to be instantiated by any other code.
diff --git a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
index 436f346d4..a0e857e9d 100644
--- a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
@@ -31,18 +31,21 @@
 #include "FrameBufferSkPictureCanvasLayerTextureUpdater.h"
 
 #include "LayerPainterChromium.h"
-#include "SharedGraphicsContext3D.h"
 #include "SkCanvas.h"
 #include "SkGpuDevice.h"
 #include "cc/CCProxy.h"
+#include <public/WebGraphicsContext3D.h>
+#include <public/WebSharedGraphicsContext3D.h>
+
+using WebKit::WebGraphicsContext3D;
+using WebKit::WebSharedGraphicsContext3D;
 
 namespace WebCore {
 
-static PassOwnPtr<SkCanvas> createAcceleratedCanvas(GraphicsContext3D* context,
+static PassOwnPtr<SkCanvas> createAcceleratedCanvas(GrContext* grContext,
                                                     IntSize canvasSize,
                                                     unsigned textureId)
 {
-    GrContext* grContext = context->grContext();
     GrPlatformTextureDesc textureDesc;
     textureDesc.fFlags = kRenderTarget_GrPlatformTextureFlag;
     textureDesc.fWidth = canvasSize.width();
@@ -66,10 +69,11 @@ FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::~Texture()
 
 void FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::updateRect(CCResourceProvider* resourceProvider, const IntRect& sourceRect, const IntRect& destRect)
 {
-    RefPtr<GraphicsContext3D> sharedContext = CCProxy::hasImplThread() ? SharedGraphicsContext3D::getForImplThread() : SharedGraphicsContext3D::get();
-    if (!sharedContext)
+    WebGraphicsContext3D* sharedContext = CCProxy::hasImplThread() ? WebSharedGraphicsContext3D::compositorThreadContext() : WebSharedGraphicsContext3D::mainThreadContext();
+    GrContext* sharedGrContext = CCProxy::hasImplThread() ? WebSharedGraphicsContext3D::compositorThreadGrContext() : WebSharedGraphicsContext3D::mainThreadGrContext();
+    if (!sharedContext || !sharedGrContext)
         return;
-    textureUpdater()->updateTextureRect(sharedContext.release(), resourceProvider, texture(), sourceRect, destRect);
+    textureUpdater()->updateTextureRect(sharedContext, sharedGrContext, resourceProvider, texture(), sourceRect, destRect);
 }
 
 PassRefPtr<FrameBufferSkPictureCanvasLayerTextureUpdater> FrameBufferSkPictureCanvasLayerTextureUpdater::create(PassOwnPtr<LayerPainterChromium> painter)
@@ -97,17 +101,15 @@ LayerTextureUpdater::SampledTexelFormat FrameBufferSkPictureCanvasLayerTextureUp
     return LayerTextureUpdater::SampledTexelFormatRGBA;
 }
 
-void FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect(PassRefPtr<GraphicsContext3D> prpContext, CCResourceProvider* resourceProvider, CCPrioritizedTexture* texture, const IntRect& sourceRect, const IntRect& destRect)
+void FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect(WebGraphicsContext3D* context, GrContext* grContext, CCResourceProvider* resourceProvider, CCPrioritizedTexture* texture, const IntRect& sourceRect, const IntRect& destRect)
 {
-    RefPtr<GraphicsContext3D> context(prpContext);
-
     // Make sure ganesh uses the correct GL context.
     context->makeContextCurrent();
 
     texture->acquireBackingTexture(resourceProvider);
     CCScopedLockResourceForWrite lock(resourceProvider, texture->resourceId());
     // Create an accelerated canvas to draw on.
-    OwnPtr<SkCanvas> canvas = createAcceleratedCanvas(context.get(), texture->size(), lock.textureId());
+    OwnPtr<SkCanvas> canvas = createAcceleratedCanvas(grContext, texture->size(), lock.textureId());
 
     // The compositor expects the textures to be upside-down so it can flip
     // the final composited image. Ganesh renders the image upright so we
@@ -115,7 +117,7 @@ void FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect(PassRefPtr
     canvas->translate(0.0, texture->size().height());
     canvas->scale(1.0, -1.0);
     // Only the region corresponding to destRect on the texture must be updated.
-    canvas->clipRect(SkRect(destRect));
+    canvas->clipRect(SkRect::MakeXYWH(destRect.x(), destRect.y(), destRect.width(), destRect.height()));
     // Translate the origin of contentRect to that of destRect.
     // Note that destRect is defined relative to sourceRect.
     canvas->translate(contentRect().x() - sourceRect.x() + destRect.x(),
@@ -123,7 +125,7 @@ void FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect(PassRefPtr
     drawPicture(canvas.get());
 
     // Flush ganesh context so that all the rendered stuff appears on the texture.
-    context->grContext()->flush();
+    grContext->flush();
 
     // Flush the GL context so rendering results from this context are visible in the compositor's context.
     context->flush();
diff --git a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
index 44649e473..64d5eec38 100644
--- a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
@@ -31,6 +31,13 @@
 
 #include "SkPictureCanvasLayerTextureUpdater.h"
 
+class GrContext;
+
+namespace WebKit {
+class WebGraphicsContext3D;
+class WebSharedGraphicsContext3D;
+}
+
 namespace WebCore {
 
 // This class records the contentRect into an SkPicture, then uses accelerated
@@ -56,7 +63,7 @@ public:
 
     virtual PassOwnPtr<LayerTextureUpdater::Texture> createTexture(CCPrioritizedTextureManager*) OVERRIDE;
     virtual SampledTexelFormat sampledTexelFormat(GC3Denum textureFormat) OVERRIDE;
-    void updateTextureRect(PassRefPtr<GraphicsContext3D>, CCResourceProvider*, CCPrioritizedTexture*, const IntRect& sourceRect, const IntRect& destRect);
+    void updateTextureRect(WebKit::WebGraphicsContext3D*, GrContext*, CCResourceProvider*, CCPrioritizedTexture*, const IntRect& sourceRect, const IntRect& destRect);
 
 private:
     explicit FrameBufferSkPictureCanvasLayerTextureUpdater(PassOwnPtr<LayerPainterChromium>);
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index 1eb237c4c..9f8304f6f 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -52,7 +52,6 @@
 #include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "Image.h"
-#include "LayerChromium.h"
 #include "LinkHighlight.h"
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
@@ -60,8 +59,7 @@
 #include "SkMatrix44.h"
 #include "SystemTime.h"
 
-#include "cc/CCActiveAnimation.h"
-
+#include <public/WebAnimation.h>
 #include <public/WebFilterOperation.h>
 #include <public/WebFilterOperations.h>
 #include <public/WebFloatPoint.h>
@@ -108,18 +106,18 @@ void GraphicsLayerChromium::willBeDestroyed()
 {
     if (!m_layer.isNull()) {
         m_layer.clearClient();
-        m_layer.unwrap<LayerChromium>()->clearRenderSurface();
-        m_layer.unwrap<LayerChromium>()->setLayerAnimationDelegate(0);
+        m_layer.clearRenderSurface();
+        m_layer.setAnimationDelegate(0);
     }
 
     if (!m_contentsLayer.isNull()) {
-        m_contentsLayer.unwrap<LayerChromium>()->clearRenderSurface();
-        m_contentsLayer.unwrap<LayerChromium>()->setLayerAnimationDelegate(0);
+        m_contentsLayer.clearRenderSurface();
+        m_contentsLayer.setAnimationDelegate(0);
     }
 
     if (!m_transformLayer.isNull()) {
-        m_transformLayer.unwrap<LayerChromium>()->clearRenderSurface();
-        m_transformLayer.unwrap<LayerChromium>()->setLayerAnimationDelegate(0);
+        m_transformLayer.clearRenderSurface();
+        m_transformLayer.setAnimationDelegate(0);
     }
 
     if (m_linkHighlight)
@@ -131,21 +129,29 @@ void GraphicsLayerChromium::willBeDestroyed()
 void GraphicsLayerChromium::setName(const String& inName)
 {
     m_nameBase = inName;
-    String name = String::format("GraphicsLayerChromium(%p) GraphicsLayer(%p) ", m_layer.unwrap<LayerChromium>(), this) + inName;
+    String name = String::format("GraphicsLayer(%p) ", this) + inName;
     GraphicsLayer::setName(name);
     updateNames();
 }
 
 void GraphicsLayerChromium::updateNames()
 {
-    if (!m_layer.isNull())
-        m_layer.unwrap<LayerChromium>()->setDebugName("Layer for " + m_nameBase);
-    if (!m_transformLayer.isNull())
-        m_transformLayer.unwrap<LayerChromium>()->setDebugName("TransformLayer for " + m_nameBase);
-    if (!m_contentsLayer.isNull())
-        m_contentsLayer.unwrap<LayerChromium>()->setDebugName("ContentsLayer for " + m_nameBase);
-    if (m_linkHighlight)
-        m_linkHighlight->contentLayer()->setDebugName("LinkHighlight for " + m_nameBase);
+    if (!m_layer.isNull()) {
+        String debugName = "Layer for " + m_nameBase;
+        m_layer.setDebugName(debugName);
+    }
+    if (!m_transformLayer.isNull()) {
+        String debugName = "TransformLayer for " + m_nameBase;
+        m_transformLayer.setDebugName(debugName);
+    }
+    if (!m_contentsLayer.isNull()) {
+        String debugName = "ContentsLayer for " + m_nameBase;
+        m_contentsLayer.setDebugName(debugName);
+    }
+    if (m_linkHighlight) {
+        String debugName = "LinkHighlight for " + m_nameBase;
+        m_linkHighlight->contentLayer()->setDebugName(debugName);
+    }
 }
 
 bool GraphicsLayerChromium::setChildren(const Vector<GraphicsLayer*>& children)
@@ -197,7 +203,7 @@ bool GraphicsLayerChromium::replaceChild(GraphicsLayer* oldChild, GraphicsLayer*
 void GraphicsLayerChromium::removeFromParent()
 {
     GraphicsLayer::removeFromParent();
-    layerForParent().removeFromParent();
+    primaryLayer().removeFromParent();
 }
 
 void GraphicsLayerChromium::setPosition(const FloatPoint& point)
@@ -264,8 +270,8 @@ void GraphicsLayerChromium::setMasksToBounds(bool masksToBounds)
 
 void GraphicsLayerChromium::setDrawsContent(bool drawsContent)
 {
-    // Note carefully this early-exit is only correct because we also properly initialize
-    // LayerChromium::m_isDrawable whenever m_contentsLayer is set to a new layer in setupContentsLayer().
+    // Note carefully this early-exit is only correct because we also properly call
+    // WebLayer::setDrawsContent whenever m_contentsLayer is set to a new layer in setupContentsLayer().
     if (drawsContent == m_drawsContent)
         return;
 
@@ -275,8 +281,8 @@ void GraphicsLayerChromium::setDrawsContent(bool drawsContent)
 
 void GraphicsLayerChromium::setContentsVisible(bool contentsVisible)
 {
-    // Note carefully this early-exit is only correct because we also properly initialize
-    // LayerChromium::m_isDrawable whenever m_contentsLayer is set to a new layer in setupContentsLayer().
+    // Note carefully this early-exit is only correct because we also properly call
+    // WebLayer::setDrawsContent whenever m_contentsLayer is set to a new layer in setupContentsLayer().
     if (contentsVisible == m_contentsVisible)
         return;
 
@@ -403,8 +409,10 @@ void GraphicsLayerChromium::setMaskLayer(GraphicsLayer* maskLayer)
 
     GraphicsLayer::setMaskLayer(maskLayer);
 
-    LayerChromium* maskLayerChromium = m_maskLayer ? m_maskLayer->platformLayer() : 0;
-    m_layer.unwrap<LayerChromium>()->setMaskLayer(maskLayerChromium);
+    WebLayer maskWebLayer;
+    if (m_maskLayer)
+        maskWebLayer = *m_maskLayer->platformLayer();
+    m_layer.setMaskLayer(maskWebLayer);
 }
 
 void GraphicsLayerChromium::setBackfaceVisibility(bool visible)
@@ -424,8 +432,11 @@ void GraphicsLayerChromium::setReplicatedByLayer(GraphicsLayer* layer)
 {
     GraphicsLayerChromium* layerChromium = static_cast<GraphicsLayerChromium*>(layer);
     GraphicsLayer::setReplicatedByLayer(layer);
-    LayerChromium* replicaLayer = layerChromium ? layerChromium->primaryLayer().unwrap<LayerChromium>() : 0;
-    primaryLayer().unwrap<LayerChromium>()->setReplicaLayer(replicaLayer);
+
+    WebLayer webReplicaLayer;
+    if (layerChromium)
+        webReplicaLayer = layerChromium->primaryLayer();
+    primaryLayer().setReplicaLayer(webReplicaLayer);
 }
 
 
@@ -462,7 +473,7 @@ void GraphicsLayerChromium::setContentsToImage(Image* image)
     if (image) {
         if (m_contentsLayer.isNull() || m_contentsLayerPurpose != ContentsLayerForImage) {
             WebKit::WebImageLayer imageLayer = WebKit::WebImageLayer::create();
-            setupContentsLayer(imageLayer.unwrap<LayerChromium>());
+            setupContentsLayer(imageLayer);
             m_contentsLayerPurpose = ContentsLayerForImage;
             childrenChanged = true;
         }
@@ -488,8 +499,8 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
 {
     bool childrenChanged = false;
     if (platformLayer) {
-        if (m_contentsLayer.unwrap<LayerChromium>() != platformLayer) {
-            setupContentsLayer(platformLayer);
+        if (m_contentsLayer != *platformLayer) {
+            setupContentsLayer(*platformLayer);
             m_contentsLayerPurpose = ContentsLayerForCanvas;
             childrenChanged = true;
         }
@@ -509,17 +520,17 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
 
 bool GraphicsLayerChromium::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, const String& animationName, double timeOffset)
 {
-    primaryLayer().unwrap<LayerChromium>()->setLayerAnimationDelegate(this);
+    primaryLayer().setAnimationDelegate(this);
 
     int animationId = mapAnimationNameToId(animationName);
     int groupId = AnimationIdVendor::getNextGroupId();
 
-    OwnPtr<CCActiveAnimation> toAdd(createActiveAnimation(values, animation, animationId, groupId, timeOffset, boxSize));
+    OwnPtr<WebKit::WebAnimation> toAdd(createWebAnimation(values, animation, animationId, groupId, timeOffset, boxSize));
 
     if (toAdd.get()) {
         // Remove any existing animations with the same animation id and target property.
-        primaryLayer().unwrap<LayerChromium>()->layerAnimationController()->removeAnimation(toAdd->id(), toAdd->targetProperty());
-        return primaryLayer().unwrap<LayerChromium>()->addAnimation(toAdd.release());
+        primaryLayer().removeAnimation(animationId, toAdd->targetProperty());
+        return primaryLayer().addAnimation(*toAdd);
     }
 
     return false;
@@ -527,12 +538,12 @@ bool GraphicsLayerChromium::addAnimation(const KeyframeValueList& values, const
 
 void GraphicsLayerChromium::pauseAnimation(const String& animationName, double timeOffset)
 {
-    primaryLayer().unwrap<LayerChromium>()->pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
+    primaryLayer().pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
 }
 
 void GraphicsLayerChromium::removeAnimation(const String& animationName)
 {
-    primaryLayer().unwrap<LayerChromium>()->removeAnimation(mapAnimationNameToId(animationName));
+    primaryLayer().removeAnimation(mapAnimationNameToId(animationName));
 }
 
 void GraphicsLayerChromium::suspendAnimations(double wallClockTime)
@@ -540,12 +551,12 @@ void GraphicsLayerChromium::suspendAnimations(double wallClockTime)
     // |wallClockTime| is in the wrong time base. Need to convert here.
     // FIXME: find a more reliable way to do this.
     double monotonicTime = wallClockTime + monotonicallyIncreasingTime() - currentTime();
-    primaryLayer().unwrap<LayerChromium>()->suspendAnimations(monotonicTime);
+    primaryLayer().suspendAnimations(monotonicTime);
 }
 
 void GraphicsLayerChromium::resumeAnimations()
 {
-    primaryLayer().unwrap<LayerChromium>()->resumeAnimations(monotonicallyIncreasingTime());
+    primaryLayer().resumeAnimations(monotonicallyIncreasingTime());
 }
 
 void GraphicsLayerChromium::addLinkHighlight(const Path& path)
@@ -567,7 +578,7 @@ void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
     bool childrenChanged = false;
     if (layer) {
         if (m_contentsLayer.isNull() || m_contentsLayerPurpose != ContentsLayerForVideo) {
-            setupContentsLayer(layer);
+            setupContentsLayer(*layer);
             m_contentsLayerPurpose = ContentsLayerForVideo;
             childrenChanged = true;
         }
@@ -585,19 +596,14 @@ void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
         updateChildList();
 }
 
-WebLayer GraphicsLayerChromium::hostLayerForChildren() const
-{
-    return m_transformLayer.isNull() ? m_layer :  m_transformLayer;
-}
-
-WebLayer GraphicsLayerChromium::layerForParent() const
+WebKit::WebLayer GraphicsLayerChromium::primaryLayer() const
 {
-    return m_transformLayer.isNull() ? m_layer :  m_transformLayer;
+    return m_transformLayer.isNull() ? m_layer : m_transformLayer;
 }
 
 PlatformLayer* GraphicsLayerChromium::platformLayer() const
 {
-    return primaryLayer().unwrap<LayerChromium>();
+    return const_cast<PlatformLayer*>(m_transformLayer.isNull() ? &m_layer : &m_transformLayer);
 }
 
 void GraphicsLayerChromium::setDebugBackgroundColor(const Color& color)
@@ -621,16 +627,16 @@ void GraphicsLayerChromium::setDebugBorder(const Color& color, float borderWidth
 
 void GraphicsLayerChromium::updateChildList()
 {
-    Vector<RefPtr<LayerChromium> > newChildren;
+    Vector<WebLayer> newChildren;
 
     if (!m_transformLayer.isNull()) {
         // Add the primary layer first. Even if we have negative z-order children, the primary layer always comes behind.
-        newChildren.append(m_layer.unwrap<LayerChromium>());
+        newChildren.append(m_layer);
     } else if (!m_contentsLayer.isNull()) {
         // FIXME: add the contents layer in the correct order with negative z-order children.
         // This does not cause visible rendering issues because currently contents layers are only used
         // for replaced elements that don't have children.
-        newChildren.append(m_contentsLayer.unwrap<LayerChromium>());
+        newChildren.append(m_contentsLayer);
     }
 
     const Vector<GraphicsLayer*>& childLayers = children();
@@ -638,18 +644,20 @@ void GraphicsLayerChromium::updateChildList()
     for (size_t i = 0; i < numChildren; ++i) {
         GraphicsLayerChromium* curChild = static_cast<GraphicsLayerChromium*>(childLayers[i]);
 
-        LayerChromium* childLayer = curChild->layerForParent().unwrap<LayerChromium>();
-        newChildren.append(childLayer);
+        newChildren.append(curChild->primaryLayer());
     }
 
     if (m_linkHighlight)
         newChildren.append(m_linkHighlight->contentLayer());
 
     for (size_t i = 0; i < newChildren.size(); ++i)
-        newChildren[i]->removeFromParent();
+        newChildren[i].removeFromParent();
+
+    WebVector<WebLayer> newWebChildren;
+    newWebChildren.assign(newChildren.data(), newChildren.size());
 
     if (!m_transformLayer.isNull()) {
-        m_transformLayer.unwrap<LayerChromium>()->setChildren(newChildren);
+        m_transformLayer.setChildren(newWebChildren);
 
         if (!m_contentsLayer.isNull()) {
             // If we have a transform layer, then the contents layer is parented in the
@@ -658,7 +666,7 @@ void GraphicsLayerChromium::updateChildList()
             m_layer.addChild(m_contentsLayer);
         }
     } else
-        m_layer.unwrap<LayerChromium>()->setChildren(newChildren);
+        m_layer.setChildren(newWebChildren);
 }
 
 void GraphicsLayerChromium::updateLayerPosition()
@@ -707,8 +715,8 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
         // Create the transform layer.
         m_transformLayer = WebLayer::create();
         m_transformLayer.setPreserves3D(true);
-        m_transformLayer.unwrap<LayerChromium>()->setLayerAnimationDelegate(this);
-        m_transformLayer.unwrap<LayerChromium>()->setLayerAnimationController(m_layer.unwrap<LayerChromium>()->releaseLayerAnimationController());
+        m_transformLayer.setAnimationDelegate(this);
+        m_layer.transferAnimationsTo(&m_transformLayer);
 
         // Copy the position from this layer.
         updateLayerPosition();
@@ -739,11 +747,11 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
         if (!m_transformLayer.parent().isNull())
             m_transformLayer.parent().replaceChild(m_transformLayer, m_layer);
 
-        m_layer.unwrap<LayerChromium>()->setLayerAnimationDelegate(this);
-        m_layer.unwrap<LayerChromium>()->setLayerAnimationController(m_transformLayer.unwrap<LayerChromium>()->releaseLayerAnimationController());
+        m_layer.setAnimationDelegate(this);
+        m_transformLayer.transferAnimationsTo(&m_layer);
 
         // Release the transform layer.
-        m_transformLayer.unwrap<LayerChromium>()->setLayerAnimationDelegate(0);
+        m_transformLayer.setAnimationDelegate(0);
         m_transformLayer.reset();
 
         updateLayerPosition();
@@ -813,9 +821,9 @@ void GraphicsLayerChromium::updateContentsScale()
     m_layer.setContentsScale(contentsScale());
 }
 
-void GraphicsLayerChromium::setupContentsLayer(LayerChromium* contentsLayer)
+void GraphicsLayerChromium::setupContentsLayer(WebLayer contentsLayer)
 {
-    if (contentsLayer == m_contentsLayer.unwrap<LayerChromium>())
+    if (contentsLayer == m_contentsLayer)
         return;
 
     if (!m_contentsLayer.isNull()) {
@@ -824,9 +832,9 @@ void GraphicsLayerChromium::setupContentsLayer(LayerChromium* contentsLayer)
         m_contentsLayer.reset();
     }
 
-    if (contentsLayer) {
-        m_contentsLayer = WebLayer(contentsLayer);
+    m_contentsLayer = contentsLayer;
 
+    if (!m_contentsLayer.isNull()) {
         m_contentsLayer.setAnchorPoint(FloatPoint(0, 0));
         m_contentsLayer.setUseParentBackfaceVisibility(true);
 
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
index 9716b174d..5ae094877 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
@@ -36,8 +36,8 @@
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
 #include "OpaqueRectTrackingContentLayerDelegate.h"
-#include "cc/CCLayerAnimationDelegate.h"
 
+#include <public/WebAnimationDelegate.h>
 #include <public/WebContentLayer.h>
 #include <public/WebLayer.h>
 #include <wtf/HashMap.h>
@@ -48,7 +48,7 @@ class LayerChromium;
 class LinkHighlight;
 class Path;
 
-class GraphicsLayerChromium : public GraphicsLayer, public GraphicsContextPainter, public CCLayerAnimationDelegate {
+class GraphicsLayerChromium : public GraphicsLayer, public GraphicsContextPainter, public WebKit::WebAnimationDelegate {
 public:
     GraphicsLayerChromium(GraphicsLayerClient*);
     virtual ~GraphicsLayerChromium();
@@ -121,9 +121,9 @@ public:
     // GraphicsContextPainter implementation.
     virtual void paint(GraphicsContext&, const IntRect& clip) OVERRIDE;
 
-    // CCLayerAnimationDelegate implementation.
-    virtual void notifyAnimationStarted(double startTime);
-    virtual void notifyAnimationFinished(double finishTime);
+    // WebAnimationDelegate implementation.
+    virtual void notifyAnimationStarted(double startTime) OVERRIDE;
+    virtual void notifyAnimationFinished(double finishTime) OVERRIDE;
 
     // Exposed for tests.
     WebKit::WebLayer contentsLayer() const { return m_contentsLayer; }
@@ -131,9 +131,7 @@ public:
 private:
     virtual void willBeDestroyed();
 
-    WebKit::WebLayer primaryLayer() const  { return m_transformLayer.isNull() ? m_layer : m_transformLayer; }
-    WebKit::WebLayer hostLayerForChildren() const;
-    WebKit::WebLayer layerForParent() const;
+    WebKit::WebLayer primaryLayer() const;
 
     void updateNames();
     void updateChildList();
@@ -152,7 +150,7 @@ private:
     void updateContentsRect();
     void updateContentsScale();
 
-    void setupContentsLayer(LayerChromium*);
+    void setupContentsLayer(WebKit::WebLayer);
     float contentsScale() const;
 
     int mapAnimationNameToId(const String& animationName);
diff --git a/Source/WebCore/platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp
index 9ee47d800..c6e759bdb 100644
--- a/Source/WebCore/platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp
@@ -33,15 +33,26 @@
 
 namespace WebCore {
 
-PassRefPtr<HeadsUpDisplayLayerChromium> HeadsUpDisplayLayerChromium::create(const CCLayerTreeSettings& settings, int maxTextureSize)
+PassRefPtr<HeadsUpDisplayLayerChromium> HeadsUpDisplayLayerChromium::create()
 {
-    return adoptRef(new HeadsUpDisplayLayerChromium(settings, maxTextureSize));
+    return adoptRef(new HeadsUpDisplayLayerChromium());
 }
 
-HeadsUpDisplayLayerChromium::HeadsUpDisplayLayerChromium(const CCLayerTreeSettings& settings, int maxTextureSize)
+HeadsUpDisplayLayerChromium::HeadsUpDisplayLayerChromium()
     : LayerChromium()
 {
-    OwnPtr<CCFontAtlas> fontAtlas;
+
+    setBounds(IntSize(512, 128));
+}
+
+HeadsUpDisplayLayerChromium::~HeadsUpDisplayLayerChromium()
+{
+}
+
+void HeadsUpDisplayLayerChromium::update(CCTextureUpdateQueue&, const CCOcclusionTracker*, CCRenderingStats&)
+{
+    const CCLayerTreeSettings& settings = layerTreeHost()->settings();
+    int maxTextureSize = layerTreeHost()->layerRendererCapabilities().maxTextureSize;
 
     IntSize bounds;
     if (settings.showPlatformLayerTree || settings.showDebugRects()) {
@@ -51,23 +62,30 @@ HeadsUpDisplayLayerChromium::HeadsUpDisplayLayerChromium(const CCLayerTreeSettin
         bounds.setWidth(512);
         bounds.setHeight(128);
     }
-    setBounds(bounds);
 
-    // Only allocate the font atlas if we have reason to use the heads-up display.
-    if (settings.showFPSCounter || settings.showPlatformLayerTree) {
-        TRACE_EVENT0("cc", "HeadsUpDisplayLayerChromium::initializeFontAtlas");
-        m_fontAtlas = CCFontAtlas::create();
-        m_fontAtlas->initialize();
-    }
+    setBounds(bounds);
 }
 
-HeadsUpDisplayLayerChromium::~HeadsUpDisplayLayerChromium()
+void HeadsUpDisplayLayerChromium::setFontAtlas(PassOwnPtr<CCFontAtlas> fontAtlas)
 {
+    m_fontAtlas = fontAtlas;
+    setNeedsCommit();
 }
 
 PassOwnPtr<CCLayerImpl> HeadsUpDisplayLayerChromium::createCCLayerImpl()
 {
-    return CCHeadsUpDisplayLayerImpl::create(m_layerId, m_fontAtlas.release());
+    return CCHeadsUpDisplayLayerImpl::create(m_layerId);
+}
+
+void HeadsUpDisplayLayerChromium::pushPropertiesTo(CCLayerImpl* layerImpl)
+{
+    LayerChromium::pushPropertiesTo(layerImpl);
+
+    if (!m_fontAtlas)
+        return;
+
+    CCHeadsUpDisplayLayerImpl* hudLayerImpl = static_cast<CCHeadsUpDisplayLayerImpl*>(layerImpl);
+    hudLayerImpl->setFontAtlas(m_fontAtlas.release());
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/HeadsUpDisplayLayerChromium.h b/Source/WebCore/platform/graphics/chromium/HeadsUpDisplayLayerChromium.h
index 97e310e18..e6a983045 100644
--- a/Source/WebCore/platform/graphics/chromium/HeadsUpDisplayLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/HeadsUpDisplayLayerChromium.h
@@ -27,24 +27,27 @@
 #ifndef HeadsUpDisplayLayerChromium_h
 #define HeadsUpDisplayLayerChromium_h
 
+#include "IntSize.h"
 #include "LayerChromium.h"
 #include "cc/CCFontAtlas.h"
 
 namespace WebCore {
 
-struct CCLayerTreeSettings;
-
 class HeadsUpDisplayLayerChromium : public LayerChromium {
 public:
-    static PassRefPtr<HeadsUpDisplayLayerChromium> create(const CCLayerTreeSettings&, int maxTextureSize);
+    static PassRefPtr<HeadsUpDisplayLayerChromium> create();
     virtual ~HeadsUpDisplayLayerChromium();
 
+    virtual void update(CCTextureUpdateQueue&, const CCOcclusionTracker*, CCRenderingStats&) OVERRIDE;
     virtual bool drawsContent() const OVERRIDE { return true; }
 
+    void setFontAtlas(PassOwnPtr<CCFontAtlas>);
+
     virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl() OVERRIDE;
+    virtual void pushPropertiesTo(CCLayerImpl*) OVERRIDE;
 
 protected:
-    HeadsUpDisplayLayerChromium(const CCLayerTreeSettings&, int maxTextureSize);
+    HeadsUpDisplayLayerChromium();
 
 private:
     OwnPtr<CCFontAtlas> m_fontAtlas;
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
index d47f14b1e..5073d1cc8 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
@@ -141,7 +141,7 @@ void ImageLayerChromium::setTexturePriorities(const CCPriorityCalculator& priori
     TiledLayerChromium::setTexturePriorities(priorityCalc);
 }
 
-void ImageLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
+void ImageLayerChromium::update(CCTextureUpdateQueue& queue, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
 {
     createTextureUpdaterIfNeeded();
     if (m_needsDisplay) {
@@ -151,7 +151,7 @@ void ImageLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTrac
         m_needsDisplay = false;
     }
 
-    updateContentRect(updater, visibleContentRect(), occlusion, stats);
+    updateContentRect(queue, visibleContentRect(), occlusion, stats);
 }
 
 void ImageLayerChromium::createTextureUpdaterIfNeeded()
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
index 0444cd574..b50e5e715 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
@@ -49,7 +49,7 @@ public:
 
     virtual bool drawsContent() const OVERRIDE;
     virtual void setTexturePriorities(const CCPriorityCalculator&) OVERRIDE;
-    virtual void update(CCTextureUpdater&, const CCOcclusionTracker*, CCRenderingStats&) OVERRIDE;
+    virtual void update(CCTextureUpdateQueue&, const CCOcclusionTracker*, CCRenderingStats&) OVERRIDE;
     virtual bool needsContentsScale() const OVERRIDE;
 
     void setBitmap(const SkBitmap& image);
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 76c065b52..3b9c36269 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -37,11 +37,12 @@
 #include "cc/CCActiveAnimation.h"
 #include "cc/CCAnimationEvents.h"
 #include "cc/CCLayerAnimationController.h"
-#include "cc/CCLayerAnimationDelegate.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCSettings.h"
 
+#include <public/WebAnimationDelegate.h>
+
 using namespace std;
 using WebKit::WebTransformationMatrix;
 
@@ -77,7 +78,7 @@ LayerChromium::LayerChromium()
     , m_masksToBounds(false)
     , m_opaque(false)
     , m_doubleSided(true)
-    , m_isNonCompositedContent(false)
+    , m_useLCDText(false)
     , m_preserves3D(false)
     , m_useParentBackfaceVisibility(false)
     , m_alwaysReserveTextures(false)
@@ -109,9 +110,9 @@ LayerChromium::~LayerChromium()
     removeAllChildren();
 }
 
-void LayerChromium::setIsNonCompositedContent(bool isNonCompositedContent)
+void LayerChromium::setUseLCDText(bool useLCDText)
 {
-    m_isNonCompositedContent = isNonCompositedContent;
+    m_useLCDText = useLCDText;
 }
 
 void LayerChromium::setLayerTreeHost(CCLayerTreeHost* host)
@@ -543,7 +544,7 @@ void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     layer->setDrawsContent(drawsContent());
     layer->setFilters(filters());
     layer->setBackgroundFilters(backgroundFilters());
-    layer->setIsNonCompositedContent(m_isNonCompositedContent);
+    layer->setUseLCDText(m_useLCDText);
     layer->setMasksToBounds(m_masksToBounds);
     layer->setScrollable(m_scrollable);
     layer->setShouldScrollOnMainThread(m_shouldScrollOnMainThread);
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index 27ce8f10a..29e387e53 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -52,14 +52,18 @@
 #include <wtf/text/StringHash.h>
 #include <wtf/text/WTFString.h>
 
+namespace WebKit {
+class WebAnimationDelegate;
+}
 
 namespace WebCore {
 
 class CCActiveAnimation;
+struct CCAnimationEvent;
 class CCLayerAnimationDelegate;
 class CCLayerImpl;
 class CCLayerTreeHost;
-class CCTextureUpdater;
+class CCTextureUpdateQueue;
 class ScrollbarLayerChromium;
 struct CCAnimationEvent;
 struct CCRenderingStats;
@@ -158,9 +162,6 @@ public:
     const IntRect& visibleContentRect() const { return m_visibleContentRect; }
     void setVisibleContentRect(const IntRect& visibleContentRect) { m_visibleContentRect = visibleContentRect; }
 
-    const IntRect& scissorRect() const { return m_scissorRect; }
-    void setScissorRect(const IntRect& scissorRect) { m_scissorRect = scissorRect; }
-
     void setScrollPosition(const IntPoint&);
     const IntPoint& scrollPosition() const { return m_scrollPosition; }
 
@@ -196,8 +197,8 @@ public:
     void setUseParentBackfaceVisibility(bool useParentBackfaceVisibility) { m_useParentBackfaceVisibility = useParentBackfaceVisibility; }
     bool useParentBackfaceVisibility() const { return m_useParentBackfaceVisibility; }
 
-    virtual void setIsNonCompositedContent(bool);
-    bool isNonCompositedContent() const { return m_isNonCompositedContent; }
+    virtual void setUseLCDText(bool);
+    bool useLCDText() const { return m_useLCDText; }
 
     virtual void setLayerTreeHost(CCLayerTreeHost*);
 
@@ -212,7 +213,7 @@ public:
 
     // These methods typically need to be overwritten by derived classes.
     virtual bool drawsContent() const { return m_isDrawable; }
-    virtual void update(CCTextureUpdater&, const CCOcclusionTracker*, CCRenderingStats&) { }
+    virtual void update(CCTextureUpdateQueue&, const CCOcclusionTracker*, CCRenderingStats&) { }
     virtual bool needMoreUpdates() { return false; }
     virtual void setIsMask(bool) { }
     virtual void bindContentsTexture() { }
@@ -280,7 +281,7 @@ public:
     void setLayerAnimationController(PassOwnPtr<CCLayerAnimationController>);
     PassOwnPtr<CCLayerAnimationController> releaseLayerAnimationController();
 
-    void setLayerAnimationDelegate(CCLayerAnimationDelegate* layerAnimationDelegate) { m_layerAnimationDelegate = layerAnimationDelegate; }
+    void setLayerAnimationDelegate(WebKit::WebAnimationDelegate* layerAnimationDelegate) { m_layerAnimationDelegate = layerAnimationDelegate; }
 
     bool hasActiveAnimation() const;
 
@@ -346,10 +347,6 @@ private:
     // Uses layer's content space.
     IntRect m_visibleContentRect;
 
-    // During drawing, identifies the region outside of which nothing should be drawn.
-    // This is the intersection of the layer's drawableContentRect and damage (if damage tracking is enabled).
-    // Uses target surface's space.
-    IntRect m_scissorRect;
     IntPoint m_scrollPosition;
     IntSize m_maxScrollPosition;
     bool m_scrollable;
@@ -373,7 +370,7 @@ private:
     bool m_masksToBounds;
     bool m_opaque;
     bool m_doubleSided;
-    bool m_isNonCompositedContent;
+    bool m_useLCDText;
     bool m_preserves3D;
     bool m_useParentBackfaceVisibility;
     bool m_alwaysReserveTextures;
@@ -402,7 +399,7 @@ private:
     IntRect m_drawableContentRect;
     float m_contentsScale;
 
-    CCLayerAnimationDelegate* m_layerAnimationDelegate;
+    WebKit::WebAnimationDelegate* m_layerAnimationDelegate;
     LayerChromiumScrollDelegate* m_layerScrollDelegate;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index c4f138ab7..7f9471a98 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -40,7 +40,6 @@
 #include "GrTexture.h"
 #include "NotImplemented.h"
 #include "PlatformColor.h"
-#include "SharedGraphicsContext3D.h"
 #include "SkBitmap.h"
 #include "SkColor.h"
 #include "ThrottledTextureUploader.h"
@@ -56,6 +55,7 @@
 #include "cc/CCSingleThreadProxy.h"
 #include "cc/CCVideoLayerImpl.h"
 #include <public/WebGraphicsContext3D.h>
+#include <public/WebSharedGraphicsContext3D.h>
 #include <public/WebVideoFrame.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
@@ -64,6 +64,7 @@
 using namespace std;
 using WebKit::WebGraphicsContext3D;
 using WebKit::WebGraphicsMemoryAllocation;
+using WebKit::WebSharedGraphicsContext3D;
 using WebKit::WebTransformationMatrix;
 
 namespace WebCore {
@@ -125,7 +126,7 @@ public:
     virtual bool isBusy() OVERRIDE { return false; }
     virtual void beginUploads() OVERRIDE { }
     virtual void endUploads() OVERRIDE { }
-    virtual void uploadTexture(LayerTextureUpdater::Texture* texture, CCResourceProvider* resourceProvider, const IntRect sourceRect, const IntRect destRect) OVERRIDE { texture->updateRect(resourceProvider, sourceRect, destRect); }
+    virtual void uploadTexture(CCResourceProvider* resourceProvider, Parameters upload) OVERRIDE { upload.texture->updateRect(resourceProvider, upload.sourceRect, upload.destRect); }
 
 protected:
     UnthrottledTextureUploader() { }
@@ -186,7 +187,8 @@ bool LayerRendererChromium::initialize()
 
     m_context->setContextLostCallback(this);
 
-    String extensionsString = m_context->getString(GraphicsContext3D::EXTENSIONS);
+    WebKit::WebString extensionsWebString = m_context->getString(GraphicsContext3D::EXTENSIONS);
+    String extensionsString(extensionsWebString.data(), extensionsWebString.length());
     Vector<String> extensionsList;
     extensionsString.split(' ', extensionsList);
     HashSet<String> extensions;
@@ -204,8 +206,6 @@ bool LayerRendererChromium::initialize()
 
     m_capabilities.usingPartialSwap = CCSettings::partialSwapEnabled() && extensions.contains("GL_CHROMIUM_post_sub_buffer");
 
-    m_capabilities.usingMapSub = extensions.contains("GL_CHROMIUM_map_sub");
-
     // Use the swapBuffers callback only with the threaded proxy.
     if (CCProxy::hasImplThread())
         m_capabilities.usingSwapCompleteCallback = extensions.contains("GL_CHROMIUM_swapbuffers_complete_callback");
@@ -219,10 +219,6 @@ bool LayerRendererChromium::initialize()
         ASSERT(extensions.contains("GL_ARB_texture_rectangle"));
     }
 
-    m_capabilities.usingTextureUsageHint = extensions.contains("GL_ANGLE_texture_usage");
-
-    m_capabilities.usingTextureStorageExtension = extensions.contains("GL_EXT_texture_storage");
-
     m_capabilities.usingGpuMemoryManager = extensions.contains("GL_CHROMIUM_gpu_memory_manager");
     if (m_capabilities.usingGpuMemoryManager)
         m_context->setMemoryAllocationChangedCallbackCHROMIUM(this);
@@ -288,35 +284,24 @@ void LayerRendererChromium::viewportChanged()
     m_isViewportChanged = true;
 }
 
-void LayerRendererChromium::clearFramebuffer(DrawingFrame& frame, const FloatRect& framebufferDamageRect)
+void LayerRendererChromium::clearFramebuffer(DrawingFrame& frame)
 {
-    // On DEBUG builds, opaque render passes are cleared to blue to easily see regions that were not drawn on the screen. If we
-    // are using partial swap / scissor optimization, then the surface should only
-    // clear the damaged region, so that we don't accidentally clear un-changed portions
-    // of the screen.
-
+    // On DEBUG builds, opaque render passes are cleared to blue to easily see regions that were not drawn on the screen.
     if (frame.currentRenderPass->hasTransparentBackground())
         GLC(m_context, m_context->clearColor(0, 0, 0, 0));
     else
         GLC(m_context, m_context->clearColor(0, 0, 1, 1));
 
-    if (m_capabilities.usingPartialSwap)
-        setScissorToRect(frame, enclosingIntRect(framebufferDamageRect));
-    else
-        GLC(m_context, m_context->disable(GraphicsContext3D::SCISSOR_TEST));
-
 #if defined(NDEBUG)
     if (frame.currentRenderPass->hasTransparentBackground())
 #endif
         m_context->clear(GraphicsContext3D::COLOR_BUFFER_BIT);
-
-    GLC(m_context, m_context->enable(GraphicsContext3D::SCISSOR_TEST));
 }
 
 // static
 IntSize LayerRendererChromium::renderPassTextureSize(const CCRenderPass* pass)
 {
-    return pass->framebufferOutputRect().size();
+    return pass->outputRect().size();
 }
 
 // static
@@ -367,7 +352,7 @@ bool LayerRendererChromium::haveCachedResourcesForRenderPassId(int id) const
     return texture && texture->id() && texture->isComplete();
 }
 
-void LayerRendererChromium::drawFrame(const CCRenderPassList& renderPassesInDrawOrder, const CCRenderPassIdHashMap& renderPassesById, const FloatRect& rootScissorRect)
+void LayerRendererChromium::drawFrame(const CCRenderPassList& renderPassesInDrawOrder, const CCRenderPassIdHashMap& renderPassesById)
 {
     const CCRenderPass* rootRenderPass = renderPassesInDrawOrder.last();
     ASSERT(rootRenderPass);
@@ -376,16 +361,17 @@ void LayerRendererChromium::drawFrame(const CCRenderPassList& renderPassesInDraw
     frame.renderPassesById = &renderPassesById;
     frame.rootRenderPass = rootRenderPass;
 
-    beginDrawingFrame();
+    frame.rootDamageRect = m_capabilities.usingPartialSwap ? frame.rootRenderPass->damageRect() : frame.rootRenderPass->outputRect();
+    frame.rootDamageRect.intersect(IntRect(IntPoint::zero(), viewportSize()));
 
-    for (size_t i = 0; i < renderPassesInDrawOrder.size(); ++i) {
-        const CCRenderPass* renderPass = renderPassesInDrawOrder[i];
+    beginDrawingFrame();
 
-        FloatRect rootScissorRectInCurrentSurface = renderPass->targetSurface()->computeRootScissorRectInCurrentSurface(rootScissorRect);
-        drawRenderPass(frame, renderPass, rootScissorRectInCurrentSurface);
-    }
+    for (size_t i = 0; i < renderPassesInDrawOrder.size(); ++i)
+        drawRenderPass(frame, renderPassesInDrawOrder[i]);
 
     finishDrawingFrame();
+
+    m_swapBufferRect.unite(enclosingIntRect(frame.rootDamageRect));
 }
 
 void LayerRendererChromium::beginDrawingFrame()
@@ -422,62 +408,73 @@ void LayerRendererChromium::doNoOp()
     GLC(m_context, m_context->flush());
 }
 
-void LayerRendererChromium::drawRenderPass(DrawingFrame& frame, const CCRenderPass* renderPass, const FloatRect& framebufferDamageRect)
+void LayerRendererChromium::drawRenderPass(DrawingFrame& frame, const CCRenderPass* renderPass)
 {
     if (!useRenderPass(frame, renderPass))
         return;
 
-    clearFramebuffer(frame, framebufferDamageRect);
+    FloatRect scissorRect = renderPass->outputRect();
+    if (frame.rootDamageRect != frame.rootRenderPass->outputRect()) {
+        WebTransformationMatrix inverseTransformToRoot = renderPass->transformToRootTarget().inverse();
+        scissorRect.intersect(CCMathUtil::projectClippedRect(inverseTransformToRoot, frame.rootDamageRect));
+    }
+
+    if (scissorRect != renderPass->outputRect())
+        setScissorToRect(frame, enclosingIntRect(scissorRect));
+    else
+        GLC(m_context, m_context->disable(GraphicsContext3D::SCISSOR_TEST));
+
+    clearFramebuffer(frame);
 
     const CCQuadList& quadList = renderPass->quadList();
     for (CCQuadList::constBackToFrontIterator it = quadList.backToFrontBegin(); it != quadList.backToFrontEnd(); ++it)
-        drawQuad(frame, it->get());
+        drawQuad(frame, it->get(), scissorRect);
+
+    CachedTexture* texture = m_renderPassTextures.get(renderPass->id());
+    if (texture)
+        texture->setIsComplete(!renderPass->hasOcclusionFromOutsideTargetSurface());
 }
 
-void LayerRendererChromium::drawQuad(DrawingFrame& frame, const WebKit::WebCompositorQuad* quad)
+void LayerRendererChromium::drawQuad(DrawingFrame& frame, const CCDrawQuad* quad, FloatRect scissorRect)
 {
-    IntRect scissorRect = quad->scissorRect();
-
-    ASSERT(!scissorRect.isEmpty());
+    scissorRect.intersect(quad->clippedRectInTarget());
     if (scissorRect.isEmpty())
         return;
 
-    setScissorToRect(frame, scissorRect);
-
     if (quad->needsBlending())
         GLC(m_context, m_context->enable(GraphicsContext3D::BLEND));
     else
         GLC(m_context, m_context->disable(GraphicsContext3D::BLEND));
 
     switch (quad->material()) {
-    case WebKit::WebCompositorQuad::Invalid:
+    case CCDrawQuad::Invalid:
         ASSERT_NOT_REACHED();
         break;
-    case WebKit::WebCompositorQuad::Checkerboard:
+    case CCDrawQuad::Checkerboard:
         drawCheckerboardQuad(frame, CCCheckerboardDrawQuad::materialCast(quad));
         break;
-    case WebKit::WebCompositorQuad::DebugBorder:
+    case CCDrawQuad::DebugBorder:
         drawDebugBorderQuad(frame, CCDebugBorderDrawQuad::materialCast(quad));
         break;
-    case WebKit::WebCompositorQuad::IOSurfaceContent:
+    case CCDrawQuad::IOSurfaceContent:
         drawIOSurfaceQuad(frame, CCIOSurfaceDrawQuad::materialCast(quad));
         break;
-    case WebKit::WebCompositorQuad::RenderPass:
+    case CCDrawQuad::RenderPass:
         drawRenderPassQuad(frame, CCRenderPassDrawQuad::materialCast(quad));
         break;
-    case WebKit::WebCompositorQuad::SolidColor:
-        drawSolidColorQuad(frame, WebKit::WebCompositorSolidColorQuad::materialCast(quad));
+    case CCDrawQuad::SolidColor:
+        drawSolidColorQuad(frame, CCSolidColorDrawQuad::materialCast(quad));
         break;
-    case WebKit::WebCompositorQuad::StreamVideoContent:
+    case CCDrawQuad::StreamVideoContent:
         drawStreamVideoQuad(frame, CCStreamVideoDrawQuad::materialCast(quad));
         break;
-    case WebKit::WebCompositorQuad::TextureContent:
-        drawTextureQuad(frame, WebKit::WebCompositorTextureQuad::materialCast(quad));
+    case CCDrawQuad::TextureContent:
+        drawTextureQuad(frame, CCTextureDrawQuad::materialCast(quad));
         break;
-    case WebKit::WebCompositorQuad::TiledContent:
+    case CCDrawQuad::TiledContent:
         drawTileQuad(frame, CCTileDrawQuad::materialCast(quad));
         break;
-    case WebKit::WebCompositorQuad::YUVVideoContent:
+    case CCDrawQuad::YUVVideoContent:
         drawYUVVideoQuad(frame, CCYUVVideoDrawQuad::materialCast(quad));
         break;
     }
@@ -512,6 +509,7 @@ void LayerRendererChromium::drawDebugBorderQuad(DrawingFrame& frame, const CCDeb
     ASSERT(program && program->initialized());
     GLC(context(), context()->useProgram(program->program()));
 
+    // Use the full quadRect for debug quads to not move the edges based on partial swaps.
     const IntRect& layerRect = quad->quadRect();
     WebTransformationMatrix renderMatrix = quad->quadTransform();
     renderMatrix.translate(0.5 * layerRect.width() + layerRect.x(), 0.5 * layerRect.height() + layerRect.y());
@@ -535,14 +533,16 @@ static inline SkBitmap applyFilters(LayerRendererChromium* layerRenderer, const
     if (filters.isEmpty())
         return SkBitmap();
 
-    RefPtr<GraphicsContext3D> filterContext = CCProxy::hasImplThread() ? SharedGraphicsContext3D::getForImplThread() : SharedGraphicsContext3D::get();
-    if (!filterContext)
+    WebGraphicsContext3D* filterContext = CCProxy::hasImplThread() ? WebSharedGraphicsContext3D::compositorThreadContext() : WebSharedGraphicsContext3D::mainThreadContext();
+    GrContext* filterGrContext = CCProxy::hasImplThread() ? WebSharedGraphicsContext3D::compositorThreadGrContext() : WebSharedGraphicsContext3D::mainThreadGrContext();
+
+    if (!filterContext || !filterGrContext)
         return SkBitmap();
 
     layerRenderer->context()->flush();
 
     CCScopedLockResourceForWrite lock(layerRenderer->resourceProvider(), sourceTexture->id());
-    SkBitmap source = CCRenderSurfaceFilters::apply(filters, lock.textureId(), sourceTexture->size(), filterContext.get());
+    SkBitmap source = CCRenderSurfaceFilters::apply(filters, lock.textureId(), sourceTexture->size(), filterContext, filterGrContext);
     return source;
 }
 
@@ -581,7 +581,7 @@ PassOwnPtr<CCScopedTexture> LayerRendererChromium::drawBackgroundFilters(Drawing
     deviceRect.move(-left, -top);
     deviceRect.expand(left + right, top + bottom);
 
-    deviceRect.intersect(frame.currentRenderPass->framebufferOutputRect());
+    deviceRect.intersect(frame.currentRenderPass->outputRect());
 
     OwnPtr<CCScopedTexture> deviceBackgroundTexture = CCScopedTexture::create(m_resourceProvider);
     if (!getFramebufferTexture(deviceBackgroundTexture.get(), deviceRect))
@@ -688,6 +688,8 @@ void LayerRendererChromium::drawRenderPassQuad(DrawingFrame& frame, const CCRend
     int shaderQuadLocation = -1;
     int shaderEdgeLocation = -1;
     int shaderMaskSamplerLocation = -1;
+    int shaderMaskTexCoordScaleLocation = -1;
+    int shaderMaskTexCoordOffsetLocation = -1;
     int shaderMatrixLocation = -1;
     int shaderAlphaLocation = -1;
     if (useAA && maskTextureId) {
@@ -698,6 +700,8 @@ void LayerRendererChromium::drawRenderPassQuad(DrawingFrame& frame, const CCRend
         shaderQuadLocation = program->vertexShader().pointLocation();
         shaderEdgeLocation = program->fragmentShader().edgeLocation();
         shaderMaskSamplerLocation = program->fragmentShader().maskSamplerLocation();
+        shaderMaskTexCoordScaleLocation = program->fragmentShader().maskTexCoordScaleLocation();
+        shaderMaskTexCoordOffsetLocation = program->fragmentShader().maskTexCoordOffsetLocation();
         shaderMatrixLocation = program->vertexShader().matrixLocation();
         shaderAlphaLocation = program->fragmentShader().alphaLocation();
     } else if (!useAA && maskTextureId) {
@@ -706,6 +710,8 @@ void LayerRendererChromium::drawRenderPassQuad(DrawingFrame& frame, const CCRend
         GLC(context(), context()->uniform1i(program->fragmentShader().samplerLocation(), 0));
 
         shaderMaskSamplerLocation = program->fragmentShader().maskSamplerLocation();
+        shaderMaskTexCoordScaleLocation = program->fragmentShader().maskTexCoordScaleLocation();
+        shaderMaskTexCoordOffsetLocation = program->fragmentShader().maskTexCoordOffsetLocation();
         shaderMatrixLocation = program->vertexShader().matrixLocation();
         shaderAlphaLocation = program->fragmentShader().alphaLocation();
     } else if (useAA && !maskTextureId) {
@@ -727,8 +733,12 @@ void LayerRendererChromium::drawRenderPassQuad(DrawingFrame& frame, const CCRend
     }
 
     if (shaderMaskSamplerLocation != -1) {
+        ASSERT(shaderMaskTexCoordScaleLocation != 1);
+        ASSERT(shaderMaskTexCoordOffsetLocation != 1);
         GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE1));
         GLC(context(), context()->uniform1i(shaderMaskSamplerLocation, 1));
+        GLC(context(), context()->uniform2f(shaderMaskTexCoordScaleLocation, quad->maskTexCoordScaleX(), quad->maskTexCoordScaleY()));
+        GLC(context(), context()->uniform2f(shaderMaskTexCoordOffsetLocation, quad->maskTexCoordOffsetX(), quad->maskTexCoordOffsetY()));
         context()->bindTexture(GraphicsContext3D::TEXTURE_2D, maskTextureId);
         GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE0));
     }
@@ -790,7 +800,7 @@ static void tileUniformLocation(T program, TileProgramUniforms& uniforms)
 
 void LayerRendererChromium::drawTileQuad(DrawingFrame& frame, const CCTileDrawQuad* quad)
 {
-    const IntRect& tileRect = quad->quadVisibleRect();
+    IntRect tileRect = quad->quadVisibleRect();
 
     FloatRect clampRect(tileRect);
     // Clamp texture coordinates to avoid sampling outside the layer
@@ -807,7 +817,7 @@ void LayerRendererChromium::drawTileQuad(DrawingFrame& frame, const CCTileDrawQu
     FloatSize clampOffset = clampRect.minXMinYCorner() - FloatRect(tileRect).minXMinYCorner();
 
     FloatPoint textureOffset = quad->textureOffset() + clampOffset +
-                               IntPoint(quad->quadVisibleRect().location() - quad->quadRect().location());
+                               IntPoint(tileRect.location() - quad->quadRect().location());
 
     // Map clamping rectangle to unit square.
     float vertexTexTranslateX = -clampRect.x() / clampRect.width();
@@ -884,17 +894,21 @@ void LayerRendererChromium::drawTileQuad(DrawingFrame& frame, const CCTileDrawQu
         FloatPoint topRight(tileRect.maxX(), tileRect.y());
 
         // Map points to device space.
-        bottomRight = deviceTransform.mapPoint(bottomRight);
-        bottomLeft = deviceTransform.mapPoint(bottomLeft);
-        topLeft = deviceTransform.mapPoint(topLeft);
-        topRight = deviceTransform.mapPoint(topRight);
+        bottomRight = CCMathUtil::mapPoint(deviceTransform, bottomRight, clipped);
+        ASSERT(!clipped);
+        bottomLeft = CCMathUtil::mapPoint(deviceTransform, bottomLeft, clipped);
+        ASSERT(!clipped);
+        topLeft = CCMathUtil::mapPoint(deviceTransform, topLeft, clipped);
+        ASSERT(!clipped);
+        topRight = CCMathUtil::mapPoint(deviceTransform, topRight, clipped);
+        ASSERT(!clipped);
 
         CCLayerQuad::Edge bottomEdge(bottomRight, bottomLeft);
         CCLayerQuad::Edge leftEdge(bottomLeft, topLeft);
         CCLayerQuad::Edge topEdge(topLeft, topRight);
         CCLayerQuad::Edge rightEdge(topRight, bottomRight);
 
-        // Only apply anti-aliasing to edges not clipped during culling.
+        // Only apply anti-aliasing to edges not clipped by culling or scissoring.
         if (quad->topEdgeAA() && tileRect.y() == quad->quadRect().y())
             topEdge = deviceLayerEdges.top();
         if (quad->leftEdgeAA() && tileRect.x() == quad->quadRect().x())
@@ -1207,7 +1221,7 @@ void LayerRendererChromium::finish()
     m_context->finish();
 }
 
-bool LayerRendererChromium::swapBuffers(const IntRect& subBuffer)
+bool LayerRendererChromium::swapBuffers()
 {
     ASSERT(m_visible);
     ASSERT(!m_isFramebufferDiscarded);
@@ -1217,14 +1231,16 @@ bool LayerRendererChromium::swapBuffers(const IntRect& subBuffer)
 
     if (m_capabilities.usingPartialSwap) {
         // If supported, we can save significant bandwidth by only swapping the damaged/scissored region (clamped to the viewport)
-        IntRect clippedSubBuffer = subBuffer;
-        clippedSubBuffer.intersect(IntRect(IntPoint::zero(), viewportSize()));
-        int flippedYPosOfRectBottom = viewportHeight() - clippedSubBuffer.y() - clippedSubBuffer.height();
-        m_context->postSubBufferCHROMIUM(clippedSubBuffer.x(), flippedYPosOfRectBottom, clippedSubBuffer.width(), clippedSubBuffer.height());
-    } else
+        m_swapBufferRect.intersect(IntRect(IntPoint(), viewportSize()));
+        int flippedYPosOfRectBottom = viewportHeight() - m_swapBufferRect.y() - m_swapBufferRect.height();
+        m_context->postSubBufferCHROMIUM(m_swapBufferRect.x(), flippedYPosOfRectBottom, m_swapBufferRect.width(), m_swapBufferRect.height());
+    } else {
         // Note that currently this has the same effect as swapBuffers; we should
         // consider exposing a different entry point on WebGraphicsContext3D.
         m_context->prepareTexture();
+    }
+
+    m_swapBufferRect = IntRect();
 
     return true;
 }
@@ -1308,8 +1324,8 @@ void LayerRendererChromium::getFramebufferPixels(void *pixels, const IntRect& re
 
     bool doWorkaround = needsIOSurfaceReadbackWorkaround();
 
-    Platform3DObject temporaryTexture = NullPlatform3DObject;
-    Platform3DObject temporaryFBO = NullPlatform3DObject;
+    Platform3DObject temporaryTexture = 0;
+    Platform3DObject temporaryFBO = 0;
 
     if (doWorkaround) {
         // On Mac OS X, calling glReadPixels against an FBO whose color attachment is an
@@ -1380,19 +1396,16 @@ bool LayerRendererChromium::useRenderPass(DrawingFrame& frame, const CCRenderPas
     if (renderPass == frame.rootRenderPass) {
         frame.currentFramebufferLock.clear();
         GLC(m_context, m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, 0));
-        setDrawFramebufferRect(frame, renderPass->framebufferOutputRect(), true);
+        setDrawFramebufferRect(frame, renderPass->outputRect(), true);
         return true;
     }
 
     CachedTexture* texture = m_renderPassTextures.get(renderPass->id());
     ASSERT(texture);
-
-    texture->setIsComplete(!renderPass->hasOcclusionFromOutsideTargetSurface());
-
     if (!texture->id() && !texture->allocate(CCRenderer::ImplPool, renderPassTextureSize(renderPass), renderPassTextureFormat(renderPass), CCResourceProvider::TextureUsageFramebuffer))
         return false;
 
-    return bindFramebufferToTexture(frame, texture, renderPass->framebufferOutputRect());
+    return bindFramebufferToTexture(frame, texture, renderPass->outputRect());
 }
 
 bool LayerRendererChromium::useScopedTexture(DrawingFrame& frame, const CCScopedTexture* texture, const IntRect& viewportRect)
@@ -1429,7 +1442,7 @@ bool LayerRendererChromium::bindFramebufferToTexture(DrawingFrame& frame, const
 // scissorRect has its origin at the top left corner of the current visible rect.
 void LayerRendererChromium::setScissorToRect(DrawingFrame& frame, const IntRect& scissorRect)
 {
-    IntRect framebufferOutputRect = frame.currentRenderPass->framebufferOutputRect();
+    IntRect framebufferOutputRect = frame.currentRenderPass->outputRect();
 
     GLC(m_context, m_context->enable(GraphicsContext3D::SCISSOR_TEST));
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index 6842f0cc5..179103359 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -80,14 +80,14 @@ public:
     virtual void decideRenderPassAllocationsForFrame(const CCRenderPassList&) OVERRIDE;
     virtual bool haveCachedResourcesForRenderPassId(int id) const OVERRIDE;
 
-    virtual void drawFrame(const CCRenderPassList&, const CCRenderPassIdHashMap&, const FloatRect& rootScissorRect) OVERRIDE;
+    virtual void drawFrame(const CCRenderPassList&, const CCRenderPassIdHashMap&) OVERRIDE;
 
     // waits for rendering to finish
     virtual void finish() OVERRIDE;
 
     virtual void doNoOp() OVERRIDE;
     // puts backbuffer onscreen
-    virtual bool swapBuffers(const IntRect& subBuffer) OVERRIDE;
+    virtual bool swapBuffers() OVERRIDE;
 
     static void debugGLCall(WebKit::WebGraphicsContext3D*, const char* command, const char* file, int line);
 
@@ -122,6 +122,8 @@ private:
         const CCScopedTexture* currentTexture;
         OwnPtr<CCScopedLockResourceForWrite> currentFramebufferLock;
 
+        FloatRect rootDamageRect;
+
         WebKit::WebTransformationMatrix projectionMatrix;
         WebKit::WebTransformationMatrix windowMatrix;
 
@@ -135,10 +137,10 @@ private:
     static void toGLMatrix(float*, const WebKit::WebTransformationMatrix&);
 
     void beginDrawingFrame();
-    void drawRenderPass(DrawingFrame&, const CCRenderPass*, const FloatRect& framebufferDamageRect);
+    void drawRenderPass(DrawingFrame&, const CCRenderPass*);
     void finishDrawingFrame();
 
-    void drawQuad(DrawingFrame&, const CCDrawQuad*);
+    void drawQuad(DrawingFrame&, const CCDrawQuad*, FloatRect scissorRect);
     void drawCheckerboardQuad(DrawingFrame&, const CCCheckerboardDrawQuad*);
     void drawDebugBorderQuad(DrawingFrame&, const CCDebugBorderDrawQuad*);
     PassOwnPtr<CCScopedTexture> drawBackgroundFilters(DrawingFrame&, const CCRenderPassDrawQuad*, const WebKit::WebFilterOperations&, const WebKit::WebTransformationMatrix& deviceTransform);
@@ -167,7 +169,7 @@ private:
 
     bool bindFramebufferToTexture(DrawingFrame&, const CCScopedTexture*, const IntRect& viewportRect);
 
-    void clearFramebuffer(DrawingFrame&, const FloatRect& framebufferDamageRect);
+    void clearFramebuffer(DrawingFrame&);
 
     bool makeContextCurrent();
 
@@ -279,6 +281,7 @@ private:
 
     WebKit::WebGraphicsContext3D* m_context;
 
+    IntRect m_swapBufferRect;
     bool m_isViewportChanged;
     bool m_isFramebufferDiscarded;
     bool m_isUsingBindUniform;
diff --git a/Source/WebCore/platform/graphics/chromium/LinkHighlight.h b/Source/WebCore/platform/graphics/chromium/LinkHighlight.h
index 1ccc3ebdf..2f97cab79 100644
--- a/Source/WebCore/platform/graphics/chromium/LinkHighlight.h
+++ b/Source/WebCore/platform/graphics/chromium/LinkHighlight.h
@@ -28,7 +28,7 @@
 
 #include "ContentLayerChromium.h"
 #include "Path.h"
-#include "cc/CCLayerAnimationDelegate.h"
+#include <public/WebAnimationDelegate.h>
 #include <wtf/RefPtr.h>
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -37,7 +37,7 @@ namespace WebCore {
 
 class GraphicsLayerChromium;
 
-class LinkHighlight : public RefCounted<LinkHighlight>, public ContentLayerDelegate, public CCLayerAnimationDelegate {
+class LinkHighlight : public RefCounted<LinkHighlight>, public ContentLayerDelegate, public WebKit::WebAnimationDelegate {
 public:
     static PassRefPtr<LinkHighlight> create(GraphicsLayerChromium* parent, const Path&, int animationId, int groupId);
     virtual ~LinkHighlight();
@@ -47,7 +47,7 @@ public:
     // ContentLayerDelegate implementation.
     virtual void paintContents(SkCanvas*, const IntRect& clipRect, FloatRect& opaque) OVERRIDE;
 
-    // CCLayerAnimationDelegate implementation.
+    // WebAnimationDelegate implementation.
     virtual void notifyAnimationStarted(double time) OVERRIDE;
     virtual void notifyAnimationFinished(double time) OVERRIDE;
 
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp
deleted file mode 100644
index 7a1f117d3..000000000
--- a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include "PlatformCanvas.h"
-
-#include "GraphicsContext.h"
-
-#include "NativeImageSkia.h"
-#include "PlatformContextSkia.h"
-#include "SkColorPriv.h"
-#include "skia/ext/platform_canvas.h"
-
-namespace WebCore {
-
-PlatformCanvas::PlatformCanvas()
-    : m_opaque(false)
-{
-}
-
-PlatformCanvas::~PlatformCanvas()
-{
-}
-
-void PlatformCanvas::resize(const IntSize& size)
-{
-    if (m_size == size)
-        return;
-    m_size = size;
-    createBackingCanvas();
-}
-
-void PlatformCanvas::setOpaque(bool opaque)
-{
-    if (opaque == m_opaque)
-        return;
-
-    m_opaque = opaque;
-    createBackingCanvas();
-}
-
-void PlatformCanvas::createBackingCanvas()
-{
-    if (m_size.isEmpty())
-        return;
-
-    m_skiaCanvas = adoptPtr(skia::CreateBitmapCanvas(m_size.width(), m_size.height(), m_opaque));
-}
-
-PlatformCanvas::AutoLocker::AutoLocker(PlatformCanvas* canvas)
-    : m_canvas(canvas)
-{
-    if (m_canvas->m_skiaCanvas) {
-        m_bitmap = &m_canvas->m_skiaCanvas->getDevice()->accessBitmap(false);
-        m_bitmap->lockPixels();
-    } else
-        m_bitmap = 0;
-}
-
-PlatformCanvas::AutoLocker::~AutoLocker()
-{
-    if (m_bitmap)
-        m_bitmap->unlockPixels();
-}
-
-const uint8_t* PlatformCanvas::AutoLocker::pixels() const
-{
-    if (m_bitmap && m_bitmap->config() == SkBitmap::kARGB_8888_Config)
-        return static_cast<const uint8_t*>(m_bitmap->getPixels());
-    return 0;
-}
-
-PlatformCanvas::Painter::Painter(PlatformCanvas* canvas, PlatformCanvas::Painter::TextOption option)
-{
-    m_skiaContext = adoptPtr(new PlatformContextSkia(canvas->m_skiaCanvas.get()));
-
-    m_context = adoptPtr(new GraphicsContext(reinterpret_cast<PlatformGraphicsContext*>(m_skiaContext.get())));
-    context()->save();
-}
-
-PlatformCanvas::Painter::~Painter()
-{
-    context()->restore();
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h
deleted file mode 100644
index 865f3d521..000000000
--- a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef PlatformCanvas_h
-#define PlatformCanvas_h
-
-#include "IntSize.h"
-#include <stdint.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/OwnPtr.h>
-
-class SkBitmap;
-class SkCanvas;
-
-namespace WebCore {
-
-class GraphicsContext;
-class PlatformContextSkia;
-
-// A 2D buffer of pixels with an associated GraphicsContext.
-class PlatformCanvas {
-    WTF_MAKE_NONCOPYABLE(PlatformCanvas);
-public:
-    PlatformCanvas();
-    ~PlatformCanvas();
-
-    // Scoped lock class to get temporary access to this canvas's pixels.
-    class AutoLocker {
-        WTF_MAKE_NONCOPYABLE(AutoLocker);
-    public:
-        explicit AutoLocker(PlatformCanvas*);
-        ~AutoLocker();
-
-        const uint8_t* pixels() const;
-    private:
-        PlatformCanvas* m_canvas;
-        const SkBitmap* m_bitmap;
-    };
-
-    // Scoped lock class to get temporary access to paint into this canvas.
-    class Painter {
-        WTF_MAKE_NONCOPYABLE(Painter);
-    public:
-        enum TextOption { GrayscaleText, SubpixelText };
-
-        Painter(PlatformCanvas*, TextOption);
-        // Destructor restores canvas context to pre-construction state.
-        ~Painter();
-
-        GraphicsContext* context() const { return m_context.get(); }
-        PlatformContextSkia* skiaContext() const { return m_skiaContext.get(); }
-    private:
-        OwnPtr<GraphicsContext> m_context;
-        OwnPtr<PlatformContextSkia> m_skiaContext;
-    };
-
-    void resize(const IntSize&);
-    IntSize size() const { return m_size; }
-
-    void setOpaque(bool);
-    bool opaque() const { return m_opaque; }
-
-private:
-    void createBackingCanvas();
-
-    OwnPtr<SkCanvas> m_skiaCanvas;
-    IntSize m_size;
-    bool m_opaque;
-};
-
-} // namespace WebCore
-
-#endif
diff --git a/Source/WebCore/platform/graphics/chromium/ProgramBinding.cpp b/Source/WebCore/platform/graphics/chromium/ProgramBinding.cpp
index 1abc2186a..2f6ca2286 100644
--- a/Source/WebCore/platform/graphics/chromium/ProgramBinding.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ProgramBinding.cpp
@@ -65,7 +65,7 @@ static bool contextLost(WebGraphicsContext3D* context)
 
 void ProgramBindingBase::init(WebGraphicsContext3D* context, const String& vertexShader, const String& fragmentShader)
 {
-    TRACE_EVENT("ProgramBindingBase::init", this, 0);
+    TRACE_EVENT0("cc", "ProgramBindingBase::init");
     m_vertexShaderId = loadShader(context, GraphicsContext3D::VERTEX_SHADER, vertexShader);
     if (!m_vertexShaderId) {
         if (!contextLost(context))
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
index 7c280a0ae..ee9be6748 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
@@ -60,11 +60,5 @@ FloatRect RenderSurfaceChromium::drawableContentRect() const
     return drawableContentRect;
 }
 
-FloatRect RenderSurfaceChromium::computeRootScissorRectInCurrentSurface(const FloatRect& rootScissorRect) const
-{
-    WebTransformationMatrix inverseScreenSpaceTransform = m_screenSpaceTransform.inverse();
-    return CCMathUtil::projectClippedRect(inverseScreenSpaceTransform, rootScissorRect);
-}
-
 }
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
index 034be58a4..7b11f6aac 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
@@ -79,16 +79,12 @@ public:
     const IntRect& clipRect() const { return m_clipRect; }
     void setClipRect(const IntRect& clipRect) { m_clipRect = clipRect; }
 
-    const IntRect& scissorRect() const { return m_scissorRect; }
-    void setScissorRect(const IntRect& scissorRect) { m_scissorRect = scissorRect; }
-
     void clearLayerList() { m_layerList.clear(); }
     Vector<RefPtr<LayerChromium> >& layerList() { return m_layerList; }
 
     void setNearestAncestorThatMovesPixels(RenderSurfaceChromium* surface) { m_nearestAncestorThatMovesPixels = surface; }
     const RenderSurfaceChromium* nearestAncestorThatMovesPixels() const { return m_nearestAncestorThatMovesPixels; }
 
-    FloatRect computeRootScissorRectInCurrentSurface(const FloatRect& rootScissorRect) const;
 private:
     LayerChromium* m_owningLayer;
 
@@ -107,10 +103,6 @@ private:
     // Uses the space of the surface's target surface.
     IntRect m_clipRect;
 
-    // During drawing, identifies the region outside of which nothing should be drawn.
-    // Uses the space of the surface's target surface.
-    IntRect m_scissorRect;
-
     Vector<RefPtr<LayerChromium> > m_layerList;
 
     // The nearest ancestor target surface that will contain the contents of this surface, and that is going
diff --git a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp
index 06c6079fe..a0fbf5c44 100644
--- a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp
@@ -29,14 +29,13 @@
 #include "ScrollbarLayerChromium.h"
 
 #include "BitmapCanvasLayerTextureUpdater.h"
-#include "GraphicsContext.h"
 #include "LayerPainterChromium.h"
-#include "PlatformContextSkia.h"
-#include "Scrollbar.h"
-#include "ScrollbarThemeComposite.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCScrollbarLayerImpl.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateQueue.h"
+#include <public/WebRect.h>
+
+using WebKit::WebRect;
 
 namespace WebCore {
 
@@ -45,27 +44,18 @@ PassOwnPtr<CCLayerImpl> ScrollbarLayerChromium::createCCLayerImpl()
     return CCScrollbarLayerImpl::create(id());
 }
 
-PassRefPtr<ScrollbarLayerChromium> ScrollbarLayerChromium::create(Scrollbar* scrollbar, int scrollLayerId)
+PassRefPtr<ScrollbarLayerChromium> ScrollbarLayerChromium::create(PassOwnPtr<WebKit::WebScrollbar> scrollbar, WebKit::WebScrollbarThemePainter painter, PassOwnPtr<WebKit::WebScrollbarThemeGeometry> geometry, int scrollLayerId)
 {
-    return adoptRef(new ScrollbarLayerChromium(scrollbar, scrollLayerId));
+    return adoptRef(new ScrollbarLayerChromium(scrollbar, painter, geometry, scrollLayerId));
 }
 
-ScrollbarLayerChromium::ScrollbarLayerChromium(Scrollbar* scrollbar, int scrollLayerId)
+ScrollbarLayerChromium::ScrollbarLayerChromium(PassOwnPtr<WebKit::WebScrollbar> scrollbar, WebKit::WebScrollbarThemePainter painter, PassOwnPtr<WebKit::WebScrollbarThemeGeometry> geometry, int scrollLayerId)
     : m_scrollbar(scrollbar)
+    , m_painter(painter)
+    , m_geometry(geometry)
     , m_scrollLayerId(scrollLayerId)
     , m_textureFormat(GraphicsContext3D::INVALID_ENUM)
-    , m_scrollbarOverlayStyle(scrollbar->scrollbarOverlayStyle())
-    , m_isScrollableAreaActive(scrollbar->isScrollableAreaActive())
-    , m_isScrollViewScrollbar(scrollbar->isScrollViewScrollbar())
-    , m_orientation(scrollbar->orientation())
-    , m_controlSize(scrollbar->controlSize())
-{
-}
-
-ScrollbarThemeComposite* ScrollbarLayerChromium::theme() const
 {
-    // All Chromium scrollbars are ScrollbarThemeComposite-derived.
-    return static_cast<ScrollbarThemeComposite*>(m_scrollbar->theme());
 }
 
 void ScrollbarLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
@@ -74,7 +64,10 @@ void ScrollbarLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
 
     CCScrollbarLayerImpl* scrollbarLayer = static_cast<CCScrollbarLayerImpl*>(layer);
 
-    scrollbarLayer->setScrollbarOverlayStyle(m_scrollbarOverlayStyle);
+    if (!scrollbarLayer->scrollbarGeometry())
+        scrollbarLayer->setScrollbarGeometry(adoptPtr(m_geometry->clone()));
+
+    scrollbarLayer->setScrollbarData(m_scrollbar.get());
 
     if (m_backTrack && m_backTrack->texture()->haveBackingTexture())
         scrollbarLayer->setBackTrackResourceId(m_backTrack->texture()->resourceId());
@@ -90,105 +83,95 @@ void ScrollbarLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
         scrollbarLayer->setThumbResourceId(m_thumb->texture()->resourceId());
     else
         scrollbarLayer->setThumbResourceId(0);
-
-    Vector<IntRect> tickmarks;
-    m_scrollbar->getTickmarks(tickmarks);
-    scrollbarLayer->setTickmarks(tickmarks);
-
-    scrollbarLayer->setIsScrollableAreaActive(m_isScrollableAreaActive);
-    scrollbarLayer->setIsScrollViewScrollbar(m_isScrollViewScrollbar);
-
-    scrollbarLayer->setOrientation(m_orientation);
-
-    scrollbarLayer->setControlSize(m_controlSize);
-
-    scrollbarLayer->setPressedPart(m_scrollbar->pressedPart());
-    scrollbarLayer->setHoveredPart(m_scrollbar->hoveredPart());
-
-    scrollbarLayer->setEnabled(m_scrollbar->enabled());
 }
 
 class ScrollbarBackgroundPainter : public LayerPainterChromium {
     WTF_MAKE_NONCOPYABLE(ScrollbarBackgroundPainter);
 public:
-    static PassOwnPtr<ScrollbarBackgroundPainter> create(ScrollbarThemeClient* scrollbar, ScrollbarThemeComposite* theme, ScrollbarPart trackPart)
+    static PassOwnPtr<ScrollbarBackgroundPainter> create(WebKit::WebScrollbar* scrollbar, WebKit::WebScrollbarThemePainter painter, WebKit::WebScrollbarThemeGeometry* geometry, WebKit::WebScrollbar::ScrollbarPart trackPart)
     {
-        return adoptPtr(new ScrollbarBackgroundPainter(scrollbar, theme, trackPart));
+        return adoptPtr(new ScrollbarBackgroundPainter(scrollbar, painter, geometry, trackPart));
     }
 
-    virtual void paint(SkCanvas* canvas, const IntRect& contentRect, FloatRect&) OVERRIDE
+    virtual void paint(SkCanvas* skCanvas, const IntRect& contentRect, FloatRect&) OVERRIDE
     {
-        PlatformContextSkia platformContext(canvas);
-        platformContext.setDrawingToImageBuffer(true);
-        GraphicsContext context(&platformContext);
-
+        WebKit::WebCanvas* canvas = skCanvas;
         // The following is a simplification of ScrollbarThemeComposite::paint.
-        m_theme->paintScrollbarBackground(&context, m_scrollbar);
+        WebKit::WebRect contentWebRect(contentRect.x(), contentRect.y(), contentRect.width(), contentRect.height());
+        m_painter.paintScrollbarBackground(canvas, contentWebRect);
 
-        if (m_theme->hasButtons(m_scrollbar)) {
-            IntRect backButtonStartPaintRect = m_theme->backButtonRect(m_scrollbar, BackButtonStartPart, true);
-            m_theme->paintButton(&context, m_scrollbar, backButtonStartPaintRect, BackButtonStartPart);
+        if (m_geometry->hasButtons(m_scrollbar)) {
+            WebRect backButtonStartPaintRect = m_geometry->backButtonStartRect(m_scrollbar);
+            m_painter.paintBackButtonStart(canvas, backButtonStartPaintRect);
 
-            IntRect backButtonEndPaintRect = m_theme->backButtonRect(m_scrollbar, BackButtonEndPart, true);
-            m_theme->paintButton(&context, m_scrollbar, backButtonEndPaintRect, BackButtonEndPart);
+            WebRect backButtonEndPaintRect = m_geometry->backButtonEndRect(m_scrollbar);
+            m_painter.paintBackButtonEnd(canvas, backButtonEndPaintRect);
 
-            IntRect forwardButtonStartPaintRect = m_theme->forwardButtonRect(m_scrollbar, ForwardButtonStartPart, true);
-            m_theme->paintButton(&context, m_scrollbar, forwardButtonStartPaintRect, ForwardButtonStartPart);
+            WebRect forwardButtonStartPaintRect = m_geometry->forwardButtonStartRect(m_scrollbar);
+            m_painter.paintForwardButtonStart(canvas, forwardButtonStartPaintRect);
 
-            IntRect forwardButtonEndPaintRect = m_theme->forwardButtonRect(m_scrollbar, ForwardButtonEndPart, true);
-            m_theme->paintButton(&context, m_scrollbar, forwardButtonEndPaintRect, ForwardButtonEndPart);
+            WebRect forwardButtonEndPaintRect = m_geometry->forwardButtonEndRect(m_scrollbar);
+            m_painter.paintForwardButtonEnd(canvas, forwardButtonEndPaintRect);
         }
 
-        IntRect trackPaintRect = m_theme->trackRect(m_scrollbar, true);
-        m_theme->paintTrackBackground(&context, m_scrollbar, trackPaintRect);
+        WebRect trackPaintRect = m_geometry->trackRect(m_scrollbar);
+        m_painter.paintTrackBackground(canvas, trackPaintRect);
 
-        bool thumbPresent = m_theme->hasThumb(m_scrollbar);
-        if (thumbPresent)
-            m_theme->paintTrackPiece(&context, m_scrollbar, trackPaintRect, m_trackPart);
+        bool thumbPresent = m_geometry->hasThumb(m_scrollbar);
+        if (thumbPresent) {
+            if (m_trackPart == WebKit::WebScrollbar::ForwardTrackPart)
+                m_painter.paintForwardTrackPart(canvas, trackPaintRect);
+            else
+                m_painter.paintBackTrackPart(canvas, trackPaintRect);
+        }
 
-        m_theme->paintTickmarks(&context, m_scrollbar, trackPaintRect);
+        m_painter.paintTickmarks(canvas, trackPaintRect);
     }
 private:
-    ScrollbarBackgroundPainter(ScrollbarThemeClient* scrollbar, ScrollbarThemeComposite* theme, ScrollbarPart trackPart)
+    ScrollbarBackgroundPainter(WebKit::WebScrollbar* scrollbar, WebKit::WebScrollbarThemePainter painter, WebKit::WebScrollbarThemeGeometry* geometry, WebKit::WebScrollbar::ScrollbarPart trackPart)
         : m_scrollbar(scrollbar)
-        , m_theme(theme)
+        , m_painter(painter)
+        , m_geometry(geometry)
         , m_trackPart(trackPart)
     {
     }
 
-    ScrollbarThemeClient* m_scrollbar;
-    ScrollbarThemeComposite* m_theme;
-    ScrollbarPart m_trackPart;
+    WebKit::WebScrollbar* m_scrollbar;
+    WebKit::WebScrollbarThemePainter m_painter;
+    WebKit::WebScrollbarThemeGeometry* m_geometry;
+    WebKit::WebScrollbar::ScrollbarPart m_trackPart;
 };
 
 class ScrollbarThumbPainter : public LayerPainterChromium {
     WTF_MAKE_NONCOPYABLE(ScrollbarThumbPainter);
 public:
-    static PassOwnPtr<ScrollbarThumbPainter> create(ScrollbarThemeClient* scrollbar, ScrollbarThemeComposite* theme)
+    static PassOwnPtr<ScrollbarThumbPainter> create(WebKit::WebScrollbar* scrollbar, WebKit::WebScrollbarThemePainter painter, WebKit::WebScrollbarThemeGeometry* geometry)
     {
-        return adoptPtr(new ScrollbarThumbPainter(scrollbar, theme));
+        return adoptPtr(new ScrollbarThumbPainter(scrollbar, painter, geometry));
     }
 
-    virtual void paint(SkCanvas* canvas, const IntRect& contentRect, FloatRect& opaque) OVERRIDE
+    virtual void paint(SkCanvas* skCanvas, const IntRect& contentRect, FloatRect& opaque) OVERRIDE
     {
-        PlatformContextSkia platformContext(canvas);
-        platformContext.setDrawingToImageBuffer(true);
-        GraphicsContext context(&platformContext);
+        WebKit::WebCanvas* canvas = skCanvas;
 
         // Consider the thumb to be at the origin when painting.
-        IntRect thumbRect = IntRect(IntPoint(), m_theme->thumbRect(m_scrollbar).size());
-        m_theme->paintThumb(&context, m_scrollbar, thumbRect);
+        WebRect thumbRect = m_geometry->thumbRect(m_scrollbar);
+        thumbRect.x = 0;
+        thumbRect.y = 0;
+        m_painter.paintThumb(canvas, thumbRect);
     }
 
 private:
-    ScrollbarThumbPainter(ScrollbarThemeClient* scrollbar, ScrollbarThemeComposite* theme)
+    ScrollbarThumbPainter(WebKit::WebScrollbar* scrollbar, WebKit::WebScrollbarThemePainter painter, WebKit::WebScrollbarThemeGeometry* geometry)
         : m_scrollbar(scrollbar)
-        , m_theme(theme)
+        , m_painter(painter)
+        , m_geometry(geometry)
     {
     }
 
-    ScrollbarThemeClient* m_scrollbar;
-    ScrollbarThemeComposite* m_theme;
+    WebKit::WebScrollbar* m_scrollbar;
+    WebKit::WebScrollbarThemePainter m_painter;
+    WebKit::WebScrollbarThemeGeometry* m_geometry;
 };
 
 void ScrollbarLayerChromium::setLayerTreeHost(CCLayerTreeHost* host)
@@ -208,25 +191,25 @@ void ScrollbarLayerChromium::createTextureUpdaterIfNeeded()
     m_textureFormat = layerTreeHost()->layerRendererCapabilities().bestTextureFormat;
 
     if (!m_backTrackUpdater)
-        m_backTrackUpdater = BitmapCanvasLayerTextureUpdater::create(ScrollbarBackgroundPainter::create(m_scrollbar.get(), theme(), BackTrackPart));
+        m_backTrackUpdater = BitmapCanvasLayerTextureUpdater::create(ScrollbarBackgroundPainter::create(m_scrollbar.get(), m_painter, m_geometry.get(), WebKit::WebScrollbar::BackTrackPart));
     if (!m_backTrack)
         m_backTrack = m_backTrackUpdater->createTexture(layerTreeHost()->contentsTextureManager());
 
     // Only create two-part track if we think the two parts could be different in appearance.
     if (m_scrollbar->isCustomScrollbar()) {
         if (!m_foreTrackUpdater)
-            m_foreTrackUpdater = BitmapCanvasLayerTextureUpdater::create(ScrollbarBackgroundPainter::create(m_scrollbar.get(), theme(), ForwardTrackPart));
+            m_foreTrackUpdater = BitmapCanvasLayerTextureUpdater::create(ScrollbarBackgroundPainter::create(m_scrollbar.get(), m_painter, m_geometry.get(), WebKit::WebScrollbar::ForwardTrackPart));
         if (!m_foreTrack)
             m_foreTrack = m_foreTrackUpdater->createTexture(layerTreeHost()->contentsTextureManager());
     }
 
     if (!m_thumbUpdater)
-        m_thumbUpdater = BitmapCanvasLayerTextureUpdater::create(ScrollbarThumbPainter::create(m_scrollbar.get(), theme()));
+        m_thumbUpdater = BitmapCanvasLayerTextureUpdater::create(ScrollbarThumbPainter::create(m_scrollbar.get(), m_painter, m_geometry.get()));
     if (!m_thumb)
         m_thumb = m_thumbUpdater->createTexture(layerTreeHost()->contentsTextureManager());
 }
 
-void ScrollbarLayerChromium::updatePart(LayerTextureUpdater* painter, LayerTextureUpdater::Texture* texture, const IntRect& rect, CCTextureUpdater& updater, CCRenderingStats& stats)
+void ScrollbarLayerChromium::updatePart(LayerTextureUpdater* painter, LayerTextureUpdater::Texture* texture, const IntRect& rect, CCTextureUpdateQueue& queue, CCRenderingStats& stats)
 {
     // Skip painting and uploading if there are no invalidations and
     // we already have valid texture data.
@@ -246,7 +229,8 @@ void ScrollbarLayerChromium::updatePart(LayerTextureUpdater* painter, LayerTextu
     texture->prepareRect(rect, stats);
 
     IntRect destRect(IntPoint(), rect.size());
-    updater.appendFullUpdate(texture, rect, destRect);
+    TextureUploader::Parameters upload = { texture, rect, destRect };
+    queue.appendFullUpload(upload);
 }
 
 
@@ -267,29 +251,30 @@ void ScrollbarLayerChromium::setTexturePriorities(const CCPriorityCalculator&)
         m_foreTrack->texture()->setRequestPriority(CCPriorityCalculator::uiPriority(drawsToRoot));
     }
     if (m_thumb) {
-        IntSize thumbSize = theme()->thumbRect(m_scrollbar.get()).size();
-        m_thumb->texture()->setDimensions(thumbSize, m_textureFormat);
+        WebKit::WebRect thumbRect = m_geometry->thumbRect(m_scrollbar.get());
+        m_thumb->texture()->setDimensions(IntSize(thumbRect.width, thumbRect.height), m_textureFormat);
         m_thumb->texture()->setRequestPriority(CCPriorityCalculator::uiPriority(drawsToRoot));
     }
 }
 
-void ScrollbarLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTracker*, CCRenderingStats& stats)
+void ScrollbarLayerChromium::update(CCTextureUpdateQueue& queue, const CCOcclusionTracker*, CCRenderingStats& stats)
 {
     if (contentBounds().isEmpty())
         return;
 
     createTextureUpdaterIfNeeded();
 
-    IntPoint scrollbarOrigin(m_scrollbar->x(), m_scrollbar->y());
+    IntPoint scrollbarOrigin(m_scrollbar->location().x, m_scrollbar->location().y);
     IntRect contentRect(scrollbarOrigin, contentBounds());
-    updatePart(m_backTrackUpdater.get(), m_backTrack.get(), contentRect, updater, stats);
+    updatePart(m_backTrackUpdater.get(), m_backTrack.get(), contentRect, queue, stats);
     if (m_foreTrack && m_foreTrackUpdater)
-        updatePart(m_foreTrackUpdater.get(), m_foreTrack.get(), contentRect, updater, stats);
+        updatePart(m_foreTrackUpdater.get(), m_foreTrack.get(), contentRect, queue, stats);
 
     // Consider the thumb to be at the origin when painting.
-    IntRect thumbRect = IntRect(IntPoint(), theme()->thumbRect(m_scrollbar.get()).size());
-    if (!thumbRect.isEmpty())
-        updatePart(m_thumbUpdater.get(), m_thumb.get(), thumbRect, updater, stats);
+    WebKit::WebRect thumbRect = m_geometry->thumbRect(m_scrollbar.get());
+    IntRect originThumbRect = IntRect(0, 0, thumbRect.width, thumbRect.height);
+    if (!originThumbRect.isEmpty())
+        updatePart(m_thumbUpdater.get(), m_thumb.get(), originThumbRect, queue, stats);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h
index 17a7ace82..115fb6610 100644
--- a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h
@@ -30,39 +30,42 @@
 
 #include "LayerChromium.h"
 #include "LayerTextureUpdater.h"
-#include "ScrollTypes.h"
+#include <public/WebScrollbar.h>
+#include <public/WebScrollbarThemeGeometry.h>
+#include <public/WebScrollbarThemePainter.h>
 
 namespace WebCore {
 
 class Scrollbar;
 class ScrollbarThemeComposite;
-class CCTextureUpdater;
+class CCTextureUpdateQueue;
 
 class ScrollbarLayerChromium : public LayerChromium {
 public:
-    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
-    static PassRefPtr<ScrollbarLayerChromium> create(Scrollbar*, int scrollLayerId);
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl() OVERRIDE;
+    static PassRefPtr<ScrollbarLayerChromium> create(PassOwnPtr<WebKit::WebScrollbar>, WebKit::WebScrollbarThemePainter, PassOwnPtr<WebKit::WebScrollbarThemeGeometry>, int scrollLayerId);
 
     // LayerChromium interface
     virtual void setTexturePriorities(const CCPriorityCalculator&) OVERRIDE;
-    virtual void update(CCTextureUpdater&, const CCOcclusionTracker*, CCRenderingStats&) OVERRIDE;
+    virtual void update(CCTextureUpdateQueue&, const CCOcclusionTracker*, CCRenderingStats&) OVERRIDE;
     virtual void setLayerTreeHost(CCLayerTreeHost*) OVERRIDE;
     virtual void pushPropertiesTo(CCLayerImpl*) OVERRIDE;
 
     int scrollLayerId() const { return m_scrollLayerId; }
     void setScrollLayerId(int id) { m_scrollLayerId = id; }
 
-    virtual ScrollbarLayerChromium* toScrollbarLayerChromium() { return this; }
+    virtual ScrollbarLayerChromium* toScrollbarLayerChromium() OVERRIDE { return this; }
 
 protected:
-    ScrollbarLayerChromium(Scrollbar*, int scrollLayerId);
+    ScrollbarLayerChromium(PassOwnPtr<WebKit::WebScrollbar>, WebKit::WebScrollbarThemePainter, PassOwnPtr<WebKit::WebScrollbarThemeGeometry>, int scrollLayerId);
 
 private:
-    ScrollbarThemeComposite* theme() const;
-    void updatePart(LayerTextureUpdater*, LayerTextureUpdater::Texture*, const IntRect&, CCTextureUpdater&, CCRenderingStats&);
+    void updatePart(LayerTextureUpdater*, LayerTextureUpdater::Texture*, const IntRect&, CCTextureUpdateQueue&, CCRenderingStats&);
     void createTextureUpdaterIfNeeded();
 
-    RefPtr<Scrollbar> m_scrollbar;
+    OwnPtr<WebKit::WebScrollbar> m_scrollbar;
+    WebKit::WebScrollbarThemePainter m_painter;
+    OwnPtr<WebKit::WebScrollbarThemeGeometry> m_geometry;
     int m_scrollLayerId;
 
     GC3Denum m_textureFormat;
@@ -75,14 +78,6 @@ private:
     OwnPtr<LayerTextureUpdater::Texture> m_backTrack;
     OwnPtr<LayerTextureUpdater::Texture> m_foreTrack;
     OwnPtr<LayerTextureUpdater::Texture> m_thumb;
-
-    ScrollbarOverlayStyle m_scrollbarOverlayStyle;
-    bool m_isScrollableAreaActive;
-    bool m_isScrollViewScrollbar;
-
-    ScrollbarOrientation m_orientation;
-
-    ScrollbarControlSize m_controlSize;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
index 7ee5a21b9..8823d1a6c 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
@@ -656,6 +656,7 @@ FragmentShaderRGBATexAlphaMask::FragmentShaderRGBATexAlphaMask()
     : m_samplerLocation(-1)
     , m_maskSamplerLocation(-1)
     , m_alphaLocation(-1)
+    , m_maskTexCoordScaleLocation(-1)
 {
 }
 
@@ -665,14 +666,18 @@ void FragmentShaderRGBATexAlphaMask::init(WebGraphicsContext3D* context, unsigne
         "s_texture",
         "s_mask",
         "alpha",
+        "maskTexCoordScale",
+        "maskTexCoordOffset",
     };
-    int locations[3];
+    int locations[5];
 
     getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
 
     m_samplerLocation = locations[0];
     m_maskSamplerLocation = locations[1];
     m_alphaLocation = locations[2];
+    m_maskTexCoordScaleLocation = locations[3];
+    m_maskTexCoordOffsetLocation = locations[4];
     ASSERT(m_samplerLocation != -1 && m_maskSamplerLocation != -1 && m_alphaLocation != -1);
 }
 
@@ -683,11 +688,14 @@ String FragmentShaderRGBATexAlphaMask::getShaderString() const
         varying vec2 v_texCoord;
         uniform sampler2D s_texture;
         uniform sampler2D s_mask;
+        uniform vec2 maskTexCoordScale;
+        uniform vec2 maskTexCoordOffset;
         uniform float alpha;
         void main()
         {
             vec4 texColor = texture2D(s_texture, v_texCoord);
-            vec4 maskColor = texture2D(s_mask, v_texCoord);
+            vec2 maskTexCoord = vec2(maskTexCoordOffset.x + v_texCoord.x * maskTexCoordScale.x, maskTexCoordOffset.y + v_texCoord.y * maskTexCoordScale.y);
+            vec4 maskColor = texture2D(s_mask, maskTexCoord);
             gl_FragColor = vec4(texColor.x, texColor.y, texColor.z, texColor.w) * alpha * maskColor.w;
         }
     );
@@ -698,6 +706,7 @@ FragmentShaderRGBATexAlphaMaskAA::FragmentShaderRGBATexAlphaMaskAA()
     , m_maskSamplerLocation(-1)
     , m_alphaLocation(-1)
     , m_edgeLocation(-1)
+    , m_maskTexCoordScaleLocation(-1)
 {
 }
 
@@ -708,8 +717,10 @@ void FragmentShaderRGBATexAlphaMaskAA::init(WebGraphicsContext3D* context, unsig
         "s_mask",
         "alpha",
         "edge",
+        "maskTexCoordScale",
+        "maskTexCoordOffset",
     };
-    int locations[4];
+    int locations[6];
 
     getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
 
@@ -717,6 +728,8 @@ void FragmentShaderRGBATexAlphaMaskAA::init(WebGraphicsContext3D* context, unsig
     m_maskSamplerLocation = locations[1];
     m_alphaLocation = locations[2];
     m_edgeLocation = locations[3];
+    m_maskTexCoordScaleLocation = locations[4];
+    m_maskTexCoordOffsetLocation = locations[5];
     ASSERT(m_samplerLocation != -1 && m_maskSamplerLocation != -1 && m_alphaLocation != -1 && m_edgeLocation != -1);
 }
 
@@ -727,12 +740,15 @@ String FragmentShaderRGBATexAlphaMaskAA::getShaderString() const
         varying vec2 v_texCoord;
         uniform sampler2D s_texture;
         uniform sampler2D s_mask;
+        uniform vec2 maskTexCoordScale;
+        uniform vec2 maskTexCoordOffset;
         uniform float alpha;
         uniform vec3 edge[8];
         void main()
         {
             vec4 texColor = texture2D(s_texture, v_texCoord);
-            vec4 maskColor = texture2D(s_mask, v_texCoord);
+            vec2 maskTexCoord = vec2(maskTexCoordOffset.x + v_texCoord.x * maskTexCoordScale.x, maskTexCoordOffset.y + v_texCoord.y * maskTexCoordScale.y);
+            vec4 maskColor = texture2D(s_mask, maskTexCoord);
             vec3 pos = vec3(gl_FragCoord.xy, 1);
             float a0 = clamp(dot(edge[0], pos), 0.0, 1.0);
             float a1 = clamp(dot(edge[1], pos), 0.0, 1.0);
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
index 00872e4a4..5af95d8c7 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
@@ -282,11 +282,15 @@ public:
     int alphaLocation() const { return m_alphaLocation; }
     int samplerLocation() const { return m_samplerLocation; }
     int maskSamplerLocation() const { return m_maskSamplerLocation; }
+    int maskTexCoordScaleLocation() const { return m_maskTexCoordScaleLocation; }
+    int maskTexCoordOffsetLocation() const { return m_maskTexCoordOffsetLocation; }
 
 private:
     int m_samplerLocation;
     int m_maskSamplerLocation;
     int m_alphaLocation;
+    int m_maskTexCoordScaleLocation;
+    int m_maskTexCoordOffsetLocation;
 };
 
 class FragmentShaderRGBATexAlphaMaskAA {
@@ -299,12 +303,16 @@ public:
     int samplerLocation() const { return m_samplerLocation; }
     int maskSamplerLocation() const { return m_maskSamplerLocation; }
     int edgeLocation() const { return m_edgeLocation; }
+    int maskTexCoordScaleLocation() const { return m_maskTexCoordScaleLocation; }
+    int maskTexCoordOffsetLocation() const { return m_maskTexCoordOffsetLocation; }
 
 private:
     int m_samplerLocation;
     int m_maskSamplerLocation;
     int m_alphaLocation;
     int m_edgeLocation;
+    int m_maskTexCoordScaleLocation;
+    int m_maskTexCoordOffsetLocation;
 };
 
 class FragmentShaderYUVVideo {
diff --git a/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h b/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h
index 2496c7fef..4a64e55fa 100644
--- a/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h
@@ -36,7 +36,7 @@ namespace WebCore {
 // setBackgroundColor() on the base class.
 class SolidColorLayerChromium : public LayerChromium {
 public:
-    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl() OVERRIDE;
     static PassRefPtr<SolidColorLayerChromium> create();
 
     virtual ~SolidColorLayerChromium();
diff --git a/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp b/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp
index 0b59597a5..fbb7cffd5 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp
@@ -66,13 +66,13 @@ AcceleratedTextureCopier::~AcceleratedTextureCopier()
         GLC(m_context, m_context->deleteFramebuffer(m_fbo));
 }
 
-void AcceleratedTextureCopier::copyTexture(unsigned sourceTextureId, unsigned destTextureId, const IntSize& size)
+void AcceleratedTextureCopier::copyTexture(Parameters parameters)
 {
     TRACE_EVENT0("cc", "TextureCopier::copyTexture");
 
     // Note: this code does not restore the viewport, bound program, 2D texture, framebuffer, buffer or blend enable.
     GLC(m_context, m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_fbo));
-    GLC(m_context, m_context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, destTextureId, 0));
+    GLC(m_context, m_context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, parameters.destTexture, 0));
 
 #if OS(ANDROID)
     // Clear destination to improve performance on tiling GPUs.
@@ -80,7 +80,7 @@ void AcceleratedTextureCopier::copyTexture(unsigned sourceTextureId, unsigned de
     GLC(m_context, m_context->clear(GraphicsContext3D::COLOR_BUFFER_BIT));
 #endif
 
-    GLC(m_context, m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, sourceTextureId));
+    GLC(m_context, m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, parameters.sourceTexture));
     GLC(m_context, m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::NEAREST));
     GLC(m_context, m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::NEAREST));
 
@@ -96,7 +96,7 @@ void AcceleratedTextureCopier::copyTexture(unsigned sourceTextureId, unsigned de
     GLC(m_context, m_context->enableVertexAttribArray(kPositionAttribute));
     GLC(m_context, m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, 0));
 
-    GLC(m_context, m_context->viewport(0, 0, size.width(), size.height()));
+    GLC(m_context, m_context->viewport(0, 0, parameters.size.width(), parameters.size.height()));
     GLC(m_context, m_context->disable(GraphicsContext3D::BLEND));
     GLC(m_context, m_context->drawArrays(GraphicsContext3D::TRIANGLE_FAN, 0, 4));
 
diff --git a/Source/WebCore/platform/graphics/chromium/TextureCopier.h b/Source/WebCore/platform/graphics/chromium/TextureCopier.h
index b385f45e5..afe2ec025 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureCopier.h
+++ b/Source/WebCore/platform/graphics/chromium/TextureCopier.h
@@ -28,6 +28,8 @@
 #include "GraphicsContext3D.h"
 #include "ProgramBinding.h"
 #include "ShaderChromium.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebKit {
 class WebGraphicsContext3D;
@@ -38,10 +40,15 @@ class IntSize;
 
 class TextureCopier {
 public:
-    // Copy the base level contents of |sourceTextureId| to |destTextureId|. Both texture objects
+    struct Parameters {
+        unsigned sourceTexture;
+        unsigned destTexture;
+        IntSize size;
+    };
+    // Copy the base level contents of |sourceTexture| to |destTexture|. Both texture objects
     // must be complete and have a base level of |size| dimensions. The color formats do not need
-    // to match, but |destTextureId| must have a renderable format.
-    virtual void copyTexture(unsigned sourceTextureId, unsigned destTextureId, const IntSize&) = 0;
+    // to match, but |destTexture| must have a renderable format.
+    virtual void copyTexture(Parameters) = 0;
     virtual void flush() = 0;
 
 protected:
@@ -59,8 +66,8 @@ public:
     }
     virtual ~AcceleratedTextureCopier();
 
-    virtual void copyTexture(unsigned sourceTextureId, unsigned destTextureId, const IntSize&);
-    virtual void flush();
+    virtual void copyTexture(Parameters) OVERRIDE;
+    virtual void flush() OVERRIDE;
 
 protected:
     AcceleratedTextureCopier(WebKit::WebGraphicsContext3D*, bool usingBindUniforms);
diff --git a/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.cpp
index 90bc70ea9..7d575d31f 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.cpp
@@ -129,10 +129,10 @@ bool TextureLayerChromium::drawsContent() const
     return (m_client || m_textureId) && !m_contextLost && LayerChromium::drawsContent();
 }
 
-void TextureLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTracker*, CCRenderingStats&)
+void TextureLayerChromium::update(CCTextureUpdateQueue& queue, const CCOcclusionTracker*, CCRenderingStats&)
 {
     if (m_client) {
-        m_textureId = m_client->prepareTexture(updater);
+        m_textureId = m_client->prepareTexture(queue);
         m_contextLost = m_client->context()->getGraphicsResetStatusARB() != GraphicsContext3D::NO_ERROR;
     }
 
diff --git a/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.h b/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.h
index 13f5cb849..4b6721bb4 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.h
@@ -40,9 +40,9 @@ namespace WebCore {
 class TextureLayerChromiumClient {
 public:
     // Called to prepare this layer's texture for compositing. The client may queue a texture
-    // upload or copy on the CCTextureUpdater.
+    // upload or copy on the CCTextureUpdateQueue.
     // Returns the texture ID to be used for compositing.
-    virtual unsigned prepareTexture(CCTextureUpdater&) = 0;
+    virtual unsigned prepareTexture(CCTextureUpdateQueue&) = 0;
 
     // Returns the context that is providing the texture. Used for rate limiting and detecting lost context.
     virtual WebKit::WebGraphicsContext3D* context() = 0;
@@ -87,7 +87,7 @@ public:
 
     virtual void setLayerTreeHost(CCLayerTreeHost*) OVERRIDE;
     virtual bool drawsContent() const OVERRIDE;
-    virtual void update(CCTextureUpdater&, const CCOcclusionTracker*, CCRenderingStats&) OVERRIDE;
+    virtual void update(CCTextureUpdateQueue&, const CCOcclusionTracker*, CCRenderingStats&) OVERRIDE;
     virtual void pushPropertiesTo(CCLayerImpl*) OVERRIDE;
 
 protected:
diff --git a/Source/WebCore/platform/graphics/chromium/TextureUploader.h b/Source/WebCore/platform/graphics/chromium/TextureUploader.h
index 92870cb5a..7a51653f8 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureUploader.h
+++ b/Source/WebCore/platform/graphics/chromium/TextureUploader.h
@@ -31,12 +31,18 @@ namespace WebCore {
 
 class TextureUploader {
 public:
+    struct Parameters {
+        LayerTextureUpdater::Texture* texture;
+        IntRect sourceRect;
+        IntRect destRect;
+    };
+
     virtual ~TextureUploader() { }
 
     virtual bool isBusy() = 0;
     virtual void beginUploads() = 0;
     virtual void endUploads() = 0;
-    virtual void uploadTexture(LayerTextureUpdater::Texture*, CCResourceProvider*, const IntRect sourceRect, const IntRect destRect) = 0;
+    virtual void uploadTexture(CCResourceProvider*, Parameters) = 0;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ThrottledTextureUploader.cpp b/Source/WebCore/platform/graphics/chromium/ThrottledTextureUploader.cpp
index 281e08ff0..93da189c5 100644
--- a/Source/WebCore/platform/graphics/chromium/ThrottledTextureUploader.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ThrottledTextureUploader.cpp
@@ -120,9 +120,9 @@ void ThrottledTextureUploader::endUploads()
     m_pendingQueries.append(m_availableQueries.takeFirst());
 }
 
-void ThrottledTextureUploader::uploadTexture(LayerTextureUpdater::Texture* texture, CCResourceProvider* resourceProvider, const IntRect sourceRect, const IntRect destRect)
+void ThrottledTextureUploader::uploadTexture(CCResourceProvider* resourceProvider, Parameters upload)
 {
-    texture->updateRect(resourceProvider, sourceRect, destRect);
+    upload.texture->updateRect(resourceProvider, upload.sourceRect, upload.destRect);
 }
 
 void ThrottledTextureUploader::processQueries()
diff --git a/Source/WebCore/platform/graphics/chromium/ThrottledTextureUploader.h b/Source/WebCore/platform/graphics/chromium/ThrottledTextureUploader.h
index f8c43dc2d..361468fc8 100644
--- a/Source/WebCore/platform/graphics/chromium/ThrottledTextureUploader.h
+++ b/Source/WebCore/platform/graphics/chromium/ThrottledTextureUploader.h
@@ -51,7 +51,7 @@ public:
     virtual bool isBusy() OVERRIDE;
     virtual void beginUploads() OVERRIDE;
     virtual void endUploads() OVERRIDE;
-    virtual void uploadTexture(LayerTextureUpdater::Texture*, CCResourceProvider*, const IntRect sourceRect, const IntRect destRect) OVERRIDE;
+    virtual void uploadTexture(CCResourceProvider*, Parameters) OVERRIDE;
 
 private:
     class Query {
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
index 68740ef50..ccbd58d32 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
@@ -36,7 +36,7 @@
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCOverdrawMetrics.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateQueue.h"
 #include "cc/CCTiledLayerImpl.h"
 
 #include <wtf/CurrentTime.h>
@@ -59,24 +59,40 @@ public:
     CCPrioritizedTexture* managedTexture() { return m_texture->texture(); }
 
     bool isDirty() const { return !dirtyRect.isEmpty(); }
-    void copyAndClearDirty()
+
+    // Reset update state for the current frame. This should occur before painting
+    // for all layers. Since painting one layer can invalidate another layer
+    // after it has already painted, mark all non-dirty tiles as valid before painting
+    // such that invalidations during painting won't prevent them from being pushed.
+    void resetUpdateState()
     {
+        updateRect = IntRect();
+        occluded = false;
+        partialUpdate = false;
+        validForFrame = !isDirty();
+    }
+
+    // This promises to update the tile and therefore also guarantees the tile
+    // will be valid for this frame. dirtyRect is copied into updateRect so
+    // we can continue to track re-entrant invalidations that occur during painting.
+    void markForUpdate()
+    {
+        validForFrame = true;
         updateRect = dirtyRect;
         dirtyRect = IntRect();
     }
-    // Returns whether the layer was dirty and not updated in the current frame. For tiles that were not culled, the
-    // updateRect holds the area of the tile that was updated. Otherwise, the area that would have been updated.
-    bool isDirtyForCurrentFrame() { return !dirtyRect.isEmpty() && (updateRect.isEmpty() || !updated); }
 
     IntRect dirtyRect;
     IntRect updateRect;
     bool partialUpdate;
-    bool updated;
+    bool validForFrame;
+    bool occluded;
     bool isInUseOnImpl;
 private:
     explicit UpdatableTile(PassOwnPtr<LayerTextureUpdater::Texture> texture)
         : partialUpdate(false)
-        , updated(false)
+        , validForFrame(false)
+        , occluded(false)
         , isInUseOnImpl(false)
         , m_texture(texture)
     {
@@ -89,9 +105,8 @@ TiledLayerChromium::TiledLayerChromium()
     : LayerChromium()
     , m_textureFormat(GraphicsContext3D::INVALID_ENUM)
     , m_skipsDraw(false)
-    , m_skipsIdlePaint(false)
+    , m_failedUpdate(false)
     , m_sampledTexelFormat(LayerTextureUpdater::SampledTexelFormatInvalid)
-    , m_didPaint(false)
     , m_tilingOption(AutoTile)
 {
     m_tiler = CCLayerTilingData::create(IntSize(), CCLayerTilingData::HasBorderTexels);
@@ -223,7 +238,7 @@ void TiledLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
             invalidTiles.append(tile);
             continue;
         }
-        if (tile->isDirtyForCurrentFrame())
+        if (!tile->validForFrame)
             continue;
 
         tiledLayer->pushTileProperties(i, j, tile->managedTexture()->resourceId(), tile->opaqueRect());
@@ -291,16 +306,16 @@ void TiledLayerChromium::setNeedsDisplayRect(const FloatRect& dirtyRect)
     LayerChromium::setNeedsDisplayRect(dirtyRect);
 }
 
-void TiledLayerChromium::setIsNonCompositedContent(bool isNonCompositedContent)
+void TiledLayerChromium::setUseLCDText(bool useLCDText)
 {
-    LayerChromium::setIsNonCompositedContent(isNonCompositedContent);
+    LayerChromium::setUseLCDText(useLCDText);
 
     CCLayerTilingData::BorderTexelOption borderTexelOption;
 #if OS(ANDROID)
     // Always want border texels and GL_LINEAR due to pinch zoom.
     borderTexelOption = CCLayerTilingData::HasBorderTexels;
 #else
-    borderTexelOption = isNonCompositedContent ? CCLayerTilingData::NoBorderTexels : CCLayerTilingData::HasBorderTexels;
+    borderTexelOption = useLCDText ? CCLayerTilingData::NoBorderTexels : CCLayerTilingData::HasBorderTexels;
 #endif
     setBorderTexelOption(borderTexelOption);
 }
@@ -345,86 +360,114 @@ bool TiledLayerChromium::tileNeedsBufferedUpdate(UpdatableTile* tile)
     return true;
 }
 
-void TiledLayerChromium::updateTiles(bool idle, int left, int top, int right, int bottom, CCTextureUpdater& updater, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
+
+bool TiledLayerChromium::updateTiles(int left, int top, int right, int bottom, CCTextureUpdateQueue& queue, const CCOcclusionTracker* occlusion, CCRenderingStats& stats, bool& didPaint)
 {
+    didPaint = false;
     createTextureUpdaterIfNeeded();
 
-    // We shouldn't track any occlusion metrics during idle painting.
-    ASSERT(!idle || !occlusion);
+    bool ignoreOcclusions = !occlusion;
+    if (!haveTexturesForTiles(left, top, right, bottom, ignoreOcclusions)) {
+        m_failedUpdate = true;
+        return false;
+    }
 
-    // Create tiles as needed, expanding a dirty rect to contain all
-    // the dirty regions currently being drawn. All dirty tiles that are to be painted
-    // get their updateRect set to dirtyRect and dirtyRect cleared. This way if
-    // invalidateContentRect is invoked during updateContentRect we don't lose the request.
-    IntRect paintRect;
+    IntRect paintRect = markTilesForUpdate(left, top, right, bottom, ignoreOcclusions);
+
+    if (occlusion)
+        occlusion->overdrawMetrics().didPaint(paintRect);
+
+    if (paintRect.isEmpty())
+        return true;
+
+    didPaint = true;
+    updateTileTextures(paintRect, left, top, right, bottom, queue, occlusion, stats);
+    return true;
+}
+
+void TiledLayerChromium::markOcclusionsAndRequestTextures(int left, int top, int right, int bottom, const CCOcclusionTracker* occlusion)
+{
+    // There is some difficult dependancies between occlusions, recording occlusion metrics
+    // and requesting memory so those are encapsulated in this function:
+    // - We only want to call requestLate on unoccluded textures (to preserve
+    //   memory for other layers when near OOM).
+    // - We only want to record occlusion metrics if all memory requests succeed.
+
+    int occludedTileCount = 0;
+    bool succeeded = true;
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
             UpdatableTile* tile = tileAt(i, j);
-            ASSERT(tile); // Did setTexturePriorites get skipped?
+            ASSERT(tile); // Did setTexturePriorities get skipped?
+            // FIXME: This should not ever be null.
             if (!tile)
-                tile = createTile(i, j);
-
-            // Temporary diagnostic crash
-            if (!m_tiler)
-                CRASH();
-
-            if (!tile->managedTexture()->haveBackingTexture()) {
-                // Sets the dirty rect to a full-sized tile with border texels.
-                tile->dirtyRect = m_tiler->tileRect(tile);
+                continue;
+            ASSERT(!tile->occluded); // Did resetUpdateState get skipped? Are we doing more than one occluded pass?
+            IntRect visibleTileRect = intersection(m_tiler->tileBounds(i, j), visibleContentRect());
+            if (occlusion && occlusion->occluded(this, visibleTileRect)) {
+                tile->occluded = true;
+                occludedTileCount++;
+            } else {
+                succeeded &= tile->managedTexture()->requestLate();
             }
+        }
+    }
 
-            // When not idle painting, if the visible region of the tile is occluded, don't reserve a texture or update the tile.
-            // If any part of the tile is visible, then we need to update it so the tile is pushed to the impl thread.
-            if (!idle && occlusion) {
-                IntRect visibleTileRect = intersection(m_tiler->tileBounds(i, j), visibleContentRect());
-                if (occlusion->occluded(this, visibleTileRect)) {
-                    ASSERT(!tile->updated);
-                    continue;
-                }
-            }
+    if (!succeeded)
+        return;
 
-            // We come through this function multiple times during a commit, and updated should be true if the tile is not culled
-            // any single time through the function.
-            tile->updated = true;
+    // FIXME: Remove the loop and just pass the count!
+    for (int i = 0; i < occludedTileCount; i++)
+        occlusion->overdrawMetrics().didCullTileForUpload();
+}
 
-            // Always try to get memory for visible textures.
-            if (!idle && !tile->managedTexture()->canAcquireBackingTexture())
-                tile->managedTexture()->requestLate();
+bool TiledLayerChromium::haveTexturesForTiles(int left, int top, int right, int bottom, bool ignoreOcclusions)
+{
+    for (int j = top; j <= bottom; ++j) {
+        for (int i = left; i <= right; ++i) {
+            UpdatableTile* tile = tileAt(i, j);
+            ASSERT(tile); // Did setTexturePriorites get skipped?
+            // FIXME: This should not ever be null.
+            if (!tile)
+                continue;
 
-            if (!tile->managedTexture()->canAcquireBackingTexture()) {
-                m_skipsIdlePaint = true;
-                if (!idle) {
-                    m_skipsDraw = true;
-                    m_tiler->reset();
-                }
-                return;
-            }
+            // Ensure the entire tile is dirty if we don't have the texture.
+            if (!tile->managedTexture()->haveBackingTexture())
+                tile->dirtyRect = m_tiler->tileRect(tile);
 
-            paintRect.unite(tile->dirtyRect);
+            // If using occlusion and the visible region of the tile is occluded,
+            // don't reserve a texture or update the tile.
+            if (tile->occluded && !ignoreOcclusions)
+                continue;
+
+            if (!tile->managedTexture()->canAcquireBackingTexture())
+                return false;
         }
     }
+    return true;
+}
 
-    // For tiles that were not culled, we are going to update the area currently marked as dirty. So
-    // clear that dirty area and mark it for update instead.
+IntRect TiledLayerChromium::markTilesForUpdate(int left, int top, int right, int bottom, bool ignoreOcclusions)
+{
+    IntRect paintRect;
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
             UpdatableTile* tile = tileAt(i, j);
+            ASSERT(tile); // Did setTexturePriorites get skipped?
             // FIXME: This should not ever be null.
             if (!tile)
                 continue;
-            if (tile->updated)
-                tile->copyAndClearDirty();
-            else if (!idle && occlusion && tile->isDirty())
-                occlusion->overdrawMetrics().didCullTileForUpload();
+            if (tile->occluded && !ignoreOcclusions)
+                continue;
+            paintRect.unite(tile->dirtyRect);
+            tile->markForUpdate();
         }
     }
+    return paintRect;
+}
 
-    if (paintRect.isEmpty())
-        return;
-
-    if (occlusion)
-        occlusion->overdrawMetrics().didPaint(paintRect);
-
+void TiledLayerChromium::updateTileTextures(const IntRect& paintRect, int left, int top, int right, int bottom, CCTextureUpdateQueue& queue, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
+{
     // The updateRect should be in layer space. So we have to convert the paintRect from content space to layer space.
     m_updateRect = FloatRect(paintRect);
     float widthScale = bounds().width() / static_cast<float>(contentBounds().width());
@@ -438,20 +481,17 @@ void TiledLayerChromium::updateTiles(bool idle, int left, int top, int right, in
     RefPtr<LayerTextureUpdater> protector(textureUpdater());
     IntRect paintedOpaqueRect;
     textureUpdater()->prepareToUpdate(paintRect, m_tiler->tileSize(), 1 / widthScale, 1 / heightScale, paintedOpaqueRect, stats);
-    m_didPaint = true;
 
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
             UpdatableTile* tile = tileAt(i, j);
+            ASSERT(tile); // Did setTexturePriorites get skipped?
             // FIXME: This should not ever be null.
             if (!tile)
                 continue;
 
             IntRect tileRect = m_tiler->tileBounds(i, j);
 
-            if (!tile->updated)
-                continue;
-
             // Use updateRect as the above loop copied the dirty rect for this frame to updateRect.
             const IntRect& dirtyRect = tile->updateRect;
             if (dirtyRect.isEmpty())
@@ -506,10 +546,11 @@ void TiledLayerChromium::updateTiles(bool idle, int left, int top, int right, in
             if (paintOffset.y() + destRect.height() > paintRect.height())
                 CRASH();
 
+            TextureUploader::Parameters upload = { tile->texture(), sourceRect, destRect };
             if (tile->partialUpdate)
-                updater.appendPartialUpdate(tile->texture(), sourceRect, destRect);
+                queue.appendPartialUpload(upload);
             else
-                updater.appendFullUpdate(tile->texture(), sourceRect, destRect);
+                queue.appendFullUpload(upload);
         }
     }
 }
@@ -604,34 +645,33 @@ void TiledLayerChromium::resetUpdateState()
         // FIXME: This should not ever be null.
         if (!tile)
             continue;
-        tile->updateRect = IntRect();
-        tile->updated = false;
-        tile->partialUpdate = false;
+        tile->resetUpdateState();
     }
 }
 
-void TiledLayerChromium::updateContentRect(CCTextureUpdater& updater, const IntRect& contentRect, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
+void TiledLayerChromium::updateContentRect(CCTextureUpdateQueue& queue, const IntRect& contentRect, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
 {
     m_skipsDraw = false;
-    m_skipsIdlePaint = false;
-    m_didPaint = false;
-
+    m_failedUpdate = false;
     updateBounds();
 
     if (m_tiler->hasEmptyBounds())
         return;
 
+    bool didPaint = false;
+
     // Visible painting. Only paint visible tiles if the visible rect isn't empty.
     if (!contentRect.isEmpty()) {
         int left, top, right, bottom;
         m_tiler->contentRectToTileIndices(contentRect, left, top, right, bottom);
-        updateTiles(false, left, top, right, bottom, updater, occlusion, stats);
+        markOcclusionsAndRequestTextures(left, top, right, bottom, occlusion);
+        m_skipsDraw = !updateTiles(left, top, right, bottom, queue, occlusion, stats, didPaint);
+        if (m_skipsDraw)
+            m_tiler->reset();
+        if (m_skipsDraw || didPaint)
+            return;
     }
 
-    // Abort if we have already painted or run out of memory.
-    if (m_skipsIdlePaint || m_didPaint)
-        return;
-
     // If we have already painting everything visible. Do some pre-painting while idle.
     IntRect idlePaintContentRect = idlePaintRect(contentRect);
     if (idlePaintContentRect.isEmpty())
@@ -642,16 +682,13 @@ void TiledLayerChromium::updateContentRect(CCTextureUpdater& updater, const IntR
 
     // If the layer is not visible, we have nothing to expand from, so instead we prepaint the outer-most set of tiles.
     if (contentRect.isEmpty()) {
-        updateTiles(true, prepaintLeft, prepaintTop, prepaintRight, prepaintTop, updater, 0, stats);
-        if (m_didPaint || m_skipsIdlePaint)
+        if (!updateTiles(prepaintLeft, prepaintTop, prepaintRight, prepaintTop, queue, 0, stats, didPaint) || didPaint)
             return;
-        updateTiles(true, prepaintLeft, prepaintBottom, prepaintRight, prepaintBottom, updater, 0, stats);
-        if (m_didPaint || m_skipsIdlePaint)
+        if (!updateTiles(prepaintLeft, prepaintBottom, prepaintRight, prepaintBottom, queue, 0, stats, didPaint) || didPaint)
             return;
-        updateTiles(true, prepaintLeft, prepaintTop, prepaintLeft, prepaintBottom, updater, 0, stats);
-        if (m_didPaint || m_skipsIdlePaint)
+        if (!updateTiles(prepaintLeft, prepaintTop, prepaintLeft, prepaintBottom, queue, 0, stats, didPaint) || didPaint)
             return;
-        updateTiles(true, prepaintRight, prepaintTop, prepaintRight, prepaintBottom, updater, 0, stats);
+        updateTiles(prepaintRight, prepaintTop, prepaintRight, prepaintBottom, queue, 0, stats, didPaint);
         return;
     }
 
@@ -659,42 +696,38 @@ void TiledLayerChromium::updateContentRect(CCTextureUpdater& updater, const IntR
     m_tiler->contentRectToTileIndices(contentRect, left, top, right, bottom);
 
     // Otherwise, prepaint anything that was occluded but inside the layer's visible region.
-    updateTiles(true, left, top, right, bottom, updater, 0, stats);
-    if (m_didPaint || m_skipsIdlePaint)
+    if (!updateTiles(left, top, right, bottom, queue, 0, stats, didPaint) || didPaint)
         return;
 
     // Then expand outwards from the visible area until we find a dirty row or column to update.
-    while (!m_skipsIdlePaint && (left > prepaintLeft || top > prepaintTop || right < prepaintRight || bottom < prepaintBottom)) {
+    while (left > prepaintLeft || top > prepaintTop || right < prepaintRight || bottom < prepaintBottom) {
         if (bottom < prepaintBottom) {
             ++bottom;
-            updateTiles(true, left, bottom, right, bottom, updater, 0, stats);
-            if (m_didPaint || m_skipsIdlePaint)
-                break;
+            if (!updateTiles(left, bottom, right, bottom, queue, 0, stats, didPaint) || didPaint)
+                return;
         }
         if (top > prepaintTop) {
             --top;
-            updateTiles(true, left, top, right, top, updater, 0, stats);
-            if (m_didPaint || m_skipsIdlePaint)
-                break;
+            if (!updateTiles(left, top, right, top, queue, 0, stats, didPaint) || didPaint)
+                return;
         }
         if (left > prepaintLeft) {
             --left;
-            updateTiles(true, left, top, left, bottom, updater, 0, stats);
-            if (m_didPaint || m_skipsIdlePaint)
-                break;
+            if (!updateTiles(left, top, left, bottom, queue, 0, stats, didPaint) || didPaint)
+                return;
         }
         if (right < prepaintRight) {
             ++right;
-            updateTiles(true, right, top, right, bottom, updater, 0, stats);
-            if (m_didPaint || m_skipsIdlePaint)
-                break;
+            if (!updateTiles(right, top, right, bottom, queue, 0, stats, didPaint) || didPaint)
+                return;
         }
     }
 }
 
 bool TiledLayerChromium::needsIdlePaint(const IntRect& visibleContentRect)
 {
-    if (m_skipsIdlePaint)
+    // Don't trigger more paints if we failed (as we'll just fail again).
+    if (m_failedUpdate)
         return false;
 
     if (m_tiler->hasEmptyBounds())
@@ -717,7 +750,7 @@ bool TiledLayerChromium::needsIdlePaint(const IntRect& visibleContentRect)
             if (!tile)
                 continue;
 
-            bool updated = tile->updated;
+            bool updated = !tile->updateRect.isEmpty();
             bool canAcquire = tile->managedTexture()->canAcquireBackingTexture();
             bool dirty = tile->isDirty() || !tile->managedTexture()->haveBackingTexture();
             if (!updated && canAcquire && dirty)
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
index 67e4f02cf..13d345eb2 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
@@ -52,7 +52,7 @@ public:
 
     virtual void setNeedsDisplayRect(const FloatRect&) OVERRIDE;
 
-    virtual void setIsNonCompositedContent(bool) OVERRIDE;
+    virtual void setUseLCDText(bool) OVERRIDE;
 
     virtual void setLayerTreeHost(CCLayerTreeHost*) OVERRIDE;
 
@@ -83,7 +83,7 @@ protected:
     void resetUpdateState();
 
     // Prepare data needed to update textures that intersect with contentRect.
-    void updateContentRect(CCTextureUpdater&, const IntRect& contentRect, const CCOcclusionTracker*, CCRenderingStats&);
+    void updateContentRect(CCTextureUpdateQueue&, const IntRect& contentRect, const CCOcclusionTracker*, CCRenderingStats&);
 
     // After preparing an update, returns true if more painting is needed.
     bool needsIdlePaint(const IntRect& visibleContentRect);
@@ -106,19 +106,21 @@ private:
 
     void setTexturePrioritiesInRect(const CCPriorityCalculator&, const IntRect& visibleContentRect);
 
-    void updateTiles(bool idle, int left, int top, int right, int bottom, CCTextureUpdater&, const CCOcclusionTracker*, CCRenderingStats&);
+    void markOcclusionsAndRequestTextures(int left, int top, int right, int bottom, const CCOcclusionTracker*);
+
+    bool updateTiles(int left, int top, int right, int bottom, CCTextureUpdateQueue&, const CCOcclusionTracker*, CCRenderingStats&, bool& didPaint);
+    bool haveTexturesForTiles(int left, int top, int right, int bottom, bool ignoreOcclusions);
+    IntRect markTilesForUpdate(int left, int top, int right, int bottom, bool ignoreOcclusions);
+    void updateTileTextures(const IntRect& paintRect, int left, int top, int right, int bottom, CCTextureUpdateQueue&, const CCOcclusionTracker*, CCRenderingStats&);
 
     UpdatableTile* tileAt(int, int) const;
     UpdatableTile* createTile(int, int);
 
     GC3Denum m_textureFormat;
     bool m_skipsDraw;
-    bool m_skipsIdlePaint;
+    bool m_failedUpdate;
     LayerTextureUpdater::SampledTexelFormat m_sampledTexelFormat;
 
-    // Tracks if we've done any painting on this update cycle.
-    bool m_didPaint;
-
     TilingOption m_tilingOption;
     OwnPtr<CCLayerTilingData> m_tiler;
 };
diff --git a/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp b/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp
index 5cd47c880..88b2c11df 100644
--- a/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp
@@ -30,6 +30,7 @@
 #include "LayerChromium.h"
 #include "ScrollbarLayerChromium.h"
 #include "cc/CCLayerImpl.h"
+#include "cc/CCScrollbarAnimationController.h"
 #include "cc/CCScrollbarLayerImpl.h"
 #include <wtf/RefPtr.h>
 
@@ -95,6 +96,13 @@ PassOwnPtr<CCLayerImpl> TreeSynchronizer::synchronizeTreeRecursive(RawPtrCCLayer
 
     layer->pushPropertiesTo(ccLayerImpl.get());
     ccLayerImpl->setLayerTreeHostImpl(hostImpl);
+
+    // Remove all dangling pointers. The pointers will be setup later in updateScrollbarLayerPointersRecursive phase
+    if (CCScrollbarAnimationController* scrollbarController = ccLayerImpl->scrollbarAnimationController()) {
+        scrollbarController->setHorizontalScrollbarLayer(0);
+        scrollbarController->setVerticalScrollbarLayer(0);
+    }
+
     return ccLayerImpl.release();
 }
 
@@ -113,10 +121,13 @@ void TreeSynchronizer::updateScrollbarLayerPointersRecursive(const RawPtrCCLayer
 
     CCScrollbarLayerImpl* ccScrollbarLayerImpl = static_cast<CCScrollbarLayerImpl*>(newLayers.get(scrollbarLayer->id()));
     ASSERT(ccScrollbarLayerImpl);
-    ccScrollbarLayerImpl->setScrollLayer(newLayers.get(scrollbarLayer->scrollLayerId()));
+    CCLayerImpl* ccScrollLayerImpl = newLayers.get(scrollbarLayer->scrollLayerId());
+    ASSERT(ccScrollLayerImpl);
 
-    // Scrollbar layers in the tree should always point to a valid scroll layer
-    ASSERT(newLayers.get(scrollbarLayer->scrollLayerId()));
+    if (ccScrollbarLayerImpl->orientation() == WebKit::WebScrollbar::Horizontal)
+        ccScrollLayerImpl->setHorizontalScrollbarLayer(ccScrollbarLayerImpl);
+    else
+        ccScrollLayerImpl->setVerticalScrollbarLayer(ccScrollbarLayerImpl);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
index ba7472539..1ac72e183 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
@@ -49,7 +49,7 @@ public:
     // Aborted or Finished states. A Finished animation was allowed to run to completion, but
     // an Aborted animation was not.
     enum RunState {
-        WaitingForNextTick = 1,
+        WaitingForNextTick = 0,
         WaitingForTargetAvailability,
         WaitingForStartTime,
         WaitingForDeletion,
@@ -60,7 +60,7 @@ public:
     };
 
     enum TargetProperty {
-        Transform = 1,
+        Transform = 0,
         Opacity
     };
 
diff --git a/Source/WebKit/chromium/public/platform/WebContentLayerClient.h b/Source/WebCore/platform/graphics/chromium/cc/CCCheckerboardDrawQuad.cpp
index 8f1ca3324..e155f7a50 100644
--- a/Source/WebKit/chromium/public/platform/WebContentLayerClient.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCCheckerboardDrawQuad.cpp
@@ -23,4 +23,27 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "../../../../Platform/chromium/public/WebContentLayerClient.h"
+#include "config.h"
+
+#include "cc/CCCheckerboardDrawQuad.h"
+
+namespace WebCore {
+
+PassOwnPtr<CCCheckerboardDrawQuad> CCCheckerboardDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect)
+{
+    return adoptPtr(new CCCheckerboardDrawQuad(sharedQuadState, quadRect));
+}
+
+CCCheckerboardDrawQuad::CCCheckerboardDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect)
+    : CCDrawQuad(sharedQuadState, CCDrawQuad::Checkerboard, quadRect)
+{
+}
+
+const CCCheckerboardDrawQuad* CCCheckerboardDrawQuad::materialCast(const CCDrawQuad* quad)
+{
+    ASSERT(quad->material() == CCDrawQuad::Checkerboard);
+    return static_cast<const CCCheckerboardDrawQuad*>(quad);
+}
+
+
+}
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h
index 35104dcf5..c6c87010c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h
@@ -26,10 +26,24 @@
 #ifndef CCCheckerboardDrawQuad_h
 #define CCCheckerboardDrawQuad_h
 
-#include <public/WebCompositorCheckerboardQuad.h>
+#include "cc/CCDrawQuad.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
-typedef WebKit::WebCompositorCheckerboardQuad CCCheckerboardDrawQuad;
+
+#pragma pack(push, 4)
+
+class CCCheckerboardDrawQuad : public CCDrawQuad {
+public:
+    static PassOwnPtr<CCCheckerboardDrawQuad> create(const CCSharedQuadState*, const IntRect&);
+
+    static const CCCheckerboardDrawQuad* materialCast(const CCDrawQuad*);
+private:
+    CCCheckerboardDrawQuad(const CCSharedQuadState*, const IntRect&);
+};
+
+#pragma pack(pop)
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/chromium/support/WebCompositorDebugBorderQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp
index 179f6c14f..ac43e4da0 100644
--- a/Source/WebCore/platform/chromium/support/WebCompositorDebugBorderQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp
@@ -25,19 +25,17 @@
 
 #include "config.h"
 
-#include <public/WebCompositorDebugBorderQuad.h>
+#include "cc/CCDebugBorderDrawQuad.h"
 
-using namespace WebCore;
+namespace WebCore {
 
-namespace WebKit {
-
-PassOwnPtr<WebCompositorDebugBorderQuad> WebCompositorDebugBorderQuad::create(const WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color, int width)
+PassOwnPtr<CCDebugBorderDrawQuad> CCDebugBorderDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color, int width)
 {
-    return adoptPtr(new WebCompositorDebugBorderQuad(sharedQuadState, quadRect, color, width));
+    return adoptPtr(new CCDebugBorderDrawQuad(sharedQuadState, quadRect, color, width));
 }
 
-WebCompositorDebugBorderQuad::WebCompositorDebugBorderQuad(const WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color, int width)
-    : WebCompositorQuad(sharedQuadState, WebCompositorQuad::DebugBorder, quadRect)
+CCDebugBorderDrawQuad::CCDebugBorderDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color, int width)
+    : CCDrawQuad(sharedQuadState, CCDrawQuad::DebugBorder, quadRect)
     , m_color(color)
     , m_width(width)
 {
@@ -46,10 +44,10 @@ WebCompositorDebugBorderQuad::WebCompositorDebugBorderQuad(const WebCompositorSh
         m_needsBlending = true;
 }
 
-const WebCompositorDebugBorderQuad* WebCompositorDebugBorderQuad::materialCast(const WebCompositorQuad* quad)
+const CCDebugBorderDrawQuad* CCDebugBorderDrawQuad::materialCast(const CCDrawQuad* quad)
 {
-    ASSERT(quad->material() == WebCompositorQuad::DebugBorder);
-    return static_cast<const WebCompositorDebugBorderQuad*>(quad);
+    ASSERT(quad->material() == CCDrawQuad::DebugBorder);
+    return static_cast<const CCDebugBorderDrawQuad*>(quad);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h
index a72c27417..3a5390047 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h
@@ -26,10 +26,31 @@
 #ifndef CCDebugBorderDrawQuad_h
 #define CCDebugBorderDrawQuad_h
 
-#include <public/WebCompositorDebugBorderQuad.h>
+#include "SkColor.h"
+#include "cc/CCDrawQuad.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
-typedef WebKit::WebCompositorDebugBorderQuad CCDebugBorderDrawQuad;
+
+#pragma pack(push, 4)
+
+class CCDebugBorderDrawQuad : public CCDrawQuad {
+public:
+    static PassOwnPtr<CCDebugBorderDrawQuad> create(const CCSharedQuadState*, const IntRect&, SkColor, int width);
+
+    SkColor color() const { return m_color; };
+    int width() const { return m_width; }
+
+    static const CCDebugBorderDrawQuad* materialCast(const CCDrawQuad*);
+private:
+    CCDebugBorderDrawQuad(const CCSharedQuadState*, const IntRect&, SkColor, int width);
+
+    SkColor m_color;
+    int m_width;
+};
+
+#pragma pack(pop)
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp
index d6dcdc6de..2598b190e 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp
@@ -26,11 +26,28 @@
 
 #include "cc/CCDelayBasedTimeSource.h"
 
+#include <algorithm>
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
 
+namespace {
+
+// doubleTickThreshold prevents ticks from running within the specified fraction of an interval.
+// This helps account for jitter in the timebase as well as quick timer reactivation.
+const double doubleTickThreshold = 0.25;
+
+// intervalChangeThreshold is the fraction of the interval that will trigger an immediate interval change.
+// phaseChangeThreshold is the fraction of the interval that will trigger an immediate phase change.
+// If the changes are within the thresholds, the change will take place on the next tick.
+// If either change is outside the thresholds, the next tick will be canceled and reissued immediately.
+const double intervalChangeThreshold = 0.25;
+const double phaseChangeThreshold = 0.25;
+
+}
+
+
 PassRefPtr<CCDelayBasedTimeSource> CCDelayBasedTimeSource::create(double interval, CCThread* thread)
 {
     return adoptRef(new CCDelayBasedTimeSource(interval, thread));
@@ -39,8 +56,9 @@ PassRefPtr<CCDelayBasedTimeSource> CCDelayBasedTimeSource::create(double interva
 CCDelayBasedTimeSource::CCDelayBasedTimeSource(double intervalSeconds, CCThread* thread)
     : m_client(0)
     , m_hasTickTarget(false)
-    , m_intervalSeconds(intervalSeconds)
-    , m_tickTarget(0)
+    , m_lastTickTime(0)
+    , m_currentParameters(intervalSeconds, 0)
+    , m_nextParameters(intervalSeconds, 0)
     , m_state(STATE_INACTIVE)
     , m_timer(thread, this)
 {
@@ -72,15 +90,25 @@ void CCDelayBasedTimeSource::setActive(bool active)
     postNextTickTask(now);
 }
 
+double CCDelayBasedTimeSource::lastTickTime()
+{
+    return m_lastTickTime;
+}
+
+double CCDelayBasedTimeSource::nextTickTime()
+{
+    return active() ? m_currentParameters.tickTarget : 0.0;
+}
+
 void CCDelayBasedTimeSource::onTimerFired()
 {
     ASSERT(m_state != STATE_INACTIVE);
 
     double now = monotonicallyIncreasingTime();
+    m_lastTickTime = now;
 
     if (m_state == STATE_STARTING) {
-        m_hasTickTarget = true;
-        m_tickTarget = now;
+        setTimebaseAndInterval(now, m_currentParameters.interval);
         m_state = STATE_ACTIVE;
     }
 
@@ -91,6 +119,42 @@ void CCDelayBasedTimeSource::onTimerFired()
         m_client->onTimerTick();
 }
 
+void CCDelayBasedTimeSource::setTimebaseAndInterval(double timebase, double intervalSeconds)
+{
+    m_nextParameters.interval = intervalSeconds;
+    m_nextParameters.tickTarget = timebase;
+    m_hasTickTarget = true;
+
+    if (m_state != STATE_ACTIVE) {
+        // If we aren't active, there's no need to reset the timer.
+        return;
+    }
+
+    // If the change in interval is larger than the change threshold,
+    // request an immediate reset.
+    double intervalDelta = std::abs(intervalSeconds - m_currentParameters.interval);
+    double intervalChange = intervalDelta / intervalSeconds;
+    if (intervalChange > intervalChangeThreshold) {
+        setActive(false);
+        setActive(true);
+        return;
+    }
+
+    // If the change in phase is greater than the change threshold in either
+    // direction, request an immediate reset. This logic might result in a false
+    // negative if there is a simultaneous small change in the interval and the
+    // fmod just happens to return something near zero. Assuming the timebase
+    // is very recent though, which it should be, we'll still be ok because the
+    // old clock and new clock just happen to line up.
+    double targetDelta = std::abs(timebase - m_currentParameters.tickTarget);
+    double phaseChange = fmod(targetDelta, intervalSeconds) / intervalSeconds;
+    if (phaseChange > phaseChangeThreshold && phaseChange < (1.0 - phaseChangeThreshold)) {
+        setActive(false);
+        setActive(true);
+        return;
+    }
+}
+
 double CCDelayBasedTimeSource::monotonicallyIncreasingTime() const
 {
     return WTF::monotonicallyIncreasingTime();
@@ -143,20 +207,25 @@ double CCDelayBasedTimeSource::monotonicallyIncreasingTime() const
 // Note, that in the above discussion, times are expressed in milliseconds, but in the code, seconds are used.
 void CCDelayBasedTimeSource::postNextTickTask(double now)
 {
-    int numIntervalsElapsed = static_cast<int>(floor((now - m_tickTarget) / m_intervalSeconds));
-    double lastEffectiveTick = m_tickTarget + m_intervalSeconds * numIntervalsElapsed;
-    double newTickTarget = lastEffectiveTick + m_intervalSeconds;
-
-    long long delayMs = static_cast<long long>((newTickTarget - now) * 1000.0);
-    if (!delayMs) {
-        newTickTarget = newTickTarget + m_intervalSeconds;
-        delayMs = static_cast<long long>((newTickTarget - now) * 1000.0);
-    }
+    double newInterval = m_nextParameters.interval;
+    double intervalsElapsed = floor((now - m_nextParameters.tickTarget) / newInterval);
+    double lastEffectiveTick = m_nextParameters.tickTarget + newInterval * intervalsElapsed;
+    double newTickTarget = lastEffectiveTick + newInterval;
+    ASSERT(newTickTarget > now);
+
+    // Avoid double ticks when:
+    // 1) Turning off the timer and turning it right back on.
+    // 2) Jittery data is passed to setTimebaseAndInterval().
+    if (newTickTarget - m_lastTickTime <= newInterval * doubleTickThreshold)
+        newTickTarget += newInterval;
 
     // Post another task *before* the tick and update state
-    ASSERT(newTickTarget > now);
-    m_timer.startOneShot(delayMs / 1000.0);
-    m_tickTarget = newTickTarget;
+    double delay = newTickTarget - now;
+    ASSERT(delay <= newInterval * (1.0 + doubleTickThreshold));
+    m_timer.startOneShot(delay);
+
+    m_nextParameters.tickTarget = newTickTarget;
+    m_currentParameters = m_nextParameters;
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.h b/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.h
index 99795db81..61f637ad7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.h
@@ -44,9 +44,17 @@ public:
 
     virtual void setClient(CCTimeSourceClient* client) OVERRIDE { m_client = client; }
 
+    // CCTimeSource implementation
+    virtual void setTimebaseAndInterval(double timebase, double intervalSeconds) OVERRIDE;
+
     virtual void setActive(bool) OVERRIDE;
     virtual bool active() const OVERRIDE { return m_state != STATE_INACTIVE; }
 
+    // Get the last and next tick times.
+    // If not active, nextTickTime will return 0.
+    virtual double lastTickTime() OVERRIDE;
+    virtual double nextTickTime() OVERRIDE;
+
     // CCTimerClient implementation.
     virtual void onTimerFired() OVERRIDE;
 
@@ -62,10 +70,26 @@ protected:
         STATE_STARTING,
         STATE_ACTIVE,
     };
+
+    struct Parameters {
+        Parameters(double interval, double tickTarget)
+            : interval(interval), tickTarget(tickTarget)
+        { }
+        double interval;
+        double tickTarget;
+    };
+
     CCTimeSourceClient* m_client;
     bool m_hasTickTarget;
-    double m_intervalSeconds;
-    double m_tickTarget;
+    double m_lastTickTime;
+
+    // m_currentParameters should only be written by postNextTickTask.
+    // m_nextParameters will take effect on the next call to postNextTickTask.
+    // Maintaining a pending set of parameters allows nextTickTime() to always
+    // reflect the actual time we expect onTimerFired to be called.
+    Parameters m_currentParameters;
+    Parameters m_nextParameters;
+
     State m_state;
     CCThread* m_thread;
     CCTimer m_timer;
diff --git a/Source/WebCore/platform/chromium/support/WebCompositorQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCDrawQuad.cpp
index 6d617cd84..3b0699d8b 100644
--- a/Source/WebCore/platform/chromium/support/WebCompositorQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDrawQuad.cpp
@@ -24,22 +24,22 @@
  */
 
 #include "config.h"
-#include <public/WebCompositorQuad.h>
+#include "cc/CCDrawQuad.h"
 
 #include "IntRect.h"
-#include <public/WebCompositorCheckerboardQuad.h>
-#include <public/WebCompositorDebugBorderQuad.h>
-#include <public/WebCompositorIOSurfaceQuad.h>
-#include <public/WebCompositorSolidColorQuad.h>
-#include <public/WebCompositorStreamVideoQuad.h>
-#include <public/WebCompositorTextureQuad.h>
-#include <public/WebCompositorTileQuad.h>
+#include "cc/CCCheckerboardDrawQuad.h"
+#include "cc/CCDebugBorderDrawQuad.h"
+#include "cc/CCIOSurfaceDrawQuad.h"
+#include "cc/CCRenderPassDrawQuad.h"
+#include "cc/CCSolidColorDrawQuad.h"
+#include "cc/CCStreamVideoDrawQuad.h"
+#include "cc/CCTextureDrawQuad.h"
+#include "cc/CCTileDrawQuad.h"
+#include "cc/CCYUVVideoDrawQuad.h"
 
-using namespace WebCore;
+namespace WebCore {
 
-namespace WebKit {
-
-WebCompositorQuad::WebCompositorQuad(const WebCompositorSharedQuadState* sharedQuadState, Material material, const IntRect& quadRect)
+CCDrawQuad::CCDrawQuad(const CCSharedQuadState* sharedQuadState, Material material, const IntRect& quadRect)
     : m_sharedQuadState(sharedQuadState)
     , m_sharedQuadStateId(sharedQuadState->id)
     , m_material(material)
@@ -52,7 +52,7 @@ WebCompositorQuad::WebCompositorQuad(const WebCompositorSharedQuadState* sharedQ
     ASSERT(m_material != Invalid);
 }
 
-IntRect WebCompositorQuad::opaqueRect() const
+IntRect CCDrawQuad::opaqueRect() const
 {
     if (opacity() != 1)
         return IntRect();
@@ -61,41 +61,43 @@ IntRect WebCompositorQuad::opaqueRect() const
     return m_opaqueRect;
 }
 
-void WebCompositorQuad::setQuadVisibleRect(const IntRect& quadVisibleRect)
+void CCDrawQuad::setQuadVisibleRect(const IntRect& quadVisibleRect)
 {
     IntRect intersection = quadVisibleRect;
     intersection.intersect(m_quadRect);
     m_quadVisibleRect = intersection;
 }
 
-unsigned WebCompositorQuad::size() const
+unsigned CCDrawQuad::size() const
 {
     switch (material()) {
     case Checkerboard:
-        return sizeof(WebCompositorCheckerboardQuad);
+        return sizeof(CCCheckerboardDrawQuad);
     case DebugBorder:
-        return sizeof(WebCompositorDebugBorderQuad);
+        return sizeof(CCDebugBorderDrawQuad);
     case IOSurfaceContent:
-        return sizeof(WebCompositorIOSurfaceQuad);
+        return sizeof(CCIOSurfaceDrawQuad);
     case TextureContent:
-        return sizeof(WebCompositorTextureQuad);
+        return sizeof(CCTextureDrawQuad);
     case SolidColor:
-        return sizeof(WebCompositorSolidColorQuad);
+        return sizeof(CCSolidColorDrawQuad);
     case TiledContent:
-        return sizeof(WebCompositorTileQuad);
+        return sizeof(CCTileDrawQuad);
     case StreamVideoContent:
-        return sizeof(WebCompositorStreamVideoQuad);
-    case Invalid:
+        return sizeof(CCStreamVideoDrawQuad);
     case RenderPass:
+        return sizeof(CCRenderPassDrawQuad);
     case YUVVideoContent:
+        return sizeof(CCYUVVideoDrawQuad);
+    case Invalid:
         break;
     }
 
     CRASH();
-    return sizeof(WebCompositorQuad);
+    return sizeof(CCDrawQuad);
 }
 
-void WebCompositorQuad::setSharedQuadState(const WebCompositorSharedQuadState* sharedQuadState)
+void CCDrawQuad::setSharedQuadState(const CCSharedQuadState* sharedQuadState)
 {
     m_sharedQuadState = sharedQuadState;
     m_sharedQuadStateId = sharedQuadState->id;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCDrawQuad.h
index 5f536a85a..bcda345bd 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDrawQuad.h
@@ -26,10 +26,90 @@
 #ifndef CCDrawQuad_h
 #define CCDrawQuad_h
 
-#include <public/WebCompositorQuad.h>
+#include "cc/CCSharedQuadState.h"
 
 namespace WebCore {
-typedef WebKit::WebCompositorQuad CCDrawQuad;
+
+// WARNING! All CCXYZDrawQuad classes must remain PODs (plain old data).
+// They are intended to be "serializable" by copying their raw bytes, so they
+// must not contain any non-bit-copyable member variables!
+//
+// Furthermore, the class members need to be packed so they are aligned
+// properly and don't have paddings/gaps, otherwise memory check tools
+// like Valgrind will complain about uninitialized memory usage when
+// transferring these classes over the wire.
+#pragma pack(push, 4)
+
+// CCDrawQuad is a bag of data used for drawing a quad. Because different
+// materials need different bits of per-quad data to render, classes that derive
+// from CCDrawQuad store additional data in their derived instance. The Material
+// enum is used to "safely" downcast to the derived class.
+class CCDrawQuad {
+public:
+    enum Material {
+        Invalid,
+        Checkerboard,
+        DebugBorder,
+        IOSurfaceContent,
+        RenderPass,
+        TextureContent,
+        SolidColor,
+        TiledContent,
+        YUVVideoContent,
+        StreamVideoContent,
+    };
+
+    IntRect quadRect() const { return m_quadRect; }
+    const WebKit::WebTransformationMatrix& quadTransform() const { return m_sharedQuadState->quadTransform; }
+    IntRect visibleContentRect() const { return m_sharedQuadState->visibleContentRect; }
+    IntRect clippedRectInTarget() const { return m_sharedQuadState->clippedRectInTarget; }
+    float opacity() const { return m_sharedQuadState->opacity; }
+    // For the purposes of blending, what part of the contents of this quad are opaque?
+    IntRect opaqueRect() const;
+    bool needsBlending() const { return m_needsBlending || !opaqueRect().contains(m_quadVisibleRect); }
+
+    // Allows changing the rect that gets drawn to make it smaller. Parameter passed
+    // in will be clipped to quadRect().
+    void setQuadVisibleRect(const IntRect&);
+    IntRect quadVisibleRect() const { return m_quadVisibleRect; }
+    bool isDebugQuad() const { return m_material == DebugBorder; }
+
+    Material material() const { return m_material; }
+
+    // Returns transfer size of this object based on the derived class (by
+    // looking at the material type).
+    unsigned size() const;
+
+    const CCSharedQuadState* sharedQuadState() const { return m_sharedQuadState; }
+    int sharedQuadStateId() const { return m_sharedQuadStateId; }
+    void setSharedQuadState(const CCSharedQuadState*);
+
+protected:
+    CCDrawQuad(const CCSharedQuadState*, Material, const IntRect&);
+
+    // Stores state common to a large bundle of quads; kept separate for memory
+    // efficiency. There is special treatment to reconstruct these pointers
+    // during serialization.
+    const CCSharedQuadState* m_sharedQuadState;
+    int m_sharedQuadStateId;
+
+    Material m_material;
+    IntRect m_quadRect;
+    IntRect m_quadVisibleRect;
+
+    // By default, the shared quad state determines whether or not this quad is
+    // opaque or needs blending. Derived classes can override with these
+    // variables.
+    bool m_quadOpaque;
+    bool m_needsBlending;
+
+    // Be default, this rect is empty. It is used when the shared quad state and above
+    // variables determine that the quad is not fully opaque but may be partially opaque.
+    IntRect m_opaqueRect;
+};
+
+#pragma pack(pop)
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.cpp
index ce7d7c70d..388d43fb9 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.cpp
@@ -27,147 +27,62 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "CCFontAtlas.h"
 
-#include "Font.h"
-#include "FontCache.h"
-#include "FontDescription.h"
-#include "GraphicsContext.h"
-#include "ImageBuffer.h"
-#include "TextRun.h"
+#include "SkCanvas.h"
 #include "cc/CCProxy.h"
 
-#define ATLAS_SIZE 128
-#define FONT_HEIGHT 14
-
 namespace WebCore {
 
 using namespace std;
 
-
-CCFontAtlas::CCFontAtlas()
-    : m_fontHeight(FONT_HEIGHT)
+CCFontAtlas::CCFontAtlas(SkBitmap bitmap, IntRect asciiToRectTable[128], int fontHeight)
+    : m_atlas(bitmap)
+    , m_fontHeight(fontHeight)
 {
+    for (size_t i = 0; i < 128; ++i)
+        m_asciiToRectTable[i] = asciiToRectTable[i];
 }
 
-static void wrapPositionIfNeeded(IntPoint& position, int textWidth, int textHeight)
-{
-    if (position.x() + textWidth > ATLAS_SIZE)
-        position = IntPoint(0, position.y() + textHeight);
-}
-
-void CCFontAtlas::generateAtlasForFont(GraphicsContext* atlasContext, const FontDescription& fontDescription, const Color& fontColor, const IntPoint& startingPosition, IntRect asciiToAtlasTable[128])
-{
-    ASSERT(CCProxy::isMainThread());
-    ASSERT(m_atlas);
-
-    FontCachePurgePreventer fontCachePurgePreventer;
-
-    IntPoint position = startingPosition;
-    int textHeight = fontDescription.computedPixelSize();
-    // This is a dirty little trick to account for overhang letters like g, p, j.
-    int inflation = textHeight / 3;
-
-    Font font(fontDescription, 0, 0);
-    font.update(0);
-
-    atlasContext->setStrokeColor(fontColor, ColorSpaceDeviceRGB);
-    atlasContext->setFillColor(fontColor, ColorSpaceDeviceRGB);
-
-    // First, draw a generic rect that will be used for special and unknown characters that have nothing else to render.
-    {
-        int textWidth = textHeight / 2;
-        wrapPositionIfNeeded(position, textWidth, textHeight + inflation);
-        atlasContext->strokeRect(FloatRect(FloatPoint(position.x() + 1, position.y() - textHeight + 1 + inflation), FloatSize(textWidth - 2, textHeight - 2 - inflation)), 1);
-
-        // Initialize the rect that would be copied when drawing this glyph from the atlas.
-        asciiToAtlasTable[0] = IntRect(IntPoint(position.x(), position.y() - textHeight), IntSize(textWidth, textHeight + inflation));
-
-        // Increment to the position where the next glyph will be placed.
-        position.setX(position.x() + textWidth);
-    }
-
-    // Then, draw the ASCII characters.
-    for (LChar i = 1; i < 128; ++i) {
-        if (i < 32) {
-            // Special characters will simply use the the default glyph.
-            asciiToAtlasTable[i] = asciiToAtlasTable[0];
-            continue;
-        }
-
-        String str;
-        str.append(i);
-        TextRun text(str);
-
-        int textWidth = round(font.width(text));
-        wrapPositionIfNeeded(position, textWidth, textHeight + inflation);
-        atlasContext->drawText(font, text, position);
-
-        // Initialize the rect that would be copied when drawing this glyph from the atlas.
-        asciiToAtlasTable[i] = IntRect(IntPoint(position.x(), position.y() - textHeight), IntSize(textWidth, textHeight + inflation));
-
-        // Increment to the position where the next glyph will be placed.
-        position.setX(position.x() + textWidth);
-    }
-}
-
-void CCFontAtlas::initialize()
+CCFontAtlas::~CCFontAtlas()
 {
-    ASSERT(CCProxy::isMainThread());
-
-    // We expect this function to be called only once when the atlas did not exist yet. We should be aware if that's not true.
-    ASSERT(!m_atlas);
-
-    m_atlas = ImageBuffer::create(IntSize(ATLAS_SIZE, ATLAS_SIZE));
-    GraphicsContext* atlasContext = m_atlas->context();
-
-    // Clear the entire texture atlas to transparent before drawing fonts.
-    atlasContext->setFillColor(Color(0, 0, 0, 0), ColorSpaceDeviceRGB);
-    atlasContext->fillRect(FloatRect(0, 0, ATLAS_SIZE, ATLAS_SIZE));
-
-    // FIXME: monospace font does not work as expected.
-    FontDescription fontDescription;
-    fontDescription.setGenericFamily(FontDescription::MonospaceFamily);
-    fontDescription.setComputedSize(m_fontHeight);
-    generateAtlasForFont(atlasContext, fontDescription, Color(255, 0, 0), IntPoint(0, fontDescription.computedPixelSize()), m_asciiToRectTable);
 }
 
-void CCFontAtlas::drawText(GraphicsContext* targetContext, const String& text, const IntPoint& destPosition, const IntSize& clip) const
+void CCFontAtlas::drawText(SkCanvas* canvas, const SkPaint& paint, const String& text, const IntPoint& destPosition, const IntSize& clip) const
 {
     ASSERT(CCProxy::isImplThread());
-    ASSERT(m_atlas);
 
     Vector<String> lines;
     text.split('\n', lines);
 
     IntPoint position = destPosition;
     for (size_t i = 0; i < lines.size(); ++i) {
-        drawOneLineOfTextInternal(targetContext, lines[i], position);
+        drawOneLineOfTextInternal(canvas, paint, lines[i], position);
         position.setY(position.y() + m_fontHeight);
         if (position.y() > clip.height())
             return;
     }
 }
 
-void CCFontAtlas::drawOneLineOfTextInternal(GraphicsContext* targetContext, const String& textLine, const IntPoint& destPosition) const
+void CCFontAtlas::drawOneLineOfTextInternal(SkCanvas* canvas, const SkPaint& paint, const String& textLine, const IntPoint& destPosition) const
 {
     ASSERT(CCProxy::isImplThread());
-    ASSERT(m_atlas);
 
     IntPoint position = destPosition;
     for (unsigned i = 0; i < textLine.length(); ++i) {
         // If the ASCII code is out of bounds, then index 0 is used, which is just a plain rectangle glyph.
         int asciiIndex = (textLine[i] < 128) ? textLine[i] : 0;
         IntRect glyphBounds = m_asciiToRectTable[asciiIndex];
-        targetContext->drawImageBuffer(m_atlas.get(), ColorSpaceDeviceRGB, position, glyphBounds);
+        SkIRect source = SkIRect::MakeXYWH(glyphBounds.x(), glyphBounds.y(), glyphBounds.width(), glyphBounds.height());
+        canvas->drawBitmapRect(m_atlas, &source, SkRect::MakeXYWH(position.x(), position.y(), glyphBounds.width(), glyphBounds.height()), &paint);
         position.setX(position.x() + glyphBounds.width());
     }
 }
 
-void CCFontAtlas::drawDebugAtlas(GraphicsContext* targetContext, const IntPoint& destPosition) const
+void CCFontAtlas::drawDebugAtlas(SkCanvas* canvas, const IntPoint& destPosition) const
 {
     ASSERT(CCProxy::isImplThread());
-    ASSERT(m_atlas);
 
-    targetContext->drawImageBuffer(m_atlas.get(), ColorSpaceDeviceRGB, destPosition, IntRect(IntPoint::zero(), IntSize(ATLAS_SIZE, ATLAS_SIZE)));
+    SkIRect source = SkIRect::MakeWH(m_atlas.width(), m_atlas.height());
+    canvas->drawBitmapRect(m_atlas, &source, SkRect::MakeXYWH(destPosition.x(), destPosition.y(), m_atlas.width(), m_atlas.height()));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.h b/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.h
index cca3a1ce5..bf25264f6 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.h
@@ -27,32 +27,31 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "ImageBuffer.h"
+#include "IntRect.h"
+#include "SkBitmap.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/WTFString.h>
 
+class SkCanvas;
+
 namespace WebCore {
 
 class Color;
 class FontDescription;
-class IntPoint;
-class IntRect;
 class GraphicsContext;
+class IntPoint;
+class IntSize;
 
 // This class provides basic ability to draw text onto the heads-up display.
-// It must be initialized on the main thread, and it can only draw text on the impl thread.
 class CCFontAtlas {
     WTF_MAKE_NONCOPYABLE(CCFontAtlas);
 public:
-    static PassOwnPtr<CCFontAtlas> create()
+    static PassOwnPtr<CCFontAtlas> create(SkBitmap bitmap, IntRect asciiToRectTable[128], int fontHeight)
     {
-        return adoptPtr(new CCFontAtlas());
+        return adoptPtr(new CCFontAtlas(bitmap, asciiToRectTable, fontHeight));
     }
-
-    // Creates the font atlas.
-    // - Should only be called on the main thread.
-    void initialize();
+    ~CCFontAtlas();
 
     // Draws multiple lines of text where each line of text is separated by '\n'.
     // - Correct glyphs will be drawn for ASCII codes in the range 32-127; any characters
@@ -60,24 +59,18 @@ public:
     // - IntSize clip is used to avoid wasting time drawing things that are outside the
     //   target canvas bounds.
     // - Should only be called only on the impl thread.
-    void drawText(GraphicsContext*, const String& text, const IntPoint& destPosition, const IntSize& clip) const;
+    void drawText(SkCanvas*, const SkPaint&, const String& text, const IntPoint& destPosition, const IntSize& clip) const;
 
     // Draws the entire atlas at the specified position, just for debugging purposes.
-    void drawDebugAtlas(GraphicsContext*, const IntPoint& destPosition) const;
+    void drawDebugAtlas(SkCanvas*, const IntPoint& destPosition) const;
 
 private:
-    CCFontAtlas();
-
-    // Paints the font into the atlas, from left-to-right, top-to-bottom, starting at
-    // startingPosition. At the same time, it updates the ascii-to-IntRect mapping for
-    // each character. By doing things this way, it is possible to support variable-width
-    // fonts and multiple fonts on the same atlas.
-    void generateAtlasForFont(GraphicsContext*, const FontDescription&, const Color& fontColor, const IntPoint& startingPosition, IntRect asciiToAtlasTable[128]);
+    CCFontAtlas(SkBitmap, IntRect asciiToRectTable[128], int fontHeight);
 
-    void drawOneLineOfTextInternal(GraphicsContext*, const String&, const IntPoint& destPosition) const;
+    void drawOneLineOfTextInternal(SkCanvas*, const SkPaint&, const String&, const IntPoint& destPosition) const;
 
     // The actual texture atlas containing all the pre-rendered glyphs.
-    OwnPtr<ImageBuffer> m_atlas;
+    SkBitmap m_atlas;
 
     // The look-up tables mapping ascii characters to their IntRect locations on the atlas.
     IntRect m_asciiToRectTable[128];
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp
index df7f31554..b52fb5f6f 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp
@@ -27,6 +27,7 @@
 #include "cc/CCFrameRateController.h"
 
 #include "TraceEvent.h"
+#include "cc/CCDelayBasedTimeSource.h"
 #include "cc/CCTimeSource.h"
 
 namespace WebCore {
@@ -52,22 +53,44 @@ CCFrameRateController::CCFrameRateController(PassRefPtr<CCTimeSource> timer)
     , m_numFramesPending(0)
     , m_maxFramesPending(0)
     , m_timeSource(timer)
+    , m_active(false)
+    , m_isTimeSourceThrottling(true)
 {
     m_timeSourceClientAdapter = CCFrameRateControllerTimeSourceAdapter::create(this);
     m_timeSource->setClient(m_timeSourceClientAdapter.get());
 }
 
+CCFrameRateController::CCFrameRateController(CCThread* thread)
+    : m_client(0)
+    , m_numFramesPending(0)
+    , m_maxFramesPending(0)
+    , m_active(false)
+    , m_isTimeSourceThrottling(false)
+{
+    m_manualTicker = adoptPtr(new CCTimer(thread, this));
+}
+
 CCFrameRateController::~CCFrameRateController()
 {
-    m_timeSource->setActive(false);
+    if (m_isTimeSourceThrottling)
+        m_timeSource->setActive(false);
 }
 
 void CCFrameRateController::setActive(bool active)
 {
-    if (m_timeSource->active() == active)
+    if (m_active == active)
         return;
     TRACE_EVENT1("cc", "CCFrameRateController::setActive", "active", active);
-    m_timeSource->setActive(active);
+    m_active = active;
+
+    if (m_isTimeSourceThrottling)
+        m_timeSource->setActive(active);
+    else {
+        if (active)
+            postManualTick();
+        else
+            m_manualTicker->stop();
+    }
 }
 
 void CCFrameRateController::setMaxFramesPending(int maxFramesPending)
@@ -75,9 +98,14 @@ void CCFrameRateController::setMaxFramesPending(int maxFramesPending)
     m_maxFramesPending = maxFramesPending;
 }
 
+void CCFrameRateController::setTimebaseAndInterval(double timebase, double intervalSeconds)
+{
+    m_timeSource->setTimebaseAndInterval(timebase, intervalSeconds);
+}
+
 void CCFrameRateController::onTimerTick()
 {
-    ASSERT(m_timeSource->active());
+    ASSERT(m_active);
 
     // Don't forward the tick if we have too many frames in flight.
     if (m_maxFramesPending && m_numFramesPending >= m_maxFramesPending) {
@@ -89,14 +117,29 @@ void CCFrameRateController::onTimerTick()
         m_client->vsyncTick();
 }
 
+void CCFrameRateController::postManualTick()
+{
+    if (m_active)
+        m_manualTicker->startOneShot(0);
+}
+
+void CCFrameRateController::onTimerFired()
+{
+    onTimerTick();
+}
+
 void CCFrameRateController::didBeginFrame()
 {
     m_numFramesPending++;
+    if (!m_isTimeSourceThrottling)
+        postManualTick();
 }
 
 void CCFrameRateController::didFinishFrame()
 {
     m_numFramesPending--;
+    if (!m_isTimeSourceThrottling)
+        postManualTick();
 }
 
 void CCFrameRateController::didAbortAllPendingFrames()
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.h b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.h
index fa23af2cc..69c9037e2 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.h
@@ -25,6 +25,8 @@
 #ifndef CCFrameRateController_h
 #define CCFrameRateController_h
 
+#include "cc/CCTimer.h"
+
 #include <wtf/CurrentTime.h>
 #include <wtf/Deque.h>
 #include <wtf/OwnPtr.h>
@@ -32,6 +34,7 @@
 
 namespace WebCore {
 
+class CCThread;
 class CCTimeSource;
 
 class CCFrameRateControllerClient {
@@ -44,17 +47,17 @@ protected:
 
 class CCFrameRateControllerTimeSourceAdapter;
 
-class CCFrameRateController {
+class CCFrameRateController : public CCTimerClient {
 public:
     explicit CCFrameRateController(PassRefPtr<CCTimeSource>);
-    ~CCFrameRateController();
+    // Alternate form of CCFrameRateController with unthrottled frame-rate.
+    explicit CCFrameRateController(CCThread*);
+    virtual ~CCFrameRateController();
 
     void setClient(CCFrameRateControllerClient* client) { m_client = client; }
 
     void setActive(bool);
 
-    void setMaxPendingFrames(int);
-
     // Use the following methods to adjust target frame rate.
     //
     // Multiple frames can be in-progress, but for every didBeginFrame, a
@@ -66,15 +69,27 @@ public:
     void didAbortAllPendingFrames();
     void setMaxFramesPending(int); // 0 for unlimited.
 
+    void setTimebaseAndInterval(double timebase, double intervalSeconds);
+
 protected:
     friend class CCFrameRateControllerTimeSourceAdapter;
     void onTimerTick();
 
+    void postManualTick();
+
+    // CCTimerClient implementation (used for unthrottled frame-rate).
+    virtual void onTimerFired() OVERRIDE;
+
     CCFrameRateControllerClient* m_client;
     int m_numFramesPending;
     int m_maxFramesPending;
     RefPtr<CCTimeSource> m_timeSource;
     OwnPtr<CCFrameRateControllerTimeSourceAdapter> m_timeSourceClientAdapter;
+    bool m_active;
+
+    // Members for unthrottled frame-rate.
+    bool m_isTimeSourceThrottling;
+    OwnPtr<CCTimer> m_manualTicker;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp
index ac2956a13..e34225a84 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp
@@ -66,17 +66,15 @@ CCFrameRateCounter::CCFrameRateCounter()
 
 void CCFrameRateCounter::markBeginningOfFrame(double timestamp)
 {
-    if (CCProxy::hasImplThread() && m_currentFrameNumber > 0) {
-        double lastFrameTimestamp = frameIndex(m_currentFrameNumber - 1);
-        double drawDelaySeconds = timestamp - lastFrameTimestamp;
-        double drawDelayMs = drawDelaySeconds * 1000.0;
+    m_timeStampHistory[frameIndex(m_currentFrameNumber)] = timestamp;
+    double frameIntervalSeconds = frameInterval(m_currentFrameNumber);
 
+    if (CCProxy::hasImplThread() && m_currentFrameNumber > 0) {
+        double drawDelayMs = frameIntervalSeconds * 1000.0;
         WebKit::Platform::current()->histogramCustomCounts("Renderer4.CompositorThreadImplDrawDelay", static_cast<int>(drawDelayMs), 1, 120, 60);
     }
 
-    m_timeStampHistory[frameIndex(m_currentFrameNumber)] = timestamp;
-    double delta = frameInterval(m_currentFrameNumber);
-    if (!isBadFrameInterval(delta) && delta > kDroppedFrameTime)
+    if (!isBadFrameInterval(frameIntervalSeconds) && frameIntervalSeconds > kDroppedFrameTime)
         ++m_droppedFrameCount;
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h b/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
index 405885ffb..5e35f5967 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
@@ -26,6 +26,7 @@
 #ifndef CCGraphicsContext_h
 #define CCGraphicsContext_h
 
+#include <public/WebCompositorOutputSurface.h>
 #include <public/WebGraphicsContext3D.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
@@ -33,28 +34,8 @@
 
 namespace WebCore {
 
-
-class CCGraphicsContext {
-    WTF_MAKE_NONCOPYABLE(CCGraphicsContext);
-public:
-    static PassOwnPtr<CCGraphicsContext> create2D()
-    {
-        return adoptPtr(new CCGraphicsContext());
-    }
-    static PassOwnPtr<CCGraphicsContext> create3D(PassOwnPtr<WebKit::WebGraphicsContext3D> context3D)
-    {
-        return adoptPtr(new CCGraphicsContext(context3D));
-    }
-
-    WebKit::WebGraphicsContext3D* context3D() { return m_context3D.get(); }
-
-private:
-    CCGraphicsContext() { }
-    explicit CCGraphicsContext(PassOwnPtr<WebKit::WebGraphicsContext3D> context3D)
-        : m_context3D(context3D) { }
-
-    OwnPtr<WebKit::WebGraphicsContext3D> m_context3D;
-};
+// FIXME: rename fully to CCOutputSurface.
+typedef WebKit::WebCompositorOutputSurface CCGraphicsContext;
 
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp
index 066fdc84d..6b46851db 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp
@@ -30,22 +30,39 @@
 #include "Extensions3DChromium.h"
 #include "GraphicsContext3D.h"
 #include "LayerRendererChromium.h"
-#include "PlatformCanvas.h"
+#include "SkBitmap.h"
+#include "SkColorMatrixFilter.h"
+#include "SkPaint.h"
 #include "cc/CCDebugRectHistory.h"
 #include "cc/CCFontAtlas.h"
 #include "cc/CCFrameRateCounter.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCQuadSink.h"
-#include <public/WebCompositorTextureQuad.h>
+#include "cc/CCTextureDrawQuad.h"
+#include "skia/ext/platform_canvas.h"
 #include <wtf/text/WTFString.h>
 
-using WebKit::WebCompositorTextureQuad;
-
 namespace WebCore {
 
-CCHeadsUpDisplayLayerImpl::CCHeadsUpDisplayLayerImpl(int id, PassOwnPtr<CCFontAtlas> fontAtlas)
-    : CCLayerImpl(id),
-      m_fontAtlas(fontAtlas)
+static inline SkPaint createPaint()
+{
+    // The SkCanvas is in RGBA but the shader is expecting BGRA, so we need to
+    // swizzle our colors when drawing to the SkCanvas.
+    SkColorMatrix swizzleMatrix;
+    for (int i = 0; i < 20; ++i)
+        swizzleMatrix.fMat[i] = 0;
+    swizzleMatrix.fMat[0 + 5 * 2] = 1;
+    swizzleMatrix.fMat[1 + 5 * 1] = 1;
+    swizzleMatrix.fMat[2 + 5 * 0] = 1;
+    swizzleMatrix.fMat[3 + 5 * 3] = 1;
+
+    SkPaint paint;
+    paint.setColorFilter(new SkColorMatrixFilter(swizzleMatrix))->unref();
+    return paint;
+}
+
+CCHeadsUpDisplayLayerImpl::CCHeadsUpDisplayLayerImpl(int id)
+    : CCLayerImpl(id)
 {
 }
 
@@ -53,6 +70,11 @@ CCHeadsUpDisplayLayerImpl::~CCHeadsUpDisplayLayerImpl()
 {
 }
 
+void CCHeadsUpDisplayLayerImpl::setFontAtlas(PassOwnPtr<CCFontAtlas> fontAtlas)
+{
+    m_fontAtlas = fontAtlas;
+}
+
 void CCHeadsUpDisplayLayerImpl::willDraw(CCResourceProvider* resourceProvider)
 {
     CCLayerImpl::willDraw(resourceProvider);
@@ -69,19 +91,15 @@ void CCHeadsUpDisplayLayerImpl::willDraw(CCResourceProvider* resourceProvider)
         return;
 
     // Render pixels into the texture.
-    PlatformCanvas canvas;
-    canvas.resize(bounds());
-    {
-        PlatformCanvas::Painter painter(&canvas, PlatformCanvas::Painter::GrayscaleText);
-        painter.context()->clearRect(FloatRect(0, 0, bounds().width(), bounds().height()));
-        drawHudContents(painter.context());
-    }
+    OwnPtr<SkCanvas> canvas = adoptPtr(skia::CreateBitmapCanvas(bounds().width(), bounds().height(), false /* opaque */));
+    drawHudContents(canvas.get());
 
-    {
-        PlatformCanvas::AutoLocker locker(&canvas);
-        IntRect layerRect(IntPoint(), bounds());
-        resourceProvider->upload(m_hudTexture->id(), locker.pixels(), layerRect, layerRect, layerRect);
-    }
+    const SkBitmap* bitmap = &canvas->getDevice()->accessBitmap(false);
+    SkAutoLockPixels locker(*bitmap);
+
+    IntRect layerRect(IntPoint(), bounds());
+    ASSERT(bitmap->config() == SkBitmap::kARGB_8888_Config);
+    resourceProvider->upload(m_hudTexture->id(), static_cast<const uint8_t*>(bitmap->getPixels()), layerRect, layerRect, layerRect);
 }
 
 void CCHeadsUpDisplayLayerImpl::appendQuads(CCQuadSink& quadList, const CCSharedQuadState* sharedQuadState, bool&)
@@ -93,7 +111,7 @@ void CCHeadsUpDisplayLayerImpl::appendQuads(CCQuadSink& quadList, const CCShared
     bool premultipliedAlpha = true;
     FloatRect uvRect(0, 0, 1, 1);
     bool flipped = false;
-    quadList.append(WebCompositorTextureQuad::create(sharedQuadState, quadRect, m_hudTexture->id(), premultipliedAlpha, uvRect, flipped));
+    quadList.append(CCTextureDrawQuad::create(sharedQuadState, quadRect, m_hudTexture->id(), premultipliedAlpha, uvRect, flipped));
 }
 
 void CCHeadsUpDisplayLayerImpl::didDraw(CCResourceProvider* resourceProvider)
@@ -111,16 +129,17 @@ void CCHeadsUpDisplayLayerImpl::didDraw(CCResourceProvider* resourceProvider)
 
 void CCHeadsUpDisplayLayerImpl::didLoseContext()
 {
-    m_hudTexture->leak();
+    m_hudTexture.clear();
 }
 
-void CCHeadsUpDisplayLayerImpl::drawHudContents(GraphicsContext* context)
+void CCHeadsUpDisplayLayerImpl::drawHudContents(SkCanvas* canvas)
 {
     const CCLayerTreeSettings& settings = layerTreeHostImpl()->settings();
 
     if (settings.showPlatformLayerTree) {
-        context->setFillColor(Color(0, 0, 0, 192), ColorSpaceDeviceRGB);
-        context->fillRect(FloatRect(0, 0, bounds().width(), bounds().height()));
+        SkPaint paint = createPaint();
+        paint.setColor(SkColorSetARGB(192, 0, 0, 0));
+        canvas->drawRect(SkRect::MakeXYWH(0, 0, bounds().width(), bounds().height()), paint);
     }
 
     int fpsCounterHeight = 40;
@@ -133,40 +152,39 @@ void CCHeadsUpDisplayLayerImpl::drawHudContents(GraphicsContext* context)
         platformLayerTreeTop = 0;
 
     if (settings.showFPSCounter)
-        drawFPSCounter(context, layerTreeHostImpl()->fpsCounter(), fpsCounterTop, fpsCounterHeight);
+        drawFPSCounter(canvas, layerTreeHostImpl()->fpsCounter(), fpsCounterTop, fpsCounterHeight);
 
     if (settings.showPlatformLayerTree && m_fontAtlas) {
         String layerTree = layerTreeHostImpl()->layerTreeAsText();
-        m_fontAtlas->drawText(context, layerTree, IntPoint(2, platformLayerTreeTop), bounds());
+        m_fontAtlas->drawText(canvas, createPaint(), layerTree, IntPoint(2, platformLayerTreeTop), bounds());
     }
 
     if (settings.showDebugRects())
-        drawDebugRects(context, layerTreeHostImpl()->debugRectHistory());
+        drawDebugRects(canvas, layerTreeHostImpl()->debugRectHistory());
 }
 
-void CCHeadsUpDisplayLayerImpl::drawFPSCounter(GraphicsContext* context, CCFrameRateCounter* fpsCounter, int top, int height)
+void CCHeadsUpDisplayLayerImpl::drawFPSCounter(SkCanvas* canvas, CCFrameRateCounter* fpsCounter, int top, int height)
 {
     float textWidth = 170; // so text fits on linux.
     float graphWidth = fpsCounter->timeStampHistorySize();
 
     // Draw the FPS text.
-    drawFPSCounterText(context, fpsCounter, top, textWidth, height);
+    drawFPSCounterText(canvas, fpsCounter, top, textWidth, height);
 
     // Draw FPS graph.
     const double loFPS = 0;
     const double hiFPS = 80;
-    context->setStrokeStyle(SolidStroke);
-    context->setFillColor(Color(154, 205, 50), ColorSpaceDeviceRGB);
-    context->fillRect(FloatRect(2 + textWidth, top, graphWidth, height / 2));
-    context->setFillColor(Color(255, 250, 205), ColorSpaceDeviceRGB);
-    context->fillRect(FloatRect(2 + textWidth, top + height / 2, graphWidth, height / 2));
-    context->setStrokeColor(Color(255, 0, 0), ColorSpaceDeviceRGB);
-    context->setFillColor(Color(255, 0, 0), ColorSpaceDeviceRGB);
+    SkPaint paint = createPaint();
+    paint.setColor(SkColorSetRGB(154, 205, 50));
+    canvas->drawRect(SkRect::MakeXYWH(2 + textWidth, top, graphWidth, height / 2), paint);
+
+    paint.setColor(SkColorSetRGB(255, 250, 205));
+    canvas->drawRect(SkRect::MakeXYWH(2 + textWidth, top + height / 2, graphWidth, height / 2), paint);
 
     int graphLeft = static_cast<int>(textWidth + 3);
-    IntPoint prev(-1, 0);
     int x = 0;
     double h = static_cast<double>(height - 2);
+    SkPath path;
     for (int i = 0; i < fpsCounter->timeStampHistorySize() - 1; ++i) {
         int j = i + 1;
         double delta = fpsCounter->timeStampOfRecentFrame(j) - fpsCounter->timeStampOfRecentFrame(i);
@@ -187,74 +205,86 @@ void CCHeadsUpDisplayLayerImpl::drawFPSCounter(GraphicsContext* context, CCFrame
             p = 1;
 
         // Plot this data point.
-        IntPoint cur(graphLeft + x, 1 + top + p*h);
-        if (prev.x() != -1)
-            context->drawLine(prev, cur);
-        prev = cur;
+        SkPoint cur = SkPoint::Make(graphLeft + x, 1 + top + p*h);
+        if (path.isEmpty())
+            path.moveTo(cur);
+        else
+            path.lineTo(cur);
         x += 1;
     }
+    paint.setColor(SK_ColorRED);
+    paint.setStyle(SkPaint::kStroke_Style);
+    paint.setStrokeWidth(1);
+    paint.setAntiAlias(true);
+    canvas->drawPath(path, paint);
 }
 
-void CCHeadsUpDisplayLayerImpl::drawFPSCounterText(GraphicsContext* context, CCFrameRateCounter* fpsCounter, int top, int width, int height)
+void CCHeadsUpDisplayLayerImpl::drawFPSCounterText(SkCanvas* canvas, CCFrameRateCounter* fpsCounter, int top, int width, int height)
 {
     double averageFPS, stdDeviation;
     fpsCounter->getAverageFPSAndStandardDeviation(averageFPS, stdDeviation);
 
     // Draw background.
-    context->setFillColor(Color(0, 0, 0, 255), ColorSpaceDeviceRGB);
-    context->fillRect(FloatRect(2, top, width, height));
+    SkPaint paint = createPaint();
+    paint.setColor(SK_ColorBLACK);
+    canvas->drawRect(SkRect::MakeXYWH(2, top, width, height), paint);
 
     // Draw FPS text.
     if (m_fontAtlas)
-        m_fontAtlas->drawText(context, String::format("FPS: %4.1f +/- %3.1f", averageFPS, stdDeviation), IntPoint(10, height / 3), IntSize(width, height));
+        m_fontAtlas->drawText(canvas, createPaint(), String::format("FPS: %4.1f +/- %3.1f", averageFPS, stdDeviation), IntPoint(10, height / 3), IntSize(width, height));
 }
 
-void CCHeadsUpDisplayLayerImpl::drawDebugRects(GraphicsContext* context, CCDebugRectHistory* debugRectHistory)
+void CCHeadsUpDisplayLayerImpl::drawDebugRects(SkCanvas* canvas, CCDebugRectHistory* debugRectHistory)
 {
     const Vector<CCDebugRect>& debugRects = debugRectHistory->debugRects();
+
     for (size_t i = 0; i < debugRects.size(); ++i) {
+        SkColor strokeColor = 0;
+        SkColor fillColor = 0;
 
-        if (debugRects[i].type == PaintRectType) {
+        switch (debugRects[i].type) {
+        case PaintRectType:
             // Paint rects in red
-            context->setStrokeColor(Color(255, 0, 0, 255), ColorSpaceDeviceRGB);
-            context->fillRect(debugRects[i].rect, Color(255, 0, 0, 30), ColorSpaceDeviceRGB);
-            context->strokeRect(debugRects[i].rect, 2.0);
-        }
-
-        if (debugRects[i].type == PropertyChangedRectType) {
+            strokeColor = SkColorSetARGB(255, 255, 0, 0);
+            fillColor = SkColorSetARGB(30, 255, 0, 0);
+            break;
+        case PropertyChangedRectType:
             // Property-changed rects in blue
-            context->setStrokeColor(Color(0, 0, 255, 255), ColorSpaceDeviceRGB);
-            context->fillRect(debugRects[i].rect, Color(0, 0, 255, 30), ColorSpaceDeviceRGB);
-            context->strokeRect(debugRects[i].rect, 2.0);
-        }
-
-        if (debugRects[i].type == SurfaceDamageRectType) {
+            strokeColor = SkColorSetARGB(255, 255, 0, 0);
+            fillColor = SkColorSetARGB(30, 0, 0, 255);
+            break;
+        case SurfaceDamageRectType:
             // Surface damage rects in yellow-orange
-            context->setStrokeColor(Color(200, 100, 0, 255), ColorSpaceDeviceRGB);
-            context->fillRect(debugRects[i].rect, Color(200, 100, 0, 30), ColorSpaceDeviceRGB);
-            context->strokeRect(debugRects[i].rect, 2.0);
-        }
-
-        if (debugRects[i].type == ReplicaScreenSpaceRectType) {
+            strokeColor = SkColorSetARGB(255, 200, 100, 0);
+            fillColor = SkColorSetARGB(30, 200, 100, 0);
+            break;
+        case ReplicaScreenSpaceRectType:
             // Screen space rects in green.
-            context->setStrokeColor(Color(100, 200, 0, 255), ColorSpaceDeviceRGB);
-            context->fillRect(debugRects[i].rect, Color(100, 200, 0, 30), ColorSpaceDeviceRGB);
-            context->strokeRect(debugRects[i].rect, 2.0);
-        }
-
-        if (debugRects[i].type == ScreenSpaceRectType) {
+            strokeColor = SkColorSetARGB(255, 100, 200, 0);
+            fillColor = SkColorSetARGB(30, 100, 200, 0);
+            break;
+        case ScreenSpaceRectType:
             // Screen space rects in purple.
-            context->setStrokeColor(Color(100, 0, 200, 255), ColorSpaceDeviceRGB);
-            context->fillRect(debugRects[i].rect, Color(100, 0, 200, 10), ColorSpaceDeviceRGB);
-            context->strokeRect(debugRects[i].rect, 2.0);
-        }
-
-        if (debugRects[i].type == OccludingRectType) {
+            strokeColor = SkColorSetARGB(255, 100, 0, 200);
+            fillColor = SkColorSetARGB(10, 100, 0, 200);
+            break;
+        case OccludingRectType:
             // Occluding rects in a reddish color.
-            context->setStrokeColor(Color(200, 0, 100, 255), ColorSpaceDeviceRGB);
-            context->fillRect(debugRects[i].rect, Color(200, 0, 100, 10), ColorSpaceDeviceRGB);
-            context->strokeRect(debugRects[i].rect, 2.0);
+            strokeColor = SkColorSetARGB(255, 200, 0, 100);
+            fillColor = SkColorSetARGB(10, 200, 0, 100);
+            break;
         }
+
+        const FloatRect& rect = debugRects[i].rect;
+        SkRect skRect = SkRect::MakeXYWH(rect.x(), rect.y(), rect.width(), rect.height());
+        SkPaint paint = createPaint();
+        paint.setColor(fillColor);
+        canvas->drawRect(skRect, paint);
+
+        paint.setColor(strokeColor);
+        paint.setStyle(SkPaint::kStroke_Style);
+        paint.setStrokeWidth(2);
+        canvas->drawRect(skRect, paint);
     }
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h
index 78378a5fe..b2cdb4d31 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h
@@ -26,24 +26,28 @@
 #ifndef CCHeadsUpDisplayLayerImpl_h
 #define CCHeadsUpDisplayLayerImpl_h
 
+#include "cc/CCFontAtlas.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCScopedTexture.h"
 
+class SkCanvas;
+
 namespace WebCore {
 
 class CCDebugRectHistory;
 class CCFontAtlas;
 class CCFrameRateCounter;
-class GraphicsContext;
 
 class CCHeadsUpDisplayLayerImpl : public CCLayerImpl {
 public:
-    static PassOwnPtr<CCHeadsUpDisplayLayerImpl> create(int id, PassOwnPtr<CCFontAtlas> fontAtlas)
+    static PassOwnPtr<CCHeadsUpDisplayLayerImpl> create(int id)
     {
-        return adoptPtr(new CCHeadsUpDisplayLayerImpl(id, fontAtlas));
+        return adoptPtr(new CCHeadsUpDisplayLayerImpl(id));
     }
     virtual ~CCHeadsUpDisplayLayerImpl();
 
+    void setFontAtlas(PassOwnPtr<CCFontAtlas>);
+
     virtual void willDraw(CCResourceProvider*) OVERRIDE;
     virtual void appendQuads(CCQuadSink&, const CCSharedQuadState*, bool& hadMissingTiles) OVERRIDE;
     virtual void didDraw(CCResourceProvider*) OVERRIDE;
@@ -53,14 +57,14 @@ public:
     virtual bool layerIsAlwaysDamaged() const OVERRIDE { return true; }
 
 private:
-    CCHeadsUpDisplayLayerImpl(int, PassOwnPtr<CCFontAtlas>);
+    explicit CCHeadsUpDisplayLayerImpl(int);
 
     virtual const char* layerTypeAsString() const OVERRIDE { return "HeadsUpDisplayLayer"; }
 
-    void drawHudContents(GraphicsContext*);
-    void drawFPSCounter(GraphicsContext*, CCFrameRateCounter*, int top, int height);
-    void drawFPSCounterText(GraphicsContext*, CCFrameRateCounter*, int top, int width, int height);
-    void drawDebugRects(GraphicsContext*, CCDebugRectHistory*);
+    void drawHudContents(SkCanvas*);
+    void drawFPSCounter(SkCanvas*, CCFrameRateCounter*, int top, int height);
+    void drawFPSCounterText(SkCanvas*, CCFrameRateCounter*, int top, int width, int height);
+    void drawDebugRects(SkCanvas*, CCDebugRectHistory*);
 
     OwnPtr<CCFontAtlas> m_fontAtlas;
     OwnPtr<CCScopedTexture> m_hudTexture;
diff --git a/Source/WebCore/platform/chromium/support/WebCompositorIOSurfaceQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.cpp
index 2b5eabd05..5551b82d3 100644
--- a/Source/WebCore/platform/chromium/support/WebCompositorIOSurfaceQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.cpp
@@ -25,29 +25,27 @@
 
 #include "config.h"
 
-#include <public/WebCompositorIOSurfaceQuad.h>
+#include "cc/CCIOSurfaceDrawQuad.h"
 
-using namespace WebCore;
+namespace WebCore {
 
-namespace WebKit {
-
-PassOwnPtr<WebCompositorIOSurfaceQuad> WebCompositorIOSurfaceQuad::create(const WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, const IntSize& ioSurfaceSize, unsigned ioSurfaceTextureId, Orientation orientation)
+PassOwnPtr<CCIOSurfaceDrawQuad> CCIOSurfaceDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const IntSize& ioSurfaceSize, unsigned ioSurfaceTextureId, Orientation orientation)
 {
-    return adoptPtr(new WebCompositorIOSurfaceQuad(sharedQuadState, quadRect, ioSurfaceSize, ioSurfaceTextureId, orientation));
+    return adoptPtr(new CCIOSurfaceDrawQuad(sharedQuadState, quadRect, ioSurfaceSize, ioSurfaceTextureId, orientation));
 }
 
-WebCompositorIOSurfaceQuad::WebCompositorIOSurfaceQuad(const WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, const IntSize& ioSurfaceSize, unsigned ioSurfaceTextureId, Orientation orientation)
-    : WebCompositorQuad(sharedQuadState, WebCompositorQuad::IOSurfaceContent, quadRect)
+CCIOSurfaceDrawQuad::CCIOSurfaceDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const IntSize& ioSurfaceSize, unsigned ioSurfaceTextureId, Orientation orientation)
+    : CCDrawQuad(sharedQuadState, CCDrawQuad::IOSurfaceContent, quadRect)
     , m_ioSurfaceSize(ioSurfaceSize)
     , m_ioSurfaceTextureId(ioSurfaceTextureId)
     , m_orientation(orientation)
 {
 }
 
-const WebCompositorIOSurfaceQuad* WebCompositorIOSurfaceQuad::materialCast(const WebCompositorQuad* quad)
+const CCIOSurfaceDrawQuad* CCIOSurfaceDrawQuad::materialCast(const CCDrawQuad* quad)
 {
-    ASSERT(quad->material() == WebCompositorQuad::IOSurfaceContent);
-    return static_cast<const WebCompositorIOSurfaceQuad*>(quad);
+    ASSERT(quad->material() == CCDrawQuad::IOSurfaceContent);
+    return static_cast<const CCIOSurfaceDrawQuad*>(quad);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h
index 77d326cbd..7ce7c06ca 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h
@@ -26,10 +26,38 @@
 #ifndef CCIOSurfaceDrawQuad_h
 #define CCIOSurfaceDrawQuad_h
 
-#include <public/WebCompositorIOSurfaceQuad.h>
+#include "IntSize.h"
+#include "cc/CCDrawQuad.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
-typedef WebKit::WebCompositorIOSurfaceQuad CCIOSurfaceDrawQuad;
+
+#pragma pack(push, 4)
+
+class CCIOSurfaceDrawQuad : public CCDrawQuad {
+public:
+    enum Orientation {
+      Flipped,
+      Unflipped
+    };
+
+    static PassOwnPtr<CCIOSurfaceDrawQuad> create(const CCSharedQuadState*, const IntRect&, const IntSize& ioSurfaceSize, unsigned ioSurfaceTextureId, Orientation);
+
+    IntSize ioSurfaceSize() const { return m_ioSurfaceSize; }
+    unsigned ioSurfaceTextureId() const { return m_ioSurfaceTextureId; }
+    Orientation orientation() const { return m_orientation; }
+
+    static const CCIOSurfaceDrawQuad* materialCast(const CCDrawQuad*);
+private:
+    CCIOSurfaceDrawQuad(const CCSharedQuadState*, const IntRect&, const IntSize& ioSurfaceSize, unsigned ioSurfaceTextureId, Orientation);
+
+    IntSize m_ioSurfaceSize;
+    unsigned m_ioSurfaceTextureId;
+    Orientation m_orientation;
+};
+
+#pragma pack(pop)
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
index 601327581..c6ebbe28b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
@@ -104,7 +104,7 @@ protected:
     explicit CCLayerAnimationController(CCLayerAnimationControllerClient*);
 
 private:
-    typedef HashSet<int> TargetProperties;
+    typedef HashSet<int, DefaultHash<int>::Hash, WTF::UnsignedWithZeroKeyHashTraits<int> > TargetProperties;
 
     void pushNewAnimationsToImplThread(CCLayerAnimationController*) const;
     void removeAnimationsCompletedOnMainThread(CCLayerAnimationController*) const;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index 2b6ef9177..a11dcd2ad 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -36,6 +36,7 @@
 #include "cc/CCMathUtil.h"
 #include "cc/CCProxy.h"
 #include "cc/CCQuadSink.h"
+#include "cc/CCScrollbarAnimationController.h"
 #include <wtf/text/WTFString.h>
 
 using WebKit::WebTransformationMatrix;
@@ -63,7 +64,7 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_preserves3D(false)
     , m_useParentBackfaceVisibility(false)
     , m_drawCheckerboardForMissingTiles(false)
-    , m_isNonCompositedContent(false)
+    , m_useLCDText(false)
     , m_drawsContent(false)
     , m_forceRenderSurface(false)
     , m_isContainerForFixedPositionLayers(false)
@@ -145,7 +146,7 @@ bool CCLayerImpl::descendantDrawsContent()
 
 PassOwnPtr<CCSharedQuadState> CCLayerImpl::createSharedQuadState(int id) const
 {
-    return CCSharedQuadState::create(id, m_drawTransform, m_visibleContentRect, m_scissorRect, m_drawOpacity, m_opaque);
+    return CCSharedQuadState::create(id, m_drawTransform, m_visibleContentRect, m_drawableContentRect, m_drawOpacity, m_opaque);
 }
 
 void CCLayerImpl::willDraw(CCResourceProvider*)
@@ -182,11 +183,17 @@ CCResourceProvider::ResourceId CCLayerImpl::contentsResourceId() const
 
 void CCLayerImpl::scrollBy(const FloatSize& scroll)
 {
-    FloatSize newDelta = m_scrollDelta + scroll;
     IntSize minDelta = -toSize(m_scrollPosition);
     IntSize maxDelta = m_maxScrollPosition - toSize(m_scrollPosition);
     // Clamp newDelta so that position + delta stays within scroll bounds.
-    m_scrollDelta = newDelta.expandedTo(minDelta).shrunkTo(maxDelta);
+    FloatSize newDelta = (m_scrollDelta + scroll).expandedTo(minDelta).shrunkTo(maxDelta);
+
+    if (m_scrollDelta == newDelta)
+        return;
+
+    m_scrollDelta = newDelta;
+    if (m_scrollbarAnimationController)
+        m_scrollbarAnimationController->updateScrollOffset(this);
     noteLayerPropertyChangedForSubtree();
 }
 
@@ -599,6 +606,41 @@ void CCLayerImpl::didLoseContext()
 {
 }
 
+void CCLayerImpl::setMaxScrollPosition(const IntSize& maxScrollPosition)
+{
+    m_maxScrollPosition = maxScrollPosition;
+
+    if (!m_scrollbarAnimationController)
+        return;
+    m_scrollbarAnimationController->updateScrollOffset(this);
+}
+
+CCScrollbarLayerImpl* CCLayerImpl::horizontalScrollbarLayer() const
+{
+    return m_scrollbarAnimationController ? m_scrollbarAnimationController->horizontalScrollbarLayer() : 0;
+}
+
+void CCLayerImpl::setHorizontalScrollbarLayer(CCScrollbarLayerImpl* scrollbarLayer)
+{
+    if (!m_scrollbarAnimationController)
+        m_scrollbarAnimationController = CCScrollbarAnimationController::create(this);
+    m_scrollbarAnimationController->setHorizontalScrollbarLayer(scrollbarLayer);
+    m_scrollbarAnimationController->updateScrollOffset(this);
+}
+
+CCScrollbarLayerImpl* CCLayerImpl::verticalScrollbarLayer() const
+{
+    return m_scrollbarAnimationController ? m_scrollbarAnimationController->verticalScrollbarLayer() : 0;
+}
+
+void CCLayerImpl::setVerticalScrollbarLayer(CCScrollbarLayerImpl* scrollbarLayer)
+{
+    if (!m_scrollbarAnimationController)
+        m_scrollbarAnimationController = CCScrollbarAnimationController::create(this);
+    m_scrollbarAnimationController->setVerticalScrollbarLayer(scrollbarLayer);
+    m_scrollbarAnimationController->updateScrollOffset(this);
+}
+
 }
 
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index decddff7a..ff089b537 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -49,6 +49,8 @@ class CCLayerSorter;
 class CCLayerTreeHostImpl;
 class CCRenderer;
 class CCQuadSink;
+class CCScrollbarAnimationController;
+class CCScrollbarLayerImpl;
 class LayerChromium;
 
 class CCLayerImpl : public CCLayerAnimationControllerClient {
@@ -148,8 +150,8 @@ public:
     void setUseParentBackfaceVisibility(bool useParentBackfaceVisibility) { m_useParentBackfaceVisibility = useParentBackfaceVisibility; }
     bool useParentBackfaceVisibility() const { return m_useParentBackfaceVisibility; }
 
-    void setIsNonCompositedContent(bool isNonCompositedContent) { m_isNonCompositedContent = isNonCompositedContent; }
-    bool isNonCompositedContent() const { return m_isNonCompositedContent; }
+    void setUseLCDText(bool useLCDText) { m_useLCDText = useLCDText; }
+    bool useLCDText() const { return m_useLCDText; }
 
     void setSublayerTransform(const WebKit::WebTransformationMatrix&);
     const WebKit::WebTransformationMatrix& sublayerTransform() const { return m_sublayerTransform; }
@@ -175,9 +177,6 @@ public:
     bool drawOpacityIsAnimating() const { return m_drawOpacityIsAnimating; }
     void setDrawOpacityIsAnimating(bool drawOpacityIsAnimating) { m_drawOpacityIsAnimating = drawOpacityIsAnimating; }
 
-    const IntRect& scissorRect() const { return m_scissorRect; }
-    void setScissorRect(const IntRect& rect) { m_scissorRect = rect; }
-
     CCLayerImpl* renderTarget() const { ASSERT(!m_renderTarget || m_renderTarget->renderSurface()); return m_renderTarget; }
     void setRenderTarget(CCLayerImpl* target) { m_renderTarget = target; }
 
@@ -191,7 +190,7 @@ public:
     void setScrollPosition(const IntPoint&);
 
     const IntSize& maxScrollPosition() const {return m_maxScrollPosition; }
-    void setMaxScrollPosition(const IntSize& maxScrollPosition) { m_maxScrollPosition = maxScrollPosition; }
+    void setMaxScrollPosition(const IntSize&);
 
     const FloatSize& scrollDelta() const { return m_scrollDelta; }
     void setScrollDelta(const FloatSize&);
@@ -265,6 +264,14 @@ public:
     // until the new context has been created successfully.
     virtual void didLoseContext();
 
+    CCScrollbarAnimationController* scrollbarAnimationController() const { return m_scrollbarAnimationController.get(); }
+
+    CCScrollbarLayerImpl* horizontalScrollbarLayer() const;
+    void setHorizontalScrollbarLayer(CCScrollbarLayerImpl*);
+
+    CCScrollbarLayerImpl* verticalScrollbarLayer() const;
+    void setVerticalScrollbarLayer(CCScrollbarLayerImpl*);
+
 protected:
     explicit CCLayerImpl(int);
 
@@ -331,7 +338,7 @@ private:
     bool m_drawCheckerboardForMissingTiles;
     WebKit::WebTransformationMatrix m_sublayerTransform;
     WebKit::WebTransformationMatrix m_transform;
-    bool m_isNonCompositedContent;
+    bool m_useLCDText;
 
     bool m_drawsContent;
     bool m_forceRenderSurface;
@@ -376,10 +383,6 @@ private:
     bool m_betweenWillDrawAndDidDraw;
 #endif
 
-    // During drawing, identifies the region outside of which nothing should be drawn.
-    // Uses target surface's space.
-    IntRect m_scissorRect;
-
     // Render surface associated with this layer. The layer and its descendants
     // will render to this surface.
     OwnPtr<CCRenderSurface> m_renderSurface;
@@ -395,6 +398,9 @@ private:
 
     // Manages animations for this layer.
     OwnPtr<CCLayerAnimationController> m_layerAnimationController;
+
+    // Manages scrollbars for this layer
+    OwnPtr<CCScrollbarAnimationController> m_scrollbarAnimationController;
 };
 
 void sortLayers(Vector<CCLayerImpl*>::iterator first, Vector<CCLayerImpl*>::iterator end, CCLayerSorter*);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp
index 48802d667..0cb703b42 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp
@@ -183,9 +183,11 @@ CCLayerSorter::LayerShape::LayerShape(float width, float height, const WebTransf
         projectedQuad.setP4(clippedQuad[2]); // this will be a degenerate quad that is actually a triangle.
 
     // Compute the normal of the layer's plane.
-    FloatPoint3D c1 = drawTransform.mapPoint(FloatPoint3D(0, 0, 0));
-    FloatPoint3D c2 = drawTransform.mapPoint(FloatPoint3D(0, 1, 0));
-    FloatPoint3D c3 = drawTransform.mapPoint(FloatPoint3D(1, 0, 0));
+    bool clipped = false;
+    FloatPoint3D c1 = CCMathUtil::mapPoint(drawTransform, FloatPoint3D(0, 0, 0), clipped);
+    FloatPoint3D c2 = CCMathUtil::mapPoint(drawTransform, FloatPoint3D(0, 1, 0), clipped);
+    FloatPoint3D c3 = CCMathUtil::mapPoint(drawTransform, FloatPoint3D(1, 0, 0), clipped);
+    // FIXME: Deal with clipping.
     FloatPoint3D c12 = c2 - c1;
     FloatPoint3D c13 = c3 - c1;
     layerNormal = c13.cross(c12);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
index ff97cf3c4..e7939327a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
@@ -133,7 +133,7 @@ void CCLayerTreeHost::initializeLayerRenderer()
     TRACE_EVENT0("cc", "CCLayerTreeHost::initializeLayerRenderer");
     if (!m_proxy->initializeLayerRenderer()) {
         // Uh oh, better tell the client that we can't do anything with this context.
-        m_client->didRecreateContext(false);
+        m_client->didRecreateOutputSurface(false);
         return;
     }
 
@@ -166,7 +166,7 @@ CCLayerTreeHost::RecreateResult CCLayerTreeHost::recreateContext()
         m_numTimesRecreateShouldFail--;
 
     if (recreated) {
-        m_client->didRecreateContext(true);
+        m_client->didRecreateOutputSurface(true);
         m_contextLost = false;
         return RecreateSucceeded;
     }
@@ -185,7 +185,7 @@ CCLayerTreeHost::RecreateResult CCLayerTreeHost::recreateContext()
 
     // We have tried too many times to recreate the context. Tell the host to fall
     // back to software rendering.
-    m_client->didRecreateContext(false);
+    m_client->didRecreateOutputSurface(false);
     return RecreateFailedAndGaveUp;
 }
 
@@ -242,7 +242,7 @@ void CCLayerTreeHost::finishCommitOnImplThread(CCLayerTreeHostImpl* hostImpl)
         hostImpl->setNeedsAnimateLayers();
 
     hostImpl->setSourceFrameNumber(commitNumber());
-    hostImpl->setViewportSize(viewportSize());
+    hostImpl->setViewportSize(layoutViewportSize(), deviceViewportSize());
     hostImpl->setDeviceScaleFactor(deviceScaleFactor());
     hostImpl->setPageScaleFactorAndLimits(m_pageScaleFactor, m_minPageScaleFactor, m_maxPageScaleFactor);
     hostImpl->setBackgroundColor(m_backgroundColor);
@@ -251,29 +251,38 @@ void CCLayerTreeHost::finishCommitOnImplThread(CCLayerTreeHostImpl* hostImpl)
     m_commitNumber++;
 }
 
+void CCLayerTreeHost::setFontAtlas(PassOwnPtr<CCFontAtlas> fontAtlas)
+{
+    m_fontAtlas = fontAtlas;
+    setNeedsCommit();
+}
+
 void CCLayerTreeHost::willCommit()
 {
     m_client->willCommit();
     if (m_rootLayer && m_settings.showDebugInfo()) {
         if (!m_hudLayer)
-            m_hudLayer = HeadsUpDisplayLayerChromium::create(m_settings, layerRendererCapabilities().maxTextureSize);
-        m_rootLayer->addChild(m_hudLayer);
+            m_hudLayer = HeadsUpDisplayLayerChromium::create();
+
+        if (m_fontAtlas)
+            m_hudLayer->setFontAtlas(m_fontAtlas.release());
+
+        if (m_hudLayer->parent() != m_rootLayer.get()) {
+            m_hudLayer->removeFromParent();
+            m_rootLayer->addChild(m_hudLayer);
+        }
     }
 }
 
 void CCLayerTreeHost::commitComplete()
 {
-    if (m_hudLayer)
-        m_hudLayer->removeFromParent();
     m_deleteTextureAfterCommitList.clear();
     m_client->didCommit();
 }
 
 PassOwnPtr<CCGraphicsContext> CCLayerTreeHost::createContext()
 {
-    if (settings().forceSoftwareCompositing)
-        return CCGraphicsContext::create2D();
-    return CCGraphicsContext::create3D(m_client->createContext3D());
+    return m_client->createOutputSurface();
 }
 
 PassOwnPtr<CCLayerTreeHostImpl> CCLayerTreeHost::createLayerTreeHostImpl(CCLayerTreeHostImplClient* client)
@@ -364,15 +373,13 @@ void CCLayerTreeHost::setRootLayer(PassRefPtr<LayerChromium> rootLayer)
     setNeedsCommit();
 }
 
-void CCLayerTreeHost::setViewportSize(const IntSize& viewportSize)
+void CCLayerTreeHost::setViewportSize(const IntSize& layoutViewportSize, const IntSize& deviceViewportSize)
 {
-    if (viewportSize == m_viewportSize)
+    if (layoutViewportSize == m_layoutViewportSize && deviceViewportSize == m_deviceViewportSize)
         return;
 
-    m_viewportSize = viewportSize;
-
-    m_deviceViewportSize = viewportSize;
-    m_deviceViewportSize.scale(m_deviceScaleFactor);
+    m_layoutViewportSize = layoutViewportSize;
+    m_deviceViewportSize = deviceViewportSize;
 
     setNeedsCommit();
 }
@@ -447,7 +454,7 @@ bool CCLayerTreeHost::initializeLayerRendererIfNeeded()
 }
 
 
-void CCLayerTreeHost::updateLayers(CCTextureUpdater& updater, size_t memoryAllocationLimitBytes)
+void CCLayerTreeHost::updateLayers(CCTextureUpdateQueue& queue, size_t memoryAllocationLimitBytes)
 {
     ASSERT(m_layerRendererInitialized);
     ASSERT(memoryAllocationLimitBytes);
@@ -455,15 +462,15 @@ void CCLayerTreeHost::updateLayers(CCTextureUpdater& updater, size_t memoryAlloc
     if (!rootLayer())
         return;
 
-    if (viewportSize().isEmpty())
+    if (layoutViewportSize().isEmpty())
         return;
 
     m_contentsTextureManager->setMaxMemoryLimitBytes(memoryAllocationLimitBytes);
 
-    updateLayers(rootLayer(), updater);
+    updateLayers(rootLayer(), queue);
 }
 
-void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer, CCTextureUpdater& updater)
+void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer, CCTextureUpdateQueue& queue)
 {
     TRACE_EVENT0("cc", "CCLayerTreeHost::updateLayers");
 
@@ -472,15 +479,13 @@ void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer, CCTextureUpdater& u
     {
         TRACE_EVENT0("cc", "CCLayerTreeHost::updateLayers::calcDrawEtc");
         CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer, deviceViewportSize(), m_deviceScaleFactor, layerRendererCapabilities().maxTextureSize, updateList);
-
-        FloatRect rootScissorRect(FloatPoint(0, 0), deviceViewportSize());
-        CCLayerTreeHostCommon::calculateVisibleAndScissorRects(updateList, rootScissorRect);
+        CCLayerTreeHostCommon::calculateVisibleRects(updateList);
     }
 
     // Reset partial texture update requests.
     m_partialTextureUpdateRequests = 0;
 
-    bool needMoreUpdates = paintLayerContents(updateList, updater);
+    bool needMoreUpdates = paintLayerContents(updateList, queue);
     if (m_triggerIdleUpdates && needMoreUpdates)
         setNeedsCommit();
 
@@ -556,7 +561,7 @@ size_t CCLayerTreeHost::calculateMemoryForRenderSurfaces(const LayerList& update
     return readbackBytes + maxBackgroundTextureBytes + contentsTextureBytes;
 }
 
-bool CCLayerTreeHost::paintMasksForRenderSurface(LayerChromium* renderSurfaceLayer, CCTextureUpdater& updater)
+bool CCLayerTreeHost::paintMasksForRenderSurface(LayerChromium* renderSurfaceLayer, CCTextureUpdateQueue& queue)
 {
     // Note: Masks and replicas only exist for layers that own render surfaces. If we reach this point
     // in code, we already know that at least something will be drawn into this render surface, so the
@@ -565,26 +570,26 @@ bool CCLayerTreeHost::paintMasksForRenderSurface(LayerChromium* renderSurfaceLay
     bool needMoreUpdates = false;
     LayerChromium* maskLayer = renderSurfaceLayer->maskLayer();
     if (maskLayer) {
-        maskLayer->update(updater, 0, m_renderingStats);
+        maskLayer->update(queue, 0, m_renderingStats);
         needMoreUpdates |= maskLayer->needMoreUpdates();
     }
 
     LayerChromium* replicaMaskLayer = renderSurfaceLayer->replicaLayer() ? renderSurfaceLayer->replicaLayer()->maskLayer() : 0;
     if (replicaMaskLayer) {
-        replicaMaskLayer->update(updater, 0, m_renderingStats);
+        replicaMaskLayer->update(queue, 0, m_renderingStats);
         needMoreUpdates |= replicaMaskLayer->needMoreUpdates();
     }
     return needMoreUpdates;
 }
 
-bool CCLayerTreeHost::paintLayerContents(const LayerList& renderSurfaceLayerList, CCTextureUpdater& updater)
+bool CCLayerTreeHost::paintLayerContents(const LayerList& renderSurfaceLayerList, CCTextureUpdateQueue& queue)
 {
     // Use FrontToBack to allow for testing occlusion and performing culling during the tree walk.
     typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::FrontToBack> CCLayerIteratorType;
 
     bool needMoreUpdates = false;
     bool recordMetricsForFrame = true; // FIXME: In the future, disable this when about:tracing is off.
-    CCOcclusionTracker occlusionTracker(IntRect(IntPoint(), deviceViewportSize()), recordMetricsForFrame);
+    CCOcclusionTracker occlusionTracker(m_rootLayer->renderSurface()->contentRect(), recordMetricsForFrame);
     occlusionTracker.setMinimumTrackingSize(m_settings.minimumOcclusionTrackingSize);
 
     prioritizeTextures(renderSurfaceLayerList, occlusionTracker.overdrawMetrics());
@@ -595,10 +600,10 @@ bool CCLayerTreeHost::paintLayerContents(const LayerList& renderSurfaceLayerList
 
         if (it.representsTargetRenderSurface()) {
             ASSERT(it->renderSurface()->drawOpacity() || it->renderSurface()->drawOpacityIsAnimating());
-            needMoreUpdates |= paintMasksForRenderSurface(*it, updater);
+            needMoreUpdates |= paintMasksForRenderSurface(*it, queue);
         } else if (it.representsItself()) {
             ASSERT(!it->bounds().isEmpty());
-            it->update(updater, &occlusionTracker, m_renderingStats);
+            it->update(queue, &occlusionTracker, m_renderingStats);
             needMoreUpdates |= it->needMoreUpdates();
         }
 
@@ -705,8 +710,6 @@ void CCLayerTreeHost::setDeviceScaleFactor(float deviceScaleFactor)
         return;
     m_deviceScaleFactor = deviceScaleFactor;
 
-    m_deviceViewportSize = m_viewportSize;
-    m_deviceViewportSize.scale(m_deviceScaleFactor);
     setNeedsCommit();
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
index 8a228f1a2..6a2d7e675 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
@@ -25,8 +25,6 @@
 #ifndef CCLayerTreeHost_h
 #define CCLayerTreeHost_h
 
-#include "GraphicsContext3D.h"
-#include "GraphicsTypes3D.h"
 #include "IntRect.h"
 #include "RateLimiter.h"
 #include "SkColor.h"
@@ -47,13 +45,14 @@
 
 namespace WebCore {
 
-class CCGraphicsContext;
+class CCFontAtlas;
 class CCLayerChromium;
 class CCLayerTreeHostImpl;
 class CCLayerTreeHostImplClient;
-class CCTextureUpdater;
-class Region;
 class CCPrioritizedTextureManager;
+class CCTextureUpdateQueue;
+class HeadsUpDisplayLayerChromium;
+class Region;
 struct CCScrollAndScaleSet;
 
 class CCLayerTreeHostClient {
@@ -64,8 +63,8 @@ public:
     virtual void updateAnimations(double frameBeginTime) = 0;
     virtual void layout() = 0;
     virtual void applyScrollAndScale(const IntSize& scrollDelta, float pageScale) = 0;
-    virtual PassOwnPtr<WebKit::WebGraphicsContext3D> createContext3D() = 0;
-    virtual void didRecreateContext(bool success) = 0;
+    virtual PassOwnPtr<WebKit::WebCompositorOutputSurface> createOutputSurface() = 0;
+    virtual void didRecreateOutputSurface(bool success) = 0;
     virtual void willCommit() = 0;
     virtual void didCommit() = 0;
     virtual void didCommitAndDrawFrame() = 0;
@@ -81,7 +80,6 @@ protected:
 struct CCLayerTreeSettings {
     CCLayerTreeSettings()
             : acceleratePainting(false)
-            , forceSoftwareCompositing(false)
             , showFPSCounter(false)
             , showPlatformLayerTree(false)
             , showPaintRects(false)
@@ -90,6 +88,7 @@ struct CCLayerTreeSettings {
             , showScreenSpaceRects(false)
             , showReplicaScreenSpaceRects(false)
             , showOccludingRects(false)
+            , renderVSyncEnabled(true)
             , refreshRate(0)
             , maxPartialTextureUpdates(std::numeric_limits<size_t>::max())
             , defaultTileSize(IntSize(256, 256))
@@ -98,7 +97,6 @@ struct CCLayerTreeSettings {
     { }
 
     bool acceleratePainting;
-    bool forceSoftwareCompositing;
     bool showFPSCounter;
     bool showPlatformLayerTree;
     bool showPaintRects;
@@ -107,6 +105,7 @@ struct CCLayerTreeSettings {
     bool showScreenSpaceRects;
     bool showReplicaScreenSpaceRects;
     bool showOccludingRects;
+    bool renderVSyncEnabled;
     double refreshRate;
     size_t maxPartialTextureUpdates;
     IntSize defaultTileSize;
@@ -123,12 +122,9 @@ struct LayerRendererCapabilities {
         : bestTextureFormat(0)
         , contextHasCachedFrontBuffer(false)
         , usingPartialSwap(false)
-        , usingMapSub(false)
         , usingAcceleratedPainting(false)
         , usingSetVisibility(false)
         , usingSwapCompleteCallback(false)
-        , usingTextureUsageHint(false)
-        , usingTextureStorageExtension(false)
         , usingGpuMemoryManager(false)
         , usingDiscardFramebuffer(false)
         , usingEglImage(false)
@@ -137,12 +133,9 @@ struct LayerRendererCapabilities {
     GC3Denum bestTextureFormat;
     bool contextHasCachedFrontBuffer;
     bool usingPartialSwap;
-    bool usingMapSub;
     bool usingAcceleratedPainting;
     bool usingSetVisibility;
     bool usingSwapCompleteCallback;
-    bool usingTextureUsageHint;
-    bool usingTextureStorageExtension;
     bool usingGpuMemoryManager;
     bool usingDiscardFramebuffer;
     bool usingEglImage;
@@ -188,7 +181,7 @@ public:
     virtual void acquireLayerTextures();
     // Returns false if we should abort this frame due to initialization failure.
     bool initializeLayerRendererIfNeeded();
-    void updateLayers(CCTextureUpdater&, size_t contentsMemoryLimitBytes);
+    void updateLayers(CCTextureUpdateQueue&, size_t contentsMemoryLimitBytes);
 
     CCLayerTreeHostClient* client() { return m_client; }
 
@@ -229,10 +222,9 @@ public:
 
     const CCLayerTreeSettings& settings() const { return m_settings; }
 
-    void setViewportSize(const IntSize&);
+    void setViewportSize(const IntSize& layoutViewportSize, const IntSize& deviceViewportSize);
 
-    const IntSize& viewportSize() const { return m_viewportSize; }
-    // Gives the viewport size in device/content space.
+    const IntSize& layoutViewportSize() const { return m_layoutViewportSize; }
     const IntSize& deviceViewportSize() const { return m_deviceViewportSize; }
 
     void setPageScaleFactorAndLimits(float pageScaleFactor, float minPageScaleFactor, float maxPageScaleFactor);
@@ -269,6 +261,8 @@ public:
     void setDeviceScaleFactor(float);
     float deviceScaleFactor() const { return m_deviceScaleFactor; }
 
+    void setFontAtlas(PassOwnPtr<CCFontAtlas>);
+
 protected:
     CCLayerTreeHost(CCLayerTreeHostClient*, const CCLayerTreeSettings&);
     bool initialize();
@@ -279,11 +273,11 @@ private:
 
     void initializeLayerRenderer();
 
-    void update(LayerChromium*, CCTextureUpdater&, const CCOcclusionTracker*);
-    bool paintLayerContents(const LayerList&, CCTextureUpdater&);
-    bool paintMasksForRenderSurface(LayerChromium*, CCTextureUpdater&);
+    void update(LayerChromium*, CCTextureUpdateQueue&, const CCOcclusionTracker*);
+    bool paintLayerContents(const LayerList&, CCTextureUpdateQueue&);
+    bool paintMasksForRenderSurface(LayerChromium*, CCTextureUpdateQueue&);
 
-    void updateLayers(LayerChromium*, CCTextureUpdater&);
+    void updateLayers(LayerChromium*, CCTextureUpdateQueue&);
 
     void prioritizeTextures(const LayerList&, CCOverdrawMetrics&); 
     void setPrioritiesForSurfaces(size_t surfaceMemoryBytes);
@@ -311,13 +305,15 @@ private:
     int m_numFailedRecreateAttempts;
 
     RefPtr<LayerChromium> m_rootLayer;
-    RefPtr<LayerChromium> m_hudLayer;
+    RefPtr<HeadsUpDisplayLayerChromium> m_hudLayer;
+    OwnPtr<CCFontAtlas> m_fontAtlas;
+
     OwnPtr<CCPrioritizedTextureManager> m_contentsTextureManager;
     OwnPtr<CCPrioritizedTexture> m_surfaceMemoryPlaceholder;
 
     CCLayerTreeSettings m_settings;
 
-    IntSize m_viewportSize;
+    IntSize m_layoutViewportSize;
     IntSize m_deviceViewportSize;
     float m_deviceScaleFactor;
 
@@ -335,6 +331,7 @@ private:
 
     TextureList m_deleteTextureAfterCommitList;
     size_t m_partialTextureUpdateRequests;
+
     static bool s_needsFilterContext;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
index 1836f6315..9f4a035d7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
@@ -65,50 +65,6 @@ IntRect CCLayerTreeHostCommon::calculateVisibleRect(const IntRect& targetSurface
     return layerRect;
 }
 
-template<typename LayerType, typename RenderSurfaceType>
-static IntRect calculateLayerScissorRect(LayerType* layer, const FloatRect& rootScissorRect)
-{
-    LayerType* renderTarget = layer->renderTarget();
-    RenderSurfaceType* targetSurface = renderTarget->renderSurface();
-
-    FloatRect rootScissorRectInTargetSurface = targetSurface->computeRootScissorRectInCurrentSurface(rootScissorRect);
-    FloatRect clipAndDamage = intersection(rootScissorRectInTargetSurface, layer->drawableContentRect());
-
-    return enclosingIntRect(clipAndDamage);
-}
-
-template<typename LayerType, typename RenderSurfaceType>
-static IntRect calculateSurfaceScissorRect(LayerType* layer, const FloatRect& rootScissorRect)
-{
-    LayerType* parentLayer = layer->parent();
-    LayerType* renderTarget = parentLayer->renderTarget();
-
-    RenderSurfaceType* targetSurface = renderTarget->renderSurface();
-    ASSERT(targetSurface);
-
-    RenderSurfaceType* currentSurface = layer->renderSurface();
-    ASSERT(currentSurface);
-
-    FloatRect clipRect = currentSurface->clipRect();
-
-    // For surfaces, empty clipRect means that the surface does not clip anything.
-    if (clipRect.isEmpty())
-        clipRect = intersection(targetSurface->contentRect(), currentSurface->drawableContentRect());
-    else
-        clipRect.intersect(currentSurface->drawableContentRect());
-
-    FloatRect rootScissorRectInTargetSurface = targetSurface->computeRootScissorRectInCurrentSurface(rootScissorRect);
-
-    FloatRect clipAndDamage = intersection(rootScissorRectInTargetSurface, clipRect);
-
-    // If the layer has background filters that move pixels, we cannot scissor as tightly.
-    // FIXME: this should be able to be a tighter scissor, perhaps expanded by the filter outsets?
-    if (layer->backgroundFilters().hasFilterThatMovesPixels())
-        clipAndDamage = rootScissorRectInTargetSurface;
-
-    return enclosingIntRect(clipAndDamage);
-}
-
 template<typename LayerType>
 static inline bool layerIsInExisting3DRenderingContext(LayerType* layer)
 {
@@ -556,6 +512,8 @@ static void calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
 
     // layerScreenSpaceTransform represents the transform between root layer's "screen space" and local content space.
     WebTransformationMatrix layerScreenSpaceTransform = fullHierarchyMatrix;
+    if (!layer->preserves3D())
+        CCMathUtil::flattenTransformTo2d(layerScreenSpaceTransform);
     layerScreenSpaceTransform.multiply(drawTransform);
     layer->setScreenSpaceTransform(layerScreenSpaceTransform);
 
@@ -679,15 +637,8 @@ static void calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
     }
 
     // Flatten to 2D if the layer doesn't preserve 3D.
-    if (!layer->preserves3D()) {
-        sublayerMatrix.setM13(0);
-        sublayerMatrix.setM23(0);
-        sublayerMatrix.setM31(0);
-        sublayerMatrix.setM32(0);
-        sublayerMatrix.setM33(1);
-        sublayerMatrix.setM34(0);
-        sublayerMatrix.setM43(0);
-    }
+    if (!layer->preserves3D())
+        CCMathUtil::flattenTransformTo2d(sublayerMatrix);
 
     // Apply the sublayer transform at the center of the layer.
     sublayerMatrix.multiply(layer->sublayerTransform());
@@ -824,7 +775,7 @@ static void calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
 // tree pass, revise calculateVisibleContentRect() so that this can be done in a single
 // pass inside calculateDrawTransformsInternal<>().
 template<typename LayerType, typename LayerList, typename RenderSurfaceType>
-static void calculateVisibleAndScissorRectsInternal(const LayerList& renderSurfaceLayerList, const FloatRect& rootScissorRect)
+static void calculateVisibleRectsInternal(const LayerList& renderSurfaceLayerList)
 {
     // Use BackToFront since it's cheap and this isn't order-dependent.
     typedef CCLayerIterator<LayerType, LayerList, RenderSurfaceType, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
@@ -841,12 +792,6 @@ static void calculateVisibleAndScissorRectsInternal(const LayerList& renderSurfa
         } else if (it.representsItself()) {
             IntRect visibleContentRect = calculateVisibleContentRect(*it);
             it->setVisibleContentRect(visibleContentRect);
-
-            IntRect scissorRect = calculateLayerScissorRect<LayerType, RenderSurfaceType>(*it, rootScissorRect);
-            it->setScissorRect(scissorRect);
-        } else if (it.representsContributingRenderSurface()) {
-            IntRect scissorRect = calculateSurfaceScissorRect<LayerType, RenderSurfaceType>(*it, rootScissorRect);
-            it->renderSurface()->setScissorRect(scissorRect);
         }
     }
 }
@@ -879,14 +824,14 @@ void CCLayerTreeHostCommon::calculateDrawTransforms(CCLayerImpl* rootLayer, cons
                                                                                                                 rootLayer->renderSurface()->layerList(), layerSorter, maxTextureSize, deviceScaleFactor, totalDrawableContentRect);
 }
 
-void CCLayerTreeHostCommon::calculateVisibleAndScissorRects(Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, const FloatRect& rootScissorRect)
+void CCLayerTreeHostCommon::calculateVisibleRects(Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList)
 {
-    calculateVisibleAndScissorRectsInternal<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium>(renderSurfaceLayerList, rootScissorRect);
+    calculateVisibleRectsInternal<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium>(renderSurfaceLayerList);
 }
 
-void CCLayerTreeHostCommon::calculateVisibleAndScissorRects(Vector<CCLayerImpl*>& renderSurfaceLayerList, const FloatRect& rootScissorRect)
+void CCLayerTreeHostCommon::calculateVisibleRects(Vector<CCLayerImpl*>& renderSurfaceLayerList)
 {
-    calculateVisibleAndScissorRectsInternal<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface>(renderSurfaceLayerList, rootScissorRect);
+    calculateVisibleRectsInternal<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface>(renderSurfaceLayerList);
 }
 
 static bool pointHitsRect(const IntPoint& viewportPoint, const WebTransformationMatrix& localSpaceToScreenSpaceTransform, FloatRect localSpaceRect)
@@ -918,7 +863,7 @@ static bool pointIsClippedBySurfaceOrClipRect(const IntPoint& viewportPoint, CCL
         // Note that drawableContentRects are actually in targetSurface space, so the transform we
         // have to provide is the target surface's screenSpaceTransform.
         CCLayerImpl* renderTarget = currentLayer->renderTarget();
-        if (!pointHitsRect(viewportPoint, renderTarget->renderSurface()->screenSpaceTransform(), currentLayer->drawableContentRect()))
+        if (layerClipsSubtree(currentLayer) && !pointHitsRect(viewportPoint, renderTarget->renderSurface()->screenSpaceTransform(), currentLayer->drawableContentRect()))
             return true;
 
         currentLayer = currentLayer->parent();
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h
index b6e2a07c5..4e96904a6 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h
@@ -44,8 +44,8 @@ public:
     static void calculateDrawTransforms(LayerChromium* rootLayer, const IntSize& deviceViewportSize, float deviceScaleFactor, int maxTextureSize, Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList);
     static void calculateDrawTransforms(CCLayerImpl* rootLayer, const IntSize& deviceViewportSize, float deviceScaleFactor, CCLayerSorter*, int maxTextureSize, Vector<CCLayerImpl*>& renderSurfaceLayerList);
 
-    static void calculateVisibleAndScissorRects(Vector<CCLayerImpl*>& renderSurfaceLayerList, const FloatRect& rootScissorRect);
-    static void calculateVisibleAndScissorRects(Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, const FloatRect& rootScissorRect);
+    static void calculateVisibleRects(Vector<CCLayerImpl*>& renderSurfaceLayerList);
+    static void calculateVisibleRects(Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList);
 
     // Performs hit testing for a given renderSurfaceLayerList.
     static CCLayerImpl* findLayerThatIsHitByPoint(const IntPoint& viewportPoint, Vector<CCLayerImpl*>& renderSurfaceLayerList);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
index 493f35a27..b4f808e15 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
@@ -43,6 +43,8 @@
 #include "cc/CCPrioritizedTextureManager.h"
 #include "cc/CCRenderPassDrawQuad.h"
 #include "cc/CCRenderingStats.h"
+#include "cc/CCScrollbarAnimationController.h"
+#include "cc/CCScrollbarLayerImpl.h"
 #include "cc/CCSettings.h"
 #include "cc/CCSingleThreadProxy.h"
 #include <wtf/CurrentTime.h>
@@ -166,7 +168,7 @@ bool CCLayerTreeHostImpl::canDraw()
         TRACE_EVENT_INSTANT0("cc", "CCLayerTreeHostImpl::canDraw no root layer");
         return false;
     }
-    if (viewportSize().isEmpty()) {
+    if (deviceViewportSize().isEmpty()) {
         TRACE_EVENT_INSTANT0("cc", "CCLayerTreeHostImpl::canDraw empty viewport");
         return false;
     }
@@ -191,6 +193,7 @@ void CCLayerTreeHostImpl::animate(double monotonicTime, double wallClockTime)
     animatePageScale(monotonicTime);
     animateLayers(monotonicTime, wallClockTime);
     animateGestures(monotonicTime);
+    animateScrollbars(monotonicTime);
 }
 
 void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTime, double duration)
@@ -204,7 +207,7 @@ void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition,
     IntSize scaledContentSize = contentSize();
     scaledContentSize.scale(m_pageScaleDelta);
 
-    m_pageScaleAnimation = CCPageScaleAnimation::create(scrollTotal, scaleTotal, m_viewportSize, scaledContentSize, startTime);
+    m_pageScaleAnimation = CCPageScaleAnimation::create(scrollTotal, scaleTotal, m_deviceViewportSize, scaledContentSize, startTime);
 
     if (anchorPoint) {
         IntSize windowAnchor(targetPosition);
@@ -253,15 +256,9 @@ void CCLayerTreeHostImpl::calculateRenderSurfaceLayerList(CCLayerList& renderSur
     {
         TRACE_EVENT0("cc", "CCLayerTreeHostImpl::calcDrawEtc");
         CCLayerTreeHostCommon::calculateDrawTransforms(m_rootLayerImpl.get(), deviceViewportSize(), m_deviceScaleFactor, &m_layerSorter, layerRendererCapabilities().maxTextureSize, renderSurfaceLayerList);
+        CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
         trackDamageForAllSurfaces(m_rootLayerImpl.get(), renderSurfaceLayerList);
-
-        if (layerRendererCapabilities().usingPartialSwap)
-            m_rootScissorRect = m_rootLayerImpl->renderSurface()->damageTracker()->currentDamageRect();
-        else
-            m_rootScissorRect = FloatRect(FloatPoint(0, 0), deviceViewportSize());
-
-        CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, m_rootScissorRect);
     }
 }
 
@@ -273,8 +270,6 @@ bool CCLayerTreeHostImpl::calculateRenderPasses(FrameData& frame)
 
     TRACE_EVENT1("cc", "CCLayerTreeHostImpl::calculateRenderPasses", "renderSurfaceLayerList.size()", static_cast<long long unsigned>(frame.renderSurfaceLayerList->size()));
 
-    m_rootLayerImpl->setScissorRect(enclosingIntRect(m_rootScissorRect));
-
     // Create the render passes in dependency order.
     HashMap<CCRenderSurface*, CCRenderPass*> surfacePassMap;
     for (int surfaceIndex = frame.renderSurfaceLayerList->size() - 1; surfaceIndex >= 0 ; --surfaceIndex) {
@@ -283,6 +278,7 @@ bool CCLayerTreeHostImpl::calculateRenderPasses(FrameData& frame)
 
         int renderPassId = renderSurfaceLayer->id();
         OwnPtr<CCRenderPass> pass = CCRenderPass::create(renderSurface, renderPassId);
+        pass->setDamageRect(renderSurface->damageTracker()->currentDamageRect());
         pass->setFilters(renderSurfaceLayer->filters());
         pass->setBackgroundFilters(renderSurfaceLayer->backgroundFilters());
 
@@ -292,7 +288,7 @@ bool CCLayerTreeHostImpl::calculateRenderPasses(FrameData& frame)
     }
 
     bool recordMetricsForFrame = true; // FIXME: In the future, disable this when about:tracing is off.
-    CCOcclusionTrackerImpl occlusionTracker(enclosingIntRect(m_rootScissorRect), recordMetricsForFrame);
+    CCOcclusionTrackerImpl occlusionTracker(m_rootLayerImpl->renderSurface()->contentRect(), recordMetricsForFrame);
     occlusionTracker.setMinimumTrackingSize(m_settings.minimumOcclusionTrackingSize);
 
     if (settings().showOccludingRects)
@@ -314,10 +310,10 @@ bool CCLayerTreeHostImpl::calculateRenderPasses(FrameData& frame)
 
         occlusionTracker.enterLayer(it);
 
-        if (it.representsContributingRenderSurface() && !it->renderSurface()->scissorRect().isEmpty()) {
+        if (it.representsContributingRenderSurface()) {
             CCRenderPass* contributingRenderPass = surfacePassMap.get(it->renderSurface());
             pass->appendQuadsForRenderSurfaceLayer(*it, contributingRenderPass, &occlusionTracker);
-        } else if (it.representsItself() && !it->visibleContentRect().isEmpty() && !it->scissorRect().isEmpty()) {
+        } else if (it.representsItself() && !it->visibleContentRect().isEmpty()) {
             bool hasOcclusionFromOutsideTargetSurface;
             if (occlusionTracker.occluded(*it, it->visibleContentRect(), &hasOcclusionFromOutsideTargetSurface)) {
                 if (hasOcclusionFromOutsideTargetSurface)
@@ -531,6 +527,11 @@ void CCLayerTreeHostImpl::setMemoryAllocationLimitBytes(size_t bytes)
     m_client->setNeedsCommitOnImplThread();
 }
 
+void CCLayerTreeHostImpl::onVSyncParametersChanged(double monotonicTimebase, double intervalInSeconds)
+{
+    m_client->onVSyncParametersChanged(monotonicTimebase, intervalInSeconds);
+}
+
 void CCLayerTreeHostImpl::drawLayers(const FrameData& frame)
 {
     TRACE_EVENT0("cc", "CCLayerTreeHostImpl::drawLayers");
@@ -542,15 +543,19 @@ void CCLayerTreeHostImpl::drawLayers(const FrameData& frame)
     // RenderWidget.
     m_fpsCounter->markBeginningOfFrame(currentTime());
 
-    m_layerRenderer->drawFrame(frame.renderPasses, frame.renderPassesById, m_rootScissorRect);
-
-    for (unsigned int i = 0; i < frame.renderPasses.size(); i++)
-        frame.renderPasses[i]->targetSurface()->damageTracker()->didDrawDamagedArea();
+    m_layerRenderer->drawFrame(frame.renderPasses, frame.renderPassesById);
 
     if (m_settings.showDebugRects())
         m_debugRectHistory->saveDebugRectsForCurrentFrame(m_rootLayerImpl.get(), *frame.renderSurfaceLayerList, frame.occludingScreenSpaceRects, settings());
 
+    // Once a RenderPass has been drawn, its damage should be cleared in
+    // case the RenderPass will be reused next frame.
+    for (unsigned int i = 0; i < frame.renderPasses.size(); i++)
+        frame.renderPasses[i]->setDamageRect(FloatRect());
+
     // The next frame should start by assuming nothing has changed, and changes are noted as they occur.
+    for (unsigned int i = 0; i < frame.renderSurfaceLayerList->size(); i++)
+        (*frame.renderSurfaceLayerList)[i]->renderSurface()->damageTracker()->didDrawDamagedArea();
     m_rootLayerImpl->resetAllChangeTrackingForSubtree();
 }
 
@@ -581,7 +586,7 @@ bool CCLayerTreeHostImpl::swapBuffers()
     ASSERT(m_layerRenderer);
 
     m_fpsCounter->markEndOfFrame();
-    return m_layerRenderer->swapBuffers(enclosingIntRect(m_rootScissorRect));
+    return m_layerRenderer->swapBuffers();
 }
 
 void CCLayerTreeHostImpl::didLoseContext()
@@ -675,7 +680,11 @@ void CCLayerTreeHostImpl::setVisible(bool visible)
 
 bool CCLayerTreeHostImpl::initializeLayerRenderer(PassOwnPtr<CCGraphicsContext> context, TextureUploaderOption textureUploader)
 {
+    if (!context->bindToClient(this))
+        return false;
+
     WebKit::WebGraphicsContext3D* context3d = context->context3D();
+
     if (!context3d) {
         // FIXME: Implement this path for software compositing.
         return false;
@@ -705,15 +714,13 @@ bool CCLayerTreeHostImpl::initializeLayerRenderer(PassOwnPtr<CCGraphicsContext>
     return m_layerRenderer;
 }
 
-void CCLayerTreeHostImpl::setViewportSize(const IntSize& viewportSize)
+void CCLayerTreeHostImpl::setViewportSize(const IntSize& layoutViewportSize, const IntSize& deviceViewportSize)
 {
-    if (viewportSize == m_viewportSize)
+    if (layoutViewportSize == m_layoutViewportSize && deviceViewportSize == m_deviceViewportSize)
         return;
 
-    m_viewportSize = viewportSize;
-
-    m_deviceViewportSize = viewportSize;
-    m_deviceViewportSize.scale(m_deviceScaleFactor);
+    m_layoutViewportSize = layoutViewportSize;
+    m_deviceViewportSize = deviceViewportSize;
 
     updateMaxScrollPosition();
 
@@ -742,12 +749,6 @@ void CCLayerTreeHostImpl::setDeviceScaleFactor(float deviceScaleFactor)
     if (deviceScaleFactor == m_deviceScaleFactor)
         return;
     m_deviceScaleFactor = deviceScaleFactor;
-
-    m_deviceViewportSize = viewportSize();
-    m_deviceViewportSize.scale(m_deviceScaleFactor);
-    updateMaxScrollPosition();
-    if (m_layerRenderer)
-        m_layerRenderer->viewportChanged();
 }
 
 
@@ -799,13 +800,15 @@ void CCLayerTreeHostImpl::updateMaxScrollPosition()
     if (!m_rootScrollLayerImpl || !m_rootScrollLayerImpl->children().size())
         return;
 
-    FloatSize viewBounds = m_viewportSize;
+    FloatSize viewBounds = m_deviceViewportSize;
     if (CCLayerImpl* clipLayer = m_rootScrollLayerImpl->parent()) {
-        if (clipLayer->masksToBounds())
+        // Compensate for non-overlay scrollbars.
+        if (clipLayer->masksToBounds()) {
             viewBounds = clipLayer->bounds();
+            viewBounds.scale(m_deviceScaleFactor);
+        }
     }
     viewBounds.scale(1 / m_pageScaleDelta);
-    viewBounds.scale(m_deviceScaleFactor);
 
     // maxScroll is computed in physical pixels, but scroll positions are in layout pixels.
     IntSize maxScroll = contentSize() - expandedIntSize(viewBounds);
@@ -931,6 +934,9 @@ void CCLayerTreeHostImpl::pinchGestureBegin()
 {
     m_pinchGestureActive = true;
     m_previousPinchAnchor = IntPoint();
+
+    if (m_rootScrollLayerImpl && m_rootScrollLayerImpl->scrollbarAnimationController())
+        m_rootScrollLayerImpl->scrollbarAnimationController()->didPinchGestureBegin();
 }
 
 void CCLayerTreeHostImpl::pinchGestureUpdate(float magnifyDelta,
@@ -954,6 +960,10 @@ void CCLayerTreeHostImpl::pinchGestureUpdate(float magnifyDelta,
     m_previousPinchAnchor = anchor;
 
     m_rootScrollLayerImpl->scrollBy(roundedIntSize(move));
+
+    if (m_rootScrollLayerImpl->scrollbarAnimationController())
+        m_rootScrollLayerImpl->scrollbarAnimationController()->didPinchGestureUpdate();
+
     m_client->setNeedsCommitOnImplThread();
     m_client->setNeedsRedrawOnImplThread();
 }
@@ -962,6 +972,9 @@ void CCLayerTreeHostImpl::pinchGestureEnd()
 {
     m_pinchGestureActive = false;
 
+    if (m_rootScrollLayerImpl && m_rootScrollLayerImpl->scrollbarAnimationController())
+        m_rootScrollLayerImpl->scrollbarAnimationController()->didPinchGestureEnd();
+
     m_client->setNeedsCommitOnImplThread();
 }
 
@@ -1179,4 +1192,22 @@ void CCLayerTreeHostImpl::renderingStats(CCRenderingStats& stats) const
     stats.droppedFrameCount = fpsCounter()->droppedFrameCount();
 }
 
+void CCLayerTreeHostImpl::animateScrollbars(double monotonicTime)
+{
+    animateScrollbarsRecursive(m_rootLayerImpl.get(), monotonicTime);
+}
+
+void CCLayerTreeHostImpl::animateScrollbarsRecursive(CCLayerImpl* layer, double monotonicTime)
+{
+    if (!layer)
+        return;
+
+    CCScrollbarAnimationController* scrollbarController = layer->scrollbarAnimationController();
+    if (scrollbarController && scrollbarController->animate(monotonicTime))
+        m_client->setNeedsRedrawOnImplThread();
+
+    for (size_t i = 0; i < layer->children().size(); ++i)
+        animateScrollbarsRecursive(layer->children()[i].get(), monotonicTime);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
index 0458e2811..6ca0cd692 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
@@ -31,6 +31,7 @@
 #include "cc/CCLayerSorter.h"
 #include "cc/CCRenderPass.h"
 #include "cc/CCRenderer.h"
+#include <public/WebCompositorOutputSurfaceClient.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -54,13 +55,16 @@ class CCLayerTreeHostImplClient {
 public:
     virtual void didLoseContextOnImplThread() = 0;
     virtual void onSwapBuffersCompleteOnImplThread() = 0;
+    virtual void onVSyncParametersChanged(double monotonicTimebase, double intervalInSeconds) = 0;
     virtual void setNeedsRedrawOnImplThread() = 0;
     virtual void setNeedsCommitOnImplThread() = 0;
     virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) = 0;
 };
 
 // CCLayerTreeHostImpl owns the CCLayerImpl tree as well as associated rendering state
-class CCLayerTreeHostImpl : public CCInputHandlerClient, CCRendererClient {
+class CCLayerTreeHostImpl : public CCInputHandlerClient,
+                            public CCRendererClient,
+                            public WebKit::WebCompositorOutputSurfaceClient {
     WTF_MAKE_NONCOPYABLE(CCLayerTreeHostImpl);
     typedef Vector<CCLayerImpl*> CCLayerList;
 
@@ -69,17 +73,17 @@ public:
     virtual ~CCLayerTreeHostImpl();
 
     // CCInputHandlerClient implementation
-    virtual CCInputHandlerClient::ScrollStatus scrollBegin(const IntPoint&, CCInputHandlerClient::ScrollInputType);
-    virtual void scrollBy(const IntSize&);
-    virtual void scrollEnd();
-    virtual void pinchGestureBegin();
-    virtual void pinchGestureUpdate(float, const IntPoint&);
-    virtual void pinchGestureEnd();
-    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTime, double duration);
-    virtual CCActiveGestureAnimation* activeGestureAnimation() { return m_activeGestureAnimation.get(); }
+    virtual CCInputHandlerClient::ScrollStatus scrollBegin(const IntPoint&, CCInputHandlerClient::ScrollInputType) OVERRIDE;
+    virtual void scrollBy(const IntSize&) OVERRIDE;
+    virtual void scrollEnd() OVERRIDE;
+    virtual void pinchGestureBegin() OVERRIDE;
+    virtual void pinchGestureUpdate(float, const IntPoint&) OVERRIDE;
+    virtual void pinchGestureEnd() OVERRIDE;
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTime, double duration) OVERRIDE;
+    virtual CCActiveGestureAnimation* activeGestureAnimation() OVERRIDE { return m_activeGestureAnimation.get(); }
     // To clear an active animation, pass nullptr.
-    virtual void setActiveGestureAnimation(PassOwnPtr<CCActiveGestureAnimation>);
-    virtual void scheduleAnimation();
+    virtual void setActiveGestureAnimation(PassOwnPtr<CCActiveGestureAnimation>) OVERRIDE;
+    virtual void scheduleAnimation() OVERRIDE;
 
     struct FrameData {
         Vector<IntRect> occludingScreenSpaceRects;
@@ -112,6 +116,9 @@ public:
     virtual void releaseContentsTextures() OVERRIDE;
     virtual void setMemoryAllocationLimitBytes(size_t) OVERRIDE;
 
+    // WebCompositorOutputSurfaceClient implementation.
+    virtual void onVSyncParametersChanged(double monotonicTimebase, double intervalInSeconds) OVERRIDE;
+
     // Implementation
     bool canDraw();
     CCGraphicsContext* context() const;
@@ -148,8 +155,8 @@ public:
     bool contentsTexturesWerePurgedSinceLastCommit() const { return m_contentsTexturesWerePurgedSinceLastCommit; }
     size_t memoryAllocationLimitBytes() const { return m_memoryAllocationLimitBytes; }
 
-    const IntSize& viewportSize() const { return m_viewportSize; }
-    void setViewportSize(const IntSize&);
+    void setViewportSize(const IntSize& layoutViewportSize, const IntSize& deviceViewportSize);
+    const IntSize& layoutViewportSize() const { return m_layoutViewportSize; }
 
     float deviceScaleFactor() const { return m_deviceScaleFactor; }
     void setDeviceScaleFactor(float);
@@ -213,6 +220,7 @@ protected:
 
     void animatePageScale(double monotonicTime);
     void animateGestures(double monotonicTime);
+    void animateScrollbars(double monotonicTime);
 
     // Exposed for testing.
     void calculateRenderSurfaceLayerList(CCLayerList&);
@@ -248,6 +256,8 @@ private:
     bool ensureRenderSurfaceLayerList();
     void clearCurrentlyScrollingLayer();
 
+    void animateScrollbarsRecursive(CCLayerImpl*, double monotonicTime);
+
     void dumpRenderSurfaces(TextStream&, int indent, const CCLayerImpl*) const;
 
     OwnPtr<CCGraphicsContext> m_context;
@@ -258,7 +268,7 @@ private:
     CCLayerImpl* m_currentlyScrollingLayerImpl;
     int m_scrollingLayerIdFromPreviousTree;
     CCLayerTreeSettings m_settings;
-    IntSize m_viewportSize;
+    IntSize m_layoutViewportSize;
     IntSize m_deviceViewportSize;
     float m_deviceScaleFactor;
     bool m_visible;
@@ -286,8 +296,6 @@ private:
 
     CCLayerSorter m_layerSorter;
 
-    FloatRect m_rootScissorRect;
-
     // List of visible layers for the most recently prepared frame. Used for
     // rendering and input event hit testing.
     CCLayerList m_renderSurfaceLayerList;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.cpp
index 007e74d49..4d5ec933d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.cpp
@@ -57,17 +57,17 @@ static HomogeneousCoordinate projectHomogeneousPoint(const WebTransformationMatr
     return HomogeneousCoordinate(outX, outY, outZ, outW);
 }
 
-static HomogeneousCoordinate mapHomogeneousPoint(const WebTransformationMatrix& transform, const FloatPoint& p)
+static HomogeneousCoordinate mapHomogeneousPoint(const WebTransformationMatrix& transform, const FloatPoint3D& p)
 {
     double x = p.x();
     double y = p.y();
-    // implicit definition of z = 0;
+    double z = p.z();
     // implicit definition of w = 1;
 
-    double outX = x * transform.m11() + y * transform.m21() + transform.m41();
-    double outY = x * transform.m12() + y * transform.m22() + transform.m42();
-    double outZ = x * transform.m13() + y * transform.m23() + transform.m43();
-    double outW = x * transform.m14() + y * transform.m24() + transform.m44();
+    double outX = x * transform.m11() + y * transform.m21() + z * transform.m31() + transform.m41();
+    double outY = x * transform.m12() + y * transform.m22() + z * transform.m32() + transform.m42();
+    double outZ = x * transform.m13() + y * transform.m23() + z * transform.m33() + transform.m43();
+    double outW = x * transform.m14() + y * transform.m24() + z * transform.m34() + transform.m44();
 
     return HomogeneousCoordinate(outX, outY, outZ, outW);
 }
@@ -274,6 +274,52 @@ FloatQuad CCMathUtil::mapQuad(const WebTransformationMatrix& transform, const Fl
     return FloatQuad(h1.cartesianPoint2d(), h2.cartesianPoint2d(), h3.cartesianPoint2d(), h4.cartesianPoint2d());
 }
 
+FloatPoint CCMathUtil::mapPoint(const WebTransformationMatrix& transform, const FloatPoint& p, bool& clipped)
+{
+    HomogeneousCoordinate h = mapHomogeneousPoint(transform, p);
+
+    if (h.w > 0) {
+        clipped = false;
+        return h.cartesianPoint2d();
+    }
+
+    // The cartesian coordinates will be invalid after dividing by w.
+    clipped = true;
+
+    // Avoid dividing by w if w == 0.
+    if (!h.w)
+        return FloatPoint();
+
+    // This return value will be invalid because clipped == true, but (1) users of this
+    // code should be ignoring the return value when clipped == true anyway, and (2) this
+    // behavior is more consistent with existing behavior of WebKit transforms if the user
+    // really does not ignore the return value.
+    return h.cartesianPoint2d();
+}
+
+FloatPoint3D CCMathUtil::mapPoint(const WebTransformationMatrix& transform, const FloatPoint3D& p, bool& clipped)
+{
+    HomogeneousCoordinate h = mapHomogeneousPoint(transform, p);
+
+    if (h.w > 0) {
+        clipped = false;
+        return h.cartesianPoint3d();
+    }
+
+    // The cartesian coordinates will be invalid after dividing by w.
+    clipped = true;
+
+    // Avoid dividing by w if w == 0.
+    if (!h.w)
+        return FloatPoint3D();
+
+    // This return value will be invalid because clipped == true, but (1) users of this
+    // code should be ignoring the return value when clipped == true anyway, and (2) this
+    // behavior is more consistent with existing behavior of WebKit transforms if the user
+    // really does not ignore the return value.
+    return h.cartesianPoint3d();
+}
+
 FloatQuad CCMathUtil::projectQuad(const WebTransformationMatrix& transform, const FloatQuad& q, bool& clipped)
 {
     FloatQuad projectedQuad;
@@ -314,5 +360,25 @@ FloatPoint CCMathUtil::projectPoint(const WebTransformationMatrix& transform, co
     return h.cartesianPoint2d();
 }
 
+void CCMathUtil::flattenTransformTo2d(WebTransformationMatrix& transform)
+{
+    // Set both the 3rd row and 3rd column to (0, 0, 1, 0).
+    //
+    // One useful interpretation of doing this operation:
+    //  - For x and y values, the new transform behaves effectively like an orthographic
+    //    projection was added to the matrix sequence.
+    //  - For z values, the new transform overrides any effect that the transform had on
+    //    z, and instead it preserves the z value for any points that are transformed.
+    //  - Because of linearity of transforms, this flattened transform also preserves the
+    //    effect that any subsequent (post-multiplied) transforms would have on z values.
+    //
+    transform.setM13(0);
+    transform.setM23(0);
+    transform.setM31(0);
+    transform.setM32(0);
+    transform.setM33(1);
+    transform.setM34(0);
+    transform.setM43(0);
+}
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.h b/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.h
index cbceda0a1..3fb591429 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.h
@@ -26,6 +26,7 @@
 #define CCMathUtil_h
 
 #include "FloatPoint.h"
+#include "FloatPoint3D.h"
 
 namespace WebKit {
 class WebTransformationMatrix;
@@ -62,6 +63,17 @@ struct HomogeneousCoordinate {
         return FloatPoint(x * invW, y * invW);
     }
 
+    FloatPoint3D cartesianPoint3d() const
+    {
+        if (w == 1)
+            return FloatPoint3D(x, y, z);
+
+        // For now, because this code is used privately only by CCMathUtil, it should never be called when w == 0, and we do not yet need to handle that case.
+        ASSERT(w);
+        double invW = 1.0 / w;
+        return FloatPoint3D(x * invW, y * invW, z * invW);
+    }
+
     double x;
     double y;
     double z;
@@ -97,8 +109,12 @@ public:
     // NOTE: These functions do not do correct clipping against w = 0 plane, but they
     // correctly detect the clipped condition via the boolean clipped.
     static FloatQuad mapQuad(const WebKit::WebTransformationMatrix&, const FloatQuad&, bool& clipped);
+    static FloatPoint mapPoint(const WebKit::WebTransformationMatrix&, const FloatPoint&, bool& clipped);
+    static FloatPoint3D mapPoint(const WebKit::WebTransformationMatrix&, const FloatPoint3D&, bool& clipped);
     static FloatQuad projectQuad(const WebKit::WebTransformationMatrix&, const FloatQuad&, bool& clipped);
     static FloatPoint projectPoint(const WebKit::WebTransformationMatrix&, const FloatPoint&, bool& clipped);
+
+    static void flattenTransformTo2d(WebKit::WebTransformationMatrix&);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
index 1b5d39726..ae490b76e 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
@@ -42,8 +42,8 @@ using WebKit::WebTransformationMatrix;
 namespace WebCore {
 
 template<typename LayerType, typename RenderSurfaceType>
-CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, bool recordMetricsForFrame)
-    : m_scissorRectInScreenSpace(scissorRectInScreenSpace)
+CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::CCOcclusionTrackerBase(IntRect rootTargetRect, bool recordMetricsForFrame)
+    : m_rootTargetRect(rootTargetRect)
     , m_overdrawMetrics(CCOverdrawMetrics::create(recordMetricsForFrame))
     , m_occludingScreenSpaceRects(0)
 {
@@ -267,7 +267,7 @@ void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::leaveToRenderTarget(c
 
 // FIXME: Remove usePaintTracking when paint tracking is on for paint culling.
 template<typename LayerType>
-static inline void addOcclusionBehindLayer(Region& region, const LayerType* layer, const WebTransformationMatrix& transform, const Region& opaqueContents, const IntRect& scissorRect, const IntSize& minimumTrackingSize, Vector<IntRect>* occludingScreenSpaceRects)
+static inline void addOcclusionBehindLayer(Region& region, const LayerType* layer, const WebTransformationMatrix& transform, const Region& opaqueContents, const IntRect& clipRectInTarget, const IntSize& minimumTrackingSize, Vector<IntRect>* occludingScreenSpaceRects)
 {
     ASSERT(layer->visibleContentRect().contains(opaqueContents.bounds()));
 
@@ -281,7 +281,7 @@ static inline void addOcclusionBehindLayer(Region& region, const LayerType* laye
     for (size_t i = 0; i < contentRects.size(); ++i) {
         // We've already checked for clipping in the mapQuad call above, these calls should not clip anything further.
         IntRect transformedRect = enclosedIntRect(CCMathUtil::mapClippedRect(transform, FloatRect(contentRects[i])));
-        transformedRect.intersect(scissorRect);
+        transformedRect.intersect(clipRectInTarget);
         if (transformedRect.width() >= minimumTrackingSize.width() || transformedRect.height() >= minimumTrackingSize.height()) {
             if (occludingScreenSpaceRects)
                 occludingScreenSpaceRects->append(transformedRect);
@@ -308,30 +308,30 @@ void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::markOccludedBehindLay
     if (opaqueContents.isEmpty())
         return;
 
-    IntRect scissorInTarget = layerScissorRectInTargetSurface(layer);
+    IntRect clipRectInTarget = layerClipRectInTarget(layer);
     if (layerTransformsToTargetKnown(layer))
-        addOcclusionBehindLayer<LayerType>(m_stack.last().occlusionInTarget, layer, layer->drawTransform(), opaqueContents, scissorInTarget, m_minimumTrackingSize, 0);
+        addOcclusionBehindLayer<LayerType>(m_stack.last().occlusionInTarget, layer, layer->drawTransform(), opaqueContents, clipRectInTarget, m_minimumTrackingSize, 0);
 
-    // We must clip the occlusion within the layer's scissorInTarget within screen space as well. If the scissor rect can't be moved to screen space and
+    // We must clip the occlusion within the layer's clipRectInTarget within screen space as well. If the clip rect can't be moved to screen space and
     // remain rectilinear, then we don't add any occlusion in screen space.
 
     if (layerTransformsToScreenKnown(layer)) {
         WebTransformationMatrix targetToScreenTransform = m_stack.last().target->renderSurface()->screenSpaceTransform();
         bool clipped;
-        FloatQuad scissorInScreenQuad = CCMathUtil::mapQuad(targetToScreenTransform, FloatQuad(FloatRect(scissorInTarget)), clipped);
-        // FIXME: Find a rect interior to the transformed scissor quad.
-        if (clipped || !scissorInScreenQuad.isRectilinear())
+        FloatQuad clipQuadInScreen = CCMathUtil::mapQuad(targetToScreenTransform, FloatQuad(FloatRect(clipRectInTarget)), clipped);
+        // FIXME: Find a rect interior to the transformed clip quad.
+        if (clipped || !clipQuadInScreen.isRectilinear())
             return;
-        IntRect scissorInScreenRect = intersection(m_scissorRectInScreenSpace, enclosedIntRect(scissorInScreenQuad.boundingBox()));
-        addOcclusionBehindLayer<LayerType>(m_stack.last().occlusionInScreen, layer, layer->screenSpaceTransform(), opaqueContents, scissorInScreenRect, m_minimumTrackingSize, m_occludingScreenSpaceRects);
+        IntRect clipRectInScreen = intersection(m_rootTargetRect, enclosedIntRect(clipQuadInScreen.boundingBox()));
+        addOcclusionBehindLayer<LayerType>(m_stack.last().occlusionInScreen, layer, layer->screenSpaceTransform(), opaqueContents, clipRectInScreen, m_minimumTrackingSize, m_occludingScreenSpaceRects);
     }
 }
 
-static inline bool testContentRectOccluded(const IntRect& contentRect, const WebTransformationMatrix& contentSpaceTransform, const IntRect& scissorRect, const Region& occlusion)
+static inline bool testContentRectOccluded(const IntRect& contentRect, const WebTransformationMatrix& contentSpaceTransform, const IntRect& clipRectInTarget, const Region& occlusion)
 {
     FloatRect transformedRect = CCMathUtil::mapClippedRect(contentSpaceTransform, FloatRect(contentRect));
     // Take the enclosingIntRect, as we want to include partial pixels in the test.
-    IntRect targetRect = intersection(enclosingIntRect(transformedRect), scissorRect);
+    IntRect targetRect = intersection(enclosingIntRect(transformedRect), clipRectInTarget);
     return targetRect.isEmpty() || occlusion.contains(targetRect);
 }
 
@@ -349,10 +349,10 @@ bool CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::occluded(const LayerT
 
     ASSERT(layer->renderTarget() == m_stack.last().target);
 
-    if (layerTransformsToTargetKnown(layer) && testContentRectOccluded(contentRect, layer->drawTransform(), layerScissorRectInTargetSurface(layer), m_stack.last().occlusionInTarget))
+    if (layerTransformsToTargetKnown(layer) && testContentRectOccluded(contentRect, layer->drawTransform(), layerClipRectInTarget(layer), m_stack.last().occlusionInTarget))
         return true;
 
-    if (layerTransformsToScreenKnown(layer) && testContentRectOccluded(contentRect, layer->screenSpaceTransform(), m_scissorRectInScreenSpace, m_stack.last().occlusionInScreen)) {
+    if (layerTransformsToScreenKnown(layer) && testContentRectOccluded(contentRect, layer->screenSpaceTransform(), m_rootTargetRect, m_stack.last().occlusionInScreen)) {
         if (hasOcclusionFromOutsideTargetSurface)
             *hasOcclusionFromOutsideTargetSurface = true;
         return true;
@@ -370,14 +370,14 @@ static inline IntRect rectSubtractRegion(const IntRect& rect, const Region& regi
     return rectRegion.bounds();
 }
 
-static inline IntRect computeUnoccludedContentRect(const IntRect& contentRect, const WebTransformationMatrix& contentSpaceTransform, const IntRect& scissorRect, const Region& occlusion)
+static inline IntRect computeUnoccludedContentRect(const IntRect& contentRect, const WebTransformationMatrix& contentSpaceTransform, const IntRect& clipRectInTarget, const Region& occlusion)
 {
     if (!contentSpaceTransform.isInvertible())
         return contentRect;
 
     // Take the enclosingIntRect at each step, as we want to contain any unoccluded partial pixels in the resulting IntRect.
     FloatRect transformedRect = CCMathUtil::mapClippedRect(contentSpaceTransform, FloatRect(contentRect));
-    IntRect shrunkRect = rectSubtractRegion(intersection(enclosingIntRect(transformedRect), scissorRect), occlusion);
+    IntRect shrunkRect = rectSubtractRegion(intersection(enclosingIntRect(transformedRect), clipRectInTarget), occlusion);
     IntRect unoccludedRect = enclosingIntRect(CCMathUtil::projectClippedRect(contentSpaceTransform.inverse(), FloatRect(shrunkRect)));
     // The rect back in content space is a bounding box and may extend outside of the original contentRect, so clamp it to the contentRectBounds.
     return intersection(unoccludedRect, contentRect);
@@ -399,11 +399,11 @@ IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::unoccludedContentR
 
     IntRect unoccludedInScreen = contentRect;
     if (layerTransformsToScreenKnown(layer))
-        unoccludedInScreen = computeUnoccludedContentRect(contentRect, layer->screenSpaceTransform(), m_scissorRectInScreenSpace, m_stack.last().occlusionInScreen);
+        unoccludedInScreen = computeUnoccludedContentRect(contentRect, layer->screenSpaceTransform(), m_rootTargetRect, m_stack.last().occlusionInScreen);
 
     IntRect unoccludedInTarget = contentRect;
     if (layerTransformsToTargetKnown(layer))
-        unoccludedInTarget = computeUnoccludedContentRect(contentRect, layer->drawTransform(), layerScissorRectInTargetSurface(layer), m_stack.last().occlusionInTarget);
+        unoccludedInTarget = computeUnoccludedContentRect(contentRect, layer->drawTransform(), layerClipRectInTarget(layer), m_stack.last().occlusionInTarget);
 
     if (hasOcclusionFromOutsideTargetSurface)
         *hasOcclusionFromOutsideTargetSurface = (intersection(unoccludedInScreen, unoccludedInTarget) != unoccludedInTarget);
@@ -446,9 +446,9 @@ IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::unoccludedContribu
     if (surfaceTransformsToScreenKnown(surface)) {
         if (hasOcclusion) {
             const StackObject& secondLast = m_stack[m_stack.size() - 2];
-            unoccludedInScreen = computeUnoccludedContentRect(contentRect, transformToScreen, m_scissorRectInScreenSpace, secondLast.occlusionInScreen);
+            unoccludedInScreen = computeUnoccludedContentRect(contentRect, transformToScreen, m_rootTargetRect, secondLast.occlusionInScreen);
         } else
-            unoccludedInScreen = computeUnoccludedContentRect(contentRect, transformToScreen, m_scissorRectInScreenSpace, Region());
+            unoccludedInScreen = computeUnoccludedContentRect(contentRect, transformToScreen, m_rootTargetRect, Region());
     }
 
     IntRect unoccludedInTarget = contentRect;
@@ -467,15 +467,15 @@ IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::unoccludedContribu
 }
 
 template<typename LayerType, typename RenderSurfaceType>
-IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::layerScissorRectInTargetSurface(const LayerType* layer) const
+IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::layerClipRectInTarget(const LayerType* layer) const
 {
     // FIXME: we could remove this helper function, but unit tests currently override this
     //        function, and they need to be verified/adjusted before this can be removed.
-    return layer->scissorRect();
+    return layer->drawableContentRect();
 }
 
 // Declare the possible functions here for the linker.
-template CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, bool recordMetricsForFrame);
+template CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::CCOcclusionTrackerBase(IntRect rootTargetRect, bool recordMetricsForFrame);
 template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::enterLayer(const CCLayerIteratorPosition<LayerChromium>&);
 template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::leaveLayer(const CCLayerIteratorPosition<LayerChromium>&);
 template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::enterRenderTarget(const LayerChromium* newTarget);
@@ -485,9 +485,9 @@ template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::mark
 template bool CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::occluded(const LayerChromium*, const IntRect& contentRect, bool* hasOcclusionFromOutsideTargetSurface) const;
 template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::unoccludedContentRect(const LayerChromium*, const IntRect& contentRect, bool* hasOcclusionFromOutsideTargetSurface) const;
 template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::unoccludedContributingSurfaceContentRect(const LayerChromium*, bool forReplica, const IntRect& contentRect, bool* hasOcclusionFromOutsideTargetSurface) const;
-template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::layerScissorRectInTargetSurface(const LayerChromium*) const;
+template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::layerClipRectInTarget(const LayerChromium*) const;
 
-template CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, bool recordMetricsForFrame);
+template CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::CCOcclusionTrackerBase(IntRect rootTargetRect, bool recordMetricsForFrame);
 template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::enterLayer(const CCLayerIteratorPosition<CCLayerImpl>&);
 template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::leaveLayer(const CCLayerIteratorPosition<CCLayerImpl>&);
 template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::enterRenderTarget(const CCLayerImpl* newTarget);
@@ -497,7 +497,7 @@ template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::markOccluded
 template bool CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::occluded(const CCLayerImpl*, const IntRect& contentRect, bool* hasOcclusionFromOutsideTargetSurface) const;
 template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::unoccludedContentRect(const CCLayerImpl*, const IntRect& contentRect, bool* hasOcclusionFromOutsideTargetSurface) const;
 template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::unoccludedContributingSurfaceContentRect(const CCLayerImpl*, bool forReplica, const IntRect& contentRect, bool* hasOcclusionFromOutsideTargetSurface) const;
-template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::layerScissorRectInTargetSurface(const CCLayerImpl*) const;
+template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::layerClipRectInTarget(const CCLayerImpl*) const;
 
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
index a601b6d39..d2f4a00dc 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
@@ -46,7 +46,7 @@ template<typename LayerType, typename RenderSurfaceType>
 class CCOcclusionTrackerBase {
     WTF_MAKE_NONCOPYABLE(CCOcclusionTrackerBase);
 public:
-    CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, bool recordMetricsForFrame);
+    CCOcclusionTrackerBase(IntRect rootTargetRect, bool recordMetricsForFrame);
 
     // Called at the beginning of each step in the CCLayerIterator's front-to-back traversal.
     void enterLayer(const CCLayerIteratorPosition<LayerType>&);
@@ -66,7 +66,7 @@ public:
     CCOverdrawMetrics& overdrawMetrics() const { return *m_overdrawMetrics.get(); }
 
     // Gives the region of the screen that is not occluded by something opaque.
-    Region computeVisibleRegionInScreen() const { return subtract(Region(m_scissorRectInScreenSpace), m_stack.last().occlusionInScreen); }
+    Region computeVisibleRegionInScreen() const { return subtract(Region(m_rootTargetRect), m_stack.last().occlusionInScreen); }
 
     void setMinimumTrackingSize(const IntSize& size) { m_minimumTrackingSize = size; }
 
@@ -92,7 +92,7 @@ protected:
     Vector<StackObject, 1> m_stack;
 
     // Allow tests to override this.
-    virtual IntRect layerScissorRectInTargetSurface(const LayerType*) const;
+    virtual IntRect layerClipRectInTarget(const LayerType*) const;
 
 private:
     // Called when visiting a layer representing itself. If the target was not already current, then this indicates we have entered a new surface subtree.
@@ -109,7 +109,7 @@ private:
     // Add the layer's occlusion to the tracked state.
     void markOccludedBehindLayer(const LayerType*);
 
-    IntRect m_scissorRectInScreenSpace;
+    IntRect m_rootTargetRect;
     OwnPtr<CCOverdrawMetrics> m_overdrawMetrics;
     IntSize m_minimumTrackingSize;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTextureManager.h b/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTextureManager.h
index b16ec1034..13dbc5176 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTextureManager.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTextureManager.h
@@ -31,6 +31,9 @@
 #include "GraphicsContext3D.h"
 #include "IntRect.h"
 #include "IntSize.h"
+#include <wtf/HashSet.h>
+#include <wtf/ListHashSet.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
index 3b6dc7f9c..935f13361 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
@@ -26,6 +26,7 @@
 #define CCProxy_h
 
 #include "IntRect.h"
+#include <public/WebCompositorOutputSurface.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -34,7 +35,6 @@
 namespace WebCore {
 
 class CCThread;
-class CCGraphicsContext;
 struct CCRenderingStats;
 struct LayerRendererCapabilities;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
index 7f0802782..e67b4468d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
@@ -42,7 +42,7 @@ public:
     virtual ~CCQuadCuller() { }
 
     // Returns true if the quad is added to the list, and false if the quad is entirely culled.
-    virtual bool append(PassOwnPtr<WebKit::WebCompositorQuad> passDrawQuad) OVERRIDE;
+    virtual bool append(PassOwnPtr<CCDrawQuad> passDrawQuad) OVERRIDE;
 
     bool hasOcclusionFromOutsideTargetSurface() { return m_hasOcclusionFromOutsideTargetSurface; }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadSink.h b/Source/WebCore/platform/graphics/chromium/cc/CCQuadSink.h
index f2a9c62ae..4ae6f238a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadSink.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadSink.h
@@ -28,18 +28,16 @@
 
 #include <wtf/PassOwnPtr.h>
 
-namespace WebKit {
-class WebCompositorQuad;
-}
-
 namespace WebCore {
 
+class CCDrawQuad;
+
 class CCQuadSink {
 public:
     virtual ~CCQuadSink() { }
 
     // Returns true if the quad is added to the list, and false if the quad is entirely culled.
-    virtual bool append(PassOwnPtr<WebKit::WebCompositorQuad> passDrawQuad) = 0;
+    virtual bool append(PassOwnPtr<CCDrawQuad> passDrawQuad) = 0;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
index c1af9d140..49dc90252 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
@@ -45,8 +45,8 @@ PassOwnPtr<CCRenderPass> CCRenderPass::create(CCRenderSurface* targetSurface, in
 
 CCRenderPass::CCRenderPass(CCRenderSurface* targetSurface, int id)
     : m_id(id)
-    , m_targetSurface(targetSurface)
-    , m_framebufferOutputRect(targetSurface->contentRect())
+    , m_transformToRootTarget(targetSurface->screenSpaceTransform())
+    , m_outputRect(targetSurface->contentRect())
     , m_hasTransparentBackground(true)
     , m_hasOcclusionFromOutsideTargetSurface(false)
 {
@@ -106,7 +106,11 @@ void CCRenderPass::appendQuadsToFillScreen(CCLayerImpl* rootLayer, SkColor scree
 
     // Manually create the quad state for the gutter quads, as the root layer
     // doesn't have any bounds and so can't generate this itself.
-    OwnPtr<CCSharedQuadState> sharedQuadState = rootLayer->createSharedQuadState(m_sharedQuadStateList.size());
+    // FIXME: Make the gutter quads generated by the solid color layer (make it smarter about generating quads to fill unoccluded areas).
+    IntRect rootTargetRect = rootLayer->renderSurface()->contentRect();
+    float opacity = 1;
+    bool opaque = true;
+    OwnPtr<CCSharedQuadState> sharedQuadState = CCSharedQuadState::create(0, rootLayer->drawTransform(), rootTargetRect, rootTargetRect, opacity, opaque);
     ASSERT(rootLayer->screenSpaceTransform().isInvertible());
     WebTransformationMatrix transformToLayerSpace = rootLayer->screenSpaceTransform().inverse();
     Vector<IntRect> fillRects = fillRegion.rects();
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
index 71582128c..e2a480e09 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
@@ -31,6 +31,7 @@
 #include "cc/CCOcclusionTracker.h"
 #include "cc/CCSharedQuadState.h"
 #include <public/WebFilterOperations.h>
+#include <public/WebTransformationMatrix.h>
 #include <wtf/HashMap.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
@@ -64,10 +65,16 @@ public:
     const CCQuadList& quadList() const { return m_quadList; }
 
     int id() const { return m_id; }
-    CCRenderSurface* targetSurface() const { return m_targetSurface; }
+
+    // FIXME: Modify this transform when merging the RenderPass into a parent compositor.
+    // Transforms from quad's original content space to the root target's content space.
+    const WebKit::WebTransformationMatrix& transformToRootTarget() const { return m_transformToRootTarget; }
 
     // This denotes the bounds in physical pixels of the output generated by this RenderPass.
-    const IntRect& framebufferOutputRect() const { return m_framebufferOutputRect; }
+    const IntRect& outputRect() const { return m_outputRect; }
+
+    FloatRect damageRect() const { return m_damageRect; }
+    void setDamageRect(FloatRect rect) { m_damageRect = rect; }
 
     const WebKit::WebFilterOperations& filters() const { return m_filters; }
     void setFilters(const WebKit::WebFilterOperations& filters) { m_filters = filters; }
@@ -84,9 +91,10 @@ protected:
     CCRenderPass(CCRenderSurface*, int id);
 
     int m_id;
-    CCRenderSurface* m_targetSurface;
     CCQuadList m_quadList;
-    IntRect m_framebufferOutputRect;
+    WebKit::WebTransformationMatrix m_transformToRootTarget;
+    IntRect m_outputRect;
+    FloatRect m_damageRect;
     Vector<OwnPtr<CCSharedQuadState> > m_sharedQuadStateList;
     bool m_hasTransparentBackground;
     bool m_hasOcclusionFromOutsideTargetSurface;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp
index 60e35396a..3b0a48a7a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp
@@ -27,28 +27,30 @@
 
 #include "cc/CCRenderPassDrawQuad.h"
 
-using WebKit::WebCompositorQuad;
-
 namespace WebCore {
 
-PassOwnPtr<CCRenderPassDrawQuad> CCRenderPassDrawQuad::create(const WebKit::WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, int renderPassId, bool isReplica, const CCResourceProvider::ResourceId maskResourceId, const IntRect& contentsChangedSinceLastFrame)
+PassOwnPtr<CCRenderPassDrawQuad> CCRenderPassDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, int renderPassId, bool isReplica, const CCResourceProvider::ResourceId maskResourceId, const IntRect& contentsChangedSinceLastFrame, float maskTexCoordScaleX, float maskTexCoordScaleY, float maskTexCoordOffsetX, float maskTexCoordOffsetY)
 {
-    return adoptPtr(new CCRenderPassDrawQuad(sharedQuadState, quadRect, renderPassId, isReplica, maskResourceId, contentsChangedSinceLastFrame));
+    return adoptPtr(new CCRenderPassDrawQuad(sharedQuadState, quadRect, renderPassId, isReplica, maskResourceId, contentsChangedSinceLastFrame, maskTexCoordScaleX, maskTexCoordScaleY, maskTexCoordOffsetX, maskTexCoordOffsetY));
 }
 
-CCRenderPassDrawQuad::CCRenderPassDrawQuad(const WebKit::WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, int renderPassId, bool isReplica, CCResourceProvider::ResourceId maskResourceId, const IntRect& contentsChangedSinceLastFrame)
-    : WebCompositorQuad(sharedQuadState, WebCompositorQuad::RenderPass, quadRect)
+CCRenderPassDrawQuad::CCRenderPassDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, int renderPassId, bool isReplica, CCResourceProvider::ResourceId maskResourceId, const IntRect& contentsChangedSinceLastFrame, float maskTexCoordScaleX, float maskTexCoordScaleY, float maskTexCoordOffsetX, float maskTexCoordOffsetY)
+    : CCDrawQuad(sharedQuadState, CCDrawQuad::RenderPass, quadRect)
     , m_renderPassId(renderPassId)
     , m_isReplica(isReplica)
     , m_maskResourceId(maskResourceId)
     , m_contentsChangedSinceLastFrame(contentsChangedSinceLastFrame)
+    , m_maskTexCoordScaleX(maskTexCoordScaleX)
+    , m_maskTexCoordScaleY(maskTexCoordScaleY)
+    , m_maskTexCoordOffsetX(maskTexCoordOffsetX)
+    , m_maskTexCoordOffsetY(maskTexCoordOffsetY)
 {
     ASSERT(m_renderPassId > 0);
 }
 
-const CCRenderPassDrawQuad* CCRenderPassDrawQuad::materialCast(const WebKit::WebCompositorQuad* quad)
+const CCRenderPassDrawQuad* CCRenderPassDrawQuad::materialCast(const CCDrawQuad* quad)
 {
-    ASSERT(quad->material() == WebCompositorQuad::RenderPass);
+    ASSERT(quad->material() == CCDrawQuad::RenderPass);
     return static_cast<const CCRenderPassDrawQuad*>(quad);
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.h
index 9e033b42c..df8ce0c90 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.h
@@ -26,32 +26,42 @@
 #ifndef CCRenderPassDrawQuad_h
 #define CCRenderPassDrawQuad_h
 
+#include "IntRect.h"
+#include "cc/CCDrawQuad.h"
 #include "cc/CCResourceProvider.h"
-#include <public/WebCompositorQuad.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
 class CCRenderPass;
 
-class CCRenderPassDrawQuad : public WebKit::WebCompositorQuad {
+class CCRenderPassDrawQuad : public CCDrawQuad {
     WTF_MAKE_NONCOPYABLE(CCRenderPassDrawQuad);
 public:
-    static PassOwnPtr<CCRenderPassDrawQuad> create(const WebKit::WebCompositorSharedQuadState*, const IntRect&, int renderPassId, bool isReplica, CCResourceProvider::ResourceId maskResourceId, const IntRect& contentsChangedSinceLastFrame);
+    static PassOwnPtr<CCRenderPassDrawQuad> create(const CCSharedQuadState*, const IntRect&, int renderPassId, bool isReplica, CCResourceProvider::ResourceId maskResourceId, const IntRect& contentsChangedSinceLastFrame, float maskTexCoordScaleX, float maskTexCoordScaleY, float maskTexCoordOffsetX, float maskTexCoordOffsetY);
 
     int renderPassId() const { return m_renderPassId; }
     bool isReplica() const { return m_isReplica; }
     CCResourceProvider::ResourceId maskResourceId() const { return m_maskResourceId; }
     const IntRect& contentsChangedSinceLastFrame() const { return m_contentsChangedSinceLastFrame; }
 
-    static const CCRenderPassDrawQuad* materialCast(const WebKit::WebCompositorQuad*);
+    static const CCRenderPassDrawQuad* materialCast(const CCDrawQuad*);
+    float maskTexCoordScaleX() const { return m_maskTexCoordScaleX; }
+    float maskTexCoordScaleY() const { return m_maskTexCoordScaleY; }
+    float maskTexCoordOffsetX() const { return m_maskTexCoordOffsetX; }
+    float maskTexCoordOffsetY() const { return m_maskTexCoordOffsetY; }
+
 private:
-    CCRenderPassDrawQuad(const WebKit::WebCompositorSharedQuadState*, const IntRect&, int renderPassId, bool isReplica, CCResourceProvider::ResourceId maskResourceId, const IntRect& contentsChangedSinceLastFrame);
+    CCRenderPassDrawQuad(const CCSharedQuadState*, const IntRect&, int renderPassId, bool isReplica, CCResourceProvider::ResourceId maskResourceId, const IntRect& contentsChangedSinceLastFrame, float maskTexCoordScaleX, float maskTexCoordScaleY, float maskTexCoordOffsetX, float maskTexCoordOffsetY);
 
     int m_renderPassId;
     bool m_isReplica;
     CCResourceProvider::ResourceId m_maskResourceId;
     IntRect m_contentsChangedSinceLastFrame;
+    float m_maskTexCoordScaleX;
+    float m_maskTexCoordScaleY;
+    float m_maskTexCoordOffsetX;
+    float m_maskTexCoordOffsetY;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
index 425d72788..ed9675e05 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
@@ -161,22 +161,38 @@ bool CCRenderSurface::surfacePropertyChangedOnlyFromDescendant() const
     return m_surfacePropertyChanged && !m_owningLayer->layerPropertyChanged();
 }
 
-PassOwnPtr<CCSharedQuadState> CCRenderSurface::createSharedQuadState(int id) const
+static inline IntRect computeClippedRectInTarget(const CCLayerImpl* owningLayer)
 {
-    bool isOpaque = false;
-    return CCSharedQuadState::create(id, m_drawTransform, m_contentRect, m_scissorRect, m_drawOpacity, isOpaque);
+    ASSERT(owningLayer->parent());
+
+    const CCLayerImpl* renderTarget = owningLayer->parent()->renderTarget();
+    const CCRenderSurface* self = owningLayer->renderSurface();
+
+    IntRect clippedRectInTarget = self->clipRect();
+    if (owningLayer->backgroundFilters().hasFilterThatMovesPixels()) {
+        // If the layer has background filters that move pixels, we cannot scissor as tightly.
+        // FIXME: this should be able to be a tighter scissor, perhaps expanded by the filter outsets?
+        clippedRectInTarget = renderTarget->renderSurface()->contentRect();
+    } else if (clippedRectInTarget.isEmpty()) {
+        // For surfaces, empty clipRect means that the surface does not clip anything.
+        clippedRectInTarget = enclosingIntRect(intersection(renderTarget->renderSurface()->contentRect(), self->drawableContentRect()));
+    } else
+        clippedRectInTarget.intersect(enclosingIntRect(self->drawableContentRect()));
+    return clippedRectInTarget;
 }
 
-PassOwnPtr<CCSharedQuadState> CCRenderSurface::createReplicaSharedQuadState(int id) const
+PassOwnPtr<CCSharedQuadState> CCRenderSurface::createSharedQuadState(int id) const
 {
+    IntRect clippedRectInTarget = computeClippedRectInTarget(m_owningLayer);
     bool isOpaque = false;
-    return CCSharedQuadState::create(id, m_replicaDrawTransform, m_contentRect, m_scissorRect, m_drawOpacity, isOpaque);
+    return CCSharedQuadState::create(id, m_drawTransform, m_contentRect, clippedRectInTarget, m_drawOpacity, isOpaque);
 }
 
-FloatRect CCRenderSurface::computeRootScissorRectInCurrentSurface(const FloatRect& rootScissorRect) const
+PassOwnPtr<CCSharedQuadState> CCRenderSurface::createReplicaSharedQuadState(int id) const
 {
-    WebTransformationMatrix inverseScreenSpaceTransform = m_screenSpaceTransform.inverse();
-    return CCMathUtil::projectClippedRect(inverseScreenSpaceTransform, rootScissorRect);
+    IntRect clippedRectInTarget = computeClippedRectInTarget(m_owningLayer);
+    bool isOpaque = false;
+    return CCSharedQuadState::create(id, m_replicaDrawTransform, m_contentRect, clippedRectInTarget, m_drawOpacity, isOpaque);
 }
 
 void CCRenderSurface::appendQuads(CCQuadSink& quadList, CCSharedQuadState* sharedQuadState, bool forReplica, int renderPassId)
@@ -207,10 +223,22 @@ void CCRenderSurface::appendQuads(CCQuadSink& quadList, CCSharedQuadState* share
             maskLayer = 0;
     }
 
+    float maskTexCoordScaleX = 1;
+    float maskTexCoordScaleY = 1;
+    float maskTexCoordOffsetX = 1;
+    float maskTexCoordOffsetY = 1;
+    if (maskLayer) {
+        maskTexCoordScaleX = static_cast<float>(contentRect().width()) / maskLayer->contentBounds().width();
+        maskTexCoordScaleY = static_cast<float>(contentRect().height()) / maskLayer->contentBounds().height();
+        maskTexCoordOffsetX = static_cast<float>(contentRect().x()) / contentRect().width() * maskTexCoordScaleX;
+        maskTexCoordOffsetY = static_cast<float>(contentRect().y()) / contentRect().height() * maskTexCoordScaleY;
+    }
+
     CCResourceProvider::ResourceId maskResourceId = maskLayer ? maskLayer->contentsResourceId() : 0;
     IntRect contentsChangedSinceLastFrame = contentsChanged() ? m_contentRect : IntRect();
 
-    quadList.append(CCRenderPassDrawQuad::create(sharedQuadState, contentRect(), renderPassId, forReplica, maskResourceId, contentsChangedSinceLastFrame));
+    quadList.append(CCRenderPassDrawQuad::create(sharedQuadState, contentRect(), renderPassId, forReplica, maskResourceId, contentsChangedSinceLastFrame,
+                                                 maskTexCoordScaleX, maskTexCoordScaleY, maskTexCoordOffsetX, maskTexCoordOffsetY));
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
index 283cbfa45..eb53af2b7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
@@ -88,9 +88,6 @@ public:
     void setClipRect(const IntRect&);
     const IntRect& clipRect() const { return m_clipRect; }
 
-    void setScissorRect(const IntRect& scissorRect) { m_scissorRect = scissorRect; }
-    const IntRect& scissorRect() const { return m_scissorRect; }
-
     bool contentsChanged() const;
 
     void setContentRect(const IntRect&);
@@ -112,8 +109,6 @@ public:
 
     void appendQuads(CCQuadSink&, CCSharedQuadState*, bool forReplica, int renderPassId);
 
-    FloatRect computeRootScissorRectInCurrentSurface(const FloatRect& rootScissorRect) const;
-
 private:
     CCLayerImpl* m_owningLayer;
 
@@ -133,10 +128,6 @@ private:
     // Uses the space of the surface's target surface.
     IntRect m_clipRect;
 
-    // During drawing, identifies the region outside of which nothing should be drawn.
-    // Uses the space of the surface's target surface.
-    IntRect m_scissorRect;
-
     Vector<CCLayerImpl*> m_layerList;
 
     // The nearest ancestor target surface that will contain the contents of this surface, and that is going
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp
index f1a21faa8..a02fd5f8f 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp
@@ -30,7 +30,6 @@
 #include "cc/CCRenderSurfaceFilters.h"
 
 #include "FloatSize.h"
-#include "GraphicsContext3D.h"
 #include "SkBlurImageFilter.h"
 #include "SkCanvas.h"
 #include "SkColorMatrixFilter.h"
@@ -38,6 +37,7 @@
 #include "SkGrTexturePixelRef.h"
 #include <public/WebFilterOperation.h>
 #include <public/WebFilterOperations.h>
+#include <public/WebGraphicsContext3D.h>
 #include <wtf/MathExtras.h>
 
 namespace {
@@ -245,6 +245,10 @@ bool getColorMatrix(const WebKit::WebFilterOperation& op, SkScalar matrix[20])
         getOpacityMatrix(op.amount(), matrix);
         return true;
     }
+    case WebKit::WebFilterOperation::FilterTypeColorMatrix: {
+        memcpy(matrix, op.matrix(), sizeof(SkScalar[20]));
+        return true;
+    }
     default:
         return false;
     }
@@ -254,6 +258,7 @@ class FilterBufferState {
 public:
     FilterBufferState(GrContext* grContext, const WebCore::FloatSize& size, unsigned textureId)
         : m_grContext(grContext)
+        , m_currentTexture(0)
     {
         // Wrap the source texture in a Ganesh platform texture.
         GrPlatformTextureDesc platformTextureDescription;
@@ -269,6 +274,24 @@ public:
 
     ~FilterBufferState() { }
 
+    bool init(int filterCount)
+    {
+        int scratchCount = std::min(2, filterCount);
+        GrTextureDesc desc;
+        desc.fFlags = kRenderTarget_GrTextureFlagBit | kNoStencil_GrTextureFlagBit;
+        desc.fSampleCnt = 0;
+        desc.fWidth = m_source.width();
+        desc.fHeight = m_source.height();
+        desc.fConfig = kSkia8888_PM_GrPixelConfig;
+        for (int i = 0; i < scratchCount; ++i) {
+            GrAutoScratchTexture scratchTexture(m_grContext, desc, GrContext::kExact_ScratchTexMatch);
+            m_scratchTextures[i].reset(scratchTexture.detach());
+            if (!m_scratchTextures[i].get())
+                return false;
+        }
+        return true;
+    }
+
     SkCanvas* canvas()
     {
         if (!m_canvas.get())
@@ -283,68 +306,35 @@ public:
         m_canvas.reset(0);
         m_device.reset(0);
 
-        m_source.setPixelRef(new SkGrTexturePixelRef(m_destinationTexture.get()))->unref();
-
-        SkAutoTUnref<GrTexture> temp;
-        temp.reset(m_freeTexture.detach());
-        m_freeTexture.reset(m_destinationTexture.detach());
-        m_destinationTexture.reset(temp.detach());
+        m_source.setPixelRef(new SkGrTexturePixelRef(m_scratchTextures[m_currentTexture].get()))->unref();
+        m_currentTexture = 1 - m_currentTexture;
     }
 
 private:
     void createCanvas()
     {
-        if (!m_destinationTexture.get()) {
-            GrTextureDesc desc;
-            desc.fFlags = kRenderTarget_GrTextureFlagBit | kNoStencil_GrTextureFlagBit;
-            desc.fSampleCnt = 0;
-            desc.fWidth = m_source.width();
-            desc.fHeight = m_source.height();
-            desc.fConfig = kSkia8888_PM_GrPixelConfig;
-            GrAutoScratchTexture scratchTexture(m_grContext, desc, GrContext::kExact_ScratchTexMatch);
-            m_destinationTexture.reset(scratchTexture.detach());
-            if (!m_destinationTexture.get())
-                return;
-        }
-        m_device.reset(new SkGpuDevice(m_grContext, m_destinationTexture.get()));
+        ASSERT(m_scratchTextures[m_currentTexture].get());
+        m_device.reset(new SkGpuDevice(m_grContext, m_scratchTextures[m_currentTexture].get()));
         m_canvas.reset(new SkCanvas(m_device.get()));
         m_canvas->clear(0x0);
     }
 
     GrContext* m_grContext;
     SkBitmap m_source;
-    SkAutoTUnref<GrTexture> m_destinationTexture;
-    SkAutoTUnref<GrTexture> m_freeTexture;
+    SkAutoTUnref<GrTexture> m_scratchTextures[2];
+    int m_currentTexture;
     SkAutoTUnref<SkGpuDevice> m_device;
     SkAutoTUnref<SkCanvas> m_canvas;
 };
 
-bool applyColorMatrix(FilterBufferState* state, SkScalar matrix[20])
-{
-    SkCanvas* canvas = state->canvas();
-    if (!canvas)
-        return false;
-    SkPaint paint;
-    paint.setColorFilter(new SkColorMatrixFilter(matrix))->unref();
-    canvas->drawBitmap(state->source(), 0, 0, &paint);
-    state->swap();
-    return true;
-}
-
 }
 
 namespace WebCore {
 
-SkBitmap CCRenderSurfaceFilters::apply(const WebKit::WebFilterOperations& filters, unsigned textureId, const FloatSize& size, GraphicsContext3D* context3D)
+WebKit::WebFilterOperations CCRenderSurfaceFilters::optimize(const WebKit::WebFilterOperations& filters)
 {
-    if (!context3D)
-        return SkBitmap();
+    WebKit::WebFilterOperations newList;
 
-    GrContext* grContext = context3D->grContext();
-    if (!grContext)
-        return SkBitmap();
-    FilterBufferState state(grContext, size, textureId);
-    
     SkScalar accumulatedColorMatrix[20];
     bool haveAccumulatedColorMatrix = false;
     for (unsigned i = 0; i < filters.size(); ++i) {
@@ -369,27 +359,61 @@ SkBitmap CCRenderSurfaceFilters::apply(const WebKit::WebFilterOperations& filter
                 continue;
         }
 
-        if (haveAccumulatedColorMatrix && !applyColorMatrix(&state, accumulatedColorMatrix))
-            return SkBitmap();
+        if (haveAccumulatedColorMatrix)
+            newList.append(WebKit::WebFilterOperation::createColorMatrixFilter(accumulatedColorMatrix));
         haveAccumulatedColorMatrix = false;
 
         switch (op.type()) {
+        case WebKit::WebFilterOperation::FilterTypeBlur:
+        case WebKit::WebFilterOperation::FilterTypeDropShadow:
+            newList.append(op);
+            break;
+        case WebKit::WebFilterOperation::FilterTypeBrightness:
+        case WebKit::WebFilterOperation::FilterTypeContrast:
+        case WebKit::WebFilterOperation::FilterTypeGrayscale:
+        case WebKit::WebFilterOperation::FilterTypeSepia:
+        case WebKit::WebFilterOperation::FilterTypeSaturate:
+        case WebKit::WebFilterOperation::FilterTypeHueRotate:
+        case WebKit::WebFilterOperation::FilterTypeInvert:
+        case WebKit::WebFilterOperation::FilterTypeOpacity:
+        case WebKit::WebFilterOperation::FilterTypeColorMatrix:
+            break;
+        }
+    }
+    if (haveAccumulatedColorMatrix)
+        newList.append(WebKit::WebFilterOperation::createColorMatrixFilter(accumulatedColorMatrix));
+    return newList;
+}
+
+SkBitmap CCRenderSurfaceFilters::apply(const WebKit::WebFilterOperations& filters, unsigned textureId, const FloatSize& size, WebKit::WebGraphicsContext3D* context3D, GrContext* grContext)
+{
+    if (!context3D || !grContext)
+        return SkBitmap();
+
+    WebKit::WebFilterOperations optimizedFilters = optimize(filters);
+    FilterBufferState state(grContext, size, textureId);
+    if (!state.init(optimizedFilters.size()))
+        return SkBitmap();
+
+    for (unsigned i = 0; i < optimizedFilters.size(); ++i) {
+        const WebKit::WebFilterOperation& op = optimizedFilters.at(i);
+        SkCanvas* canvas = state.canvas();
+        switch (op.type()) {
+        case WebKit::WebFilterOperation::FilterTypeColorMatrix: {
+            SkPaint paint;
+            paint.setColorFilter(new SkColorMatrixFilter(op.matrix()))->unref();
+            canvas->drawBitmap(state.source(), 0, 0, &paint);
+            break;
+        }
         case WebKit::WebFilterOperation::FilterTypeBlur: {
-            SkCanvas* canvas = state.canvas();
-            if (!canvas)
-                return SkBitmap();
             float stdDeviation = op.amount();
             SkAutoTUnref<SkImageFilter> filter(new SkBlurImageFilter(stdDeviation, stdDeviation));
             SkPaint paint;
             paint.setImageFilter(filter.get());
             canvas->drawSprite(state.source(), 0, 0, &paint);
-            state.swap();
             break;
         }
         case WebKit::WebFilterOperation::FilterTypeDropShadow: {
-            SkCanvas* canvas = state.canvas();
-            if (!canvas)
-                return SkBitmap();
             SkAutoTUnref<SkImageFilter> blurFilter(new SkBlurImageFilter(op.amount(), op.amount()));
             SkAutoTUnref<SkColorFilter> colorFilter(SkColorFilter::CreateModeFilter(op.dropShadowColor(), SkXfermode::kSrcIn_Mode));
             SkPaint paint;
@@ -400,7 +424,6 @@ SkBitmap CCRenderSurfaceFilters::apply(const WebKit::WebFilterOperations& filter
             canvas->drawBitmap(state.source(), op.dropShadowOffset().x, -op.dropShadowOffset().y);
             canvas->restore();
             canvas->drawBitmap(state.source(), 0, 0);
-            state.swap();
             break;
         }
         case WebKit::WebFilterOperation::FilterTypeBrightness:
@@ -411,11 +434,11 @@ SkBitmap CCRenderSurfaceFilters::apply(const WebKit::WebFilterOperations& filter
         case WebKit::WebFilterOperation::FilterTypeHueRotate:
         case WebKit::WebFilterOperation::FilterTypeInvert:
         case WebKit::WebFilterOperation::FilterTypeOpacity:
+            ASSERT_NOT_REACHED();
             break;
         }
+        state.swap();
     }
-    if (haveAccumulatedColorMatrix && !applyColorMatrix(&state, accumulatedColorMatrix))
-        return SkBitmap();
     context3D->flush();
     return state.source();
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.h
index e2582757c..4ae97a201 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.h
@@ -29,19 +29,22 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+class GrContext;
 class SkBitmap;
 
 namespace WebKit {
 class WebFilterOperations;
+class WebGraphicsContext3D;
 }
 
 namespace WebCore {
 class FloatSize;
-class GraphicsContext3D;
 
 class CCRenderSurfaceFilters {
 public:
-    static SkBitmap apply(const WebKit::WebFilterOperations& filters, unsigned textureId, const FloatSize&, GraphicsContext3D*);
+    static SkBitmap apply(const WebKit::WebFilterOperations& filters, unsigned textureId, const FloatSize&, WebKit::WebGraphicsContext3D*, GrContext*);
+    static WebKit::WebFilterOperations optimize(const WebKit::WebFilterOperations& filters);
+
 private:
     CCRenderSurfaceFilters();
 };
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h
index 9080564c0..6664b7f9e 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h
@@ -47,9 +47,11 @@ public:
     virtual const CCLayerTreeSettings& settings() const = 0;
     virtual void didLoseContext() = 0;
     virtual void onSwapBuffersComplete() = 0;
-    virtual void setFullRootLayerDamage() = 0;
     virtual void releaseContentsTextures() = 0;
+    virtual void setFullRootLayerDamage() = 0;
     virtual void setMemoryAllocationLimitBytes(size_t) = 0;
+protected:
+    virtual ~CCRendererClient() { }
 };
 
 class CCRenderer {
@@ -77,14 +79,14 @@ public:
     virtual void decideRenderPassAllocationsForFrame(const CCRenderPassList&) { }
     virtual bool haveCachedResourcesForRenderPassId(int) const { return false; }
 
-    virtual void drawFrame(const CCRenderPassList&, const CCRenderPassIdHashMap&, const FloatRect& rootScissorRect) = 0;
+    virtual void drawFrame(const CCRenderPassList&, const CCRenderPassIdHashMap&) = 0;
 
     // waits for rendering to finish
     virtual void finish() = 0;
 
     virtual void doNoOp() { }
     // puts backbuffer onscreen
-    virtual bool swapBuffers(const IntRect& subBuffer) = 0;
+    virtual bool swapBuffers() = 0;
 
     virtual void getFramebufferPixels(void *pixels, const IntRect&) = 0;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
index 49c3b243f..a0bd37cc8 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
@@ -30,7 +30,6 @@
 #include "IntRect.h"
 #include "LayerRendererChromium.h" // For the GLC() macro
 #include "LayerTextureSubImage.h"
-#include "cc/CCGraphicsContext.h"
 #include "cc/CCProxy.h"
 #include <public/WebGraphicsContext3D.h>
 
@@ -244,7 +243,8 @@ bool CCResourceProvider::initialize()
         // FIXME: Implement this path for software compositing.
         return false;
     }
-    String extensionsString = context3d->getString(GraphicsContext3D::EXTENSIONS);
+    WebKit::WebString extensionsWebString = context3d->getString(GraphicsContext3D::EXTENSIONS);
+    String extensionsString(extensionsWebString.data(), extensionsWebString.length());
     Vector<String> extensions;
     extensionsString.split(' ', extensions);
     bool useMapSub = false;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
index 9b0b44caf..add909e5b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
@@ -29,6 +29,7 @@
 
 #include "GraphicsContext3D.h"
 #include "IntSize.h"
+#include "cc/CCGraphicsContext.h"
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -41,9 +42,9 @@ class WebGraphicsContext3D;
 
 namespace WebCore {
 
-class CCGraphicsContext;
 class CCScopedLockResourceForRead;
 class CCScopedLockResourceForWrite;
+class IntRect;
 class LayerTextureSubImage;
 
 // Thread-safety notes: this class is not thread-safe and can only be called
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
index 6f865c9cd..2c1b5053c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
@@ -126,6 +126,11 @@ void CCScheduler::didRecreateContext()
     processScheduledActions();
 }
 
+void CCScheduler::setTimebaseAndInterval(double timebase, double intervalSeconds)
+{
+    m_frameRateController->setTimebaseAndInterval(timebase, intervalSeconds);
+}
+
 void CCScheduler::vsyncTick()
 {
     if (m_updateMoreResourcesPending) {
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
index 3e6f7aa7b..a7d8b0330 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
@@ -105,6 +105,8 @@ public:
     bool commitPending() const { return m_stateMachine.commitPending(); }
     bool redrawPending() const { return m_stateMachine.redrawPending(); }
 
+    void setTimebaseAndInterval(double timebase, double intervalSeconds);
+
     // CCFrameRateControllerClient implementation
     virtual void vsyncTick() OVERRIDE;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarAnimationController.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarAnimationController.cpp
new file mode 100644
index 000000000..3c0aac16e
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarAnimationController.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCScrollbarAnimationController.h"
+
+#include "cc/CCScrollbarLayerImpl.h"
+#include <wtf/CurrentTime.h>
+
+#if OS(ANDROID)
+#include "cc/CCScrollbarAnimationControllerLinearFade.h"
+#endif
+
+namespace WebCore {
+
+#if OS(ANDROID)
+PassOwnPtr<CCScrollbarAnimationController> CCScrollbarAnimationController::create(CCLayerImpl* scrollLayer)
+{
+    static const double fadeoutDelay = 0.3;
+    static const double fadeoutLength = 0.3;
+    return CCScrollbarAnimationControllerLinearFade::create(scrollLayer, fadeoutDelay, fadeoutLength);
+}
+#else
+PassOwnPtr<CCScrollbarAnimationController> CCScrollbarAnimationController::create(CCLayerImpl* scrollLayer)
+{
+    return adoptPtr(new CCScrollbarAnimationController(scrollLayer));
+}
+#endif
+
+CCScrollbarAnimationController::CCScrollbarAnimationController(CCLayerImpl* scrollLayer)
+    : m_horizontalScrollbarLayer(0)
+    , m_verticalScrollbarLayer(0)
+{
+    CCScrollbarAnimationController::updateScrollOffsetAtTime(scrollLayer, 0);
+}
+
+CCScrollbarAnimationController::~CCScrollbarAnimationController()
+{
+}
+
+void CCScrollbarAnimationController::didPinchGestureBegin()
+{
+    didPinchGestureBeginAtTime(monotonicallyIncreasingTime());
+}
+
+void CCScrollbarAnimationController::didPinchGestureUpdate()
+{
+    didPinchGestureUpdateAtTime(monotonicallyIncreasingTime());
+}
+
+void CCScrollbarAnimationController::didPinchGestureEnd()
+{
+    didPinchGestureEndAtTime(monotonicallyIncreasingTime());
+}
+
+void CCScrollbarAnimationController::updateScrollOffset(CCLayerImpl* scrollLayer)
+{
+    updateScrollOffsetAtTime(scrollLayer, monotonicallyIncreasingTime());
+}
+
+IntSize CCScrollbarAnimationController::getScrollLayerBounds(const CCLayerImpl* scrollLayer)
+{
+    if (!scrollLayer->children().size())
+        return IntSize();
+    // Copy & paste from CCLayerTreeHostImpl...
+    // FIXME: Hardcoding the first child here is weird. Think of
+    // a cleaner way to get the contentBounds on the Impl side.
+    return scrollLayer->children()[0]->bounds();
+}
+
+void CCScrollbarAnimationController::updateScrollOffsetAtTime(CCLayerImpl* scrollLayer, double)
+{
+    m_currentPos = scrollLayer->scrollPosition() + scrollLayer->scrollDelta();
+    m_totalSize = getScrollLayerBounds(scrollLayer);
+    m_maximum = scrollLayer->maxScrollPosition();
+
+    if (m_horizontalScrollbarLayer) {
+        m_horizontalScrollbarLayer->setCurrentPos(m_currentPos.x());
+        m_horizontalScrollbarLayer->setTotalSize(m_totalSize.width());
+        m_horizontalScrollbarLayer->setMaximum(m_maximum.width());
+    }
+
+    if (m_verticalScrollbarLayer) {
+        m_verticalScrollbarLayer->setCurrentPos(m_currentPos.y());
+        m_verticalScrollbarLayer->setTotalSize(m_totalSize.height());
+        m_verticalScrollbarLayer->setMaximum(m_maximum.height());
+    }
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarAnimationController.h b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarAnimationController.h
new file mode 100644
index 000000000..c081fe7f9
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarAnimationController.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCScrollbarAnimationController_h
+#define CCScrollbarAnimationController_h
+
+#include "FloatPoint.h"
+#include "IntSize.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class CCLayerImpl;
+class CCScrollbarLayerImpl;
+
+// This abstract class represents the compositor-side analogy of ScrollbarAnimator.
+// Individual platforms should subclass it to provide specialized implementation.
+class CCScrollbarAnimationController {
+public:
+    // Implemented by subclass.
+    static PassOwnPtr<CCScrollbarAnimationController> create(CCLayerImpl* scrollLayer);
+
+    virtual ~CCScrollbarAnimationController();
+
+    virtual bool animate(double monotonicTime) { return false; }
+    void didPinchGestureBegin();
+    void didPinchGestureUpdate();
+    void didPinchGestureEnd();
+    void updateScrollOffset(CCLayerImpl* scrollLayer);
+
+    void setHorizontalScrollbarLayer(CCScrollbarLayerImpl* layer) { m_horizontalScrollbarLayer = layer; }
+    CCScrollbarLayerImpl* horizontalScrollbarLayer() const { return m_horizontalScrollbarLayer; }
+
+    void setVerticalScrollbarLayer(CCScrollbarLayerImpl* layer) { m_verticalScrollbarLayer = layer; }
+    CCScrollbarLayerImpl* verticalScrollbarLayer() const { return m_verticalScrollbarLayer; }
+
+    FloatPoint currentPos() const { return m_currentPos; }
+    IntSize totalSize() const { return m_totalSize; }
+    IntSize maximum() const { return m_maximum; }
+
+    virtual void didPinchGestureBeginAtTime(double monotonicTime) { }
+    virtual void didPinchGestureUpdateAtTime(double monotonicTime) { }
+    virtual void didPinchGestureEndAtTime(double monotonicTime) { }
+    virtual void updateScrollOffsetAtTime(CCLayerImpl* scrollLayer, double monotonicTime);
+
+protected:
+    explicit CCScrollbarAnimationController(CCLayerImpl* scrollLayer);
+
+private:
+    static IntSize getScrollLayerBounds(const CCLayerImpl*);
+
+    // Beware of dangling pointer. Always update these during tree synchronization.
+    CCScrollbarLayerImpl* m_horizontalScrollbarLayer;
+    CCScrollbarLayerImpl* m_verticalScrollbarLayer;
+
+    FloatPoint m_currentPos;
+    IntSize m_totalSize;
+    IntSize m_maximum;
+};
+
+} // namespace WebCore
+
+#endif // CCScrollbarAnimationController_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarAnimationControllerLinearFade.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarAnimationControllerLinearFade.cpp
new file mode 100644
index 000000000..820f2291f
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarAnimationControllerLinearFade.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCScrollbarAnimationControllerLinearFade.h"
+
+#include "cc/CCScrollbarLayerImpl.h"
+
+namespace WebCore {
+
+PassOwnPtr<CCScrollbarAnimationControllerLinearFade> CCScrollbarAnimationControllerLinearFade::create(CCLayerImpl* scrollLayer, double fadeoutDelay, double fadeoutLength)
+{
+    return adoptPtr(new CCScrollbarAnimationControllerLinearFade(scrollLayer, fadeoutDelay, fadeoutLength));
+}
+
+CCScrollbarAnimationControllerLinearFade::CCScrollbarAnimationControllerLinearFade(CCLayerImpl* scrollLayer, double fadeoutDelay, double fadeoutLength)
+    : CCScrollbarAnimationController(scrollLayer)
+    , m_lastAwakenTime(-100000000) // arbitrary invalid timestamp
+    , m_pinchGestureInEffect(false)
+    , m_fadeoutDelay(fadeoutDelay)
+    , m_fadeoutLength(fadeoutLength)
+{
+}
+
+CCScrollbarAnimationControllerLinearFade::~CCScrollbarAnimationControllerLinearFade()
+{
+}
+
+bool CCScrollbarAnimationControllerLinearFade::animate(double monotonicTime)
+{
+    float opacity = opacityAtTime(monotonicTime);
+    if (horizontalScrollbarLayer())
+        horizontalScrollbarLayer()->setOpacity(opacity);
+    if (verticalScrollbarLayer())
+        verticalScrollbarLayer()->setOpacity(opacity);
+    return opacity;
+}
+
+void CCScrollbarAnimationControllerLinearFade::didPinchGestureUpdateAtTime(double)
+{
+    m_pinchGestureInEffect = true;
+}
+
+void CCScrollbarAnimationControllerLinearFade::didPinchGestureEndAtTime(double monotonicTime)
+{
+    m_pinchGestureInEffect = false;
+    m_lastAwakenTime = monotonicTime;
+}
+
+void CCScrollbarAnimationControllerLinearFade::updateScrollOffsetAtTime(CCLayerImpl* scrollLayer, double monotonicTime)
+{
+    FloatPoint previousPos = currentPos();
+    CCScrollbarAnimationController::updateScrollOffsetAtTime(scrollLayer, monotonicTime);
+
+    if (previousPos == currentPos())
+        return;
+
+    m_lastAwakenTime = monotonicTime;
+}
+
+float CCScrollbarAnimationControllerLinearFade::opacityAtTime(double monotonicTime)
+{
+    if (m_pinchGestureInEffect)
+        return 1;
+
+    double delta = monotonicTime - m_lastAwakenTime;
+
+    if (delta <= m_fadeoutDelay)
+        return 1;
+    if (delta < m_fadeoutDelay + m_fadeoutLength)
+        return (m_fadeoutDelay + m_fadeoutLength - delta) / m_fadeoutLength;
+    return 0;
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/page/PointerLock.h b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarAnimationControllerLinearFade.h
index d1e25fb64..eb9d81e86 100644
--- a/Source/WebCore/page/PointerLock.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarAnimationControllerLinearFade.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -22,45 +22,38 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef PointerLock_h
-#define PointerLock_h
+#ifndef CCScrollbarAnimationControllerLinearFade_h
+#define CCScrollbarAnimationControllerLinearFade_h
 
-#if ENABLE(POINTER_LOCK)
-
-#include "DOMWindowProperty.h"
-#include "VoidCallback.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
+#include "cc/CCScrollbarAnimationController.h"
 
 namespace WebCore {
 
-class Element;
-class Frame;
-class PointerLockController;
-
-class PointerLock : public RefCounted<PointerLock>, public DOMWindowProperty {
+class CCScrollbarAnimationControllerLinearFade : public CCScrollbarAnimationController {
 public:
-    static PassRefPtr<PointerLock> create(Frame* frame) { return adoptRef(new PointerLock(frame)); }
+    static PassOwnPtr<CCScrollbarAnimationControllerLinearFade> create(CCLayerImpl* scrollLayer, double fadeoutDelay, double fadeoutLength);
+
+    virtual ~CCScrollbarAnimationControllerLinearFade();
 
-    ~PointerLock();
+    virtual bool animate(double monotonicTime) OVERRIDE;
 
-    // DOMWindowProperty Interface
-    virtual void disconnectFrameForPageCache() OVERRIDE;
-    virtual void willDestroyGlobalObjectInFrame() OVERRIDE;
+    virtual void didPinchGestureUpdateAtTime(double monotonicTime) OVERRIDE;
+    virtual void didPinchGestureEndAtTime(double monotonicTime) OVERRIDE;
+    virtual void updateScrollOffsetAtTime(CCLayerImpl* scrollLayer, double monotonicTime) OVERRIDE;
 
-    void lock(Element* target, PassRefPtr<VoidCallback> successCallback, PassRefPtr<VoidCallback> failureCallback);
-    void unlock();
-    bool isLocked();
+protected:
+    CCScrollbarAnimationControllerLinearFade(CCLayerImpl* scrollLayer, double fadeoutDelay, double fadeoutLength);
 
 private:
-    explicit PointerLock(Frame*);
+    float opacityAtTime(double monotonicTime);
 
-    PointerLockController* m_controller;
+    double m_lastAwakenTime;
+    bool m_pinchGestureInEffect;
+
+    double m_fadeoutDelay;
+    double m_fadeoutLength;
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(POINTER_LOCK)
-
-#endif // PointerLock_h
-
+#endif // CCScrollbarAnimationControllerLinearFade_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
index 1fcd1da8b..ec0589525 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
@@ -29,11 +29,13 @@
 
 #include "CCScrollbarLayerImpl.h"
 
-#include "ScrollbarTheme.h"
-#include "ScrollbarThemeComposite.h"
 #include "cc/CCQuadSink.h"
+#include "cc/CCScrollbarAnimationController.h"
 #include "cc/CCTextureDrawQuad.h"
 
+using WebKit::WebRect;
+using WebKit::WebScrollbar;
+
 namespace WebCore {
 
 PassOwnPtr<CCScrollbarLayerImpl> CCScrollbarLayerImpl::create(int id)
@@ -43,41 +45,64 @@ PassOwnPtr<CCScrollbarLayerImpl> CCScrollbarLayerImpl::create(int id)
 
 CCScrollbarLayerImpl::CCScrollbarLayerImpl(int id)
     : CCLayerImpl(id)
-    , m_scrollLayer(0)
     , m_scrollbar(this)
     , m_backTrackResourceId(0)
     , m_foreTrackResourceId(0)
     , m_thumbResourceId(0)
+    , m_scrollbarOverlayStyle(WebScrollbar::ScrollbarOverlayStyleDefault)
+    , m_orientation(WebScrollbar::Horizontal)
+    , m_controlSize(WebScrollbar::RegularScrollbar)
+    , m_pressedPart(WebScrollbar::NoPart)
+    , m_hoveredPart(WebScrollbar::NoPart)
+    , m_isScrollableAreaActive(false)
+    , m_isScrollViewScrollbar(false)
+    , m_enabled(false)
+    , m_isCustomScrollbar(false)
+    , m_isOverlayScrollbar(false)
 {
 }
 
-namespace {
+void CCScrollbarLayerImpl::setScrollbarGeometry(PassOwnPtr<WebKit::WebScrollbarThemeGeometry> geometry)
+{
+    m_geometry = geometry;
+}
 
-FloatRect toUVRect(const IntRect& r, const IntRect& bounds)
+void CCScrollbarLayerImpl::setScrollbarData(const WebScrollbar* scrollbar)
 {
-    ASSERT(bounds.contains(r));
-    return FloatRect(static_cast<float>(r.x()) / bounds.width(), static_cast<float>(r.y()) / bounds.height(),
-                     static_cast<float>(r.width()) / bounds.width(), static_cast<float>(r.height()) / bounds.height());
+    m_scrollbarOverlayStyle = scrollbar->scrollbarOverlayStyle();
+    m_orientation = scrollbar->orientation();
+    m_controlSize = scrollbar->controlSize();
+    m_pressedPart = scrollbar->pressedPart();
+    m_hoveredPart = scrollbar->hoveredPart();
+    m_isScrollableAreaActive = scrollbar->isScrollableAreaActive();
+    m_isScrollViewScrollbar = scrollbar->isScrollViewScrollbar();
+    m_enabled = scrollbar->enabled();
+    m_isCustomScrollbar = scrollbar->isCustomScrollbar();
+    m_isOverlayScrollbar = scrollbar->isOverlay();
+
+    scrollbar->getTickmarks(m_tickmarks);
 }
 
+static FloatRect toUVRect(const WebRect& r, const IntRect& bounds)
+{
+    return FloatRect(static_cast<float>(r.x) / bounds.width(), static_cast<float>(r.y) / bounds.height(),
+                     static_cast<float>(r.width) / bounds.width(), static_cast<float>(r.height) / bounds.height());
 }
 
 void CCScrollbarLayerImpl::appendQuads(CCQuadSink& quadList, const CCSharedQuadState* sharedQuadState, bool&)
 {
-    ScrollbarThemeComposite* theme = static_cast<ScrollbarThemeComposite*>(ScrollbarTheme::theme());
-    if (!theme)
-        return;
-
     bool premultipledAlpha = false;
     bool flipped = false;
     FloatRect uvRect(0, 0, 1, 1);
     IntRect boundsRect(IntPoint(), contentBounds());
 
-    IntRect thumbRect, backTrackRect, foreTrackRect;
-    theme->splitTrack(&m_scrollbar, theme->trackRect(&m_scrollbar), backTrackRect, thumbRect, foreTrackRect);
+    WebRect thumbRect, backTrackRect, foreTrackRect;
+    m_geometry->splitTrack(&m_scrollbar, m_geometry->trackRect(&m_scrollbar), backTrackRect, thumbRect, foreTrackRect);
+    if (!m_geometry->hasThumb(&m_scrollbar))
+        thumbRect = WebRect();
 
-    if (m_thumbResourceId && theme->hasThumb(&m_scrollbar) && !thumbRect.isEmpty()) {
-        OwnPtr<CCTextureDrawQuad> quad = CCTextureDrawQuad::create(sharedQuadState, thumbRect, m_thumbResourceId, premultipledAlpha, uvRect, flipped);
+    if (m_thumbResourceId && !thumbRect.isEmpty()) {
+        OwnPtr<CCTextureDrawQuad> quad = CCTextureDrawQuad::create(sharedQuadState, IntRect(thumbRect.x, thumbRect.y, thumbRect.width, thumbRect.height), m_thumbResourceId, premultipledAlpha, uvRect, flipped);
         quad->setNeedsBlending();
         quadList.append(quad.release());
     }
@@ -87,90 +112,54 @@ void CCScrollbarLayerImpl::appendQuads(CCQuadSink& quadList, const CCSharedQuadS
 
     // We only paint the track in two parts if we were given a texture for the forward track part.
     if (m_foreTrackResourceId && !foreTrackRect.isEmpty())
-        quadList.append(CCTextureDrawQuad::create(sharedQuadState, foreTrackRect, m_foreTrackResourceId, premultipledAlpha, toUVRect(foreTrackRect, boundsRect), flipped));
+        quadList.append(CCTextureDrawQuad::create(sharedQuadState, IntRect(foreTrackRect.x, foreTrackRect.y, foreTrackRect.width, foreTrackRect.height), m_foreTrackResourceId, premultipledAlpha, toUVRect(foreTrackRect, boundsRect), flipped));
 
     // Order matters here: since the back track texture is being drawn to the entire contents rect, we must append it after the thumb and
     // fore track quads. The back track texture contains (and displays) the buttons.
     if (!boundsRect.isEmpty())
-        quadList.append(CCTextureDrawQuad::create(sharedQuadState, boundsRect, m_backTrackResourceId, premultipledAlpha, uvRect, flipped));
-}
-
-
-int CCScrollbarLayerImpl::CCScrollbar::x() const
-{
-    return frameRect().x();
-}
-
-int CCScrollbarLayerImpl::CCScrollbar::y() const
-{
-    return frameRect().y();
-}
-
-int CCScrollbarLayerImpl::CCScrollbar::width() const
-{
-    return frameRect().width();
-}
-
-int CCScrollbarLayerImpl::CCScrollbar::height() const
-{
-    return frameRect().height();
-}
-
-IntSize CCScrollbarLayerImpl::CCScrollbar::size() const
-{
-    return frameRect().size();
-}
-
-IntPoint CCScrollbarLayerImpl::CCScrollbar::location() const
-{
-    return frameRect().location();
-}
-
-ScrollView* CCScrollbarLayerImpl::CCScrollbar::parent() const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
+        quadList.append(CCTextureDrawQuad::create(sharedQuadState, IntRect(boundsRect), m_backTrackResourceId, premultipledAlpha, uvRect, flipped));
 }
 
-ScrollView* CCScrollbarLayerImpl::CCScrollbar::root() const
+void CCScrollbarLayerImpl::didLoseContext()
 {
-    ASSERT_NOT_REACHED();
-    return 0;
+    m_backTrackResourceId = 0;
+    m_foreTrackResourceId = 0;
+    m_thumbResourceId = 0;
 }
 
-void CCScrollbarLayerImpl::CCScrollbar::setFrameRect(const IntRect&)
+bool CCScrollbarLayerImpl::CCScrollbar::isOverlay() const
 {
-    ASSERT_NOT_REACHED();
+    return m_owner->m_isOverlayScrollbar;
 }
 
-IntRect CCScrollbarLayerImpl::CCScrollbar::frameRect() const
+int CCScrollbarLayerImpl::CCScrollbar::value() const
 {
-    return IntRect(IntPoint(), m_owner->contentBounds());
+    return m_owner->m_currentPos;
 }
 
-void CCScrollbarLayerImpl::CCScrollbar::invalidate()
+WebKit::WebPoint CCScrollbarLayerImpl::CCScrollbar::location() const
 {
-    invalidateRect(frameRect());
+    return WebKit::WebPoint();
 }
 
-void CCScrollbarLayerImpl::CCScrollbar::invalidateRect(const IntRect&)
+WebKit::WebSize CCScrollbarLayerImpl::CCScrollbar::size() const
 {
-    ASSERT_NOT_REACHED();
+    return WebKit::WebSize(m_owner->contentBounds().width(), m_owner->contentBounds().height());
 }
 
-ScrollbarOverlayStyle CCScrollbarLayerImpl::CCScrollbar::scrollbarOverlayStyle() const
+bool CCScrollbarLayerImpl::CCScrollbar::enabled() const
 {
-    return m_owner->m_scrollbarOverlayStyle;
+    return m_owner->m_enabled;
 }
 
-void CCScrollbarLayerImpl::CCScrollbar::getTickmarks(Vector<IntRect>& tickmarks) const
+int CCScrollbarLayerImpl::CCScrollbar::maximum() const
 {
-    tickmarks = m_owner->m_tickmarks;
+    return m_owner->m_maximum;
 }
 
-bool CCScrollbarLayerImpl::CCScrollbar::isScrollableAreaActive() const
+int CCScrollbarLayerImpl::CCScrollbar::totalSize() const
 {
-    return m_owner->m_isScrollableAreaActive;
+    return m_owner->m_totalSize;
 }
 
 bool CCScrollbarLayerImpl::CCScrollbar::isScrollViewScrollbar() const
@@ -178,101 +167,44 @@ bool CCScrollbarLayerImpl::CCScrollbar::isScrollViewScrollbar() const
     return m_owner->m_isScrollViewScrollbar;
 }
 
-IntPoint CCScrollbarLayerImpl::CCScrollbar::convertFromContainingWindow(const IntPoint& windowPoint)
-{
-    ASSERT_NOT_REACHED();
-    return windowPoint;
-}
-
-bool CCScrollbarLayerImpl::CCScrollbar::isCustomScrollbar() const
-{
-    return false;
-}
-
-ScrollbarOrientation CCScrollbarLayerImpl::CCScrollbar::orientation() const
-{
-    return m_owner->m_orientation;
-}
-
-int CCScrollbarLayerImpl::CCScrollbar::value() const
-{
-    if (!m_owner->m_scrollLayer)
-        return 0;
-    if (orientation() == HorizontalScrollbar)
-        return m_owner->m_scrollLayer->scrollPosition().x() + m_owner->m_scrollLayer->scrollDelta().width();
-    return m_owner->m_scrollLayer->scrollPosition().y() + m_owner->m_scrollLayer->scrollDelta().height();
-}
-
-float CCScrollbarLayerImpl::CCScrollbar::currentPos() const
-{
-    return value();
-}
-
-int CCScrollbarLayerImpl::CCScrollbar::visibleSize() const
-{
-    return totalSize() - maximum();
-}
-
-int CCScrollbarLayerImpl::CCScrollbar::totalSize() const
+bool CCScrollbarLayerImpl::CCScrollbar::isScrollableAreaActive() const
 {
-    if (!m_owner->m_scrollLayer || !m_owner->m_scrollLayer->children().size())
-        return 0;
-    // Copy & paste from CCLayerTreeHostImpl...
-    // FIXME: Hardcoding the first child here is weird. Think of
-    // a cleaner way to get the contentBounds on the Impl side.
-    if (orientation() == HorizontalScrollbar)
-        return m_owner->m_scrollLayer->children()[0]->bounds().width();
-    return m_owner->m_scrollLayer->children()[0]->bounds().height();
+    return m_owner->m_isScrollableAreaActive;
 }
 
-int CCScrollbarLayerImpl::CCScrollbar::maximum() const
+void CCScrollbarLayerImpl::CCScrollbar::getTickmarks(WebKit::WebVector<WebRect>& tickmarks) const
 {
-    if (!m_owner->m_scrollLayer)
-        return 0;
-    if (orientation() == HorizontalScrollbar)
-        return m_owner->m_scrollLayer->maxScrollPosition().width();
-    return m_owner->m_scrollLayer->maxScrollPosition().height();
+    tickmarks = m_owner->m_tickmarks;
 }
 
-ScrollbarControlSize CCScrollbarLayerImpl::CCScrollbar::controlSize() const
+WebScrollbar::ScrollbarControlSize CCScrollbarLayerImpl::CCScrollbar::controlSize() const
 {
     return m_owner->m_controlSize;
 }
 
-int CCScrollbarLayerImpl::CCScrollbar::lineStep() const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-int CCScrollbarLayerImpl::CCScrollbar::pageStep() const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-ScrollbarPart CCScrollbarLayerImpl::CCScrollbar::pressedPart() const
+WebScrollbar::ScrollbarPart CCScrollbarLayerImpl::CCScrollbar::pressedPart() const
 {
     return m_owner->m_pressedPart;
 }
 
-ScrollbarPart CCScrollbarLayerImpl::CCScrollbar::hoveredPart() const
+WebScrollbar::ScrollbarPart CCScrollbarLayerImpl::CCScrollbar::hoveredPart() const
 {
     return m_owner->m_hoveredPart;
 }
 
-void CCScrollbarLayerImpl::CCScrollbar::styleChanged()
+WebScrollbar::ScrollbarOverlayStyle CCScrollbarLayerImpl::CCScrollbar::scrollbarOverlayStyle() const
 {
+    return m_owner->m_scrollbarOverlayStyle;
 }
 
-bool CCScrollbarLayerImpl::CCScrollbar::enabled() const
+WebScrollbar::Orientation CCScrollbarLayerImpl::CCScrollbar::orientation() const
 {
-    return m_owner->m_enabled;
+    return m_owner->m_orientation;
 }
 
-void CCScrollbarLayerImpl::CCScrollbar::setEnabled(bool)
+bool CCScrollbarLayerImpl::CCScrollbar::isCustomScrollbar() const
 {
-    ASSERT_NOT_REACHED();
+    return m_owner->m_isCustomScrollbar;
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
index faa3361ba..5b8dac297 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
@@ -28,8 +28,11 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "ScrollbarThemeClient.h"
 #include "cc/CCLayerImpl.h"
+#include <public/WebRect.h>
+#include <public/WebScrollbar.h>
+#include <public/WebScrollbarThemeGeometry.h>
+#include <public/WebVector.h>
 
 namespace WebCore {
 
@@ -39,108 +42,86 @@ class CCScrollbarLayerImpl : public CCLayerImpl {
 public:
     static PassOwnPtr<CCScrollbarLayerImpl> create(int id);
 
-    void setScrollbarOverlayStyle(ScrollbarOverlayStyle scrollbarOverlayStyle) { m_scrollbarOverlayStyle = scrollbarOverlayStyle; }
-    void setTickmarks(const Vector<IntRect>& tickmarks) { m_tickmarks = tickmarks; }
-    void setIsScrollableAreaActive(bool isScrollableAreaActive) { m_isScrollableAreaActive = isScrollableAreaActive; }
-    void setIsScrollViewScrollbar(bool isScrollViewScrollbar) { m_isScrollViewScrollbar = isScrollViewScrollbar; }
-
-    void setOrientation(ScrollbarOrientation orientation) { m_orientation = orientation; }
-
-    void setControlSize(ScrollbarControlSize controlSize) { m_controlSize = controlSize; }
-
-    void setPressedPart(ScrollbarPart pressedPart) { m_pressedPart = pressedPart; }
-    void setHoveredPart(ScrollbarPart hoveredPart) { m_hoveredPart = hoveredPart; }
-
-    void setEnabled(bool enabled) { m_enabled = enabled; }
+    WebKit::WebScrollbarThemeGeometry* scrollbarGeometry() const { return m_geometry.get(); }
+    void setScrollbarGeometry(PassOwnPtr<WebKit::WebScrollbarThemeGeometry>);
+    void setScrollbarData(const WebKit::WebScrollbar*);
 
     void setBackTrackResourceId(CCResourceProvider::ResourceId id) { m_backTrackResourceId = id; }
     void setForeTrackResourceId(CCResourceProvider::ResourceId id) { m_foreTrackResourceId = id; }
     void setThumbResourceId(CCResourceProvider::ResourceId id) { m_thumbResourceId = id; }
 
-    CCLayerImpl* scrollLayer() const { return m_scrollLayer; }
-    void setScrollLayer(CCLayerImpl* scrollLayer) { m_scrollLayer = scrollLayer; }
+    float currentPos() const { return m_currentPos; }
+    void setCurrentPos(float currentPos) { m_currentPos = currentPos; }
+
+    int totalSize() const { return m_totalSize; }
+    void setTotalSize(int totalSize) { m_totalSize = totalSize; }
+
+    int maximum() const { return m_maximum; }
+    void setMaximum(int maximum) { m_maximum = maximum; }
+
+    WebKit::WebScrollbar::Orientation orientation() const { return m_orientation; }
 
     virtual void appendQuads(CCQuadSink&, const CCSharedQuadState*, bool& hadMissingTiles) OVERRIDE;
 
+    virtual void didLoseContext() OVERRIDE;
+
 protected:
     explicit CCScrollbarLayerImpl(int id);
 
 private:
-    CCLayerImpl* m_scrollLayer;
-
     // nested class only to avoid namespace problem
-    class CCScrollbar : public ScrollbarThemeClient {
+    class CCScrollbar : public WebKit::WebScrollbar {
     public:
         explicit CCScrollbar(CCScrollbarLayerImpl* owner) : m_owner(owner) { }
 
-        // ScrollbarThemeClient implementation
-        virtual int x() const;
-        virtual int y() const;
-        virtual int width() const;
-        virtual int height() const;
-        virtual IntSize size() const;
-        virtual IntPoint location() const;
-
-        virtual ScrollView* parent() const;
-        virtual ScrollView* root() const;
-
-        virtual void setFrameRect(const IntRect&);
-        virtual IntRect frameRect() const;
-
-        virtual void invalidate();
-        virtual void invalidateRect(const IntRect&);
-
-        virtual ScrollbarOverlayStyle scrollbarOverlayStyle() const;
-        virtual void getTickmarks(Vector<IntRect>&) const;
-        virtual bool isScrollableAreaActive() const;
-        virtual bool isScrollViewScrollbar() const;
-
-        virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint);
-
-        virtual bool isCustomScrollbar() const;
-        virtual ScrollbarOrientation orientation() const;
-
+        // WebScrollbar implementation
+        virtual bool isOverlay() const;
         virtual int value() const;
-        virtual float currentPos() const;
-        virtual int visibleSize() const;
-        virtual int totalSize() const;
-        virtual int maximum() const;
-        virtual ScrollbarControlSize controlSize() const;
-
-        virtual int lineStep() const;
-        virtual int pageStep() const;
-
-        virtual ScrollbarPart pressedPart() const;
-        virtual ScrollbarPart hoveredPart() const;
-
-        virtual void styleChanged();
-
+        virtual WebKit::WebPoint location() const;
+        virtual WebKit::WebSize size() const;
         virtual bool enabled() const;
-        virtual void setEnabled(bool);
+        virtual int maximum() const;
+        virtual int totalSize() const;
+        virtual bool isScrollViewScrollbar() const;
+        virtual bool isScrollableAreaActive() const;
+        virtual void getTickmarks(WebKit::WebVector<WebKit::WebRect>& tickmarks) const;
+        virtual WebScrollbar::ScrollbarControlSize controlSize() const;
+        virtual WebScrollbar::ScrollbarPart pressedPart() const;
+        virtual WebScrollbar::ScrollbarPart hoveredPart() const;
+        virtual WebScrollbar::ScrollbarOverlayStyle scrollbarOverlayStyle() const;
+        virtual WebScrollbar::Orientation orientation() const;
+        virtual bool isCustomScrollbar() const;
 
     private:
         CCScrollbarLayerImpl* m_owner;
 
     };
+
     CCScrollbar m_scrollbar;
 
     CCResourceProvider::ResourceId m_backTrackResourceId;
     CCResourceProvider::ResourceId m_foreTrackResourceId;
     CCResourceProvider::ResourceId m_thumbResourceId;
 
-    ScrollbarOverlayStyle m_scrollbarOverlayStyle;
-    Vector<IntRect> m_tickmarks;
-    bool m_isScrollableAreaActive;
-    bool m_isScrollViewScrollbar;
-
-    ScrollbarOrientation m_orientation;
+    OwnPtr<WebKit::WebScrollbarThemeGeometry> m_geometry;
 
-    ScrollbarControlSize m_controlSize;
+    // Data to implement CCScrollbar
+    WebKit::WebScrollbar::ScrollbarOverlayStyle m_scrollbarOverlayStyle;
+    WebKit::WebVector<WebKit::WebRect> m_tickmarks;
+    WebKit::WebScrollbar::Orientation m_orientation;
+    WebKit::WebScrollbar::ScrollbarControlSize m_controlSize;
+    WebKit::WebScrollbar::ScrollbarPart m_pressedPart;
+    WebKit::WebScrollbar::ScrollbarPart m_hoveredPart;
 
-    ScrollbarPart m_pressedPart;
-    ScrollbarPart m_hoveredPart;
+    float m_currentPos;
+    int m_totalSize;
+    int m_maximum;
 
+    bool m_isScrollableAreaActive;
+    bool m_isScrollViewScrollbar;
     bool m_enabled;
+    bool m_isCustomScrollbar;
+    bool m_isOverlayScrollbar;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.cpp
new file mode 100644
index 000000000..e64f72f23
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCSharedQuadState.h"
+
+#include "FloatQuad.h"
+
+namespace WebCore {
+
+PassOwnPtr<CCSharedQuadState> CCSharedQuadState::create(int id, const WebKit::WebTransformationMatrix& quadTransform, const IntRect& visibleContentRect, const IntRect& clippedRectInTarget, float opacity, bool opaque)
+{
+    return adoptPtr(new CCSharedQuadState(id, quadTransform, visibleContentRect, clippedRectInTarget, opacity, opaque));
+}
+
+CCSharedQuadState::CCSharedQuadState(int id, const WebKit::WebTransformationMatrix& quadTransform, const IntRect& visibleContentRect, const IntRect& clippedRectInTarget, float opacity, bool opaque)
+    : id(id)
+    , quadTransform(quadTransform)
+    , visibleContentRect(visibleContentRect)
+    , clippedRectInTarget(clippedRectInTarget)
+    , opacity(opacity)
+    , opaque(opaque)
+{
+}
+
+}
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.h b/Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.h
index 79036ddd4..af12bec5a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.h
@@ -26,10 +26,28 @@
 #ifndef CCSharedQuadState_h
 #define CCSharedQuadState_h
 
-#include <public/WebCompositorSharedQuadState.h>
+#include "IntRect.h"
+#include <public/WebTransformationMatrix.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
-typedef WebKit::WebCompositorSharedQuadState CCSharedQuadState;
+
+struct CCSharedQuadState {
+    int id;
+
+    // Transforms from quad's original content space to its target content space.
+    WebKit::WebTransformationMatrix quadTransform;
+    // This rect lives in the content space for the quad's originating layer.
+    IntRect visibleContentRect;
+    IntRect clippedRectInTarget;
+    float opacity;
+    bool opaque;
+
+    static PassOwnPtr<CCSharedQuadState> create(int id, const WebKit::WebTransformationMatrix& quadTransform, const IntRect& visibleContentRect, const IntRect& clippedRectInTarget, float opacity, bool opaque);
+    CCSharedQuadState(int id, const WebKit::WebTransformationMatrix& quadTransform, const IntRect& visibleContentRect, const IntRect& clippedRectInTarget, float opacity, bool opaque);
+    bool isLayerAxisAlignedIntRect() const;
+};
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
index 26b0a7186..9fe505f32 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
@@ -30,7 +30,7 @@
 #include "cc/CCDrawQuad.h"
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerTreeHost.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateController.h"
 #include "cc/CCTimer.h"
 #include <wtf/CurrentTime.h>
 
@@ -194,7 +194,7 @@ void CCSingleThreadProxy::setNeedsAnimate()
     ASSERT_NOT_REACHED();
 }
 
-void CCSingleThreadProxy::doCommit(CCTextureUpdater& updater)
+void CCSingleThreadProxy::doCommit(CCTextureUpdateQueue& queue)
 {
     ASSERT(CCProxy::isMainThread());
     // Commit immediately
@@ -206,12 +206,13 @@ void CCSingleThreadProxy::doCommit(CCTextureUpdater& updater)
 
         m_layerTreeHost->beginCommitOnImplThread(m_layerTreeHostImpl.get());
 
-        // CCTextureUpdater is non-blocking and will return without updating
-        // any textures if the uploader is busy. This shouldn't be a problem
-        // here as the throttled uploader isn't used in single thread mode.
-        // For correctness, loop until no more updates are pending.
-        while (updater.hasMoreUpdates())
-            updater.update(m_layerTreeHostImpl->resourceProvider(), m_layerTreeHostImpl->layerRenderer()->textureCopier(), m_layerTreeHostImpl->layerRenderer()->textureUploader(), maxPartialTextureUpdates());
+        // CCTextureUpdateController::updateTextures is non-blocking and will
+        // return without updating any textures if the uploader is busy. This
+        // shouldn't be a problem here as the throttled uploader isn't used in
+        // single thread mode. For correctness, loop until no more updates are
+        // pending.
+        while (queue.hasMoreUpdates())
+            CCTextureUpdateController::updateTextures(m_layerTreeHostImpl->resourceProvider(), m_layerTreeHostImpl->layerRenderer()->textureCopier(), m_layerTreeHostImpl->layerRenderer()->textureUploader(), &queue, maxPartialTextureUpdates());
 
         m_layerTreeHost->finishCommitOnImplThread(m_layerTreeHostImpl.get());
 
@@ -302,11 +303,11 @@ bool CCSingleThreadProxy::commitAndComposite()
     if (m_layerTreeHostImpl->contentsTexturesWerePurgedSinceLastCommit())
         m_layerTreeHost->evictAllContentTextures();
 
-    CCTextureUpdater updater;
-    m_layerTreeHost->updateLayers(updater, m_layerTreeHostImpl->memoryAllocationLimitBytes());
+    CCTextureUpdateQueue queue;
+    m_layerTreeHost->updateLayers(queue, m_layerTreeHostImpl->memoryAllocationLimitBytes());
 
     m_layerTreeHost->willCommit();
-    doCommit(updater);
+    doCommit(queue);
     bool result = doComposite();
     m_layerTreeHost->didBeginFrame();
     return result;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
index 6dce1c35e..319d33597 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
@@ -68,6 +68,7 @@ public:
     // CCLayerTreeHostImplClient implementation
     virtual void didLoseContextOnImplThread() OVERRIDE { }
     virtual void onSwapBuffersCompleteOnImplThread() OVERRIDE { ASSERT_NOT_REACHED(); }
+    virtual void onVSyncParametersChanged(double monotonicTimebase, double intervalInSeconds) OVERRIDE { }
     virtual void setNeedsRedrawOnImplThread() OVERRIDE { m_layerTreeHost->scheduleComposite(); }
     virtual void setNeedsCommitOnImplThread() OVERRIDE { m_layerTreeHost->scheduleComposite(); }
     virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) OVERRIDE;
@@ -79,7 +80,7 @@ private:
     explicit CCSingleThreadProxy(CCLayerTreeHost*);
 
     bool commitAndComposite();
-    void doCommit(CCTextureUpdater&);
+    void doCommit(CCTextureUpdateQueue&);
     bool doComposite();
     void didSwapFrame();
 
diff --git a/Source/WebCore/platform/chromium/support/WebCompositorSolidColorQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp
index 782458c72..3b62b32bc 100644
--- a/Source/WebCore/platform/chromium/support/WebCompositorSolidColorQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp
@@ -25,19 +25,17 @@
 
 #include "config.h"
 
-#include <public/WebCompositorSolidColorQuad.h>
+#include "cc/CCSolidColorDrawQuad.h"
 
-using namespace WebCore;
+namespace WebCore {
 
-namespace WebKit {
-
-PassOwnPtr<WebCompositorSolidColorQuad> WebCompositorSolidColorQuad::create(const WebKit::WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color)
+PassOwnPtr<CCSolidColorDrawQuad> CCSolidColorDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color)
 {
-    return adoptPtr(new WebCompositorSolidColorQuad(sharedQuadState, quadRect, color));
+    return adoptPtr(new CCSolidColorDrawQuad(sharedQuadState, quadRect, color));
 }
 
-WebCompositorSolidColorQuad::WebCompositorSolidColorQuad(const WebKit::WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color)
-    : WebCompositorQuad(sharedQuadState, WebCompositorQuad::SolidColor, quadRect)
+CCSolidColorDrawQuad::CCSolidColorDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color)
+    : CCDrawQuad(sharedQuadState, CCDrawQuad::SolidColor, quadRect)
     , m_color(color)
 {
     if (SkColorGetA(m_color) < 255)
@@ -46,10 +44,10 @@ WebCompositorSolidColorQuad::WebCompositorSolidColorQuad(const WebKit::WebCompos
         m_opaqueRect = quadRect;
 }
 
-const WebCompositorSolidColorQuad* WebCompositorSolidColorQuad::materialCast(const WebCompositorQuad* quad)
+const CCSolidColorDrawQuad* CCSolidColorDrawQuad::materialCast(const CCDrawQuad* quad)
 {
-    ASSERT(quad->material() == WebCompositorQuad::SolidColor);
-    return static_cast<const WebCompositorSolidColorQuad*>(quad);
+    ASSERT(quad->material() == CCDrawQuad::SolidColor);
+    return static_cast<const CCSolidColorDrawQuad*>(quad);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.h
index b6c0ee025..59bc8fea1 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.h
@@ -26,10 +26,30 @@
 #ifndef CCSolidColorDrawQuad_h
 #define CCSolidColorDrawQuad_h
 
-#include <public/WebCompositorSolidColorQuad.h>
+#include "SkColor.h"
+#include "cc/CCDrawQuad.h"
+
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
-typedef WebKit::WebCompositorSolidColorQuad CCSolidColorDrawQuad;
+
+#pragma pack(push, 4)
+
+class CCSolidColorDrawQuad : public CCDrawQuad {
+public:
+    static PassOwnPtr<CCSolidColorDrawQuad> create(const CCSharedQuadState*, const IntRect&, SkColor);
+
+    SkColor color() const { return m_color; };
+
+    static const CCSolidColorDrawQuad* materialCast(const CCDrawQuad*);
+private:
+    CCSolidColorDrawQuad(const CCSharedQuadState*, const IntRect&, SkColor);
+
+    SkColor m_color;
+};
+
+#pragma pack(pop)
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/chromium/support/WebCompositorStreamVideoQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCStreamVideoDrawQuad.cpp
index ae257aaf7..6dd3ff2f1 100644
--- a/Source/WebCore/platform/chromium/support/WebCompositorStreamVideoQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCStreamVideoDrawQuad.cpp
@@ -25,28 +25,26 @@
 
 #include "config.h"
 
-#include <public/WebCompositorStreamVideoQuad.h>
+#include "cc/CCStreamVideoDrawQuad.h"
 
-using namespace WebCore;
+namespace WebCore {
 
-namespace WebKit {
-
-PassOwnPtr<WebCompositorStreamVideoQuad> WebCompositorStreamVideoQuad::create(const WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, unsigned textureId, const WebTransformationMatrix& matrix)
+PassOwnPtr<CCStreamVideoDrawQuad> CCStreamVideoDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, unsigned textureId, const WebKit::WebTransformationMatrix& matrix)
 {
-    return adoptPtr(new WebCompositorStreamVideoQuad(sharedQuadState, quadRect, textureId, matrix));
+    return adoptPtr(new CCStreamVideoDrawQuad(sharedQuadState, quadRect, textureId, matrix));
 }
 
-WebCompositorStreamVideoQuad::WebCompositorStreamVideoQuad(const WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, unsigned textureId, const WebTransformationMatrix& matrix)
-    : WebCompositorQuad(sharedQuadState, WebCompositorQuad::StreamVideoContent, quadRect)
+CCStreamVideoDrawQuad::CCStreamVideoDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, unsigned textureId, const WebKit::WebTransformationMatrix& matrix)
+    : CCDrawQuad(sharedQuadState, CCDrawQuad::StreamVideoContent, quadRect)
     , m_textureId(textureId)
     , m_matrix(matrix)
 {
 }
 
-const WebCompositorStreamVideoQuad* WebCompositorStreamVideoQuad::materialCast(const WebCompositorQuad* quad)
+const CCStreamVideoDrawQuad* CCStreamVideoDrawQuad::materialCast(const CCDrawQuad* quad)
 {
-    ASSERT(quad->material() == WebCompositorQuad::StreamVideoContent);
-    return static_cast<const WebCompositorStreamVideoQuad*>(quad);
+    ASSERT(quad->material() == CCDrawQuad::StreamVideoContent);
+    return static_cast<const CCStreamVideoDrawQuad*>(quad);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h
index a1890611a..c935db7af 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h
@@ -26,10 +26,32 @@
 #ifndef CCStreamVideoDrawQuad_h
 #define CCStreamVideoDrawQuad_h
 
-#include <public/WebCompositorStreamVideoQuad.h>
+#include "cc/CCDrawQuad.h"
+#include <public/WebTransformationMatrix.h>
+
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
-typedef WebKit::WebCompositorStreamVideoQuad CCStreamVideoDrawQuad;
+
+#pragma pack(push, 4)
+
+class CCStreamVideoDrawQuad : public CCDrawQuad {
+public:
+    static PassOwnPtr<CCStreamVideoDrawQuad> create(const CCSharedQuadState*, const IntRect&, unsigned textureId, const WebKit::WebTransformationMatrix&);
+
+    unsigned textureId() const { return m_textureId; }
+    const WebKit::WebTransformationMatrix& matrix() const { return m_matrix; }
+
+    static const CCStreamVideoDrawQuad* materialCast(const CCDrawQuad*);
+private:
+    CCStreamVideoDrawQuad(const CCSharedQuadState*, const IntRect&, unsigned textureId, const WebKit::WebTransformationMatrix&);
+
+    unsigned m_textureId;
+    WebKit::WebTransformationMatrix m_matrix;
+};
+
+#pragma pack(pop)
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/chromium/support/WebCompositorTextureQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTextureDrawQuad.cpp
index dd0b67a41..ed0b99d80 100644
--- a/Source/WebCore/platform/chromium/support/WebCompositorTextureQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTextureDrawQuad.cpp
@@ -25,19 +25,17 @@
 
 #include "config.h"
 
-#include <public/WebCompositorTextureQuad.h>
+#include "cc/CCTextureDrawQuad.h"
 
-using namespace WebCore;
+namespace WebCore {
 
-namespace WebKit {
-
-PassOwnPtr<WebCompositorTextureQuad> WebCompositorTextureQuad::create(const WebKit::WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, unsigned resourceId, bool premultipliedAlpha, const FloatRect& uvRect, bool flipped)
+PassOwnPtr<CCTextureDrawQuad> CCTextureDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, unsigned resourceId, bool premultipliedAlpha, const FloatRect& uvRect, bool flipped)
 {
-    return adoptPtr(new WebCompositorTextureQuad(sharedQuadState, quadRect, resourceId, premultipliedAlpha, uvRect, flipped));
+    return adoptPtr(new CCTextureDrawQuad(sharedQuadState, quadRect, resourceId, premultipliedAlpha, uvRect, flipped));
 }
 
-WebCompositorTextureQuad::WebCompositorTextureQuad(const WebKit::WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, unsigned resourceId, bool premultipliedAlpha, const FloatRect& uvRect, bool flipped)
-    : WebCompositorQuad(sharedQuadState, WebCompositorQuad::TextureContent, quadRect)
+CCTextureDrawQuad::CCTextureDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, unsigned resourceId, bool premultipliedAlpha, const FloatRect& uvRect, bool flipped)
+    : CCDrawQuad(sharedQuadState, CCDrawQuad::TextureContent, quadRect)
     , m_resourceId(resourceId)
     , m_premultipliedAlpha(premultipliedAlpha)
     , m_uvRect(uvRect)
@@ -45,15 +43,15 @@ WebCompositorTextureQuad::WebCompositorTextureQuad(const WebKit::WebCompositorSh
 {
 }
 
-void WebCompositorTextureQuad::setNeedsBlending()
+void CCTextureDrawQuad::setNeedsBlending()
 {
     m_needsBlending = true;
 }
 
-const WebCompositorTextureQuad* WebCompositorTextureQuad::materialCast(const WebKit::WebCompositorQuad* quad)
+const CCTextureDrawQuad* CCTextureDrawQuad::materialCast(const CCDrawQuad* quad)
 {
-    ASSERT(quad->material() == WebCompositorQuad::TextureContent);
-    return static_cast<const WebCompositorTextureQuad*>(quad);
+    ASSERT(quad->material() == CCDrawQuad::TextureContent);
+    return static_cast<const CCTextureDrawQuad*>(quad);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTextureDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCTextureDrawQuad.h
index 28c3d9132..20d5c9d12 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTextureDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTextureDrawQuad.h
@@ -26,10 +26,37 @@
 #ifndef CCTextureDrawQuad_h
 #define CCTextureDrawQuad_h
 
-#include <public/WebCompositorTextureQuad.h>
+#include "FloatRect.h"
+#include "cc/CCDrawQuad.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
-typedef WebKit::WebCompositorTextureQuad CCTextureDrawQuad;
+
+#pragma pack(push, 4)
+
+class CCTextureDrawQuad : public CCDrawQuad {
+public:
+    static PassOwnPtr<CCTextureDrawQuad> create(const CCSharedQuadState*, const IntRect&, unsigned resourceId, bool premultipliedAlpha, const FloatRect& uvRect, bool flipped);
+    FloatRect uvRect() const { return m_uvRect; }
+
+    unsigned resourceId() const { return m_resourceId; }
+    bool premultipliedAlpha() const { return  m_premultipliedAlpha; }
+    bool flipped() const { return m_flipped; }
+
+    void setNeedsBlending();
+
+    static const CCTextureDrawQuad* materialCast(const CCDrawQuad*);
+private:
+    CCTextureDrawQuad(const CCSharedQuadState*, const IntRect&, unsigned resourceId, bool premultipliedAlpha, const FloatRect& uvRect, bool flipped);
+
+    unsigned m_resourceId;
+    bool m_premultipliedAlpha;
+    FloatRect m_uvRect;
+    bool m_flipped;
+};
+
+#pragma pack(pop)
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdateController.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdateController.cpp
new file mode 100644
index 000000000..dde894950
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdateController.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCTextureUpdateController.h"
+
+#include "GraphicsContext3D.h"
+#include "TextureCopier.h"
+#include "TextureUploader.h"
+#include <wtf/CurrentTime.h>
+
+namespace {
+
+// Number of textures to update with each call to updateMoreTextures().
+static const size_t textureUpdatesPerFrame = 48;
+
+// Flush interval when performing texture uploads.
+static const int textureUploadFlushPeriod = 4;
+
+} // anonymous namespace
+
+namespace WebCore {
+
+size_t CCTextureUpdateController::maxPartialTextureUpdates()
+{
+    return textureUpdatesPerFrame;
+}
+
+void CCTextureUpdateController::updateTextures(CCResourceProvider* resourceProvider, TextureCopier* copier, TextureUploader* uploader, CCTextureUpdateQueue* queue, size_t count)
+{
+    if (queue->fullUploadSize() || queue->partialUploadSize()) {
+        if (uploader->isBusy())
+            return;
+
+        uploader->beginUploads();
+
+        size_t fullUploadCount = 0;
+        while (queue->fullUploadSize() && fullUploadCount < count) {
+            uploader->uploadTexture(resourceProvider, queue->takeFirstFullUpload());
+            fullUploadCount++;
+            if (!(fullUploadCount % textureUploadFlushPeriod))
+                resourceProvider->shallowFlushIfSupported();
+        }
+
+        // Make sure there are no dangling uploads without a flush.
+        if (fullUploadCount % textureUploadFlushPeriod)
+            resourceProvider->shallowFlushIfSupported();
+
+        bool moreUploads = queue->fullUploadSize();
+
+        ASSERT(queue->partialUploadSize() <= count);
+        // We need another update batch if the number of updates remaining
+        // in |count| is greater than the remaining partial entries.
+        if ((count - fullUploadCount) < queue->partialUploadSize())
+            moreUploads = true;
+
+        if (moreUploads) {
+            uploader->endUploads();
+            return;
+        }
+
+        size_t partialUploadCount = 0;
+        while (queue->partialUploadSize()) {
+            uploader->uploadTexture(resourceProvider, queue->takeFirstPartialUpload());
+            partialUploadCount++;
+            if (!(partialUploadCount % textureUploadFlushPeriod))
+                resourceProvider->shallowFlushIfSupported();
+        }
+
+        // Make sure there are no dangling partial uploads without a flush.
+        if (partialUploadCount % textureUploadFlushPeriod)
+            resourceProvider->shallowFlushIfSupported();
+
+        uploader->endUploads();
+    }
+
+    size_t copyCount = 0;
+    while (queue->copySize()) {
+        copier->copyTexture(queue->takeFirstCopy());
+        copyCount++;
+    }
+
+    // If we've performed any texture copies, we need to insert a flush here into the compositor context
+    // before letting the main thread proceed as it may make draw calls to the source texture of one of
+    // our copy operations.
+    if (copyCount)
+        copier->flush();
+}
+
+CCTextureUpdateController::CCTextureUpdateController(PassOwnPtr<CCTextureUpdateQueue> queue, CCResourceProvider* resourceProvider, TextureCopier* copier, TextureUploader* uploader)
+    : m_queue(queue)
+    , m_resourceProvider(resourceProvider)
+    , m_copier(copier)
+    , m_uploader(uploader)
+{
+}
+
+CCTextureUpdateController::~CCTextureUpdateController()
+{
+}
+
+bool CCTextureUpdateController::hasMoreUpdates() const
+{
+    return m_queue->hasMoreUpdates();
+}
+
+void CCTextureUpdateController::updateMoreTextures()
+{
+    if (!m_queue->hasMoreUpdates())
+        return;
+
+    updateTextures(m_resourceProvider, m_copier, m_uploader, m_queue.get(), updateMoreTexturesSize());
+}
+
+size_t CCTextureUpdateController::updateMoreTexturesSize() const
+{
+    return textureUpdatesPerFrame;
+}
+
+}
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdateController.h
index 972a1c0ec..bd2c7bc82 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdateController.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,56 +23,45 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef CCTextureUpdater_h
-#define CCTextureUpdater_h
+#ifndef CCTextureUpdateController_h
+#define CCTextureUpdateController_h
 
-#include "IntRect.h"
-#include "LayerTextureUpdater.h"
-#include <wtf/Vector.h>
+#include "cc/CCTextureUpdateQueue.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
-class CCResourceProvider;
 class TextureCopier;
 class TextureUploader;
 
-class CCTextureUpdater {
+class CCTextureUpdateController {
+    WTF_MAKE_NONCOPYABLE(CCTextureUpdateController);
 public:
-    CCTextureUpdater();
-    ~CCTextureUpdater();
+    static PassOwnPtr<CCTextureUpdateController> create(PassOwnPtr<CCTextureUpdateQueue> queue, CCResourceProvider* resourceProvider, TextureCopier* copier, TextureUploader* uploader)
+    {
+        return adoptPtr(new CCTextureUpdateController(queue, resourceProvider, copier, uploader));
+    }
+    static size_t maxPartialTextureUpdates();
+    static void updateTextures(CCResourceProvider*, TextureCopier*, TextureUploader*, CCTextureUpdateQueue*, size_t count);
 
-    void appendFullUpdate(LayerTextureUpdater::Texture*, const IntRect& sourceRect, const IntRect& destRect);
-    void appendPartialUpdate(LayerTextureUpdater::Texture*, const IntRect& sourceRect, const IntRect& destRect);
-    void appendCopy(unsigned sourceTexture, unsigned destTexture, const IntSize&);
+    virtual ~CCTextureUpdateController();
 
     bool hasMoreUpdates() const;
+    void updateMoreTextures();
 
-    // Update some textures.
-    void update(CCResourceProvider*, TextureCopier*, TextureUploader*, size_t count);
+    // Virtual for testing.
+    virtual size_t updateMoreTexturesSize() const;
 
-    void clear();
+protected:
+    CCTextureUpdateController(PassOwnPtr<CCTextureUpdateQueue>, CCResourceProvider*, TextureCopier*, TextureUploader*);
 
-private:
-    struct UpdateEntry {
-        LayerTextureUpdater::Texture* texture;
-        IntRect sourceRect;
-        IntRect destRect;
-    };
-
-    struct CopyEntry {
-        IntSize size;
-        unsigned sourceTexture;
-        unsigned destTexture;
-    };
-
-    static void appendUpdate(LayerTextureUpdater::Texture*, const IntRect& sourceRect, const IntRect& destRect, Vector<UpdateEntry>&);
-
-    size_t m_entryIndex;
-    Vector<UpdateEntry> m_fullEntries;
-    Vector<UpdateEntry> m_partialEntries;
-    Vector<CopyEntry> m_copyEntries;
+    OwnPtr<CCTextureUpdateQueue> m_queue;
+    CCResourceProvider* m_resourceProvider;
+    TextureCopier* m_copier;
+    TextureUploader* m_uploader;
 };
 
 }
 
-#endif // CCTextureUpdater_h
+#endif // CCTextureUpdateController_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdateQueue.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdateQueue.cpp
new file mode 100644
index 000000000..ae9ab9788
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdateQueue.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "cc/CCTextureUpdateQueue.h"
+
+namespace WebCore {
+
+CCTextureUpdateQueue::CCTextureUpdateQueue()
+{
+}
+
+CCTextureUpdateQueue::~CCTextureUpdateQueue()
+{
+}
+
+void CCTextureUpdateQueue::appendFullUpload(TextureUploader::Parameters upload)
+{
+    m_fullEntries.append(upload);
+}
+
+void CCTextureUpdateQueue::appendPartialUpload(TextureUploader::Parameters upload)
+{
+    m_partialEntries.append(upload);
+}
+
+void CCTextureUpdateQueue::appendCopy(TextureCopier::Parameters copy)
+{
+    m_copyEntries.append(copy);
+}
+
+TextureUploader::Parameters CCTextureUpdateQueue::takeFirstFullUpload()
+{
+    return m_fullEntries.takeFirst();
+}
+
+TextureUploader::Parameters CCTextureUpdateQueue::takeFirstPartialUpload()
+{
+    return m_partialEntries.takeFirst();
+}
+
+TextureCopier::Parameters CCTextureUpdateQueue::takeFirstCopy()
+{
+    return m_copyEntries.takeFirst();
+}
+
+bool CCTextureUpdateQueue::hasMoreUpdates() const
+{
+    return m_fullEntries.size() || m_partialEntries.size() || m_copyEntries.size();
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/Platform/chromium/public/WebCompositorStreamVideoQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdateQueue.h
index 36a3ceab4..7bb5cbc1d 100644
--- a/Source/Platform/chromium/public/WebCompositorStreamVideoQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdateQueue.h
@@ -23,40 +23,42 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCompositorStreamVideoQuad_h
-#define WebCompositorStreamVideoQuad_h
+#ifndef CCTextureUpdateQueue_h
+#define CCTextureUpdateQueue_h
 
-#include "WebCompositorQuad.h"
-#include <public/WebTransformationMatrix.h>
-#if WEBKIT_IMPLEMENTATION
-#include <wtf/PassOwnPtr.h>
-#endif
+#include "TextureCopier.h"
+#include "TextureUploader.h"
+#include <wtf/Deque.h>
+#include <wtf/Noncopyable.h>
 
-namespace WebKit {
+namespace WebCore {
 
-#pragma pack(push, 4)
-
-class WebCompositorStreamVideoQuad : public WebCompositorQuad {
+class CCTextureUpdateQueue {
+    WTF_MAKE_NONCOPYABLE(CCTextureUpdateQueue);
 public:
-#if WEBKIT_IMPLEMENTATION
-    static PassOwnPtr<WebCompositorStreamVideoQuad> create(const WebCompositorSharedQuadState*, const WebCore::IntRect&, unsigned textureId, const WebTransformationMatrix&);
-#endif
+    CCTextureUpdateQueue();
+    virtual ~CCTextureUpdateQueue();
 
-    unsigned textureId() const { return m_textureId; }
-    const WebTransformationMatrix& matrix() const { return m_matrix; }
+    void appendFullUpload(TextureUploader::Parameters);
+    void appendPartialUpload(TextureUploader::Parameters);
+    void appendCopy(TextureCopier::Parameters);
 
-    static const WebCompositorStreamVideoQuad* materialCast(const WebCompositorQuad*);
-private:
-#if WEBKIT_IMPLEMENTATION
-    WebCompositorStreamVideoQuad(const WebCompositorSharedQuadState*, const WebCore::IntRect&, unsigned textureId, const WebTransformationMatrix&);
-#endif
+    TextureUploader::Parameters takeFirstFullUpload();
+    TextureUploader::Parameters takeFirstPartialUpload();
+    TextureCopier::Parameters takeFirstCopy();
 
-    unsigned m_textureId;
-    WebTransformationMatrix m_matrix;
-};
+    size_t fullUploadSize() const { return m_fullEntries.size(); }
+    size_t partialUploadSize() const { return m_partialEntries.size(); }
+    size_t copySize() const { return m_copyEntries.size(); }
 
-#pragma pack(pop)
+    bool hasMoreUpdates() const;
+
+private:
+    Deque<TextureUploader::Parameters> m_fullEntries;
+    Deque<TextureUploader::Parameters> m_partialEntries;
+    Deque<TextureCopier::Parameters> m_copyEntries;
+};
 
 }
 
-#endif
+#endif // CCTextureUpdateQueue_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp
deleted file mode 100644
index c6f4929a8..000000000
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp
+++ /dev/null
@@ -1,167 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if USE(ACCELERATED_COMPOSITING)
-
-#include "cc/CCTextureUpdater.h"
-
-#include "CCPrioritizedTexture.h"
-#include "GraphicsContext3D.h"
-#include "LayerTextureUpdater.h"
-#include "TextureCopier.h"
-#include "TextureUploader.h"
-
-using namespace std;
-
-namespace WebCore {
-
-static const int kUploadFlushPeriod = 4;
-
-CCTextureUpdater::CCTextureUpdater()
-    : m_entryIndex(0)
-{
-}
-
-CCTextureUpdater::~CCTextureUpdater()
-{
-}
-
-void CCTextureUpdater::appendUpdate(LayerTextureUpdater::Texture* texture, const IntRect& sourceRect, const IntRect& destRect, Vector<UpdateEntry>& entries)
-{
-    ASSERT(texture);
-
-    UpdateEntry entry;
-    entry.texture = texture;
-    entry.sourceRect = sourceRect;
-    entry.destRect = destRect;
-    entries.append(entry);
-}
-
-void CCTextureUpdater::appendFullUpdate(LayerTextureUpdater::Texture* texture, const IntRect& sourceRect, const IntRect& destRect)
-{
-    appendUpdate(texture, sourceRect, destRect, m_fullEntries);
-}
-
-void CCTextureUpdater::appendPartialUpdate(LayerTextureUpdater::Texture* texture, const IntRect& sourceRect, const IntRect& destRect)
-{
-    appendUpdate(texture, sourceRect, destRect, m_partialEntries);
-}
-
-void CCTextureUpdater::appendCopy(unsigned sourceTexture, unsigned destTexture, const IntSize& size)
-{
-    CopyEntry copy;
-    copy.sourceTexture = sourceTexture;
-    copy.destTexture = destTexture;
-    copy.size = size;
-    m_copyEntries.append(copy);
-}
-
-bool CCTextureUpdater::hasMoreUpdates() const
-{
-    return m_fullEntries.size() || m_partialEntries.size() || m_copyEntries.size();
-}
-
-void CCTextureUpdater::update(CCResourceProvider* resourceProvider, TextureCopier* copier, TextureUploader* uploader, size_t count)
-{
-    size_t index;
-
-    if (m_fullEntries.size() || m_partialEntries.size()) {
-        if (uploader->isBusy())
-            return;
-
-        uploader->beginUploads();
-
-        int fullUploadCount = 0;
-        size_t maxIndex = min(m_entryIndex + count, m_fullEntries.size());
-        for (index = m_entryIndex; index < maxIndex; ++index) {
-            UpdateEntry& entry = m_fullEntries[index];
-            uploader->uploadTexture(entry.texture, resourceProvider, entry.sourceRect, entry.destRect);
-            fullUploadCount++;
-            if (!(fullUploadCount % kUploadFlushPeriod))
-                resourceProvider->shallowFlushIfSupported();
-        }
-
-        // Make sure there are no dangling uploads without a flush.
-        if (fullUploadCount % kUploadFlushPeriod)
-            resourceProvider->shallowFlushIfSupported();
-
-        bool moreUploads = maxIndex < m_fullEntries.size();
-
-        ASSERT(m_partialEntries.size() <= count);
-        // We need another update batch if the number of updates remaining
-        // in |count| is greater than the remaining partial entries.
-        if ((count - (index - m_entryIndex)) < m_partialEntries.size())
-            moreUploads = true;
-
-        if (moreUploads) {
-            m_entryIndex = index;
-            uploader->endUploads();
-            return;
-        }
-
-        for (index = 0; index < m_partialEntries.size(); ++index) {
-            UpdateEntry& entry = m_partialEntries[index];
-            uploader->uploadTexture(entry.texture, resourceProvider, entry.sourceRect, entry.destRect);
-            if (!((index+1) % kUploadFlushPeriod))
-                resourceProvider->shallowFlushIfSupported();
-        }
-
-        // Make sure there are no dangling partial uploads without a flush.
-        // Note: We don't need to use (index+1) in this case because index was
-        // incremented at the end of the for loop.
-        if (index % kUploadFlushPeriod)
-            resourceProvider->shallowFlushIfSupported();
-
-        uploader->endUploads();
-    }
-
-    for (index = 0; index < m_copyEntries.size(); ++index) {
-        CopyEntry& copyEntry = m_copyEntries[index];
-        copier->copyTexture(copyEntry.sourceTexture, copyEntry.destTexture, copyEntry.size);
-    }
-
-    // If we've performed any texture copies, we need to insert a flush here into the compositor context
-    // before letting the main thread proceed as it may make draw calls to the source texture of one of
-    // our copy operations.
-    if (m_copyEntries.size())
-        copier->flush();
-
-    // If no entries left to process, auto-clear.
-    clear();
-}
-
-void CCTextureUpdater::clear()
-{
-    m_entryIndex = 0;
-    m_fullEntries.clear();
-    m_partialEntries.clear();
-    m_copyEntries.clear();
-}
-
-}
-
-#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
index 9a455ffb0..d37168f11 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
@@ -26,8 +26,6 @@
 
 #include "cc/CCThreadProxy.h"
 
-#include "GraphicsContext3D.h"
-#include "SharedGraphicsContext3D.h"
 #include "TraceEvent.h"
 #include "cc/CCDelayBasedTimeSource.h"
 #include "cc/CCDrawQuad.h"
@@ -37,19 +35,17 @@
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCScheduler.h"
 #include "cc/CCScopedThreadProxy.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateController.h"
 #include "cc/CCThreadTask.h"
+#include <public/WebSharedGraphicsContext3D.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
 
 using namespace WTF;
 
+using WebKit::WebSharedGraphicsContext3D;
 namespace {
 
-// Number of textures to update with each call to
-// scheduledActionUpdateMoreResources().
-static const size_t textureUpdatesPerFrame = 48;
-
 // Measured in seconds.
 static const double contextRecreationTickRate = 0.03;
 
@@ -85,6 +81,7 @@ CCThreadProxy::CCThreadProxy(CCLayerTreeHost* layerTreeHost)
     , m_commitCompletionEventOnImplThread(0)
     , m_textureAcquisitionCompletionEventOnImplThread(0)
     , m_nextFrameIsNewlyCommittedFrameOnImplThread(false)
+    , m_renderVSyncEnabled(layerTreeHost->settings().renderVSyncEnabled)
 {
     TRACE_EVENT0("cc", "CCThreadProxy::CCThreadProxy");
     ASSERT(isMainThread());
@@ -111,7 +108,7 @@ bool CCThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect)
 
     // Perform a synchronous commit.
     CCCompletionEvent beginFrameCompletion;
-    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::forceBeginFrameOnImplThread, AllowCrossThreadAccess(&beginFrameCompletion)));
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::forceBeginFrameOnImplThread, &beginFrameCompletion));
     beginFrameCompletion.wait();
     m_inCompositeAndReadback = true;
     beginFrame();
@@ -121,7 +118,7 @@ bool CCThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect)
     ReadbackRequest request;
     request.rect = rect;
     request.pixels = pixels;
-    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::requestReadbackOnImplThread, AllowCrossThreadAccess(&request)));
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::requestReadbackOnImplThread, &request));
     request.completion.wait();
     return request.success;
 }
@@ -160,7 +157,7 @@ void CCThreadProxy::finishAllRendering()
 
     // Make sure all GL drawing is finished on the impl thread.
     CCCompletionEvent completion;
-    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::finishAllRenderingOnImplThread, AllowCrossThreadAccess(&completion)));
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::finishAllRenderingOnImplThread, &completion));
     completion.wait();
 }
 
@@ -178,7 +175,7 @@ bool CCThreadProxy::initializeContext()
         return false;
 
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::initializeContextOnImplThread,
-                                                       AllowCrossThreadAccess(context.leakPtr())));
+                                                       context.leakPtr()));
     return true;
 }
 
@@ -198,7 +195,7 @@ void CCThreadProxy::setVisible(bool visible)
 {
     TRACE_EVENT0("cc", "CCThreadProxy::setVisible");
     CCCompletionEvent completion;
-    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setVisibleOnImplThread, AllowCrossThreadAccess(&completion), visible));
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setVisibleOnImplThread, &completion, visible));
     completion.wait();
 }
 
@@ -219,9 +216,9 @@ bool CCThreadProxy::initializeLayerRenderer()
     bool initializeSucceeded = false;
     LayerRendererCapabilities capabilities;
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::initializeLayerRendererOnImplThread,
-                                                       AllowCrossThreadAccess(&completion),
-                                                       AllowCrossThreadAccess(&initializeSucceeded),
-                                                       AllowCrossThreadAccess(&capabilities)));
+                                                       &completion,
+                                                       &initializeSucceeded,
+                                                       &capabilities));
     completion.wait();
 
     if (initializeSucceeded) {
@@ -240,8 +237,8 @@ bool CCThreadProxy::recreateContext()
     OwnPtr<CCGraphicsContext> context = m_layerTreeHost->createContext();
     if (!context)
         return false;
-    if (m_layerTreeHost->needsSharedContext() && !m_layerTreeHost->settings().forceSoftwareCompositing)
-        if (!SharedGraphicsContext3D::createForImplThread())
+    if (m_layerTreeHost->needsSharedContext())
+        if (!WebSharedGraphicsContext3D::createCompositorThreadContext())
             return false;
 
     // Make a blocking call to recreateContextOnImplThread. The results of that
@@ -251,10 +248,10 @@ bool CCThreadProxy::recreateContext()
     bool recreateSucceeded = false;
     LayerRendererCapabilities capabilities;
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::recreateContextOnImplThread,
-                                                       AllowCrossThreadAccess(&completion),
-                                                       AllowCrossThreadAccess(context.leakPtr()),
-                                                       AllowCrossThreadAccess(&recreateSucceeded),
-                                                       AllowCrossThreadAccess(&capabilities)));
+                                                       &completion,
+                                                       context.leakPtr(),
+                                                       &recreateSucceeded,
+                                                       &capabilities));
     completion.wait();
 
     if (recreateSucceeded)
@@ -274,8 +271,8 @@ void CCThreadProxy::implSideRenderingStats(CCRenderingStats& stats)
 
     CCCompletionEvent completion;
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::implSideRenderingStatsOnImplThread,
-                                                       AllowCrossThreadAccess(&completion),
-                                                       AllowCrossThreadAccess(&stats)));
+                                                       &completion,
+                                                       &stats));
     completion.wait();
 }
 
@@ -327,6 +324,13 @@ void CCThreadProxy::onSwapBuffersCompleteOnImplThread()
     m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::didCompleteSwapBuffers));
 }
 
+void CCThreadProxy::onVSyncParametersChanged(double monotonicTimebase, double intervalInSeconds)
+{
+    ASSERT(isImplThread());
+    TRACE_EVENT0("cc", "CCThreadProxy::onVSyncParametersChanged");
+    // FIXME: route this into the scheduler once the scheduler supports vsync.
+}
+
 void CCThreadProxy::setNeedsCommitOnImplThread()
 {
     ASSERT(isImplThread());
@@ -376,7 +380,7 @@ void CCThreadProxy::start()
     ASSERT(CCProxy::implThread());
     // Create LayerTreeHostImpl.
     CCCompletionEvent completion;
-    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::initializeImplOnImplThread, AllowCrossThreadAccess(&completion)));
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::initializeImplOnImplThread, &completion));
     completion.wait();
 
     m_started = true;
@@ -393,7 +397,7 @@ void CCThreadProxy::stop()
         DebugScopedSetMainThreadBlocked mainThreadBlocked;
 
         CCCompletionEvent completion;
-        CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::layerTreeHostClosedOnImplThread, AllowCrossThreadAccess(&completion)));
+        CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::layerTreeHostClosedOnImplThread, &completion));
         completion.wait();
     }
 
@@ -407,7 +411,7 @@ void CCThreadProxy::stop()
 void CCThreadProxy::forceSerializeOnSwapBuffers()
 {
     CCCompletionEvent completion;
-    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::forceSerializeOnSwapBuffersOnImplThread, AllowCrossThreadAccess(&completion)));
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::forceSerializeOnSwapBuffersOnImplThread, &completion));
     completion.wait();
 }
 
@@ -448,8 +452,6 @@ void CCThreadProxy::scheduledActionBeginFrame()
     m_pendingBeginFrameRequest = adoptPtr(new BeginFrameAndCommitState());
     m_pendingBeginFrameRequest->monotonicFrameBeginTime = monotonicallyIncreasingTime();
     m_pendingBeginFrameRequest->scrollInfo = m_layerTreeHostImpl->processScrollDeltas();
-    m_currentTextureUpdaterOnImplThread = adoptPtr(new CCTextureUpdater);
-    m_pendingBeginFrameRequest->updater = m_currentTextureUpdaterOnImplThread.get();
     m_pendingBeginFrameRequest->contentsTexturesWereDeleted = m_layerTreeHostImpl->contentsTexturesWerePurgedSinceLastCommit();
     m_pendingBeginFrameRequest->memoryAllocationLimitBytes = m_layerTreeHostImpl->memoryAllocationLimitBytes();
 
@@ -473,8 +475,8 @@ void CCThreadProxy::beginFrame()
         return;
     }
 
-    if (m_layerTreeHost->needsSharedContext() && !m_layerTreeHost->settings().forceSoftwareCompositing && !SharedGraphicsContext3D::haveForImplThread())
-        SharedGraphicsContext3D::createForImplThread();
+    if (m_layerTreeHost->needsSharedContext() && !WebSharedGraphicsContext3D::haveCompositorThreadContext())
+        WebSharedGraphicsContext3D::createCompositorThreadContext();
 
     OwnPtr<BeginFrameAndCommitState> request(m_pendingBeginFrameRequest.release());
 
@@ -520,7 +522,8 @@ void CCThreadProxy::beginFrame()
     if (request->contentsTexturesWereDeleted)
         m_layerTreeHost->evictAllContentTextures();
 
-    m_layerTreeHost->updateLayers(*request->updater, request->memoryAllocationLimitBytes);
+    OwnPtr<CCTextureUpdateQueue> queue = adoptPtr(new CCTextureUpdateQueue);
+    m_layerTreeHost->updateLayers(*(queue.get()), request->memoryAllocationLimitBytes);
 
     // Once single buffered layers are committed, they cannot be modified until
     // they are drawn by the impl thread.
@@ -542,7 +545,7 @@ void CCThreadProxy::beginFrame()
         DebugScopedSetMainThreadBlocked mainThreadBlocked;
 
         CCCompletionEvent completion;
-        CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::beginFrameCompleteOnImplThread, AllowCrossThreadAccess(&completion)));
+        CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::beginFrameCompleteOnImplThread, &completion, queue.release()));
         completion.wait();
     }
 
@@ -550,7 +553,7 @@ void CCThreadProxy::beginFrame()
     m_layerTreeHost->didBeginFrame();
 }
 
-void CCThreadProxy::beginFrameCompleteOnImplThread(CCCompletionEvent* completion)
+void CCThreadProxy::beginFrameCompleteOnImplThread(CCCompletionEvent* completion, PassOwnPtr<CCTextureUpdateQueue> queue)
 {
     TRACE_EVENT0("cc", "CCThreadProxy::beginFrameCompleteOnImplThread");
     ASSERT(!m_commitCompletionEventOnImplThread);
@@ -563,6 +566,7 @@ void CCThreadProxy::beginFrameCompleteOnImplThread(CCCompletionEvent* completion
         return;
     }
 
+    m_currentTextureUpdateControllerOnImplThread = CCTextureUpdateController::create(queue, m_layerTreeHostImpl->resourceProvider(), m_layerTreeHostImpl->layerRenderer()->textureCopier(), m_layerTreeHostImpl->layerRenderer()->textureUploader());
     m_commitCompletionEventOnImplThread = completion;
 
     m_schedulerOnImplThread->beginFrameComplete();
@@ -580,9 +584,9 @@ void CCThreadProxy::beginFrameAbortedOnImplThread()
 
 bool CCThreadProxy::hasMoreResourceUpdates() const
 {
-    if (!m_currentTextureUpdaterOnImplThread)
+    if (!m_currentTextureUpdateControllerOnImplThread)
         return false;
-    return m_currentTextureUpdaterOnImplThread->hasMoreUpdates();
+    return m_currentTextureUpdateControllerOnImplThread->hasMoreUpdates();
 }
 
 bool CCThreadProxy::canDraw()
@@ -596,19 +600,19 @@ bool CCThreadProxy::canDraw()
 void CCThreadProxy::scheduledActionUpdateMoreResources()
 {
     TRACE_EVENT0("cc", "CCThreadProxy::scheduledActionUpdateMoreResources");
-    ASSERT(m_currentTextureUpdaterOnImplThread);
-    m_currentTextureUpdaterOnImplThread->update(m_layerTreeHostImpl->resourceProvider(), m_layerTreeHostImpl->layerRenderer()->textureCopier(), m_layerTreeHostImpl->layerRenderer()->textureUploader(), textureUpdatesPerFrame);
+    ASSERT(m_currentTextureUpdateControllerOnImplThread);
+    m_currentTextureUpdateControllerOnImplThread->updateMoreTextures();
 }
 
 void CCThreadProxy::scheduledActionCommit()
 {
     TRACE_EVENT0("cc", "CCThreadProxy::scheduledActionCommit");
     ASSERT(isImplThread());
-    ASSERT(m_currentTextureUpdaterOnImplThread);
-    ASSERT(!m_currentTextureUpdaterOnImplThread->hasMoreUpdates());
+    ASSERT(m_currentTextureUpdateControllerOnImplThread);
+    ASSERT(!m_currentTextureUpdateControllerOnImplThread->hasMoreUpdates());
     ASSERT(m_commitCompletionEventOnImplThread);
 
-    m_currentTextureUpdaterOnImplThread.clear();
+    m_currentTextureUpdateControllerOnImplThread.clear();
 
     m_layerTreeHostImpl->beginCommit();
 
@@ -706,7 +710,7 @@ void CCThreadProxy::acquireLayerTextures()
 
     TRACE_EVENT0("cc", "CCThreadProxy::acquireLayerTextures");
     CCCompletionEvent completion;
-    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::acquireLayerTexturesForMainThreadOnImplThread, AllowCrossThreadAccess(&completion)));
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::acquireLayerTexturesForMainThreadOnImplThread, &completion));
     completion.wait(); // Block until it is safe to write to layer textures from the main thread.
 
     m_texturesAcquired = true;
@@ -809,7 +813,11 @@ void CCThreadProxy::initializeImplOnImplThread(CCCompletionEvent* completion)
     ASSERT(isImplThread());
     m_layerTreeHostImpl = m_layerTreeHost->createLayerTreeHostImpl(this);
     const double displayRefreshInterval = 1.0 / 60.0;
-    OwnPtr<CCFrameRateController> frameRateController = adoptPtr(new CCFrameRateController(CCDelayBasedTimeSource::create(displayRefreshInterval, CCProxy::implThread())));
+    OwnPtr<CCFrameRateController> frameRateController;
+    if (m_renderVSyncEnabled)
+        frameRateController = adoptPtr(new CCFrameRateController(CCDelayBasedTimeSource::create(displayRefreshInterval, CCProxy::implThread())));
+    else
+        frameRateController = adoptPtr(new CCFrameRateController(CCProxy::implThread()));
     m_schedulerOnImplThread = CCScheduler::create(this, frameRateController.release());
     m_schedulerOnImplThread->setVisible(m_layerTreeHostImpl->visible());
 
@@ -861,7 +869,7 @@ void CCThreadProxy::setFullRootLayerDamageOnImplThread()
 
 size_t CCThreadProxy::maxPartialTextureUpdates() const
 {
-    return textureUpdatesPerFrame;
+    return CCTextureUpdateController::maxPartialTextureUpdates();
 }
 
 void CCThreadProxy::recreateContextOnImplThread(CCCompletionEvent* completion, CCGraphicsContext* contextPtr, bool* recreateSucceeded, LayerRendererCapabilities* capabilities)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
index 860a20173..34360d51a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
@@ -38,7 +38,8 @@ class CCInputHandler;
 class CCLayerTreeHost;
 class CCScheduler;
 class CCScopedThreadProxy;
-class CCTextureUpdater;
+class CCTextureUpdateQueue;
+class CCTextureUpdateController;
 class CCThread;
 class CCThreadProxyContextRecreationTimer;
 
@@ -76,6 +77,7 @@ public:
     // CCLayerTreeHostImplClient implementation
     virtual void didLoseContextOnImplThread() OVERRIDE;
     virtual void onSwapBuffersCompleteOnImplThread() OVERRIDE;
+    virtual void onVSyncParametersChanged(double monotonicTimebase, double intervalInSeconds) OVERRIDE;
     virtual void setNeedsRedrawOnImplThread() OVERRIDE;
     virtual void setNeedsCommitOnImplThread() OVERRIDE;
     virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) OVERRIDE;
@@ -99,13 +101,11 @@ private:
     struct BeginFrameAndCommitState {
         BeginFrameAndCommitState()
             : monotonicFrameBeginTime(0)
-            , updater(0)
         {
         }
 
         double monotonicFrameBeginTime;
         OwnPtr<CCScrollAndScaleSet> scrollInfo;
-        CCTextureUpdater* updater;
         bool contentsTexturesWereDeleted;
         size_t memoryAllocationLimitBytes;
     };
@@ -127,7 +127,7 @@ private:
         IntRect rect;
     };
     void forceBeginFrameOnImplThread(CCCompletionEvent*);
-    void beginFrameCompleteOnImplThread(CCCompletionEvent*);
+    void beginFrameCompleteOnImplThread(CCCompletionEvent*, PassOwnPtr<CCTextureUpdateQueue>);
     void beginFrameAbortedOnImplThread();
     void requestReadbackOnImplThread(ReadbackRequest*);
     void requestStartPageScaleAnimationOnImplThread(IntSize targetPosition, bool useAnchor, float scale, double durationSec);
@@ -183,10 +183,12 @@ private:
     // Set when the main thread is waiting on layers to be drawn.
     CCCompletionEvent* m_textureAcquisitionCompletionEventOnImplThread;
 
-    OwnPtr<CCTextureUpdater> m_currentTextureUpdaterOnImplThread;
+    OwnPtr<CCTextureUpdateController> m_currentTextureUpdateControllerOnImplThread;
 
     // Set when the next draw should post didCommitAndDrawFrame to the main thread.
     bool m_nextFrameIsNewlyCommittedFrameOnImplThread;
+
+    bool m_renderVSyncEnabled;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadTask.h b/Source/WebCore/platform/graphics/chromium/cc/CCThreadTask.h
index 62f7e7680..c93159428 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadTask.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadTask.h
@@ -24,8 +24,6 @@
 #ifndef CCThreadTask_h
 #define CCThreadTask_h
 
-#include "CrossThreadCopier.h"
-#include "CrossThreadTask.h"
 #include "cc/CCThread.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -64,15 +62,14 @@ class CCThreadTask1 : public CCThread::Task {
 public:
     typedef void (T::*Method)(MP1);
     typedef CCThreadTask1<T, P1, MP1> CCThreadTaskImpl;
-    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
 
-    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, Param1 parameter1)
+    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, P1 parameter1)
     {
         return adoptPtr(new CCThreadTaskImpl(instance, method, parameter1));
     }
 
 private:
-    CCThreadTask1(T* instance, Method method, Param1 parameter1)
+    CCThreadTask1(T* instance, Method method, P1 parameter1)
         : CCThread::Task(instance)
         , m_method(method)
         , m_parameter1(parameter1)
@@ -94,16 +91,14 @@ class CCThreadTask2 : public CCThread::Task {
 public:
     typedef void (T::*Method)(MP1, MP2);
     typedef CCThreadTask2<T, P1, MP1, P2, MP2> CCThreadTaskImpl;
-    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
-    typedef typename CrossThreadTaskTraits<P2>::ParamType Param2;
 
-    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, Param1 parameter1, Param2 parameter2)
+    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, P1 parameter1, P2 parameter2)
     {
         return adoptPtr(new CCThreadTaskImpl(instance, method, parameter1, parameter2));
     }
 
 private:
-    CCThreadTask2(T* instance, Method method, Param1 parameter1, Param2 parameter2)
+    CCThreadTask2(T* instance, Method method, P1 parameter1, P2 parameter2)
         : CCThread::Task(instance)
         , m_method(method)
         , m_parameter1(parameter1)
@@ -127,17 +122,14 @@ class CCThreadTask3 : public CCThread::Task {
 public:
     typedef void (T::*Method)(MP1, MP2, MP3);
     typedef CCThreadTask3<T, P1, MP1, P2, MP2, P3, MP3> CCThreadTaskImpl;
-    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
-    typedef typename CrossThreadTaskTraits<P2>::ParamType Param2;
-    typedef typename CrossThreadTaskTraits<P3>::ParamType Param3;
 
-    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
+    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, P1 parameter1, P2 parameter2, P3 parameter3)
     {
         return adoptPtr(new CCThreadTaskImpl(instance, method, parameter1, parameter2, parameter3));
     }
 
 private:
-    CCThreadTask3(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
+    CCThreadTask3(T* instance, Method method, P1 parameter1, P2 parameter2, P3 parameter3)
         : CCThread::Task(instance)
         , m_method(method)
         , m_parameter1(parameter1)
@@ -164,18 +156,14 @@ class CCThreadTask4 : public CCThread::Task {
 public:
     typedef void (T::*Method)(MP1, MP2, MP3, MP4);
     typedef CCThreadTask4<T, P1, MP1, P2, MP2, P3, MP3, P4, MP4> CCThreadTaskImpl;
-    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
-    typedef typename CrossThreadTaskTraits<P2>::ParamType Param2;
-    typedef typename CrossThreadTaskTraits<P3>::ParamType Param3;
-    typedef typename CrossThreadTaskTraits<P4>::ParamType Param4;
 
-    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
+    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, P1 parameter1, P2 parameter2, P3 parameter3, P4 parameter4)
     {
         return adoptPtr(new CCThreadTaskImpl(instance, method, parameter1, parameter2, parameter3, parameter4));
     }
 
 private:
-    CCThreadTask4(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
+    CCThreadTask4(T* instance, Method method, P1 parameter1, P2 parameter2, P3 parameter3, P4 parameter4)
         : CCThread::Task(instance)
         , m_method(method)
         , m_parameter1(parameter1)
@@ -203,19 +191,14 @@ class CCThreadTask5 : public CCThread::Task {
 public:
     typedef void (T::*Method)(MP1, MP2, MP3, MP4, MP5);
     typedef CCThreadTask5<T, P1, MP1, P2, MP2, P3, MP3, P4, MP4, P5, MP5> CCThreadTaskImpl;
-    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
-    typedef typename CrossThreadTaskTraits<P2>::ParamType Param2;
-    typedef typename CrossThreadTaskTraits<P3>::ParamType Param3;
-    typedef typename CrossThreadTaskTraits<P4>::ParamType Param4;
-    typedef typename CrossThreadTaskTraits<P5>::ParamType Param5;
 
-    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5)
+    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, P1 parameter1, P2 parameter2, P3 parameter3, P4 parameter4, P5 parameter5)
     {
         return adoptPtr(new CCThreadTaskImpl(instance, method, parameter1, parameter2, parameter3, parameter4, parameter5));
     }
 
 private:
-    CCThreadTask5(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5)
+    CCThreadTask5(T* instance, Method method, P1 parameter1, P2 parameter2, P3 parameter3, P4 parameter4, P5 parameter5)
         : CCThread::Task(instance)
         , m_method(method)
         , m_parameter1(parameter1)
@@ -261,10 +244,10 @@ PassOwnPtr<CCThread::Task> createCCThreadTask(
     void (T::*method)(MP1),
     const P1& parameter1)
 {
-    return CCThreadTask1<T, typename CrossThreadCopier<P1>::Type, MP1>::create(
+    return CCThreadTask1<T, P1, MP1>::create(
         callee,
         method,
-        CrossThreadCopier<P1>::copy(parameter1));
+        parameter1);
 }
 
 template<typename T, typename P1, typename MP1, typename P2, typename MP2>
@@ -274,11 +257,11 @@ PassOwnPtr<CCThread::Task> createCCThreadTask(
     const P1& parameter1,
     const P2& parameter2)
 {
-    return CCThreadTask2<T, typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2>::create(
+    return CCThreadTask2<T, P1, MP1, P2, MP2>::create(
         callee,
         method,
-        CrossThreadCopier<P1>::copy(parameter1),
-        CrossThreadCopier<P2>::copy(parameter2));
+        parameter1,
+        parameter2);
 }
 
 template<typename T, typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3>
@@ -289,12 +272,12 @@ PassOwnPtr<CCThread::Task> createCCThreadTask(
     const P2& parameter2,
     const P3& parameter3)
 {
-    return CCThreadTask3<T, typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2, typename CrossThreadCopier<P3>::Type, MP3>::create(
+    return CCThreadTask3<T, P1, MP1, P2, MP2, P3, MP3>::create(
         callee,
         method,
-        CrossThreadCopier<P1>::copy(parameter1),
-        CrossThreadCopier<P2>::copy(parameter2),
-        CrossThreadCopier<P3>::copy(parameter3));
+        parameter1,
+        parameter2,
+        parameter3);
 }
 
 template<typename T, typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4>
@@ -306,13 +289,13 @@ PassOwnPtr<CCThread::Task> createCCThreadTask(
     const P3& parameter3,
     const P4& parameter4)
 {
-    return CCThreadTask4<T, typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2, typename CrossThreadCopier<P3>::Type, MP3, typename CrossThreadCopier<P4>::Type, MP4>::create(
+    return CCThreadTask4<T, P1, MP1, P2, MP2, P3, MP3, P4, MP4>::create(
         callee,
         method,
-        CrossThreadCopier<P1>::copy(parameter1),
-        CrossThreadCopier<P2>::copy(parameter2),
-        CrossThreadCopier<P3>::copy(parameter3),
-        CrossThreadCopier<P4>::copy(parameter4));
+        parameter1,
+        parameter2,
+        parameter3,
+        parameter4);
 
 }
 
@@ -326,14 +309,14 @@ PassOwnPtr<CCThread::Task> createCCThreadTask(
     const P4& parameter4,
     const P5& parameter5)
 {
-    return CCThreadTask5<T, typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2, typename CrossThreadCopier<P3>::Type, MP3, typename CrossThreadCopier<P4>::Type, MP4, typename CrossThreadCopier<P5>::Type, MP5>::create(
+    return CCThreadTask5<T, P1, MP1, P2, MP2, P3, MP3, P4, MP4, P5, MP5>::create(
         callee,
         method,
-        CrossThreadCopier<P1>::copy(parameter1),
-        CrossThreadCopier<P2>::copy(parameter2),
-        CrossThreadCopier<P3>::copy(parameter3),
-        CrossThreadCopier<P4>::copy(parameter4),
-        CrossThreadCopier<P5>::copy(parameter5));
+        parameter1,
+        parameter2,
+        parameter3,
+        parameter4,
+        parameter5);
 
 }
 
diff --git a/Source/WebCore/platform/chromium/support/WebCompositorTileQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTileDrawQuad.cpp
index de0e81dfc..a5d317879 100644
--- a/Source/WebCore/platform/chromium/support/WebCompositorTileQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTileDrawQuad.cpp
@@ -25,19 +25,17 @@
 
 #include "config.h"
 
-#include <public/WebCompositorTileQuad.h>
+#include "cc/CCTileDrawQuad.h"
 
-using namespace WebCore;
+namespace WebCore {
 
-namespace WebKit {
-
-PassOwnPtr<WebCompositorTileQuad> WebCompositorTileQuad::create(const WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, const IntRect& opaqueRect, unsigned resourceId, const IntPoint& textureOffset, const IntSize& textureSize, GC3Dint textureFilter, bool swizzleContents, bool leftEdgeAA, bool topEdgeAA, bool rightEdgeAA, bool bottomEdgeAA)
+PassOwnPtr<CCTileDrawQuad> CCTileDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const IntRect& opaqueRect, unsigned resourceId, const IntPoint& textureOffset, const IntSize& textureSize, GC3Dint textureFilter, bool swizzleContents, bool leftEdgeAA, bool topEdgeAA, bool rightEdgeAA, bool bottomEdgeAA)
 {
-    return adoptPtr(new WebCompositorTileQuad(sharedQuadState, quadRect, opaqueRect, resourceId, textureOffset, textureSize, textureFilter, swizzleContents, leftEdgeAA, topEdgeAA, rightEdgeAA, bottomEdgeAA));
+    return adoptPtr(new CCTileDrawQuad(sharedQuadState, quadRect, opaqueRect, resourceId, textureOffset, textureSize, textureFilter, swizzleContents, leftEdgeAA, topEdgeAA, rightEdgeAA, bottomEdgeAA));
 }
 
-WebCompositorTileQuad::WebCompositorTileQuad(const WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, const IntRect& opaqueRect, unsigned resourceId, const IntPoint& textureOffset, const IntSize& textureSize, GC3Dint textureFilter, bool swizzleContents, bool leftEdgeAA, bool topEdgeAA, bool rightEdgeAA, bool bottomEdgeAA)
-    : WebCompositorQuad(sharedQuadState, WebCompositorQuad::TiledContent, quadRect)
+CCTileDrawQuad::CCTileDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const IntRect& opaqueRect, unsigned resourceId, const IntPoint& textureOffset, const IntSize& textureSize, GC3Dint textureFilter, bool swizzleContents, bool leftEdgeAA, bool topEdgeAA, bool rightEdgeAA, bool bottomEdgeAA)
+    : CCDrawQuad(sharedQuadState, CCDrawQuad::TiledContent, quadRect)
     , m_resourceId(resourceId)
     , m_textureOffset(textureOffset)
     , m_textureSize(textureSize)
@@ -53,10 +51,10 @@ WebCompositorTileQuad::WebCompositorTileQuad(const WebCompositorSharedQuadState*
     m_opaqueRect = opaqueRect;
 }
 
-const WebCompositorTileQuad* WebCompositorTileQuad::materialCast(const WebCompositorQuad* quad)
+const CCTileDrawQuad* CCTileDrawQuad::materialCast(const CCDrawQuad* quad)
 {
-    ASSERT(quad->material() == WebCompositorQuad::TiledContent);
-    return static_cast<const WebCompositorTileQuad*>(quad);
+    ASSERT(quad->material() == CCDrawQuad::TiledContent);
+    return static_cast<const CCTileDrawQuad*>(quad);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTileDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCTileDrawQuad.h
index d530f4a48..7943bc9f0 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTileDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTileDrawQuad.h
@@ -26,10 +26,50 @@
 #ifndef CCTileDrawQuad_h
 #define CCTileDrawQuad_h
 
-#include <public/WebCompositorTileQuad.h>
+#include "GraphicsTypes3D.h"
+#include "IntPoint.h"
+#include "IntSize.h"
+#include "cc/CCDrawQuad.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
-typedef WebKit::WebCompositorTileQuad CCTileDrawQuad;
+
+#pragma pack(push, 4)
+
+class CCTileDrawQuad : public CCDrawQuad {
+public:
+    static PassOwnPtr<CCTileDrawQuad> create(const CCSharedQuadState*, const IntRect& quadRect, const IntRect& opaqueRect, unsigned resourceId, const IntPoint& textureOffset, const IntSize& textureSize, GC3Dint textureFilter, bool swizzleContents, bool leftEdgeAA, bool topEdgeAA, bool rightEdgeAA, bool bottomEdgeAA);
+
+    unsigned resourceId() const { return m_resourceId; }
+    IntPoint textureOffset() const { return m_textureOffset; }
+    IntSize textureSize() const { return m_textureSize; }
+    GC3Dint textureFilter() const { return m_textureFilter; }
+    bool swizzleContents() const { return m_swizzleContents; }
+
+    bool leftEdgeAA() const { return m_leftEdgeAA; }
+    bool topEdgeAA() const { return m_topEdgeAA; }
+    bool rightEdgeAA() const { return m_rightEdgeAA; }
+    bool bottomEdgeAA() const { return m_bottomEdgeAA; }
+
+    bool isAntialiased() const { return leftEdgeAA() || topEdgeAA() || rightEdgeAA() || bottomEdgeAA(); }
+
+    static const CCTileDrawQuad* materialCast(const CCDrawQuad*);
+private:
+     CCTileDrawQuad(const CCSharedQuadState*, const IntRect& quadRect, const IntRect& opaqueRect, unsigned resourceId, const IntPoint& textureOffset, const IntSize& textureSize, GC3Dint textureFilter, bool swizzleContents, bool leftEdgeAA, bool topEdgeAA, bool rightEdgeAA, bool bottomEdgeAA);
+
+    unsigned m_resourceId;
+    IntPoint m_textureOffset;
+    IntSize m_textureSize;
+    GC3Dint m_textureFilter;
+    bool m_swizzleContents;
+    bool m_leftEdgeAA;
+    bool m_topEdgeAA;
+    bool m_rightEdgeAA;
+    bool m_bottomEdgeAA;
+};
+
+#pragma pack(pop)
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
index ee4965187..74eb2dc23 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
@@ -35,6 +35,7 @@
 #include "cc/CCCheckerboardDrawQuad.h"
 #include "cc/CCDebugBorderDrawQuad.h"
 #include "cc/CCLayerTilingData.h"
+#include "cc/CCMathUtil.h"
 #include "cc/CCQuadSink.h"
 #include "cc/CCSolidColorDrawQuad.h"
 #include "cc/CCTileDrawQuad.h"
@@ -182,7 +183,10 @@ void CCTiledLayerImpl::appendQuads(CCQuadSink& quadList, const CCSharedQuadState
             float tileHeight = static_cast<float>(m_tiler->tileSize().height());
             IntSize textureSize(tileWidth, tileHeight);
 
-            bool useAA = m_tiler->hasBorderTexels() && !sharedQuadState->isLayerAxisAlignedIntRect();
+            bool clipped = false;
+            FloatQuad visibleContentInTargetQuad = CCMathUtil::mapQuad(drawTransform(), FloatQuad(visibleContentRect()), clipped);
+            bool isAxisAlignedInTarget = !clipped && visibleContentInTargetQuad.isRectilinear();
+            bool useAA = m_tiler->hasBorderTexels() && !isAxisAlignedInTarget;
 
             bool leftEdgeAA = !i && useAA;
             bool topEdgeAA = !j && useAA;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTimeSource.h b/Source/WebCore/platform/graphics/chromium/cc/CCTimeSource.h
index dccb470a6..c6309d210 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTimeSource.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTimeSource.h
@@ -50,6 +50,9 @@ public:
     virtual void setClient(CCTimeSourceClient*) = 0;
     virtual void setActive(bool) = 0;
     virtual bool active() const = 0;
+    virtual void setTimebaseAndInterval(double timebase, double intervalSeconds) = 0;
+    virtual double lastTickTime() = 0;
+    virtual double nextTickTime() = 0;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp
index 43f2e2f6f..27a66f374 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp
@@ -27,26 +27,24 @@
 
 #include "cc/CCYUVVideoDrawQuad.h"
 
-using WebKit::WebCompositorQuad;
-
 namespace WebCore {
 
-PassOwnPtr<CCYUVVideoDrawQuad> CCYUVVideoDrawQuad::create(const WebKit::WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, const CCVideoLayerImpl::FramePlane& yPlane, const CCVideoLayerImpl::FramePlane& uPlane, const CCVideoLayerImpl::FramePlane& vPlane)
+PassOwnPtr<CCYUVVideoDrawQuad> CCYUVVideoDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const CCVideoLayerImpl::FramePlane& yPlane, const CCVideoLayerImpl::FramePlane& uPlane, const CCVideoLayerImpl::FramePlane& vPlane)
 {
     return adoptPtr(new CCYUVVideoDrawQuad(sharedQuadState, quadRect, yPlane, uPlane, vPlane));
 }
 
-CCYUVVideoDrawQuad::CCYUVVideoDrawQuad(const WebKit::WebCompositorSharedQuadState* sharedQuadState, const IntRect& quadRect, const CCVideoLayerImpl::FramePlane& yPlane, const CCVideoLayerImpl::FramePlane& uPlane, const CCVideoLayerImpl::FramePlane& vPlane)
-    : WebCompositorQuad(sharedQuadState, WebCompositorQuad::YUVVideoContent, quadRect)
+CCYUVVideoDrawQuad::CCYUVVideoDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const CCVideoLayerImpl::FramePlane& yPlane, const CCVideoLayerImpl::FramePlane& uPlane, const CCVideoLayerImpl::FramePlane& vPlane)
+    : CCDrawQuad(sharedQuadState, CCDrawQuad::YUVVideoContent, quadRect)
     , m_yPlane(yPlane)
     , m_uPlane(uPlane)
     , m_vPlane(vPlane)
 {
 }
 
-const CCYUVVideoDrawQuad* CCYUVVideoDrawQuad::materialCast(const WebKit::WebCompositorQuad* quad)
+const CCYUVVideoDrawQuad* CCYUVVideoDrawQuad::materialCast(const CCDrawQuad* quad)
 {
-    ASSERT(quad->material() == WebCompositorQuad::YUVVideoContent);
+    ASSERT(quad->material() == CCDrawQuad::YUVVideoContent);
     return static_cast<const CCYUVVideoDrawQuad*>(quad);
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h
index 6684ad897..456a96f48 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h
@@ -26,24 +26,24 @@
 #ifndef CCYUVVideoDrawQuad_h
 #define CCYUVVideoDrawQuad_h
 
+#include "cc/CCDrawQuad.h"
 #include "cc/CCVideoLayerImpl.h"
-#include <public/WebCompositorQuad.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-class CCYUVVideoDrawQuad : public WebKit::WebCompositorQuad {
+class CCYUVVideoDrawQuad : public CCDrawQuad {
     WTF_MAKE_NONCOPYABLE(CCYUVVideoDrawQuad);
 public:
-    static PassOwnPtr<CCYUVVideoDrawQuad> create(const WebKit::WebCompositorSharedQuadState*, const IntRect&, const CCVideoLayerImpl::FramePlane& yPlane, const CCVideoLayerImpl::FramePlane& uPlane, const CCVideoLayerImpl::FramePlane& vPlane);
+    static PassOwnPtr<CCYUVVideoDrawQuad> create(const CCSharedQuadState*, const IntRect&, const CCVideoLayerImpl::FramePlane& yPlane, const CCVideoLayerImpl::FramePlane& uPlane, const CCVideoLayerImpl::FramePlane& vPlane);
 
     const CCVideoLayerImpl::FramePlane& yPlane() const { return m_yPlane; }
     const CCVideoLayerImpl::FramePlane& uPlane() const { return m_uPlane; }
     const CCVideoLayerImpl::FramePlane& vPlane() const { return m_vPlane; }
 
-    static const CCYUVVideoDrawQuad* materialCast(const WebKit::WebCompositorQuad*);
+    static const CCYUVVideoDrawQuad* materialCast(const CCDrawQuad*);
 private:
-    CCYUVVideoDrawQuad(const WebKit::WebCompositorSharedQuadState*, const IntRect&, const CCVideoLayerImpl::FramePlane& yPlane, const CCVideoLayerImpl::FramePlane& uPlane, const CCVideoLayerImpl::FramePlane& vPlane);
+    CCYUVVideoDrawQuad(const CCSharedQuadState*, const IntRect&, const CCVideoLayerImpl::FramePlane& yPlane, const CCVideoLayerImpl::FramePlane& uPlane, const CCVideoLayerImpl::FramePlane& vPlane);
 
     CCVideoLayerImpl::FramePlane m_yPlane;
     CCVideoLayerImpl::FramePlane m_uPlane;
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
index 9ab5e570d..1eabd7ecd 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
@@ -32,6 +32,8 @@
 #if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 #include "CustomFilterCompiledProgram.h"
  
+#include "CustomFilterGlobalContext.h"
+#include "CustomFilterProgramInfo.h"
 #include "GraphicsContext3D.h"
 
 namespace WebCore {
@@ -69,10 +71,10 @@ String CustomFilterCompiledProgram::defaultFragmentShaderString()
     return fragmentShaderString;
 }
 
-CustomFilterCompiledProgram::CustomFilterCompiledProgram(GraphicsContext3D* context, const String& vertexShaderString, const String& fragmentShaderString)
-    : m_context(context)
-    , m_vertexShaderString(!vertexShaderString.isNull() ? vertexShaderString : defaultVertexShaderString())
-    , m_fragmentShaderString(!fragmentShaderString.isNull() ? fragmentShaderString : defaultFragmentShaderString())
+CustomFilterCompiledProgram::CustomFilterCompiledProgram(CustomFilterGlobalContext* globalContext, const CustomFilterProgramInfo& programInfo)
+    : m_globalContext(globalContext)
+    , m_context(globalContext->context())
+    , m_programInfo(programInfo)
     , m_program(0)
     , m_positionAttribLocation(-1)
     , m_texAttribLocation(-1)
@@ -89,11 +91,11 @@ CustomFilterCompiledProgram::CustomFilterCompiledProgram(GraphicsContext3D* cont
 {
     m_context->makeContextCurrent();
     
-    Platform3DObject vertexShader = compileShader(GraphicsContext3D::VERTEX_SHADER, m_vertexShaderString);
+    Platform3DObject vertexShader = compileShader(GraphicsContext3D::VERTEX_SHADER, programInfo.vertexShaderString());
     if (!vertexShader)
         return;
     
-    Platform3DObject fragmentShader = compileShader(GraphicsContext3D::FRAGMENT_SHADER, m_fragmentShaderString);
+    Platform3DObject fragmentShader = compileShader(GraphicsContext3D::FRAGMENT_SHADER, programInfo.fragmentShaderString());
     if (!fragmentShader) {
         m_context->deleteShader(vertexShader);
         return;
@@ -112,10 +114,26 @@ CustomFilterCompiledProgram::CustomFilterCompiledProgram(GraphicsContext3D* cont
     m_isInitialized = true;
 }
 
+String CustomFilterCompiledProgram::getDefaultShaderString(GC3Denum shaderType)
+{
+    switch (shaderType) {
+    case GraphicsContext3D::VERTEX_SHADER:
+        return defaultVertexShaderString();
+    case GraphicsContext3D::FRAGMENT_SHADER:
+        return defaultFragmentShaderString();
+    default:
+        ASSERT_NOT_REACHED();
+        return String();
+    }
+}
+
 Platform3DObject CustomFilterCompiledProgram::compileShader(GC3Denum shaderType, const String& shaderString)
 {
     Platform3DObject shader = m_context->createShader(shaderType);
-    m_context->shaderSource(shader, shaderString);
+    if (shaderString.isNull())
+        m_context->shaderSource(shader, getDefaultShaderString(shaderType));
+    else
+        m_context->shaderSource(shader, shaderString);
     m_context->compileShader(shader);
     
     int compiled = 0;
@@ -173,6 +191,8 @@ int CustomFilterCompiledProgram::uniformLocationByName(const String& name)
     
 CustomFilterCompiledProgram::~CustomFilterCompiledProgram()
 {
+    if (m_globalContext)
+        m_globalContext->removeCompiledProgram(this);
     if (m_program) {
         m_context->makeContextCurrent();
         m_context->deleteProgram(m_program);
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
index 6057efe24..44f377782 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
@@ -32,25 +32,31 @@
 
 #if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 
+#include "CustomFilterProgramInfo.h"
 #include "GraphicsTypes3D.h"
 #include <wtf/RefCounted.h>
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
+class CustomFilterGlobalContext;
 class GraphicsContext3D;
 
+// A specific combination of vertex / fragment shader is only going to be compiled once. The CustomFilterGlobalContext is 
+// caching the compiled programs. CustomFilterGlobalContext has a weak reference to the CustomFilterCompiledProgram, so the 
+// CustomFilterCompiledProgram destructor needs to notify the CustomFilterGlobalContext to remove the program from the cache.
+// FECustomFilter is the reference owner of the CustomFilterCompiledProgram, so a compiled shader is only kept alive as 
+// long as there is at least one visible layer that applies the shader.
 class CustomFilterCompiledProgram: public RefCounted<CustomFilterCompiledProgram> {
 public:
-    static PassRefPtr<CustomFilterCompiledProgram> create(GraphicsContext3D* context, const String& vertexShader, const String& fragmentShader)
+    static PassRefPtr<CustomFilterCompiledProgram> create(CustomFilterGlobalContext* globalContext, const CustomFilterProgramInfo& programInfo)
     {
-        return adoptRef(new CustomFilterCompiledProgram(context, vertexShader, fragmentShader));
+        return adoptRef(new CustomFilterCompiledProgram(globalContext, programInfo));
     }
     
     ~CustomFilterCompiledProgram();
-    
-    String vertexShaderString() const { return m_vertexShaderString; }
-    String fragmentShaderString() const { return m_fragmentShaderString; }
+
+    const CustomFilterProgramInfo& programInfo() const { return m_programInfo; }
     
     int positionAttribLocation() const { return m_positionAttribLocation; }
     int texAttribLocation() const { return m_texAttribLocation; }
@@ -70,8 +76,13 @@ public:
     
     Platform3DObject program() const { return m_program; }
 
+    // 'detachGlobalContext' is called when the CustomFilterGlobalContext is deleted
+    // and there's no need for the callback anymore. 
+    // Note that CustomFilterGlobalContext doesn't not keep a strong reference to 
+    // the CustomFilterCompiledProgram.
+    void detachFromGlobalContext() { m_globalContext = 0; }
 private:
-    CustomFilterCompiledProgram(GraphicsContext3D*, const String& vertexShader, const String& fragmentShader);
+    CustomFilterCompiledProgram(CustomFilterGlobalContext*, const CustomFilterProgramInfo&);
     
     Platform3DObject compileShader(GC3Denum shaderType, const String& shaderString);
     Platform3DObject linkProgram(Platform3DObject vertexShader, Platform3DObject fragmentShader);
@@ -79,12 +90,11 @@ private:
     
     static String defaultVertexShaderString();
     static String defaultFragmentShaderString();
+    String getDefaultShaderString(GC3Denum shaderType);
     
+    CustomFilterGlobalContext* m_globalContext;
     RefPtr<GraphicsContext3D> m_context;
-    
-    String m_vertexShaderString;
-    String m_fragmentShaderString;
-
+    CustomFilterProgramInfo m_programInfo;
     Platform3DObject m_program;
     
     int m_positionAttribLocation;
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.cpp
index 455ae40c9..382c278ea 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.cpp
@@ -32,6 +32,7 @@
 #if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 #include "CustomFilterGlobalContext.h"
 
+#include "CustomFilterCompiledProgram.h"
 #include "GraphicsContext3D.h"
 
 namespace WebCore {
@@ -42,6 +43,8 @@ CustomFilterGlobalContext::CustomFilterGlobalContext()
 
 CustomFilterGlobalContext::~CustomFilterGlobalContext()
 {
+    for (CustomFilterCompiledProgramsMap::iterator iter = m_programs.begin(); iter != m_programs.end(); ++iter)
+        iter->second->detachFromGlobalContext();
 }
 
 void CustomFilterGlobalContext::prepareContextIfNeeded(HostWindow* hostWindow)
@@ -59,6 +62,33 @@ void CustomFilterGlobalContext::prepareContextIfNeeded(HostWindow* hostWindow)
     m_context->enable(GraphicsContext3D::DEPTH_TEST);
 }
 
+PassRefPtr<CustomFilterCompiledProgram> CustomFilterGlobalContext::getCompiledProgram(const CustomFilterProgramInfo& programInfo)
+{
+    // Check that the context is already prepared.
+    ASSERT(m_context);
+
+    CustomFilterCompiledProgramsMap::iterator iter = m_programs.find(programInfo);
+    if (iter != m_programs.end())
+        return iter->second;
+
+    RefPtr<CustomFilterCompiledProgram> compiledProgram = CustomFilterCompiledProgram::create(this, programInfo);
+    m_programs.set(programInfo, compiledProgram.get());
+    return compiledProgram.release();
+}
+
+void CustomFilterGlobalContext::removeCompiledProgram(const CustomFilterCompiledProgram* program)
+{
+    CustomFilterCompiledProgramsMap::iterator iter = m_programs.find(program->programInfo());
+    ASSERT(iter != m_programs.end());
+    m_programs.remove(iter);
+
+#ifndef NDEBUG
+    // Check that there's no way we could have the same program under a different key.
+    for (iter = m_programs.begin(); iter != m_programs.end(); ++iter)
+        ASSERT(iter->second != program);
+#endif
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.h b/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.h
index aba003581..8dc85f212 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.h
@@ -31,13 +31,18 @@
 #define CustomFilterGlobalContext_h
 
 #if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
+#include "CustomFilterProgramInfo.h"
+#include <wtf/HashMap.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
+class CustomFilterCompiledProgram;
 class HostWindow;
 class GraphicsContext3D;
 
+typedef HashMap<CustomFilterProgramInfo, CustomFilterCompiledProgram*> CustomFilterCompiledProgramsMap;
+
 class CustomFilterGlobalContext {
 public:
     CustomFilterGlobalContext();
@@ -47,8 +52,11 @@ public:
     
     void prepareContextIfNeeded(HostWindow*);
 
+    PassRefPtr<CustomFilterCompiledProgram> getCompiledProgram(const CustomFilterProgramInfo&);
+    void removeCompiledProgram(const CustomFilterCompiledProgram*);
 private:
     RefPtr<GraphicsContext3D> m_context;
+    CustomFilterCompiledProgramsMap m_programs;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
index 63507f561..b4e8b2936 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
@@ -65,13 +65,6 @@ public:
         return adoptRef(new CustomFilterOperation(program, sortedParameters, meshRows, meshColumns, meshBoxType, meshType));
     }
     
-    virtual PassRefPtr<FilterOperation> clone() const
-    {
-        // Some member vars (e.g., m_program) are not thread-safe, so
-        // we can't be cloned.
-        return 0;
-    }
-    
     CustomFilterProgram* program() const { return m_program.get(); }
     
     const CustomFilterParameterList& parameters() { return m_parameters; }
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
index 60cff22e7..d1cf6134f 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
@@ -34,14 +34,12 @@
 
 #include "CustomFilterCompiledProgram.h"
 #include "CustomFilterProgramClient.h"
-
-#if USE(3D_GRAPHICS)
-#include "GraphicsContext3D.h"
-#endif
+#include "CustomFilterProgramInfo.h"
 
 namespace WebCore {
 
-CustomFilterProgram::CustomFilterProgram()
+CustomFilterProgram::CustomFilterProgram(CustomFilterProgramMixSettings mixSettings)
+    : m_mixSettings(mixSettings)
 {
     // Keep the constructor protected to prevent creating this object directly.
 }
@@ -80,13 +78,11 @@ void CustomFilterProgram::notifyClients()
         iter->first->notifyCustomFilterProgramLoaded(this);
 }
 
-#if USE(3D_GRAPHICS)
-PassRefPtr<CustomFilterCompiledProgram> CustomFilterProgram::compileProgramWithContext(GraphicsContext3D* context)
+CustomFilterProgramInfo CustomFilterProgram::programInfo() const
 {
     ASSERT(isLoaded());
-    return CustomFilterCompiledProgram::create(context, vertexShaderString(), fragmentShaderString());
+    return CustomFilterProgramInfo(vertexShaderString(), fragmentShaderString(), m_mixSettings);
 }
-#endif
 
 } // namespace WebCore
 #endif // ENABLE(CSS_SHADERS)
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
index 221606676..ef19dfb83 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
@@ -32,6 +32,8 @@
 
 #if ENABLE(CSS_SHADERS)
 
+#include "CustomFilterProgramInfo.h"
+
 #include <wtf/HashCountedSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/text/WTFString.h>
@@ -50,12 +52,12 @@ public:
 
     virtual bool isLoaded() const = 0;
     
+    CustomFilterProgramMixSettings mixSettings() const { return m_mixSettings; }
+
     void addClient(CustomFilterProgramClient*);
     void removeClient(CustomFilterProgramClient*);
     
-#if USE(3D_GRAPHICS)
-    PassRefPtr<CustomFilterCompiledProgram> compileProgramWithContext(GraphicsContext3D*);
-#endif
+    CustomFilterProgramInfo programInfo() const;
 
     // StyleCustomFilterProgram has the only implementation for the following method. That means, it casts to StyleCustomFilterProgram
     // withouth checking the type. If you add another implementation, also add a mechanism to check for the correct type.
@@ -73,11 +75,12 @@ protected:
     virtual void didRemoveLastClient() = 0;
 
     // Keep the constructor protected to prevent creating this object directly.
-    CustomFilterProgram();
+    CustomFilterProgram(CustomFilterProgramMixSettings);
 
 private:
     typedef HashCountedSet<CustomFilterProgramClient*> CustomFilterProgramClientList;
     CustomFilterProgramClientList m_clients;
+    CustomFilterProgramMixSettings m_mixSettings;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.cpp
new file mode 100644
index 000000000..1bf6a91f0
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(CSS_SHADERS)
+#include "CustomFilterProgramInfo.h"
+
+#include <wtf/HashFunctions.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+static unsigned hashPossiblyNullString(const String& string)
+{
+    return string.isNull() ? 0 : DefaultHash<String>::Hash::hash(string);
+}
+
+CustomFilterProgramInfo::CustomFilterProgramInfo()
+{
+}
+
+bool CustomFilterProgramInfo::isEmptyValue() const 
+{ 
+    return m_vertexShaderString.isNull() 
+        && m_fragmentShaderString.isNull();
+}
+
+CustomFilterProgramInfo::CustomFilterProgramInfo(WTF::HashTableDeletedValueType)
+    : m_vertexShaderString(WTF::HashTableDeletedValue)
+    , m_fragmentShaderString(WTF::HashTableDeletedValue)
+{
+}
+
+bool CustomFilterProgramInfo::isHashTableDeletedValue() const
+{
+    return m_vertexShaderString.isHashTableDeletedValue() 
+        && m_fragmentShaderString.isHashTableDeletedValue();
+}
+
+CustomFilterProgramInfo::CustomFilterProgramInfo(const String& vertexShader, const String& fragmentShader, const CustomFilterProgramMixSettings& mixSettings)
+    : m_vertexShaderString(vertexShader)
+    , m_fragmentShaderString(fragmentShader)
+    , m_mixSettings(mixSettings)
+{
+    // At least one of the shaders needs to be non-null.
+    ASSERT(!m_vertexShaderString.isNull() || !m_fragmentShaderString.isNull());
+}
+
+unsigned CustomFilterProgramInfo::hash() const
+{
+    // At least one of the shaders needs to be non-null.
+    ASSERT(!m_vertexShaderString.isNull() || !m_fragmentShaderString.isNull());
+    uintptr_t hashCodes[5] = {
+        hashPossiblyNullString(m_vertexShaderString),
+        hashPossiblyNullString(m_fragmentShaderString),
+        m_mixSettings.enabled,
+        m_mixSettings.enabled ? m_mixSettings.blendMode : 0,
+        m_mixSettings.enabled ? m_mixSettings.compositeOperator : 0
+    };
+    return StringHasher::hashMemory<sizeof(hashCodes)>(&hashCodes);
+}
+
+bool CustomFilterProgramInfo::operator==(const CustomFilterProgramInfo& o) const 
+{
+    ASSERT(!isHashTableDeletedValue());
+    ASSERT(!o.isHashTableDeletedValue());
+    return m_vertexShaderString == o.m_vertexShaderString
+        && m_fragmentShaderString == o.m_fragmentShaderString
+        && m_mixSettings == o.m_mixSettings;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(CSS_SHADERS)
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.h b/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.h
new file mode 100644
index 000000000..e1f4559ab
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef CustomFilterProgramInfo_h
+#define CustomFilterProgramInfo_h
+
+#if ENABLE(CSS_SHADERS)
+#include "GraphicsTypes.h"
+
+#include <wtf/HashTraits.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+struct CustomFilterProgramMixSettings {
+    CustomFilterProgramMixSettings()
+        : enabled(false)
+        , blendMode(BlendModeNormal)
+        , compositeOperator(CompositeSourceOver)
+    {
+    }
+    
+    bool operator==(const CustomFilterProgramMixSettings& o) const
+    {
+        return (!enabled && !o.enabled)
+            || (blendMode == o.blendMode && compositeOperator == o.compositeOperator);
+    }
+    
+    bool enabled;
+    BlendMode blendMode;
+    CompositeOperator compositeOperator;
+};
+
+// CustomFilterProgramInfo is the key used to link CustomFilterProgram with CustomFilterCompiledProgram.
+// It can be used as a key in a HashMap, with the note that at least one of Strings needs to be non-null. 
+// Null strings are placeholders for the default shader.
+class CustomFilterProgramInfo {
+public:
+    CustomFilterProgramInfo(const String&, const String&, const CustomFilterProgramMixSettings&);
+
+    CustomFilterProgramInfo();
+    bool isEmptyValue() const;
+
+    CustomFilterProgramInfo(WTF::HashTableDeletedValueType);
+    bool isHashTableDeletedValue() const;
+    
+    unsigned hash() const;
+    bool operator==(const CustomFilterProgramInfo&) const;
+
+    const String& vertexShaderString() const { return m_vertexShaderString; }
+    const String& fragmentShaderString() const { return m_fragmentShaderString; }
+private:
+    String m_vertexShaderString;
+    String m_fragmentShaderString;
+    CustomFilterProgramMixSettings m_mixSettings;
+};
+
+struct CustomFilterProgramInfoHash {
+    static unsigned hash(const CustomFilterProgramInfo& programInfo) { return programInfo.hash(); }
+    static bool equal(const CustomFilterProgramInfo& a, const CustomFilterProgramInfo& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = false;
+};
+
+struct CustomFilterProgramInfoHashTraits : WTF::SimpleClassHashTraits<CustomFilterProgramInfo> {
+    static const bool hasIsEmptyValueFunction = true;
+    static bool isEmptyValue(const CustomFilterProgramInfo& info) { return info.isEmptyValue(); }
+};
+
+} // namespace WebCore
+
+namespace WTF {
+
+template<> struct HashTraits<WebCore::CustomFilterProgramInfo> : WebCore::CustomFilterProgramInfoHashTraits { };
+template<> struct DefaultHash<WebCore::CustomFilterProgramInfo> { 
+    typedef WebCore::CustomFilterProgramInfoHash Hash; 
+};
+
+}
+#endif // ENABLE(CSS_SHADERS)
+
+#endif // CustomFilterProgramInfo_h
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
index 36d06d32b..39fa83163 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
@@ -41,6 +41,7 @@
 #include "DrawingBuffer.h"
 #include "GraphicsContext3D.h"
 #include "ImageData.h"
+#include "NotImplemented.h"
 #include "RenderTreeAsText.h"
 #include "TextStream.h"
 #include "Texture.h"
@@ -122,30 +123,51 @@ void FECustomFilter::deleteRenderBuffers()
 
 void FECustomFilter::platformApplySoftware()
 {
-    Uint8ClampedArray* dstPixelArray = createPremultipliedImageResult();
+    if (!applyShader())
+        clearShaderResult();
+}
+
+void FECustomFilter::clearShaderResult()
+{
+    clearResult();
+    Uint8ClampedArray* dstPixelArray = createUnmultipliedImageResult();
     if (!dstPixelArray)
         return;
 
     FilterEffect* in = inputEffect(0);
+    setIsAlphaImage(in->isAlphaImage());
+    IntRect effectDrawingRect = requestedRegionOfInputImageData(in->absolutePaintRect());
+    in->copyUnmultipliedImage(dstPixelArray, effectDrawingRect);
+}
+
+bool FECustomFilter::applyShader()
+{
+    Uint8ClampedArray* dstPixelArray = createUnmultipliedImageResult();
+    if (!dstPixelArray)
+        return false;
+
+    FilterEffect* in = inputEffect(0);
     IntRect effectDrawingRect = requestedRegionOfInputImageData(in->absolutePaintRect());
-    RefPtr<Uint8ClampedArray> srcPixelArray = in->asPremultipliedImage(effectDrawingRect);
+    RefPtr<Uint8ClampedArray> srcPixelArray = in->asUnmultipliedImage(effectDrawingRect);
     
     IntSize newContextSize(effectDrawingRect.size());
     bool hadContext = m_context;
     if (!m_context && !initializeContext())
-        return;
+        return false;
     m_context->makeContextCurrent();
     
     if (!hadContext || m_contextSize != newContextSize)
         resizeContext(newContextSize);
 
+#if !PLATFORM(BLACKBERRY) // BlackBerry defines its own Texture class.
     // Do not draw the filter if the input image cannot fit inside a single GPU texture.
     if (m_inputTexture->tiles().numTilesX() != 1 || m_inputTexture->tiles().numTilesY() != 1)
-        return;
+        return false;
+#endif
     
     // The shader had compiler errors. We cannot draw anything.
     if (!m_compiledProgram->isInitialized())
-        return;
+        return false;
 
     m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_frameBuffer);
     m_context->viewport(0, 0, newContextSize.width(), newContextSize.height());
@@ -159,6 +181,8 @@ void FECustomFilter::platformApplySoftware()
     
     ASSERT(static_cast<size_t>(newContextSize.width() * newContextSize.height() * 4) == dstPixelArray->length());
     m_context->readPixels(0, 0, newContextSize.width(), newContextSize.height(), GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, dstPixelArray->data());
+
+    return true;
 }
 
 bool FECustomFilter::initializeContext()
@@ -168,11 +192,7 @@ bool FECustomFilter::initializeContext()
     if (!m_context)
         return false;
     m_context->makeContextCurrent();
-    
-    // FIXME: The shader and the mesh can be shared across multiple elements when possible.
-    // Sharing the shader means it's no need to analyze / compile and upload to GPU again.
-    // https://bugs.webkit.org/show_bug.cgi?id=88427
-    m_compiledProgram = m_program->compileProgramWithContext(m_context.get());
+    m_compiledProgram = m_globalContext->getCompiledProgram(m_program->programInfo());
 
     // FIXME: Sharing the mesh would just save the time needed to upload it to the GPU, so I assume we could
     // benchmark that for performance.
@@ -185,7 +205,11 @@ bool FECustomFilter::initializeContext()
 
 void FECustomFilter::resizeContext(const IntSize& newContextSize)
 {
+#if !PLATFORM(BLACKBERRY) // BlackBerry defines its own Texture class
     m_inputTexture = Texture::create(m_context.get(), Texture::RGBA8, newContextSize.width(), newContextSize.height());
+#else
+    m_inputTexture = Texture::create(true);
+#endif
     
     if (!m_frameBuffer)
         m_frameBuffer = m_context->createFramebuffer();
@@ -269,8 +293,12 @@ void FECustomFilter::bindProgramAndBuffers(Uint8ClampedArray* srcPixelArray)
     if (m_compiledProgram->samplerLocation() != -1) {
         m_context->activeTexture(GraphicsContext3D::TEXTURE0);
         m_context->uniform1i(m_compiledProgram->samplerLocation(), 0);
+#if !PLATFORM(BLACKBERRY)
         m_inputTexture->load(srcPixelArray->data());
         m_inputTexture->bindTile(0);
+#else
+        notImplemented();
+#endif
     }
     
     if (m_compiledProgram->projectionMatrixLocation() != -1) {
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.h b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
index b7f93698e..a1bacde1f 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.h
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
@@ -72,6 +72,8 @@ private:
                    CustomFilterOperation::MeshType);
     ~FECustomFilter();
     
+    bool applyShader();
+    void clearShaderResult();
     bool initializeContext();
     void deleteRenderBuffers();
     void resizeContext(const IntSize& newContextSize);
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperation.h b/Source/WebCore/platform/graphics/filters/FilterOperation.h
index b8796e802..e72600c47 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperation.h
+++ b/Source/WebCore/platform/graphics/filters/FilterOperation.h
@@ -35,6 +35,10 @@
 #include <wtf/RefCounted.h>
 #include <wtf/text/WTFString.h>
 
+#if PLATFORM(BLACKBERRY)
+#include <wtf/ThreadSafeRefCounted.h>
+#endif
+
 // Annoyingly, wingdi.h #defines this.
 #ifdef PASSTHROUGH
 #undef PASSTHROUGH
@@ -44,7 +48,11 @@ namespace WebCore {
 
 // CSS Filters
 
+#if PLATFORM(BLACKBERRY)
+class FilterOperation : public ThreadSafeRefCounted<FilterOperation> {
+#else
 class FilterOperation : public RefCounted<FilterOperation> {
+#endif
 public:
     enum OperationType {
         REFERENCE, // url(#somefilter)
@@ -82,8 +90,6 @@ public:
     // True if the the value of one pixel can affect the value of another pixel under this operation, such as blur.
     virtual bool movesPixels() const { return false; }
 
-    virtual PassRefPtr<FilterOperation> clone() const = 0;
-
 protected:
     FilterOperation(OperationType type)
         : m_type(type)
@@ -100,11 +106,6 @@ public:
         return adoptRef(new DefaultFilterOperation(type));
     }
 
-    virtual PassRefPtr<FilterOperation> clone() const
-    {
-        return adoptRef(new DefaultFilterOperation(m_type));
-    }
-
 private:
 
     virtual bool operator==(const FilterOperation& o) const
@@ -127,11 +128,6 @@ public:
         return adoptRef(new PassthroughFilterOperation());
     }
 
-    virtual PassRefPtr<FilterOperation> clone() const
-    {
-        return adoptRef(new PassthroughFilterOperation());
-    }
-
 private:
 
     virtual bool operator==(const FilterOperation& o) const
@@ -152,12 +148,6 @@ public:
         return adoptRef(new ReferenceFilterOperation(url, fragment, type));
     }
 
-    virtual PassRefPtr<FilterOperation> clone() const
-    {
-        // Unimplemented
-        return 0;
-    }
-
     virtual bool affectsOpacity() const { return true; }
     virtual bool movesPixels() const { return true; }
 
@@ -199,11 +189,6 @@ public:
         return adoptRef(new BasicColorMatrixFilterOperation(amount, type));
     }
 
-    virtual PassRefPtr<FilterOperation> clone() const
-    {
-        return adoptRef(new BasicColorMatrixFilterOperation(m_amount, m_type));
-    }
-
     double amount() const { return m_amount; }
 
     virtual PassRefPtr<FilterOperation> blend(const FilterOperation* from, double progress, bool blendToPassthrough = false);
@@ -236,11 +221,6 @@ public:
         return adoptRef(new BasicComponentTransferFilterOperation(amount, type));
     }
 
-    virtual PassRefPtr<FilterOperation> clone() const
-    {
-        return adoptRef(new BasicComponentTransferFilterOperation(m_amount, m_type));
-    }
-
     double amount() const { return m_amount; }
 
     virtual bool affectsOpacity() const { return m_type == OPACITY; }
@@ -274,11 +254,6 @@ public:
         return adoptRef(new GammaFilterOperation(amplitude, exponent, offset, type));
     }
 
-    virtual PassRefPtr<FilterOperation> clone() const
-    {
-        return adoptRef(new GammaFilterOperation(m_amplitude, m_exponent, m_offset, m_type));
-    }
-
     double amplitude() const { return m_amplitude; }
     double exponent() const { return m_exponent; }
     double offset() const { return m_offset; }
@@ -314,11 +289,6 @@ public:
         return adoptRef(new BlurFilterOperation(stdDeviation, type));
     }
 
-    virtual PassRefPtr<FilterOperation> clone() const
-    {
-        return adoptRef(new BlurFilterOperation(m_stdDeviation, m_type));
-    }
-
     Length stdDeviation() const { return m_stdDeviation; }
 
     virtual bool affectsOpacity() const { return true; }
@@ -351,11 +321,6 @@ public:
         return adoptRef(new DropShadowFilterOperation(location, stdDeviation, color, type));
     }
 
-    virtual PassRefPtr<FilterOperation> clone() const
-    {
-        return adoptRef(new DropShadowFilterOperation(m_location, m_stdDeviation, m_color, m_type));
-    }
-
     int x() const { return m_location.x(); }
     int y() const { return m_location.y(); }
     IntPoint location() const { return m_location; }
diff --git a/Source/WebCore/platform/graphics/filters/arm/NEONHelpers.h b/Source/WebCore/platform/graphics/filters/arm/NEONHelpers.h
index 78a32418e..53cdc77b6 100644
--- a/Source/WebCore/platform/graphics/filters/arm/NEONHelpers.h
+++ b/Source/WebCore/platform/graphics/filters/arm/NEONHelpers.h
@@ -37,7 +37,8 @@ namespace WebCore {
 
 inline float32x4_t loadRGBA8AsFloat(uint32_t* source)
 {
-    uint32x2_t temporary1 = vset_lane_u32(*source, temporary1, 0);
+    uint32x2_t temporary1 = {0, 0};
+    temporary1 = vset_lane_u32(*source, temporary1, 0);
     uint16x4_t temporary2 = vget_low_u16(vmovl_u8(vreinterpret_u8_u32(temporary1)));
     return vcvtq_f32_u32(vmovl_u16(temporary2));
 }
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp
index a96213cc7..cb4336b6e 100644
--- a/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp
@@ -614,6 +614,9 @@ void LoopBlinnPathProcessor::buildContours(const Path& path)
 {
     // Clear out the contours
     m_contours.clear();
+    if (path.isNull())
+        return;
+
 #if USE(SKIA)
     SkPath::Iter iter(*path.platformPath(), false);
     SkPoint points[4];
diff --git a/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp
index 062e3fc97..37468bc5c 100644
--- a/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp
@@ -28,7 +28,7 @@ namespace WTF {
 
 template <> GRefPtr<GstElement> adoptGRef(GstElement* ptr)
 {
-    ASSERT(!ptr || !GST_OBJECT_IS_FLOATING(GST_OBJECT(ptr)));
+    ASSERT(!ptr || !gstObjectIsFloating(GST_OBJECT(ptr)));
     return GRefPtr<GstElement>(ptr, GRefPtrAdopt);
 }
 
@@ -48,7 +48,7 @@ template <> void derefGPtr<GstElement>(GstElement* ptr)
 
 template <> GRefPtr<GstPad> adoptGRef(GstPad* ptr)
 {
-    ASSERT(!ptr || !GST_OBJECT_IS_FLOATING(GST_OBJECT(ptr)));
+    ASSERT(!ptr || !gstObjectIsFloating(GST_OBJECT(ptr)));
     return GRefPtr<GstPad>(ptr, GRefPtrAdopt);
 }
 
@@ -68,7 +68,7 @@ template <> void derefGPtr<GstPad>(GstPad* ptr)
 
 template <> GRefPtr<GstPadTemplate> adoptGRef(GstPadTemplate* ptr)
 {
-    ASSERT(!ptr || !GST_OBJECT_IS_FLOATING(GST_OBJECT(ptr)));
+    ASSERT(!ptr || !gstObjectIsFloating(GST_OBJECT(ptr)));
     return GRefPtr<GstPadTemplate>(ptr, GRefPtrAdopt);
 }
 
@@ -102,7 +102,7 @@ template <> void derefGPtr<GstCaps>(GstCaps* ptr)
 
 template <> GRefPtr<GstTask> adoptGRef(GstTask* ptr)
 {
-    ASSERT(!GST_OBJECT_IS_FLOATING(GST_OBJECT(ptr)));
+    ASSERT(!gstObjectIsFloating(GST_OBJECT(ptr)));
     return GRefPtr<GstTask>(ptr, GRefPtrAdopt);
 }
 
@@ -122,7 +122,7 @@ template <> void derefGPtr<GstTask>(GstTask* ptr)
 
 template <> GRefPtr<GstBus> adoptGRef(GstBus* ptr)
 {
-    ASSERT(!GST_OBJECT_IS_FLOATING(GST_OBJECT(ptr)));
+    ASSERT(!gstObjectIsFloating(GST_OBJECT(ptr)));
     return GRefPtr<GstBus>(ptr, GRefPtrAdopt);
 }
 
@@ -142,7 +142,7 @@ template <> void derefGPtr<GstBus>(GstBus* ptr)
 
 template <> GRefPtr<GstElementFactory> adoptGRef(GstElementFactory* ptr)
 {
-    ASSERT(!GST_OBJECT_IS_FLOATING(GST_OBJECT(ptr)));
+    ASSERT(!gstObjectIsFloating(GST_OBJECT(ptr)));
     return GRefPtr<GstElementFactory>(ptr, GRefPtrAdopt);
 }
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerUtilities.h b/Source/WebCore/platform/graphics/gstreamer/GStreamerUtilities.h
index b9eb165e4..87bcf6787 100644
--- a/Source/WebCore/platform/graphics/gstreamer/GStreamerUtilities.h
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerUtilities.h
@@ -16,6 +16,9 @@
  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#define LOG_MEDIA_MESSAGE(...) do { \
+    GST_DEBUG(__VA_ARGS__); \
+    LOG_VERBOSE(Media, __VA_ARGS__); } while (0)
 
 namespace WebCore {
 bool initializeGStreamer();
diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.cpp b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.cpp
index 06a8c9e1b..3c3f367b9 100644
--- a/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.cpp
@@ -22,6 +22,7 @@
 #include "GStreamerVersioning.h"
 
 #include "IntSize.h"
+#include <wtf/UnusedParam.h>
 
 void webkitGstObjectRefSink(GstObject* gstObject)
 {
@@ -105,3 +106,22 @@ void setGstElementClassMetadata(GstElementClass* elementClass, const char* name,
     gst_element_class_set_details_simple(elementClass, name, longName, description, author);
 #endif
 }
+
+bool gstObjectIsFloating(GstObject* gstObject)
+{
+#ifdef GST_API_VERSION_1
+    return g_object_is_floating(G_OBJECT(gstObject));
+#else
+    return GST_OBJECT_IS_FLOATING(gstObject);
+#endif
+}
+
+void notifyGstTagsOnPad(GstElement* element, GstPad* pad, GstTagList* tags)
+{
+#ifdef GST_API_VERSION_1
+    UNUSED_PARAM(element);
+    gst_pad_push_event(GST_PAD_CAST(pad), gst_event_new_tag(tags));
+#else
+    gst_element_found_tags_for_pad(element, pad, tags);
+#endif
+}
diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h
index 6b21b63b3..a8e5182f6 100644
--- a/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h
@@ -32,4 +32,6 @@ GstCaps* webkitGstGetPadCaps(GstPad*);
 bool getVideoSizeAndFormatFromCaps(GstCaps*, WebCore::IntSize&, GstVideoFormat&, int& pixelAspectRatioNumerator, int& pixelAspectRatioDenominator, int& stride);
 GstBuffer* createGstBuffer(GstBuffer*);
 void setGstElementClassMetadata(GstElementClass*, const char* name, const char* longName, const char* description, const char* author);
+bool gstObjectIsFloating(GstObject*);
+void notifyGstTagsOnPad(GstElement*, GstPad*, GstTagList*);
 #endif // GStreamerVersioning_h
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index fba8252da..adf555f07 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -80,6 +80,9 @@ static const char* gPlaybinName = "playbin";
 static const char* gPlaybinName = "playbin2";
 #endif
 
+GST_DEBUG_CATEGORY_STATIC(webkit_media_player_debug);
+#define GST_CAT_DEFAULT webkit_media_player_debug
+
 using namespace std;
 
 namespace WebCore {
@@ -182,8 +185,10 @@ bool initializeGStreamerAndRegisterWebKitElements()
         return false;
 
     GRefPtr<GstElementFactory> srcFactory = gst_element_factory_find("webkitwebsrc");
-    if (!srcFactory)
+    if (!srcFactory) {
+        GST_DEBUG_CATEGORY_INIT(webkit_media_player_debug, "webkitmediaplayer", 0, "WebKit media player");
         return gst_element_register(0, "webkitwebsrc", GST_RANK_PRIMARY + 100, WEBKIT_TYPE_WEB_SRC);
+    }
 
     return true;
 }
@@ -235,6 +240,8 @@ MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer(MediaPlayer* player)
     , m_audioTimerHandler(0)
     , m_videoTimerHandler(0)
     , m_webkitAudioSink(0)
+    , m_totalBytes(-1)
+    , m_originalPreloadWasAutoAndWasOverridden(false)
 {
     if (initializeGStreamerAndRegisterWebKitElements())
         createGSTPlayBin();
@@ -292,15 +299,23 @@ void MediaPlayerPrivateGStreamer::load(const String& url)
     if (kurl.isLocalFile())
         cleanUrl = cleanUrl.substring(0, kurl.pathEnd());
 
+    m_url = KURL(KURL(), cleanUrl);
     g_object_set(m_playBin, "uri", cleanUrl.utf8().data(), NULL);
 
-    LOG_VERBOSE(Media, "Load %s", cleanUrl.utf8().data());
+    LOG_MEDIA_MESSAGE("Load %s", cleanUrl.utf8().data());
 
     if (m_preload == MediaPlayer::None) {
-        LOG_VERBOSE(Media, "Delaying load.");
+        LOG_MEDIA_MESSAGE("Delaying load.");
         m_delayingLoad = true;
     }
 
+    // Reset network and ready states. Those will be set properly once
+    // the pipeline pre-rolled.
+    m_networkState = MediaPlayer::Loading;
+    m_player->networkStateChanged();
+    m_readyState = MediaPlayer::HaveNothing;
+    m_player->readyStateChanged();
+
     // GStreamer needs to have the pipeline set to a paused state to
     // start providing anything useful.
     gst_element_set_state(m_playBin, GST_STATE_PAUSED);
@@ -312,7 +327,7 @@ void MediaPlayerPrivateGStreamer::load(const String& url)
 void MediaPlayerPrivateGStreamer::commitLoad()
 {
     ASSERT(!m_delayingLoad);
-    LOG_VERBOSE(Media, "Committing load.");
+    LOG_MEDIA_MESSAGE("Committing load.");
     updateStates();
 }
 
@@ -322,7 +337,7 @@ float MediaPlayerPrivateGStreamer::playbackPosition() const
 
     GstQuery* query = gst_query_new_position(GST_FORMAT_TIME);
     if (!gst_element_query(m_playBin, query)) {
-        LOG_VERBOSE(Media, "Position query failed...");
+        LOG_MEDIA_MESSAGE("Position query failed...");
         gst_query_unref(query);
         return ret;
     }
@@ -335,7 +350,7 @@ float MediaPlayerPrivateGStreamer::playbackPosition() const
     if (position != static_cast<gint64>(GST_CLOCK_TIME_NONE))
         ret = static_cast<double>(position) / GST_SECOND;
 
-    LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
+    LOG_MEDIA_MESSAGE("Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
 
     gst_query_unref(query);
 
@@ -374,13 +389,13 @@ void MediaPlayerPrivateGStreamer::prepareToPlay()
 void MediaPlayerPrivateGStreamer::play()
 {
     if (changePipelineState(GST_STATE_PLAYING))
-        LOG_VERBOSE(Media, "Play");
+        LOG_MEDIA_MESSAGE("Play");
 }
 
 void MediaPlayerPrivateGStreamer::pause()
 {
     if (changePipelineState(GST_STATE_PAUSED))
-        LOG_VERBOSE(Media, "Pause");
+        LOG_MEDIA_MESSAGE("Pause");
 }
 
 float MediaPlayerPrivateGStreamer::duration() const
@@ -407,11 +422,11 @@ float MediaPlayerPrivateGStreamer::duration() const
     bool failure = !gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeFormat != GST_FORMAT_TIME || static_cast<guint64>(timeLength) == GST_CLOCK_TIME_NONE;
 #endif
     if (failure) {
-        LOG_VERBOSE(Media, "Time duration query failed.");
+        LOG_MEDIA_MESSAGE("Time duration query failed for %s", m_url.string().utf8().data());
         return numeric_limits<float>::infinity();
     }
 
-    LOG_VERBOSE(Media, "Duration: %" GST_TIME_FORMAT, GST_TIME_ARGS(timeLength));
+    LOG_MEDIA_MESSAGE("Duration: %" GST_TIME_FORMAT, GST_TIME_ARGS(timeLength));
 
     return static_cast<double>(timeLength) / GST_SECOND;
     // FIXME: handle 3.14.9.5 properly
@@ -463,14 +478,14 @@ void MediaPlayerPrivateGStreamer::seek(float time)
     timeValue.tv_usec = static_cast<glong>(roundf(microSeconds / 10000) * 10000);
 
     GstClockTime clockTime = GST_TIMEVAL_TO_TIME(timeValue);
-    LOG_VERBOSE(Media, "Seek: %" GST_TIME_FORMAT, GST_TIME_ARGS(clockTime));
+    LOG_MEDIA_MESSAGE("Seek: %" GST_TIME_FORMAT, GST_TIME_ARGS(clockTime));
 
     if (!gst_element_seek(m_playBin, m_player->rate(),
             GST_FORMAT_TIME,
             (GstSeekFlags)(GST_SEEK_FLAG_FLUSH | GST_SEEK_FLAG_ACCURATE),
             GST_SEEK_TYPE_SET, clockTime,
             GST_SEEK_TYPE_NONE, GST_CLOCK_TIME_NONE))
-        LOG_VERBOSE(Media, "Seek to %f failed", time);
+        LOG_MEDIA_MESSAGE("Seek to %f failed", time);
     else {
         m_seeking = true;
         m_seekTime = time;
@@ -516,8 +531,8 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
     if (!getVideoSizeAndFormatFromCaps(caps, originalSize, format, pixelAspectRatioNumerator, pixelAspectRatioDenominator, stride))
         return IntSize();
 
-    LOG_VERBOSE(Media, "Original video size: %dx%d", originalSize.width(), originalSize.height());
-    LOG_VERBOSE(Media, "Pixel aspect ratio: %d/%d", pixelAspectRatioNumerator, pixelAspectRatioDenominator);
+    LOG_MEDIA_MESSAGE("Original video size: %dx%d", originalSize.width(), originalSize.height());
+    LOG_MEDIA_MESSAGE("Pixel aspect ratio: %d/%d", pixelAspectRatioNumerator, pixelAspectRatioDenominator);
 
     // Calculate DAR based on PAR and video size.
     int displayWidth = originalSize.width() * pixelAspectRatioNumerator;
@@ -531,20 +546,20 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
     // Apply DAR to original video size. This is the same behavior as in xvimagesink's setcaps function.
     guint64 width = 0, height = 0;
     if (!(originalSize.height() % displayHeight)) {
-        LOG_VERBOSE(Media, "Keeping video original height");
+        LOG_MEDIA_MESSAGE("Keeping video original height");
         width = gst_util_uint64_scale_int(originalSize.height(), displayWidth, displayHeight);
         height = static_cast<guint64>(originalSize.height());
     } else if (!(originalSize.width() % displayWidth)) {
-        LOG_VERBOSE(Media, "Keeping video original width");
+        LOG_MEDIA_MESSAGE("Keeping video original width");
         height = gst_util_uint64_scale_int(originalSize.width(), displayHeight, displayWidth);
         width = static_cast<guint64>(originalSize.width());
     } else {
-        LOG_VERBOSE(Media, "Approximating while keeping original video height");
+        LOG_MEDIA_MESSAGE("Approximating while keeping original video height");
         width = gst_util_uint64_scale_int(originalSize.height(), displayWidth, displayHeight);
         height = static_cast<guint64>(originalSize.height());
     }
 
-    LOG_VERBOSE(Media, "Natural size: %" G_GUINT64_FORMAT "x%" G_GUINT64_FORMAT, width, height);
+    LOG_MEDIA_MESSAGE("Natural size: %" G_GUINT64_FORMAT "x%" G_GUINT64_FORMAT, width, height);
     m_videoSize = IntSize(static_cast<int>(width), static_cast<int>(height));
     return m_videoSize;
 }
@@ -634,7 +649,7 @@ void MediaPlayerPrivateGStreamer::setRate(float rate)
         || (pending == GST_STATE_PAUSED))
         return;
 
-    if (m_isStreaming)
+    if (isLiveStream())
         return;
 
     m_playbackRate = rate;
@@ -650,7 +665,7 @@ void MediaPlayerPrivateGStreamer::setRate(float rate)
     gint64 start, end;
     bool mute = false;
 
-    LOG_VERBOSE(Media, "Set Rate to %f", rate);
+    LOG_MEDIA_MESSAGE("Set Rate to %f", rate);
     if (rate > 0) {
         // Mute the sound if the playback rate is too extreme.
         // TODO: in other cases we should perform pitch adjustments.
@@ -669,12 +684,12 @@ void MediaPlayerPrivateGStreamer::setRate(float rate)
             end = currentPosition;
     }
 
-    LOG_VERBOSE(Media, "Need to mute audio: %d", (int) mute);
+    LOG_MEDIA_MESSAGE("Need to mute audio: %d", (int) mute);
 
     if (!gst_element_seek(m_playBin, rate, GST_FORMAT_TIME, flags,
                           GST_SEEK_TYPE_SET, start,
                           GST_SEEK_TYPE_SET, end))
-        LOG_VERBOSE(Media, "Set rate to %f failed", rate);
+        LOG_MEDIA_MESSAGE("Set rate to %f failed", rate);
     else
         g_object_set(m_playBin, "mute", mute, NULL);
 }
@@ -692,7 +707,7 @@ MediaPlayer::ReadyState MediaPlayerPrivateGStreamer::readyState() const
 PassRefPtr<TimeRanges> MediaPlayerPrivateGStreamer::buffered() const
 {
     RefPtr<TimeRanges> timeRanges = TimeRanges::create();
-    if (m_errorOccured || m_isStreaming)
+    if (m_errorOccured || isLiveStream())
         return timeRanges.release();
 
 #if GST_CHECK_VERSION(0, 10, 31)
@@ -723,7 +738,7 @@ PassRefPtr<TimeRanges> MediaPlayerPrivateGStreamer::buffered() const
     gst_query_unref(query);
 #else
     float loaded = maxTimeLoaded();
-    if (!m_errorOccured && !m_isStreaming && loaded > 0)
+    if (!m_errorOccured && !isLiveStream() && loaded > 0)
         timeRanges->add(0, loaded);
 #endif
     return timeRanges.release();
@@ -749,12 +764,13 @@ gboolean MediaPlayerPrivateGStreamer::handleMessage(GstMessage* message)
         }
     }
 
+    LOG_MEDIA_MESSAGE("Message received from element %s", GST_MESSAGE_SRC_NAME(message));
     switch (GST_MESSAGE_TYPE(message)) {
     case GST_MESSAGE_ERROR:
         if (m_resetPipeline)
             break;
         gst_message_parse_error(message, &err.outPtr(), &debug.outPtr());
-        LOG_VERBOSE(Media, "Error: %d, %s", err->code,  err->message);
+        LOG_MEDIA_MESSAGE("Error %d: %s (url=%s)", err->code, err->message, m_url.string().utf8().data());
 
         GST_DEBUG_BIN_TO_DOT_FILE_WITH_TS(GST_BIN(m_playBin), GST_DEBUG_GRAPH_SHOW_ALL, "webkit-video.error");
 
@@ -770,7 +786,7 @@ gboolean MediaPlayerPrivateGStreamer::handleMessage(GstMessage* message)
             // this case the HTMLMediaElement will emit a stalled
             // event.
             if (err->code == GST_STREAM_ERROR_TYPE_NOT_FOUND) {
-                LOG_VERBOSE(Media, "Decode error, let the Media element emit a stalled event.");
+                LOG_MEDIA_MESSAGE("Decode error, let the Media element emit a stalled event.");
                 break;
             }
             error = MediaPlayer::DecodeError;
@@ -784,14 +800,14 @@ gboolean MediaPlayerPrivateGStreamer::handleMessage(GstMessage* message)
             loadingFailed(error);
         break;
     case GST_MESSAGE_EOS:
-        LOG_VERBOSE(Media, "End of Stream");
+        LOG_MEDIA_MESSAGE("End of Stream");
         didEnd();
         break;
     case GST_MESSAGE_STATE_CHANGED:
         // Ignore state changes if load is delayed (preload=none). The
         // player state will be updated once commitLoad() is called.
         if (m_delayingLoad) {
-            LOG_VERBOSE(Media, "Media load has been delayed. Ignoring state changes for now");
+            LOG_MEDIA_MESSAGE("Media load has been delayed. Ignoring state changes for now");
             break;
         }
 
@@ -815,11 +831,11 @@ gboolean MediaPlayerPrivateGStreamer::handleMessage(GstMessage* message)
         processBufferingStats(message);
         break;
     case GST_MESSAGE_DURATION:
-        LOG_VERBOSE(Media, "Duration changed");
+        LOG_MEDIA_MESSAGE("Duration changed");
         durationChanged();
         break;
     default:
-        LOG_VERBOSE(Media, "Unhandled GStreamer message type: %s",
+        LOG_MEDIA_MESSAGE("Unhandled GStreamer message type: %s",
                     GST_MESSAGE_TYPE_NAME(message));
         break;
     }
@@ -834,7 +850,7 @@ void MediaPlayerPrivateGStreamer::processBufferingStats(GstMessage* message)
     const GstStructure *structure = gst_message_get_structure(message);
     gst_structure_get_int(structure, "buffer-percent", &m_bufferingPercentage);
 
-    LOG_VERBOSE(Media, "[Buffering] Buffering: %d%%.", m_bufferingPercentage);
+    LOG_MEDIA_MESSAGE("[Buffering] Buffering: %d%%.", m_bufferingPercentage);
 
     GstBufferingMode mode;
     gst_message_parse_buffering_stats(message, &mode, 0, 0, 0);
@@ -846,7 +862,7 @@ void MediaPlayerPrivateGStreamer::processBufferingStats(GstMessage* message)
     // This is on-disk buffering, that allows us to download much more
     // than needed for right now.
     if (!m_startedBuffering) {
-        LOG_VERBOSE(Media, "[Buffering] Starting on-disk buffering.");
+        LOG_MEDIA_MESSAGE("[Buffering] Starting on-disk buffering.");
 
         m_startedBuffering = true;
 
@@ -875,7 +891,7 @@ void MediaPlayerPrivateGStreamer::fillTimerFired(Timer<MediaPlayerPrivateGStream
     if (stop != -1)
         fillStatus = 100.0 * stop / GST_FORMAT_PERCENT_MAX;
 
-    LOG_VERBOSE(Media, "[Buffering] Download buffer filled up to %f%%", fillStatus);
+    LOG_MEDIA_MESSAGE("[Buffering] Download buffer filled up to %f%%", fillStatus);
 
     if (!m_mediaDuration)
         durationChanged();
@@ -887,7 +903,7 @@ void MediaPlayerPrivateGStreamer::fillTimerFired(Timer<MediaPlayerPrivateGStream
             m_maxTimeLoaded = m_mediaDuration;
         else
             m_maxTimeLoaded = static_cast<float>((fillStatus * m_mediaDuration) / 100.0);
-        LOG_VERBOSE(Media, "[Buffering] Updated maxTimeLoaded: %f", m_maxTimeLoaded);
+        LOG_MEDIA_MESSAGE("[Buffering] Updated maxTimeLoaded: %f", m_maxTimeLoaded);
     }
 
     if (fillStatus != 100.0) {
@@ -908,7 +924,7 @@ float MediaPlayerPrivateGStreamer::maxTimeSeekable() const
     if (m_errorOccured)
         return 0.0f;
 
-    LOG_VERBOSE(Media, "maxTimeSeekable");
+    LOG_MEDIA_MESSAGE("maxTimeSeekable");
     // infinite duration means live stream
     if (isinf(duration()))
         return 0.0f;
@@ -924,7 +940,7 @@ float MediaPlayerPrivateGStreamer::maxTimeLoaded() const
     float loaded = m_maxTimeLoaded;
     if (!loaded && !m_fillTimer.isActive())
         loaded = duration();
-    LOG_VERBOSE(Media, "maxTimeLoaded: %f", loaded);
+    LOG_MEDIA_MESSAGE("maxTimeLoaded: %f", loaded);
     return loaded;
 }
 
@@ -935,16 +951,19 @@ bool MediaPlayerPrivateGStreamer::didLoadingProgress() const
     float currentMaxTimeLoaded = maxTimeLoaded();
     bool didLoadingProgress = currentMaxTimeLoaded != m_maxTimeLoadedAtLastDidLoadingProgress;
     m_maxTimeLoadedAtLastDidLoadingProgress = currentMaxTimeLoaded;
-    LOG_VERBOSE(Media, "didLoadingProgress: %d", didLoadingProgress);
+    LOG_MEDIA_MESSAGE("didLoadingProgress: %d", didLoadingProgress);
     return didLoadingProgress;
 }
 
 unsigned MediaPlayerPrivateGStreamer::totalBytes() const
 {
-    if (!m_source)
+    if (m_errorOccured)
         return 0;
 
-    if (m_errorOccured)
+    if (m_totalBytes != -1)
+        return m_totalBytes;
+
+    if (!m_source)
         return 0;
 
     GstFormat fmt = GST_FORMAT_BYTES;
@@ -954,8 +973,10 @@ unsigned MediaPlayerPrivateGStreamer::totalBytes() const
 #else
     if (gst_element_query_duration(m_source.get(), &fmt, &length)) {
 #endif
-        LOG_VERBOSE(Media, "totalBytes %" G_GINT64_FORMAT, length);
-        return static_cast<unsigned>(length);
+        LOG_MEDIA_MESSAGE("totalBytes %" G_GINT64_FORMAT, length);
+        m_totalBytes = static_cast<unsigned>(length);
+        m_isStreaming = !length;
+        return m_totalBytes;
     }
 
     // Fall back to querying the source pads manually.
@@ -1002,9 +1023,10 @@ unsigned MediaPlayerPrivateGStreamer::totalBytes() const
 
     gst_iterator_free(iter);
 
-    LOG_VERBOSE(Media, "totalBytes %" G_GINT64_FORMAT, length);
-
-    return static_cast<unsigned>(length);
+    LOG_MEDIA_MESSAGE("totalBytes %" G_GINT64_FORMAT, length);
+    m_totalBytes = static_cast<unsigned>(length);
+    m_isStreaming = !length;
+    return m_totalBytes;
 }
 
 unsigned MediaPlayerPrivateGStreamer::decodedFrameCount() const
@@ -1099,7 +1121,7 @@ void MediaPlayerPrivateGStreamer::updateStates()
     bool shouldUpdateAfterSeek = false;
     switch (ret) {
     case GST_STATE_CHANGE_SUCCESS:
-        LOG_VERBOSE(Media, "State: %s, pending: %s",
+        LOG_MEDIA_MESSAGE("State: %s, pending: %s",
             gst_element_state_get_name(state),
             gst_element_state_get_name(pending));
 
@@ -1137,10 +1159,10 @@ void MediaPlayerPrivateGStreamer::updateStates()
                 m_bufferingPercentage = 0;
                 m_readyState = MediaPlayer::HaveEnoughData;
 
-                LOG_VERBOSE(Media, "[Buffering] Complete.");
+                LOG_MEDIA_MESSAGE("[Buffering] Complete.");
 
                 if (!m_paused) {
-                    LOG_VERBOSE(Media, "[Buffering] Restarting playback.");
+                    LOG_MEDIA_MESSAGE("[Buffering] Restarting playback.");
                     gst_element_set_state(m_playBin, GST_STATE_PLAYING);
                 }
             } else if (!m_buffering && (currentTime() < duration())) {
@@ -1150,11 +1172,11 @@ void MediaPlayerPrivateGStreamer::updateStates()
             m_readyState = MediaPlayer::HaveEnoughData;
             m_paused = false;
 
-            if (m_buffering) {
+            if (m_buffering && !isLiveStream()) {
                 m_readyState = MediaPlayer::HaveCurrentData;
                 m_networkState = MediaPlayer::Loading;
 
-                LOG_VERBOSE(Media, "[Buffering] Pausing stream for buffering.");
+                LOG_MEDIA_MESSAGE("[Buffering] Pausing stream for buffering.");
 
                 gst_element_set_state(m_playBin, GST_STATE_PAUSED);
             }
@@ -1177,12 +1199,27 @@ void MediaPlayerPrivateGStreamer::updateStates()
 
         break;
     case GST_STATE_CHANGE_ASYNC:
-        LOG_VERBOSE(Media, "Async: State: %s, pending: %s",
+        LOG_MEDIA_MESSAGE("Async: State: %s, pending: %s",
             gst_element_state_get_name(state),
             gst_element_state_get_name(pending));
         // Change in progress
 
-        if (!m_isStreaming && !m_buffering)
+        // On-disk buffering was attempted but the media is live. This
+        // can't work so disable on-disk buffering and reset the
+        // pipeline.
+        if (state == GST_STATE_READY && isLiveStream() && m_preload == MediaPlayer::Auto) {
+            setPreload(MediaPlayer::None);
+            gst_element_set_state(m_playBin, GST_STATE_NULL);
+            gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+        }
+
+        // A live stream was paused, reset the pipeline.
+        if (state == GST_STATE_PAUSED && pending == GST_STATE_PLAYING && isLiveStream()) {
+            gst_element_set_state(m_playBin, GST_STATE_NULL);
+            gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+        }
+
+        if (!isLiveStream() && !m_buffering)
             return;
 
         if (m_seeking) {
@@ -1191,13 +1228,13 @@ void MediaPlayerPrivateGStreamer::updateStates()
         }
         break;
     case GST_STATE_CHANGE_FAILURE:
-        LOG_VERBOSE(Media, "Failure: State: %s, pending: %s",
+        LOG_MEDIA_MESSAGE("Failure: State: %s, pending: %s",
             gst_element_state_get_name(state),
             gst_element_state_get_name(pending));
         // Change failed
         return;
     case GST_STATE_CHANGE_NO_PREROLL:
-        LOG_VERBOSE(Media, "No preroll: State: %s, pending: %s",
+        LOG_MEDIA_MESSAGE("No preroll: State: %s, pending: %s",
             gst_element_state_get_name(state),
             gst_element_state_get_name(pending));
 
@@ -1222,7 +1259,7 @@ void MediaPlayerPrivateGStreamer::updateStates()
         m_networkState = MediaPlayer::Loading;
         break;
     default:
-        LOG_VERBOSE(Media, "Else : %d", ret);
+        LOG_MEDIA_MESSAGE("Else : %d", ret);
         break;
     }
 
@@ -1233,12 +1270,12 @@ void MediaPlayerPrivateGStreamer::updateStates()
         timeChanged();
 
     if (m_networkState != oldNetworkState) {
-        LOG_VERBOSE(Media, "Network State Changed from %u to %u",
+        LOG_MEDIA_MESSAGE("Network State Changed from %u to %u",
             oldNetworkState, m_networkState);
         m_player->networkStateChanged();
     }
     if (m_readyState != oldReadyState) {
-        LOG_VERBOSE(Media, "Ready State Changed from %u to %u",
+        LOG_MEDIA_MESSAGE("Ready State Changed from %u to %u",
             oldReadyState, m_readyState);
         m_player->readyStateChanged();
     }
@@ -1317,7 +1354,7 @@ bool MediaPlayerPrivateGStreamer::loadNextLocation()
 
         RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::create(currentUrl);
         if (securityOrigin->canRequest(newUrl)) {
-            LOG_VERBOSE(Media, "New media url: %s", newUrl.string().utf8().data());
+            LOG_MEDIA_MESSAGE("New media url: %s", newUrl.string().utf8().data());
 
             // Reset player states.
             m_networkState = MediaPlayer::Loading;
@@ -1413,6 +1450,15 @@ void MediaPlayerPrivateGStreamer::durationChanged()
     // HTMLMediaElement.
     if (previousDuration && m_mediaDuration != previousDuration)
         m_player->durationChanged();
+
+    if (m_preload == MediaPlayer::None && m_originalPreloadWasAutoAndWasOverridden) {
+        m_totalBytes = -1;
+        if (totalBytes() && !isLiveStream()) {
+            setPreload(MediaPlayer::Auto);
+            gst_element_set_state(m_playBin, GST_STATE_NULL);
+            gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+        }
+    }
 }
 
 bool MediaPlayerPrivateGStreamer::supportsMuting() const
@@ -1642,18 +1688,34 @@ PlatformMedia MediaPlayerPrivateGStreamer::platformMedia() const
     return p;
 }
 
+MediaPlayer::MovieLoadType MediaPlayerPrivateGStreamer::movieLoadType() const
+{
+    if (m_readyState == MediaPlayer::HaveNothing)
+        return MediaPlayer::Unknown;
+
+    if (isLiveStream())
+        return MediaPlayer::LiveStream;
+
+    return MediaPlayer::Download;
+}
+
 void MediaPlayerPrivateGStreamer::setPreload(MediaPlayer::Preload preload)
 {
-    ASSERT(m_playBin);
+    m_originalPreloadWasAutoAndWasOverridden = m_preload != preload && m_preload == MediaPlayer::Auto;
 
     m_preload = preload;
 
+    ASSERT(m_playBin);
+
     GstPlayFlags flags;
     g_object_get(m_playBin, "flags", &flags, NULL);
-    if (preload == MediaPlayer::None)
-        g_object_set(m_playBin, "flags", flags & ~GST_PLAY_FLAG_DOWNLOAD, NULL);
-    else
+    if (m_preload == MediaPlayer::Auto) {
+        LOG_MEDIA_MESSAGE("Enabling on-disk buffering");
         g_object_set(m_playBin, "flags", flags | GST_PLAY_FLAG_DOWNLOAD, NULL);
+    } else {
+        LOG_MEDIA_MESSAGE("Disabling on-disk buffering");
+        g_object_set(m_playBin, "flags", flags & ~GST_PLAY_FLAG_DOWNLOAD, NULL);
+    }
 
     if (m_delayingLoad && m_preload != MediaPlayer::None) {
         m_delayingLoad = false;
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
index f454fe312..d14d004f0 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
@@ -124,6 +124,8 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             unsigned audioDecodedByteCount() const;
             unsigned videoDecodedByteCount() const;
 
+            MediaPlayer::MovieLoadType movieLoadType() const;
+
         private:
             MediaPlayerPrivateGStreamer(MediaPlayer*);
 
@@ -151,6 +153,7 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             void processBufferingStats(GstMessage*);
 
             virtual String engineDescription() const { return "GStreamer"; }
+            bool isLiveStream() const { return m_isStreaming; }
 
         private:
             MediaPlayer* m_player;
@@ -195,8 +198,11 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             guint m_audioTimerHandler;
             guint m_videoTimerHandler;
             GRefPtr<GstElement> m_webkitAudioSink;
+            mutable long m_totalBytes;
             GRefPtr<GstPad> m_videoSinkPad;
             mutable IntSize m_videoSize;
+            KURL m_url;
+            bool m_originalPreloadWasAutoAndWasOverridden;
     };
 }
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
index b929e90e4..423d0cbf3 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
@@ -23,23 +23,13 @@
 #include <QEvent>
 #include <QTimer>
 
-#if defined(HAVE_QT5) && HAVE_QT5
 #include <QWindow>
-#else
-#include <QWidget>
-#endif
 
 namespace WebCore {
 
 class HTMLVideoElement;
 
-#if defined(HAVE_QT5) && HAVE_QT5
-typedef QWindow Base;
-#else
-typedef QWidget Base;
-#endif
-
-class FullScreenVideoWindow: public Base {
+class FullScreenVideoWindow: public QWindow {
 Q_OBJECT
 public:
     FullScreenVideoWindow();
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
index 3e431f241..977fa3a24 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
@@ -38,11 +38,6 @@ static const int gHideMouseCursorDelay = 3000;
 FullScreenVideoWindow::FullScreenVideoWindow()
     : m_mediaElement(0)
 {
-#if !HAVE(QT5)
-    setAttribute(Qt::WA_NativeWindow);
-    setAttribute(Qt::WA_NoSystemBackground, true);
-    setAttribute(Qt::WA_PaintOnScreen, true);
-#endif
     setWindowModality(Qt::ApplicationModal);
 
 #ifndef QT_NO_CURSOR
@@ -65,7 +60,7 @@ void FullScreenVideoWindow::keyPressEvent(QKeyEvent* ev)
             m_mediaElement->play();
     } else if (ev->key() == Qt::Key_Escape)
         emit closed();
-    Base::keyPressEvent(ev);
+    QWindow::keyPressEvent(ev);
 }
 
 bool FullScreenVideoWindow::event(QEvent* ev)
@@ -83,10 +78,6 @@ bool FullScreenVideoWindow::event(QEvent* ev)
 #ifndef QT_NO_CURSOR
         m_cursorTimer.stop();
 #endif
-#if !HAVE(QT5)
-        setMouseTracking(false);
-        releaseMouse();
-#endif
 #ifndef QT_NO_CURSOR
         QGuiApplication::restoreOverrideCursor();
 #endif
@@ -94,19 +85,13 @@ bool FullScreenVideoWindow::event(QEvent* ev)
     default:
         break;
     }
-    return Base::event(ev);
+    return QWindow::event(ev);
 }
 
 void FullScreenVideoWindow::showFullScreen()
 {
-    Base::showFullScreen();
-#if !HAVE(QT5)
-    setMouseTracking(true);
-#endif
+    QWindow::showFullScreen();
     raise();
-#if !HAVE(QT5)
-    setFocus();
-#endif
     hideCursor();
 }
 
@@ -128,16 +113,10 @@ void FullScreenVideoWindow::showCursor()
 
 PlatformVideoWindow::PlatformVideoWindow()
 {
-    Base* win = new FullScreenVideoWindow();
+    QWindow* win = new FullScreenVideoWindow();
     m_window = win;
     win->setWindowFlags(win->windowFlags() | Qt::FramelessWindowHint);
     // FIXME: Port to Qt 5.
-#if !HAVE(QT5)
-    QPalette p;
-    p.setColor(QPalette::Base, Qt::black);
-    p.setColor(QPalette::Window, Qt::black);
-    win->setPalette(p);
-#endif
     win->showFullScreen();
     m_videoWindowId = win->winId();
 }
diff --git a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
index 38aaec1f7..e584be231 100644
--- a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
@@ -853,11 +853,7 @@ void StreamingClient::didReceiveResponse(ResourceHandle*, const ResourceResponse
         gst_tag_list_free(tags);
 #endif
     else
-#ifdef GST_API_VERSION_1
-        gst_pad_push_event(GST_PAD_CAST(m_src->priv->srcpad), gst_event_new_tag("WebKitWebSrc", tags));
-#else
-        gst_element_found_tags_for_pad(GST_ELEMENT(m_src), m_src->priv->srcpad, tags);
-#endif
+        notifyGstTagsOnPad(GST_ELEMENT(m_src), m_src->priv->srcpad, tags);
 }
 
 void StreamingClient::didReceiveData(ResourceHandle* handle, const char* data, int length, int encodedDataLength)
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
index 9191d9df6..9401b0135 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
@@ -80,11 +80,6 @@ ComplexTextController::ComplexTextController(const Font* font, const TextRun& ru
     m_item.string = m_normalizedBuffer.get();
     m_item.stringLength = m_normalizedBufferLength;
 
-#if OS(ANDROID)
-    // Kerning does not currently work on Android.
-    m_item.shaperFlags = HB_ShaperFlag_NoKerning;
-#endif
-
     reset(startingX);
     m_startingY = startingY;
 
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFaceCairo.cpp b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFaceCairo.cpp
index 8c56f2a79..0f9bb432c 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFaceCairo.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFaceCairo.cpp
@@ -95,11 +95,17 @@ static hb_bool_t harfbuzzGetGlyph(hb_font_t* hbFont, void* fontData, hb_codepoin
     FontPlatformData* platformData = reinterpret_cast<FontPlatformData*>(fontData);
     cairo_scaled_font_t* scaledFont = platformData->scaledFont();
     ASSERT(scaledFont);
-    CairoFtFaceLocker cairoFtFaceLocker(scaledFont);
-    FT_Face ftFace = cairoFtFaceLocker.lock();
-    ASSERT(ftFace);
-    *glyph = FT_Get_Char_Index(ftFace, unicode);
-    return !!*glyph;
+
+    cairo_glyph_t* glyphs = 0;
+    int numGlyphs = 0;
+    CString utf8Codepoint = UTF8Encoding().encode(reinterpret_cast<UChar*>(&unicode), 1, QuestionMarksForUnencodables);
+    if (CAIRO_STATUS_SUCCESS != cairo_scaled_font_text_to_glyphs(scaledFont, 0, 0, utf8Codepoint.data(), utf8Codepoint.length(), &glyphs, &numGlyphs, 0, 0, 0))
+        return false;
+    if (!numGlyphs)
+        return false;
+    *glyph = glyphs[0].index;
+    cairo_glyph_free(glyphs);
+    return true;
 }
 
 static hb_position_t harfbuzzGetGlyphHorizontalAdvance(hb_font_t* hbFont, void* fontData, hb_codepoint_t glyph, void* userData)
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp
index 17ad2b69b..c3bb54da3 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp
@@ -117,14 +117,14 @@ void HarfBuzzShaper::HarfBuzzRun::setGlyphAndAdvance(unsigned index, uint16_t gl
     m_advances[index] = advance;
 }
 
-int HarfBuzzShaper::HarfBuzzRun::characterIndexForXPosition(int targetX)
+int HarfBuzzShaper::HarfBuzzRun::characterIndexForXPosition(float targetX)
 {
-    ASSERT(static_cast<unsigned>(targetX) <= m_width);
-    int currentX = 0;
+    ASSERT(targetX <= m_width);
+    float currentX = 0;
     float prevAdvance = 0;
     for (unsigned i = 0; i < m_numGlyphs; ++i) {
         float currentAdvance = m_advances[i] / 2.0;
-        int nextX = currentX + roundf(prevAdvance + currentAdvance);
+        float nextX = currentX + prevAdvance + currentAdvance;
         if (currentX <= targetX && targetX <= nextX)
             return m_glyphToCharacterIndex[i] + (rtl() ? 1 : 0);
         currentX = nextX;
@@ -369,25 +369,27 @@ void HarfBuzzShaper::setGlyphPositionsForHarfBuzzRun(HarfBuzzRun* currentRun, un
 int HarfBuzzShaper::offsetForPosition(float targetX)
 {
     int charactersSoFar = 0;
-    int currentX = 0;
+    float currentX = 0;
 
     if (m_run.rtl()) {
         charactersSoFar = m_normalizedBufferLength;
         for (int i = m_harfbuzzRuns.size() - 1; i >= 0; --i) {
             charactersSoFar -= m_harfbuzzRuns[i]->numCharacters();
-            int nextX = currentX + m_harfbuzzRuns[i]->width();
-            if (currentX <= targetX && targetX <= nextX) {
+            float nextX = currentX + m_harfbuzzRuns[i]->width();
+            float offsetForRun = targetX - currentX;
+            if (offsetForRun >= 0 && offsetForRun <= m_harfbuzzRuns[i]->width()) {
                 // The x value in question is within this script run.
-                const unsigned index = m_harfbuzzRuns[i]->characterIndexForXPosition(targetX - currentX);
+                const unsigned index = m_harfbuzzRuns[i]->characterIndexForXPosition(offsetForRun);
                 return charactersSoFar + index;
             }
             currentX = nextX;
         }
     } else {
         for (unsigned i = 0; i < m_harfbuzzRuns.size(); ++i) {
-            int nextX = currentX + m_harfbuzzRuns[i]->width();
-            if (currentX <= targetX && targetX <= nextX) {
-                const unsigned index = m_harfbuzzRuns[i]->characterIndexForXPosition(targetX - currentX);
+            float nextX = currentX + m_harfbuzzRuns[i]->width();
+            float offsetForRun = targetX - currentX;
+            if (offsetForRun >= 0 && offsetForRun <= m_harfbuzzRuns[i]->width()) {
+                const unsigned index = m_harfbuzzRuns[i]->characterIndexForXPosition(offsetForRun);
                 return charactersSoFar + index;
             }
             charactersSoFar += m_harfbuzzRuns[i]->numCharacters();
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.h b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.h
index 87844cc7f..8260fc96c 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.h
+++ b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.h
@@ -70,7 +70,7 @@ private:
         void setGlyphAndAdvance(unsigned index, uint16_t glyphId, float advance);
         void setWidth(float width) { m_width = width; }
 
-        int characterIndexForXPosition(int targetX);
+        int characterIndexForXPosition(float targetX);
         float xPositionForOffset(unsigned offset);
 
         const SimpleFontData* fontData() { return m_fontData; }
diff --git a/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp b/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
index 13c88bbdc..b7acd83bc 100644
--- a/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
+++ b/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
@@ -185,7 +185,24 @@ const SimpleFontData* Font::fontDataForCombiningCharacterSequence(const UChar* c
     unsigned i = 0;
     for (const FontData* fontData = fontDataAt(0); fontData; fontData = fontDataAt(++i)) {
         const SimpleFontData* simpleFontData = fontData->fontDataForCharacter(baseCharacter);
-        if (variant != NormalVariant) {
+        if (variant == NormalVariant) {
+            if (simpleFontData->platformData().orientation() == Vertical) {
+                if (isCJKIdeographOrSymbol(baseCharacter) && !simpleFontData->hasVerticalGlyphs()) {
+                    variant = BrokenIdeographVariant;
+                    simpleFontData = simpleFontData->brokenIdeographFontData();
+                } else if (m_fontDescription.textOrientation() == TextOrientationVerticalRight) {
+                    SimpleFontData* verticalRightFontData = simpleFontData->verticalRightOrientationFontData();
+                    Glyph verticalRightGlyph = verticalRightFontData->glyphForCharacter(baseCharacter);
+                    if (verticalRightGlyph == baseCharacterGlyphData.glyph)
+                        simpleFontData = verticalRightFontData;
+                } else {
+                    SimpleFontData* uprightFontData = simpleFontData->uprightOrientationFontData();
+                    Glyph uprightGlyph = uprightFontData->glyphForCharacter(baseCharacter);
+                    if (uprightGlyph != baseCharacterGlyphData.glyph)
+                        simpleFontData = uprightFontData;
+                }
+            }
+        } else {
             if (const SimpleFontData* variantFontData = simpleFontData->variantFontData(m_fontDescription, variant))
                 simpleFontData = variantFontData;
         }
diff --git a/Source/WebCore/platform/graphics/mac/GraphicsContextMac.mm b/Source/WebCore/platform/graphics/mac/GraphicsContextMac.mm
index e3d4f3346..adae2a31d 100644
--- a/Source/WebCore/platform/graphics/mac/GraphicsContextMac.mm
+++ b/Source/WebCore/platform/graphics/mac/GraphicsContextMac.mm
@@ -55,7 +55,7 @@ void GraphicsContext::drawFocusRing(const Path& path, int width, int /*offset*/,
 {
     // FIXME: Use 'offset' for something? http://webkit.org/b/49909
 
-    if (paintingDisabled())
+    if (paintingDisabled() || path.isNull())
         return;
 
     int radius = (width - 1) / 2;
diff --git a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index 587b9dd81..66fe90a59 100644
--- a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -82,7 +82,7 @@ static NSString *webFallbackFontFamily(void)
 }
 
 #if !ERROR_DISABLED
-#if defined(__LP64__) || PLATFORM(IOS) || __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
+#if defined(__LP64__) || PLATFORM(IOS) || __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070 || (__MAC_OS_X_VERSION_MAX_ALLOWED >= 107 && __MAC_OS_X_VERSION_MIN_REQUIRED >= 106)
 static NSString* pathFromFont(NSFont*)
 {
     // FMGetATSFontRefFromFont is not available. As pathFromFont is only used for debugging purposes,
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp
index 5a628810d..3bbb6c737 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp
@@ -143,6 +143,21 @@ void Extensions3DOpenGLCommon::initializeAvailableExtensions()
     m_initializedAvailableExtensions = true;
 }
 
+void Extensions3DOpenGLCommon::readnPixelsEXT(int, int, GC3Dsizei, GC3Dsizei, GC3Denum, GC3Denum, GC3Dsizei, void *)
+{
+    m_context->synthesizeGLError(GL_INVALID_OPERATION);
+}
+
+void Extensions3DOpenGLCommon::getnUniformfvEXT(GC3Duint, int, GC3Dsizei, float *)
+{
+    m_context->synthesizeGLError(GL_INVALID_OPERATION);
+}
+
+void Extensions3DOpenGLCommon::getnUniformivEXT(GC3Duint, int, GC3Dsizei, int *)
+{
+    m_context->synthesizeGLError(GL_INVALID_OPERATION);
+}
+
 } // namespace WebCore
 
 #endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.h b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.h
index 6a61e4632..75869de19 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.h
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.h
@@ -52,6 +52,11 @@ public:
 
     virtual String getTranslatedShaderSourceANGLE(Platform3DObject);
 
+    // EXT Robustness - uses getGraphicsResetStatusARB()
+    virtual void readnPixelsEXT(int x, int y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, GC3Dsizei bufSize, void *data);
+    virtual void getnUniformfvEXT(GC3Duint program, int location, GC3Dsizei bufSize, float *params);
+    virtual void getnUniformivEXT(GC3Duint program, int location, GC3Dsizei bufSize, int *params);
+
 protected:
     friend class Extensions3DOpenGLES;
     Extensions3DOpenGLCommon(GraphicsContext3D*);
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.cpp
index b3a930001..4ade7e554 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.cpp
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.cpp
@@ -33,11 +33,15 @@
 #include <EGL/egl.h>
 #include <wtf/Vector.h>
 
+#if PLATFORM(BLACKBERRY)
+#include <BlackBerryPlatformLog.h>
+#endif
 
 namespace WebCore {
 
 Extensions3DOpenGLES::Extensions3DOpenGLES(GraphicsContext3D* context)
     : Extensions3DOpenGLCommon(context)
+    , m_contextResetStatus(GL_NO_ERROR)
     , m_supportsOESvertexArrayObject(false)
     , m_supportsIMGMultisampledRenderToTexture(false)
     , m_glFramebufferTexture2DMultisampleIMG(0)
@@ -46,6 +50,10 @@ Extensions3DOpenGLES::Extensions3DOpenGLES(GraphicsContext3D* context)
     , m_glDeleteVertexArraysOES(0)
     , m_glGenVertexArraysOES(0)
     , m_glIsVertexArrayOES(0)
+    , m_glGetGraphicsResetStatusEXT(0)
+    , m_glReadnPixelsEXT(0)
+    , m_glGetnUniformfvEXT(0)
+    , m_glGetnUniformivEXT(0)
 {
 }
 
@@ -137,6 +145,77 @@ void Extensions3DOpenGLES::bindVertexArrayOES(Platform3DObject array)
         m_context->synthesizeGLError(GL_INVALID_OPERATION);
 }
 
+int Extensions3DOpenGLES::getGraphicsResetStatusARB()
+{
+    // FIXME: This does not call getGraphicsResetStatusARB, but instead getGraphicsResetStatusEXT.
+    // The return codes from the two extensions are identical and their purpose is the same, so it
+    // may be best to rename getGraphicsResetStatusARB() to getGraphicsResetStatus().
+    if (m_contextResetStatus != GL_NO_ERROR)
+        return m_contextResetStatus;
+    if (m_glGetGraphicsResetStatusEXT) {
+        m_context->makeContextCurrent();
+        int reasonForReset = m_glGetGraphicsResetStatusEXT();
+        if (reasonForReset != GL_NO_ERROR) {
+#if PLATFORM(BLACKBERRY)
+            // We cannot yet recreate our compositing thread, so just quit.
+            BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelCritical, "Robust OpenGL context has been reset. Aborting.");
+            CRASH();
+#endif
+            ASSERT(m_contextLostCallback);
+            if (m_contextLostCallback)
+                m_contextLostCallback->onContextLost();
+            m_contextResetStatus = reasonForReset;
+        }
+        return reasonForReset;
+    }
+
+    m_context->synthesizeGLError(GL_INVALID_OPERATION);
+    return false;
+}
+
+void Extensions3DOpenGLES::setEXTContextLostCallback(PassOwnPtr<GraphicsContext3D::ContextLostCallback> callback)
+{
+    m_contextLostCallback = callback;
+}
+
+void Extensions3DOpenGLES::readnPixelsEXT(int x, int y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, GC3Dsizei bufSize, void *data)
+{
+    if (m_glReadnPixelsEXT) {
+        m_context->makeContextCurrent();
+        // FIXME: remove the two glFlush calls when the driver bug is fixed, i.e.,
+        // all previous rendering calls should be done before reading pixels.
+        ::glFlush();
+
+        // FIXME: If non-BlackBerry platforms use this, they will need to implement
+        // their anti-aliasing code here.
+        m_glReadnPixelsEXT(x, y, width, height, format, type, bufSize, data);
+        return;
+    }
+
+    m_context->synthesizeGLError(GL_INVALID_OPERATION);
+}
+
+void Extensions3DOpenGLES::getnUniformfvEXT(GC3Duint program, int location, GC3Dsizei bufSize, float *params)
+{
+    if (m_glGetnUniformfvEXT) {
+        m_context->makeContextCurrent();
+        m_glGetnUniformfvEXT(program, location, bufSize, params);
+        return;
+    }
+
+    m_context->synthesizeGLError(GL_INVALID_OPERATION);
+}
+
+void Extensions3DOpenGLES::getnUniformivEXT(GC3Duint program, int location, GC3Dsizei bufSize, int *params)
+{
+    if (m_glGetnUniformivEXT) {
+        m_context->makeContextCurrent();
+        m_glGetnUniformivEXT(program, location, bufSize, params);
+        return;
+    }
+
+    m_context->synthesizeGLError(GL_INVALID_OPERATION);
+}
 
 bool Extensions3DOpenGLES::supportsExtension(const String& name)
 {
@@ -151,6 +230,11 @@ bool Extensions3DOpenGLES::supportsExtension(const String& name)
             m_glFramebufferTexture2DMultisampleIMG = reinterpret_cast<PFNGLFRAMEBUFFERTEXTURE2DMULTISAMPLEIMG>(eglGetProcAddress("glFramebufferTexture2DMultisampleIMG"));
             m_glRenderbufferStorageMultisampleIMG = reinterpret_cast<PFNGLRENDERBUFFERSTORAGEMULTISAMPLEIMG>(eglGetProcAddress("glRenderbufferStorageMultisampleIMG"));
             m_supportsIMGMultisampledRenderToTexture = true;
+        } else if (name == "GL_EXT_robustness" && !m_glGetGraphicsResetStatusEXT) {
+            m_glGetGraphicsResetStatusEXT = reinterpret_cast<PFNGLGETGRAPHICSRESETSTATUSEXTPROC>(eglGetProcAddress("glGetGraphicsResetStatusEXT"));
+            m_glReadnPixelsEXT = reinterpret_cast<PFNGLREADNPIXELSEXTPROC>(eglGetProcAddress("glReadnPixelsEXT"));
+            m_glGetnUniformfvEXT = reinterpret_cast<PFNGLGETNUNIFORMFVEXTPROC>(eglGetProcAddress("glGetnUniformfvEXT"));
+            m_glGetnUniformivEXT = reinterpret_cast<PFNGLGETNUNIFORMIVEXTPROC>(eglGetProcAddress("glGetnUniformivEXT"));
         }
         return true;
     }
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.h b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.h
index fcf72d6b5..1885880f2 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.h
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.h
@@ -38,6 +38,31 @@
 #define PFNGLRENDERBUFFERSTORAGEMULTISAMPLEIMG PFNGLRENDERBUFFERSTORAGEMULTISAMPLEIMGPROC
 #endif
 
+#ifndef GL_EXT_robustness
+/* reuse GL_NO_ERROR */
+#define GL_GUILTY_CONTEXT_RESET_EXT 0x8253
+#define GL_INNOCENT_CONTEXT_RESET_EXT 0x8254
+#define GL_UNKNOWN_CONTEXT_RESET_EXT 0x8255
+#define GL_CONTEXT_ROBUST_ACCESS_EXT 0x90F3
+#define GL_RESET_NOTIFICATION_STRATEGY_EXT 0x8256
+#define GL_LOSE_CONTEXT_ON_RESET_EXT 0x8252
+#define GL_NO_RESET_NOTIFICATION_EXT 0x8261
+#endif
+
+#ifndef GL_EXT_robustness
+#define GL_EXT_robustness 1
+#ifdef GL_GLEXT_PROTOTYPES
+GL_APICALL GC3Denum GL_APIENTRY glGetGraphicsResetStatusEXT(void);
+GL_APICALL void GL_APIENTRY glReadnPixelsEXT(GLint x, GLint y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, GC3Dsizei bufSize, void *data);
+GL_APICALL void GL_APIENTRY glGetnUniformfvEXT(GLuint program, GLint location, GC3Dsizei bufSize, float *params);
+GL_APICALL void GL_APIENTRY glGetnUniformivEXT(GLuint program, GLint location, GC3Dsizei bufSize, GLint *params);
+#endif
+typedef GC3Denum (GL_APIENTRYP PFNGLGETGRAPHICSRESETSTATUSEXTPROC) (void);
+typedef void (GL_APIENTRYP PFNGLREADNPIXELSEXTPROC) (GLint x, GLint y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, GC3Dsizei bufSize, void *data);
+typedef void (GL_APIENTRYP PFNGLGETNUNIFORMFVEXTPROC) (GLuint program, GLint location, GC3Dsizei bufSize, float *params);
+typedef void (GL_APIENTRYP PFNGLGETNUNIFORMIVEXTPROC) (GLuint program, GLint location, GC3Dsizei bufSize, GLint *params);
+#endif
+
 namespace WebCore {
 
 class Extensions3DOpenGLES : public Extensions3DOpenGLCommon {
@@ -57,6 +82,15 @@ public:
     virtual GC3Dboolean isVertexArrayOES(Platform3DObject);
     virtual void bindVertexArrayOES(Platform3DObject);
 
+    // EXT Robustness - reset
+    virtual int getGraphicsResetStatusARB();
+    void setEXTContextLostCallback(PassOwnPtr<GraphicsContext3D::ContextLostCallback>);
+
+    // EXT Robustness - etc
+    virtual void readnPixelsEXT(int x, int y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, GC3Dsizei bufSize, void *data);
+    virtual void getnUniformfvEXT(GC3Duint program, int location, GC3Dsizei bufSize, float *params);
+    virtual void getnUniformivEXT(GC3Duint program, int location, GC3Dsizei bufSize, int *params);
+
 protected:
     // This class only needs to be instantiated by GraphicsContext3D implementations.
     friend class GraphicsContext3D;
@@ -65,6 +99,8 @@ protected:
     virtual bool supportsExtension(const String&);
     virtual String getExtensions();
 
+    GC3Denum m_contextResetStatus;
+
     bool m_supportsOESvertexArrayObject;
     bool m_supportsIMGMultisampledRenderToTexture;
 
@@ -74,6 +110,12 @@ protected:
     PFNGLDELETEVERTEXARRAYSOESPROC m_glDeleteVertexArraysOES;
     PFNGLGENVERTEXARRAYSOESPROC m_glGenVertexArraysOES;
     PFNGLISVERTEXARRAYOESPROC m_glIsVertexArrayOES;
+    PFNGLGETGRAPHICSRESETSTATUSEXTPROC m_glGetGraphicsResetStatusEXT;
+    PFNGLREADNPIXELSEXTPROC m_glReadnPixelsEXT;
+    PFNGLGETNUNIFORMFVEXTPROC m_glGetnUniformfvEXT;
+    PFNGLGETNUNIFORMIVEXTPROC m_glGetnUniformivEXT;
+
+    OwnPtr<GraphicsContext3D::ContextLostCallback> m_contextLostCallback;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.h b/Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.h
index f0739575a..34ccee09e 100644
--- a/Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.h
+++ b/Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.h
@@ -25,6 +25,8 @@
 #ifndef OpenTypeVerticalData_h
 #define OpenTypeVerticalData_h
 
+#if ENABLE(OPENTYPE_VERTICAL)
+
 #include "Glyph.h"
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
@@ -56,8 +58,13 @@ private:
     Vector<int16_t> m_topSideBearings;
     int16_t m_defaultVertOriginY;
     HashMap<Glyph, int16_t> m_vertOriginY;
+
+    friend class FontCache;
+    bool m_inFontCache; // for mark & sweep in FontCache::purgeInactiveFontData()
 };
 
 } // namespace WebCore
 
+#endif // ENABLE(OPENTYPE_VERTICAL)
+
 #endif // OpenTypeVerticalData_h
diff --git a/Source/WebCore/platform/graphics/openvg/PainterOpenVG.cpp b/Source/WebCore/platform/graphics/openvg/PainterOpenVG.cpp
index a64f112de..802978343 100644
--- a/Source/WebCore/platform/graphics/openvg/PainterOpenVG.cpp
+++ b/Source/WebCore/platform/graphics/openvg/PainterOpenVG.cpp
@@ -713,6 +713,9 @@ void PainterOpenVG::translate(float dx, float dy)
 
 void PainterOpenVG::drawPath(const Path& path, VGbitfield specifiedPaintModes, WindRule fillRule)
 {
+    if (path.isNull())
+        return;
+
     ASSERT(m_state);
 
     VGbitfield paintModes = 0;
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index 895f76688..cb824f63c 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -34,10 +34,8 @@
 #include "OpenGLShims.h"
 #include "QWebPageClient.h"
 #include "SharedBuffer.h"
-#if HAVE(QT5)
 #include <QWindow>
 #include <qpa/qplatformpixmap.h>
-#endif
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
 
@@ -255,7 +253,6 @@ void GraphicsContext3DPrivate::blitMultisampleFramebufferAndRestoreContext() con
     if (!m_context->m_attrs.antialias)
         return;
 
-#if HAVE(QT5)
     const QOpenGLContext* currentContext = QOpenGLContext::currentContext();
     QSurface* currentSurface = 0;
     if (currentContext != m_platformContext) {
@@ -265,35 +262,14 @@ void GraphicsContext3DPrivate::blitMultisampleFramebufferAndRestoreContext() con
     blitMultisampleFramebuffer();
     if (currentSurface)
         const_cast<QOpenGLContext*>(currentContext)->makeCurrent(currentSurface);
-#else
-    const QGLContext* currentContext = QGLContext::currentContext();
-    const QGLContext* widgetContext = m_surface->context();
-    if (currentContext != widgetContext)
-        m_surface->makeCurrent();
-    blitMultisampleFramebuffer();
-    if (currentContext) {
-        if (currentContext != widgetContext)
-            const_cast<QGLContext*>(currentContext)->makeCurrent();
-    } else
-        m_surface->doneCurrent();
-#endif
 }
 
 bool GraphicsContext3DPrivate::makeCurrentIfNeeded() const
 {
-#if HAVE(QT5)
     const QOpenGLContext* currentContext = QOpenGLContext::currentContext();
     if (currentContext == m_platformContext)
         return true;
     return m_platformContext->makeCurrent(m_surface);
-#else
-    const QGLContext* currentContext = QGLContext::currentContext();
-    const QGLContext* widgetContext = m_surface->context();
-    if (currentContext != widgetContext)
-        m_surface->makeCurrent();
-
-    return QGLContext::currentContext() == widgetContext;
-#endif
 }
 
 void GraphicsContext3DPrivate::createGraphicsSurfaces(const IntSize& size)
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index d3f507dd3..cb81d6534 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -66,7 +66,7 @@
 #include <QVector>
 #include <wtf/MathExtras.h>
 
-#if OS(WINDOWS) && HAVE(QT5)
+#if OS(WINDOWS)
 Q_GUI_EXPORT QPixmap qt_pixmapFromWinHBITMAP(HBITMAP, int hbitmapFormat = 0);
 
 enum HBitmapFormat {
@@ -181,6 +181,41 @@ static inline Qt::FillRule toQtFillRule(WindRule rule)
     return Qt::OddEvenFill;
 }
 
+static inline void adjustPointsForDottedLine(FloatPoint& p1, FloatPoint& p2, float width, bool isVerticalLine)
+{
+    if (isVerticalLine) {
+        p1.setY(p1.y() - width / 2);
+        p2.setY(p2.y() + width / 2);
+    } else {
+        p1.setX(p1.x() - width / 2);
+        p2.setX(p2.x() + width / 2);
+    }
+}
+
+static inline void drawLineEndpointsForStyle(QPainter *painter, const FloatPoint& p1, const FloatPoint& p2, float width, bool isVerticalLine, StrokeStyle style, Color color)
+{
+    // Do a rect fill of our endpoints. This ensures we always have the
+    // appearance of being a border.
+    if (style == DashedStroke) {
+        if (isVerticalLine) {
+            painter->fillRect(FloatRect(p1.x() - width / 2, p1.y() - width, width, width), QColor(color));
+            painter->fillRect(FloatRect(p2.x() - width / 2, p2.y(), width, width), QColor(color));
+        } else {
+            painter->fillRect(FloatRect(p1.x() - width, p1.y() - width / 2, width, width), QColor(color));
+            painter->fillRect(FloatRect(p2.x(), p2.y() - width / 2, width, width), QColor(color));
+        }
+    }
+
+    // As per css spec a dotted stroke should be made of circles so we're
+    // drawing circles as endpoints.
+    if (style == DottedStroke) {
+        painter->setPen(Qt::NoPen);
+        painter->setBrush(QColor(color));
+        painter->drawEllipse(p1.x() - width / 2, p1.y() - width / 2, width, width);
+        painter->drawEllipse(p2.x() - width / 2, p2.y() - width / 2, width, width);
+    }
+}
+
 class GraphicsContextPlatformPrivate {
     WTF_MAKE_NONCOPYABLE(GraphicsContextPlatformPrivate); WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -357,31 +392,39 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
     adjustLineToPixelBoundaries(p1, p2, width, style);
 
+    Qt::PenCapStyle capStyle = Qt::FlatCap;
+    QVector<qreal> dashes;
     int patWidth = 0;
+
     switch (style) {
     case NoStroke:
     case SolidStroke:
         break;
-    case DottedStroke:
+    case DottedStroke: {
+        capStyle = Qt::RoundCap;
         patWidth = static_cast<int>(width);
+        // The actual length of one line element can not be set to zero and at 0.1 the dots
+        // are still slightly elongated. Setting it to 0.01 will make it look like the
+        // line endings are being stuck together, close enough to look like a circle.
+        // For the distance of the line elements we subtract the small amount again.
+        const qreal lineElementLength = 0.01;
+        dashes << lineElementLength << qreal(2 * patWidth) / width - lineElementLength;
+        adjustPointsForDottedLine(p1, p2, width, isVerticalLine);
         break;
+    }
     case DashedStroke:
+        capStyle = Qt::FlatCap;
         patWidth = 3 * static_cast<int>(width);
+        dashes << qreal(patWidth) / width << qreal(patWidth) / width;
         break;
     }
 
     if (patWidth) {
         p->save();
 
-        // Do a rect fill of our endpoints.  This ensures we always have the
-        // appearance of being a border.  We then draw the actual dotted/dashed line.
-        if (isVerticalLine) {
-            p->fillRect(FloatRect(p1.x() - width / 2, p1.y() - width, width, width), QColor(color));
-            p->fillRect(FloatRect(p2.x() - width / 2, p2.y(), width, width), QColor(color));
-        } else {
-            p->fillRect(FloatRect(p1.x() - width, p1.y() - width / 2, width, width), QColor(color));
-            p->fillRect(FloatRect(p2.x(), p2.y() - width / 2, width, width), QColor(color));
-        }
+        QPen pen = p->pen();
+
+        drawLineEndpointsForStyle(p, p1, p2, width, isVerticalLine, style, color);
 
         // Example: 80 pixels with a width of 30 pixels.
         // Remainder is 20.  The maximum pixels of line we could paint
@@ -411,12 +454,8 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
             }
         }
 
-        QVector<qreal> dashes;
-        dashes << qreal(patWidth) / width << qreal(patWidth) / width;
-
-        QPen pen = p->pen();
         pen.setWidthF(width);
-        pen.setCapStyle(Qt::FlatCap);
+        pen.setCapStyle(capStyle);
         pen.setDashPattern(dashes);
         pen.setDashOffset(patternOffset / width);
         p->setPen(pen);
@@ -1470,11 +1509,7 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
             GetObject(bitmap, sizeof(info), &info);
             ASSERT(info.bmBitsPixel == 32);
 
-#if HAVE(QT5)
             QPixmap pixmap = qt_pixmapFromWinHBITMAP(bitmap, supportAlphaBlend ? HBitmapPremultipliedAlpha : HBitmapNoAlpha);
-#else
-            QPixmap pixmap = QPixmap::fromWinHBITMAP(bitmap, supportAlphaBlend ? QPixmap::PremultipliedAlpha : QPixmap::NoAlpha);
-#endif
             m_data->p()->drawPixmap(dstRect, pixmap);
 
             ::DeleteObject(bitmap);
diff --git a/Source/WebCore/platform/graphics/qt/ImageQt.cpp b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
index 10fe1feb6..16330a40f 100644
--- a/Source/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -52,7 +52,7 @@
 
 #include <math.h>
 
-#if OS(WINDOWS) && HAVE(QT5)
+#if OS(WINDOWS)
 Q_GUI_EXPORT QPixmap qt_pixmapFromWinHBITMAP(HBITMAP, int hbitmapFormat = 0);
 #endif
 
@@ -299,11 +299,7 @@ void BitmapImage::checkForSolidColor()
 #if OS(WINDOWS)
 PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
 {
-#if HAVE(QT5)
     QImage* nativeImage = new QImage(qt_pixmapFromWinHBITMAP(hBitmap).toImage());
-#else
-    QImage* nativeImage = new QImage(QPixmap::fromWinHBITMAP(hBitmap).toImage());
-#endif
 
     return BitmapImage::create(nativeImage);
 }
diff --git a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
index 4c01f1dac..57908656e 100644
--- a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
@@ -148,12 +148,6 @@ void SimpleFontData::platformInit()
     float spaceWidth = fm.width(QLatin1Char(' '));
 #endif
 
-#if !HAVE(QT5)
-    // Qt subtracts 1 from the descent to account for the baseline,
-    // we add it back here to get correct metrics for WebKit.
-    descent += 1;
-#endif
-
     // The line spacing should always be >= (ascent + descent), but this
     // may be false in some cases due to misbehaving platform libraries.
     // Workaround from SimpleFontPango.cpp and SimpleFontFreeType.cpp
diff --git a/Source/WebCore/platform/graphics/skia/GradientSkia.cpp b/Source/WebCore/platform/graphics/skia/GradientSkia.cpp
index 23a1a3acb..e7008e015 100644
--- a/Source/WebCore/platform/graphics/skia/GradientSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GradientSkia.cpp
@@ -152,7 +152,7 @@ SkShader* Gradient::platformGradient()
             // negative radius, ask for zero instead.
             SkScalar radius0 = m_r0 >= 0.0f ? WebCoreFloatToSkScalar(m_r0) : 0;
             SkScalar radius1 = m_r1 >= 0.0f ? WebCoreFloatToSkScalar(m_r1) : 0;
-            m_gradient = SkGradientShader::CreateTwoPointRadial(m_p0, radius0, m_p1, radius1, colors, pos, static_cast<int>(countUsed), tile);
+            m_gradient = SkGradientShader::CreateTwoPointConical(m_p0, radius0, m_p1, radius1, colors, pos, static_cast<int>(countUsed), tile);
         }
 
         if (aspectRatio() != 1) {
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index 24f664522..35231a9da 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -68,14 +68,19 @@ namespace WebCore {
 
 namespace {
 
+// Return value % max, but account for value possibly being negative.
 inline int fastMod(int value, int max)
 {
-    int sign = SkExtractSign(value);
-
-    value = SkApplySign(value, sign);
+    bool isNeg = false;
+    if (value < 0) {
+        value = -value;
+        isNeg = true;
+    }
     if (value >= max)
         value %= max;
-    return SkApplySign(value, sign);
+    if (isNeg)
+        value = -value;
+    return value;
 }
 
 inline float square(float n)
@@ -241,7 +246,7 @@ void GraphicsContext::clip(const FloatRect& rect)
 
 void GraphicsContext::clip(const Path& path)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || path.isEmpty())
         return;
 
     platformContext()->clipPathAntiAliased(*path.platformPath());
@@ -252,7 +257,7 @@ void GraphicsContext::canvasClip(const Path& path)
     if (paintingDisabled())
         return;
 
-    platformContext()->canvasClipPath(*path.platformPath());
+    platformContext()->canvasClipPath(path.isNull() ? SkPath() : *path.platformPath());
 }
 
 void GraphicsContext::clipOut(const IntRect& rect)
@@ -269,7 +274,7 @@ void GraphicsContext::clipOut(const Path& p)
         return;
 
     // We must make a copy of the path, to mark it as inverse-filled.
-    SkPath path(*p.platformPath());
+    SkPath path(p.isNull() ? SkPath() : *p.platformPath());
     path.toggleInverseFillType();
     platformContext()->clipPathAntiAliased(path);
 }
@@ -282,7 +287,9 @@ void GraphicsContext::clipPath(const Path& pathToClip, WindRule clipRule)
     const SkPath* path = pathToClip.platformPath();
     SkPath::FillType ftype = (clipRule == RULE_EVENODD) ? SkPath::kEvenOdd_FillType : SkPath::kWinding_FillType;
     SkPath storage;
-    if (path->getFillType() != ftype) {
+    if (!path)
+        path = &storage;
+    else if (path->getFillType() != ftype) {
         storage = *path;
         storage.setFillType(ftype);
         path = &storage;
@@ -670,7 +677,7 @@ void GraphicsContext::drawRect(const IntRect& rect)
 
 void GraphicsContext::fillPath(const Path& pathToFill)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || pathToFill.isEmpty())
         return;
 
     const GraphicsContextState& state = m_state;
@@ -1044,7 +1051,7 @@ void GraphicsContext::strokeArc(const IntRect& r, int startAngle, int angleSpan)
 
 void GraphicsContext::strokePath(const Path& pathToStroke)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || pathToStroke.isEmpty())
         return;
 
     const SkPath& path = *pathToStroke.platformPath();
diff --git a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
index 929879dcf..a0af3d64a 100644
--- a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -178,7 +178,7 @@ static ResamplingMode limitResamplingMode(PlatformContextSkia* platformContext,
 static void drawResampledBitmap(SkCanvas& canvas, SkPaint& paint, const NativeImageSkia& bitmap, const SkIRect& srcIRect, const SkRect& destRect)
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("drawResampledBitmap", &canvas, 0);
+    TRACE_EVENT0("skia", "drawResampledBitmap");
 #endif
     // Apply forward transform to destRect to estimate required size of
     // re-sampled bitmap, and use only in calls required to resize, or that
@@ -227,7 +227,7 @@ static bool hasNon90rotation(PlatformContextSkia* context)
 static void paintSkBitmap(PlatformContextSkia* platformContext, const NativeImageSkia& bitmap, const SkIRect& srcRect, const SkRect& destRect, const SkXfermode::Mode& compOp)
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("paintSkBitmap", platformContext, 0);
+    TRACE_EVENT0("skia", "paintSkBitmap");
 #endif
     SkPaint paint;
     paint.setXfermodeMode(compOp);
@@ -274,25 +274,6 @@ static void paintSkBitmap(PlatformContextSkia* platformContext, const NativeImag
     platformContext->didDrawRect(destRect, paint, &bitmap.bitmap());
 }
 
-// Transforms the given dimensions with the given matrix. Used to see how big
-// images will be once transformed.
-static void TransformDimensions(const SkMatrix& matrix, float srcWidth, float srcHeight, float* destWidth, float* destHeight)
-{
-    // Transform 3 points to see how long each side of the bitmap will be.
-    SkPoint srcPoints[3]; // (0, 0), (width, 0), (0, height).
-    srcPoints[0].set(0, 0);
-    srcPoints[1].set(SkFloatToScalar(srcWidth), 0);
-    srcPoints[2].set(0, SkFloatToScalar(srcHeight));
-
-    // Now measure the length of the two transformed vectors relative to the
-    // transformed origin to see how big the bitmap will be. Note: for skews,
-    // this isn't the best thing, but we don't have skews.
-    SkPoint destPoints[3];
-    matrix.mapPoints(destPoints, srcPoints, 3);
-    *destWidth = SkScalarToFloat((destPoints[1] - destPoints[0]).length());
-    *destHeight = SkScalarToFloat((destPoints[2] - destPoints[0]).length());
-}
-
 // A helper method for translating negative width and height values.
 FloatRect normalizeRect(const FloatRect& rect)
 {
@@ -332,7 +313,7 @@ void Image::drawPattern(GraphicsContext* context,
                         const FloatRect& destRect)
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("Image::drawPattern", this, 0);
+    TRACE_EVENT0("skia", "Image::drawPattern");
 #endif
     FloatRect normSrcRect = normalizeRect(floatSrcRect);
     if (destRect.isEmpty() || normSrcRect.isEmpty())
@@ -350,9 +331,11 @@ void Image::drawPattern(GraphicsContext* context,
     // Figure out what size the bitmap will be in the destination. The
     // destination rect is the bounds of the pattern, we need to use the
     // matrix to see how big it will be.
-    float destBitmapWidth, destBitmapHeight;
-    TransformDimensions(totalMatrix, srcRect.width(), srcRect.height(),
-                        &destBitmapWidth, &destBitmapHeight);
+    SkRect destRectTarget;
+    totalMatrix.mapRect(&destRectTarget, normSrcRect);
+
+    float destBitmapWidth = SkScalarToFloat(destRectTarget.width());
+    float destBitmapHeight = SkScalarToFloat(destRectTarget.height());
 
     // Compute the resampling mode.
     ResamplingMode resampling;
diff --git a/Source/WebCore/platform/graphics/skia/NativeImageSkia.cpp b/Source/WebCore/platform/graphics/skia/NativeImageSkia.cpp
index 7cc23c4f4..7e34c079d 100644
--- a/Source/WebCore/platform/graphics/skia/NativeImageSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/NativeImageSkia.cpp
@@ -75,7 +75,7 @@ SkBitmap NativeImageSkia::resizedBitmap(const SkIRect& srcSubset,
                                         const SkIRect& destVisibleSubset) const
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("NativeImageSkia::resizedBitmap", const_cast<NativeImageSkia*>(this), 0);
+    TRACE_EVENT0("skia", "NativeImageSkia::resizedBitmap");
 #endif
     if (!hasResizedBitmap(srcSubset, destWidth, destHeight)) {
         bool shouldCache = isDataComplete()
@@ -85,7 +85,7 @@ SkBitmap NativeImageSkia::resizedBitmap(const SkIRect& srcSubset,
         m_image.extractSubset(&subset, srcSubset);
         if (!shouldCache) {
 #if PLATFORM(CHROMIUM)
-            TRACE_EVENT("nonCachedResize", const_cast<NativeImageSkia*>(this), 0);
+            TRACE_EVENT0("skia", "nonCachedResize");
 #endif
             // Just resize the visible subset and return it.
             SkBitmap resizedImage = skia::ImageOperations::Resize(subset, skia::ImageOperations::RESIZE_LANCZOS3, destWidth, destHeight, destVisibleSubset);
@@ -93,7 +93,7 @@ SkBitmap NativeImageSkia::resizedBitmap(const SkIRect& srcSubset,
             return resizedImage;
         } else {
 #if PLATFORM(CHROMIUM)
-            TRACE_EVENT("cachedResize", const_cast<NativeImageSkia*>(this), 0);
+            TRACE_EVENT0("skia", "cachedResize");
 #endif
             m_resizedImage = skia::ImageOperations::Resize(subset, skia::ImageOperations::RESIZE_LANCZOS3, destWidth, destHeight);
         }
diff --git a/Source/WebCore/platform/graphics/skia/PathSkia.cpp b/Source/WebCore/platform/graphics/skia/PathSkia.cpp
index 8795b4c3c..47587525d 100644
--- a/Source/WebCore/platform/graphics/skia/PathSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PathSkia.cpp
@@ -44,13 +44,13 @@
 namespace WebCore {
 
 Path::Path()
+    : m_path(0)
 {
-    m_path = new SkPath;
 }
 
 Path::Path(const Path& other)
 {
-    m_path = new SkPath(*other.m_path);
+    m_path = other.m_path ? new SkPath(*other.m_path) : 0;
 }
 
 #if PLATFORM(BLACKBERRY)
@@ -62,28 +62,41 @@ Path::Path(const SkPath& path)
 
 Path::~Path()
 {
-    delete m_path;
+    if (m_path)
+        delete m_path;
+}
+
+PlatformPathPtr Path::ensurePlatformPath()
+{
+    if (!m_path)
+        m_path = new SkPath();
+    return m_path;
 }
 
 Path& Path::operator=(const Path& other)
 {
-    *m_path = *other.m_path;
+    if (other.isNull()) {
+        if (m_path)
+            delete m_path;
+        m_path = 0;
+    } else
+        *ensurePlatformPath() = *other.m_path;
     return *this;
 }
 
 bool Path::isEmpty() const
 {
-    return m_path->isEmpty();
+    return isNull() || m_path->isEmpty();
 }
 
 bool Path::hasCurrentPoint() const
 {
-    return m_path->getPoints(NULL, 0) != 0;
+    return !isNull() && m_path->getPoints(0, 0);
 }
 
 FloatPoint Path::currentPoint() const 
 {
-    if (m_path->countPoints() > 0) {
+    if (!isNull() && m_path->countPoints() > 0) {
         SkPoint skResult;
         m_path->getLastPt(&skResult);
         FloatPoint result;
@@ -92,57 +105,64 @@ FloatPoint Path::currentPoint() const
         return result;
     }
 
+    // FIXME: Why does this return quietNaN? Other ports return 0,0.
     float quietNaN = std::numeric_limits<float>::quiet_NaN();
     return FloatPoint(quietNaN, quietNaN);
 }
 
 bool Path::contains(const FloatPoint& point, WindRule rule) const
 {
-    return SkPathContainsPoint(m_path, point,
-      rule == RULE_NONZERO ? SkPath::kWinding_FillType : SkPath::kEvenOdd_FillType);
+    if (isNull())
+        return false;
+    return SkPathContainsPoint(m_path, point, rule == RULE_NONZERO ? SkPath::kWinding_FillType : SkPath::kEvenOdd_FillType);
 }
 
 void Path::translate(const FloatSize& size)
 {
-    m_path->offset(WebCoreFloatToSkScalar(size.width()), WebCoreFloatToSkScalar(size.height()));
+    ensurePlatformPath()->offset(WebCoreFloatToSkScalar(size.width()), WebCoreFloatToSkScalar(size.height()));
 }
 
 FloatRect Path::boundingRect() const
 {
+    if (isNull())
+        return FloatRect();
     return m_path->getBounds();
 }
 
 void Path::moveTo(const FloatPoint& point)
 {
-    m_path->moveTo(point);
+    ensurePlatformPath()->moveTo(point);
 }
 
 void Path::addLineTo(const FloatPoint& point)
 {
-    m_path->lineTo(point);
+    ensurePlatformPath()->lineTo(point);
 }
 
 void Path::addQuadCurveTo(const FloatPoint& cp, const FloatPoint& ep)
 {
-    m_path->quadTo(cp, ep);
+    ensurePlatformPath()->quadTo(cp, ep);
 }
 
 void Path::addBezierCurveTo(const FloatPoint& p1, const FloatPoint& p2, const FloatPoint& ep)
 {
-    m_path->cubicTo(p1, p2, ep);
+    ensurePlatformPath()->cubicTo(p1, p2, ep);
 }
 
 void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
 {
-    m_path->arcTo(p1, p2, WebCoreFloatToSkScalar(radius));
+    ensurePlatformPath()->arcTo(p1, p2, WebCoreFloatToSkScalar(radius));
 }
 
 void Path::closeSubpath()
 {
-    m_path->close();
+    ensurePlatformPath()->close();
 }
 
-void Path::addArc(const FloatPoint& p, float r, float sa, float ea, bool anticlockwise) {
+void Path::addArc(const FloatPoint& p, float r, float sa, float ea, bool anticlockwise)
+{
+    ensurePlatformPath(); // Make sure m_path is not null.
+
     SkScalar cx = WebCoreFloatToSkScalar(p.x());
     SkScalar cy = WebCoreFloatToSkScalar(p.y());
     SkScalar radius = WebCoreFloatToSkScalar(r);
@@ -180,16 +200,18 @@ void Path::addArc(const FloatPoint& p, float r, float sa, float ea, bool anticlo
 
 void Path::addRect(const FloatRect& rect)
 {
-    m_path->addRect(rect);
+    ensurePlatformPath()->addRect(rect);
 }
 
 void Path::addEllipse(const FloatRect& rect)
 {
-    m_path->addOval(rect);
+    ensurePlatformPath()->addOval(rect);
 }
 
 void Path::clear()
 {
+    if (isNull())
+        return;
     m_path->reset();
 }
 
@@ -204,6 +226,9 @@ static FloatPoint* convertPathPoints(FloatPoint dst[], const SkPoint src[], int
 
 void Path::apply(void* info, PathApplierFunction function) const
 {
+    if (isNull())
+        return;
+
     SkPath::RawIter iter(*m_path);
     SkPoint pts[4];
     PathElement pathElement;
@@ -240,11 +265,14 @@ void Path::apply(void* info, PathApplierFunction function) const
 
 void Path::transform(const AffineTransform& xform)
 {
-    m_path->transform(xform);
+    ensurePlatformPath()->transform(xform);
 }
 
 FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
+    if (isNull())
+        return FloatRect();
+
     GraphicsContext* scratch = scratchContext();
     scratch->save();
 
@@ -263,6 +291,9 @@ FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 
 bool Path::strokeContains(StrokeStyleApplier* applier, const FloatPoint& point) const
 {
+    if (isNull())
+        return false;
+
     ASSERT(applier);
     GraphicsContext* scratch = scratchContext();
     scratch->save();
@@ -273,10 +304,10 @@ bool Path::strokeContains(StrokeStyleApplier* applier, const FloatPoint& point)
     scratch->platformContext()->setupPaintForStroking(&paint, 0, 0);
     SkPath strokePath;
     paint.getFillPath(*platformPath(), &strokePath);
-    bool contains = SkPathContainsPoint(&strokePath, point,
-                                        SkPath::kWinding_FillType);
+    bool contains = SkPathContainsPoint(&strokePath, point, SkPath::kWinding_FillType);
 
     scratch->restore();
     return contains;
 }
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index 50df71146..394688f4a 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -583,7 +583,7 @@ void PlatformContextSkia::paintSkPaint(const SkRect& rect,
 const SkBitmap* PlatformContextSkia::bitmap() const
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("PlatformContextSkia::bitmap", this, 0);
+    TRACE_EVENT0("skia", "PlatformContextSkia::bitmap");
 #endif
     return &m_canvas->getDevice()->accessBitmap(false);
 }
diff --git a/Source/WebCore/platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp b/Source/WebCore/platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp
index 544e94d32..bfa20ba35 100644
--- a/Source/WebCore/platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp
+++ b/Source/WebCore/platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp
@@ -26,7 +26,7 @@
 #include <CGLCurrent.h>
 #include <CGLIOSurface.h>
 #include <IOSurface/IOSurface.h>
-
+#include <OpenGL/gl.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
index 2802933a9..f2051ecb6 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
@@ -273,6 +273,16 @@ void GraphicsLayerTextureMapper::setDrawsContent(bool value)
 
 /* \reimp (GraphicsLayer.h)
 */
+void GraphicsLayerTextureMapper::setContentsVisible(bool value)
+{
+    if (value == contentsAreVisible())
+        return;
+    notifyChange(TextureMapperLayer::ContentsVisibleChange);
+    GraphicsLayer::setContentsVisible(value);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
 void GraphicsLayerTextureMapper::setContentsOpaque(bool value)
 {
     if (value == contentsOpaque())
@@ -368,7 +378,7 @@ bool GraphicsLayerTextureMapper::addAnimation(const KeyframeValueList& valueList
     if (valueList.property() == AnimatedPropertyWebkitTransform)
         listsMatch = validateTransformOperations(valueList, hasBigRotation) >= 0;
 
-    m_animations.add(keyframesName, GraphicsLayerAnimation(valueList, boxSize, anim, timeOffset, listsMatch));
+    m_animations.add(GraphicsLayerAnimation(keyframesName, valueList, boxSize, anim, timeOffset, listsMatch));
     notifyChange(TextureMapperLayer::AnimationChange);
     m_animationStartedTimer.startOneShot(0);
     return true;
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
index c5cbbac04..c4d42f1fc 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
@@ -60,6 +60,7 @@ public:
     virtual void setPreserves3D(bool b);
     virtual void setMasksToBounds(bool b);
     virtual void setDrawsContent(bool b);
+    virtual void setContentsVisible(bool);
     virtual void setContentsOpaque(bool b);
     virtual void setBackfaceVisibility(bool b);
     virtual void setOpacity(float opacity);
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.h b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
index 7793f70ad..3d9452b76 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -24,11 +24,8 @@
 
 #if PLATFORM(QT)
 #include <qglobal.h>
-
-#if defined(QT_OPENGL_LIB) || HAVE(QT5)
-    #if defined(QT_OPENGL_ES_2) && !defined(TEXMAP_OPENGL_ES_2)
-        #define TEXMAP_OPENGL_ES_2
-    #endif
+#if defined(QT_OPENGL_ES_2) && !defined(TEXMAP_OPENGL_ES_2)
+    #define TEXMAP_OPENGL_ES_2
 #endif
 #endif
 
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
index 86704bc15..c6b1e2825 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
@@ -38,11 +38,7 @@
 
 #if PLATFORM(QT)
 #include "NativeImageQt.h"
-#if HAVE(QT5)
 #include <QOpenGLContext>
-#else
-#include <QGLContext>
-#endif // QT_VERSION
 #elif OS(WINDOWS)
 #include <windows.h>
 #elif OS(MAC_OS_X)
@@ -62,19 +58,11 @@ namespace WebCore {
 struct TextureMapperGLData {
     struct SharedGLData : public RefCounted<SharedGLData> {
 #if PLATFORM(QT)
-#if QT_VERSION >= 0x050000
         typedef QOpenGLContext* GLContext;
         static GLContext getCurrentGLContext()
         {
             return QOpenGLContext::currentContext();
         }
-#else
-        typedef const QGLContext* GLContext;
-        static GLContext getCurrentGLContext()
-        {
-            return QGLContext::currentContext();
-        }
-#endif
 #elif OS(WINDOWS)
         typedef HGLRC GLContext;
         static GLContext getCurrentGLContext()
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
index cf88009be..e58bd7381 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
@@ -103,7 +103,7 @@ void TextureMapperLayer::updateBackingStore(TextureMapper* textureMapper, Graphi
     if (!m_shouldUpdateBackingStoreFromLayer)
         return;
 
-    if (!m_state.drawsContent || m_size.isEmpty()) {
+    if (!m_state.drawsContent || !m_state.contentsVisible || m_size.isEmpty()) {
         m_backingStore.clear();
         return;
     }
@@ -157,7 +157,7 @@ void TextureMapperLayer::paint()
 
 void TextureMapperLayer::paintSelf(const TextureMapperPaintOptions& options)
 {
-    if (!m_state.visible)
+    if (!m_state.visible || !m_state.contentsVisible)
         return;
 
     // We apply the following transform to compensate for painting into a surface, and then apply the offset so that the painting fits in the target rect.
@@ -294,6 +294,8 @@ bool TextureMapperLayer::isVisible() const
         return false;
     if (!m_state.visible && m_children.isEmpty())
         return false;
+    if (!m_state.contentsVisible && m_children.isEmpty())
+        return false;
     if (m_opacity < 0.01)
         return false;
     return true;
@@ -472,6 +474,7 @@ void TextureMapperLayer::syncCompositingStateSelf(GraphicsLayerTextureMapper* gr
     m_state.preserves3D = graphicsLayer->preserves3D();
     m_state.masksToBounds = graphicsLayer->masksToBounds();
     m_state.drawsContent = graphicsLayer->drawsContent();
+    m_state.contentsVisible = graphicsLayer->contentsAreVisible();
     m_state.contentsOpaque = graphicsLayer->contentsOpaque();
     m_state.backfaceVisibility = graphicsLayer->backfaceVisibility();
     m_state.childrenTransform = graphicsLayer->childrenTransform();
@@ -487,7 +490,7 @@ void TextureMapperLayer::syncCompositingStateSelf(GraphicsLayerTextureMapper* gr
         m_state.needsDisplayRect.unite(graphicsLayer->needsDisplayRect());
     m_contentsLayer = graphicsLayer->contentsLayer();
 
-    m_transform.setPosition(m_state.pos);
+    m_transform.setPosition(adjustedPosition());
     m_transform.setAnchorPoint(m_state.anchorPoint);
     m_transform.setSize(m_state.size);
     m_transform.setFlattening(!m_state.preserves3D);
@@ -567,17 +570,17 @@ bool TextureMapperLayer::isAncestorFixedToViewport() const
     return false;
 }
 
-void TextureMapperLayer::setScrollPositionDeltaIfNeeded(const IntPoint& delta)
+void TextureMapperLayer::setScrollPositionDeltaIfNeeded(const FloatSize& delta)
 {
     // delta is the difference between the scroll offset in the ui process and the scroll offset
     // in the web process. We add this delta to the position of fixed layers, to make
     // sure that they do not move while scrolling. We need to reset this delta to fixed layers
     // that have an ancestor which is also a fixed layer, because the delta will be added to the ancestor.
     if (isAncestorFixedToViewport())
-        m_scrollPositionDelta = IntPoint();
+        m_scrollPositionDelta = FloatSize();
     else
         m_scrollPositionDelta = delta;
-    m_transform.setPosition(m_state.pos + m_scrollPositionDelta);
+    m_transform.setPosition(adjustedPosition());
 }
 
 void TextureMapperLayer::setDebugBorder(const Color& color, float width)
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
index de0da3856..af52e9895 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
@@ -83,16 +83,17 @@ public:
         Preserves3DChange =         (1L << 12),
         MasksToBoundsChange =       (1L << 13),
         DrawsContentChange =        (1L << 14),
-        ContentsOpaqueChange =      (1L << 15),
+        ContentsVisibleChange =     (1L << 15),
+        ContentsOpaqueChange =      (1L << 16),
 
-        BackfaceVisibilityChange =  (1L << 16),
-        ChildrenTransformChange =   (1L << 17),
-        DisplayChange =             (1L << 18),
-        BackgroundColorChange =     (1L << 19),
+        BackfaceVisibilityChange =  (1L << 17),
+        ChildrenTransformChange =   (1L << 18),
+        DisplayChange =             (1L << 19),
+        BackgroundColorChange =     (1L << 20),
 
-        ReplicaLayerChange =        (1L << 20),
-        AnimationChange =           (1L << 21),
-        FilterChange =              (1L << 22)
+        ReplicaLayerChange =        (1L << 21),
+        AnimationChange =           (1L << 22),
+        FilterChange =              (1L << 23)
     };
 
     enum SyncOptions {
@@ -128,7 +129,7 @@ public:
     PassRefPtr<TextureMapperBackingStore> backingStore() { return m_backingStore; }
     void clearBackingStoresRecursive();
 
-    void setScrollPositionDeltaIfNeeded(const IntPoint&);
+    void setScrollPositionDeltaIfNeeded(const FloatSize&);
 
     void setDebugBorder(const Color&, float width);
 
@@ -149,6 +150,7 @@ private:
     static void sortByZOrder(Vector<TextureMapperLayer* >& array, int first, int last);
 
     PassRefPtr<BitmapTexture> texture() { return m_backingStore ? m_backingStore->texture() : 0; }
+    FloatPoint adjustedPosition() const { return m_state.pos + m_scrollPositionDelta; }
     bool isAncestorFixedToViewport() const;
 
     void paintRecursive(const TextureMapperPaintOptions&);
@@ -211,6 +213,7 @@ private:
         bool preserves3D : 1;
         bool masksToBounds : 1;
         bool drawsContent : 1;
+        bool contentsVisible : 1;
         bool contentsOpaque : 1;
         bool backfaceVisibility : 1;
         bool visible : 1;
@@ -224,6 +227,7 @@ private:
             , preserves3D(false)
             , masksToBounds(false)
             , drawsContent(false)
+            , contentsVisible(true)
             , contentsOpaque(false)
             , backfaceVisibility(false)
             , visible(true)
@@ -237,7 +241,7 @@ private:
     State m_state;
     TextureMapper* m_textureMapper;
     GraphicsLayerAnimations m_animations;
-    IntPoint m_scrollPositionDelta;
+    FloatSize m_scrollPositionDelta;
     bool m_fixedToViewport;
     Color m_debugBorderColor;
     float m_debugBorderWidth;
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
index df97d631c..53038b4ee 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
@@ -28,7 +28,6 @@
 #include "TransformationMatrix.h"
 
 #include "AffineTransform.h"
-#include "FractionalLayoutRect.h"
 #include "FloatPoint3D.h"
 #include "FloatRect.h"
 #include "FloatQuad.h"
@@ -614,10 +613,10 @@ FloatQuad TransformationMatrix::projectQuad(const FloatQuad& q) const
 static float clampEdgeValue(float f)
 {
     ASSERT(!isnan(f));
-    return min<float>(max<float>(f, -MAX_LAYOUT_UNIT / 2), MAX_LAYOUT_UNIT / 2);
+    return min<float>(max<float>(f, -FractionalLayoutUnit::max() / 2), FractionalLayoutUnit::max() / 2);
 }
 
-LayoutRect TransformationMatrix::clampedBoundsOfProjectedQuad(const FloatQuad& q) const
+FractionalLayoutRect TransformationMatrix::clampedBoundsOfProjectedQuad(const FloatQuad& q) const
 {
     FloatRect mappedQuadBounds = projectQuad(q).boundingBox();
 
@@ -626,18 +625,18 @@ LayoutRect TransformationMatrix::clampedBoundsOfProjectedQuad(const FloatQuad& q
 
     float right;
     if (isinf(mappedQuadBounds.x()) && isinf(mappedQuadBounds.width()))
-        right = MAX_LAYOUT_UNIT / 2;
+        right = FractionalLayoutUnit::max() / 2;
     else
         right = clampEdgeValue(ceilf(mappedQuadBounds.maxX()));
 
     float bottom;
     if (isinf(mappedQuadBounds.y()) && isinf(mappedQuadBounds.height()))
-        bottom = MAX_LAYOUT_UNIT / 2;
+        bottom = FractionalLayoutUnit::max() / 2;
     else
         bottom = clampEdgeValue(ceilf(mappedQuadBounds.maxY()));
-    
-    return LayoutRect(clampToLayoutUnit(left), clampToLayoutUnit(top), 
-                      clampToLayoutUnit(right - left), clampToLayoutUnit(bottom - top));
+
+    return FractionalLayoutRect(FractionalLayoutUnit::clamp(left), FractionalLayoutUnit::clamp(top), 
+                                FractionalLayoutUnit::clamp(right - left), FractionalLayoutUnit::clamp(bottom - top));
 }
 
 FloatPoint TransformationMatrix::mapPoint(const FloatPoint& p) const
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
index b164d7927..ca68c57aa 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -27,8 +27,8 @@
 #define TransformationMatrix_h
 
 #include "FloatPoint.h"
+#include "FractionalLayoutRect.h"
 #include "IntPoint.h"
-#include "LayoutTypes.h"
 #include <string.h> //for memcpy
 #include <wtf/FastAllocBase.h>
 
@@ -167,7 +167,7 @@ public:
     FloatQuad projectQuad(const FloatQuad&) const;
     // Projects the four corners of the quad and takes a bounding box,
     // while sanitizing values created when the w component is negative.
-    LayoutRect clampedBoundsOfProjectedQuad(const FloatQuad&) const;
+    FractionalLayoutRect clampedBoundsOfProjectedQuad(const FloatQuad&) const;
 
     double m11() const { return m_matrix[0][0]; }
     void setM11(double f) { m_matrix[0][0] = f; }
diff --git a/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp b/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
index 46e2ce800..4e5f7e86e 100644
--- a/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
+++ b/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
@@ -1330,6 +1330,9 @@ Color gradientAverageColor(const Gradient* gradient)
 
 void GraphicsContext::fillPath(const Path& path)
 {
+    if (path.isNull())
+        return;
+
     Color c = m_state.fillGradient
         ? gradientAverageColor(m_state.fillGradient.get())
         : fillColor();
@@ -1369,7 +1372,7 @@ void GraphicsContext::fillPath(const Path& path)
 
 void GraphicsContext::strokePath(const Path& path)
 {
-    if (!m_data->m_opacity)
+    if (path.isNull() || !m_data->m_opacity)
         return;
 
     ScopeDCProvider dcProvider(m_data);
diff --git a/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp b/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
index 9d5487011..6d59eae7d 100644
--- a/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
@@ -396,10 +396,11 @@ void GraphicsContext::clipPath(const Path& path, WindRule clipRule)
 {
     if (paintingDisabled())
         return;
-        
+
+    // FIXME: Why does this method ignore empty paths?
     if (path.isEmpty())
         return; 
-    
+
     wxGraphicsContext* gc = m_data->context->GetGraphicsContext();
 
 #if wxUSE_CAIRO
@@ -638,6 +639,9 @@ InterpolationQuality GraphicsContext::imageInterpolationQuality() const
 
 void GraphicsContext::fillPath(const Path& path)
 {
+    if (path.isNull())
+        return;
+
 #if USE(WXGC)
     wxGraphicsContext* gc = m_data->context->GetGraphicsContext();
     if (gc)
@@ -647,6 +651,9 @@ void GraphicsContext::fillPath(const Path& path)
 
 void GraphicsContext::strokePath(const Path& path)
 {
+    if (path.isNull())
+        return;
+
 #if USE(WXGC)
     wxGraphicsContext* gc = m_data->context->GetGraphicsContext();
     if (gc)
diff --git a/Source/WebCore/platform/graphics/wx/PathWx.cpp b/Source/WebCore/platform/graphics/wx/PathWx.cpp
index 2b010f64f..e183dfdc2 100644
--- a/Source/WebCore/platform/graphics/wx/PathWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/PathWx.cpp
@@ -49,30 +49,14 @@ int getWxWindRuleForWindRule(WindRule rule)
 }
 
 Path::Path() 
-{ 
-    m_path = 0;
-    // NB: This only supports the 'default' renderer as determined by wx on
-    // each platform. If an app uses a non-default renderer (e.g. Cairo on Win),  
-    // there will be problems, but there's no way we can determine which 
-    // renderer an app is using right now with wx API, so we will just handle
-    // the common case.
-#if USE(WXGC)
-    wxGraphicsRenderer* renderer = 0;
-#if wxUSE_CAIRO
-    renderer = wxGraphicsRenderer::GetCairoRenderer();
-#else
-    renderer = wxGraphicsRenderer::GetDefaultRenderer();
-#endif
-    if (renderer) {
-        wxGraphicsPath path = renderer->CreatePath();
-        m_path = new wxGraphicsPath(path);
-    }
-#endif
+    : m_path(0)
+{
 }
 
 Path::~Path()
 {
-    clear();
+    if (m_path)
+        delete m_path;
 }
 
 Path::Path(const Path& path)
@@ -102,9 +86,8 @@ void Path::translate(const FloatSize&)
 FloatRect Path::boundingRect() const 
 { 
 #if USE(WXGC)
-    if (m_path) {
-        return m_path->GetBox();     
-    }
+    if (m_path)
+        return m_path->GetBox();
 #endif
 
     return FloatRect();
@@ -124,32 +107,46 @@ bool Path::strokeContains(StrokeStyleApplier*, const FloatPoint&) const
 
 Path& Path::operator=(const Path& path)
 { 
-    *m_path = *path.platformPath();
+    *ensurePlatformPath() = *path.platformPath();
     return *this; 
 }
 
-void Path::clear() 
-{ 
+PlatformPathPtr Path::ensurePlatformPath()
+{
     if (m_path)
-        delete m_path;
+        return m_path;
 
+    // NB: This only supports the 'default' renderer as determined by wx on
+    // each platform. If an app uses a non-default renderer (e.g. Cairo on Win),
+    // there will be problems, but there's no way we can determine which
+    // renderer an app is using right now with wx API, so we will just handle
+    // the common case.
 #if USE(WXGC)
+    wxGraphicsRenderer* renderer = 0;
 #if wxUSE_CAIRO
-    wxGraphicsRenderer* renderer = wxGraphicsRenderer::GetCairoRenderer();
+    renderer = wxGraphicsRenderer::GetCairoRenderer();
 #else
-    wxGraphicsRenderer* renderer = wxGraphicsRenderer::GetDefaultRenderer();
+    renderer = wxGraphicsRenderer::GetDefaultRenderer();
 #endif
     if (renderer) {
         wxGraphicsPath path = renderer->CreatePath();
         m_path = new wxGraphicsPath(path);
     }
 #endif
+    return m_path;
+}
+
+void Path::clear()
+{ 
+    if (m_path)
+        delete m_path;
+    m_path = 0;
 }
 
 void Path::moveTo(const FloatPoint& point) 
 {
 #if USE(WXGC)
-    if (m_path)
+    if (ensurePlatformPath())
         m_path->MoveToPoint(point.x(), point.y());
 #endif
 }
@@ -157,7 +154,7 @@ void Path::moveTo(const FloatPoint& point)
 void Path::addLineTo(const FloatPoint& point) 
 {
 #if USE(WXGC)
-    if (m_path)
+    if (ensurePlatformPath())
         m_path->AddLineToPoint(point.x(), point.y());
 #endif
 }
@@ -165,7 +162,7 @@ void Path::addLineTo(const FloatPoint& point)
 void Path::addQuadCurveTo(const FloatPoint& control, const FloatPoint& end) 
 {
 #if USE(WXGC)
-    if (m_path)
+    if (ensurePlatformPath())
         m_path->AddQuadCurveToPoint(control.x(), control.y(), end.x(), end.y());
 #endif
 }
@@ -173,7 +170,7 @@ void Path::addQuadCurveTo(const FloatPoint& control, const FloatPoint& end)
 void Path::addBezierCurveTo(const FloatPoint& control1, const FloatPoint& control2, const FloatPoint& end) 
 {
 #if USE(WXGC)
-    if (m_path)
+    if (ensurePlatformPath())
         m_path->AddCurveToPoint(control1.x(), control1.y(), control2.x(), control2.y(), end.x(), end.y());
 #endif
 }
@@ -181,7 +178,7 @@ void Path::addBezierCurveTo(const FloatPoint& control1, const FloatPoint& contro
 void Path::addArcTo(const FloatPoint& point1, const FloatPoint& point2, float radius) 
 {
 #if USE(WXGC)
-    if (m_path)
+    if (ensurePlatformPath())
         m_path->AddArcToPoint(point1.x(), point1.y(), point2.x(), point2.y(), radius);
 #endif
 }
@@ -189,7 +186,7 @@ void Path::addArcTo(const FloatPoint& point1, const FloatPoint& point2, float ra
 void Path::closeSubpath() 
 {
 #if USE(WXGC)
-    if (m_path)
+    if (ensurePlatformPath())
         m_path->CloseSubpath();
 #endif
 }
@@ -197,7 +194,7 @@ void Path::closeSubpath()
 void Path::addArc(const FloatPoint& point, float radius, float startAngle, float endAngle, bool clockwise) 
 {
 #if USE(WXGC)
-    if (m_path)
+    if (ensurePlatformPath())
         m_path->AddArc(point.x(), point.y(), radius, startAngle, endAngle, clockwise);
 #endif
 }
@@ -205,7 +202,7 @@ void Path::addArc(const FloatPoint& point, float radius, float startAngle, float
 void Path::addRect(const FloatRect& rect) 
 {
 #if USE(WXGC)
-    if (m_path)
+    if (ensurePlatformPath())
         m_path->AddRectangle(rect.x(), rect.y(), rect.width(), rect.height());
 #endif
 }
@@ -213,7 +210,7 @@ void Path::addRect(const FloatRect& rect)
 void Path::addEllipse(const FloatRect& rect) 
 {
 #if USE(WXGC)
-    if (m_path)
+    if (ensurePlatformPath())
         m_path->AddEllipse(rect.x(), rect.y(), rect.width(), rect.height());
 #endif
 }
@@ -221,7 +218,7 @@ void Path::addEllipse(const FloatRect& rect)
 void Path::transform(const AffineTransform& transform) 
 {
 #if USE(WXGC)
-    if (m_path)
+    if (ensurePlatformPath())
         m_path->Transform(transform);
 #endif
 }
@@ -248,7 +245,7 @@ bool Path::hasCurrentPoint() const
     return !isEmpty();
 }
 
-FloatPoint Path::currentPoint() const 
+FloatPoint Path::currentPoint() const
 {
     // FIXME: return current point of subpath.
     float quietNaN = std::numeric_limits<float>::quiet_NaN();
diff --git a/Source/WebCore/platform/gtk/ClipboardGtk.h b/Source/WebCore/platform/gtk/ClipboardGtk.h
index 9af53e5f5..b071c6f7e 100644
--- a/Source/WebCore/platform/gtk/ClipboardGtk.h
+++ b/Source/WebCore/platform/gtk/ClipboardGtk.h
@@ -27,7 +27,7 @@
 #ifndef ClipboardGtk_h
 #define ClipboardGtk_h
 
-#include "CachedImage.h"
+#include "CachedImageClient.h"
 #include "Clipboard.h"
 #include "DataObjectGtk.h"
 
diff --git a/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp b/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
index 4bb2ce086..81af05bb7 100644
--- a/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
+++ b/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
@@ -473,6 +473,12 @@ String crashedPluginText()
     return String::fromUTF8(_("Plug-in Failure"));
 }
 
+String blockedPluginByContentSecurityPolicyText()
+{
+    notImplemented();
+    return String();
+}
+
 String insecurePluginVersionText()
 {
     notImplemented();
@@ -717,6 +723,11 @@ String validationMessageStepMismatchText(const String&, const String&)
     return String::fromUTF8(_("step mismatch"));
 }
 
+String unacceptableTLSCertificate()
+{
+    return String::fromUTF8(_("Unacceptable TLS certificate"));
+}
+
 String localizedString(const char* key)
 {
     return String::fromUTF8(key, strlen(key));
diff --git a/Source/WebCore/platform/gtk/PasteboardGtk.cpp b/Source/WebCore/platform/gtk/PasteboardGtk.cpp
index bd6e0290b..fe5a1f1d9 100644
--- a/Source/WebCore/platform/gtk/PasteboardGtk.cpp
+++ b/Source/WebCore/platform/gtk/PasteboardGtk.cpp
@@ -68,14 +68,15 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     helper->writeClipboardContents(clipboard, canSmartCopyOrDelete ? PasteboardHelper::IncludeSmartPaste : PasteboardHelper::DoNotIncludeSmartPaste);
 }
 
-void Pasteboard::writePlainText(const String& text)
+void Pasteboard::writePlainText(const String& text, SmartReplaceOption smartReplaceOption)
 {
     GtkClipboard* clipboard = gtk_clipboard_get_for_display(gdk_display_get_default(), GDK_SELECTION_CLIPBOARD);
     DataObjectGtk* dataObject = DataObjectGtk::forClipboard(clipboard);
     dataObject->clearAll();
 
     dataObject->setText(text);
-    PasteboardHelper::defaultPasteboardHelper()->writeClipboardContents(clipboard);
+    PasteboardHelper::defaultPasteboardHelper()->writeClipboardContents(clipboard,
+        (smartReplaceOption == CanSmartReplace) ? PasteboardHelper::IncludeSmartPaste : PasteboardHelper::DoNotIncludeSmartPaste);
 }
 
 void Pasteboard::writeURL(const KURL& url, const String& label, Frame* frame)
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
index 72b5ddc2d..995110827 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
@@ -277,6 +277,15 @@ template <MatchType type> int getScaledValue(const Vector<int>& scaledValues, in
 
 }
 
+bool ImageDecoder::frameHasAlphaAtIndex(size_t index) const
+{
+    if (m_frameBufferCache.size() <= index)
+        return true;
+    if (m_frameBufferCache[index].status() == ImageFrame::FrameComplete)
+        return m_frameBufferCache[index].hasAlpha();
+    return true;
+}
+
 void ImageDecoder::prepareScaleDataIfNecessary()
 {
     m_scaled = false;
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.h b/Source/WebCore/platform/image-decoders/ImageDecoder.h
index 911878e1d..f2aaecc47 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.h
@@ -276,6 +276,9 @@ namespace WebCore {
         // ImageDecoder-owned pointer.
         virtual ImageFrame* frameBufferAtIndex(size_t) = 0;
 
+        // Make the best effort guess to check if the requested frame has alpha channel.
+        virtual bool frameHasAlphaAtIndex(size_t) const;
+
         void setIgnoreGammaAndColorProfile(bool flag) { m_ignoreGammaAndColorProfile = flag; }
         bool ignoresGammaAndColorProfile() const { return m_ignoreGammaAndColorProfile; }
 
diff --git a/Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp b/Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp
index 20a248c7d..43ef518de 100644
--- a/Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp
@@ -95,7 +95,7 @@ bool BMPImageDecoder::setFailed()
 void BMPImageDecoder::decode(bool onlySize)
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("BMPImageDecoder::decode", this, 0);
+    TRACE_EVENT0("webkit", "BMPImageDecoder::decode");
 #endif
     if (failed())
         return;
diff --git a/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp b/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
index 5f6193b8f..724ea0d13 100644
--- a/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
@@ -315,7 +315,7 @@ void GIFImageDecoder::gifComplete()
 void GIFImageDecoder::decode(unsigned haltAtFrame, GIFQuery query)
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("GIFImageDecoder::decode", this, 0);
+    TRACE_EVENT0("webkit", "GIFImageDecoder::decode");
 #endif
     if (failed())
         return;
diff --git a/Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp b/Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
index 3a03e54c9..36dde1cdd 100644
--- a/Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
@@ -158,7 +158,7 @@ void ICOImageDecoder::setDataForPNGDecoderAtIndex(size_t index)
 void ICOImageDecoder::decode(size_t index, bool onlySize)
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("ICOImageDecoder::decode", this, 0);
+    TRACE_EVENT0("webkit", "ICOImageDecoder::decode");
 #endif
     if (failed())
         return;
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index 91f1236b3..bef4203a5 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -648,7 +648,7 @@ void JPEGImageDecoder::jpegComplete()
 void JPEGImageDecoder::decode(bool onlySize)
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("JPEGImageDecoder::decode", this, 0);
+    TRACE_EVENT0("webkit", "JPEGImageDecoder::decode");
 #endif
     if (failed())
         return;
diff --git a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
index 138d5c512..158debb5a 100644
--- a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
@@ -531,7 +531,7 @@ void PNGImageDecoder::pngComplete()
 void PNGImageDecoder::decode(bool onlySize)
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("PNGImageDecoder::decode", this, 0);
+    TRACE_EVENT0("webkit", "PNGImageDecoder::decode");
 #endif
     if (failed())
         return;
diff --git a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
index 082e33ddb..612890f31 100644
--- a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
@@ -88,7 +88,7 @@ ImageFrame* WEBPImageDecoder::frameBufferAtIndex(size_t index)
 bool WEBPImageDecoder::decode(bool onlySize)
 {
 #if PLATFORM(CHROMIUM)
-    TRACE_EVENT("WEBPImageDecoder::decode", this, 0);
+    TRACE_EVENT0("webkit", "WEBPImageDecoder::decode");
 #endif
     if (failed())
         return false;
diff --git a/Source/WebCore/platform/mac/ClipboardMac.h b/Source/WebCore/platform/mac/ClipboardMac.h
index 1fe7398e2..75517c161 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.h
+++ b/Source/WebCore/platform/mac/ClipboardMac.h
@@ -27,6 +27,7 @@
 #define ClipboardMac_h
 
 #include "CachedImage.h"
+#include "CachedImageClient.h"
 #include "Clipboard.h"
 #include <wtf/RetainPtr.h>
 
diff --git a/Source/WebCore/platform/mac/ClipboardMac.mm b/Source/WebCore/platform/mac/ClipboardMac.mm
index 7004d23b0..1af14df9c 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.mm
+++ b/Source/WebCore/platform/mac/ClipboardMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "ClipboardMac.h"
 
+#import "CachedImageClient.h"
 #import "DOMElementInternal.h"
 #import "DragClient.h"
 #import "DragController.h"
@@ -383,7 +384,7 @@ void ClipboardMac::writeRange(Range* range, Frame* frame)
 void ClipboardMac::writePlainText(const String& text)
 {
     Pasteboard pasteboard(m_pasteboardName);
-    pasteboard.writePlainText(text);
+    pasteboard.writePlainText(text, Pasteboard::CannotSmartReplace);
 }
 
 void ClipboardMac::writeURL(const KURL& url, const String& title, Frame* frame)
diff --git a/Source/WebCore/platform/mac/PasteboardMac.mm b/Source/WebCore/platform/mac/PasteboardMac.mm
index 604aa7fae..750130fc4 100644
--- a/Source/WebCore/platform/mac/PasteboardMac.mm
+++ b/Source/WebCore/platform/mac/PasteboardMac.mm
@@ -204,12 +204,17 @@ void Pasteboard::writeSelectionForTypes(const Vector<String>& pasteboardTypes, b
         platformStrategies()->pasteboardStrategy()->setBufferForType(0, WebSmartPastePboardType, m_pasteboardName);
 }
 
-void Pasteboard::writePlainText(const String& text)
+void Pasteboard::writePlainText(const String& text, SmartReplaceOption smartReplaceOption)
 {
     Vector<String> types;
     types.append(NSStringPboardType);
+    if (smartReplaceOption == CanSmartReplace)
+        types.append(WebSmartPastePboardType);
+
     platformStrategies()->pasteboardStrategy()->setTypes(types, m_pasteboardName);
     platformStrategies()->pasteboardStrategy()->setStringForType(text, NSStringPboardType, m_pasteboardName);
+    if (smartReplaceOption == CanSmartReplace)
+        platformStrategies()->pasteboardStrategy()->setBufferForType(0, WebSmartPastePboardType, m_pasteboardName);
 }
     
 void Pasteboard::writeSelection(Range*, bool canSmartCopyOrDelete, Frame* frame)
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
index 323719bd6..96aa12a26 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -484,13 +484,8 @@ static void scrollbarPainterPaint(ScrollbarPainter scrollbarPainter, bool enable
     [scrollbarPainter setDoubleValue:value];
     [scrollbarPainter setKnobProportion:proportion];
 
-    // The scrollbar's frameRect includes a side inset for overlay scrollers, so we have to use the 
-    // trackWidth for drawKnobSlotInRect
-    NSRect trackRect;
-    if ([scrollbarPainter isHorizontal])
-        trackRect = NSMakeRect(0, 0, frameRect.size.width, [scrollbarPainter trackWidth]);
-    else
-        trackRect = NSMakeRect(0, 0, [scrollbarPainter trackWidth], frameRect.size.height);
+    // Use rectForPart: here; it will take the expansion transition progress into account.
+    NSRect trackRect = [scrollbarPainter rectForPart:NSScrollerKnobSlot];
     [scrollbarPainter drawKnobSlotInRect:trackRect highlight:NO];
 
     // If the scrollbar is not enabled, then there is nothing to scroll to, and we shouldn't
diff --git a/Source/WebCore/platform/mediastream/MediaStreamSource.h b/Source/WebCore/platform/mediastream/MediaStreamSource.h
index c45b57142..b093f34f0 100644
--- a/Source/WebCore/platform/mediastream/MediaStreamSource.h
+++ b/Source/WebCore/platform/mediastream/MediaStreamSource.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2011 Ericsson AB. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,6 +48,11 @@ public:
         virtual void sourceChangedState() = 0;
     };
 
+    class ExtraData : public RefCounted<ExtraData> {
+    public:
+        virtual ~ExtraData() { }
+    };
+
     enum Type {
         TypeAudio,
         TypeVideo
@@ -70,6 +76,9 @@ public:
     void addObserver(Observer*);
     void removeObserver(Observer*);
 
+    PassRefPtr<ExtraData> extraData() const { return m_extraData; }
+    void setExtraData(PassRefPtr<ExtraData> extraData) { m_extraData = extraData; }
+
 private:
     MediaStreamSource(const String& id, Type, const String& name, ReadyState);
 
@@ -78,6 +87,7 @@ private:
     String m_name;
     ReadyState m_readyState;
     Vector<Observer*> m_observers;
+    RefPtr<ExtraData> m_extraData;
 };
 
 typedef Vector<RefPtr<MediaStreamSource> > MediaStreamSourceVector;
diff --git a/Source/WebCore/platform/mediastream/RTCConfiguration.h b/Source/WebCore/platform/mediastream/RTCConfiguration.h
new file mode 100644
index 000000000..c96889fdc
--- /dev/null
+++ b/Source/WebCore/platform/mediastream/RTCConfiguration.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RTCConfiguration_h
+#define RTCConfiguration_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "KURL.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class RTCIceServer : public RefCounted<RTCIceServer> {
+public:
+    static PassRefPtr<RTCIceServer> create(const KURL& uri, const String& credential)
+    {
+        return adoptRef(new RTCIceServer(uri, credential));
+    }
+    virtual ~RTCIceServer() { }
+
+    const KURL& uri() { return m_uri; }
+    const String& credential() { return m_credential; }
+
+private:
+    RTCIceServer(const KURL& uri, const String& credential)
+        : m_uri(uri)
+        , m_credential(credential)
+    {
+    }
+
+    KURL m_uri;
+    String m_credential;
+};
+
+class RTCConfiguration : public RefCounted<RTCConfiguration> {
+public:
+    static PassRefPtr<RTCConfiguration> create() { return adoptRef(new RTCConfiguration()); }
+    virtual ~RTCConfiguration() { }
+
+    void appendServer(PassRefPtr<RTCIceServer> server) { m_servers.append(server); }
+    size_t numberOfServers() { return m_servers.size(); }
+    RTCIceServer* server(size_t index) { return m_servers[index].get(); }
+
+ private:
+    RTCConfiguration() { }
+
+    Vector<RefPtr<RTCIceServer> > m_servers;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // RTCConfiguration_h
diff --git a/Source/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp b/Source/WebCore/platform/mediastream/RTCPeerConnectionHandler.cpp
index b536bbfc6..af5400c80 100644
--- a/Source/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
+++ b/Source/WebCore/platform/mediastream/RTCPeerConnectionHandler.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,39 +29,49 @@
  */
 
 #include "config.h"
-#include "V8Float32Array.h"
 
-#include <wtf/ArrayBuffer.h>
-#include <wtf/Float32Array.h>
+#if ENABLE(MEDIA_STREAM)
 
-#include "V8Binding.h"
-#include "V8ArrayBuffer.h"
-#include "V8ArrayBufferViewCustom.h"
-#include "V8Proxy.h"
+#include "RTCPeerConnectionHandler.h"
+
+#include "RTCPeerConnectionHandlerClient.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-v8::Handle<v8::Value> V8Float32Array::constructorCallback(const v8::Arguments& args)
+// Dummy implementations below for ports that build with MEDIA_STREAM enabled by default.
+
+class RTCPeerConnectionHandlerDummy : public RTCPeerConnectionHandler {
+public:
+    RTCPeerConnectionHandlerDummy(RTCPeerConnectionHandlerClient*);
+    virtual ~RTCPeerConnectionHandlerDummy();
+
+    virtual bool initialize() OVERRIDE;
+
+private:
+    RTCPeerConnectionHandlerClient* m_client;
+};
+
+PassOwnPtr<RTCPeerConnectionHandler> RTCPeerConnectionHandler::create(RTCPeerConnectionHandlerClient* client)
 {
-    INC_STATS("DOM.Float32Array.Contructor");
+    return adoptPtr(new RTCPeerConnectionHandlerDummy(client));
+}
 
-    return constructWebGLArray<Float32Array, float>(args, &info, v8::kExternalFloatArray);
+RTCPeerConnectionHandlerDummy::RTCPeerConnectionHandlerDummy(RTCPeerConnectionHandlerClient* client)
+    : m_client(client)
+{
+    ASSERT(m_client);
 }
 
-v8::Handle<v8::Value> V8Float32Array::setCallback(const v8::Arguments& args)
+RTCPeerConnectionHandlerDummy::~RTCPeerConnectionHandlerDummy()
 {
-    INC_STATS("DOM.Float32Array.set()");
-    return setWebGLArrayHelper<Float32Array, V8Float32Array>(args);
 }
 
-v8::Handle<v8::Value> toV8(Float32Array* impl, v8::Isolate* isolate)
+bool RTCPeerConnectionHandlerDummy::initialize()
 {
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8Float32Array::wrap(impl, isolate);
-    if (!wrapper.IsEmpty())
-        wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), v8::kExternalFloatArray, impl->length());
-    return wrapper;
+    return false;
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/platform/mediastream/RTCPeerConnectionHandler.h b/Source/WebCore/platform/mediastream/RTCPeerConnectionHandler.h
new file mode 100644
index 000000000..a7f31fc06
--- /dev/null
+++ b/Source/WebCore/platform/mediastream/RTCPeerConnectionHandler.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RTCPeerConnectionHandler_h
+#define RTCPeerConnectionHandler_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class RTCPeerConnectionHandlerClient;
+
+class RTCPeerConnectionHandler {
+public:
+    static PassOwnPtr<RTCPeerConnectionHandler> create(RTCPeerConnectionHandlerClient*);
+    virtual ~RTCPeerConnectionHandler() { }
+
+    virtual bool initialize() = 0;
+
+protected:
+    RTCPeerConnectionHandler() { }
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // RTCPeerConnectionHandler_h
diff --git a/Source/WebCore/platform/mediastream/RTCPeerConnectionHandlerClient.h b/Source/WebCore/platform/mediastream/RTCPeerConnectionHandlerClient.h
new file mode 100644
index 000000000..bad9f32b9
--- /dev/null
+++ b/Source/WebCore/platform/mediastream/RTCPeerConnectionHandlerClient.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google AB. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RTCPeerConnectionHandlerClient_h
+#define RTCPeerConnectionHandlerClient_h
+
+#if ENABLE(MEDIA_STREAM)
+
+namespace WebCore {
+
+class RTCPeerConnectionHandlerClient {
+public:
+    virtual ~RTCPeerConnectionHandlerClient() { }
+
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // RTCPeerConnectionHandlerClient_h
diff --git a/Source/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp b/Source/WebCore/platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp
index 0270f7e89..b89be72eb 100644
--- a/Source/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp
+++ b/Source/WebCore/platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,38 +29,37 @@
  */
 
 #include "config.h"
-#include <wtf/ArrayBuffer.h>
-#include <wtf/Int32Array.h>
 
-#include "V8Binding.h"
-#include "V8ArrayBuffer.h"
-#include "V8ArrayBufferViewCustom.h"
-#include "V8Int32Array.h"
-#include "V8Proxy.h"
+#if ENABLE(MEDIA_STREAM)
+
+#include "RTCPeerConnectionHandlerChromium.h"
+
+#include "RTCPeerConnectionHandlerClient.h"
+#include <public/Platform.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-v8::Handle<v8::Value> V8Int32Array::constructorCallback(const v8::Arguments& args)
+PassOwnPtr<RTCPeerConnectionHandler> RTCPeerConnectionHandler::create(RTCPeerConnectionHandlerClient* client)
 {
-    INC_STATS("DOM.Int32Array.Contructor");
+    return adoptPtr(new RTCPeerConnectionHandlerChromium(client));
+}
 
-    return constructWebGLArray<Int32Array, int>(args, &info, v8::kExternalIntArray);
+RTCPeerConnectionHandlerChromium::RTCPeerConnectionHandlerChromium(RTCPeerConnectionHandlerClient*)
+{
 }
 
-v8::Handle<v8::Value> V8Int32Array::setCallback(const v8::Arguments& args)
+RTCPeerConnectionHandlerChromium::~RTCPeerConnectionHandlerChromium()
 {
-    INC_STATS("DOM.Int32Array.set()");
-    return setWebGLArrayHelper<Int32Array, V8Int32Array>(args);
 }
 
-v8::Handle<v8::Value> toV8(Int32Array* impl, v8::Isolate* isolate)
+bool RTCPeerConnectionHandlerChromium::initialize()
 {
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8Int32Array::wrap(impl, isolate);
-    if (!wrapper.IsEmpty())
-        wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), v8::kExternalIntArray, impl->length());
-    return wrapper;
+    m_webHandler = adoptPtr(WebKit::Platform::current()->createRTCPeerConnectionHandler(this));
+    // FIXME: Change the default value to false once the mock WebRTCPeerConnectionHandler has landed.
+    return m_webHandler ? m_webHandler->initialize() : true;
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h b/Source/WebCore/platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h
new file mode 100644
index 000000000..1a6d16288
--- /dev/null
+++ b/Source/WebCore/platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RTCPeerConnectionHandlerChromium_h
+#define RTCPeerConnectionHandlerChromium_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "RTCPeerConnectionHandler.h"
+#include <public/WebRTCPeerConnectionHandler.h>
+#include <public/WebRTCPeerConnectionHandlerClient.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class RTCPeerConnectionHandlerChromium : public RTCPeerConnectionHandler, public WebKit::WebRTCPeerConnectionHandlerClient {
+public:
+    RTCPeerConnectionHandlerChromium(RTCPeerConnectionHandlerClient*);
+    virtual ~RTCPeerConnectionHandlerChromium();
+
+    virtual bool initialize() OVERRIDE;
+
+private:
+    OwnPtr<WebKit::WebRTCPeerConnectionHandler> m_webHandler;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // RTCPeerConnectionHandlerChromium_h
diff --git a/Source/WebCore/platform/network/ResourceHandle.h b/Source/WebCore/platform/network/ResourceHandle.h
index 840097006..fbea7c92a 100644
--- a/Source/WebCore/platform/network/ResourceHandle.h
+++ b/Source/WebCore/platform/network/ResourceHandle.h
@@ -168,6 +168,9 @@ public:
 
 #if USE(SOUP)
     static SoupSession* defaultSession();
+    static void setHostAllowsAnyHTTPSCertificate(const String&);
+    static void setClientCertificate(const String& host, GTlsCertificate*);
+    static void setIgnoreSSLErrors(bool);
 #endif
 
     // Used to work around the fact that you don't get any more NSURLConnection callbacks until you return from the one you're in.
diff --git a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
index ce203eae7..3aab2122c 100644
--- a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
+++ b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
@@ -47,7 +47,7 @@ static unsigned hashCredentialInfo(const String& url, const ProtectionSpace& spa
                                        static_cast<int>(space.serverType()),
                                        space.realm().utf8().data(),
                                        static_cast<int>(space.authenticationScheme()));
-    return StringHasher::computeHash(hashString.characters(), hashString.length());
+    return StringHasher::computeHashAndMaskTop8Bits(hashString.characters(), hashString.length());
 }
 
 CredentialBackingStore& credentialBackingStore()
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
index a6dd1a8ae..5780a3349 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
@@ -186,9 +186,7 @@ void NetworkJob::handleNotifyStatusReceived(int status, const String& message)
 
     m_response.setHTTPStatusText(message);
 
-    if (!isError(m_extendedStatusCode))
-        storeCredentials();
-    else if (isUnauthorized(m_extendedStatusCode)) {
+    if (isUnauthorized(m_extendedStatusCode)) {
         purgeCredentials();
         BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "Authentication failed, purge the stored credentials for this site.");
     }
@@ -231,7 +229,7 @@ void NetworkJob::notifyMultipartHeaderReceived(const char* key, const char* valu
         handleNotifyMultipartHeaderReceived(key, value);
 }
 
-void NetworkJob::notifyAuthReceived(BlackBerry::Platform::NetworkRequest::AuthType authType, const char* realm)
+void NetworkJob::notifyAuthReceived(BlackBerry::Platform::NetworkRequest::AuthType authType, const char* realm, bool success, bool requireCredentials)
 {
     using BlackBerry::Platform::NetworkRequest;
 
@@ -244,6 +242,9 @@ void NetworkJob::notifyAuthReceived(BlackBerry::Platform::NetworkRequest::AuthTy
     case NetworkRequest::AuthHTTPDigest:
         scheme = ProtectionSpaceAuthenticationSchemeHTTPDigest;
         break;
+    case NetworkRequest::AuthNegotiate:
+        scheme = ProtectionSpaceAuthenticationSchemeNegotiate;
+        break;
     case NetworkRequest::AuthHTTPNTLM:
         scheme = ProtectionSpaceAuthenticationSchemeNTLM;
         break;
@@ -258,7 +259,27 @@ void NetworkJob::notifyAuthReceived(BlackBerry::Platform::NetworkRequest::AuthTy
         return;
     }
 
-    m_newJobWithCredentialsStarted = sendRequestWithCredentials(serverType, scheme, realm);
+    if (success) {
+        // Update the credentials that will be stored to match the scheme that was actually used
+        AuthenticationChallenge& challenge = m_handle->getInternal()->m_currentWebChallenge;
+        if (!challenge.isNull()) {
+            const ProtectionSpace& oldSpace = challenge.protectionSpace();
+            if (oldSpace.authenticationScheme() != scheme) {
+                // The scheme might have changed, but the server type shouldn't have!
+                BLACKBERRY_ASSERT(serverType == oldSpace.serverType());
+                ProtectionSpace newSpace(oldSpace.host(), oldSpace.port(), oldSpace.serverType(), oldSpace.realm(), scheme);
+                m_handle->getInternal()->m_currentWebChallenge = AuthenticationChallenge(newSpace,
+                                                                                         challenge.proposedCredential(),
+                                                                                         challenge.previousFailureCount(),
+                                                                                         challenge.failureResponse(),
+                                                                                         challenge.error());
+            }
+        }
+        storeCredentials();
+        return;
+    }
+
+    m_newJobWithCredentialsStarted = sendRequestWithCredentials(serverType, scheme, realm, requireCredentials);
 }
 
 void NetworkJob::notifyStringHeaderReceived(const String& key, const String& value)
@@ -327,14 +348,14 @@ void NetworkJob::handleNotifyMultipartHeaderReceived(const String& key, const St
         }
 
         m_multipartResponse->setIsMultipartPayload(true);
-    } else {
-        if (key.lower() == "content-type") {
-            String contentType = value.lower();
-            m_multipartResponse->setMimeType(extractMIMETypeFromMediaType(contentType));
-            m_multipartResponse->setTextEncodingName(extractCharsetFromMediaType(contentType));
-        }
-        m_multipartResponse->setHTTPHeaderField(key, value);
     }
+
+    if (key.lower() == "content-type") {
+        String contentType = value.lower();
+        m_multipartResponse->setMimeType(extractMIMETypeFromMediaType(contentType));
+        m_multipartResponse->setTextEncodingName(extractCharsetFromMediaType(contentType));
+    }
+    m_multipartResponse->setHTTPHeaderField(key, value);
 }
 
 void NetworkJob::handleSetCookieHeader(const String& value)
@@ -510,7 +531,7 @@ bool NetworkJob::retryAsFTPDirectory()
     return startNewJobWithRequest(newRequest);
 }
 
-bool NetworkJob::startNewJobWithRequest(ResourceRequest& newRequest, bool increasRedirectCount)
+bool NetworkJob::startNewJobWithRequest(ResourceRequest& newRequest, bool increaseRedirectCount)
 {
     // m_frame can be null if this is a PingLoader job (See NetworkJob::initialize).
     // In this case we don't start new request.
@@ -538,7 +559,7 @@ bool NetworkJob::startNewJobWithRequest(ResourceRequest& newRequest, bool increa
         m_streamFactory,
         *m_frame,
         m_deferLoadingCount,
-        increasRedirectCount ? m_redirectCount + 1 : m_redirectCount);
+        increaseRedirectCount ? m_redirectCount + 1 : m_redirectCount);
     return true;
 }
 
@@ -674,7 +695,7 @@ bool NetworkJob::handleFTPHeader(const String& header)
     return true;
 }
 
-bool NetworkJob::sendRequestWithCredentials(ProtectionSpaceServerType type, ProtectionSpaceAuthenticationScheme scheme, const String& realm)
+bool NetworkJob::sendRequestWithCredentials(ProtectionSpaceServerType type, ProtectionSpaceAuthenticationScheme scheme, const String& realm, bool requireCredentials)
 {
     ASSERT(m_handle);
     if (!m_handle)
@@ -699,9 +720,13 @@ bool NetworkJob::sendRequestWithCredentials(ProtectionSpaceServerType type, Prot
     ProtectionSpace protectionSpace(host, port, type, realm, scheme);
 
     // We've got the scheme and realm. Now we need a username and password.
-    // First search the CredentialStorage.
-    Credential credential = CredentialStorage::get(protectionSpace);
-    if (!credential.isEmpty()) {
+    Credential credential;
+    if (!requireCredentials) {
+        // Don't overwrite any existing credentials with the empty credential
+        if (m_handle->getInternal()->m_currentWebChallenge.isNull())
+            m_handle->getInternal()->m_currentWebChallenge = AuthenticationChallenge(protectionSpace, credential, 0, m_response, ResourceError());
+    } else if (!(credential = CredentialStorage::get(protectionSpace)).isEmpty()) {
+        // First search the CredentialStorage.
         m_handle->getInternal()->m_currentWebChallenge = AuthenticationChallenge(protectionSpace, credential, 0, m_response, ResourceError());
         m_handle->getInternal()->m_currentWebChallenge.setStored(true);
     } else {
@@ -733,6 +758,8 @@ bool NetworkJob::sendRequestWithCredentials(ProtectionSpaceServerType type, Prot
                 m_handle->getInternal()->m_user = "";
                 m_handle->getInternal()->m_pass = "";
             } else {
+                if (m_handle->firstRequest().targetType() != ResourceRequest::TargetIsMainFrame && BlackBerry::Platform::Client::isChromeProcess())
+                    return false;
                 Credential inputCredential;
                 if (!m_frame->page()->chrome()->client()->platformPageClient()->authenticationChallenge(newURL, protectionSpace, inputCredential))
                     return false;
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.h b/Source/WebCore/platform/network/blackberry/NetworkJob.h
index b48c1ecc0..e39e539ab 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.h
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.h
@@ -67,8 +67,8 @@ public:
     void handleNotifyStatusReceived(int status, const String& message);
     virtual void notifyHeadersReceived(BlackBerry::Platform::NetworkRequest::HeaderList& headers);
     virtual void notifyMultipartHeaderReceived(const char* key, const char* value);
-    // Exists only to resolve ambiguity between char* and String parameters
-    virtual void notifyAuthReceived(BlackBerry::Platform::NetworkRequest::AuthType, const char* realm);
+    virtual void notifyAuthReceived(BlackBerry::Platform::NetworkRequest::AuthType, const char* realm, bool success, bool requireCredentials);
+    // notifyStringHeaderReceived exists only to resolve ambiguity between char* and String parameters
     void notifyStringHeaderReceived(const String& key, const String& value);
     void handleNotifyHeaderReceived(const String& key, const String& value);
     void handleNotifyMultipartHeaderReceived(const String& key, const String& value);
@@ -120,7 +120,7 @@ private:
 
     // The server needs authentication credentials. Search in the CredentialStorage
     // or prompt the user via dialog, then resend the request with the credentials.
-    bool sendRequestWithCredentials(ProtectionSpaceServerType, ProtectionSpaceAuthenticationScheme, const String& realm);
+    bool sendRequestWithCredentials(ProtectionSpaceServerType, ProtectionSpaceAuthenticationScheme, const String& realm, bool requireCredentials = true);
 
     void storeCredentials();
 
diff --git a/Source/WebCore/platform/network/blackberry/NetworkManager.cpp b/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
index b92a0a45c..118bd7144 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
@@ -97,6 +97,9 @@ bool NetworkManager::startJob(int playerId, const String& pageGroupName, PassRef
             case ProtectionSpaceAuthenticationSchemeHTTPDigest:
                 authType = BlackBerry::Platform::NetworkRequest::AuthHTTPDigest;
                 break;
+            case ProtectionSpaceAuthenticationSchemeNegotiate:
+                authType = BlackBerry::Platform::NetworkRequest::AuthNegotiate;
+                break;
             case ProtectionSpaceAuthenticationSchemeNTLM:
                 authType = BlackBerry::Platform::NetworkRequest::AuthHTTPNTLM;
                 break;
diff --git a/Source/WebCore/platform/network/chromium/ResourceResponse.cpp b/Source/WebCore/platform/network/chromium/ResourceResponse.cpp
index 189bc1f46..81ee3cf61 100644
--- a/Source/WebCore/platform/network/chromium/ResourceResponse.cpp
+++ b/Source/WebCore/platform/network/chromium/ResourceResponse.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google, Inc.
+ * Copyright (C) 2012 Google, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,8 @@ namespace WebCore {
 
 PassOwnPtr<CrossThreadResourceResponseData> ResourceResponse::doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData> data) const
 {
+    data->m_securityInfo = CString(m_securityInfo.data(), m_securityInfo.length());
+    data->m_httpVersion = m_httpVersion;
     data->m_appCacheID = m_appCacheID;
     data->m_appCacheManifestURL = m_appCacheManifestURL.copy();
     data->m_isMultipartPayload = m_isMultipartPayload;
@@ -38,14 +40,17 @@ PassOwnPtr<CrossThreadResourceResponseData> ResourceResponse::doPlatformCopyData
     data->m_wasAlternateProtocolAvailable = m_wasAlternateProtocolAvailable;
     data->m_wasFetchedViaProxy = m_wasFetchedViaProxy;
     data->m_responseTime = m_responseTime;
-    data->m_remoteIPAddress = m_remoteIPAddress;
+    data->m_remoteIPAddress = m_remoteIPAddress.isolatedCopy();
     data->m_remotePort = m_remotePort;
-    // Bug https://bugs.webkit.org/show_bug.cgi?id=60397 this doesn't support m_downloadedFile.
+    // Bug https://bugs.webkit.org/show_bug.cgi?id=60397 this doesn't support m_downloadedFile,
+    // or whatever values may be present in the opaque m_extraData structure.
     return data;
 }
 
 void ResourceResponse::doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData> data)
 {
+    m_securityInfo = data->m_securityInfo;
+    m_httpVersion = data->m_httpVersion;
     m_appCacheID = data->m_appCacheID;
     m_appCacheManifestURL = data->m_appCacheManifestURL.copy();
     m_isMultipartPayload = data->m_isMultipartPayload;
@@ -56,7 +61,8 @@ void ResourceResponse::doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseDat
     m_responseTime = data->m_responseTime;
     m_remoteIPAddress = data->m_remoteIPAddress;
     m_remotePort = data->m_remotePort;
-    // Bug https://bugs.webkit.org/show_bug.cgi?id=60397 this doesn't support m_downloadedFile.
+    // Bug https://bugs.webkit.org/show_bug.cgi?id=60397 this doesn't support m_downloadedFile,
+    // or whatever values may be present in the opaque m_extraData structure.
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/chromium/ResourceResponse.h b/Source/WebCore/platform/network/chromium/ResourceResponse.h
index 261c5745d..0dd8d6a43 100644
--- a/Source/WebCore/platform/network/chromium/ResourceResponse.h
+++ b/Source/WebCore/platform/network/chromium/ResourceResponse.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- * Copyright (C) 2008 Google, Inc.
+ * Copyright (C) 2012 Google, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -123,11 +123,6 @@ namespace WebCore {
     private:
         friend class ResourceResponseBase;
 
-        // An opaque value that contains some information regarding the security of
-        // the connection for this request, such as SSL connection info (empty
-        // string if not over HTTPS).
-        CString m_securityInfo;
-
         void doUpdateResourceResponse()
         {
             notImplemented();
@@ -136,6 +131,11 @@ namespace WebCore {
         PassOwnPtr<CrossThreadResourceResponseData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData>) const;
         void doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData>);
 
+        // An opaque value that contains some information regarding the security of
+        // the connection for this request, such as SSL connection info (empty
+        // string if not over HTTPS).
+        CString m_securityInfo;
+
         // HTTP version used in the response, if known.
         HTTPVersion m_httpVersion;
 
@@ -181,6 +181,8 @@ namespace WebCore {
     };
 
     struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
+        CString m_securityInfo;
+        ResourceResponse::HTTPVersion m_httpVersion;
         long long m_appCacheID;
         KURL m_appCacheManifestURL;
         bool m_isMultipartPayload;
diff --git a/Source/WebCore/platform/network/soup/ResourceError.h b/Source/WebCore/platform/network/soup/ResourceError.h
index 2d1136751..37880e52d 100644
--- a/Source/WebCore/platform/network/soup/ResourceError.h
+++ b/Source/WebCore/platform/network/soup/ResourceError.h
@@ -27,6 +27,9 @@
 #define ResourceError_h
 
 #include "ResourceErrorBase.h"
+#include <wtf/gobject/GRefPtr.h>
+
+typedef struct _GTlsCertificate GTlsCertificate;
 
 namespace WebCore {
 
@@ -34,13 +37,29 @@ class ResourceError : public ResourceErrorBase
 {
 public:
     ResourceError()
+        : m_tlsErrors(0)
     {
     }
 
     ResourceError(const String& domain, int errorCode, const String& failingURL, const String& localizedDescription)
         : ResourceErrorBase(domain, errorCode, failingURL, localizedDescription)
+        , m_tlsErrors(0)
     {
     }
+
+    ResourceError(const String& domain, int errorCode, const String& failingURL, const String& localizedDescription, unsigned tlsErrors, GTlsCertificate* certificate)
+        : ResourceErrorBase(domain, errorCode, failingURL, localizedDescription)
+        , m_tlsErrors(tlsErrors)
+        , m_certificate(certificate)
+    {
+    }
+
+    unsigned tlsErrors() const { return m_tlsErrors; }
+    GTlsCertificate* certificate() const { return m_certificate.get(); }
+
+private:
+    unsigned m_tlsErrors;
+    GRefPtr<GTlsCertificate> m_certificate;
 };
 
 }
diff --git a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 35d41abfb..69b344246 100644
--- a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -34,6 +34,7 @@
 #include "Frame.h"
 #include "GOwnPtrSoup.h"
 #include "HTTPParsers.h"
+#include "LocalizedStrings.h"
 #include "Logging.h"
 #include "MIMETypeRegistry.h"
 #include "NotImplemented.h"
@@ -55,7 +56,9 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
+#include <wtf/SHA1.h>
 #include <wtf/gobject/GRefPtr.h>
+#include <wtf/text/Base64.h>
 #include <wtf/text/CString.h>
 
 #if ENABLE(BLOB)
@@ -158,6 +161,42 @@ private:
     GRefPtr<GMainLoop> m_mainLoop;
 };
 
+class HostTLSCertificateSet {
+public:
+    void add(GTlsCertificate* certificate)
+    {
+        String certificateHash = computeCertificateHash(certificate);
+        if (!certificateHash.isEmpty())
+            m_certificates.add(certificateHash);
+    }
+
+    bool contains(GTlsCertificate* certificate)
+    {
+        return m_certificates.contains(computeCertificateHash(certificate));
+    }
+
+private:
+    static String computeCertificateHash(GTlsCertificate* certificate)
+    {
+        GByteArray* data = 0;
+        g_object_get(G_OBJECT(certificate), "certificate", &data, NULL);
+        if (!data)
+            return String();
+
+        static const size_t sha1HashSize = 20;
+        GRefPtr<GByteArray> certificateData = adoptGRef(data);
+        SHA1 sha1;
+        sha1.addBytes(certificateData->data, certificateData->len);
+
+        Vector<uint8_t, sha1HashSize> digest;
+        sha1.computeHash(digest);
+
+        return base64Encode(reinterpret_cast<const char*>(digest.data()), sha1HashSize);
+    }
+
+    HashSet<String> m_certificates;
+};
+
 static void cleanupSoupRequestOperation(ResourceHandle*, bool isDestroying);
 static void sendRequestCallback(GObject*, GAsyncResult*, gpointer);
 static void readCallback(GObject*, GAsyncResult*, gpointer);
@@ -167,6 +206,21 @@ static bool startNonHTTPRequest(ResourceHandle*, KURL);
 static int  milisecondsSinceRequest(double requestTime);
 #endif
 
+static bool gIgnoreSSLErrors = false;
+
+static HashSet<String>& allowsAnyHTTPSCertificateHosts()
+{
+    DEFINE_STATIC_LOCAL(HashSet<String>, hosts, ());
+    return hosts;
+}
+
+typedef HashMap<String, HostTLSCertificateSet> CertificatesMap;
+static CertificatesMap& clientCertificates()
+{
+    DEFINE_STATIC_LOCAL(CertificatesMap, certificates, ());
+    return certificates;
+}
+
 ResourceHandleInternal::~ResourceHandleInternal()
 {
 }
@@ -349,6 +403,13 @@ static ResourceError convertSoupErrorToResourceError(GError* error, SoupRequest*
                          String::fromUTF8(error->message));
 }
 
+static inline bool hasUnignoredTLSErrors(ResourceHandle* handle)
+{
+    return handle->getInternal()->m_response.soupMessageTLSErrors()
+        && !gIgnoreSSLErrors
+        && !allowsAnyHTTPSCertificateHosts().contains(handle->firstRequest().url().host().lower());
+}
+
 static void sendRequestCallback(GObject* source, GAsyncResult* res, gpointer data)
 {
     RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
@@ -384,6 +445,18 @@ static void sendRequestCallback(GObject* source, GAsyncResult* res, gpointer dat
             d->m_response.setSniffedContentType(sniffedType);
         }
         d->m_response.updateFromSoupMessage(soupMessage);
+
+        if (hasUnignoredTLSErrors(handle.get())) {
+            CertificatesMap::iterator iter = clientCertificates().find(handle->firstRequest().url().host().lower());
+            if (iter == clientCertificates().end() || !iter->second.contains(d->m_response.soupMessageCertificate())) {
+                GOwnPtr<char> uri(soup_uri_to_string(soup_request_get_uri(d->m_soupRequest.get()), FALSE));
+                client->didFail(handle.get(), ResourceError(g_quark_to_string(SOUP_HTTP_ERROR), SOUP_STATUS_SSL_FAILED,
+                                                            uri.get(), unacceptableTLSCertificate(),
+                                                            d->m_response.soupMessageTLSErrors(), d->m_response.soupMessageCertificate()));
+                cleanupSoupRequestOperation(handle.get());
+                return;
+            }
+        }
     } else {
         d->m_response.setURL(handle->firstRequest().url());
         const gchar* contentType = soup_request_get_content_type(d->m_soupRequest.get());
@@ -739,6 +812,21 @@ void ResourceHandle::cancel()
         g_cancellable_cancel(d->m_cancellable.get());
 }
 
+void ResourceHandle::setHostAllowsAnyHTTPSCertificate(const String& host)
+{
+    allowsAnyHTTPSCertificateHosts().add(host.lower());
+}
+
+void ResourceHandle::setClientCertificate(const String& host, GTlsCertificate* certificate)
+{
+    clientCertificates().add(host.lower(), HostTLSCertificateSet()).iterator->second.add(certificate);
+}
+
+void ResourceHandle::setIgnoreSSLErrors(bool ignoreSSLErrors)
+{
+    gIgnoreSSLErrors = ignoreSSLErrors;
+}
+
 static bool hasBeenSent(ResourceHandle* handle)
 {
     ResourceHandleInternal* d = handle->getInternal();
diff --git a/Source/WebCore/platform/qt/ClipboardQt.h b/Source/WebCore/platform/qt/ClipboardQt.h
index a03fa3b87..5d09c84f4 100644
--- a/Source/WebCore/platform/qt/ClipboardQt.h
+++ b/Source/WebCore/platform/qt/ClipboardQt.h
@@ -26,7 +26,7 @@
 #ifndef ClipboardQt_h
 #define ClipboardQt_h
 
-#include "CachedImage.h"
+#include "CachedImageClient.h"
 #include "Clipboard.h"
 
 QT_BEGIN_NAMESPACE
diff --git a/Source/WebCore/platform/qt/DeviceMotionProviderQt.h b/Source/WebCore/platform/qt/DeviceMotionProviderQt.h
index 21d978674..243600383 100644
--- a/Source/WebCore/platform/qt/DeviceMotionProviderQt.h
+++ b/Source/WebCore/platform/qt/DeviceMotionProviderQt.h
@@ -25,12 +25,6 @@
 #include <QAccelerometerFilter>
 #include <wtf/RefPtr.h>
 
-#if !HAVE(QT5)
-using QTM_NAMESPACE::QAccelerometer;
-using QTM_NAMESPACE::QAccelerometerFilter;
-using QTM_NAMESPACE::QAccelerometerReading;
-#endif
-
 namespace WebCore {
 
 class DeviceMotionController;
diff --git a/Source/WebCore/platform/qt/DeviceOrientationProviderQt.h b/Source/WebCore/platform/qt/DeviceOrientationProviderQt.h
index c4a22f74e..350298449 100644
--- a/Source/WebCore/platform/qt/DeviceOrientationProviderQt.h
+++ b/Source/WebCore/platform/qt/DeviceOrientationProviderQt.h
@@ -25,12 +25,6 @@
 #include <QRotationFilter>
 #include <wtf/RefPtr.h>
 
-#if !HAVE(QT5)
-using QTM_NAMESPACE::QRotationFilter;
-using QTM_NAMESPACE::QRotationReading;
-using QTM_NAMESPACE::QRotationSensor;
-#endif
-
 namespace WebCore {
 
 class DeviceOrientationProviderQt : public QRotationFilter {
diff --git a/Source/WebCore/platform/qt/GamepadsQt.cpp b/Source/WebCore/platform/qt/GamepadsQt.cpp
new file mode 100644
index 000000000..8ebe8ecc9
--- /dev/null
+++ b/Source/WebCore/platform/qt/GamepadsQt.cpp
@@ -0,0 +1,226 @@
+/*
+ * Copyright (C) 2012 INdT - Instituto Nokia de Tecnologia
+ * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Gamepads.h"
+
+#include "GamepadDeviceLinux.h"
+#include "GamepadList.h"
+
+#include <QObject>
+#include <QSocketNotifier>
+
+extern "C" {
+    #include <libudev.h>
+}
+
+#include <unistd.h>
+#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class GamepadDeviceLinuxQt : public QObject, public GamepadDeviceLinux {
+    Q_OBJECT
+public:
+    static PassOwnPtr<GamepadDeviceLinuxQt> create(const String& deviceFile)
+    {
+        return adoptPtr(new GamepadDeviceLinuxQt(deviceFile));
+    }
+    ~GamepadDeviceLinuxQt();
+
+private:
+    GamepadDeviceLinuxQt(const String&);
+    QSocketNotifier* m_notifier;
+
+private slots:
+    bool readCallback();
+};
+
+GamepadDeviceLinuxQt::GamepadDeviceLinuxQt(const String& deviceFile)
+    : QObject()
+    , GamepadDeviceLinux(deviceFile)
+{
+    if (m_fileDescriptor == -1)
+        return;
+
+    m_notifier = new QSocketNotifier(m_fileDescriptor, QSocketNotifier::Read, this);
+    connect(m_notifier, SIGNAL(activated(int)), this, SLOT(readCallback()));
+}
+
+GamepadDeviceLinuxQt::~GamepadDeviceLinuxQt()
+{
+}
+
+bool GamepadDeviceLinuxQt::readCallback()
+{
+    js_event event;
+    int len = read(m_fileDescriptor, &event, sizeof(js_event));
+    if (len != sizeof(event))
+        return false;
+    updateForEvent(event);
+    return true;
+}
+
+class GamepadsQt : public QObject {
+    Q_OBJECT
+public:
+    GamepadsQt(unsigned);
+
+    void registerDevice(const String&);
+    void unregisterDevice(const String&);
+
+    void updateGamepadList(GamepadList*);
+
+private slots:
+    void onGamePadChange();
+
+private:
+    ~GamepadsQt();
+    bool isGamepadDevice(struct udev_device*);
+
+    Vector<OwnPtr<GamepadDeviceLinuxQt> > m_slots;
+    HashMap<String, GamepadDeviceLinuxQt*> m_deviceMap;
+
+    struct udev* m_udev;
+    struct udev_monitor* m_gamepadsMonitor;
+    QSocketNotifier* m_gamepadsNotifier;
+};
+
+GamepadsQt::GamepadsQt(unsigned length)
+    : QObject()
+    , m_slots(length)
+{
+    m_udev = udev_new();
+    m_gamepadsMonitor = udev_monitor_new_from_netlink(m_udev, "udev");
+    udev_monitor_enable_receiving(m_gamepadsMonitor);
+    udev_monitor_filter_add_match_subsystem_devtype(m_gamepadsMonitor, "input", 0);
+    m_gamepadsNotifier = new QSocketNotifier(udev_monitor_get_fd(m_gamepadsMonitor), QSocketNotifier::Read, this);
+    connect(m_gamepadsNotifier, SIGNAL(activated(int)), this, SLOT(onGamePadChange()));
+
+    struct udev_enumerate* enumerate = udev_enumerate_new(m_udev);
+    udev_enumerate_add_match_subsystem(enumerate, "input");
+    udev_enumerate_add_match_property(enumerate, "ID_INPUT_JOYSTICK", "1");
+    udev_enumerate_scan_devices(enumerate);
+    struct udev_list_entry* cur;
+    struct udev_list_entry* devs = udev_enumerate_get_list_entry(enumerate);
+    udev_list_entry_foreach(cur, devs)
+    {
+        const char* devname = udev_list_entry_get_name(cur);
+        struct udev_device* device = udev_device_new_from_syspath(m_udev, devname);
+        if (isGamepadDevice(device))
+            registerDevice(String::fromUTF8(udev_device_get_devnode(device)));
+        udev_device_unref(device);
+    }
+    udev_enumerate_unref(enumerate);
+}
+
+GamepadsQt::~GamepadsQt()
+{
+    udev_unref(m_udev);
+    udev_monitor_unref(m_gamepadsMonitor);
+}
+
+bool GamepadsQt::isGamepadDevice(struct udev_device* device)
+{
+    const char* deviceFile = udev_device_get_devnode(device);
+    const char* sysfsPath = udev_device_get_syspath(device);
+    if (!deviceFile || !sysfsPath)
+        return false;
+    if (!udev_device_get_property_value(device, "ID_INPUT") || !udev_device_get_property_value(device, "ID_INPUT_JOYSTICK"))
+        return false;
+    return QByteArray(deviceFile).startsWith("/dev/input/js");
+}
+
+void GamepadsQt::onGamePadChange()
+{
+    struct udev_device* device = udev_monitor_receive_device(m_gamepadsMonitor);
+    if (!isGamepadDevice(device))
+        return;
+    QByteArray action(udev_device_get_action(device));
+    if (action == "add")
+        registerDevice(udev_device_get_devnode(device));
+    else if (action == "remove")
+        unregisterDevice(udev_device_get_devnode(device));
+}
+
+void GamepadsQt::registerDevice(const String& deviceFile)
+{
+    ASSERT(!m_deviceMap.contains(deviceFile));
+
+    for (unsigned index = 0; index < m_slots.size(); index++) {
+        if (!m_slots[index]) {
+            m_slots[index] = GamepadDeviceLinuxQt::create(deviceFile);
+            m_deviceMap.add(deviceFile, m_slots[index].get());
+            break;
+        }
+    }
+}
+
+void GamepadsQt::unregisterDevice(const String& deviceFile)
+{
+    ASSERT(m_deviceMap.contains(deviceFile));
+
+    GamepadDeviceLinuxQt* gamepadDevice = m_deviceMap.take(deviceFile);
+    unsigned index = m_slots.find(gamepadDevice);
+
+    m_slots[index].clear();
+}
+
+void GamepadsQt::updateGamepadList(GamepadList* into)
+{
+    ASSERT(m_slots.size() == into->length());
+
+    for (unsigned i = 0; i < m_slots.size(); i++) {
+        if (m_slots[i] && m_slots[i]->connected()) {
+            GamepadDeviceLinuxQt* gamepadDevice = m_slots[i].get();
+            RefPtr<Gamepad> gamepad = into->item(i);
+            if (!gamepad)
+                gamepad = Gamepad::create();
+
+            gamepad->index(i);
+            gamepad->id(gamepadDevice->id());
+            gamepad->timestamp(gamepadDevice->timestamp());
+            gamepad->axes(gamepadDevice->axesCount(), gamepadDevice->axesData());
+            gamepad->buttons(gamepadDevice->buttonsCount(), gamepadDevice->buttonsData());
+
+            into->set(i, gamepad);
+        } else
+            into->set(i, 0);
+    }
+}
+
+void sampleGamepads(GamepadList* into)
+{
+    DEFINE_STATIC_LOCAL(GamepadsQt, gamepadsQt, (into->length()));
+    gamepadsQt.updateGamepadList(into);
+}
+
+#include "GamepadsQt.moc"
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/qt/KURLQt.cpp b/Source/WebCore/platform/qt/KURLQt.cpp
index 86e4ab7b6..3dca4eee0 100644
--- a/Source/WebCore/platform/qt/KURLQt.cpp
+++ b/Source/WebCore/platform/qt/KURLQt.cpp
@@ -34,15 +34,7 @@ KURL::KURL(const QUrl& url)
 
 KURL::operator QUrl() const
 {
-#if !HAVE(QT5)
-    QString str = QString::fromRawData(reinterpret_cast<const QChar*>(m_string.characters()), m_string.length());
-    QByteArray ba = str.toUtf8();
-
-    QUrl url = QUrl::fromEncoded(ba);
-    return url;
-#else
     return QUrl(m_string);
-#endif
 }
 
 String KURL::fileSystemPath() const
diff --git a/Source/WebCore/platform/qt/LocalizedStringsQt.cpp b/Source/WebCore/platform/qt/LocalizedStringsQt.cpp
index b82fc5c74..5613fb103 100644
--- a/Source/WebCore/platform/qt/LocalizedStringsQt.cpp
+++ b/Source/WebCore/platform/qt/LocalizedStringsQt.cpp
@@ -445,6 +445,12 @@ String crashedPluginText()
     return String();
 }
 
+String blockedPluginByContentSecurityPolicyText()
+{
+    notImplemented();
+    return String();
+}
+
 String insecurePluginVersionText()
 {
     notImplemented();
diff --git a/Source/WebCore/platform/qt/MemoryUsageSupportQt.cpp b/Source/WebCore/platform/qt/MemoryUsageSupportQt.cpp
index 40eafb214..4505d2d0d 100644
--- a/Source/WebCore/platform/qt/MemoryUsageSupportQt.cpp
+++ b/Source/WebCore/platform/qt/MemoryUsageSupportQt.cpp
@@ -111,4 +111,8 @@ bool MemoryUsageSupport::processMemorySizesInBytes(size_t*, size_t*)
     return false;
 }
 
+void MemoryUsageSupport::memoryUsageByComponents(Vector<ComponentInfo>&)
+{
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/qt/PasteboardQt.cpp b/Source/WebCore/platform/qt/PasteboardQt.cpp
index c6e3d0153..66b0e4026 100644
--- a/Source/WebCore/platform/qt/PasteboardQt.cpp
+++ b/Source/WebCore/platform/qt/PasteboardQt.cpp
@@ -127,7 +127,7 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
     return 0;
 }
 
-void Pasteboard::writePlainText(const String& text)
+void Pasteboard::writePlainText(const String& text, SmartReplaceOption smartReplaceOption)
 {
 #ifndef QT_NO_CLIPBOARD
     QMimeData* md = new QMimeData;
@@ -135,6 +135,8 @@ void Pasteboard::writePlainText(const String& text)
     qtext.replace(QChar(0xa0), QLatin1Char(' '));
     md->setText(qtext);
     QGuiApplication::clipboard()->setMimeData(md, m_selectionMode ? QClipboard::Selection : QClipboard::Clipboard);
+    if (smartReplaceOption == CanSmartReplace)
+        md->setData(QLatin1String("application/vnd.qtwebkit.smartpaste"), QByteArray());
 #endif
 }
 
diff --git a/Source/WebCore/platform/qt/PlatformScreenQt.cpp b/Source/WebCore/platform/qt/PlatformScreenQt.cpp
index f30472a0b..fa2e837ea 100644
--- a/Source/WebCore/platform/qt/PlatformScreenQt.cpp
+++ b/Source/WebCore/platform/qt/PlatformScreenQt.cpp
@@ -38,13 +38,8 @@
 #include "NotImplemented.h"
 #include "Widget.h"
 #include "QWebPageClient.h"
-#if HAVE(QT5)
 #include <QGuiApplication>
 #include <QScreen>
-#else
-#include <QApplication>
-#include <QDesktopWidget>
-#endif
 
 namespace WebCore {
 
@@ -71,31 +66,14 @@ static int screenNumber(Widget* w)
 
 int screenDepth(Widget* w)
 {
-#if HAVE(QT5)
     return QGuiApplication::screens().value(screenNumber(w))->depth();
-#else
-    return QApplication::desktop()->screen(screenNumber(w))->depth();
-#endif
 }
 
 int screenDepthPerComponent(Widget* w)
 {
-#if HAVE(QT5)
     int depth = QGuiApplication::primaryScreen()->depth();
     // FIXME: Use widget's screen
     Q_UNUSED(w);
-#else
-    int depth = QApplication::desktop()->screen(0)->depth();
-    if (w) {
-        QWebPageClient* client = w->root()->hostWindow()->platformPageClient();
-
-        if (client) {
-            QWidget* view = client->ownerWidget();
-            if (view)
-                depth = view->depth();
-        }
-    }
-#endif
     // An interface to establish the actual number of bits per color
     // doesn't exist in Qt, or probably at all, so use common-sense
     // values for each screen depth and assume RGB/RGBA where appropriate.
@@ -114,32 +92,20 @@ int screenDepthPerComponent(Widget* w)
 
 bool screenIsMonochrome(Widget* w)
 {
-#if HAVE(QT5)
     Q_UNUSED(w);
     // FIXME: In Qt 5 colorCount() isn't even implemented beyond returning 256 :)
     return false;
-#else
-    return QApplication::desktop()->screen(screenNumber(w))->colorCount() == 2;
-#endif
 }
 
 FloatRect screenRect(Widget* widget)
 {
-#if HAVE(QT5)
     QRect r = QGuiApplication::screens().value(screenNumber(widget))->geometry();
-#else
-    QRect r = QApplication::desktop()->screenGeometry(screenNumber(widget));
-#endif
     return FloatRect(r.x(), r.y(), r.width(), r.height());
 }
 
 FloatRect screenAvailableRect(Widget* widget)
 {
-#if HAVE(QT5)
     QRect r = QGuiApplication::screens().value(screenNumber(widget))->availableGeometry();
-#else
-    QRect r = QApplication::desktop()->availableGeometry(screenNumber(widget));
-#endif
     return FloatRect(r.x(), r.y(), r.width(), r.height());
 }
 
diff --git a/Source/WebCore/platform/qt/QWebPageClient.h b/Source/WebCore/platform/qt/QWebPageClient.h
index 078999dc2..adef7ffd4 100644
--- a/Source/WebCore/platform/qt/QWebPageClient.h
+++ b/Source/WebCore/platform/qt/QWebPageClient.h
@@ -110,9 +110,7 @@ public:
     virtual void createPlatformGraphicsContext3D(PlatformGraphicsContext3D*,
                                                  PlatformGraphicsSurface3D*) = 0;
 #endif
-#if HAVE(QT5)
     virtual QWindow* ownerWindow() const;
-#endif
 
 protected:
 #ifndef QT_NO_CURSOR
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index 09f518b86..f3917b8a9 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -65,9 +65,7 @@
 #include <QFile>
 #include <QFontMetrics>
 
-#if QT_VERSION >= 0x050000
 #include <QStyleHints>
-#endif
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/text/DateTimeFormat.h b/Source/WebCore/platform/text/DateTimeFormat.h
index e7d539f2b..b7b740290 100644
--- a/Source/WebCore/platform/text/DateTimeFormat.h
+++ b/Source/WebCore/platform/text/DateTimeFormat.h
@@ -108,5 +108,4 @@ public:
 } // namespace WebCore
 
 #endif
-
 #endif // DateTimeFormat_h
diff --git a/Source/WebCore/platform/text/LocaleICU.cpp b/Source/WebCore/platform/text/LocaleICU.cpp
index 51ba4aa35..0abe12ce3 100644
--- a/Source/WebCore/platform/text/LocaleICU.cpp
+++ b/Source/WebCore/platform/text/LocaleICU.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2011,2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -81,38 +81,38 @@ LocaleICU* LocaleICU::currentLocale()
     return currentLocale;
 }
 
-void LocaleICU::setDecimalSymbol(unsigned index, UNumberFormatSymbol symbol)
+String LocaleICU::decimalSymbol(UNumberFormatSymbol symbol)
 {
     UErrorCode status = U_ZERO_ERROR;
     int32_t bufferLength = unum_getSymbol(m_numberFormat, symbol, 0, 0, &status);
     ASSERT(U_SUCCESS(status) || status == U_BUFFER_OVERFLOW_ERROR);
     if (U_FAILURE(status) && status != U_BUFFER_OVERFLOW_ERROR)
-        return;
+        return String();
     Vector<UChar> buffer(bufferLength);
     status = U_ZERO_ERROR;
     unum_getSymbol(m_numberFormat, symbol, buffer.data(), bufferLength, &status);
     if (U_FAILURE(status))
-        return;
-    m_decimalSymbols[index] = String::adopt(buffer);
+        return String();
+    return String::adopt(buffer);
 }
 
-void LocaleICU::setDecimalTextAttribute(String& destination, UNumberFormatTextAttribute tag)
+String LocaleICU::decimalTextAttribute(UNumberFormatTextAttribute tag)
 {
     UErrorCode status = U_ZERO_ERROR;
     int32_t bufferLength = unum_getTextAttribute(m_numberFormat, tag, 0, 0, &status);
     ASSERT(U_SUCCESS(status) || status == U_BUFFER_OVERFLOW_ERROR);
     if (U_FAILURE(status) && status != U_BUFFER_OVERFLOW_ERROR)
-        return;
+        return String();
     Vector<UChar> buffer(bufferLength);
     status = U_ZERO_ERROR;
     unum_getTextAttribute(m_numberFormat, tag, buffer.data(), bufferLength, &status);
     ASSERT(U_SUCCESS(status));
     if (U_FAILURE(status))
-        return;
-    destination = String::adopt(buffer);
+        return String();
+    return String::adopt(buffer);
 }
 
-void LocaleICU::initializeDecimalFormat()
+void LocaleICU::initializeNumberLocalizerData()
 {
     if (m_didCreateDecimalFormat)
         return;
@@ -122,155 +122,21 @@ void LocaleICU::initializeDecimalFormat()
     if (!U_SUCCESS(status))
         return;
 
-    setDecimalSymbol(0, UNUM_ZERO_DIGIT_SYMBOL);
-    setDecimalSymbol(1, UNUM_ONE_DIGIT_SYMBOL);
-    setDecimalSymbol(2, UNUM_TWO_DIGIT_SYMBOL);
-    setDecimalSymbol(3, UNUM_THREE_DIGIT_SYMBOL);
-    setDecimalSymbol(4, UNUM_FOUR_DIGIT_SYMBOL);
-    setDecimalSymbol(5, UNUM_FIVE_DIGIT_SYMBOL);
-    setDecimalSymbol(6, UNUM_SIX_DIGIT_SYMBOL);
-    setDecimalSymbol(7, UNUM_SEVEN_DIGIT_SYMBOL);
-    setDecimalSymbol(8, UNUM_EIGHT_DIGIT_SYMBOL);
-    setDecimalSymbol(9, UNUM_NINE_DIGIT_SYMBOL);
-    setDecimalSymbol(DecimalSeparatorIndex, UNUM_DECIMAL_SEPARATOR_SYMBOL);
-    setDecimalSymbol(GroupSeparatorIndex, UNUM_GROUPING_SEPARATOR_SYMBOL);
-    setDecimalTextAttribute(m_positivePrefix, UNUM_POSITIVE_PREFIX);
-    setDecimalTextAttribute(m_positiveSuffix, UNUM_POSITIVE_SUFFIX);
-    setDecimalTextAttribute(m_negativePrefix, UNUM_NEGATIVE_PREFIX);
-    setDecimalTextAttribute(m_negativeSuffix, UNUM_NEGATIVE_SUFFIX);
-    ASSERT(!m_positivePrefix.isEmpty() || !m_positiveSuffix.isEmpty() || !m_negativePrefix.isEmpty() || !m_negativeSuffix.isEmpty());
-}
-
-String LocaleICU::convertToLocalizedNumber(const String& input)
-{
-    initializeDecimalFormat();
-    if (!m_numberFormat || input.isEmpty())
-        return input;
-
-    unsigned i = 0;
-    bool isNegative = false;
-    UnicodeString ustring;
-    StringBuilder builder;
-    builder.reserveCapacity(input.length());
-
-    if (input[0] == '-') {
-        ++i;
-        isNegative = true;
-        builder.append(m_negativePrefix);
-    } else
-        builder.append(m_positivePrefix);
-
-    for (; i < input.length(); ++i) {
-        switch (input[i]) {
-        case '0':
-        case '1':
-        case '2':
-        case '3':
-        case '4':
-        case '5':
-        case '6':
-        case '7':
-        case '8':
-        case '9':
-            builder.append(m_decimalSymbols[input[i] - '0']);
-            break;
-        case '.':
-            builder.append(m_decimalSymbols[DecimalSeparatorIndex]);
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-        }
-    }
-
-    builder.append(isNegative ? m_negativeSuffix : m_positiveSuffix);
-
-    return builder.toString();
-}
-
-static bool matches(const String& text, unsigned position, const String& part)
-{
-    if (part.isEmpty())
-        return true;
-    if (position + part.length() > text.length())
-        return false;
-    for (unsigned i = 0; i < part.length(); ++i) {
-        if (text[position + i] != part[i])
-            return false;
-    }
-    return true;
-}
-
-bool LocaleICU::detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex)
-{
-    startIndex = 0;
-    endIndex = input.length();
-    if (m_negativePrefix.isEmpty() && m_negativeSuffix.isEmpty()) {
-        if (input.startsWith(m_positivePrefix) && input.endsWith(m_positiveSuffix)) {
-            isNegative = false;
-            startIndex = m_positivePrefix.length();
-            endIndex -= m_positiveSuffix.length();
-        } else
-            isNegative = true;
-    } else {
-        if (input.startsWith(m_negativePrefix) && input.endsWith(m_negativeSuffix)) {
-            isNegative = true;
-            startIndex = m_negativePrefix.length();
-            endIndex -= m_negativeSuffix.length();
-        } else {
-            isNegative = false;
-            if (input.startsWith(m_positivePrefix) && input.endsWith(m_positiveSuffix)) {
-                startIndex = m_positivePrefix.length();
-                endIndex -= m_positiveSuffix.length();
-            } else
-                return false;
-        }
-    }
-    return true;
-}
-
-unsigned LocaleICU::matchedDecimalSymbolIndex(const String& input, unsigned& position)
-{
-    for (unsigned symbolIndex = 0; symbolIndex < DecimalSymbolsSize; ++symbolIndex) {
-        if (m_decimalSymbols[symbolIndex].length() && matches(input, position, m_decimalSymbols[symbolIndex])) {
-            position += m_decimalSymbols[symbolIndex].length();
-            return symbolIndex;
-        }
-    }
-    return DecimalSymbolsSize;
-}
-
-String LocaleICU::convertFromLocalizedNumber(const String& localized)
-{
-    initializeDecimalFormat();
-    String input = localized.stripWhiteSpace();
-    if (!m_numberFormat || input.isEmpty())
-        return input;
-
-    bool isNegative;
-    unsigned startIndex;
-    unsigned endIndex;
-    if (!detectSignAndGetDigitRange(input, isNegative, startIndex, endIndex)) {
-        // Input is broken. Returning an invalid number string.
-        return "*";
-    }
-
-    StringBuilder builder;
-    builder.reserveCapacity(input.length());
-    if (isNegative)
-        builder.append("-");
-    for (unsigned i = startIndex; i < endIndex;) {
-        unsigned symbolIndex = matchedDecimalSymbolIndex(input, i);
-        if (symbolIndex >= DecimalSymbolsSize)
-            return "*";
-        if (symbolIndex == DecimalSeparatorIndex)
-            builder.append('.');
-        else if (symbolIndex == GroupSeparatorIndex) {
-            // Ignore group separators.
-
-        } else
-            builder.append(static_cast<UChar>('0' + symbolIndex));
-    }
-    return builder.toString();
+    Vector<String, DecimalSymbolsSize> symbols;
+    symbols.append(decimalSymbol(UNUM_ZERO_DIGIT_SYMBOL));
+    symbols.append(decimalSymbol(UNUM_ONE_DIGIT_SYMBOL));
+    symbols.append(decimalSymbol(UNUM_TWO_DIGIT_SYMBOL));
+    symbols.append(decimalSymbol(UNUM_THREE_DIGIT_SYMBOL));
+    symbols.append(decimalSymbol(UNUM_FOUR_DIGIT_SYMBOL));
+    symbols.append(decimalSymbol(UNUM_FIVE_DIGIT_SYMBOL));
+    symbols.append(decimalSymbol(UNUM_SIX_DIGIT_SYMBOL));
+    symbols.append(decimalSymbol(UNUM_SEVEN_DIGIT_SYMBOL));
+    symbols.append(decimalSymbol(UNUM_EIGHT_DIGIT_SYMBOL));
+    symbols.append(decimalSymbol(UNUM_NINE_DIGIT_SYMBOL));
+    symbols.append(decimalSymbol(UNUM_DECIMAL_SEPARATOR_SYMBOL));
+    symbols.append(decimalSymbol(UNUM_GROUPING_SEPARATOR_SYMBOL));
+    ASSERT(symbols.size() == DecimalSymbolsSize);
+    setNumberLocalizerData(symbols, decimalTextAttribute(UNUM_POSITIVE_PREFIX), decimalTextAttribute(UNUM_POSITIVE_SUFFIX), decimalTextAttribute(UNUM_NEGATIVE_PREFIX), decimalTextAttribute(UNUM_NEGATIVE_SUFFIX));
 }
 
 bool LocaleICU::initializeShortDateFormat()
@@ -501,13 +367,6 @@ unsigned LocaleICU::firstDayOfWeek()
 #endif
 
 #if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
-
-String LocaleICU::localizedDecimalSeparator()
-{
-    initializeDecimalFormat();
-    return m_decimalSymbols[DecimalSeparatorIndex];
-}
-
 static PassOwnPtr<Vector<String> > createFallbackAMPMLabels()
 {
     OwnPtr<Vector<String> > labels = adoptPtr(new Vector<String>());
diff --git a/Source/WebCore/platform/text/LocaleICU.h b/Source/WebCore/platform/text/LocaleICU.h
index 08667806d..70a99c357 100644
--- a/Source/WebCore/platform/text/LocaleICU.h
+++ b/Source/WebCore/platform/text/LocaleICU.h
@@ -32,6 +32,7 @@
 #define LocaleICU_h
 
 #include "DateComponents.h"
+#include "NumberLocalizer.h"
 #include <unicode/udat.h>
 #include <unicode/unum.h>
 #include <wtf/Forward.h>
@@ -43,18 +44,11 @@ namespace WebCore {
 
 // We should use this class only for LocalizedNumberICU.cpp, LocalizedDateICU.cpp,
 // and LocalizedNumberICUTest.cpp.
-class LocaleICU {
+class LocaleICU : public NumberLocalizer {
 public:
     static PassOwnPtr<LocaleICU> create(const char* localeString);
     static LocaleICU* currentLocale();
-    ~LocaleICU();
-
-    // For LocalizedNumber
-    String convertToLocalizedNumber(const String&);
-    String convertFromLocalizedNumber(const String&);
-#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
-    String localizedDecimalSeparator();
-#endif
+    virtual ~LocaleICU();
 
     // For LocalizedDate
     double parseLocalizedDate(const String&);
@@ -76,9 +70,9 @@ public:
 private:
     static PassOwnPtr<LocaleICU> createForCurrentLocale();
     explicit LocaleICU(const char*);
-    void setDecimalSymbol(unsigned index, UNumberFormatSymbol);
-    void setDecimalTextAttribute(String&, UNumberFormatTextAttribute);
-    void initializeDecimalFormat();
+    String decimalSymbol(UNumberFormatSymbol);
+    String decimalTextAttribute(UNumberFormatTextAttribute);
+    virtual void initializeNumberLocalizerData() OVERRIDE;
 
     bool detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex);
     unsigned matchedDecimalSymbolIndex(const String& input, unsigned& position);
@@ -102,17 +96,6 @@ private:
     CString m_locale;
     UNumberFormat* m_numberFormat;
     UDateFormat* m_shortDateFormat;
-    enum {
-        // 0-9 for digits.
-        DecimalSeparatorIndex = 10,
-        GroupSeparatorIndex = 11,
-        DecimalSymbolsSize
-    };
-    String m_decimalSymbols[DecimalSymbolsSize];
-    String m_positivePrefix;
-    String m_positiveSuffix;
-    String m_negativePrefix;
-    String m_negativeSuffix;
     bool m_didCreateDecimalFormat;
     bool m_didCreateShortDateFormat;
 
@@ -133,5 +116,5 @@ private:
 #endif
 };
 
-}
+} // namespace WebCore
 #endif
diff --git a/Source/WebCore/platform/text/LocaleWin.cpp b/Source/WebCore/platform/text/LocaleWin.cpp
index 0f0e740e0..68b6367d8 100644
--- a/Source/WebCore/platform/text/LocaleWin.cpp
+++ b/Source/WebCore/platform/text/LocaleWin.cpp
@@ -35,6 +35,7 @@
 #if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
 #include "DateTimeFormat.h"
 #endif
+#include "Language.h"
 #include "LocalizedStrings.h"
 #include <limits>
 #include <windows.h>
@@ -56,6 +57,7 @@ namespace WebCore {
 
 inline LocaleWin::LocaleWin(LCID lcid)
     : m_lcid(lcid)
+    , m_didInitializeNumberData(false)
 {
     SYSTEMTIME systemTime;
     GetLocalTime(&systemTime);
@@ -63,7 +65,7 @@ inline LocaleWin::LocaleWin(LCID lcid)
 
 #if ENABLE(CALENDAR_PICKER)
     DWORD value = 0;
-    ::GetLocaleInfo(m_lcid, LOCALE_IFIRSTDAYOFWEEK | LOCALE_RETURN_NUMBER, reinterpret_cast<LPWSTR>(&value), sizeof(value) / sizeof(TCHAR));
+    getLocaleInfo(LOCALE_IFIRSTDAYOFWEEK, value);
     // 0:Monday, ..., 6:Sunday.
     // We need 1 for Monday, 0 for Sunday.
     m_firstDayOfWeek = (value + 1) % 7;
@@ -75,11 +77,30 @@ PassOwnPtr<LocaleWin> LocaleWin::create(LCID lcid)
     return adoptPtr(new LocaleWin(lcid));
 }
 
+static LCID determineCurrentLCID()
+{
+    LCID lcid = LOCALE_USER_DEFAULT;
+    // LocaleNameToLCID() is available since Windows Vista.
+    typedef LCID (WINAPI* LocaleNameToLCIDPtr)(LPCWSTR, DWORD);
+    LocaleNameToLCIDPtr localeNameToLCID = reinterpret_cast<LocaleNameToLCIDPtr>(::GetProcAddress(::GetModuleHandle(L"kernel32"), "LocaleNameToLCID"));
+    if (!localeNameToLCID)
+        return lcid;
+    // According to MSDN, 9 is enough for LOCALE_SISO639LANGNAME.
+    const size_t languageCodeBufferSize = 9;
+    WCHAR lowercaseLanguageCode[languageCodeBufferSize];
+    ::GetLocaleInfo(LOCALE_USER_DEFAULT, LOCALE_SISO639LANGNAME, lowercaseLanguageCode, languageCodeBufferSize);
+    String browserLanguage = defaultLanguage();
+    size_t dashPosition = browserLanguage.find('-');
+    if (dashPosition != notFound)
+        browserLanguage = browserLanguage.left(dashPosition);
+    if (!equalIgnoringCase(browserLanguage, String(lowercaseLanguageCode)))
+        lcid = localeNameToLCID(defaultLanguage().charactersWithNullTermination(), 0);
+    return lcid;
+}
+
 LocaleWin* LocaleWin::currentLocale()
 {
-    // Ideally we should make LCID from defaultLanguage(). But
-    // ::LocaleNameToLCID() is available since Windows Vista.
-    static LocaleWin* currentLocale = LocaleWin::create(LOCALE_USER_DEFAULT).leakPtr();
+    static LocaleWin* currentLocale = LocaleWin::create(determineCurrentLCID()).leakPtr();
     return currentLocale;
 }
 
@@ -98,6 +119,11 @@ String LocaleWin::getLocaleInfoString(LCTYPE type)
     return String::adopt(buffer);
 }
 
+void LocaleWin::getLocaleInfo(LCTYPE type, DWORD& result)
+{
+    ::GetLocaleInfo(m_lcid, type | LOCALE_RETURN_NUMBER, reinterpret_cast<LPWSTR>(&result), sizeof(DWORD) / sizeof(TCHAR));
+}
+
 void LocaleWin::ensureShortMonthLabels()
 {
     if (!m_shortMonthLabels.isEmpty())
@@ -670,4 +696,75 @@ const Vector<String>& LocaleWin::timeAMPMLabels()
 }
 #endif
 
+void LocaleWin::initializeNumberLocalizerData()
+{
+    if (m_didInitializeNumberData)
+        return;
+
+    Vector<String, DecimalSymbolsSize> symbols;
+    enum DigitSubstitution {
+        DigitSubstitutionContext = 0,
+        DigitSubstitution0to9 = 1,
+        DigitSubstitutionNative = 2,
+    };
+    DWORD digitSubstitution = DigitSubstitution0to9;
+    getLocaleInfo(LOCALE_IDIGITSUBSTITUTION, digitSubstitution);
+    if (digitSubstitution != DigitSubstitutionNative) {
+        symbols.append("0");
+        symbols.append("1");
+        symbols.append("2");
+        symbols.append("3");
+        symbols.append("4");
+        symbols.append("5");
+        symbols.append("6");
+        symbols.append("7");
+        symbols.append("8");
+        symbols.append("9");
+    } else {
+        String digits = getLocaleInfoString(LOCALE_SNATIVEDIGITS);
+        ASSERT(digits.length() >= 10);
+        for (unsigned i = 0; i < 10; ++i)
+            symbols.append(digits.substring(i, 1));
+    }
+    ASSERT(symbols.size() == DecimalSeparatorIndex);
+    symbols.append(getLocaleInfoString(LOCALE_SDECIMAL));
+    ASSERT(symbols.size() == GroupSeparatorIndex);
+    symbols.append(getLocaleInfoString(LOCALE_STHOUSAND));
+    ASSERT(symbols.size() == DecimalSymbolsSize);
+
+    String negativeSign = getLocaleInfoString(LOCALE_SNEGATIVESIGN);
+    enum NegativeFormat {
+        NegativeFormatParenthesis = 0,
+        NegativeFormatSignPrefix = 1,
+        NegativeFormatSignSpacePrefix = 2,
+        NegativeFormatSignSuffix = 3,
+        NegativeFormatSpaceSignSuffix = 4,
+    };
+    DWORD negativeFormat = NegativeFormatSignPrefix;
+    getLocaleInfo(LOCALE_INEGNUMBER, negativeFormat);
+    String negativePrefix = emptyString();
+    String negativeSuffix = emptyString();
+    switch (negativeFormat) {
+    case NegativeFormatParenthesis:
+        negativePrefix = "(";
+        negativeSuffix = ")";
+        break;
+    case NegativeFormatSignSpacePrefix:
+        negativePrefix = negativeSign + " ";
+        break;
+    case NegativeFormatSignSuffix:
+        negativeSuffix = negativeSign;
+        break;
+    case NegativeFormatSpaceSignSuffix:
+        negativeSuffix = " " + negativeSign;
+        break;
+    case NegativeFormatSignPrefix: // Fall through.
+    default:
+        negativePrefix = negativeSign;
+        break;
+    }
+    m_didInitializeNumberData = true;
+    setNumberLocalizerData(symbols, emptyString(), emptyString(), negativePrefix, negativeSuffix);
+}
+
 }
diff --git a/Source/WebCore/platform/text/LocaleWin.h b/Source/WebCore/platform/text/LocaleWin.h
index 6f4fd8bb8..f8248aa4c 100644
--- a/Source/WebCore/platform/text/LocaleWin.h
+++ b/Source/WebCore/platform/text/LocaleWin.h
@@ -31,6 +31,7 @@
 #ifndef LocaleWin_h
 #define LocaleWin_h
 
+#include "NumberLocalizer.h"
 #include <windows.h>
 #include <wtf/Forward.h>
 #include <wtf/Vector.h>
@@ -41,7 +42,7 @@ namespace WebCore {
 class DateComponents;
 struct DateFormatToken;
 
-class LocaleWin {
+class LocaleWin : public NumberLocalizer {
 public:
     static PassOwnPtr<LocaleWin> create(LCID);
     static LocaleWin* currentLocale();
@@ -69,6 +70,7 @@ public:
 private:
     explicit LocaleWin(LCID);
     String getLocaleInfoString(LCTYPE);
+    void getLocaleInfo(LCTYPE, DWORD&);
     void ensureShortMonthLabels();
     void ensureMonthLabels();
     void ensureShortDateTokens();
@@ -78,6 +80,8 @@ private:
 #if ENABLE(CALENDAR_PICKER)
     void ensureWeekDayShortLabels();
 #endif
+    // NumberLocalizer function:
+    virtual void initializeNumberLocalizerData() OVERRIDE;
 
     LCID m_lcid;
     int m_baseYear;
@@ -92,7 +96,8 @@ private:
     String m_timeFormatText;
     Vector<String> m_timeAMPMLabels;
 #endif
+    bool m_didInitializeNumberData;
 };
 
-}
+} // namespace WebCore
 #endif
diff --git a/Source/WebCore/platform/text/LocalizedDate.h b/Source/WebCore/platform/text/LocalizedDate.h
index ab6854e53..74422afb8 100644
--- a/Source/WebCore/platform/text/LocalizedDate.h
+++ b/Source/WebCore/platform/text/LocalizedDate.h
@@ -60,7 +60,6 @@ const Vector<String>& weekDayShortLabels();
 
 // The first day of a week. 0 is Sunday, and 6 is Saturday.
 unsigned firstDayOfWeek();
-
 #endif
 
 #if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
diff --git a/Source/WebCore/platform/text/LocalizedNumber.h b/Source/WebCore/platform/text/LocalizedNumber.h
index 8703b74f4..7a97413e2 100644
--- a/Source/WebCore/platform/text/LocalizedNumber.h
+++ b/Source/WebCore/platform/text/LocalizedNumber.h
@@ -37,10 +37,8 @@ namespace WebCore {
 
 // Converts the specified number string to another number string
 // localized for the browser's current locale. The input string must
-// conform to HTML floating-point numbers, and is not empty. The
-// fractionDigits argument is deprecated. The function implementaion
-// should not use the argument.
-String convertToLocalizedNumber(const String&, unsigned fractionDigits);
+// conform to HTML floating-point numbers, and is not empty.
+String convertToLocalizedNumber(const String&);
 
 // Converts the specified localized number string to a number string
 // in the HTML floating-point number format. The input string is
@@ -50,7 +48,6 @@ String convertToLocalizedNumber(const String&, unsigned fractionDigits);
 // responsible to check the format of the resultant string.
 String convertFromLocalizedNumber(const String&);
 
-
 #if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
 // Returns localized decimal separator, e.g. "." for English, "," for French.
 String localizedDecimalSeparator();
diff --git a/Source/WebCore/platform/text/LocalizedNumberICU.cpp b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
index 3288746f9..17cf7edb3 100644
--- a/Source/WebCore/platform/text/LocalizedNumberICU.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
@@ -35,7 +35,7 @@
 
 namespace WebCore {
 
-String convertToLocalizedNumber(const String& canonicalNumberString, unsigned fractionDigits)
+String convertToLocalizedNumber(const String& canonicalNumberString)
 {
     return LocaleICU::currentLocale()->convertToLocalizedNumber(canonicalNumberString);
 }
diff --git a/Source/WebCore/platform/text/LocalizedNumberNone.cpp b/Source/WebCore/platform/text/LocalizedNumberNone.cpp
index d40ff2421..94855b6e2 100644
--- a/Source/WebCore/platform/text/LocalizedNumberNone.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberNone.cpp
@@ -37,7 +37,7 @@ using namespace std;
 
 namespace WebCore {
 
-String convertToLocalizedNumber(const String& canonicalNumberString, unsigned)
+String convertToLocalizedNumber(const String& canonicalNumberString)
 {
     return canonicalNumberString;
 }
diff --git a/Source/WebCore/platform/text/NumberLocalizer.cpp b/Source/WebCore/platform/text/NumberLocalizer.cpp
new file mode 100644
index 000000000..661d9b414
--- /dev/null
+++ b/Source/WebCore/platform/text/NumberLocalizer.cpp
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2011,2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NumberLocalizer.h"
+
+#include <wtf/text/StringBuilder.h>
+
+namespace WebCore {
+
+NumberLocalizer::~NumberLocalizer()
+{
+}
+
+void NumberLocalizer::setNumberLocalizerData(const Vector<String, DecimalSymbolsSize>& symbols, const String& positivePrefix, const String& positiveSuffix, const String& negativePrefix, const String& negativeSuffix)
+{
+    for (size_t i = 0; i < symbols.size(); ++i) {
+        ASSERT(!symbols[i].isEmpty());
+        m_decimalSymbols[i] = symbols[i];
+    }
+    m_positivePrefix = positivePrefix;
+    m_positiveSuffix = positiveSuffix;
+    m_negativePrefix = negativePrefix;
+    m_negativeSuffix = negativeSuffix;
+    ASSERT(!m_positivePrefix.isEmpty() || !m_positiveSuffix.isEmpty() || !m_negativePrefix.isEmpty() || !m_negativeSuffix.isEmpty());
+    m_hasNumberLocalizerData = true;
+}
+
+String NumberLocalizer::convertToLocalizedNumber(const String& input)
+{
+    initializeNumberLocalizerData();
+    if (!m_hasNumberLocalizerData || input.isEmpty())
+        return input;
+
+    unsigned i = 0;
+    bool isNegative = false;
+    StringBuilder builder;
+    builder.reserveCapacity(input.length());
+
+    if (input[0] == '-') {
+        ++i;
+        isNegative = true;
+        builder.append(m_negativePrefix);
+    } else
+        builder.append(m_positivePrefix);
+
+    for (; i < input.length(); ++i) {
+        switch (input[i]) {
+        case '0':
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9':
+            builder.append(m_decimalSymbols[input[i] - '0']);
+            break;
+        case '.':
+            builder.append(m_decimalSymbols[DecimalSeparatorIndex]);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    builder.append(isNegative ? m_negativeSuffix : m_positiveSuffix);
+
+    return builder.toString();
+}
+
+static bool matches(const String& text, unsigned position, const String& part)
+{
+    if (part.isEmpty())
+        return true;
+    if (position + part.length() > text.length())
+        return false;
+    for (unsigned i = 0; i < part.length(); ++i) {
+        if (text[position + i] != part[i])
+            return false;
+    }
+    return true;
+}
+
+bool NumberLocalizer::detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex)
+{
+    startIndex = 0;
+    endIndex = input.length();
+    if (m_negativePrefix.isEmpty() && m_negativeSuffix.isEmpty()) {
+        if (input.startsWith(m_positivePrefix) && input.endsWith(m_positiveSuffix)) {
+            isNegative = false;
+            startIndex = m_positivePrefix.length();
+            endIndex -= m_positiveSuffix.length();
+        } else
+            isNegative = true;
+    } else {
+        if (input.startsWith(m_negativePrefix) && input.endsWith(m_negativeSuffix)) {
+            isNegative = true;
+            startIndex = m_negativePrefix.length();
+            endIndex -= m_negativeSuffix.length();
+        } else {
+            isNegative = false;
+            if (input.startsWith(m_positivePrefix) && input.endsWith(m_positiveSuffix)) {
+                startIndex = m_positivePrefix.length();
+                endIndex -= m_positiveSuffix.length();
+            } else
+                return false;
+        }
+    }
+    return true;
+}
+
+unsigned NumberLocalizer::matchedDecimalSymbolIndex(const String& input, unsigned& position)
+{
+    for (unsigned symbolIndex = 0; symbolIndex < DecimalSymbolsSize; ++symbolIndex) {
+        if (m_decimalSymbols[symbolIndex].length() && matches(input, position, m_decimalSymbols[symbolIndex])) {
+            position += m_decimalSymbols[symbolIndex].length();
+            return symbolIndex;
+        }
+    }
+    return DecimalSymbolsSize;
+}
+
+String NumberLocalizer::convertFromLocalizedNumber(const String& localized)
+{
+    initializeNumberLocalizerData();
+    String input = localized.stripWhiteSpace();
+    if (!m_hasNumberLocalizerData || input.isEmpty())
+        return input;
+
+    bool isNegative;
+    unsigned startIndex;
+    unsigned endIndex;
+    if (!detectSignAndGetDigitRange(input, isNegative, startIndex, endIndex)) {
+        // Input is broken. Returning an invalid number string.
+        return "*";
+    }
+
+    StringBuilder builder;
+    builder.reserveCapacity(input.length());
+    if (isNegative)
+        builder.append("-");
+    for (unsigned i = startIndex; i < endIndex;) {
+        unsigned symbolIndex = matchedDecimalSymbolIndex(input, i);
+        if (symbolIndex >= DecimalSymbolsSize)
+            return "*";
+        if (symbolIndex == DecimalSeparatorIndex)
+            builder.append('.');
+        else if (symbolIndex == GroupSeparatorIndex) {
+            // Ignore group separators.
+
+        } else
+            builder.append(static_cast<UChar>('0' + symbolIndex));
+    }
+    return builder.toString();
+}
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+String NumberLocalizer::localizedDecimalSeparator()
+{
+    initializeNumberLocalizerData();
+    return m_decimalSymbols[DecimalSeparatorIndex];
+}
+#endif
+
+}
diff --git a/Source/WebCore/platform/text/NumberLocalizer.h b/Source/WebCore/platform/text/NumberLocalizer.h
new file mode 100644
index 000000000..21831b2ae
--- /dev/null
+++ b/Source/WebCore/platform/text/NumberLocalizer.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef NumberLocalizer_h
+#define NumberLocalizer_h
+
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class NumberLocalizer {
+public:
+    String convertToLocalizedNumber(const String&);
+    String convertFromLocalizedNumber(const String&);
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    String localizedDecimalSeparator();
+#endif
+    virtual ~NumberLocalizer();
+
+protected:
+    enum {
+        // 0-9 for digits.
+        DecimalSeparatorIndex = 10,
+        GroupSeparatorIndex = 11,
+        DecimalSymbolsSize
+    };
+
+    NumberLocalizer() : m_hasNumberLocalizerData(false) { }
+    virtual void initializeNumberLocalizerData() = 0;
+    void setNumberLocalizerData(const Vector<String, DecimalSymbolsSize>&, const String& positivePrefix, const String& positiveSuffix, const String& negativePrefix, const String& negativeSuffix);
+
+private:
+    bool detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex);
+    unsigned matchedDecimalSymbolIndex(const String& input, unsigned& position);
+
+    String m_decimalSymbols[DecimalSymbolsSize];
+    String m_positivePrefix;
+    String m_positiveSuffix;
+    String m_negativePrefix;
+    String m_negativeSuffix;
+    bool m_hasNumberLocalizerData;
+};
+
+}
+#endif
diff --git a/Source/WebCore/platform/text/SegmentedString.cpp b/Source/WebCore/platform/text/SegmentedString.cpp
index 63373ba7a..9edb83c92 100644
--- a/Source/WebCore/platform/text/SegmentedString.cpp
+++ b/Source/WebCore/platform/text/SegmentedString.cpp
@@ -28,13 +28,17 @@ SegmentedString::SegmentedString(const SegmentedString& other)
     , m_currentString(other.m_currentString)
     , m_substrings(other.m_substrings)
     , m_closed(other.m_closed)
+    , m_empty(other.m_empty)
+    , m_fastPathFlags(other.m_fastPathFlags)
+    , m_advanceFunc(other.m_advanceFunc)
+    , m_advanceAndUpdateLineNumberFunc(other.m_advanceAndUpdateLineNumberFunc)
 {
-    if (other.m_currentChar == &other.m_pushedChar1)
-        m_currentChar = &m_pushedChar1;
-    else if (other.m_currentChar == &other.m_pushedChar2)
-        m_currentChar = &m_pushedChar2;
+    if (m_pushedChar2)
+        m_currentChar = m_pushedChar2;
+    else if (m_pushedChar1)
+        m_currentChar = m_pushedChar1;
     else
-        m_currentChar = other.m_currentChar;
+        m_currentChar = m_currentString.m_length ? m_currentString.getCurrentChar() : 0;
 }
 
 const SegmentedString& SegmentedString::operator=(const SegmentedString& other)
@@ -43,17 +47,23 @@ const SegmentedString& SegmentedString::operator=(const SegmentedString& other)
     m_pushedChar2 = other.m_pushedChar2;
     m_currentString = other.m_currentString;
     m_substrings = other.m_substrings;
-    if (other.m_currentChar == &other.m_pushedChar1)
-        m_currentChar = &m_pushedChar1;
-    else if (other.m_currentChar == &other.m_pushedChar2)
-        m_currentChar = &m_pushedChar2;
+    if (m_pushedChar2)
+        m_currentChar = m_pushedChar2;
+    else if (m_pushedChar1)
+        m_currentChar = m_pushedChar1;
     else
-        m_currentChar = other.m_currentChar;
+        m_currentChar = m_currentString.m_length ? m_currentString.getCurrentChar() : 0;
+
     m_closed = other.m_closed;
+    m_empty = other.m_empty;
+    m_fastPathFlags = other.m_fastPathFlags;
     m_numberOfCharactersConsumedPriorToCurrentString = other.m_numberOfCharactersConsumedPriorToCurrentString;
     m_numberOfCharactersConsumedPriorToCurrentLine = other.m_numberOfCharactersConsumedPriorToCurrentLine;
     m_currentLine = other.m_currentLine;
 
+    m_advanceFunc = other.m_advanceFunc;
+    m_advanceAndUpdateLineNumberFunc = other.m_advanceAndUpdateLineNumberFunc;
+
     return *this;
 }
 
@@ -96,6 +106,10 @@ void SegmentedString::clear()
     m_currentLine = 0;
     m_substrings.clear();
     m_closed = false;
+    m_empty = true;
+    m_fastPathFlags = NoFastPath;
+    m_advanceFunc = &SegmentedString::advanceEmpty;
+    m_advanceAndUpdateLineNumberFunc = &SegmentedString::advanceEmpty;
 }
 
 void SegmentedString::append(const SegmentedSubstring& s)
@@ -107,8 +121,10 @@ void SegmentedString::append(const SegmentedSubstring& s)
     if (!m_currentString.m_length) {
         m_numberOfCharactersConsumedPriorToCurrentString += m_currentString.numberOfCharactersConsumed();
         m_currentString = s;
+        updateAdvanceFunctionPointers();
     } else
         m_substrings.append(s);
+    m_empty = false;
 }
 
 void SegmentedString::prepend(const SegmentedSubstring& s)
@@ -125,13 +141,16 @@ void SegmentedString::prepend(const SegmentedSubstring& s)
     //        cases in the future.
     m_numberOfCharactersConsumedPriorToCurrentString += m_currentString.numberOfCharactersConsumed();
     m_numberOfCharactersConsumedPriorToCurrentString -= s.m_length;
-    if (!m_currentString.m_length)
+    if (!m_currentString.m_length) {
         m_currentString = s;
-    else {
+        updateAdvanceFunctionPointers();
+    } else {
         // Shift our m_currentString into our list.
         m_substrings.prepend(m_currentString);
         m_currentString = s;
+        updateAdvanceFunctionPointers();
     }
+    m_empty = false;
 }
 
 void SegmentedString::close()
@@ -152,7 +171,7 @@ void SegmentedString::append(const SegmentedString& s)
         for (; it != e; ++it)
             append(*it);
     }
-    m_currentChar = m_pushedChar1 ? &m_pushedChar1 : m_currentString.m_current;
+    m_currentChar = m_pushedChar1 ? m_pushedChar1 : (m_currentString.m_length ? m_currentString.getCurrentChar() : 0);
 }
 
 void SegmentedString::prepend(const SegmentedString& s)
@@ -166,7 +185,7 @@ void SegmentedString::prepend(const SegmentedString& s)
             prepend(*it);
     }
     prepend(s.m_currentString);
-    m_currentChar = m_pushedChar1 ? &m_pushedChar1 : m_currentString.m_current;
+    m_currentChar = m_pushedChar1 ? m_pushedChar1 : (m_currentString.m_length ? m_currentString.getCurrentChar() : 0);
 }
 
 void SegmentedString::advanceSubstring()
@@ -178,8 +197,14 @@ void SegmentedString::advanceSubstring()
         // string, we now account for those characters as part of the current
         // string, not as part of "prior to current string."
         m_numberOfCharactersConsumedPriorToCurrentString -= m_currentString.numberOfCharactersConsumed();
-    } else
+        updateAdvanceFunctionPointers();
+    } else {
         m_currentString.clear();
+        m_empty = true;
+        m_fastPathFlags = NoFastPath;
+        m_advanceFunc = &SegmentedString::advanceEmpty;
+        m_advanceAndUpdateLineNumberFunc = &SegmentedString::advanceEmpty;
+    }
 }
 
 String SegmentedString::toString() const
@@ -204,22 +229,72 @@ void SegmentedString::advance(unsigned count, UChar* consumedCharacters)
 {
     ASSERT(count <= length());
     for (unsigned i = 0; i < count; ++i) {
-        consumedCharacters[i] = *current();
+        consumedCharacters[i] = currentChar();
         advance();
     }
 }
 
+void SegmentedString::advance8()
+{
+    ASSERT(!m_pushedChar1);
+    decrementAndCheckLength();
+    m_currentChar = m_currentString.incrementAndGetCurrentChar8();
+}
+
+void SegmentedString::advance16()
+{
+    ASSERT(!m_pushedChar1);
+    decrementAndCheckLength();
+    m_currentChar = m_currentString.incrementAndGetCurrentChar16();
+}
+
+void SegmentedString::advanceAndUpdateLineNumber8()
+{
+    ASSERT(!m_pushedChar1);
+    ASSERT(m_currentString.getCurrentChar() == m_currentChar);
+    if (m_currentChar == '\n') {
+        ++m_currentLine;
+        m_numberOfCharactersConsumedPriorToCurrentLine = numberOfCharactersConsumed() + 1;
+    }
+    decrementAndCheckLength();
+    m_currentChar = m_currentString.incrementAndGetCurrentChar8();
+}
+
+void SegmentedString::advanceAndUpdateLineNumber16()
+{
+    ASSERT(!m_pushedChar1);
+    ASSERT(m_currentString.getCurrentChar() == m_currentChar);
+    if (m_currentChar == '\n') {
+        ++m_currentLine;
+        m_numberOfCharactersConsumedPriorToCurrentLine = numberOfCharactersConsumed() + 1;
+    }
+    decrementAndCheckLength();
+    m_currentChar = m_currentString.incrementAndGetCurrentChar16();
+}
+
 void SegmentedString::advanceSlowCase()
 {
     if (m_pushedChar1) {
         m_pushedChar1 = m_pushedChar2;
         m_pushedChar2 = 0;
-    } else if (m_currentString.m_current) {
-        ++m_currentString.m_current;
+
+        if (m_pushedChar1) {
+            m_currentChar = m_pushedChar1;
+            return;
+        }
+
+        updateAdvanceFunctionPointers();
+    } else if (m_currentString.m_length) {
         if (--m_currentString.m_length == 0)
             advanceSubstring();
+    } else if (!isComposite()) {
+        m_currentString.clear();
+        m_empty = true;
+        m_fastPathFlags = NoFastPath;
+        m_advanceFunc = &SegmentedString::advanceEmpty;
+        m_advanceAndUpdateLineNumberFunc = &SegmentedString::advanceEmpty;
     }
-    m_currentChar = m_pushedChar1 ? &m_pushedChar1 : m_currentString.m_current;
+    m_currentChar = m_currentString.m_length ? m_currentString.getCurrentChar() : 0;
 }
 
 void SegmentedString::advanceAndUpdateLineNumberSlowCase()
@@ -227,16 +302,45 @@ void SegmentedString::advanceAndUpdateLineNumberSlowCase()
     if (m_pushedChar1) {
         m_pushedChar1 = m_pushedChar2;
         m_pushedChar2 = 0;
-    } else if (m_currentString.m_current) {
-        if (*m_currentString.m_current++ == '\n' && m_currentString.doNotExcludeLineNumbers()) {
+
+        if (m_pushedChar1) {
+            m_currentChar = m_pushedChar1;
+            return;
+        }
+
+        updateAdvanceFunctionPointers();
+    } else if (m_currentString.m_length) {
+        if (m_currentString.getCurrentChar() == '\n' && m_currentString.doNotExcludeLineNumbers()) {
             ++m_currentLine;
             // Plus 1 because numberOfCharactersConsumed value hasn't incremented yet; it does with m_length decrement below.
             m_numberOfCharactersConsumedPriorToCurrentLine = numberOfCharactersConsumed() + 1;
         }
         if (--m_currentString.m_length == 0)
             advanceSubstring();
+        else
+            m_currentString.incrementAndGetCurrentChar(); // Only need the ++
+    } else if (!isComposite()) {
+        m_currentString.clear();
+        m_empty = true;
+        m_fastPathFlags = NoFastPath;
+        m_advanceFunc = &SegmentedString::advanceEmpty;
+        m_advanceAndUpdateLineNumberFunc = &SegmentedString::advanceEmpty;
     }
-    m_currentChar = m_pushedChar1 ? &m_pushedChar1 : m_currentString.m_current;
+
+    m_currentChar = m_currentString.m_length ? m_currentString.getCurrentChar() : 0;
+}
+
+void SegmentedString::advanceEmpty()
+{
+    ASSERT(!m_currentString.m_length && !isComposite());
+    m_currentChar = 0;
+}
+
+void SegmentedString::updateSlowCaseFunctionPointers()
+{
+    m_fastPathFlags = NoFastPath;
+    m_advanceFunc = &SegmentedString::advanceSlowCase;
+    m_advanceAndUpdateLineNumberFunc = &SegmentedString::advanceAndUpdateLineNumberSlowCase;
 }
 
 OrdinalNumber SegmentedString::currentLine() const
diff --git a/Source/WebCore/platform/text/SegmentedString.h b/Source/WebCore/platform/text/SegmentedString.h
index 777a65e7a..0a8ecb227 100644
--- a/Source/WebCore/platform/text/SegmentedString.h
+++ b/Source/WebCore/platform/text/SegmentedString.h
@@ -33,20 +33,32 @@ class SegmentedSubstring {
 public:
     SegmentedSubstring()
         : m_length(0)
-        , m_current(0)
         , m_doNotExcludeLineNumbers(true)
+        , m_is8Bit(false)
     {
+        m_data.string16Ptr = 0;
     }
 
     SegmentedSubstring(const String& str)
         : m_length(str.length())
-        , m_current(str.isEmpty() ? 0 : str.characters())
-        , m_string(str)
         , m_doNotExcludeLineNumbers(true)
+        , m_string(str)
     {
+        if (m_length) {
+            if (m_string.is8Bit()) {
+                m_is8Bit = true;
+                m_data.string8Ptr = m_string.characters8();
+            } else {
+                m_is8Bit = false;
+                m_data.string16Ptr = m_string.characters16();
+            }
+        } else
+            m_is8Bit = false;
     }
 
-    void clear() { m_length = 0; m_current = 0; }
+    void clear() { m_length = 0; m_data.string16Ptr = 0; m_is8Bit = false;}
+    
+    bool is8Bit() { return m_is8Bit; }
     
     bool excludeLineNumbers() const { return !m_doNotExcludeLineNumbers; }
     bool doNotExcludeLineNumbers() const { return m_doNotExcludeLineNumbers; }
@@ -57,19 +69,70 @@ public:
 
     void appendTo(StringBuilder& builder) const
     {
-        if (m_string.characters() == m_current)
-            builder.append(m_string);
-        else
-            builder.append(String(m_current, m_length));
+        int offset = m_string.length() - m_length;
+
+        if (!offset) {
+            if (m_length)
+                builder.append(m_string);
+        } else
+            builder.append(m_string.substring(offset, m_length));
+    }
+
+    UChar getCurrentChar8()
+    {
+        return *m_data.string8Ptr;
+    }
+
+    UChar getCurrentChar16()
+    {
+        return m_data.string16Ptr ? *m_data.string16Ptr : 0;
+    }
+
+    UChar incrementAndGetCurrentChar8()
+    {
+        ASSERT(m_data.string8Ptr);
+        return *++m_data.string8Ptr;
+    }
+
+    UChar incrementAndGetCurrentChar16()
+    {
+        ASSERT(m_data.string16Ptr);
+        return *++m_data.string16Ptr;
+    }
+
+    String currentSubString(unsigned length)
+    {
+        int offset = m_string.length() - m_length;
+        return m_string.substring(offset, length);
+    }
+
+    ALWAYS_INLINE UChar getCurrentChar()
+    {
+        ASSERT(m_length);
+        if (is8Bit())
+            return getCurrentChar8();
+        return getCurrentChar16();
+    }
+    
+    ALWAYS_INLINE UChar incrementAndGetCurrentChar()
+    {
+        ASSERT(m_length);
+        if (is8Bit())
+            return incrementAndGetCurrentChar8();
+        return incrementAndGetCurrentChar16();
     }
 
 public:
+    union {
+        const LChar* string8Ptr;
+        const UChar* string16Ptr;
+    } m_data;
     int m_length;
-    const UChar* m_current;
 
 private:
-    String m_string;
     bool m_doNotExcludeLineNumbers;
+    bool m_is8Bit;
+    String m_string;
 };
 
 class SegmentedString {
@@ -82,6 +145,10 @@ public:
         , m_numberOfCharactersConsumedPriorToCurrentLine(0)
         , m_currentLine(0)
         , m_closed(false)
+        , m_empty(true)
+        , m_fastPathFlags(NoFastPath)
+        , m_advanceFunc(&SegmentedString::advanceEmpty)
+        , m_advanceAndUpdateLineNumberFunc(&SegmentedString::advanceEmpty)
     {
     }
 
@@ -89,12 +156,17 @@ public:
         : m_pushedChar1(0)
         , m_pushedChar2(0)
         , m_currentString(str)
-        , m_currentChar(m_currentString.m_current)
+        , m_currentChar(0)
         , m_numberOfCharactersConsumedPriorToCurrentString(0)
         , m_numberOfCharactersConsumedPriorToCurrentLine(0)
         , m_currentLine(0)
         , m_closed(false)
+        , m_empty(!str.length())
+        , m_fastPathFlags(NoFastPath)
     {
+        if (m_currentString.m_length)
+            m_currentChar = m_currentString.getCurrentChar();
+        updateAdvanceFunctionPointers();
     }
 
     SegmentedString(const SegmentedString&);
@@ -114,14 +186,15 @@ public:
     {
         if (!m_pushedChar1) {
             m_pushedChar1 = c;
-            m_currentChar = m_pushedChar1 ? &m_pushedChar1 : m_currentString.m_current;
+            m_currentChar = m_pushedChar1 ? m_pushedChar1 : m_currentString.getCurrentChar();
+            updateSlowCaseFunctionPointers();
         } else {
             ASSERT(!m_pushedChar2);
             m_pushedChar2 = c;
         }
     }
 
-    bool isEmpty() const { return !current(); }
+    bool isEmpty() const { return m_empty; }
     unsigned length() const;
 
     bool isClosed() const { return m_closed; }
@@ -132,66 +205,82 @@ public:
         NotEnoughCharacters,
     };
 
-    LookAheadResult lookAhead(const String& string) { return lookAheadInline<SegmentedString::equalsLiterally>(string); }
-    LookAheadResult lookAheadIgnoringCase(const String& string) { return lookAheadInline<SegmentedString::equalsIgnoringCase>(string); }
+    LookAheadResult lookAhead(const String& string) { return lookAheadInline(string, true); }
+    LookAheadResult lookAheadIgnoringCase(const String& string) { return lookAheadInline(string, false); }
 
     void advance()
     {
-        if (!m_pushedChar1 && m_currentString.m_length > 1) {
-            --m_currentString.m_length;
-            m_currentChar = ++m_currentString.m_current;
+        if (m_fastPathFlags & Use8BitAdvance) {
+            ASSERT(!m_pushedChar1);
+            bool haveOneCharacterLeft = (--m_currentString.m_length == 1);
+            m_currentChar = m_currentString.incrementAndGetCurrentChar8();
+
+            if (!haveOneCharacterLeft)
+                return;
+
+            updateSlowCaseFunctionPointers();
+
             return;
         }
-        advanceSlowCase();
+
+        (this->*m_advanceFunc)();
+    }
+
+    inline void advanceAndUpdateLineNumber()
+    {
+        if (m_fastPathFlags & Use8BitAdvance) {
+            ASSERT(!m_pushedChar1);
+
+            bool haveNewLine = (m_currentChar == '\n') & !!(m_fastPathFlags & Use8BitAdvanceAndUpdateLineNumbers);
+            bool haveOneCharacterLeft = (--m_currentString.m_length == 1);
+
+            m_currentChar = m_currentString.incrementAndGetCurrentChar8();
+
+            if (!(haveNewLine | haveOneCharacterLeft))
+                return;
+
+            if (haveNewLine) {
+                ++m_currentLine;
+                m_numberOfCharactersConsumedPriorToCurrentLine =  m_numberOfCharactersConsumedPriorToCurrentString + m_currentString.numberOfCharactersConsumed();
+            }
+
+            if (haveOneCharacterLeft)
+                updateSlowCaseFunctionPointers();
+
+            return;
+        }
+
+        (this->*m_advanceAndUpdateLineNumberFunc)();
     }
 
     void advanceAndASSERT(UChar expectedCharacter)
     {
-        ASSERT_UNUSED(expectedCharacter, *current() == expectedCharacter);
+        ASSERT_UNUSED(expectedCharacter, currentChar() == expectedCharacter);
         advance();
     }
 
     void advanceAndASSERTIgnoringCase(UChar expectedCharacter)
     {
-        ASSERT_UNUSED(expectedCharacter, WTF::Unicode::foldCase(*current()) == WTF::Unicode::foldCase(expectedCharacter));
+        ASSERT_UNUSED(expectedCharacter, WTF::Unicode::foldCase(currentChar()) == WTF::Unicode::foldCase(expectedCharacter));
         advance();
     }
 
-    void advancePastNewlineAndUpdateLineNumber()
-    {
-        ASSERT(*current() == '\n');
-        if (!m_pushedChar1 && m_currentString.m_length > 1) {
-            int newLineFlag = m_currentString.doNotExcludeLineNumbers();
-            m_currentLine += newLineFlag;
-            if (newLineFlag)
-                m_numberOfCharactersConsumedPriorToCurrentLine = numberOfCharactersConsumed() + 1;
-            --m_currentString.m_length;
-            m_currentChar = ++m_currentString.m_current;
-            return;
-        }
-        advanceAndUpdateLineNumberSlowCase();
-    }
-    
     void advancePastNonNewline()
     {
-        ASSERT(*current() != '\n');
-        if (!m_pushedChar1 && m_currentString.m_length > 1) {
-            --m_currentString.m_length;
-            m_currentChar = ++m_currentString.m_current;
-            return;
-        }
-        advanceSlowCase();
+        ASSERT(currentChar() != '\n');
+        advance();
     }
-    
-    void advanceAndUpdateLineNumber()
+
+    void advancePastNewlineAndUpdateLineNumber()
     {
+        ASSERT(currentChar() == '\n');
         if (!m_pushedChar1 && m_currentString.m_length > 1) {
-            int newLineFlag = (*m_currentString.m_current == '\n') & m_currentString.doNotExcludeLineNumbers();
+            int newLineFlag = m_currentString.doNotExcludeLineNumbers();
             m_currentLine += newLineFlag;
             if (newLineFlag)
                 m_numberOfCharactersConsumedPriorToCurrentLine = numberOfCharactersConsumed() + 1;
-            --m_currentString.m_length;
-            m_currentChar = ++m_currentString.m_current;
+            decrementAndCheckLength();
+            m_currentChar = m_currentString.incrementAndGetCurrentChar();
             return;
         }
         advanceAndUpdateLineNumberSlowCase();
@@ -216,9 +305,7 @@ public:
 
     String toString() const;
 
-    const UChar& operator*() const { return *current(); }
-    const UChar* operator->() const { return current(); }
-    
+    UChar currentChar() const { return m_currentChar; }    
 
     // The method is moderately slow, comparing to currentLine method.
     OrdinalNumber currentColumn() const;
@@ -228,30 +315,77 @@ public:
     void setCurrentPosition(OrdinalNumber line, OrdinalNumber columnAftreProlog, int prologLength);
 
 private:
+    enum FastPathFlags {
+        NoFastPath = 0,
+        Use8BitAdvanceAndUpdateLineNumbers = 1 << 0,
+        Use8BitAdvance = 1 << 1,
+    };
+
     void append(const SegmentedSubstring&);
     void prepend(const SegmentedSubstring&);
 
+    void advance8();
+    void advance16();
+    void advanceAndUpdateLineNumber8();
+    void advanceAndUpdateLineNumber16();
     void advanceSlowCase();
     void advanceAndUpdateLineNumberSlowCase();
+    void advanceEmpty();
     void advanceSubstring();
-    const UChar* current() const { return m_currentChar; }
+    
+    void updateSlowCaseFunctionPointers();
+
+    void decrementAndCheckLength()
+    {
+        ASSERT(m_currentString.m_length > 1);
+        if (--m_currentString.m_length == 1)
+            updateSlowCaseFunctionPointers();
+    }
+
+    void updateAdvanceFunctionPointers()
+    {
+        if ((m_currentString.m_length > 1) && !m_pushedChar1) {
+            if (m_currentString.is8Bit()) {
+                m_advanceFunc = &SegmentedString::advance8;
+                m_fastPathFlags = Use8BitAdvance;
+                if (m_currentString.doNotExcludeLineNumbers()) {
+                    m_advanceAndUpdateLineNumberFunc = &SegmentedString::advanceAndUpdateLineNumber8;
+                    m_fastPathFlags |= Use8BitAdvanceAndUpdateLineNumbers;
+                } else
+                    m_advanceAndUpdateLineNumberFunc = &SegmentedString::advance8;
+                return;
+            }
+
+            m_advanceFunc = &SegmentedString::advance16;
+            m_fastPathFlags = NoFastPath;
+            if (m_currentString.doNotExcludeLineNumbers())
+                m_advanceAndUpdateLineNumberFunc = &SegmentedString::advanceAndUpdateLineNumber16;
+            else
+                m_advanceAndUpdateLineNumberFunc = &SegmentedString::advance16;
+            return;
+        }
 
-    static bool equalsLiterally(const UChar* str1, const UChar* str2, size_t count) { return !memcmp(str1, str2, count * sizeof(UChar)); }
-    static bool equalsIgnoringCase(const UChar* str1, const UChar* str2, size_t count) { return !WTF::Unicode::umemcasecmp(str1, str2, count); }
+        if (!m_currentString.m_length && !isComposite()) {
+            m_advanceFunc = &SegmentedString::advanceEmpty;
+            m_fastPathFlags = NoFastPath;
+            m_advanceAndUpdateLineNumberFunc = &SegmentedString::advanceEmpty;
+        }
+
+        updateSlowCaseFunctionPointers();
+    }
 
-    template<bool equals(const UChar* str1, const UChar* str2, size_t count)>
-    inline LookAheadResult lookAheadInline(const String& string)
+    inline LookAheadResult lookAheadInline(const String& string, bool caseSensitive)
     {
         if (!m_pushedChar1 && string.length() <= static_cast<unsigned>(m_currentString.m_length)) {
-            if (equals(string.characters(), m_currentString.m_current, string.length()))
+            String currentSubstring = m_currentString.currentSubString(string.length());
+            if (currentSubstring.startsWith(string, caseSensitive))
                 return DidMatch;
             return DidNotMatch;
         }
-        return lookAheadSlowCase<equals>(string);
+        return lookAheadSlowCase(string, caseSensitive);
     }
-
-    template<bool equals(const UChar* str1, const UChar* str2, size_t count)>
-    LookAheadResult lookAheadSlowCase(const String& string)
+    
+    LookAheadResult lookAheadSlowCase(const String& string, bool caseSensitive)
     {
         unsigned count = string.length();
         if (count > length())
@@ -260,7 +394,7 @@ private:
         String consumedString = String::createUninitialized(count, consumedCharacters);
         advance(count, consumedCharacters);
         LookAheadResult result = DidNotMatch;
-        if (equals(string.characters(), consumedCharacters, count))
+        if (consumedString.startsWith(string, caseSensitive))
             result = DidMatch;
         prepend(SegmentedString(consumedString));
         return result;
@@ -271,12 +405,16 @@ private:
     UChar m_pushedChar1;
     UChar m_pushedChar2;
     SegmentedSubstring m_currentString;
-    const UChar* m_currentChar;
+    UChar m_currentChar;
     int m_numberOfCharactersConsumedPriorToCurrentString;
     int m_numberOfCharactersConsumedPriorToCurrentLine;
     int m_currentLine;
     Deque<SegmentedSubstring> m_substrings;
     bool m_closed;
+    bool m_empty;
+    unsigned char m_fastPathFlags;
+    void (SegmentedString::*m_advanceFunc)();
+    void (SegmentedString::*m_advanceAndUpdateLineNumberFunc)();
 };
 
 }
diff --git a/Source/WebCore/platform/text/TextEncoding.cpp b/Source/WebCore/platform/text/TextEncoding.cpp
index e3d372a1e..2e9079b6a 100644
--- a/Source/WebCore/platform/text/TextEncoding.cpp
+++ b/Source/WebCore/platform/text/TextEncoding.cpp
@@ -125,7 +125,7 @@ CString TextEncoding::encode(const UChar* characters, size_t length, Unencodable
     UTF16Normalized.set(g_utf8_to_utf16(UTF8Normalized.get(), -1, 0, &UTF16Length, 0));
 
     return newTextCodec(*this)->encode(UTF16Normalized.get(), UTF16Length, handling);
-#elif USE(WINCE_UNICODE)
+#elif OS(WINDOWS) && USE(WCHAR_UNICODE)
     // normalization will be done by Windows CE API
     OwnPtr<TextCodec> textCodec = newTextCodec(*this);
     return textCodec.get() ? textCodec->encode(characters, length, handling) : CString();
diff --git a/Source/WebCore/platform/text/TextEncodingRegistry.cpp b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
index bd8b7a51e..4763bf834 100644
--- a/Source/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -51,7 +51,7 @@
 #if USE(GLIB_UNICODE)
 #include "gtk/TextCodecGtk.h"
 #endif
-#if USE(WINCE_UNICODE)
+#if OS(WINDOWS) && USE(WCHAR_UNICODE)
 #include "win/TextCodecWin.h"
 #endif
 
@@ -311,7 +311,7 @@ static void extendTextCodecMaps()
     TextCodecGtk::registerExtendedCodecs(addToTextCodecMap);
 #endif
 
-#if USE(WINCE_UNICODE)
+#if OS(WINDOWS) && USE(WCHAR_UNICODE)
     TextCodecWin::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecWin::registerExtendedCodecs(addToTextCodecMap);
 #endif
diff --git a/Source/WebCore/platform/text/chromium/Hyphenation.cpp b/Source/WebCore/platform/text/chromium/Hyphenation.cpp
new file mode 100644
index 000000000..c630d021b
--- /dev/null
+++ b/Source/WebCore/platform/text/chromium/Hyphenation.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Hyphenation.h"
+
+#include <public/Platform.h>
+
+namespace WebCore {
+
+bool canHyphenate(const AtomicString& localeIdentifier)
+{
+    return WebKit::Platform::current()->canHyphenate(localeIdentifier);
+}
+
+size_t lastHyphenLocation(const UChar* characters, size_t length, size_t beforeIndex, const AtomicString& localeIdentifier)
+{
+    return WebKit::Platform::current()->computeLastHyphenLocation(characters, length, beforeIndex, localeIdentifier);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/text/gtk/TextCheckerEnchant.cpp b/Source/WebCore/platform/text/gtk/TextCheckerEnchant.cpp
index d0d99c0fc..ad668ab20 100644
--- a/Source/WebCore/platform/text/gtk/TextCheckerEnchant.cpp
+++ b/Source/WebCore/platform/text/gtk/TextCheckerEnchant.cpp
@@ -24,12 +24,13 @@
 #include <pango/pango.h>
 #include <wtf/gobject/GOwnPtr.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
 
 using namespace WebCore;
 
 static const size_t maximumNumberOfSuggestions = 10;
 
-static void getAvailableDictionariesCallback(const char* const languageTag, const char* const, const char* const, const char* const, void* data)
+static void enchantDictDescribeCallback(const char* const languageTag, const char* const, const char* const, const char* const, void* data)
 {
     Vector<CString>* dictionaries = static_cast<Vector<CString>*>(data);
     dictionaries->append(languageTag);
@@ -80,16 +81,17 @@ void TextCheckerEnchant::checkSpellingOfString(const String& string, int& misspe
         return;
     Vector<EnchantDict*>::const_iterator dictIter = m_enchantDictionaries.begin();
 
-    GOwnPtr<gchar> cString(g_strdup(string.utf8().data()));
-    size_t length = string.utf8().length();
-
     PangoLanguage* language(pango_language_get_default());
-    GOwnPtr<PangoLogAttr> attrs(g_new(PangoLogAttr, length + 1));
+    size_t numberOfCharacters = string.length();
+    GOwnPtr<PangoLogAttr> attrs(g_new(PangoLogAttr, numberOfCharacters + 1));
+
+    CString utf8String = string.utf8();
+    const char* cString = utf8String.data();
 
     // pango_get_log_attrs uses an aditional position at the end of the text.
-    pango_get_log_attrs(cString.get(), -1, -1, language, attrs.get(), length + 1);
+    pango_get_log_attrs(cString, -1, -1, language, attrs.get(), numberOfCharacters + 1);
 
-    for (size_t i = 0; i < length + 1; i++) {
+    for (size_t i = 0; i < numberOfCharacters + 1; i++) {
         // We go through each character until we find an is_word_start,
         // then we get into an inner loop to find the is_word_end corresponding
         // to it.
@@ -98,7 +100,7 @@ void TextCheckerEnchant::checkSpellingOfString(const String& string, int& misspe
             int end = i;
             int wordLength;
 
-            while (attrs.get()[end].is_word_end < 1  || wordEndIsAContractionApostrophe(cString.get(), end))
+            while (attrs.get()[end].is_word_end < 1  || wordEndIsAContractionApostrophe(cString, end))
                 end++;
 
             wordLength = end - start;
@@ -106,8 +108,8 @@ void TextCheckerEnchant::checkSpellingOfString(const String& string, int& misspe
             // check characters twice.
             i = end;
 
-            gchar* cstart = g_utf8_offset_to_pointer(cString.get(), start);
-            gint bytes = static_cast<gint>(g_utf8_offset_to_pointer(cString.get(), end) - cstart);
+            gchar* cstart = g_utf8_offset_to_pointer(cString, start);
+            gint bytes = static_cast<gint>(g_utf8_offset_to_pointer(cString, end) - cstart);
             GOwnPtr<gchar> word(g_new0(gchar, bytes + 1));
 
             g_utf8_strncpy(word.get(), cstart, wordLength);
@@ -161,9 +163,9 @@ void TextCheckerEnchant::updateSpellCheckingLanguages(const String& languages)
         Vector<String> languagesVector;
         languages.split(static_cast<UChar>(','), languagesVector);
         for (Vector<String>::const_iterator iter = languagesVector.begin(); iter != languagesVector.end(); ++iter) {
-            GOwnPtr<gchar> currentLanguage(g_strdup(iter->utf8().data()));
-            if (enchant_broker_dict_exists(m_broker, currentLanguage.get())) {
-                EnchantDict* dict = enchant_broker_request_dict(m_broker, currentLanguage.get());
+            CString currentLanguage = iter->utf8();
+            if (enchant_broker_dict_exists(m_broker, currentLanguage.data())) {
+                EnchantDict* dict = enchant_broker_request_dict(m_broker, currentLanguage.data());
                 spellDictionaries.append(dict);
             }
         }
@@ -175,7 +177,7 @@ void TextCheckerEnchant::updateSpellCheckingLanguages(const String& languages)
         } else {
             // No dictionaries selected, we get one from the list.
             Vector<CString> allDictionaries;
-            enchant_broker_list_dicts(m_broker, getAvailableDictionariesCallback, &allDictionaries);
+            enchant_broker_list_dicts(m_broker, enchantDictDescribeCallback, &allDictionaries);
             if (!allDictionaries.isEmpty()) {
                 EnchantDict* dict = enchant_broker_request_dict(m_broker, allDictionaries[0].data());
                 spellDictionaries.append(dict);
@@ -186,6 +188,26 @@ void TextCheckerEnchant::updateSpellCheckingLanguages(const String& languages)
     m_enchantDictionaries = spellDictionaries;
 }
 
+String TextCheckerEnchant::getSpellCheckingLanguages()
+{
+    if (m_enchantDictionaries.isEmpty())
+        return String();
+
+    // Get a Vector<CString> with the list of languages in use.
+    Vector<CString> currentDictionaries;
+    for (Vector<EnchantDict*>::const_iterator iter = m_enchantDictionaries.begin(); iter != m_enchantDictionaries.end(); ++iter)
+        enchant_dict_describe(*iter, enchantDictDescribeCallback, &currentDictionaries);
+
+    // Build the result String;
+    StringBuilder builder;
+    for (Vector<CString>::const_iterator iter = currentDictionaries.begin(); iter != currentDictionaries.end(); ++iter) {
+        if (iter != currentDictionaries.begin())
+            builder.append(",");
+        builder.append(String::fromUTF8(iter->data()));
+    }
+    return builder.toString();
+}
+
 void TextCheckerEnchant::freeEnchantBrokerDictionaries()
 {
     for (Vector<EnchantDict*>::const_iterator iter = m_enchantDictionaries.begin(); iter != m_enchantDictionaries.end(); ++iter)
diff --git a/Source/WebCore/platform/text/gtk/TextCheckerEnchant.h b/Source/WebCore/platform/text/gtk/TextCheckerEnchant.h
index 739755e42..e7a980978 100644
--- a/Source/WebCore/platform/text/gtk/TextCheckerEnchant.h
+++ b/Source/WebCore/platform/text/gtk/TextCheckerEnchant.h
@@ -42,6 +42,7 @@ public:
     void checkSpellingOfString(const String&, int& misspellingLocation, int& misspellingLength);
     Vector<String> getGuessesForWord(const String&);
     void updateSpellCheckingLanguages(const String& languages);
+    String getSpellCheckingLanguages();
 
 private:
     TextCheckerEnchant();
diff --git a/Source/WebCore/platform/text/mac/LocaleMac.h b/Source/WebCore/platform/text/mac/LocaleMac.h
index 074fe3e12..1d81c637a 100644
--- a/Source/WebCore/platform/text/mac/LocaleMac.h
+++ b/Source/WebCore/platform/text/mac/LocaleMac.h
@@ -31,6 +31,7 @@
 #ifndef LocaleMac_h
 #define LocaleMac_h
 
+#include "NumberLocalizer.h"
 #include <wtf/Forward.h>
 #include <wtf/RetainPtr.h>
 #include <wtf/Vector.h>
@@ -43,7 +44,7 @@ namespace WebCore {
 
 class DateComponents;
 
-class LocaleMac {
+class LocaleMac : public NumberLocalizer {
 public:
     static PassOwnPtr<LocaleMac> create(const String&);
     static LocaleMac* currentLocale();
@@ -68,6 +69,7 @@ private:
     explicit LocaleMac(NSLocale*);
     explicit LocaleMac(const String&);
     NSDateFormatter *createShortDateFormatter();
+    virtual void initializeNumberLocalizerData() OVERRIDE;
 
     RetainPtr<NSLocale> m_locale;
 #if ENABLE(CALENDAR_PICKER)
@@ -83,7 +85,8 @@ private:
     String m_localizedShortTimeFormatText;
     Vector<String> m_timeAMPMLabels;
 #endif
+    bool m_didInitializeNumberData;
 };
 
-}
+} // namespace WebCore
 #endif
diff --git a/Source/WebCore/platform/text/mac/LocaleMac.mm b/Source/WebCore/platform/text/mac/LocaleMac.mm
index 35b64de6a..2e7f94c7f 100644
--- a/Source/WebCore/platform/text/mac/LocaleMac.mm
+++ b/Source/WebCore/platform/text/mac/LocaleMac.mm
@@ -33,6 +33,7 @@
 
 #import <Foundation/NSDateFormatter.h>
 #import <Foundation/NSLocale.h>
+#include "Language.h"
 #include "LocalizedDate.h"
 #include "LocalizedStrings.h"
 #include <wtf/DateMath.h>
@@ -57,11 +58,13 @@ static NSDateFormatter* createDateTimeFormatter(NSLocale* locale, NSDateFormatte
 
 LocaleMac::LocaleMac(NSLocale* locale)
     : m_locale(locale)
+    , m_didInitializeNumberData(false)
 {
 }
 
 LocaleMac::LocaleMac(const String& localeIdentifier)
     : m_locale([[NSLocale alloc] initWithLocaleIdentifier:localeIdentifier])
+    , m_didInitializeNumberData(false)
 {
 }
 
@@ -74,9 +77,30 @@ PassOwnPtr<LocaleMac> LocaleMac::create(const String& localeIdentifier)
     return adoptPtr(new LocaleMac(localeIdentifier));
 }
 
+static inline String languageFromLocale(const String& locale)
+{
+    String normalizedLocale = locale;
+    normalizedLocale.replace('-', '_');
+    size_t separatorPosition = normalizedLocale.find('_');
+    if (separatorPosition == notFound)
+        return normalizedLocale;
+    return normalizedLocale.left(separatorPosition);
+}
+
+static NSLocale* determineLocale()
+{
+    NSLocale* currentLocale = [NSLocale currentLocale];
+    String currentLocaleLanguage = languageFromLocale(String([currentLocale localeIdentifier]));
+    String browserLanguage = languageFromLocale(defaultLanguage());
+    if (equalIgnoringCase(currentLocaleLanguage, browserLanguage))
+        return currentLocale;
+    // It seems initWithLocaleIdentifier accepts dash-separated locale identifier.
+    return [[NSLocale alloc] initWithLocaleIdentifier:defaultLanguage()];
+}
+
 LocaleMac* LocaleMac::currentLocale()
 {
-    static LocaleMac* currentLocale = new LocaleMac([NSLocale currentLocale]);
+    static LocaleMac* currentLocale = new LocaleMac(determineLocale());
     return currentLocale;
 }
 
@@ -245,4 +269,36 @@ const Vector<String>& LocaleMac::timeAMPMLabels()
     return m_timeAMPMLabels;
 }
 #endif
+
+void LocaleMac::initializeNumberLocalizerData()
+{
+    if (m_didInitializeNumberData)
+        return;
+    m_didInitializeNumberData = true;
+
+    RetainPtr<NSNumberFormatter> formatter(AdoptNS, [[NSNumberFormatter alloc] init]);
+    [formatter.get() setLocale:m_locale.get()];
+    [formatter.get() setNumberStyle:NSNumberFormatterDecimalStyle];
+    [formatter.get() setUsesGroupingSeparator:NO];
+
+    RetainPtr<NSNumber> sampleNumber(AdoptNS, [[NSNumber alloc] initWithDouble:9876543210]);
+    String nineToZero([formatter.get() stringFromNumber:sampleNumber.get()]);
+    if (nineToZero.length() != 10)
+        return;
+    Vector<String, DecimalSymbolsSize> symbols;
+    for (unsigned i = 0; i < 10; ++i)
+        symbols.append(nineToZero.substring(9 - i, 1));
+    ASSERT(symbols.size() == DecimalSeparatorIndex);
+    symbols.append(String([formatter.get() decimalSeparator]));
+    ASSERT(symbols.size() == GroupSeparatorIndex);
+    symbols.append(String([formatter.get() groupingSeparator]));
+    ASSERT(symbols.size() == DecimalSymbolsSize);
+
+    String positivePrefix([formatter.get() positivePrefix]);
+    String positiveSuffix([formatter.get() positiveSuffix]);
+    String negativePrefix([formatter.get() negativePrefix]);
+    String negativeSuffix([formatter.get() negativeSuffix]);
+    setNumberLocalizerData(symbols, positivePrefix, positiveSuffix, negativePrefix, negativeSuffix);
+}
+
 }
diff --git a/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm b/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
index 26ebf3d8e..bd6b38a75 100644
--- a/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
+++ b/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2011,2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,99 +31,25 @@
 #import "config.h"
 #import "LocalizedNumber.h"
 
-#import <Foundation/NSNumberFormatter.h>
-#import <limits>
-#import <wtf/dtoa.h>
-#import <wtf/MainThread.h>
-#import <wtf/MathExtras.h>
-#import <wtf/RetainPtr.h>
-#import <wtf/text/CString.h>
-
-using namespace std;
+#include "LocaleMac.h"
 
 namespace WebCore {
 
-static RetainPtr<NSNumberFormatter> createFormatterForCurrentLocale()
-{
-    RetainPtr<NSNumberFormatter> formatter(AdoptNS, [[NSNumberFormatter alloc] init]);
-    [formatter.get() setLocalizesFormat:YES];
-    [formatter.get() setNumberStyle:NSNumberFormatterDecimalStyle];
-    return formatter;
-}
-
-static RetainPtr<NSNumberFormatter> createFormatterForCurrentLocaleForDisplay()
-{
-    RetainPtr<NSNumberFormatter> formatter = createFormatterForCurrentLocale();
-    [formatter.get() setUsesGroupingSeparator:NO];
-    return formatter;
-}
-
-static NSNumberFormatter *numberFormatterForParsing()
-{
-    ASSERT(isMainThread());
-    static NSNumberFormatter *formatter = createFormatterForCurrentLocale().leakRef();
-    return formatter;    
-}
-
-static NSNumberFormatter *numberFormatterForDisplay()
-{
-    ASSERT(isMainThread());
-    static NSNumberFormatter *formatter = createFormatterForCurrentLocaleForDisplay().leakRef();
-    return formatter;
-}
-
-static double parseLocalizedNumber(const String& numberString)
-{
-    if (numberString.isEmpty())
-        return numeric_limits<double>::quiet_NaN();
-    NSNumber *number = [numberFormatterForParsing() numberFromString:numberString];
-    if (!number)
-        return numeric_limits<double>::quiet_NaN();
-    return [number doubleValue];
-}
-
-static String formatLocalizedNumber(double inputNumber, unsigned fractionDigits)
-{
-    RetainPtr<NSNumber> number(AdoptNS, [[NSNumber alloc] initWithDouble:inputNumber]);
-    RetainPtr<NSNumberFormatter> formatter = numberFormatterForDisplay();
-    [formatter.get() setMaximumFractionDigits:fractionDigits];
-    return String([formatter.get() stringFromNumber:number.get()]);
-}
-
-String convertToLocalizedNumber(const String& canonicalNumberString, unsigned fractionDigits)
+String convertToLocalizedNumber(const String& canonicalNumberString)
 {
-    // FIXME: We should not do parse-then-format. It makes some
-    // problems such as removing leading zeros, changing trailing
-    // digits to zeros.
-    // FIXME: We should not use the fractionDigits argument.
-
-    double doubleValue = canonicalNumberString.toDouble();
-    // The input string must be valid.
-    return formatLocalizedNumber(doubleValue, fractionDigits);
-
+    return LocaleMac::currentLocale()->convertToLocalizedNumber(canonicalNumberString);
 }
 
 String convertFromLocalizedNumber(const String& localizedNumberString)
 {
-    // FIXME: We should not do parse-then-format. It makes some
-    // problems such as removing leading zeros, changing trailing
-    // digits to zeros.
-
-    double doubleValue = parseLocalizedNumber(localizedNumberString);
-    if (!isfinite(doubleValue))
-        return localizedNumberString;
-    NumberToStringBuffer buffer;
-    return String(numberToString(doubleValue, buffer));
+    return LocaleMac::currentLocale()->convertFromLocalizedNumber(localizedNumberString);
 }
 
 #if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
-
 String localizedDecimalSeparator()
 {
-    RetainPtr<NSNumberFormatter> formatter = numberFormatterForDisplay();
-    return String([formatter.get() decimalSeparator]);
+    return LocaleMac::currentLocale()->localizedDecimalSeparator();
 }
-
 #endif
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/text/qt/TextBreakIteratorQt.cpp b/Source/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
deleted file mode 100644
index 0d9d48dbe..000000000
--- a/Source/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
+++ /dev/null
@@ -1,175 +0,0 @@
-/*
- * Copyright (C) 2006 Lars Knoll <lars@trolltech.com>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "TextBreakIterator.h"
-
-#include <QtCore/qtextboundaryfinder.h>
-#include <algorithm>
-#include <qdebug.h>
-#include <wtf/Atomics.h>
-
-// #define DEBUG_TEXT_ITERATORS
-#ifdef DEBUG_TEXT_ITERATORS
-#define DEBUG qDebug
-#else
-#define DEBUG if (1) {} else qDebug
-#endif
-
-using namespace WTF;
-using namespace std;
-
-namespace WebCore {
-
-    class TextBreakIterator : public QTextBoundaryFinder {
-    public:
-        TextBreakIterator(QTextBoundaryFinder::BoundaryType type, const QString& string)
-            : QTextBoundaryFinder(type, string)
-        { }
-        TextBreakIterator()
-            : QTextBoundaryFinder()
-        { }
-    };
-
-    TextBreakIterator* setUpIterator(TextBreakIterator& iterator, QTextBoundaryFinder::BoundaryType type, const UChar* characters, int length)
-    {
-        if (!characters || !length)
-            return 0;
-
-        if (iterator.isValid() && type == iterator.type() && iterator.string() == QString::fromRawData(reinterpret_cast<const QChar*>(characters), length)) {
-            iterator.toStart();
-            return &iterator;
-        }
-
-        iterator = TextBreakIterator(type, QString(reinterpret_cast<const QChar*>(characters), length));
-        return &iterator;
-    }
-
-    TextBreakIterator* wordBreakIterator(const UChar* string, int length)
-    {
-        static TextBreakIterator staticWordBreakIterator;
-        return setUpIterator(staticWordBreakIterator, QTextBoundaryFinder::Word, string, length);
-    }
-
-    static TextBreakIterator* nonSharedCharacterBreakIterator;
-
-    NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator(const UChar* buffer, int length)
-    {
-        m_iterator = nonSharedCharacterBreakIterator;
-        bool createdIterator = m_iterator && weakCompareAndSwap(reinterpret_cast<void**>(&nonSharedCharacterBreakIterator), m_iterator, 0);
-        if (!createdIterator)
-            m_iterator = new TextBreakIterator();
-        if (!setUpIterator(*m_iterator, QTextBoundaryFinder::Grapheme, buffer, length)) {
-            delete m_iterator;
-            m_iterator = 0;
-        }
-    }
-
-    NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator()
-    {
-        if (!weakCompareAndSwap(reinterpret_cast<void**>(&nonSharedCharacterBreakIterator), 0, m_iterator))
-            delete m_iterator;
-    }
-
-    TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
-    {
-        static TextBreakIterator staticCursorMovementIterator;
-        return setUpIterator(staticCursorMovementIterator, QTextBoundaryFinder::Grapheme, string, length);
-    }
-
-    static TextBreakIterator* staticLineBreakIterator;
-
-    TextBreakIterator* acquireLineBreakIterator(const UChar* string, int length, const AtomicString&)
-    {
-        TextBreakIterator* lineBreakIterator = 0;
-        if (staticLineBreakIterator) {
-            setUpIterator(*staticLineBreakIterator, QTextBoundaryFinder::Line, string, length);
-            std::swap(staticLineBreakIterator, lineBreakIterator);
-        }
-
-        if (!lineBreakIterator && string && length)
-            lineBreakIterator = new TextBreakIterator(QTextBoundaryFinder::Line, QString(reinterpret_cast<const QChar*>(string), length));
-
-        return lineBreakIterator;
-    }
-
-    void releaseLineBreakIterator(TextBreakIterator* iterator)
-    {
-        ASSERT(iterator);
-
-        if (!staticLineBreakIterator)
-            staticLineBreakIterator = iterator;
-        else
-            delete iterator;
-    }
-
-    TextBreakIterator* sentenceBreakIterator(const UChar* string, int length)
-    {
-        static TextBreakIterator staticSentenceBreakIterator;
-        return setUpIterator(staticSentenceBreakIterator, QTextBoundaryFinder::Sentence, string, length);
-
-    }
-
-    int textBreakFirst(TextBreakIterator* bi)
-    {
-        bi->toStart();
-        DEBUG() << "textBreakFirst" << bi->position();
-        return bi->position();
-    }
-
-    int textBreakNext(TextBreakIterator* bi)
-    {
-        int pos = bi->toNextBoundary();
-        DEBUG() << "textBreakNext" << pos;
-        return pos;
-    }
-
-    int textBreakPreceding(TextBreakIterator* bi, int pos)
-    {
-        bi->setPosition(pos);
-        int newpos = bi->toPreviousBoundary();
-        DEBUG() << "textBreakPreceding" << pos << newpos;
-        return newpos;
-    }
-
-    int textBreakFollowing(TextBreakIterator* bi, int pos)
-    {
-        bi->setPosition(pos);
-        int newpos = bi->toNextBoundary();
-        DEBUG() << "textBreakFollowing" << pos << newpos;
-        return newpos;
-    }
-
-    int textBreakCurrent(TextBreakIterator* bi)
-    {
-        return bi->position();
-    }
-
-    bool isTextBreak(TextBreakIterator*, int)
-    {
-        return true;
-    }
-
-    bool isWordTextBreak(TextBreakIterator*)
-    {
-        return true;
-    }
-
-}
diff --git a/Source/WebCore/platform/text/win/LocalizedNumberWin.cpp b/Source/WebCore/platform/text/win/LocalizedNumberWin.cpp
new file mode 100644
index 000000000..a56071722
--- /dev/null
+++ b/Source/WebCore/platform/text/win/LocalizedNumberWin.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "LocalizedNumber.h"
+
+#include "LocaleWin.h"
+
+namespace WebCore {
+
+String convertToLocalizedNumber(const String& canonicalNumberString)
+{
+    return LocaleWin::currentLocale()->convertToLocalizedNumber(canonicalNumberString);
+}
+
+String convertFromLocalizedNumber(const String& localizedNumberString)
+{
+    return LocaleWin::currentLocale()->convertFromLocalizedNumber(localizedNumberString);
+}
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+String localizedDecimalSeparator()
+{
+    return LocaleWin::currentLocale()->localizedDecimalSeparator();
+}
+#endif
+} // namespace WebCore
diff --git a/Source/WebCore/platform/win/ClipboardWin.h b/Source/WebCore/platform/win/ClipboardWin.h
index d56ea1900..8dad415f1 100644
--- a/Source/WebCore/platform/win/ClipboardWin.h
+++ b/Source/WebCore/platform/win/ClipboardWin.h
@@ -27,7 +27,7 @@
 #define ClipboardWin_h
 
 #include "COMPtr.h"
-#include "CachedImage.h"
+#include "CachedImageClient.h"
 #include "Clipboard.h"
 #include "DragData.h"
 
diff --git a/Source/WebCore/platform/win/PasteboardWin.cpp b/Source/WebCore/platform/win/PasteboardWin.cpp
index 065e3a801..f9fe00de4 100644
--- a/Source/WebCore/platform/win/PasteboardWin.cpp
+++ b/Source/WebCore/platform/win/PasteboardWin.cpp
@@ -149,7 +149,7 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     }
 }
 
-void Pasteboard::writePlainText(const String& text)
+void Pasteboard::writePlainText(const String& text, SmartReplaceOption smartReplaceOption)
 {
     clear();
 
@@ -162,6 +162,14 @@ void Pasteboard::writePlainText(const String& text)
             ::GlobalFree(cbData);
         ::CloseClipboard();
     }
+
+    // enable smart-replacing later on by putting dummy data on the pasteboard
+    if (smartReplaceOption == CanSmartReplace) {
+        if (::OpenClipboard(m_owner)) {
+            ::SetClipboardData(WebSmartPasteFormat, 0);
+            ::CloseClipboard();
+        }
+    }
 }
 
 void Pasteboard::writeURL(const KURL& url, const String& titleStr, Frame* frame)
diff --git a/Source/WebCore/platform/wince/PasteboardWinCE.cpp b/Source/WebCore/platform/wince/PasteboardWinCE.cpp
index 13bbe4840..cc8d18eeb 100644
--- a/Source/WebCore/platform/wince/PasteboardWinCE.cpp
+++ b/Source/WebCore/platform/wince/PasteboardWinCE.cpp
@@ -144,7 +144,7 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     }
 }
 
-void Pasteboard::writePlainText(const String& text)
+void Pasteboard::writePlainText(const String& text, SmartReplaceOption smartReplaceOption)
 {
     clear();
 
@@ -157,6 +157,14 @@ void Pasteboard::writePlainText(const String& text)
             ::GlobalFree(cbData);
         ::CloseClipboard();
     }
+
+    // enable smart-replacing later on by putting dummy data on the pasteboard
+    if (smartReplaceOption == CanSmartReplace) {
+        if (::OpenClipboard(m_owner)) {
+            ::SetClipboardData(WebSmartPasteFormat, 0);
+            ::CloseClipboard();
+        }
+    }
 }
 
 void Pasteboard::writeURL(const KURL& url, const String& titleStr, Frame* frame)
diff --git a/Source/WebCore/platform/wx/ClipboardWx.cpp b/Source/WebCore/platform/wx/ClipboardWx.cpp
index 24220b9d7..990662177 100644
--- a/Source/WebCore/platform/wx/ClipboardWx.cpp
+++ b/Source/WebCore/platform/wx/ClipboardWx.cpp
@@ -142,7 +142,7 @@ bool ClipboardWx::hasData()
 
 void ClipboardWx::writePlainText(const WTF::String& text)
 {
-    Pasteboard::generalPasteboard()->writePlainText(text);
+    Pasteboard::generalPasteboard()->writePlainText(text, Pasteboard::CannotSmartReplace);
 }
 
 }
diff --git a/Source/WebCore/platform/wx/PasteboardWx.cpp b/Source/WebCore/platform/wx/PasteboardWx.cpp
index 48183fa6f..c45d1fc42 100644
--- a/Source/WebCore/platform/wx/PasteboardWx.cpp
+++ b/Source/WebCore/platform/wx/PasteboardWx.cpp
@@ -61,7 +61,7 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     }
 }
 
-void Pasteboard::writePlainText(const String& text)
+void Pasteboard::writePlainText(const String& text, SmartReplaceOption)
 {
     if (wxTheClipboard->Open()) {
         wxTheClipboard->SetData( new wxTextDataObject(text) );
diff --git a/Source/WebCore/plugins/PluginDatabase.cpp b/Source/WebCore/plugins/PluginDatabase.cpp
index 9508c5b8c..e021bad0e 100644
--- a/Source/WebCore/plugins/PluginDatabase.cpp
+++ b/Source/WebCore/plugins/PluginDatabase.cpp
@@ -510,7 +510,8 @@ static bool readTime(time_t& resultTime, char*& start, const char* end)
     if (start + sizeof(time_t) >= end)
         return false;
 
-    resultTime = *reinterpret_cast_ptr<time_t*>(start);
+    // The stream is not necessary aligned.
+    memcpy(&resultTime, start, sizeof(time_t));
     start += sizeof(time_t);
 
     return true;
diff --git a/Source/WebCore/plugins/PluginViewBase.h b/Source/WebCore/plugins/PluginViewBase.h
index 702e95adb..312d57c09 100644
--- a/Source/WebCore/plugins/PluginViewBase.h
+++ b/Source/WebCore/plugins/PluginViewBase.h
@@ -59,6 +59,7 @@ public:
 
     // FIXME: This is a hack that works around the fact that the WebKit2 PluginView isn't a ScrollableArea.
     virtual bool wantsWheelEvents() { return false; }
+    virtual bool supportsKeyboardFocus() const { return false; }
 
 protected:
     explicit PluginViewBase(PlatformWidget widget = 0) : Widget(widget) { }
diff --git a/Source/WebCore/plugins/blackberry/PluginPackageBlackBerry.cpp b/Source/WebCore/plugins/blackberry/PluginPackageBlackBerry.cpp
index 967c7d30c..3f92735ce 100644
--- a/Source/WebCore/plugins/blackberry/PluginPackageBlackBerry.cpp
+++ b/Source/WebCore/plugins/blackberry/PluginPackageBlackBerry.cpp
@@ -196,7 +196,7 @@ unsigned PluginPackage::hash() const
         m_path.impl()->hash()
     };
 
-    return StringHasher::computeHash(reinterpret_cast<const UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));
+    return StringHasher::computeHashAndMaskTop8Bits(reinterpret_cast<const UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));
 }
 
 bool PluginPackage::load()
diff --git a/Source/WebCore/plugins/efl/PluginPackageEfl.cpp b/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
index 35b1e7d31..d6fd9d1ab 100644
--- a/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
+++ b/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
@@ -53,13 +53,13 @@ bool PluginPackage::fetchInfo()
     NPP_GetValueProcPtr getValue = 0;
     NP_GetMIMEDescriptionFuncPtr getMIMEDescription = 0;
 
-    getValue = reinterpret_cast<NPP_GetValueProcPtr>(dlsym(m_module, "NP_GetValue"));
+    getValue = reinterpret_cast<NPP_GetValueProcPtr>(eina_module_symbol_get(m_module, "NP_GetValue"));
     if ((errmsg = dlerror())) {
         EINA_LOG_ERR("Could not get symbol NP_GetValue: %s", errmsg);
         return false;
     }
 
-    getMIMEDescription = reinterpret_cast<NP_GetMIMEDescriptionFuncPtr>(dlsym(m_module, "NP_GetMIMEDescription"));
+    getMIMEDescription = reinterpret_cast<NP_GetMIMEDescriptionFuncPtr>(eina_module_symbol_get(m_module, "NP_GetMIMEDescription"));
     if ((errmsg = dlerror())) {
         EINA_LOG_ERR("Could not get symbol NP_GetMIMEDescription: %s", errmsg);
         return false;
diff --git a/Source/WebCore/plugins/gtk/gtk2xtbin.c b/Source/WebCore/plugins/gtk/gtk2xtbin.c
index 605e42cc1..7bcfa7adc 100644
--- a/Source/WebCore/plugins/gtk/gtk2xtbin.c
+++ b/Source/WebCore/plugins/gtk/gtk2xtbin.c
@@ -132,9 +132,9 @@ xt_event_prepare (GSource*  source_data,
 {   
   int mask;
 
-  GDK_THREADS_ENTER();
+  gdk_threads_enter();
   mask = XPending(xtdisplay);
-  GDK_THREADS_LEAVE();
+  gdk_threads_leave();
 
   return (gboolean)mask;
 }
@@ -142,16 +142,16 @@ xt_event_prepare (GSource*  source_data,
 static gboolean
 xt_event_check (GSource*  source_data)
 {
-  GDK_THREADS_ENTER ();
+  gdk_threads_enter();
 
   if (xt_event_poll_fd.revents & G_IO_IN) {
     int mask;
     mask = XPending(xtdisplay);
-    GDK_THREADS_LEAVE ();
+    gdk_threads_leave();
     return (gboolean)mask;
   }
 
-  GDK_THREADS_LEAVE ();
+  gdk_threads_leave();
   return FALSE;
 }   
 
@@ -165,7 +165,7 @@ xt_event_dispatch (GSource*  source_data,
 
   ac = XtDisplayToApplicationContext(xtdisplay);
 
-  GDK_THREADS_ENTER ();
+  gdk_threads_enter();
 
   /* Process only real X traffic here.  We only look for data on the
    * pipe, limit it to XTBIN_MAX_EVENTS and only call
@@ -176,7 +176,7 @@ xt_event_dispatch (GSource*  source_data,
     XtAppProcessEvent(ac, XtIMXEvent);
   }
 
-  GDK_THREADS_LEAVE ();
+  gdk_threads_leave();
 
   return TRUE;  
 }
diff --git a/Source/WebCore/plugins/qt/PluginContainerQt.cpp b/Source/WebCore/plugins/qt/PluginContainerQt.cpp
deleted file mode 100644
index 848618026..000000000
--- a/Source/WebCore/plugins/qt/PluginContainerQt.cpp
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
-    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include "PluginContainerQt.h"
-
-#include "FocusController.h"
-#include "Frame.h"
-#include "FrameView.h"
-#include "Page.h"
-#include "PlatformKeyboardEvent.h"
-#include "PlatformWheelEvent.h"
-#include "PluginView.h"
-#include <QApplication>
-#include <QX11Info>
-
-using namespace WebCore;
-
-PluginClientWrapper::PluginClientWrapper(QWidget* parent, WId client)
-    : QWidget(0, Qt::Popup)
-{
-    // create a QWidget that adopts the plugin window id, do not give it
-    // a parent so that we don't end up handling events supposed to be
-    // handled by the QX11EmbedContainer.
-
-    // without the parent this will be considered a toplevel widget,
-    // and thus make Qt not quit the event loop after the last window
-    // has been closed. In order to work around this, we set the window
-    // type to Qt::Popup.
-
-    create(client, false, true);
-    m_parent = parent;
-}
-
-PluginClientWrapper::~PluginClientWrapper()
-{
-    destroy(false, false);
-}
-
-bool PluginClientWrapper::x11Event(XEvent* event)
-{
-    // modify the event window id and insert it into the Qt event system.
-    event->xany.window = m_parent->effectiveWinId();
-    static_cast<QApplication*>(QApplication::instance())->x11ProcessEvent(event);
-    return true;
-}
-
-PluginContainerQt::PluginContainerQt(PluginView* view, QWidget* parent)
-    : QX11EmbedContainer(parent)
-    , m_pluginView(view)
-    , m_clientWrapper(0)
-{
-    connect(this, SIGNAL(clientClosed()), this, SLOT(on_clientClosed()));
-    connect(this, SIGNAL(clientIsEmbedded()), this, SLOT(on_clientIsEmbedded()));
-}
-
-PluginContainerQt::~PluginContainerQt()
-{
-    delete m_clientWrapper;
-    m_pluginView->setPlatformPluginWidget(0);
-}
-
-void PluginContainerQt::on_clientClosed()
-{
-    delete m_clientWrapper;
-    m_clientWrapper = 0;
-}
-
-void PluginContainerQt::on_clientIsEmbedded()
-{
-    delete m_clientWrapper;
-    m_clientWrapper = 0;
-
-    // Only create a QWidget wrapper for the plugin in the case it isn't in the
-    // Qt window mapper, and thus receiving events from the Qt event system.
-    // This way the PluginClientWrapper receives the scroll events and passes
-    // them to the parent. NOTICE: Native Qt based plugins running in process,
-    // will already be in the window mapper, and thus creating a wrapper, stops
-    // them from getting events from Qt, as they are redirected to the wrapper.
-    if (!QWidget::find(clientWinId()))
-        m_clientWrapper = new PluginClientWrapper(this, clientWinId());
-}
-
-void PluginContainerQt::redirectWheelEventsToParent(bool enable)
-{
-    // steal wheel events from the plugin as we want to handle it. When doing this
-    // all button 4, 5, 6, and 7, ButtonPress and ButtonRelease events are passed
-    // to the x11Event handler of the PluginClientWrapper, which then changes the
-    // window id of the event to the parent of PluginContainer and puts the event
-    // back into the Qt event loop, so that we will actually scroll the parent
-    // frame.
-    for (int buttonNo = 4; buttonNo < 8; buttonNo++) {
-        if (enable)
-            XGrabButton(x11Info().display(), buttonNo, AnyModifier, clientWinId(),
-                false, ButtonPressMask, GrabModeAsync, GrabModeAsync, 0L, 0L);
-        else
-            XUngrabButton(x11Info().display(), buttonNo, AnyModifier, clientWinId());
-    }
-}
-
-bool PluginContainerQt::x11Event(XEvent* event)
-{
-    switch (event->type) {
-    case EnterNotify:
-        // if the plugin window doesn't have focus we do not want to send wheel
-        // events to it, but to the parent frame, so let's redirect here.
-        redirectWheelEventsToParent(!hasFocus());
-        break;
-    case LeaveNotify:
-        // it is always safe to ungrab wheel events when the mouse leaves the
-        // plugin window.
-        redirectWheelEventsToParent(false);
-        break;
-    }
-
-    return QX11EmbedContainer::x11Event(event);
-}
-
-void PluginContainerQt::focusInEvent(QFocusEvent* event)
-{
-    // we got focus, stop redirecting the wheel events
-    redirectWheelEventsToParent(false);
-
-    if (Page* page = m_pluginView->parentFrame()->page())
-        page->focusController()->setActive(true);
-
-    m_pluginView->focusPluginElement();
-}
-
-void PluginContainerQt::focusOutEvent(QFocusEvent*)
-{
-    if (Page* page = m_pluginView->parentFrame()->page())
-        page->focusController()->setActive(false);
-}
diff --git a/Source/WebCore/plugins/qt/PluginContainerQt.h b/Source/WebCore/plugins/qt/PluginContainerQt.h
deleted file mode 100644
index 3a2896d3f..000000000
--- a/Source/WebCore/plugins/qt/PluginContainerQt.h
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
-    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-#ifndef PluginContainerQt_h
-#define PluginContainerQt_h
-
-#include <QX11EmbedContainer>
-
-namespace WebCore {
-
-    class PluginView;
-
-    class PluginContainerQt : public QX11EmbedContainer
-    {
-        Q_OBJECT
-    public:
-        PluginContainerQt(PluginView*, QWidget* parent);
-        ~PluginContainerQt();
-
-        void redirectWheelEventsToParent(bool enable = true);
-
-    protected:
-        virtual bool x11Event(XEvent*);
-        virtual void focusInEvent(QFocusEvent*);
-        virtual void focusOutEvent(QFocusEvent*);
-
-    public slots:
-        void on_clientClosed();
-        void on_clientIsEmbedded();
-
-    private:
-        PluginView* m_pluginView;
-        QWidget* m_clientWrapper;
-    };
-
-    class PluginClientWrapper : public QWidget
-    {
-    public:
-        PluginClientWrapper(QWidget* parent, WId client);
-        ~PluginClientWrapper();
-        bool x11Event(XEvent*);
-
-    private:
-        QWidget* m_parent;
-    };
-}
-
-#endif // PluginContainerQt_h
diff --git a/Source/WebCore/plugins/qt/PluginPackageQt.cpp b/Source/WebCore/plugins/qt/PluginPackageQt.cpp
index fbac529ac..ddab475ba 100644
--- a/Source/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -132,7 +132,6 @@ static void initializeGtk(QLibrary* module = 0)
 
 bool PluginPackage::isPluginBlacklisted()
 {
-#if HAVE(QT5)
     // TODO: enumerate all plugins that are incompatible with Qt5.
     const QLatin1String pluginBlacklist[] = {
         QLatin1String("skypebuttons")
@@ -143,7 +142,6 @@ bool PluginPackage::isPluginBlacklisted()
         if (baseName == pluginBlacklist[i])
             return true;
     }
-#endif
     return false;
 }
 
diff --git a/Source/WebCore/plugins/qt/PluginViewQt.cpp b/Source/WebCore/plugins/qt/PluginViewQt.cpp
index 891d42b97..04d710ea2 100644
--- a/Source/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginViewQt.cpp
@@ -79,20 +79,10 @@
 #include <runtime/JSLock.h>
 #include <runtime/JSValue.h>
 
-#if HAVE(QT5)
 #include "QtX11ImageConversion.h"
 #include <QGuiApplication>
 #include <qpa/qplatformnativeinterface.h>
 #include <QWindow>
-#else
-#include "PluginContainerQt.h"
-#include <QApplication>
-#include <QDesktopWidget>
-#include <QGraphicsWidget>
-#include <QStyleOptionGraphicsItem>
-#include <QWidget>
-#include <QX11Info>
-#endif
 
 using JSC::ExecState;
 #if USE(JSC)
@@ -199,13 +189,7 @@ void PluginView::updatePluginWidget()
 
 void PluginView::setFocus(bool focused)
 {
-#if !HAVE(QT5) // Windowed mode is not supported with Qt5 yet (so platformPluginWidget() is always null).
-    if (platformPluginWidget()) {
-        if (focused)
-            static_cast<QWidget*>(platformPluginWidget())->setFocus(Qt::OtherFocusReason);
-    } else
-#endif
-        Widget::setFocus(focused);
+    Widget::setFocus(focused);
 }
 
 void PluginView::show()
@@ -238,65 +222,16 @@ void PluginView::paintUsingXPixmap(QPainter* painter, const QRect &exposedRect)
     bool shouldSyncX = m_pluginDisplay && m_pluginDisplay != x11Display();
     XEvent xevent;
 
-#if HAVE(QT5)
     setupGraphicsExposeEvent(m_drawable, exposedRect, xevent);
-#else
-    QPixmap qtDrawable = QPixmap::fromX11Pixmap(m_drawable, QPixmap::ExplicitlyShared);
-    const int drawableDepth = ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth;
-    ASSERT(drawableDepth == qtDrawable.depth());
-
-    // When printing, Qt uses a QPicture to capture the output in preview mode. The
-    // QPicture holds a reference to the X Pixmap. As a result, the print preview would
-    // update itself when the X Pixmap changes. To prevent this, we create a copy.
-    if (m_element->document()->printing())
-        qtDrawable = qtDrawable.copy();
-
-    if (m_isTransparent && drawableDepth != 32) {
-        // Attempt content propagation for drawable with no alpha by copying over from the backing store
-        QPoint offset;
-        QPaintDevice* backingStoreDevice =  QPainter::redirected(painter->device(), &offset);
-        offset = -offset; // negating the offset gives us the offset of the view within the backing store pixmap
-
-        const bool hasValidBackingStore = backingStoreDevice && backingStoreDevice->devType() == QInternal::Pixmap;
-        QPixmap* backingStorePixmap = static_cast<QPixmap*>(backingStoreDevice);
-
-        // We cannot grab contents from the backing store when painting on QGraphicsView items
-        // (because backing store contents are already transformed). What we really mean to do 
-        // here is to check if we are painting on QWebView, but let's be a little permissive :)
-        QWebPageClient* client = platformPageClient();
-        const bool backingStoreHasUntransformedContents = client && qobject_cast<QWidget*>(client->pluginParent());
-
-        if (hasValidBackingStore && backingStorePixmap->depth() == drawableDepth 
-            && backingStoreHasUntransformedContents) {
-            GC gc = XDefaultGC(QX11Info::display(), QX11Info::appScreen());
-            XCopyArea(QX11Info::display(), backingStorePixmap->handle(), m_drawable, gc,
-                offset.x() + m_windowRect.x() + exposedRect.x(), offset.y() + m_windowRect.y() + exposedRect.y(),
-                exposedRect.width(), exposedRect.height(), exposedRect.x(), exposedRect.y());
-        } else { // no backing store, clean the pixmap because the plugin thinks its transparent
-            QPainter painter(&qtDrawable);
-            painter.fillRect(exposedRect, Qt::white);
-        }
-
-        if (shouldSyncX)
-            syncX();
-    }
-
-    setupGraphicsExposeEvent(qtDrawable.handle(), exposedRect, xevent);
-#endif
-
     dispatchNPEvent(xevent);
 
     if (shouldSyncX)
         XSync(m_pluginDisplay, false); // sync changes by plugin
 
-#if HAVE(QT5)
     XImage* xImage = XGetImage(x11Display(), m_drawable, exposedRect.x(), exposedRect.y(),
                                exposedRect.width(), exposedRect.height(), ULONG_MAX, ZPixmap);
     painter->drawImage(QPoint(exposedRect.x(), exposedRect.y()), qimageFromXImage(xImage), exposedRect);
     XDestroyImage(xImage);
-#else
-    painter->drawPixmap(QPoint(exposedRect.x(), exposedRect.y()), qtDrawable, exposedRect);
-#endif
 }
 
 void PluginView::paint(GraphicsContext* context, const IntRect& rect)
@@ -369,13 +304,8 @@ void setSharedXEventFields(XEvent* xEvent, QWebPageClient* pageClient)
     // NOTE: event->xany.window doesn't always respond to the .window property of other XEvent's
     // but does in the case of KeyPress, KeyRelease, ButtonPress, ButtonRelease, and MotionNotify
     // events; thus, this is right:
-#if HAVE(QT5)
     QWindow* window = pageClient ? pageClient->ownerWindow() : 0;
     xEvent->xany.window = window ? window->winId() : 0;
-#else
-    QWidget* ownerWidget = pageClient ? pageClient->ownerWidget() : 0;
-    xEvent->xany.window = ownerWidget ? ownerWidget->window()->winId() : 0;
-#endif
 }
 
 void PluginView::initXEvent(XEvent* xEvent)
@@ -606,32 +536,8 @@ void PluginView::setNPWindowIfNeeded()
         return;
     m_hasPendingGeometryChange = false;
 
-#if !HAVE(QT5) // Windowed mode is not supported with Qt5 yet
-    if (m_isWindowed) {
-        QWidget* widget = static_cast<QWidget*>(platformPluginWidget());
-        widget->setGeometry(m_windowRect);
-
-        // Cut out areas of the plugin occluded by iframe shims
-        Vector<IntRect> cutOutRects;
-        QRegion clipRegion = QRegion(m_clipRect);
-        getPluginOcclusions(m_element, this->parent(), frameRect(), cutOutRects);
-        for (size_t i = 0; i < cutOutRects.size(); i++) {
-            cutOutRects[i].move(-frameRect().x(), -frameRect().y());
-            clipRegion = clipRegion.subtracted(QRegion(cutOutRects[i]));
-        }
-        // if setMask is set with an empty QRegion, no clipping will
-        // be performed, so in that case we hide the plugin view
-        widget->setVisible(!clipRegion.isEmpty());
-        widget->setMask(clipRegion);
-
-        m_npWindow.x = m_windowRect.x();
-        m_npWindow.y = m_windowRect.y();
-    } else
-#endif
-    {
-        m_npWindow.x = 0;
-        m_npWindow.y = 0;
-    }
+    m_npWindow.x = 0;
+    m_npWindow.y = 0;
 
     // If the width or height are null, set the clipRect to null, indicating that
     // the plugin is not visible/scrolled out.
@@ -676,11 +582,6 @@ void PluginView::setParentVisible(bool visible)
         return;
 
     Widget::setParentVisible(visible);
-
-#if !HAVE(QT5) // Windowed mode is not supported with Qt5 yet.
-    if (isSelfVisible() && platformPluginWidget())
-        static_cast<QWidget*>(platformPluginWidget())->setVisible(visible);
-#endif
 }
 
 NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32_t len, const char* buf)
@@ -751,12 +652,8 @@ bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* re
 
     case NPNVnetscapeWindow: {
         QWebPageClient* client = platformPageClient();
-#if HAVE(QT5)
         QWindow* window = client ? client->ownerWindow() : 0;
         *reinterpret_cast<XID*>(value) = window ? window->winId() : 0;
-#else
-        *reinterpret_cast<XID*>(value) = client ? client->ownerWidget()->window()->winId() : 0;
-#endif
         *result = NPERR_NO_ERROR;
         return true;
     }
@@ -776,19 +673,6 @@ bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* re
 
 void PluginView::invalidateRect(const IntRect& rect)
 {
-#if !HAVE(QT5) // Windowed mode is not supported with Qt5 yet.
-    if (m_isWindowed) {
-        if (platformWidget()) {
-            // update() will schedule a repaint of the widget so ensure
-            // its knowledge of its position on the page is up to date.
-            QWidget* w = static_cast<QWidget*>(platformWidget());
-            w->setGeometry(m_windowRect);
-            w->update(rect);
-        }
-        return;
-    }
-#endif
-
     invalidateWindowlessPluginRect(rect);
 }
 
@@ -849,12 +733,7 @@ static bool getVisualAndColormap(int depth, Visual*& visual, Colormap& colormap,
     visual = 0;
     colormap = 0;
 
-#if !HAVE(QT5) && !defined(QT_NO_XRENDER)
-    static const bool useXRender = qgetenv("QT_X11_NO_XRENDER").isNull(); // Should also check for XRender >= 0.5
-#else
-    static const bool useXRender = false;
-#endif
-    if (!useXRender && forceARGB32)
+    if (forceARGB32)
         return false;
 
     int nvi;
@@ -867,22 +746,7 @@ static bool getVisualAndColormap(int depth, Visual*& visual, Colormap& colormap,
     if (!xvi)
         return false;
 
-#if !HAVE(QT5) && !defined(QT_NO_XRENDER)
-    if (forceARGB32) {
-        for (int idx = 0; idx < nvi; ++idx) {
-            XRenderPictFormat* format = XRenderFindVisualFormat(x11Display(), xvi[idx].visual);
-            if (format->type == PictTypeDirect && format->direct.alphaMask) {
-                 visual = xvi[idx].visual;
-                 break;
-            }
-        }
-        if (!visual)
-            return false;
-    } else
-#endif
-    {
-        visual = xvi[0].visual;
-    }
+    visual = xvi[0].visual;
     ASSERT(visual);
 
     XFree(xvi);
@@ -898,50 +762,18 @@ bool PluginView::platformStart()
 
     if (!x11Environment.display) {
         Display* display;
-#if HAVE(QT5)
         display = static_cast<Display*>(QGuiApplication::platformNativeInterface()->nativeResourceForWindow("display", 0));
-#else
-        display = QX11Info::display();
-#endif
         x11Environment.display = display;
         x11Environment.screenID = XDefaultScreen(display);
         x11Environment.displayDepth = XDefaultDepth(display, x11Environment.screenID);
         x11Environment.rootWindowID = XDefaultRootWindow(display);
     }
 
-#if HAVE(QT5)
     // Windowed mode is not supported with Qt5 yet.
     if (m_isWindowed)
         return false;
-#else
-    if (m_plugin->pluginFuncs()->getvalue) {
-        PluginView::setCurrentPluginView(this);
-#if USE(JSC)
-        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
-#endif
-        setCallingPlugin(true);
-        m_plugin->pluginFuncs()->getvalue(m_instance, NPPVpluginNeedsXEmbed, &m_needsXEmbed);
-        setCallingPlugin(false);
-        PluginView::setCurrentPluginView(0);
-    }
-
-    if (m_isWindowed) {
-        QWebPageClient* client = platformPageClient();
-        if (m_needsXEmbed && client) {
-            setPlatformWidget(new PluginContainerQt(this, client->ownerWidget()));
-            // sync our XEmbed container window creation before sending the xid to plugins.
-            QApplication::syncX();
-        } else {
-            notImplemented();
-            m_status = PluginStatusCanNotLoadPlugin;
-            return false;
-        }
-    } else
-#endif // HAVE(QT5)
-    {
-        setPlatformWidget(0);
-        m_pluginDisplay = getPluginDisplay();
-    }
+    setPlatformWidget(0);
+    m_pluginDisplay = getPluginDisplay();
 
     // If the width and the height are not zero we show the PluginView.
     if (!frameRect().isEmpty())
@@ -950,47 +782,21 @@ bool PluginView::platformStart()
     NPSetWindowCallbackStruct* wsi = new NPSetWindowCallbackStruct();
     wsi->type = 0;
 
-#if !HAVE(QT5)
-    if (m_isWindowed) {
-        const QX11Info* x11Info = &static_cast<QWidget*>(platformPluginWidget())->x11Info();
-
-        wsi->display = x11Info->display();
-        wsi->visual = (Visual*)x11Info->visual();
-        wsi->depth = x11Info->depth();
-        wsi->colormap = x11Info->colormap();
-
-        m_npWindow.type = NPWindowTypeWindow;
-        m_npWindow.window = (void*)static_cast<QWidget*>(platformPluginWidget())->winId();
-        m_npWindow.width = -1;
-        m_npWindow.height = -1;
-    } else
-#endif
-    {
-#if !HAVE(QT5)
-        const QX11Info* x11Info = &QApplication::desktop()->x11Info();
-        if ((x11Info->depth() == 32 || !m_plugin->quirks().contains(PluginQuirkRequiresDefaultScreenDepth))
-             && getVisualAndColormap(32, m_visual, m_colormap, /* forceARGB32 = */ true))
-            wsi->depth = 32;
-        else
-#endif
-        {
-            int depth = displayDepth();
-            bool found = getVisualAndColormap(depth, m_visual, m_colormap, /* forceARGB32 = */ false);
-            ASSERT_UNUSED(found, found);
-            wsi->depth = depth;
-        }
-
-        wsi->display = x11Display();
-        wsi->visual = m_visual;
-        wsi->colormap = m_colormap;
-
-        m_npWindow.type = NPWindowTypeDrawable;
-        m_npWindow.window = 0; // Not used?
-        m_npWindow.x = 0;
-        m_npWindow.y = 0;
-        m_npWindow.width = -1;
-        m_npWindow.height = -1;
-    }
+    int depth = displayDepth();
+    bool found = getVisualAndColormap(depth, m_visual, m_colormap, /* forceARGB32 = */ false);
+    ASSERT_UNUSED(found, found);
+    wsi->depth = depth;
+
+    wsi->display = x11Display();
+    wsi->visual = m_visual;
+    wsi->colormap = m_colormap;
+
+    m_npWindow.type = NPWindowTypeDrawable;
+    m_npWindow.window = 0; // Not used?
+    m_npWindow.x = 0;
+    m_npWindow.y = 0;
+    m_npWindow.width = -1;
+    m_npWindow.height = -1;
 
     m_npWindow.ws_info = wsi;
 
diff --git a/Source/WebCore/plugins/win/PluginViewWin.cpp b/Source/WebCore/plugins/win/PluginViewWin.cpp
index adfd2d36b..142fa8305 100644
--- a/Source/WebCore/plugins/win/PluginViewWin.cpp
+++ b/Source/WebCore/plugins/win/PluginViewWin.cpp
@@ -93,11 +93,7 @@
 
 #if PLATFORM(QT)
 #include "QWebPageClient.h"
-#if HAVE(QT5)
 #include <QWindow>
-#else
-#include <QWidget>
-#endif
 #endif
 
 #if PLATFORM(WX)
@@ -116,13 +112,8 @@ static inline HWND windowHandleForPageClient(PlatformPageClient client)
 #elif PLATFORM(QT)
     if (!client)
         return 0;
-#if HAVE(QT5)
     if (QWindow* window = client->ownerWindow())
         return reinterpret_cast<HWND>(window->winId());
-#else
-    if (QWidget* pluginParent = qobject_cast<QWidget*>(client->pluginParent()))
-        return pluginParent->winId();
-#endif
     return 0;
 #elif PLATFORM(WX)
     if (!client)
diff --git a/Source/WebCore/rendering/HitTestResult.cpp b/Source/WebCore/rendering/HitTestResult.cpp
index 0f6e4b916..44b17478f 100644
--- a/Source/WebCore/rendering/HitTestResult.cpp
+++ b/Source/WebCore/rendering/HitTestResult.cpp
@@ -67,7 +67,7 @@ HitTestPoint::HitTestPoint(const LayoutPoint& point)
 }
 
 HitTestPoint::HitTestPoint(const FloatPoint& point)
-    : m_point(roundedLayoutPoint(point))
+    : m_point(flooredLayoutPoint(point))
     , m_boundingBox(rectForPoint(m_point, 0, 0, 0, 0))
     , m_transformedPoint(point)
     , m_transformedRect(m_boundingBox)
@@ -83,7 +83,7 @@ HitTestPoint::HitTestPoint(const FloatPoint& point, const FloatQuad& quad)
     , m_region(0)
     , m_isRectBased(true)
 {
-    m_point = roundedLayoutPoint(point);
+    m_point = flooredLayoutPoint(point);
     m_boundingBox = enclosingIntRect(quad.boundingBox());
     m_isRectilinear = quad.isRectilinear();
 }
@@ -181,7 +181,7 @@ bool HitTestPoint::intersects(const FloatRect& rect) const
 
 IntRect HitTestPoint::rectForPoint(const LayoutPoint& point, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding)
 {
-    IntPoint actualPoint(roundedIntPoint(point));
+    IntPoint actualPoint(flooredIntPoint(point));
     actualPoint -= IntSize(leftPadding, topPadding);
 
     IntSize actualPadding(leftPadding + rightPadding, topPadding + bottomPadding);
diff --git a/Source/WebCore/rendering/HitTestingTransformState.cpp b/Source/WebCore/rendering/HitTestingTransformState.cpp
index b089336ab..6d9cc7629 100644
--- a/Source/WebCore/rendering/HitTestingTransformState.cpp
+++ b/Source/WebCore/rendering/HitTestingTransformState.cpp
@@ -79,7 +79,7 @@ FloatQuad HitTestingTransformState::mappedArea() const
     return m_accumulatedTransform.inverse().projectQuad(m_lastPlanarArea);
 }
 
-LayoutRect HitTestingTransformState::boundsOfMappedArea() const
+FractionalLayoutRect HitTestingTransformState::boundsOfMappedArea() const
 {
     return m_accumulatedTransform.inverse().clampedBoundsOfProjectedQuad(m_lastPlanarArea);
 }
diff --git a/Source/WebCore/rendering/HitTestingTransformState.h b/Source/WebCore/rendering/HitTestingTransformState.h
index 95ec25b5f..b58303850 100644
--- a/Source/WebCore/rendering/HitTestingTransformState.h
+++ b/Source/WebCore/rendering/HitTestingTransformState.h
@@ -59,7 +59,7 @@ public:
     FloatPoint mappedPoint() const;
     FloatQuad mappedQuad() const;
     FloatQuad mappedArea() const;
-    LayoutRect boundsOfMappedArea() const;
+    FractionalLayoutRect boundsOfMappedArea() const;
     void flatten();
 
     FloatPoint m_lastPlanarPoint;
diff --git a/Source/WebCore/rendering/LayoutTypes.h b/Source/WebCore/rendering/LayoutTypes.h
index 95055f8eb..51967f8e9 100644
--- a/Source/WebCore/rendering/LayoutTypes.h
+++ b/Source/WebCore/rendering/LayoutTypes.h
@@ -91,17 +91,12 @@ inline LayoutPoint roundedLayoutPoint(const FloatPoint& p)
 
 inline LayoutPoint flooredLayoutPoint(const FloatPoint& p)
 {
-    return LayoutPoint(p.x(), p.y());
+    return flooredFractionalLayoutPoint(p);
 }
 
 inline LayoutPoint flooredLayoutPoint(const FloatSize& s)
 {
-    return LayoutPoint(s.width(), s.height());
-}
-
-inline LayoutSize flooredLayoutSize(const FloatPoint& p)
-{
-    return LayoutSize(p.x(), p.y());
+    return flooredLayoutPoint(FloatPoint(s));
 }
 
 inline int roundToInt(LayoutUnit value)
@@ -111,7 +106,7 @@ inline int roundToInt(LayoutUnit value)
 
 inline int floorToInt(LayoutUnit value)
 {
-    return value.toInt();
+    return value.floor();
 }
 
 inline LayoutUnit roundedLayoutUnit(float value)
@@ -149,12 +144,7 @@ inline LayoutPoint toLayoutPoint(const LayoutSize& p)
 
 inline LayoutUnit layoutMod(const LayoutUnit& numerator, const LayoutUnit& denominator)
 {
-    return numerator.toInt() % denominator.toInt();
-}
-
-inline LayoutUnit clampToLayoutUnit(double value)
-{
-    return clampTo<FractionalLayoutUnit>(value, FractionalLayoutUnit::min(), FractionalLayoutUnit::max());
+    return numerator % denominator;
 }
 
 inline IntSize pixelSnappedIntSize(const FractionalLayoutSize& s, const FractionalLayoutPoint& p)
@@ -169,7 +159,7 @@ inline IntRect pixelSnappedIntRect(LayoutPoint location, LayoutSize size)
 
 inline bool isIntegerValue(const LayoutUnit value)
 {
-    return value.floor() == value;
+    return value.toInt() == value;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 0e4a77a78..c2509065e 100755
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -71,7 +71,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 struct SameSizeAsRenderBlock : public RenderBox {
-    void* pointers[3];
+    void* pointers[2];
     RenderObjectChildList children;
     RenderLineBoxList lineBoxes;
     uint32_t bitfields;
@@ -96,11 +96,11 @@ struct SameSizeAsMarginInfo {
 typedef WTF::HashMap<const RenderBox*, ColumnInfo*> ColumnInfoMap;
 static ColumnInfoMap* gColumnInfoMap = 0;
 
-typedef WTF::HashMap<const RenderBlock*, HashSet<RenderBox*>*> PercentHeightDescendantsMap;
-static PercentHeightDescendantsMap* gPercentHeightDescendantsMap = 0;
+static TrackedDescendantsMap* gPositionedDescendantsMap = 0;
+static TrackedDescendantsMap* gPercentHeightDescendantsMap = 0;
 
-typedef WTF::HashMap<const RenderBox*, HashSet<RenderBlock*>*> PercentHeightContainerMap;
-static PercentHeightContainerMap* gPercentHeightContainerMap = 0;
+static TrackedContainerMap* gPositionedContainerMap = 0;
+static TrackedContainerMap* gPercentHeightContainerMap = 0;
     
 typedef WTF::HashMap<RenderBlock*, ListHashSet<RenderInline*>*> ContinuationOutlineTableMap;
 
@@ -196,6 +196,26 @@ RenderBlock::RenderBlock(Node* node)
     COMPILE_ASSERT(sizeof(RenderBlock::MarginInfo) == sizeof(SameSizeAsMarginInfo), MarginInfo_should_stay_small);
 }
 
+static void removeBlockFromDescendantAndContainerMaps(RenderBlock* block, TrackedDescendantsMap*& descendantMap, TrackedContainerMap*& containerMap)
+{
+    if (TrackedRendererListHashSet* descendantSet = descendantMap->take(block)) {
+        TrackedRendererListHashSet::iterator end = descendantSet->end();
+        for (TrackedRendererListHashSet::iterator descendant = descendantSet->begin(); descendant != end; ++descendant) {
+            HashSet<RenderBlock*>* containerSet = containerMap->get(*descendant);
+            ASSERT(containerSet);
+            if (!containerSet)
+                continue;
+            ASSERT(containerSet->contains(block));
+            containerSet->remove(block);
+            if (containerSet->isEmpty()) {
+                containerMap->remove(*descendant);
+                delete containerSet;
+            }
+        }
+        delete descendantSet;
+    }
+}
+
 RenderBlock::~RenderBlock()
 {
     if (m_floatingObjects)
@@ -204,24 +224,10 @@ RenderBlock::~RenderBlock()
     if (hasColumns())
         delete gColumnInfoMap->take(this);
 
-    if (gPercentHeightDescendantsMap) {
-        if (HashSet<RenderBox*>* descendantSet = gPercentHeightDescendantsMap->take(this)) {
-            HashSet<RenderBox*>::iterator end = descendantSet->end();
-            for (HashSet<RenderBox*>::iterator descendant = descendantSet->begin(); descendant != end; ++descendant) {
-                HashSet<RenderBlock*>* containerSet = gPercentHeightContainerMap->get(*descendant);
-                ASSERT(containerSet);
-                if (!containerSet)
-                    continue;
-                ASSERT(containerSet->contains(this));
-                containerSet->remove(this);
-                if (containerSet->isEmpty()) {
-                    gPercentHeightContainerMap->remove(*descendant);
-                    delete containerSet;
-                }
-            }
-            delete descendantSet;
-        }
-    }
+    if (gPercentHeightDescendantsMap)
+        removeBlockFromDescendantAndContainerMaps(this, gPercentHeightDescendantsMap, gPercentHeightContainerMap);
+    if (gPositionedDescendantsMap)
+        removeBlockFromDescendantAndContainerMaps(this, gPositionedDescendantsMap, gPositionedContainerMap);
 }
 
 void RenderBlock::willBeDestroyed()
@@ -1139,15 +1145,21 @@ void RenderBlock::collapseAnonymousBoxChild(RenderBlock* parent, RenderObject* c
     RenderBlock* anonBlock = toRenderBlock(parent->children()->removeChildNode(parent, child, child->hasLayer()));
     anonBlock->moveAllChildrenTo(parent, nextSibling, child->hasLayer());
     // Delete the now-empty block's lines and nuke it.
-    if (!parent->documentBeingDestroyed())
-        anonBlock->deleteLineBoxTree();
-    if (!parent->documentBeingDestroyed() && childFlowThread && childFlowThread->isRenderNamedFlowThread())
+    anonBlock->deleteLineBoxTree();
+    if (childFlowThread && childFlowThread->isRenderNamedFlowThread())
         toRenderNamedFlowThread(childFlowThread)->removeFlowChildInfo(anonBlock);
     anonBlock->destroy();
 }
 
 void RenderBlock::removeChild(RenderObject* oldChild)
 {
+    // No need to waste time in merging or removing empty anonymous blocks.
+    // We can just bail out if our document is getting destroyed.
+    if (documentBeingDestroyed()) {
+        RenderBox::removeChild(oldChild);
+        return;
+    }
+
     // If this child is a block, and if our previous and next siblings are
     // both anonymous blocks with inline content, then we can go ahead and
     // fold the inline content back together.
@@ -1169,12 +1181,14 @@ void RenderBlock::removeChild(RenderObject* oldChild)
             // column span flag if it is set.
             ASSERT(!inlineChildrenBlock->continuation());
             RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyleWithDisplay(style(), BLOCK);
-            children()->removeChildNode(this, inlineChildrenBlock, inlineChildrenBlock->hasLayer());
+            // Cache this value as it might get changed in setStyle() call.
+            bool inlineChildrenBlockHasLayer = inlineChildrenBlock->hasLayer();
             inlineChildrenBlock->setStyle(newStyle);
+            children()->removeChildNode(this, inlineChildrenBlock, inlineChildrenBlockHasLayer);
             
             // Now just put the inlineChildrenBlock inside the blockChildrenBlock.
             blockChildrenBlock->children()->insertChildNode(blockChildrenBlock, inlineChildrenBlock, prev == inlineChildrenBlock ? blockChildrenBlock->firstChild() : 0,
-                                                            inlineChildrenBlock->hasLayer() || blockChildrenBlock->hasLayer());
+                                                            inlineChildrenBlockHasLayer || blockChildrenBlock->hasLayer());
             next->setNeedsLayoutAndPrefWidthsRecalc();
             
             // inlineChildrenBlock got reparented to blockChildrenBlock, so it is no longer a child
@@ -1215,14 +1229,14 @@ void RenderBlock::removeChild(RenderObject* oldChild)
         }
     }
 
-    if (!firstChild() && !documentBeingDestroyed()) {
+    if (!firstChild()) {
         // If this was our last child be sure to clear out our line boxes.
         if (childrenInline())
             deleteLineBoxTree();
 
         // If we are an empty anonymous block in the continuation chain,
         // we need to remove ourself and fix the continuation chain.
-        if (!beingDestroyed() && isAnonymousBlockContinuation()) {
+        if (!beingDestroyed() && isAnonymousBlockContinuation() && !oldChild->isListMarker()) {
             RenderObject* containingBlockIgnoringAnonymous = containingBlock();
             while (containingBlockIgnoringAnonymous && containingBlockIgnoringAnonymous->isAnonymousBlock())
                 containingBlockIgnoringAnonymous = containingBlockIgnoringAnonymous->containingBlock();
@@ -1418,7 +1432,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeigh
     if (!relayoutChildren && simplifiedLayout())
         return;
 
-    LayoutRepainter repainter(*this, everHadLayout() && checkForRepaintDuringLayout());
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
 
     if (recomputeLogicalWidth())
         relayoutChildren = true;
@@ -1472,14 +1486,6 @@ void RenderBlock::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeigh
         setPaginationStrut(0);
     }
 
-    // For overflow:scroll blocks, ensure we have both scrollbars in place always.
-    if (scrollsOverflow() && style()->appearance() != ListboxPart) {
-        if (styleToUse->overflowX() == OSCROLL)
-            layer()->setHasHorizontalScrollbar(true);
-        if (styleToUse->overflowY() == OSCROLL)
-            layer()->setHasVerticalScrollbar(true);
-    }
-
     LayoutUnit repaintLogicalTop = ZERO_LAYOUT_UNIT;
     LayoutUnit repaintLogicalBottom = ZERO_LAYOUT_UNIT;
     LayoutUnit maxFloatLogicalBottom = ZERO_LAYOUT_UNIT;
@@ -1660,17 +1666,22 @@ void RenderBlock::addOverflowFromFloats()
 
 void RenderBlock::addOverflowFromPositionedObjects()
 {
-    if (!m_positionedObjects)
+    TrackedRendererListHashSet* positionedDescendants = positionedObjects();
+    if (!positionedDescendants)
         return;
 
     RenderBox* positionedObject;
-    Iterator end = m_positionedObjects->end();
-    for (Iterator it = m_positionedObjects->begin(); it != end; ++it) {
+    TrackedRendererListHashSet::iterator end = positionedDescendants->end();
+    for (TrackedRendererListHashSet::iterator it = positionedDescendants->begin(); it != end; ++it) {
         positionedObject = *it;
         
         // Fixed positioned elements don't contribute to layout overflow, since they don't scroll with the content.
-        if (positionedObject->style()->position() != FixedPosition)
-            addOverflowFromChild(positionedObject, IntSize(positionedObject->x(), positionedObject->y()));
+        if (positionedObject->style()->position() != FixedPosition) {
+            LayoutUnit x = positionedObject->x();
+            if (style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+                x -= verticalScrollbarWidth();
+            addOverflowFromChild(positionedObject, LayoutSize(x, positionedObject->y()));
+        }
     }
 }
 
@@ -1699,18 +1710,11 @@ void RenderBlock::adjustPositionedBlock(RenderBox* child, const MarginInfo& marg
     setStaticInlinePositionForChild(child, logicalTop, startOffsetForContent(logicalTop));
 
     if (!marginInfo.canCollapseWithMarginBefore()) {
-        child->computeBlockDirectionMargins(this);
-        LayoutUnit marginBefore = marginBeforeForChild(child);
+        // Positioned blocks don't collapse margins, so add the margin provided by
+        // the container now. The child's own margin is added later when calculating its logical top.
         LayoutUnit collapsedBeforePos = marginInfo.positiveMargin();
         LayoutUnit collapsedBeforeNeg = marginInfo.negativeMargin();
-        if (marginBefore > 0) {
-            if (marginBefore > collapsedBeforePos)
-                collapsedBeforePos = marginBefore;
-        } else {
-            if (-marginBefore > collapsedBeforeNeg)
-                collapsedBeforeNeg = -marginBefore;
-        }
-        logicalTop += (collapsedBeforePos - collapsedBeforeNeg) - marginBefore;
+        logicalTop += collapsedBeforePos - collapsedBeforeNeg;
     }
     
     RenderLayer* childLayer = child->layer();
@@ -1849,11 +1853,7 @@ void RenderBlock::moveRunInUnderSiblingBlockIfNeeded(RenderObject* runIn)
 
     // Check if this node is allowed to run-in. E.g. <select> expects its renderer to
     // be a RenderListBox or RenderMenuList, and hence cannot be a RenderInline run-in.
-    Node* runInNode = runIn->node();
-    if (runInNode && runInNode->hasTagName(selectTag))
-        return;
-
-    if (runInNode && runInNode->hasTagName(progressTag))
+    if (!runIn->canBeReplacedWithInlineRunIn())
         return;
 
     RenderObject* curr = runIn->nextSibling();
@@ -2204,6 +2204,8 @@ LayoutUnit RenderBlock::computeStartPositionDeltaForChildAvoidingFloats(const Re
 void RenderBlock::determineLogicalLeftPositionForChild(RenderBox* child)
 {
     LayoutUnit startPosition = borderStart() + paddingStart();
+    if (style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+        startPosition -= verticalScrollbarWidth();
     LayoutUnit totalAvailableLogicalWidth = borderAndPaddingLogicalWidth() + availableLogicalWidth();
 
     // Add in our start margin.
@@ -2285,9 +2287,9 @@ void RenderBlock::setLogicalTopForChild(RenderBox* child, LayoutUnit logicalTop,
 void RenderBlock::layoutBlockChildren(bool relayoutChildren, LayoutUnit& maxFloatLogicalBottom)
 {
     if (gPercentHeightDescendantsMap) {
-        if (HashSet<RenderBox*>* descendants = gPercentHeightDescendantsMap->get(this)) {
-            HashSet<RenderBox*>::iterator end = descendants->end();
-            for (HashSet<RenderBox*>::iterator it = descendants->begin(); it != end; ++it) {
+        if (TrackedRendererListHashSet* descendants = gPercentHeightDescendantsMap->get(this)) {
+            TrackedRendererListHashSet::iterator end = descendants->end();
+            for (TrackedRendererListHashSet::iterator it = descendants->begin(); it != end; ++it) {
                 RenderBox* box = *it;
                 while (box != this) {
                     if (box->normalChildNeedsLayout())
@@ -2566,15 +2568,16 @@ bool RenderBlock::simplifiedLayout()
 
 void RenderBlock::layoutPositionedObjects(bool relayoutChildren)
 {
-    if (!m_positionedObjects)
+    TrackedRendererListHashSet* positionedDescendants = positionedObjects();
+    if (!positionedDescendants)
         return;
         
     if (hasColumns())
         view()->layoutState()->clearPaginationInformation(); // Positioned objects are not part of the column flow, so they don't paginate with the columns.
 
     RenderBox* r;
-    Iterator end = m_positionedObjects->end();
-    for (Iterator it = m_positionedObjects->begin(); it != end; ++it) {
+    TrackedRendererListHashSet::iterator end = positionedDescendants->end();
+    for (TrackedRendererListHashSet::iterator it = positionedDescendants->begin(); it != end; ++it) {
         r = *it;
         // When a non-positioned block element moves, it may have positioned children that are implicitly positioned relative to the
         // non-positioned block.  Rather than trying to detect all of these movement cases, we just always lay out positioned
@@ -2630,10 +2633,11 @@ void RenderBlock::layoutPositionedObjects(bool relayoutChildren)
 
 void RenderBlock::markPositionedObjectsForLayout()
 {
-    if (m_positionedObjects) {
+    TrackedRendererListHashSet* positionedDescendants = positionedObjects();
+    if (positionedDescendants) {
         RenderBox* r;
-        Iterator end = m_positionedObjects->end();
-        for (Iterator it = m_positionedObjects->begin(); it != end; ++it) {
+        TrackedRendererListHashSet::iterator end = positionedDescendants->end();
+        for (TrackedRendererListHashSet::iterator it = positionedDescendants->begin(); it != end; ++it) {
             r = *it;
             r->setChildNeedsLayout(true);
         }
@@ -2969,11 +2973,8 @@ void RenderBlock::paintObject(PaintInfo& paintInfo, const LayoutPoint& paintOffs
 
     // Adjust our painting position if we're inside a scrolled layer (e.g., an overflow:auto div).
     LayoutPoint scrolledOffset = paintOffset;
-    if (hasOverflowClip()) {
+    if (hasOverflowClip())
         scrolledOffset.move(-scrolledContentOffset());
-        if (style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
-            scrolledOffset.move(verticalScrollbarWidth(), 0);
-    }
 
     // 2. paint contents
     if (paintPhase != PaintPhaseSelfOutline) {
@@ -3220,7 +3221,7 @@ GapRects RenderBlock::selectionGapRectsForRepaint(RenderBoxModelObject* repaintC
 
     // FIXME: this is broken with transforms
     TransformState transformState(TransformState::ApplyTransformDirection, FloatPoint());
-    mapLocalToContainer(repaintContainer, false, false, transformState);
+    mapLocalToContainer(repaintContainer, transformState);
     LayoutPoint offsetFromRepaintContainer = roundedLayoutPoint(transformState.mappedPoint());
 
     if (hasOverflowClip())
@@ -3258,13 +3259,13 @@ void RenderBlock::paintSelection(PaintInfo& paintInfo, const LayoutPoint& paintO
     }
 }
 
-static void clipOutPositionedObjects(const PaintInfo* paintInfo, const LayoutPoint& offset, RenderBlock::PositionedObjectsListHashSet* positionedObjects)
+static void clipOutPositionedObjects(const PaintInfo* paintInfo, const LayoutPoint& offset, TrackedRendererListHashSet* positionedObjects)
 {
     if (!positionedObjects)
         return;
     
-    RenderBlock::PositionedObjectsListHashSet::const_iterator end = positionedObjects->end();
-    for (RenderBlock::PositionedObjectsListHashSet::const_iterator it = positionedObjects->begin(); it != end; ++it) {
+    TrackedRendererListHashSet::const_iterator end = positionedObjects->end();
+    for (TrackedRendererListHashSet::const_iterator it = positionedObjects->begin(); it != end; ++it) {
         RenderBox* r = *it;
         paintInfo->context->clipOut(IntRect(offset.x() + r->x(), offset.y() + r->y(), r->width(), r->height()));
     }
@@ -3302,10 +3303,10 @@ GapRects RenderBlock::selectionGaps(RenderBlock* rootBlock, const LayoutPoint& r
         LayoutRect flippedBlockRect(offsetFromRootBlock.width(), offsetFromRootBlock.height(), width(), height());
         rootBlock->flipForWritingMode(flippedBlockRect);
         flippedBlockRect.moveBy(rootBlockPhysicalPosition);
-        clipOutPositionedObjects(paintInfo, flippedBlockRect.location(), m_positionedObjects.get());
+        clipOutPositionedObjects(paintInfo, flippedBlockRect.location(), positionedObjects());
         if (isBody() || isRoot()) // The <body> must make sure to examine its containingBlock's positioned objects.
             for (RenderBlock* cb = containingBlock(); cb && !cb->isRenderView(); cb = cb->containingBlock())
-                clipOutPositionedObjects(paintInfo, LayoutPoint(cb->x(), cb->y()), cb->m_positionedObjects.get()); // FIXME: Not right for flipped writing modes.
+                clipOutPositionedObjects(paintInfo, LayoutPoint(cb->x(), cb->y()), cb->positionedObjects()); // FIXME: Not right for flipped writing modes.
         if (m_floatingObjects) {
             const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
             FloatingObjectSetIterator end = floatingObjectSet.end();
@@ -3596,6 +3597,74 @@ RenderBlock* RenderBlock::blockBeforeWithinSelectionRoot(LayoutSize& offset) con
     return beforeBlock;
 }
 
+void RenderBlock::insertIntoTrackedRendererMaps(RenderBox* descendant, TrackedDescendantsMap*& descendantsMap, TrackedContainerMap*& containerMap)
+{
+    if (!descendantsMap) {
+        descendantsMap = new TrackedDescendantsMap;
+        containerMap = new TrackedContainerMap;
+    }
+    
+    TrackedRendererListHashSet* descendantSet = descendantsMap->get(this);
+    if (!descendantSet) {
+        descendantSet = new TrackedRendererListHashSet;
+        descendantsMap->set(this, descendantSet);
+    }
+    bool added = descendantSet->add(descendant).isNewEntry;
+    if (!added) {
+        ASSERT(containerMap->get(descendant));
+        ASSERT(containerMap->get(descendant)->contains(this));
+        return;
+    }
+    
+    HashSet<RenderBlock*>* containerSet = containerMap->get(descendant);
+    if (!containerSet) {
+        containerSet = new HashSet<RenderBlock*>;
+        containerMap->set(descendant, containerSet);
+    }
+    ASSERT(!containerSet->contains(this));
+    containerSet->add(this);
+}
+
+void RenderBlock::removeFromTrackedRendererMaps(RenderBox* descendant, TrackedDescendantsMap*& descendantsMap, TrackedContainerMap*& containerMap)
+{
+    if (!descendantsMap)
+        return;
+    
+    HashSet<RenderBlock*>* containerSet = containerMap->take(descendant);
+    if (!containerSet)
+        return;
+    
+    HashSet<RenderBlock*>::iterator end = containerSet->end();
+    for (HashSet<RenderBlock*>::iterator it = containerSet->begin(); it != end; ++it) {
+        RenderBlock* container = *it;
+
+        // FIXME: Disabling this assert temporarily until we fix the layout
+        // bugs associated with positioned objects not properly cleared from
+        // their ancestor chain before being moved. See webkit bug 93766.
+        // ASSERT(descendant->isDescendantOf(container));
+
+        TrackedRendererListHashSet* descendantSet = descendantsMap->get(container);
+        ASSERT(descendantSet);
+        if (!descendantSet)
+            continue;
+        ASSERT(descendantSet->contains(descendant));
+        descendantSet->remove(descendant);
+        if (descendantSet->isEmpty()) {
+            descendantsMap->remove(container);
+            delete descendantSet;
+        }
+    }
+    
+    delete containerSet;
+}
+
+TrackedRendererListHashSet* RenderBlock::positionedObjects() const
+{
+    if (gPositionedDescendantsMap)
+        return gPositionedDescendantsMap->get(this);
+    return 0;
+}
+
 void RenderBlock::insertPositionedObject(RenderBox* o)
 {
     ASSERT(!isAnonymousBlock());
@@ -3603,31 +3672,27 @@ void RenderBlock::insertPositionedObject(RenderBox* o)
     if (o->isRenderFlowThread())
         return;
     
-    // Create the list of special objects if we don't aleady have one
-    if (!m_positionedObjects)
-        m_positionedObjects = adoptPtr(new PositionedObjectsListHashSet);
-
-    m_positionedObjects->add(o);
+    insertIntoTrackedRendererMaps(o, gPositionedDescendantsMap, gPositionedContainerMap);
 }
 
 void RenderBlock::removePositionedObject(RenderBox* o)
 {
-    if (m_positionedObjects)
-        m_positionedObjects->remove(o);
+    removeFromTrackedRendererMaps(o, gPositionedDescendantsMap, gPositionedContainerMap);
 }
 
 void RenderBlock::removePositionedObjects(RenderBlock* o)
 {
-    if (!m_positionedObjects)
+    TrackedRendererListHashSet* positionedDescendants = positionedObjects();
+    if (!positionedDescendants)
         return;
     
     RenderBox* r;
     
-    Iterator end = m_positionedObjects->end();
+    TrackedRendererListHashSet::iterator end = positionedDescendants->end();
     
     Vector<RenderBox*, 16> deadObjects;
 
-    for (Iterator it = m_positionedObjects->begin(); it != end; ++it) {
+    for (TrackedRendererListHashSet::iterator it = positionedDescendants->begin(); it != end; ++it) {
         r = *it;
         if (!o || r->isDescendantOf(o)) {
             if (o)
@@ -3646,7 +3711,7 @@ void RenderBlock::removePositionedObjects(RenderBlock* o)
     }
     
     for (unsigned i = 0; i < deadObjects.size(); i++)
-        m_positionedObjects->remove(deadObjects.at(i));
+        removePositionedObject(deadObjects.at(i));
 }
 
 RenderBlock::FloatingObject* RenderBlock::insertFloatingObject(RenderBox* o)
@@ -3924,60 +3989,15 @@ void RenderBlock::newLine(EClear clear)
 
 void RenderBlock::addPercentHeightDescendant(RenderBox* descendant)
 {
-    if (!gPercentHeightDescendantsMap) {
-        gPercentHeightDescendantsMap = new PercentHeightDescendantsMap;
-        gPercentHeightContainerMap = new PercentHeightContainerMap;
-    }
-
-    HashSet<RenderBox*>* descendantSet = gPercentHeightDescendantsMap->get(this);
-    if (!descendantSet) {
-        descendantSet = new HashSet<RenderBox*>;
-        gPercentHeightDescendantsMap->set(this, descendantSet);
-    }
-    bool added = descendantSet->add(descendant).isNewEntry;
-    if (!added) {
-        ASSERT(gPercentHeightContainerMap->get(descendant));
-        ASSERT(gPercentHeightContainerMap->get(descendant)->contains(this));
-        return;
-    }
-
-    HashSet<RenderBlock*>* containerSet = gPercentHeightContainerMap->get(descendant);
-    if (!containerSet) {
-        containerSet = new HashSet<RenderBlock*>;
-        gPercentHeightContainerMap->set(descendant, containerSet);
-    }
-    ASSERT(!containerSet->contains(this));
-    containerSet->add(this);
+    insertIntoTrackedRendererMaps(descendant, gPercentHeightDescendantsMap, gPercentHeightContainerMap);
 }
 
 void RenderBlock::removePercentHeightDescendant(RenderBox* descendant)
 {
-    if (!gPercentHeightContainerMap)
-        return;
-
-    HashSet<RenderBlock*>* containerSet = gPercentHeightContainerMap->take(descendant);
-    if (!containerSet)
-        return;
-
-    HashSet<RenderBlock*>::iterator end = containerSet->end();
-    for (HashSet<RenderBlock*>::iterator it = containerSet->begin(); it != end; ++it) {
-        RenderBlock* container = *it;
-        HashSet<RenderBox*>* descendantSet = gPercentHeightDescendantsMap->get(container);
-        ASSERT(descendantSet);
-        if (!descendantSet)
-            continue;
-        ASSERT(descendantSet->contains(descendant));
-        descendantSet->remove(descendant);
-        if (descendantSet->isEmpty()) {
-            gPercentHeightDescendantsMap->remove(container);
-            delete descendantSet;
-        }
-    }
-
-    delete containerSet;
+    removeFromTrackedRendererMaps(descendant, gPercentHeightDescendantsMap, gPercentHeightContainerMap);
 }
 
-HashSet<RenderBox*>* RenderBlock::percentHeightDescendants() const
+TrackedRendererListHashSet* RenderBlock::percentHeightDescendants() const
 {
     return gPercentHeightDescendantsMap ? gPercentHeightDescendantsMap->get(this) : 0;
 }
@@ -6902,11 +6922,11 @@ LayoutUnit RenderBlock::pageRemainingLogicalHeightForOffset(LayoutUnit offset, P
     
     if (!inRenderFlowThread()) {
         LayoutUnit pageLogicalHeight = renderView->layoutState()->m_pageLogicalHeight;
-        LayoutUnit remainingHeight = pageLogicalHeight - layoutMod(offset, pageLogicalHeight);
+        LayoutUnit remainingHeight = pageLogicalHeight - intMod(offset, pageLogicalHeight);
         if (pageBoundaryRule == IncludePageBoundary) {
             // If includeBoundaryPoint is true the line exactly on the top edge of a
             // column will act as being part of the previous column.
-            remainingHeight = layoutMod(remainingHeight, pageLogicalHeight);
+            remainingHeight = intMod(remainingHeight, pageLogicalHeight);
         }
         return remainingHeight;
     }
@@ -7438,9 +7458,12 @@ RenderBlock* RenderBlock::createAnonymousColumnSpanWithParentRenderer(const Rend
 #ifndef NDEBUG
 void RenderBlock::checkPositionedObjectsNeedLayout()
 {
-    if (PositionedObjectsListHashSet* positionedObjects = this->positionedObjects()) {
-        PositionedObjectsListHashSet::const_iterator end = positionedObjects->end();
-        for (PositionedObjectsListHashSet::const_iterator it = positionedObjects->begin(); it != end; ++it) {
+    if (!gPositionedDescendantsMap)
+        return;
+
+    if (TrackedRendererListHashSet* positionedDescendantSet = positionedObjects()) {
+        TrackedRendererListHashSet::const_iterator end = positionedDescendantSet->end();
+        for (TrackedRendererListHashSet::const_iterator it = positionedDescendantSet->begin(); it != end; ++it) {
             RenderBox* currBox = *it;
             ASSERT(!currBox->needsLayout());
         }
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 53a1f202c..2c7fe3628 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -54,6 +54,9 @@ template <class Run> class BidiRunList;
 template <class Iterator> struct MidpointState;
 typedef BidiResolver<InlineIterator, BidiRun> InlineBidiResolver;
 typedef MidpointState<InlineIterator> LineMidpointState;
+typedef WTF::ListHashSet<RenderBox*> TrackedRendererListHashSet;
+typedef WTF::HashMap<const RenderBlock*, TrackedRendererListHashSet*> TrackedDescendantsMap;
+typedef WTF::HashMap<const RenderBox*, HashSet<RenderBlock*>*> TrackedContainerMap;
 
 enum CaretType { CursorCaret, DragCaret };
 
@@ -99,16 +102,19 @@ public:
     virtual void layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeight = 0);
 
     void insertPositionedObject(RenderBox*);
-    void removePositionedObject(RenderBox*);
+    static void removePositionedObject(RenderBox*);
     void removePositionedObjects(RenderBlock*);
 
-    typedef ListHashSet<RenderBox*, 4> PositionedObjectsListHashSet;
-    PositionedObjectsListHashSet* positionedObjects() const { return m_positionedObjects.get(); }
-    bool hasPositionedObjects() const { return m_positionedObjects && !m_positionedObjects->isEmpty(); }
+    TrackedRendererListHashSet* positionedObjects() const;
+    bool hasPositionedObjects() const
+    {
+        TrackedRendererListHashSet* objects = positionedObjects();
+        return objects && !objects->isEmpty();
+    }
 
     void addPercentHeightDescendant(RenderBox*);
     static void removePercentHeightDescendant(RenderBox*);
-    HashSet<RenderBox*>* percentHeightDescendants() const;
+    TrackedRendererListHashSet* percentHeightDescendants() const;
     static bool hasPercentHeightContainerMap();
     static bool hasPercentHeightDescendant(RenderBox*);
     static void clearPercentHeightDescendantsFrom(RenderBox*);
@@ -510,6 +516,9 @@ private:
     void layoutInlineChildren(bool relayoutChildren, LayoutUnit& repaintLogicalTop, LayoutUnit& repaintLogicalBottom);
     BidiRun* handleTrailingSpaces(BidiRunList<BidiRun>&, BidiContext*);
 
+    void insertIntoTrackedRendererMaps(RenderBox* descendant, TrackedDescendantsMap*&, TrackedContainerMap*&);
+    static void removeFromTrackedRendererMaps(RenderBox* descendant, TrackedDescendantsMap*&, TrackedContainerMap*&);
+
     virtual void borderFitAdjust(LayoutRect&) const; // Shrink the box in which the border paints if border-fit is set.
 
     virtual void updateBeforeAfterContent(PseudoId);
@@ -1068,9 +1077,6 @@ protected:
         const RenderBlock* m_renderer;
     };
     OwnPtr<FloatingObjects> m_floatingObjects;
-    
-    typedef PositionedObjectsListHashSet::const_iterator Iterator;
-    OwnPtr<PositionedObjectsListHashSet> m_positionedObjects;
 
     // Allocated only when some of these fields have non-default values
     struct RenderBlockRareData {
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index 088c14cbb..6b904b2cb 100755
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -75,8 +75,13 @@ public:
         ASSERT(block);
         updateAvailableWidth();
     }
+#if ENABLE(SUBPIXEL_LAYOUT)
+    bool fitsOnLine() const { return currentWidth() <= m_availableWidth + LayoutUnit::epsilon(); }
+    bool fitsOnLine(float extra) const { return currentWidth() + extra <= m_availableWidth + LayoutUnit::epsilon(); }
+#else
     bool fitsOnLine() const { return currentWidth() <= m_availableWidth; }
     bool fitsOnLine(float extra) const { return currentWidth() + extra <= m_availableWidth; }
+#endif
     float currentWidth() const { return m_committedWidth + m_uncommittedWidth; }
 
     // FIXME: We should eventually replace these three functions by ones that work on a higher abstraction.
@@ -768,8 +773,11 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
     ETextAlign textAlign = textAlignmentForLine(!reachedEnd && !lineBox->endsWithBreak());
     
     LayoutUnit lineLogicalHeight = logicalHeightForLine(this);
-    float logicalLeft = pixelSnappedLogicalLeftOffsetForLine(logicalHeight(), lineInfo.isFirstLine(), lineLogicalHeight);
-    float availableLogicalWidth = pixelSnappedLogicalRightOffsetForLine(logicalHeight(), lineInfo.isFirstLine(), lineLogicalHeight) - logicalLeft;
+    // CSS 2.1: "'Text-indent' only affects a line if it is the first formatted line of an element. For example, the first line of an anonymous block 
+    // box is only affected if it is the first child of its parent element."
+    bool firstLine = lineInfo.isFirstLine() && !(isAnonymousBlock() && parent()->firstChild() != this);
+    float logicalLeft = pixelSnappedLogicalLeftOffsetForLine(logicalHeight(), firstLine, lineLogicalHeight);
+    float availableLogicalWidth = pixelSnappedLogicalRightOffsetForLine(logicalHeight(), firstLine, lineLogicalHeight) - logicalLeft;
 
     bool needsWordSpacing = false;
     float totalLogicalWidth = lineBox->getFlowSpacingLogicalWidth();
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index 9b3b7de86..faf9102e1 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -175,12 +175,8 @@ void RenderBox::removeFloatingOrPositionedChildFromBlockLists()
         }
     }
 
-    if (isOutOfFlowPositioned()) {
-        for (RenderObject* curr = parent(); curr; curr = curr->parent()) {
-            if (curr->isRenderBlock())
-                toRenderBlock(curr)->removePositionedObject(this);
-        }
-    }
+    if (isOutOfFlowPositioned())
+        RenderBlock::removePositionedObject(this);
 }
 
 void RenderBox::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
@@ -309,7 +305,7 @@ void RenderBox::updateBoxModelInfoFromStyle()
     setFloating(!isOutOfFlowPositioned() && styleToUse->isFloating());
 
     // We also handle <body> and <html>, whose overflow applies to the viewport.
-    if (styleToUse->overflowX() != OVISIBLE && !isRootObject && (isRenderBlock() || isTableRow() || isTableSection())) {
+    if (styleToUse->overflowX() != OVISIBLE && !isRootObject && isRenderBlock()) {
         bool boxHasOverflowClip = true;
         if (isBody()) {
             // Overflow on the body can propagate to the viewport under the following conditions.
@@ -1252,7 +1248,7 @@ LayoutUnit RenderBox::perpendicularContainingBlockLogicalHeight() const
     return cb->computeContentBoxLogicalHeight(logicalHeightLength.value());
 }
 
-void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState, ApplyContainerFlipOrNot, bool* wasFixed) const
+void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState& transformState, MapLocalToContainerFlags mode, bool* wasFixed) const
 {
     if (repaintContainer == this)
         return;
@@ -1278,17 +1274,17 @@ void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool
     // If this box has a transform, it acts as a fixed position container for fixed descendants,
     // and may itself also be fixed position. So propagate 'fixed' up only if this box is fixed position.
     if (hasTransform && !isFixedPos)
-        fixed = false;
+        mode &= ~IsFixed;
     else if (isFixedPos)
-        fixed = true;
+        mode |= IsFixed;
 
     if (wasFixed)
-        *wasFixed = fixed;
+        *wasFixed = mode & IsFixed;
     
     LayoutSize containerOffset = offsetFromContainer(o, roundedLayoutPoint(transformState.mappedPoint()));
     
-    bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
-    if (useTransforms && shouldUseTransformFromContainer(o)) {
+    bool preserve3D = mode & UseTransforms && (o->style()->preserves3D() || style()->preserves3D());
+    if (mode & UseTransforms && shouldUseTransformFromContainer(o)) {
         TransformationMatrix t;
         getTransformFromContainer(o, containerOffset, t);
         transformState.applyTransform(t, preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
@@ -1303,15 +1299,16 @@ void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool
         return;
     }
 
+    mode &= ~ApplyContainerFlip;
     if (o->isRenderFlowThread()) {
         // Transform from render flow coordinates into region coordinates.
         RenderRegion* region = toRenderFlowThread(o)->mapFromFlowToRegion(transformState);
         if (region)
-            region->mapLocalToContainer(region->containerForRepaint(), fixed, useTransforms, transformState, DoNotApplyContainerFlip, wasFixed);
+            region->mapLocalToContainer(region->containerForRepaint(), transformState, mode, wasFixed);
         return;
     }
 
-    o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState, DoNotApplyContainerFlip, wasFixed);
+    o->mapLocalToContainer(repaintContainer, transformState, mode, wasFixed);
 }
 
 const RenderObject* RenderBox::pushMappingToContainer(const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap& geometryMap) const
@@ -2060,6 +2057,14 @@ LayoutUnit RenderBox::computeLogicalHeightUsing(SizeType heightType, const Lengt
     return logicalHeight;
 }
 
+LayoutUnit RenderBox::computeLogicalClientHeight(SizeType heightType, const Length& height)
+{
+    LayoutUnit heightIncludingScrollbar = computeContentLogicalHeightUsing(heightType, height);
+    if (heightIncludingScrollbar == -1)
+        return -1;
+    return std::max(LayoutUnit(0), computeContentBoxLogicalHeight(heightIncludingScrollbar) - scrollbarLogicalHeight());
+}
+
 LayoutUnit RenderBox::computeContentLogicalHeightUsing(SizeType heightType, const Length& height)
 {
     if (height.isAuto())
@@ -3951,8 +3956,6 @@ LayoutSize RenderBox::topLeftLocationOffset() const
         return locationOffset();
     
     LayoutRect rect(frameRect());
-    if (containerBlock->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
-        rect.move(containerBlock->verticalScrollbarWidth(), 0);
     containerBlock->flipForWritingMode(rect); // FIXME: This is wrong if we are an absolutely positioned object enclosed by a relative-positioned inline.
     return LayoutSize(rect.x(), rect.y());
 }
@@ -3999,6 +4002,10 @@ RenderObject* RenderBox::splitAnonymousBoxesAroundChild(RenderObject* beforeChil
             RenderBox* postBox = boxToSplit->createAnonymousBoxWithSameTypeAs(this);
             postBox->setChildrenInline(boxToSplit->childrenInline());
             RenderBox* parentBox = toRenderBox(boxToSplit->parent());
+            // We need to invalidate the |parentBox| before inserting the new node
+            // so that the table repainting logic knows the structure is dirty.
+            // See for example RenderTableCell:clippedOverflowRectForRepaint.
+            markBoxForRelayoutAfterSplit(parentBox);
             parentBox->virtualChildren()->insertChildNode(parentBox, postBox, boxToSplit->nextSibling());
             boxToSplit->moveChildrenTo(postBox, beforeChild, 0, true);
 
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index bbb034451..2dcc3cdc7 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -342,6 +342,7 @@ public:
 
     LayoutUnit computeLogicalWidthInRegionUsing(SizeType, LayoutUnit availableLogicalWidth, const RenderBlock* containingBlock, RenderRegion*, LayoutUnit offsetFromLogicalTopOfFirstPage);
     LayoutUnit computeLogicalHeightUsing(SizeType, const Length& height);
+    LayoutUnit computeLogicalClientHeight(SizeType, const Length& height);
     LayoutUnit computeContentLogicalHeightUsing(SizeType, const Length& height);
     LayoutUnit computeReplacedLogicalWidthUsing(SizeType, Length width) const;
     LayoutUnit computeReplacedLogicalWidthRespectingMinMaxWidth(LayoutUnit logicalWidth, bool includeMaxWidth = true) const;
@@ -518,7 +519,7 @@ protected:
     
     virtual bool shouldComputeSizeAsReplaced() const { return isReplaced() && !isInlineBlockOrInlineTable(); }
 
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState&, ApplyContainerFlipOrNot = ApplyContainerFlip, bool* wasFixed = 0) const;
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState&, MapLocalToContainerFlags mode = ApplyContainerFlip, bool* wasFixed = 0) const OVERRIDE;
     virtual const RenderObject* pushMappingToContainer(const RenderBoxModelObject*, RenderGeometryMap&) const;
     virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
 
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index 5eef3ccac..caf327b13 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -2526,6 +2526,8 @@ void RenderBoxModelObject::paintBoxShadow(const PaintInfo& info, const LayoutRec
                     context->fillRect(fillRect.rect(), Color::black, s->colorSpace());
                 else {
                     fillRect.expandRadii(shadowSpread);
+                    if (!fillRect.isRenderable())
+                        fillRect.adjustRadii();
                     context->fillRoundedRect(fillRect, Color::black, s->colorSpace());
                 }
             } else {
@@ -2749,9 +2751,8 @@ void RenderBoxModelObject::mapAbsoluteToLocalPoint(bool fixed, bool useTransform
 
 void RenderBoxModelObject::moveChildTo(RenderBoxModelObject* toBoxModelObject, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
 {
-    // FIXME: We need a performant way to handle clearing positioned objects from our list that are
-    // in |child|'s subtree so we could just clear them here. Because of this, we assume that callers
-    // have cleared their positioned objects list for child moves (!fullRemoveInsert) to avoid any badness.
+    // We assume that callers have cleared their positioned objects list for child moves (!fullRemoveInsert) so the
+    // positioned renderer maps don't become stale. It would be too slow to do the map lookup on each call.
     ASSERT(!fullRemoveInsert || !isRenderBlock() || !toRenderBlock(this)->hasPositionedObjects());
 
     ASSERT(this == child->parent());
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
index 4ae42bc7d..830efb2b0 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
@@ -122,7 +122,7 @@ RenderDeprecatedFlexibleBox::RenderDeprecatedFlexibleBox(Node* node)
     : RenderBlock(node)
 {
     setChildrenInline(false); // All of our children must be block-level
-    m_flexingChildren = m_stretchingChildren = false;
+    m_stretchingChildren = false;
 }
 
 RenderDeprecatedFlexibleBox::~RenderDeprecatedFlexibleBox()
@@ -258,18 +258,10 @@ void RenderDeprecatedFlexibleBox::layoutBlock(bool relayoutChildren, LayoutUnit)
 
     setHeight(0);
 
-    m_flexingChildren = m_stretchingChildren = false;
+    m_stretchingChildren = false;
 
     initMaxMarginValues();
 
-    // For overflow:scroll blocks, ensure we have both scrollbars in place always.
-    if (scrollsOverflow()) {
-        if (style()->overflowX() == OSCROLL)
-            layer()->setHasHorizontalScrollbar(true);
-        if (style()->overflowY() == OSCROLL)
-            layer()->setHasVerticalScrollbar(true);
-    }
-
     if (isHorizontal())
         layoutHorizontalBox(relayoutChildren);
     else
@@ -360,7 +352,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
     FlexBoxIterator iterator(this);
     unsigned int highestFlexGroup = 0;
     unsigned int lowestFlexGroup = 0;
-    bool haveFlex = false;
+    bool haveFlex = false, flexingChildren = false;
     gatherFlexChildrenInfo(iterator, relayoutChildren, highestFlexGroup, lowestFlexGroup, haveFlex);
 
     RenderBlock::startDelayUpdateScrollInfo();
@@ -494,7 +486,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
         remainingSpace = borderLeft() + paddingLeft() + contentWidth() - xPos;
 
         m_stretchingChildren = false;
-        if (m_flexingChildren)
+        if (flexingChildren)
             haveFlex = false; // We're done.
         else if (haveFlex) {
             // We have some flexible objects.  See if we need to grow/shrink them at all.
@@ -546,7 +538,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                             LayoutUnit spaceAdd = LayoutUnit(spaceAvailableThisPass * (child->style()->boxFlex() / totalFlex));
                             if (spaceAdd) {
                                 child->setOverrideLogicalContentWidth(child->overrideLogicalContentWidth() + spaceAdd);
-                                m_flexingChildren = true;
+                                flexingChildren = true;
                                 relayoutChildren = true;
                             }
 
@@ -563,7 +555,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                         for (RenderBox* child = iterator.first(); child && groupRemainingSpace; child = iterator.next()) {
                             if (allowedChildFlex(child, expanding, i)) {
                                 child->setOverrideLogicalContentWidth(child->overrideLogicalContentWidth() + spaceAdd);
-                                m_flexingChildren = true;
+                                flexingChildren = true;
                                 relayoutChildren = true;
                                 remainingSpace -= spaceAdd;
                                 groupRemainingSpace -= spaceAdd;
@@ -574,13 +566,11 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             }
 
             // We didn't find any children that could grow.
-            if (haveFlex && !m_flexingChildren)
+            if (haveFlex && !flexingChildren)
                 haveFlex = false;
         }
     } while (haveFlex);
 
-    m_flexingChildren = false;
-
     RenderBlock::finishDelayUpdateScrollInfo();
 
     if (remainingSpace > 0 && ((style()->isLeftToRightDirection() && style()->boxPack() != Start)
@@ -649,7 +639,7 @@ void RenderDeprecatedFlexibleBox::layoutVerticalBox(bool relayoutChildren)
     FlexBoxIterator iterator(this);
     unsigned int highestFlexGroup = 0;
     unsigned int lowestFlexGroup = 0;
-    bool haveFlex = false;
+    bool haveFlex = false, flexingChildren = false;
     gatherFlexChildrenInfo(iterator, relayoutChildren, highestFlexGroup, lowestFlexGroup, haveFlex);
 
     // We confine the line clamp ugliness to vertical flexible boxes (thus keeping it out of
@@ -750,7 +740,7 @@ void RenderDeprecatedFlexibleBox::layoutVerticalBox(bool relayoutChildren)
 
         remainingSpace = borderTop() + paddingTop() + contentHeight() - yPos;
 
-        if (m_flexingChildren)
+        if (flexingChildren)
             haveFlex = false; // We're done.
         else if (haveFlex) {
             // We have some flexible objects.  See if we need to grow/shrink them at all.
@@ -799,7 +789,7 @@ void RenderDeprecatedFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                             LayoutUnit spaceAdd = static_cast<LayoutUnit>(spaceAvailableThisPass * (child->style()->boxFlex() / totalFlex));
                             if (spaceAdd) {
                                 child->setOverrideLogicalContentHeight(child->overrideLogicalContentHeight() + spaceAdd);
-                                m_flexingChildren = true;
+                                flexingChildren = true;
                                 relayoutChildren = true;
                             }
 
@@ -816,7 +806,7 @@ void RenderDeprecatedFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                         for (RenderBox* child = iterator.first(); child && groupRemainingSpace; child = iterator.next()) {
                             if (allowedChildFlex(child, expanding, i)) {
                                 child->setOverrideLogicalContentHeight(child->overrideLogicalContentHeight() + spaceAdd);
-                                m_flexingChildren = true;
+                                flexingChildren = true;
                                 relayoutChildren = true;
                                 remainingSpace -= spaceAdd;
                                 groupRemainingSpace -= spaceAdd;
@@ -827,7 +817,7 @@ void RenderDeprecatedFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             }
 
             // We didn't find any children that could grow.
-            if (haveFlex && !m_flexingChildren)
+            if (haveFlex && !flexingChildren)
                 haveFlex = false;
         }
     } while (haveFlex);
@@ -930,9 +920,7 @@ void RenderDeprecatedFlexibleBox::applyLineClamp(FlexBoxIterator& iterator, bool
 
         child->setChildNeedsLayout(true, MarkOnlyThis);
         child->setOverrideLogicalContentHeight(newHeight - child->borderAndPaddingHeight());
-        m_flexingChildren = true;
         child->layoutIfNeeded();
-        m_flexingChildren = false;
         child->clearOverrideSize();
 
         // FIXME: For now don't support RTL.
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
index 32f518199..958bdf32f 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
@@ -49,7 +49,6 @@ public:
     virtual bool avoidsFloats() const { return true; }
 
     virtual bool isDeprecatedFlexibleBox() const { return true; }
-    virtual bool isFlexingChildren() const { return m_flexingChildren; }
     virtual bool isStretchingChildren() const { return m_stretchingChildren; }
 
     void placeChild(RenderBox* child, const LayoutPoint& location);
@@ -61,8 +60,7 @@ protected:
     bool isVertical() const { return style()->boxOrient() == VERTICAL; }
     bool isHorizontal() const { return style()->boxOrient() == HORIZONTAL; }
 
-    bool m_flexingChildren : 1;
-    bool m_stretchingChildren : 1;
+    bool m_stretchingChildren;
 
 private:
     void applyLineClamp(FlexBoxIterator&, bool relayoutChildren);
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.cpp b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
index a3657fae3..135959420 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.cpp
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -109,6 +109,8 @@ static String unavailablePluginReplacementText(RenderEmbeddedObject::PluginUnava
         return missingPluginText();
     case RenderEmbeddedObject::PluginCrashed:
         return crashedPluginText();
+    case RenderEmbeddedObject::PluginBlockedByContentSecurityPolicy:
+        return blockedPluginByContentSecurityPolicyText();
     case RenderEmbeddedObject::InsecurePluginVersion:
         return insecurePluginVersionText();
     }
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.h b/Source/WebCore/rendering/RenderEmbeddedObject.h
index fd44e080f..be854c1ed 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.h
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.h
@@ -39,6 +39,7 @@ public:
     enum PluginUnavailabilityReason {
         PluginMissing,
         PluginCrashed,
+        PluginBlockedByContentSecurityPolicy,
         InsecurePluginVersion
     };
     void setPluginUnavailabilityReason(PluginUnavailabilityReason);
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.cpp b/Source/WebCore/rendering/RenderFileUploadControl.cpp
index 3b880ccf1..bac5b59c7 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/Source/WebCore/rendering/RenderFileUploadControl.cpp
@@ -60,6 +60,11 @@ RenderFileUploadControl::~RenderFileUploadControl()
 {
 }
 
+bool RenderFileUploadControl::canBeReplacedWithInlineRunIn() const
+{
+    return false;
+}
+
 void RenderFileUploadControl::updateFromElement()
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
@@ -141,8 +146,7 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, const LayoutPoin
         // We want to match the button's baseline
         RenderButton* buttonRenderer = toRenderButton(button->renderer());
         // FIXME: Make this work with transforms.
-        LayoutUnit textY = buttonRenderer->absoluteBoundingBoxRectIgnoringTransforms().y()
-            + buttonRenderer->baselinePosition(AlphabeticBaseline, true, HorizontalLine, PositionOnContainingLine);
+        LayoutUnit textY = paintOffset.y() + buttonRenderer->baselinePosition(AlphabeticBaseline, true, HorizontalLine, PositionOnContainingLine);
 
         paintInfo.context->setFillColor(style()->visitedDependentColor(CSSPropertyColor), style()->colorSpace());
         
@@ -190,7 +194,8 @@ void RenderFileUploadControl::computePreferredLogicalWidths()
         const String label = theme()->fileListDefaultLabel(node()->toInputElement()->multiple());
         float defaultLabelWidth = font.width(constructTextRun(this, font, label, style, TextRun::AllowTrailingExpansion));
         if (HTMLInputElement* button = uploadButton())
-            defaultLabelWidth += button->renderer()->maxPreferredLogicalWidth() + afterButtonSpacing;
+            if (RenderObject* buttonRenderer = button->renderer())
+                defaultLabelWidth += buttonRenderer->maxPreferredLogicalWidth() + afterButtonSpacing;
         m_maxPreferredLogicalWidth = static_cast<int>(ceilf(max(minDefaultLabelWidth, defaultLabelWidth)));
     }
 
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.h b/Source/WebCore/rendering/RenderFileUploadControl.h
index 11015eb90..2ce4ca6f2 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.h
+++ b/Source/WebCore/rendering/RenderFileUploadControl.h
@@ -44,6 +44,7 @@ public:
 private:
     virtual const char* renderName() const { return "RenderFileUploadControl"; }
 
+    virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
     virtual void updateFromElement();
     virtual void computePreferredLogicalWidths();
     virtual void paintObject(PaintInfo&, const LayoutPoint&);
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index 3b1d4737c..5de6425f2 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -39,6 +39,16 @@
 
 namespace WebCore {
 
+// Normally, -1 and 0 are not valid in a HashSet, but these are relatively likely order: values. Instead,
+// we make the two smallest int values invalid order: values (in the css parser code we clamp them to
+// int min + 2).
+struct RenderFlexibleBox::OrderHashTraits : WTF::GenericHashTraits<int> {
+    static const bool emptyValueIsZero = false;
+    static int emptyValue() { return std::numeric_limits<int>::min(); }
+    static void constructDeletedValue(int& slot) { slot = std::numeric_limits<int>::min() + 1; }
+    static bool isDeletedValue(int value) { return value == std::numeric_limits<int>::min() + 1; }
+};
+
 class RenderFlexibleBox::OrderIterator {
 public:
     OrderIterator(RenderFlexibleBox* flexibleBox, const OrderHashSet& orderValues)
@@ -89,8 +99,8 @@ public:
 private:
     RenderFlexibleBox* m_flexibleBox;
     RenderBox* m_currentChild;
-    Vector<float> m_orderValues;
-    Vector<float>::const_iterator m_orderValuesIterator;
+    Vector<int> m_orderValues;
+    Vector<int>::const_iterator m_orderValuesIterator;
 };
 
 struct RenderFlexibleBox::LineContext {
@@ -194,10 +204,10 @@ void RenderFlexibleBox::computePreferredLogicalWidths()
     LayoutUnit scrollbarWidth = 0;
     if (hasOverflowClip()) {
         if (isHorizontalWritingMode() && styleToUse->overflowY() == OSCROLL) {
-            layer()->setHasVerticalScrollbar(true);
+            ASSERT(layer()->hasVerticalScrollbar());
             scrollbarWidth = verticalScrollbarWidth();
         } else if (!isHorizontalWritingMode() && styleToUse->overflowX() == OSCROLL) {
-            layer()->setHasHorizontalScrollbar(true);
+            ASSERT(layer()->hasHorizontalScrollbar());
             scrollbarWidth = horizontalScrollbarHeight();
         }
     }
@@ -248,14 +258,6 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren, LayoutUnit)
 
     m_overflow.clear();
 
-    // For overflow:scroll blocks, ensure we have both scrollbars in place always.
-    if (scrollsOverflow()) {
-        if (style()->overflowX() == OSCROLL)
-            layer()->setHasHorizontalScrollbar(true);
-        if (style()->overflowY() == OSCROLL)
-            layer()->setHasVerticalScrollbar(true);
-    }
-
     WTF::Vector<LineContext> lineContexts;
     OrderHashSet orderValues;
     computeMainAxisPreferredSizes(relayoutChildren, orderValues);
@@ -358,11 +360,6 @@ Length RenderFlexibleBox::flexBasisForChild(RenderBox* child) const
     return flexLength;
 }
 
-Length RenderFlexibleBox::crossAxisLength() const
-{
-    return isHorizontalFlow() ? style()->height() : style()->width();
-}
-
 void RenderFlexibleBox::setCrossAxisExtent(LayoutUnit extent)
 {
     if (isHorizontalFlow())
@@ -399,10 +396,19 @@ LayoutUnit RenderFlexibleBox::crossAxisContentExtent() const
 LayoutUnit RenderFlexibleBox::mainAxisContentExtent()
 {
     if (isColumnFlow())
-        return std::max(LayoutUnit(0), computeContentLogicalHeightUsing(MainOrPreferredSize, style()->logicalHeight()));
+        return std::max(LayoutUnit(0), computeLogicalClientHeight(MainOrPreferredSize, style()->logicalHeight()));
     return contentLogicalWidth();
 }
 
+LayoutUnit RenderFlexibleBox::computeMainAxisExtentForChild(RenderBox* child, SizeType sizeType, const Length& size, LayoutUnit maximumValue)
+{
+    // FIXME: This is wrong for orthogonal flows. It should use the flexbox's writing-mode, not the child's in order
+    // to figure out the logical height/width.
+    if (isColumnFlow())
+        return child->computeLogicalClientHeight(sizeType, size);
+    return child->computeContentBoxLogicalWidth(valueForLength(size, maximumValue, view()));
+}
+
 WritingMode RenderFlexibleBox::transformedWritingMode() const
 {
     WritingMode mode = style()->writingMode();
@@ -599,7 +605,7 @@ LayoutUnit RenderFlexibleBox::preferredMainAxisContentExtentForChild(RenderBox*
         LayoutUnit mainAxisExtent = hasOrthogonalFlow(child) ? child->logicalHeight() : child->maxPreferredLogicalWidth();
         return mainAxisExtent - mainAxisBorderAndPaddingExtentForChild(child);
     }
-    return std::max(LayoutUnit(0), minimumValueForLength(flexBasis, mainAxisContentExtent(), view()));
+    return std::max(LayoutUnit(0), computeMainAxisExtentForChild(child, MainOrPreferredSize, flexBasis, mainAxisContentExtent()));
 }
 
 LayoutUnit RenderFlexibleBox::computeAvailableFreeSpace(LayoutUnit preferredMainAxisExtent)
@@ -610,11 +616,11 @@ LayoutUnit RenderFlexibleBox::computeAvailableFreeSpace(LayoutUnit preferredMain
     else if (hasOverrideHeight())
         contentExtent = overrideLogicalContentHeight();
     else {
-        LayoutUnit heightResult = computeContentLogicalHeightUsing(MainOrPreferredSize, style()->logicalHeight());
+        LayoutUnit heightResult = computeLogicalClientHeight(MainOrPreferredSize, style()->logicalHeight());
         if (heightResult == -1)
             heightResult = preferredMainAxisExtent;
-        LayoutUnit minHeight = computeContentLogicalHeightUsing(MinSize, style()->logicalMinHeight()); // Leave as -1 if unset.
-        LayoutUnit maxHeight = style()->logicalMaxHeight().isUndefined() ? heightResult : computeContentLogicalHeightUsing(MaxSize, style()->logicalMaxHeight());
+        LayoutUnit minHeight = computeLogicalClientHeight(MinSize, style()->logicalMinHeight()); // Leave as -1 if unset.
+        LayoutUnit maxHeight = style()->logicalMaxHeight().isUndefined() ? heightResult : computeLogicalClientHeight(MaxSize, style()->logicalMaxHeight());
         if (maxHeight == -1)
             maxHeight = heightResult;
         heightResult = std::min(maxHeight, heightResult);
@@ -751,6 +757,14 @@ LayoutUnit RenderFlexibleBox::marginBoxAscentForChild(RenderBox* child)
     return ascent + flowAwareMarginBeforeForChild(child);
 }
 
+LayoutUnit RenderFlexibleBox::computeMarginValue(Length margin, LayoutUnit availableSize, RenderView* view)
+{
+    // CSS always computes percent margins with respect to the containing block's width, even for margin-top/margin-bottom.
+    if (margin.isPercent())
+        availableSize = logicalWidth();
+    return minimumValueForLength(margin, availableSize, view);
+}
+
 void RenderFlexibleBox::computeMainAxisPreferredSizes(bool relayoutChildren, OrderHashSet& orderValues)
 {
     LayoutUnit flexboxAvailableContentExtent = mainAxisContentExtent();
@@ -766,18 +780,18 @@ void RenderFlexibleBox::computeMainAxisPreferredSizes(bool relayoutChildren, Ord
         Length childMainAxisMin = isHorizontalFlow() ? child->style()->minWidth() : child->style()->minHeight();
         if (hasOrthogonalFlow(child) && (flexBasisForChild(child).isAuto() || childMainAxisMin.isAuto())) {
             if (!relayoutChildren)
-                child->setChildNeedsLayout(true);
+                child->setChildNeedsLayout(true, MarkOnlyThis);
             child->layoutIfNeeded();
         }
 
         // Before running the flex algorithm, 'auto' has a margin of 0.
         // Also, if we're not auto sizing, we don't do a layout that computes the start/end margins.
         if (isHorizontalFlow()) {
-            child->setMarginLeft(minimumValueForLength(child->style()->marginLeft(), flexboxAvailableContentExtent, renderView));
-            child->setMarginRight(minimumValueForLength(child->style()->marginRight(), flexboxAvailableContentExtent, renderView));
+            child->setMarginLeft(computeMarginValue(child->style()->marginLeft(), flexboxAvailableContentExtent, renderView));
+            child->setMarginRight(computeMarginValue(child->style()->marginRight(), flexboxAvailableContentExtent, renderView));
         } else {
-            child->setMarginTop(minimumValueForLength(child->style()->marginTop(), flexboxAvailableContentExtent, renderView));
-            child->setMarginBottom(minimumValueForLength(child->style()->marginBottom(), flexboxAvailableContentExtent, renderView));
+            child->setMarginTop(computeMarginValue(child->style()->marginTop(), flexboxAvailableContentExtent, renderView));
+            child->setMarginBottom(computeMarginValue(child->style()->marginBottom(), flexboxAvailableContentExtent, renderView));
         }
     }
 }
@@ -787,10 +801,10 @@ LayoutUnit RenderFlexibleBox::lineBreakLength()
     if (!isColumnFlow())
         return mainAxisContentExtent();
 
-    LayoutUnit height = computeContentLogicalHeightUsing(MainOrPreferredSize, style()->logicalHeight());
+    LayoutUnit height = computeLogicalClientHeight(MainOrPreferredSize, style()->logicalHeight());
     if (height == -1)
         height = MAX_LAYOUT_UNIT;
-    LayoutUnit maxHeight = computeContentLogicalHeightUsing(MaxSize, style()->logicalMaxHeight());
+    LayoutUnit maxHeight = computeLogicalClientHeight(MaxSize, style()->logicalMaxHeight());
     if (maxHeight != -1)
         height = std::min(height, maxHeight);
     return height;
@@ -798,25 +812,23 @@ LayoutUnit RenderFlexibleBox::lineBreakLength()
 
 LayoutUnit RenderFlexibleBox::adjustChildSizeForMinAndMax(RenderBox* child, LayoutUnit childSize, LayoutUnit flexboxAvailableContentExtent)
 {
+    // FIXME: Support intrinsic min/max lengths.
     Length max = isHorizontalFlow() ? child->style()->maxWidth() : child->style()->maxHeight();
-    Length min = isHorizontalFlow() ? child->style()->minWidth() : child->style()->minHeight();
-    RenderView* renderView = view();
-    // FIXME: valueForLength isn't quite right in quirks mode: percentage heights should check parents until a value is found.
-    // https://bugs.webkit.org/show_bug.cgi?id=81809
-    if (max.isSpecified() && childSize > valueForLength(max, flexboxAvailableContentExtent, renderView))
-        childSize = valueForLength(max, flexboxAvailableContentExtent, renderView);
-
-    if (min.isSpecified() && childSize < valueForLength(min, flexboxAvailableContentExtent, renderView))
-        return valueForLength(min, flexboxAvailableContentExtent, renderView);
-
-    // FIXME: Support min/max sizes of fit-content, max-content and fill-available.
-    if (min.isAuto()) {
-        LayoutUnit minContent = hasOrthogonalFlow(child) ? child->logicalHeight() : child->minPreferredLogicalWidth();
-        minContent -= mainAxisBorderAndPaddingExtentForChild(child);
-        return std::max(childSize, minContent);
+    if (max.isSpecified()) {
+        LayoutUnit maxExtent = computeMainAxisExtentForChild(child, MaxSize, max, flexboxAvailableContentExtent);
+        if (maxExtent != -1 && childSize > maxExtent)
+            childSize = maxExtent;
     }
 
-    return childSize;
+    Length min = isHorizontalFlow() ? child->style()->minWidth() : child->style()->minHeight();
+    LayoutUnit minExtent = 0;
+    if (min.isSpecified())
+        minExtent = computeMainAxisExtentForChild(child, MinSize, min, flexboxAvailableContentExtent);
+    else if (min.isAuto()) {
+        minExtent = hasOrthogonalFlow(child) ? child->logicalHeight() : child->minPreferredLogicalWidth();
+        minExtent -= mainAxisBorderAndPaddingExtentForChild(child);
+    }
+    return std::max(childSize, minExtent);
 }
 
 bool RenderFlexibleBox::computeNextFlexLine(OrderIterator& iterator, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalFlexGrow, float& totalWeightedFlexShrink, LayoutUnit& minMaxAppliedMainAxisExtent)
@@ -1007,7 +1019,7 @@ void RenderFlexibleBox::layoutAndPlaceChildren(LayoutUnit& crossAxisOffset, cons
         LayoutUnit childPreferredSize = childSizes[i] + mainAxisBorderAndPaddingExtentForChild(child);
         setLogicalOverrideSize(child, childPreferredSize);
         // FIXME: Can avoid laying out here in some cases. See https://webkit.org/b/87905.
-        child->setChildNeedsLayout(true);
+        child->setChildNeedsLayout(true, MarkOnlyThis);
         child->layoutIfNeeded();
 
         updateAutoMarginsInMainAxis(child, autoMarginOffset);
@@ -1231,14 +1243,14 @@ void RenderFlexibleBox::applyStretchAlignmentToChild(RenderBox* child, LayoutUni
         if (child->logicalHeight() != logicalHeightBefore) {
             child->setOverrideLogicalContentHeight(child->logicalHeight() - child->borderAndPaddingLogicalHeight());
             child->setLogicalHeight(0);
-            child->setChildNeedsLayout(true);
+            child->setChildNeedsLayout(true, MarkOnlyThis);
             child->layoutIfNeeded();
         }
     } else if (isColumnFlow() && child->style()->logicalWidth().isAuto() && isMultiline()) {
         // FIXME: Handle min-width and max-width.
         LayoutUnit childWidth = lineCrossAxisExtent - crossAxisMarginExtentForChild(child);
         child->setOverrideLogicalContentWidth(std::max(ZERO_LAYOUT_UNIT, childWidth));
-        child->setChildNeedsLayout(true);
+        child->setChildNeedsLayout(true, MarkOnlyThis);
         child->layoutIfNeeded();
     }
 }
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.h b/Source/WebCore/rendering/RenderFlexibleBox.h
index 1a9ebc982..bd05b450c 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.h
+++ b/Source/WebCore/rendering/RenderFlexibleBox.h
@@ -44,6 +44,7 @@ public:
     virtual const char* renderName() const OVERRIDE;
 
     virtual bool isFlexibleBox() const OVERRIDE { return true; }
+    virtual bool avoidsFloats() const OVERRIDE { return true; }
     virtual void computePreferredLogicalWidths() OVERRIDE;
     virtual void layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeight = 0) OVERRIDE;
 
@@ -62,7 +63,8 @@ private:
         NoFlipForRowReverse,
     };
 
-    typedef HashSet<float> OrderHashSet;
+    struct OrderHashTraits;
+    typedef HashSet<int, DefaultHash<int>::Hash, OrderHashTraits> OrderHashSet;
 
     class OrderIterator;
     typedef WTF::HashMap<const RenderBox*, LayoutUnit> InflexibleFlexItemSize;
@@ -75,7 +77,6 @@ private:
     bool isColumnFlow() const;
     bool isLeftToRightFlow() const;
     bool isMultiline() const;
-    Length crossAxisLength() const;
     Length flexBasisForChild(RenderBox* child) const;
     void setCrossAxisExtent(LayoutUnit);
     LayoutUnit crossAxisExtentForChild(RenderBox* child);
@@ -84,6 +85,7 @@ private:
     LayoutUnit mainAxisExtent() const;
     LayoutUnit crossAxisContentExtent() const;
     LayoutUnit mainAxisContentExtent();
+    LayoutUnit computeMainAxisExtentForChild(RenderBox* child, SizeType, const Length& size, LayoutUnit maximumValue);
     WritingMode transformedWritingMode() const;
     LayoutUnit flowAwareBorderStart() const;
     LayoutUnit flowAwareBorderEnd() const;
@@ -117,6 +119,7 @@ private:
     LayoutUnit availableAlignmentSpaceForChild(LayoutUnit lineCrossAxisExtent, RenderBox*);
     LayoutUnit marginBoxAscentForChild(RenderBox*);
 
+    LayoutUnit computeMarginValue(Length margin, LayoutUnit availableSize, RenderView*);
     void computeMainAxisPreferredSizes(bool relayoutChildren, OrderHashSet&);
     LayoutUnit lineBreakLength();
     LayoutUnit adjustChildSizeForMinAndMax(RenderBox*, LayoutUnit childSize, LayoutUnit flexboxAvailableContentExtent);
diff --git a/Source/WebCore/rendering/RenderFlowThread.cpp b/Source/WebCore/rendering/RenderFlowThread.cpp
index 1b09cbb8d..1c805c027 100644
--- a/Source/WebCore/rendering/RenderFlowThread.cpp
+++ b/Source/WebCore/rendering/RenderFlowThread.cpp
@@ -52,7 +52,6 @@ RenderFlowThread::RenderFlowThread(Node* node)
     , m_regionsHaveUniformLogicalWidth(true)
     , m_regionsHaveUniformLogicalHeight(true)
     , m_overset(true)
-    , m_regionLayoutUpdateEventTimer(this, &RenderFlowThread::regionLayoutUpdateEventTimerFired)
 {
     ASSERT(node->document()->cssRegionsEnabled());
     setIsAnonymous(false);
@@ -206,15 +205,9 @@ void RenderFlowThread::layout()
     LayoutStateMaintainer statePusher(view(), this, regionsChanged);
     RenderBlock::layout();
     statePusher.pop();
-    if (document()->hasListenerType(Document::REGIONLAYOUTUPDATE_LISTENER) && !m_regionLayoutUpdateEventTimer.isActive())
-        for (RenderRegionList::iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
-            RenderRegion* region = *iter;
-            if (region->shouldDispatchRegionLayoutUpdateEvent()) {
-                // at least one region needs to dispatch the event
-                m_regionLayoutUpdateEventTimer.startOneShot(0);
-                break;
-            }
-        }
+    
+    if (shouldDispatchRegionLayoutUpdateEvent())
+        dispatchRegionLayoutUpdateEvent();
 }
 
 void RenderFlowThread::computeLogicalWidth()
@@ -268,8 +261,8 @@ void RenderFlowThread::paintIntoRegion(PaintInfo& paintInfo, RenderRegion* regio
     // paintOffset contains the offset where the painting should occur
     // adjusted with the region padding and border.
     LayoutRect regionRect(region->regionRect());
-    LayoutRect regionOverflowRect(region->regionOverflowRect());
-    LayoutRect regionClippingRect(paintOffset + (regionOverflowRect.location() - regionRect.location()), regionOverflowRect.size());
+    LayoutRect regionOversetRect(region->regionOversetRect());
+    LayoutRect regionClippingRect(paintOffset + (regionOversetRect.location() - regionRect.location()), regionOversetRect.size());
 
     PaintInfo info(paintInfo);
     info.rect.intersect(pixelSnappedIntRect(regionClippingRect));
@@ -302,8 +295,8 @@ void RenderFlowThread::paintIntoRegion(PaintInfo& paintInfo, RenderRegion* regio
 bool RenderFlowThread::hitTestRegion(RenderRegion* region, const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset)
 {
     LayoutRect regionRect(region->regionRect());
-    LayoutRect regionOverflowRect = region->regionOverflowRect();
-    LayoutRect regionClippingRect(accumulatedOffset + (regionOverflowRect.location() - regionRect.location()), regionOverflowRect.size());
+    LayoutRect regionOversetRect = region->regionOversetRect();
+    LayoutRect regionClippingRect(accumulatedOffset + (regionOversetRect.location() - regionRect.location()), regionOversetRect.size());
     if (!regionClippingRect.contains(pointInContainer.point()))
         return false;
 
@@ -349,12 +342,12 @@ void RenderFlowThread::repaintRectangleInRegions(const LayoutRect& repaintRect,
 
         // We only have to issue a repaint in this region if the region rect intersects the repaint rect.
         LayoutRect flippedRegionRect(region->regionRect());
-        LayoutRect flippedRegionOverflowRect(region->regionOverflowRect());
+        LayoutRect flippedRegionOversetRect(region->regionOversetRect());
         flipForWritingMode(flippedRegionRect); // Put the region rects into physical coordinates.
-        flipForWritingMode(flippedRegionOverflowRect);
+        flipForWritingMode(flippedRegionOversetRect);
 
         LayoutRect clippedRect(repaintRect);
-        clippedRect.intersect(flippedRegionOverflowRect);
+        clippedRect.intersect(flippedRegionOversetRect);
         if (clippedRect.isEmpty())
             continue;
 
@@ -438,7 +431,7 @@ LayoutUnit RenderFlowThread::regionRemainingLogicalHeightForLine(LayoutUnit posi
         // If IncludePageBoundary is set, the line exactly on the top edge of a
         // region will act as being part of the previous region.
         LayoutUnit regionHeight = isHorizontalWritingMode() ? region->regionRect().height() : region->regionRect().width();
-        remainingHeight = layoutMod(remainingHeight, regionHeight);
+        remainingHeight = intMod(remainingHeight, regionHeight);
     }
     return remainingHeight;
 }
@@ -701,50 +694,21 @@ void RenderFlowThread::computeOverflowStateForRegions(LayoutUnit oldClientAfterE
         if (flowMin <= 0)
             state = RenderRegion::RegionEmpty;
         if (flowMax > 0)
-            state = RenderRegion::RegionOverflow;
+            state = RenderRegion::RegionOverset;
         region->setRegionState(state);
-        // determine whether this region should dispatch a regionLayoutUpdate event
-        // FIXME: currently it cannot determine whether a region whose regionOverflow state remained either "fit" or "overflow" has actually
-        // changed, so it just assumes that those region should dispatch the event
+        // determine whether the NamedFlow object should dispatch a regionLayoutUpdate event
+        // FIXME: currently it cannot determine whether a region whose regionOverset state remained either "fit" or "overset" has actually
+        // changed, so it just assumes that the NamedFlow should dispatch the event
         if (previousState != state
             || state == RenderRegion::RegionFit
-            || state == RenderRegion::RegionOverflow)
-            region->setDispatchRegionLayoutUpdateEvent(true);
+            || state == RenderRegion::RegionOverset)
+            setDispatchRegionLayoutUpdateEvent(true);
     }
 
     // With the regions overflow state computed we can also set the overset flag for the named flow.
     // If there are no valid regions in the chain, overset is true
     RenderRegion* lastReg = lastRegion();
-    m_overset = lastReg ? lastReg->regionState() == RenderRegion::RegionOverflow : true;
-}
-
-void RenderFlowThread::regionLayoutUpdateEventTimerFired(Timer<RenderFlowThread>*)
-{
-    // Create a copy of region nodes, to protect them for being destroyed in the event listener
-    Vector<RefPtr<Node> > regionNodes;
-    regionNodes.reserveCapacity(m_regionList.size());
-    for (RenderRegionList::iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
-        RenderRegion* region = *iter;
-        ASSERT(region->node() && region->node()->isElementNode());
-        // dispatch the event only for marked regions and only for those who have a listener
-        if (region->shouldDispatchRegionLayoutUpdateEvent()) {
-            regionNodes.append(region->node());
-            // clear the dispatch flag here, as it is possible to be set again due to event listeners
-            region->setDispatchRegionLayoutUpdateEvent(false);
-        }
-    }
-    for (Vector<RefPtr<Node> >::const_iterator it = regionNodes.begin(); it != regionNodes.end(); ++it) {
-        RefPtr<Node> node = *it;
-        RefPtr<Document> document = node->document();
-        if (!document)
-            continue;
-        RenderObject* renderer = node->renderer();
-        if (renderer && renderer->isRenderRegion()) {
-            node->dispatchRegionLayoutUpdateEvent();
-            // Layout needs to be uptodate after each event listener
-            document->updateLayoutIgnorePendingStylesheets();
-        }
-    }
+    m_overset = lastReg ? lastReg->regionState() == RenderRegion::RegionOverset : true;
 }
 
 bool RenderFlowThread::regionInRange(const RenderRegion* targetRegion, const RenderRegion* startRegion, const RenderRegion* endRegion) const
diff --git a/Source/WebCore/rendering/RenderFlowThread.h b/Source/WebCore/rendering/RenderFlowThread.h
index c76ee0870..4730be8dc 100644
--- a/Source/WebCore/rendering/RenderFlowThread.h
+++ b/Source/WebCore/rendering/RenderFlowThread.h
@@ -133,8 +133,13 @@ protected:
     virtual const char* renderName() const = 0;
 
     bool shouldRepaint(const LayoutRect&) const;
-    void regionLayoutUpdateEventTimerFired(Timer<RenderFlowThread>*);
     bool regionInRange(const RenderRegion* targetRegion, const RenderRegion* startRegion, const RenderRegion* endRegion) const;
+    
+    void setDispatchRegionLayoutUpdateEvent(bool value) { m_dispatchRegionLayoutUpdateEvent = value; }
+    bool shouldDispatchRegionLayoutUpdateEvent() { return m_dispatchRegionLayoutUpdateEvent; }
+    
+    // Override if the flow thread implementation supports dispatching events when the flow layout is updated (e.g. for named flows)
+    virtual void dispatchRegionLayoutUpdateEvent() { m_dispatchRegionLayoutUpdateEvent = false; }
 
     RenderRegionList m_regionList;
 
@@ -174,7 +179,7 @@ protected:
     bool m_regionsHaveUniformLogicalHeight;
     bool m_overset;
     bool m_hasRegionsWithStyling;
-    Timer<RenderFlowThread> m_regionLayoutUpdateEventTimer;
+    bool m_dispatchRegionLayoutUpdateEvent;
 };
 
 inline RenderFlowThread* toRenderFlowThread(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderFullScreen.cpp b/Source/WebCore/rendering/RenderFullScreen.cpp
index e0507388d..2f1c311b1 100644
--- a/Source/WebCore/rendering/RenderFullScreen.cpp
+++ b/Source/WebCore/rendering/RenderFullScreen.cpp
@@ -105,15 +105,32 @@ static PassRefPtr<RenderStyle> createFullScreenStyle()
     return fullscreenStyle.release();
 }
 
-RenderObject* RenderFullScreen::wrapRenderer(RenderObject* object, Document* document)
+RenderObject* RenderFullScreen::wrapRenderer(RenderObject* object, RenderObject* parent, Document* document)
 {
     RenderFullScreen* fullscreenRenderer = new (document->renderArena()) RenderFullScreen(document);
     fullscreenRenderer->setStyle(createFullScreenStyle());
+    if (parent && !parent->isChildAllowed(fullscreenRenderer, fullscreenRenderer->style())) {
+        fullscreenRenderer->destroy();
+        return 0;
+    }
     if (object) {
+        // |object->parent()| can be null if the object is not yet attached
+        // to |parent|.
         if (RenderObject* parent = object->parent()) {
+            RenderBlock* containingBlock = object->containingBlock();
+            ASSERT(containingBlock);
+            // Since we are moving the |object| to a new parent |fullscreenRenderer|,
+            // the line box tree underneath our |containingBlock| is not longer valid.
+            containingBlock->deleteLineBoxTree();
+
             parent->addChild(fullscreenRenderer, object);
             object->remove();
+            
+            // Always just do a full layout to ensure that line boxes get deleted properly.
+            // Because objects moved from |parent| to |fullscreenRenderer|, we want to
+            // make new line boxes instead of leaving the old ones around.
             parent->setNeedsLayoutAndPrefWidthsRecalc();
+            containingBlock->setNeedsLayoutAndPrefWidthsRecalc();
         }
         fullscreenRenderer->addChild(object);
         fullscreenRenderer->setNeedsLayoutAndPrefWidthsRecalc();
diff --git a/Source/WebCore/rendering/RenderFullScreen.h b/Source/WebCore/rendering/RenderFullScreen.h
index d0aac50ac..a675c5f09 100644
--- a/Source/WebCore/rendering/RenderFullScreen.h
+++ b/Source/WebCore/rendering/RenderFullScreen.h
@@ -42,7 +42,7 @@ public:
     void createPlaceholder(PassRefPtr<RenderStyle>, const LayoutRect& frameRect);
 
 
-    static RenderObject* wrapRenderer(RenderObject* renderer, Document*);
+    static RenderObject* wrapRenderer(RenderObject*, RenderObject*, Document*);
     void unwrapRenderer();
 
 private:
diff --git a/Source/WebCore/rendering/RenderGeometryMap.cpp b/Source/WebCore/rendering/RenderGeometryMap.cpp
index 0a6c9e04f..edf59787c 100644
--- a/Source/WebCore/rendering/RenderGeometryMap.cpp
+++ b/Source/WebCore/rendering/RenderGeometryMap.cpp
@@ -92,8 +92,7 @@ void RenderGeometryMap::mapToAbsolute(TransformState& transformState) const
 {
     // If the mapping includes something like columns, we have to go via renderers.
     if (hasNonUniformStep()) {
-        bool fixed = false;
-        m_mapping.last().m_renderer->mapLocalToContainer(0, fixed, true, transformState, RenderObject::ApplyContainerFlip);
+        m_mapping.last().m_renderer->mapLocalToContainer(0, transformState, UseTransforms | ApplyContainerFlip);
         return;
     }
     
diff --git a/Source/WebCore/rendering/RenderGrid.cpp b/Source/WebCore/rendering/RenderGrid.cpp
index b4d2a0c08..6a4519d1f 100644
--- a/Source/WebCore/rendering/RenderGrid.cpp
+++ b/Source/WebCore/rendering/RenderGrid.cpp
@@ -80,13 +80,6 @@ void RenderGrid::layoutBlock(bool relayoutChildren, LayoutUnit)
 
     m_overflow.clear();
 
-    if (scrollsOverflow()) {
-        if (style()->overflowX() == OSCROLL)
-            layer()->setHasHorizontalScrollbar(true);
-        if (style()->overflowY() == OSCROLL)
-            layer()->setHasVerticalScrollbar(true);
-    }
-
     layoutGridItems();
 
     LayoutUnit oldClientAfterEdge = clientLogicalBottom();
@@ -114,6 +107,35 @@ void RenderGrid::layoutBlock(bool relayoutChildren, LayoutUnit)
     setNeedsLayout(false);
 }
 
+void RenderGrid::computePreferredLogicalWidths()
+{
+    ASSERT(preferredLogicalWidthsDirty());
+
+    m_minPreferredLogicalWidth = 0;
+    m_maxPreferredLogicalWidth = 0;
+
+    // FIXME: We don't take our own logical width into account.
+
+    const Vector<Length>& trackStyles = style()->gridColumns();
+
+    for (size_t i = 0; i < trackStyles.size(); ++i) {
+        Length trackLength = trackStyles[i];
+        if (!trackLength.isFixed()) {
+            notImplemented();
+            continue;
+        }
+
+        m_minPreferredLogicalWidth += trackLength.intValue();
+        m_maxPreferredLogicalWidth += trackLength.intValue();
+    }
+
+    // FIXME: We should account for min / max logical width.
+
+    // FIXME: Include borders and paddings in inline direction.
+
+    setPreferredLogicalWidthsDirty(false);
+}
+
 void RenderGrid::computedUsedBreadthOfGridTracks(TrackSizingDirection direction, Vector<GridTrack>& tracks)
 {
     const Vector<Length>& trackStyles = (direction == ForColumns) ? style()->gridColumns() : style()->gridRows();
diff --git a/Source/WebCore/rendering/RenderGrid.h b/Source/WebCore/rendering/RenderGrid.h
index 829bf8862..f9b0879bd 100644
--- a/Source/WebCore/rendering/RenderGrid.h
+++ b/Source/WebCore/rendering/RenderGrid.h
@@ -38,6 +38,7 @@ public:
     virtual const char* renderName() const OVERRIDE;
 
     virtual void layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeight = 0) OVERRIDE;
+    virtual void computePreferredLogicalWidths() OVERRIDE;
 
     virtual bool avoidsFloats() const OVERRIDE { return true; }
 
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index 7b9fc2efb..da120bed1 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -39,7 +39,7 @@
 #include "TransformState.h"
 #include "VisiblePosition.h"
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 #include "Frame.h"
 #endif
 
@@ -1114,7 +1114,7 @@ LayoutSize RenderInline::offsetFromContainer(RenderObject* container, const Layo
     return offset;
 }
 
-void RenderInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState, ApplyContainerFlipOrNot applyContainerFlip, bool* wasFixed) const
+void RenderInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState& transformState, MapLocalToContainerFlags mode, bool* wasFixed) const
 {
     if (repaintContainer == this)
         return;
@@ -1135,18 +1135,18 @@ void RenderInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer, b
     if (!o)
         return;
 
-    if (applyContainerFlip && o->isBox()) {
+    if (mode & ApplyContainerFlip && o->isBox()) {
         if (o->style()->isFlippedBlocksWritingMode()) {
             IntPoint centerPoint = roundedIntPoint(transformState.mappedPoint());
             transformState.move(toRenderBox(o)->flipForWritingModeIncludingColumns(centerPoint) - centerPoint);
         }
-        applyContainerFlip = DoNotApplyContainerFlip;
+        mode &= ~ApplyContainerFlip;
     }
 
     LayoutSize containerOffset = offsetFromContainer(o, roundedLayoutPoint(transformState.mappedPoint()));
 
-    bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
-    if (useTransforms && shouldUseTransformFromContainer(o)) {
+    bool preserve3D = mode & UseTransforms && (o->style()->preserves3D() || style()->preserves3D());
+    if (mode & UseTransforms && shouldUseTransformFromContainer(o)) {
         TransformationMatrix t;
         getTransformFromContainer(o, containerOffset, t);
         transformState.applyTransform(t, preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
@@ -1161,7 +1161,7 @@ void RenderInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer, b
         return;
     }
 
-    o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState, applyContainerFlip, wasFixed);
+    o->mapLocalToContainer(repaintContainer, transformState, mode, wasFixed);
 }
 
 const RenderObject* RenderInline::pushMappingToContainer(const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap& geometryMap) const
@@ -1534,7 +1534,7 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, const L
             antialias);
 }
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 void RenderInline::addDashboardRegions(Vector<DashboardRegionValue>& regions)
 {
     // Convert the style regions to absolute coordinates.
diff --git a/Source/WebCore/rendering/RenderInline.h b/Source/WebCore/rendering/RenderInline.h
index a8cc2f1be..e207caf58 100644
--- a/Source/WebCore/rendering/RenderInline.h
+++ b/Source/WebCore/rendering/RenderInline.h
@@ -135,7 +135,7 @@ private:
     virtual LayoutRect rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, LayoutUnit outlineWidth) const;
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, LayoutRect&, bool fixed) const;
 
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState&, ApplyContainerFlipOrNot = ApplyContainerFlip, bool* wasFixed = 0) const;
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState&, MapLocalToContainerFlags mode = ApplyContainerFlip, bool* wasFixed = 0) const OVERRIDE;
     virtual const RenderObject* pushMappingToContainer(const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap&) const;
 
     virtual VisiblePosition positionForPoint(const LayoutPoint&);
@@ -159,7 +159,7 @@ private:
 
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     virtual void addDashboardRegions(Vector<DashboardRegionValue>&);
 #endif
     
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index 74b0f5a67..373beab8a 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -485,6 +485,17 @@ void RenderLayer::computeRepaintRects(LayoutPoint* offsetFromRoot)
     m_outlineBox = renderer()->outlineBoundsForRepaint(repaintContainer, offsetFromRoot);
 }
 
+
+void RenderLayer::computeRepaintRectsIncludingDescendants()
+{
+    // FIXME: computeRepaintRects() has to walk up the parent chain for every layer to compute the rects.
+    // We should make this more efficient.
+    computeRepaintRects();
+
+    for (RenderLayer* layer = firstChild(); layer; layer = layer->nextSibling())
+        layer->computeRepaintRectsIncludingDescendants();
+}
+
 void RenderLayer::clearRepaintRects()
 {
     ASSERT(!m_hasVisibleContent);
@@ -1446,7 +1457,7 @@ void RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutP
         // If the fixed layer's container is the root, just add in the offset of the view. We can obtain this by calling
         // localToAbsolute() on the RenderView.
         FloatPoint absPos = renderer()->localToAbsolute(FloatPoint(), true);
-        location += flooredLayoutSize(absPos);
+        location += LayoutSize(absPos.x(), absPos.y());
         return;
     }
 
@@ -1668,7 +1679,7 @@ void RenderLayer::scrollTo(int x, int y)
     // We should have a RenderView if we're trying to scroll.
     ASSERT(view);
     if (view) {
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
         // Update dashboard regions, scrolling may change the clip of a
         // particular region.
         view->frameView()->updateDashboardRegions();
@@ -2229,6 +2240,10 @@ void RenderLayer::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& r
     IntRect scrollRect = rect;
     RenderBox* box = renderBox();
     ASSERT(box);
+    // If we are not yet inserted into the tree, there is no need to repaint.
+    if (!box->parent())
+        return;
+
     if (scrollbar == m_vBar.get())
         scrollRect.move(verticalScrollbarStart(0, box->width()), box->borderTop());
     else
@@ -2315,7 +2330,7 @@ void RenderLayer::setHasHorizontalScrollbar(bool hasScrollbar)
     if (m_vBar)
         m_vBar->styleChanged();
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     // Force an update since we know the scrollbars have changed things.
     if (renderer()->document()->hasDashboardRegions())
         renderer()->document()->setDashboardRegionsDirty(true);
@@ -2338,7 +2353,7 @@ void RenderLayer::setHasVerticalScrollbar(bool hasScrollbar)
     if (m_vBar)
         m_vBar->styleChanged();
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     // Force an update since we know the scrollbars have changed things.
     if (renderer()->document()->hasDashboardRegions())
         renderer()->document()->setDashboardRegionsDirty(true);
@@ -2522,13 +2537,17 @@ void RenderLayer::updateScrollbarsAfterLayout()
     RenderBox* box = renderBox();
     ASSERT(box);
 
+    // List box parts handle the scrollbars by themselves so we have nothing to do.
+    if (box->style()->appearance() == ListboxPart)
+        return;
+
     bool hasHorizontalOverflow = this->hasHorizontalOverflow();
     bool hasVerticalOverflow = this->hasVerticalOverflow();
 
     // overflow:scroll should just enable/disable.
-    if (m_hBar && renderer()->style()->overflowX() == OSCROLL)
+    if (renderer()->style()->overflowX() == OSCROLL)
         m_hBar->setEnabled(hasHorizontalOverflow);
-    if (m_vBar && renderer()->style()->overflowY() == OSCROLL)
+    if (renderer()->style()->overflowY() == OSCROLL)
         m_vBar->setEnabled(hasVerticalOverflow);
 
     // overflow:auto may need to lay out again if scrollbars got added/removed.
@@ -2543,7 +2562,7 @@ void RenderLayer::updateScrollbarsAfterLayout()
 
         updateSelfPaintingLayer();
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
         // Force an update since we know the scrollbars have changed things.
         if (renderer()->document()->hasDashboardRegions())
             renderer()->document()->setDashboardRegionsDirty(true);
@@ -4818,33 +4837,45 @@ void RenderLayer::updateStackingContextsAfterStyleChange(const RenderStyle* oldS
     }
 }
 
-static bool overflowCanHaveAScrollbar(EOverflow overflow)
+static bool overflowRequiresScrollbar(EOverflow overflow)
 {
-    return overflow == OAUTO || overflow == OSCROLL || overflow == OOVERLAY;
+    return overflow == OSCROLL;
+}
+
+static bool overflowDefinesAutomaticScrollbar(EOverflow overflow)
+{
+    return overflow == OAUTO || overflow == OOVERLAY;
 }
 
 void RenderLayer::updateScrollbarsAfterStyleChange(const RenderStyle* oldStyle)
 {
     // Overflow are a box concept.
-    if (!renderBox())
+    RenderBox* box = renderBox();
+    if (!box)
+        return;
+
+    // List box parts handle the scrollbars by themselves so we have nothing to do.
+    if (box->style()->appearance() == ListboxPart)
         return;
 
-    EOverflow overflowX = renderBox()->style()->overflowX();
-    EOverflow overflowY = renderBox()->style()->overflowY();
-    if (hasHorizontalScrollbar() && !overflowCanHaveAScrollbar(overflowX))
-        setHasHorizontalScrollbar(false);
-    if (hasVerticalScrollbar() && !overflowCanHaveAScrollbar(overflowY))
-        setHasVerticalScrollbar(false);
+    EOverflow overflowX = box->style()->overflowX();
+    EOverflow overflowY = box->style()->overflowY();
+
+    // To avoid doing a relayout in updateScrollbarsAfterLayout, we try to keep any automatic scrollbar that was already present.
+    bool needsHorizontalScrollbar = (hasHorizontalScrollbar() && overflowDefinesAutomaticScrollbar(overflowX)) || overflowRequiresScrollbar(overflowX);
+    bool needsVerticalScrollbar = (hasVerticalScrollbar() && overflowDefinesAutomaticScrollbar(overflowY)) || overflowRequiresScrollbar(overflowY);
+    setHasHorizontalScrollbar(needsHorizontalScrollbar);
+    setHasVerticalScrollbar(needsVerticalScrollbar);
 
     // With overflow: scroll, scrollbars are always visible but may be disabled.
     // When switching to another value, we need to re-enable them (see bug 11985).
-    if (hasHorizontalScrollbar() && oldStyle->overflowX() == OSCROLL && overflowX != OSCROLL) {
-        ASSERT(overflowCanHaveAScrollbar(overflowX));
+    if (needsHorizontalScrollbar && oldStyle && oldStyle->overflowX() == OSCROLL && overflowX != OSCROLL) {
+        ASSERT(hasHorizontalScrollbar());
         m_hBar->setEnabled(true);
     }
 
-    if (hasVerticalScrollbar() && oldStyle->overflowY() == OSCROLL && overflowY != OSCROLL) {
-        ASSERT(overflowCanHaveAScrollbar(overflowY));
+    if (needsVerticalScrollbar && oldStyle && oldStyle->overflowY() == OSCROLL && overflowY != OSCROLL) {
+        ASSERT(hasVerticalScrollbar());
         m_vBar->setEnabled(true);
     }
 
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index be945707a..dd6df15a1 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -673,6 +673,7 @@ private:
     void dirtyAncestorChainHasSelfPaintingLayerDescendantStatus();
 
     void computeRepaintRects(LayoutPoint* offsetFromRoot = 0);
+    void computeRepaintRectsIncludingDescendants();
     void clearRepaintRects();
 
     void clipToRect(RenderLayer* rootLayer, GraphicsContext*, const LayoutRect& paintDirtyRect, const ClipRect&,
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index 57b83e352..415891731 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -52,6 +52,7 @@
 #include "RenderVideo.h"
 #include "RenderView.h"
 #include "ScrollingCoordinator.h"
+#include "Settings.h"
 #include "StyleResolver.h"
 #include "TiledBacking.h"
 
@@ -121,8 +122,11 @@ RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
     if (m_usingTiledCacheLayer) {
         if (Page* page = renderer()->frame()->page()) {
             if (TiledBacking* tiledBacking = m_graphicsLayer->tiledBacking()) {
+                Frame* frame = renderer()->frame();
+
                 tiledBacking->setIsInWindow(page->isOnscreen());
-                tiledBacking->setCanHaveScrollbars(renderer()->frame()->view()->canHaveScrollbars());
+                tiledBacking->setCanHaveScrollbars(frame->view()->canHaveScrollbars());
+                tiledBacking->setScrollingPerformanceLoggingEnabled(frame->settings() && frame->settings()->scrollingPerformanceLoggingEnabled());
             }
         }
     }
@@ -895,16 +899,23 @@ bool RenderLayerBacking::paintsChildren() const
     return false;
 }
 
+static bool isCompositedPlugin(RenderObject* renderer)
+{
+    return renderer->isEmbeddedObject() && toRenderEmbeddedObject(renderer)->allowsAcceleratedCompositing();
+}
+
 // A "simple container layer" is a RenderLayer which has no visible content to render.
 // It may have no children, or all its children may be themselves composited.
 // This is a useful optimization, because it allows us to avoid allocating backing store.
 bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
 {
     RenderObject* renderObject = renderer();
-    if (renderObject->isReplaced() ||       // replaced objects are not containers
-        renderObject->hasMask())            // masks require special treatment
+    if (renderObject->hasMask()) // masks require special treatment
         return false;
 
+    if (renderObject->isReplaced() && !isCompositedPlugin(renderObject))
+            return false;
+    
     if (paintsBoxDecorations() || paintsChildren())
         return false;
     
@@ -1619,6 +1630,20 @@ double RenderLayerBacking::backingStoreMemoryEstimate() const
     return backingMemory;
 }
 
+#if PLATFORM(BLACKBERRY)
+bool RenderLayerBacking::contentsVisible(const GraphicsLayer*, const IntRect& localContentRect) const
+{
+    Frame* frame = renderer()->frame();
+    FrameView* view = frame ? frame->view() : 0;
+    if (!view)
+        return false;
+
+    IntRect visibleContentRect(view->visibleContentRect());
+    FloatQuad absoluteContentQuad = renderer()->localToAbsoluteQuad(FloatRect(localContentRect));
+    return absoluteContentQuad.enclosingBoundingBox().intersects(visibleContentRect);
+}
+#endif
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index c3cf9835f..6062aaec8 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -494,11 +494,10 @@ bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeR
 
             layer->ensureBacking();
 
-            // The RenderLayer's needs to update repaint rects here, because the target
-            // repaintContainer may have changed after becoming a composited layer.
-            // https://bugs.webkit.org/show_bug.cgi?id=80641
+            // This layer and all of its descendants have cached repaints rects that are relative to
+            // the repaint container, so change when compositing changes; we need to update them here.
             if (layer->parent())
-                layer->computeRepaintRects();
+                layer->computeRepaintRectsIncludingDescendants();
 
             layerChanged = true;
         }
@@ -518,9 +517,9 @@ bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeR
             layer->clearBacking();
             layerChanged = true;
 
-            // The layer's cached repaints rects are relative to the repaint container, so change when
-            // compositing changes; we need to update them here.
-            layer->computeRepaintRects();
+            // This layer and all of its descendants have cached repaints rects that are relative to
+            // the repaint container, so change when compositing changes; we need to update them here.
+            layer->computeRepaintRectsIncludingDescendants();
 
             // If we need to repaint, do so now that we've removed the backing
             if (shouldRepaint == CompositingChangeRepaintNow)
diff --git a/Source/WebCore/rendering/RenderListBox.cpp b/Source/WebCore/rendering/RenderListBox.cpp
index 40b5f58fd..2f5ae2b6c 100644
--- a/Source/WebCore/rendering/RenderListBox.cpp
+++ b/Source/WebCore/rendering/RenderListBox.cpp
@@ -146,6 +146,11 @@ void RenderListBox::updateFromElement()
     }
 }
 
+bool RenderListBox::canBeReplacedWithInlineRunIn() const
+{
+    return false;
+}
+
 void RenderListBox::selectionChanged()
 {
     repaint();
@@ -378,7 +383,9 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, const LayoutPoint&
 {
     FontCachePurgePreventer fontCachePurgePreventer;
 
-    const Vector<HTMLElement*>& listItems = toHTMLSelectElement(node())->listItems();
+    HTMLSelectElement* selectElement = toHTMLSelectElement(node());
+
+    const Vector<HTMLElement*>& listItems = selectElement->listItems();
     HTMLElement* element = listItems[listIndex];
 
     RenderStyle* itemStyle = element->renderStyle();
@@ -401,7 +408,7 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, const LayoutPoint&
         if (frame()->selection()->isFocusedAndActive() && document()->focusedNode() == node())
             textColor = theme()->activeListBoxSelectionForegroundColor();
         // Honor the foreground color for disabled items
-        else if (!element->disabled())
+        else if (!element->disabled() && !selectElement->disabled())
             textColor = theme()->inactiveListBoxSelectionForegroundColor();
     }
 
@@ -620,6 +627,11 @@ void RenderListBox::setScrollOffset(const IntPoint& offset)
     scrollTo(offset.y());
 }
 
+IntPoint RenderListBox::scrollPosition() const
+{
+    return IntPoint(0, m_indexOffset);
+}
+
 void RenderListBox::scrollTo(int newOffset)
 {
     if (newOffset == m_indexOffset)
@@ -864,7 +876,7 @@ void RenderListBox::setHasVerticalScrollbar(bool hasScrollbar)
     if (m_vBar)
         m_vBar->styleChanged();
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     // Force an update since we know the scrollbars have changed things.
     if (document()->hasDashboardRegions())
         document()->setDashboardRegionsDirty(true);
diff --git a/Source/WebCore/rendering/RenderListBox.h b/Source/WebCore/rendering/RenderListBox.h
index 10b1945c2..6038c4316 100644
--- a/Source/WebCore/rendering/RenderListBox.h
+++ b/Source/WebCore/rendering/RenderListBox.h
@@ -61,7 +61,7 @@ private:
     virtual bool isListBox() const { return true; }
 
     virtual void updateFromElement();
-
+    virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
     virtual bool hasControlClip() const { return true; }
     virtual void paintObject(PaintInfo&, const LayoutPoint&);
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
@@ -100,6 +100,7 @@ private:
     virtual int scrollSize(ScrollbarOrientation) const;
     virtual int scrollPosition(Scrollbar*) const;
     virtual void setScrollOffset(const IntPoint&);
+    virtual IntPoint scrollPosition() const OVERRIDE;
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
     virtual bool isActive() const;
     virtual bool isScrollCornerVisible() const { return false; } // We don't support resize on list boxes yet. If we did these would have to change.
diff --git a/Source/WebCore/rendering/RenderMenuList.cpp b/Source/WebCore/rendering/RenderMenuList.cpp
index 56eccf8a1..521cc0327 100644
--- a/Source/WebCore/rendering/RenderMenuList.cpp
+++ b/Source/WebCore/rendering/RenderMenuList.cpp
@@ -74,6 +74,11 @@ RenderMenuList::~RenderMenuList()
     m_popup = 0;
 }
 
+bool RenderMenuList::canBeReplacedWithInlineRunIn() const
+{
+    return false;
+}
+
 void RenderMenuList::createInnerBlock()
 {
     if (m_innerBlock) {
diff --git a/Source/WebCore/rendering/RenderMenuList.h b/Source/WebCore/rendering/RenderMenuList.h
index 7466b1ff9..0b4300840 100644
--- a/Source/WebCore/rendering/RenderMenuList.h
+++ b/Source/WebCore/rendering/RenderMenuList.h
@@ -68,6 +68,7 @@ private:
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
     virtual bool hasControlClip() const { return true; }
     virtual bool canHaveGeneratedChildren() const OVERRIDE { return false; }
+    virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
 
     virtual const char* renderName() const { return "RenderMenuList"; }
 
diff --git a/Source/WebCore/rendering/RenderNamedFlowThread.cpp b/Source/WebCore/rendering/RenderNamedFlowThread.cpp
index 227af7df5..5b02453e4 100644
--- a/Source/WebCore/rendering/RenderNamedFlowThread.cpp
+++ b/Source/WebCore/rendering/RenderNamedFlowThread.cpp
@@ -36,6 +36,7 @@ namespace WebCore {
 RenderNamedFlowThread::RenderNamedFlowThread(Node* node, PassRefPtr<WebKitNamedFlow> namedFlow)
     : RenderFlowThread(node)
     , m_namedFlow(namedFlow)
+    , m_regionLayoutUpdateEventTimer(this, &RenderNamedFlowThread::regionLayoutUpdateEventTimerFired)
 {
     m_namedFlow->setRenderer(this);
 }
@@ -192,6 +193,10 @@ void RenderNamedFlowThread::removeRegionFromThread(RenderRegion* renderRegion)
         return;
     }
 
+    // After removing all the regions in the flow the following layout needs to dispatch the regionLayoutUpdate event
+    if (m_regionList.isEmpty())
+        setDispatchRegionLayoutUpdateEvent(true);
+
     invalidateRegions();
 }
 
@@ -301,4 +306,19 @@ void RenderNamedFlowThread::willBeDestroyed()
     RenderFlowThread::willBeDestroyed();
 }
 
+void RenderNamedFlowThread::dispatchRegionLayoutUpdateEvent()
+{
+    RenderFlowThread::dispatchRegionLayoutUpdateEvent();
+
+    if (!m_regionLayoutUpdateEventTimer.isActive() && m_namedFlow->hasEventListeners())
+        m_regionLayoutUpdateEventTimer.startOneShot(0);
+}
+
+void RenderNamedFlowThread::regionLayoutUpdateEventTimerFired(Timer<RenderNamedFlowThread>*)
+{
+    ASSERT(m_namedFlow);
+
+    m_namedFlow->dispatchRegionLayoutUpdateEvent();
+}
+
 }
diff --git a/Source/WebCore/rendering/RenderNamedFlowThread.h b/Source/WebCore/rendering/RenderNamedFlowThread.h
index 5e0d96249..4101b771e 100644
--- a/Source/WebCore/rendering/RenderNamedFlowThread.h
+++ b/Source/WebCore/rendering/RenderNamedFlowThread.h
@@ -28,6 +28,7 @@
 #define RenderNamedFlowThread_h
 
 #include "RenderFlowThread.h"
+#include "Timer.h"
 #include <wtf/HashCountedSet.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/text/AtomicString.h>
@@ -76,11 +77,14 @@ private:
     virtual const char* renderName() const OVERRIDE;
     virtual bool isRenderNamedFlowThread() const OVERRIDE { return true; }
 
+    virtual void dispatchRegionLayoutUpdateEvent() OVERRIDE;
+
     bool dependsOn(RenderNamedFlowThread* otherRenderFlowThread) const;
     void addDependencyOnFlowThread(RenderNamedFlowThread*);
     void removeDependencyOnFlowThread(RenderNamedFlowThread*);
     void checkInvalidRegions();
     bool canBeDestroyed() const { return m_regionList.isEmpty() && m_contentNodes.isEmpty(); }
+    void regionLayoutUpdateEventTimerFired(Timer<RenderNamedFlowThread>*);
 
 private:
     // Observer flow threads have invalid regions that depend on the state of this thread
@@ -101,6 +105,8 @@ private:
 
     // The DOM Object that represents a named flow.
     RefPtr<WebKitNamedFlow> m_namedFlow;
+
+    Timer<RenderNamedFlowThread> m_regionLayoutUpdateEventTimer;
 };
 
 inline RenderNamedFlowThread* toRenderNamedFlowThread(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index 6391334ef..b5f69575a 100755
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -151,7 +151,7 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
     if (node->hasTagName(rtTag) && style->display() == BLOCK)
         return new (arena) RenderRubyText(node);
     if (doc->cssRegionsEnabled() && style->isDisplayRegionType() && !style->regionThread().isEmpty() && doc->renderView())
-        return new (arena) RenderRegion(node, doc->renderView()->flowThreadController()->ensureRenderFlowThreadWithName(style->regionThread()));
+        return new (arena) RenderRegion(node, 0);
     switch (style->display()) {
     case NONE:
         return 0;
@@ -834,14 +834,22 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
                                       BoxSide side, Color color, EBorderStyle style,
                                       int adjacentWidth1, int adjacentWidth2, bool antialias)
 {
-    int width = (side == BSTop || side == BSBottom ? y2 - y1 : x2 - x1);
+    int thickness;
+    int length;
+    if (side == BSTop || side == BSBottom) {
+        thickness = y2 - y1;
+        length = x2 - x1;
+    } else {
+        thickness = x2 - x1;
+        length = y2 - y1;
+    }
 
-    // FIXME: We really would like this check to be an ASSERT as we don't want to draw 0px borders. However
-    // nothing guarantees that the following recursive calls to drawLineForBoxSide will have non-null width.
-    if (!width)
+    // FIXME: We really would like this check to be an ASSERT as we don't want to draw empty borders. However
+    // nothing guarantees that the following recursive calls to drawLineForBoxSide will have non-null dimensions.
+    if (!thickness || !length)
         return;
 
-    if (style == DOUBLE && width < 3)
+    if (style == DOUBLE && thickness < 3)
         style = SOLID;
 
     switch (style) {
@@ -851,11 +859,11 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
         case DOTTED:
         case DASHED: {
             graphicsContext->setStrokeColor(color, m_style->colorSpace());
-            graphicsContext->setStrokeThickness(width);
+            graphicsContext->setStrokeThickness(thickness);
             StrokeStyle oldStrokeStyle = graphicsContext->strokeStyle();
             graphicsContext->setStrokeStyle(style == DASHED ? DashedStroke : DottedStroke);
 
-            if (width > 0) {
+            if (thickness > 0) {
                 bool wasAntialiased = graphicsContext->shouldAntialias();
                 graphicsContext->setShouldAntialias(antialias);
 
@@ -875,7 +883,8 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
             break;
         }
         case DOUBLE: {
-            int third = (width + 1) / 3;
+            int thirdOfThickness = (thickness + 1) / 3;
+            ASSERT(thirdOfThickness);
 
             if (adjacentWidth1 == 0 && adjacentWidth2 == 0) {
                 StrokeStyle oldStrokeStyle = graphicsContext->strokeStyle();
@@ -888,16 +897,16 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
                 switch (side) {
                     case BSTop:
                     case BSBottom:
-                        graphicsContext->drawRect(IntRect(x1, y1, x2 - x1, third));
-                        graphicsContext->drawRect(IntRect(x1, y2 - third, x2 - x1, third));
+                        graphicsContext->drawRect(IntRect(x1, y1, length, thirdOfThickness));
+                        graphicsContext->drawRect(IntRect(x1, y2 - thirdOfThickness, length, thirdOfThickness));
                         break;
                     case BSLeft:
-                        graphicsContext->drawRect(IntRect(x1, y1 + 1, third, y2 - y1 - 1));
-                        graphicsContext->drawRect(IntRect(x2 - third, y1 + 1, third, y2 - y1 - 1));
-                        break;
                     case BSRight:
-                        graphicsContext->drawRect(IntRect(x1, y1 + 1, third, y2 - y1 - 1));
-                        graphicsContext->drawRect(IntRect(x2 - third, y1 + 1, third, y2 - y1 - 1));
+                        // FIXME: Why do we offset the border by 1 in this case but not the other one?
+                        if (length > 1) {
+                            graphicsContext->drawRect(IntRect(x1, y1 + 1, thirdOfThickness, length - 1));
+                            graphicsContext->drawRect(IntRect(x2 - thirdOfThickness, y1 + 1, thirdOfThickness, length - 1));
+                        }
                         break;
                 }
 
@@ -910,33 +919,33 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
                 switch (side) {
                     case BSTop:
                         drawLineForBoxSide(graphicsContext, x1 + max((-adjacentWidth1 * 2 + 1) / 3, 0),
-                                   y1, x2 - max((-adjacentWidth2 * 2 + 1) / 3, 0), y1 + third,
+                                   y1, x2 - max((-adjacentWidth2 * 2 + 1) / 3, 0), y1 + thirdOfThickness,
                                    side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
                         drawLineForBoxSide(graphicsContext, x1 + max((adjacentWidth1 * 2 + 1) / 3, 0),
-                                   y2 - third, x2 - max((adjacentWidth2 * 2 + 1) / 3, 0), y2,
+                                   y2 - thirdOfThickness, x2 - max((adjacentWidth2 * 2 + 1) / 3, 0), y2,
                                    side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
                         break;
                     case BSLeft:
                         drawLineForBoxSide(graphicsContext, x1, y1 + max((-adjacentWidth1 * 2 + 1) / 3, 0),
-                                   x1 + third, y2 - max((-adjacentWidth2 * 2 + 1) / 3, 0),
+                                   x1 + thirdOfThickness, y2 - max((-adjacentWidth2 * 2 + 1) / 3, 0),
                                    side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
-                        drawLineForBoxSide(graphicsContext, x2 - third, y1 + max((adjacentWidth1 * 2 + 1) / 3, 0),
+                        drawLineForBoxSide(graphicsContext, x2 - thirdOfThickness, y1 + max((adjacentWidth1 * 2 + 1) / 3, 0),
                                    x2, y2 - max((adjacentWidth2 * 2 + 1) / 3, 0),
                                    side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
                         break;
                     case BSBottom:
                         drawLineForBoxSide(graphicsContext, x1 + max((adjacentWidth1 * 2 + 1) / 3, 0),
-                                   y1, x2 - max((adjacentWidth2 * 2 + 1) / 3, 0), y1 + third,
+                                   y1, x2 - max((adjacentWidth2 * 2 + 1) / 3, 0), y1 + thirdOfThickness,
                                    side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
                         drawLineForBoxSide(graphicsContext, x1 + max((-adjacentWidth1 * 2 + 1) / 3, 0),
-                                   y2 - third, x2 - max((-adjacentWidth2 * 2 + 1) / 3, 0), y2,
+                                   y2 - thirdOfThickness, x2 - max((-adjacentWidth2 * 2 + 1) / 3, 0), y2,
                                    side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
                         break;
                     case BSRight:
                         drawLineForBoxSide(graphicsContext, x1, y1 + max((adjacentWidth1 * 2 + 1) / 3, 0),
-                                   x1 + third, y2 - max((adjacentWidth2 * 2 + 1) / 3, 0),
+                                   x1 + thirdOfThickness, y2 - max((adjacentWidth2 * 2 + 1) / 3, 0),
                                    side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
-                        drawLineForBoxSide(graphicsContext, x2 - third, y1 + max((-adjacentWidth1 * 2 + 1) / 3, 0),
+                        drawLineForBoxSide(graphicsContext, x2 - thirdOfThickness, y1 + max((-adjacentWidth1 * 2 + 1) / 3, 0),
                                    x2, y2 - max((-adjacentWidth2 * 2 + 1) / 3, 0),
                                    side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
                         break;
@@ -1444,10 +1453,7 @@ void RenderObject::repaintOverhangingFloats(bool)
 
 bool RenderObject::checkForRepaintDuringLayout() const
 {
-    // FIXME: <https://bugs.webkit.org/show_bug.cgi?id=20885> It is probably safe to also require
-    // m_everHadLayout. Currently, only RenderBlock::layoutBlock() adds this condition. See also
-    // <https://bugs.webkit.org/show_bug.cgi?id=15129>.
-    return !document()->view()->needsFullRepaint() && !hasLayer();
+    return !document()->view()->needsFullRepaint() && !hasLayer() && everHadLayout();
 }
 
 LayoutRect RenderObject::rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, LayoutUnit outlineWidth) const
@@ -1787,7 +1793,7 @@ void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newS
             bool visibilityChanged = m_style->visibility() != newStyle->visibility() 
                 || m_style->zIndex() != newStyle->zIndex() 
                 || m_style->hasAutoZIndex() != newStyle->hasAutoZIndex();
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
             if (visibilityChanged)
                 document()->setDashboardRegionsDirty(true);
 #endif
@@ -1978,7 +1984,12 @@ LayoutRect RenderObject::viewRect() const
 FloatPoint RenderObject::localToAbsolute(const FloatPoint& localPoint, bool fixed, bool useTransforms) const
 {
     TransformState transformState(TransformState::ApplyTransformDirection, localPoint);
-    mapLocalToContainer(0, fixed, useTransforms, transformState);
+    MapLocalToContainerFlags mode = ApplyContainerFlip;
+    if (fixed)
+        mode |= IsFixed;
+    if (useTransforms)
+        mode |= UseTransforms;
+    mapLocalToContainer(0, transformState, mode);
     transformState.flatten();
     
     return transformState.lastPlanarPoint();
@@ -1993,7 +2004,7 @@ FloatPoint RenderObject::absoluteToLocal(const FloatPoint& containerPoint, bool
     return transformState.lastPlanarPoint();
 }
 
-void RenderObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState, ApplyContainerFlipOrNot applyContainerFlip, bool* wasFixed) const
+void RenderObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState& transformState, MapLocalToContainerFlags mode, bool* wasFixed) const
 {
     if (repaintContainer == this)
         return;
@@ -2004,10 +2015,10 @@ void RenderObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, b
 
     // FIXME: this should call offsetFromContainer to share code, but I'm not sure it's ever called.
     LayoutPoint centerPoint = roundedLayoutPoint(transformState.mappedPoint());
-    if (applyContainerFlip && o->isBox()) {
+    if (mode & ApplyContainerFlip && o->isBox()) {
         if (o->style()->isFlippedBlocksWritingMode())
             transformState.move(toRenderBox(o)->flipForWritingModeIncludingColumns(roundedLayoutPoint(transformState.mappedPoint())) - centerPoint);
-        applyContainerFlip = DoNotApplyContainerFlip;
+        mode &= ~ApplyContainerFlip;
     }
 
     LayoutSize columnOffset;
@@ -2018,7 +2029,7 @@ void RenderObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, b
     if (o->hasOverflowClip())
         transformState.move(-toRenderBox(o)->scrolledContentOffset());
 
-    o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState, applyContainerFlip, wasFixed);
+    o->mapLocalToContainer(repaintContainer, transformState, mode, wasFixed);
 }
 
 const RenderObject* RenderObject::pushMappingToContainer(const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap& geometryMap) const
@@ -2092,7 +2103,10 @@ FloatQuad RenderObject::localToContainerQuad(const FloatQuad& localQuad, RenderB
     // Track the point at the center of the quad's bounding box. As mapLocalToContainer() calls offsetFromContainer(),
     // it will use that point as the reference point to decide which column's transform to apply in multiple-column blocks.
     TransformState transformState(TransformState::ApplyTransformDirection, localQuad.boundingBox().center(), localQuad);
-    mapLocalToContainer(repaintContainer, fixed, true, transformState, ApplyContainerFlip, wasFixed);
+    MapLocalToContainerFlags mode = ApplyContainerFlip | UseTransforms;
+    if (fixed)
+        mode |= IsFixed;
+    mapLocalToContainer(repaintContainer, transformState, mode, wasFixed);
     transformState.flatten();
     
     return transformState.lastPlanarQuad();
@@ -2101,7 +2115,10 @@ FloatQuad RenderObject::localToContainerQuad(const FloatQuad& localQuad, RenderB
 FloatPoint RenderObject::localToContainerPoint(const FloatPoint& localPoint, RenderBoxModelObject* repaintContainer, bool fixed, bool* wasFixed) const
 {
     TransformState transformState(TransformState::ApplyTransformDirection, localPoint);
-    mapLocalToContainer(repaintContainer, fixed, true, transformState, ApplyContainerFlip, wasFixed);
+    MapLocalToContainerFlags mode = ApplyContainerFlip | UseTransforms;
+    if (fixed)
+        mode |= IsFixed;
+    mapLocalToContainer(repaintContainer, transformState, mode, wasFixed);
     transformState.flatten();
 
     return transformState.lastPlanarPoint();
@@ -2632,7 +2649,7 @@ void RenderObject::getTextDecorationColors(int decorations, Color& underline, Co
     }
 }
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 void RenderObject::addDashboardRegions(Vector<DashboardRegionValue>& regions)
 {
     // Convert the style regions to absolute coordinates.
@@ -2890,6 +2907,11 @@ bool RenderObject::canHaveGeneratedChildren() const
     return canHaveChildren();
 }
 
+bool RenderObject::canBeReplacedWithInlineRunIn() const
+{
+    return true;
+}
+
 #if ENABLE(SVG)
 
 RenderSVGResourceContainer* RenderObject::toRenderSVGResourceContainer()
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 2dcd62e5d..5ef90fc0e 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -26,8 +26,7 @@
 #ifndef RenderObject_h
 #define RenderObject_h
 
-#include "CachedImage.h"
-#include "Document.h"
+#include "CachedImageClient.h"
 #include "Element.h"
 #include "FractionalLayoutUnit.h"
 #include "FloatQuad.h"
@@ -46,6 +45,7 @@ namespace WebCore {
 class AffineTransform;
 class AnimationController;
 class Cursor;
+class Document;
 class HitTestPoint;
 class HitTestResult;
 class InlineBox;
@@ -107,9 +107,16 @@ enum PlaceGeneratedRunInFlag {
     DoNotPlaceGeneratedRunIn
 };
 
+enum MapLocalToContainerMode {
+    IsFixed = 1 << 0,
+    UseTransforms = 1 << 1,
+    ApplyContainerFlip = 1 << 2
+};
+typedef unsigned MapLocalToContainerFlags;
+
 const int caretWidth = 1;
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 struct DashboardRegionValue {
     bool operator==(const DashboardRegionValue& o) const
     {
@@ -636,7 +643,7 @@ public:
     // repaint and do not need a relayout
     virtual void updateFromElement() { }
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     virtual void addDashboardRegions(Vector<DashboardRegionValue>&);
     void collectDashboardRegions(Vector<DashboardRegionValue>&);
 #endif
@@ -844,7 +851,6 @@ public:
 
     // Virtual function helpers for the deprecated Flexible Box Layout (display: -webkit-box).
     virtual bool isDeprecatedFlexibleBox() const { return false; }
-    virtual bool isFlexingChildren() const { return false; }
     virtual bool isStretchingChildren() const { return false; }
 
     // Virtual function helper for the new FlexibleBox Layout (display: -webkit-flex).
@@ -878,8 +884,7 @@ public:
 
     // Map points and quads through elements, potentially via 3d transforms. You should never need to call these directly; use
     // localToAbsolute/absoluteToLocal methods instead.
-    enum ApplyContainerFlipOrNot { DoNotApplyContainerFlip, ApplyContainerFlip };
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&, ApplyContainerFlipOrNot = ApplyContainerFlip, bool* wasFixed = 0) const;
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState&, MapLocalToContainerFlags mode = ApplyContainerFlip, bool* wasFixed = 0) const;
     virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
 
     // Pushes state onto RenderGeometryMap about how to map coordinates from this renderer to its container, or ancestorToStopAt (whichever is encountered first).
@@ -927,6 +932,8 @@ protected:
 
     virtual LayoutRect outlineBoundsForRepaint(RenderBoxModelObject* /*repaintContainer*/, LayoutPoint* /*cachedOffsetToRepaintContainer*/ = 0) const { return LayoutRect(); }
 
+    virtual bool canBeReplacedWithInlineRunIn() const;
+
 private:
     RenderStyle* firstLineStyleSlowCase() const;
     StyleDifference adjustStyleDifference(StyleDifference, unsigned contextSensitiveProperties) const;
diff --git a/Source/WebCore/rendering/RenderObjectChildList.cpp b/Source/WebCore/rendering/RenderObjectChildList.cpp
index da98088e2..3158fbfb6 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -117,6 +117,9 @@ RenderObject* RenderObjectChildList::removeChildNode(RenderObject* owner, Render
         if (oldChild->isRenderRegion())
             toRenderRegion(oldChild)->detachRegion();
 
+        if (oldChild->isQuote())
+            toRenderQuote(oldChild)->detachQuote();
+
         if (oldChild->inRenderFlowThread()) {
             if (oldChild->isBox())
                 oldChild->enclosingRenderFlowThread()->removeRenderBoxRegionInfo(toRenderBox(oldChild));
@@ -158,7 +161,6 @@ RenderObject* RenderObjectChildList::removeChildNode(RenderObject* owner, Render
     // by skipping this step when destroying the entire tree.
     if (!owner->documentBeingDestroyed()) {
         RenderCounter::rendererRemovedFromTree(oldChild);
-        RenderQuote::rendererRemovedFromTree(oldChild);
     }
 
     if (AXObjectCache::accessibilityEnabled())
@@ -210,13 +212,16 @@ void RenderObjectChildList::appendChildNode(RenderObject* owner, RenderObject* n
         if (newChild->isRenderRegion())
             toRenderRegion(newChild)->attachRegion();
 
+        // You can't attachQuote() otherwise the quote would be attached too early
+        // and get the wrong depth since generated content is inserted into anonymous
+        // renderers before going into the main render tree.
+
         if (RenderNamedFlowThread* containerFlowThread = renderNamedFlowThreadContainer(owner))
             containerFlowThread->addFlowChild(newChild);
     }
 
     if (!owner->documentBeingDestroyed()) {
         RenderCounter::rendererSubtreeAttached(newChild);
-        RenderQuote::rendererSubtreeAttached(newChild);
     }
     newChild->setNeedsLayoutAndPrefWidthsRecalc(); // Goes up the containing block hierarchy.
     if (!owner->normalChildNeedsLayout())
@@ -279,13 +284,15 @@ void RenderObjectChildList::insertChildNode(RenderObject* owner, RenderObject* c
         if (child->isRenderRegion())
             toRenderRegion(child)->attachRegion();
 
+        // Calling attachQuote() here would be too early (before anonymous renderers are inserted)
+        // see appendChild() for more explanation.
+
         if (RenderNamedFlowThread* containerFlowThread = renderNamedFlowThreadContainer(owner))
             containerFlowThread->addFlowChild(child, beforeChild);
     }
 
     if (!owner->documentBeingDestroyed()) {
         RenderCounter::rendererSubtreeAttached(child);
-        RenderQuote::rendererSubtreeAttached(child);
     }
     child->setNeedsLayoutAndPrefWidthsRecalc();
     if (!owner->normalChildNeedsLayout())
diff --git a/Source/WebCore/rendering/RenderProgress.cpp b/Source/WebCore/rendering/RenderProgress.cpp
index d004506a3..7243e96dc 100644
--- a/Source/WebCore/rendering/RenderProgress.cpp
+++ b/Source/WebCore/rendering/RenderProgress.cpp
@@ -33,7 +33,7 @@ using namespace std;
 
 namespace WebCore {
 
-RenderProgress::RenderProgress(HTMLProgressElement* element)
+RenderProgress::RenderProgress(HTMLElement* element)
     : RenderBlock(element)
     , m_position(HTMLProgressElement::InvalidPosition)
     , m_animationStartTime(0)
@@ -59,6 +59,11 @@ void RenderProgress::updateFromElement()
     RenderBlock::updateFromElement();
 }
 
+bool RenderProgress::canBeReplacedWithInlineRunIn() const
+{
+    return false;
+}
+
 double RenderProgress::animationProgress() const
 {
     return m_animating ? (fmod((currentTime() - m_animationStartTime), m_animationDuration) / m_animationDuration) : 0;
@@ -97,7 +102,14 @@ void RenderProgress::updateAnimationState()
 
 HTMLProgressElement* RenderProgress::progressElement() const
 {
-    return static_cast<HTMLProgressElement*>(node());
+    if (!node())
+        return 0;
+
+    if (isHTMLProgressElement(node()))
+        return toHTMLProgressElement(node());
+
+    ASSERT(node()->shadowHost());
+    return toHTMLProgressElement(node()->shadowHost());
 }    
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderProgress.h b/Source/WebCore/rendering/RenderProgress.h
index 96921bdb4..6835e48c8 100644
--- a/Source/WebCore/rendering/RenderProgress.h
+++ b/Source/WebCore/rendering/RenderProgress.h
@@ -30,7 +30,7 @@ class HTMLProgressElement;
 
 class RenderProgress : public RenderBlock {
 public:
-    RenderProgress(HTMLProgressElement*);
+    RenderProgress(HTMLElement*);
     virtual ~RenderProgress();
 
     double position() const { return m_position; }
@@ -38,6 +38,7 @@ public:
     double animationStartTime() const { return m_animationStartTime; }
 
     bool isDeterminate() const;
+    virtual void updateFromElement();
 
     HTMLProgressElement* progressElement() const;
 
@@ -45,7 +46,7 @@ private:
     virtual const char* renderName() const { return "RenderProgress"; }
     virtual bool isProgress() const { return true; }
     virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
-    virtual void updateFromElement();
+    virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
 
     void animationTimerFired(Timer<RenderProgress>*);
     void updateAnimationState();
diff --git a/Source/WebCore/rendering/RenderQuote.cpp b/Source/WebCore/rendering/RenderQuote.cpp
index 79da0d20d..e17a044a4 100644
--- a/Source/WebCore/rendering/RenderQuote.cpp
+++ b/Source/WebCore/rendering/RenderQuote.cpp
@@ -21,321 +21,189 @@
 #include "config.h"
 #include "RenderQuote.h"
 
-#include "Document.h"
-#include "Element.h"
-#include "HTMLElement.h"
-#include "QuotesData.h"
-#include "RenderStyle.h"
-#include <algorithm>
 #include <wtf/text/AtomicString.h>
-#include <wtf/text/CString.h>
 
-#define UNKNOWN_DEPTH -1
+#define U(x) ((const UChar*)L##x)
 
 namespace WebCore {
-static inline void adjustDepth(int &depth, QuoteType type)
-{
-    switch (type) {
-    case OPEN_QUOTE:
-    case NO_OPEN_QUOTE:
-        ++depth;
-        break;
-    case CLOSE_QUOTE:
-    case NO_CLOSE_QUOTE:
-        if (depth)
-            --depth;
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-    }
-}
 
 RenderQuote::RenderQuote(Document* node, QuoteType quote)
     : RenderText(node, StringImpl::empty())
     , m_type(quote)
-    , m_depth(UNKNOWN_DEPTH)
+    , m_depth(0)
     , m_next(0)
     , m_previous(0)
+    , m_attached(false)
 {
-    view()->addRenderQuote();
 }
 
 RenderQuote::~RenderQuote()
 {
+    ASSERT(!m_attached);
+    ASSERT(!m_next && !m_previous);
 }
 
 void RenderQuote::willBeDestroyed()
 {
-    if (view())
-        view()->removeRenderQuote();
+    detachQuote();
     RenderText::willBeDestroyed();
 }
 
-const char* RenderQuote::renderName() const
-{
-    return "RenderQuote";
-}
-
-// This function places a list of quote renderers starting at "this" in the list of quote renderers already
-// in the document's renderer tree.
-// The assumptions are made (for performance):
-// 1. The list of quotes already in the renderers tree of the document is already in a consistent state
-// (All quote renderers are linked and have the correct depth set)
-// 2. The quote renderers of the inserted list are in a tree of renderers of their own which has been just
-// inserted in the main renderer tree with its root as child of some renderer.
-// 3. The quote renderers in the inserted list have depths consistent with their position in the list relative
-// to "this", thus if "this" does not need to change its depth upon insertion, the other renderers in the list don't
-// need to either.
-void RenderQuote::placeQuote()
-{
-    RenderQuote* head = this;
-    ASSERT(!head->m_previous);
-    RenderQuote* tail = 0;
-    for (RenderObject* predecessor = head->previousInPreOrder(); predecessor; predecessor = predecessor->previousInPreOrder()) {
-        if (!predecessor->isQuote())
-            continue;
-        head->m_previous = toRenderQuote(predecessor);
-        if (head->m_previous->m_next) {
-            // We need to splice the list of quotes headed by head into the document's list of quotes.
-            tail = head;
-            while (tail->m_next)
-                 tail = tail->m_next;
-            tail->m_next = head->m_previous->m_next;
-            ASSERT(tail->m_next->m_previous == head->m_previous);
-            tail->m_next->m_previous =  tail;
-            tail = tail->m_next; // This marks the splicing point here there may be a depth discontinuity
-        }
-        head->m_previous->m_next = head;
-        ASSERT(head->m_previous->m_depth != UNKNOWN_DEPTH);
-        break;
-    }
-    int newDepth;
-    if (!head->m_previous) {
-        newDepth = 0;
-        goto skipNewDepthCalc;
-    }
-    newDepth = head->m_previous->m_depth;
-    do {
-        adjustDepth(newDepth, head->m_previous->m_type);
-skipNewDepthCalc:
-        if (head->m_depth == newDepth) { // All remaining depth should be correct except if splicing was done.
-            if (!tail) // We've done the post splicing section already or there was no splicing.
-                break;
-            head = tail; // Continue after the splicing point
-            tail = 0; // Mark the possible splicing point discontinuity fixed.
-            newDepth = head->m_previous->m_depth;
-            continue;
-        }
-        head->m_depth = newDepth;
-        // FIXME: If the width and height of the quotation characters does not change we may only need to
-        // Invalidate the renderer's area not a relayout.
-        head->setNeedsLayoutAndPrefWidthsRecalc();
-        head = head->m_next;
-        if (head == tail) // We are at the splicing point
-            tail = 0; // Mark the possible depth discontinuity fixed.
-    } while (head);
-}
-
-#define ARRAY_SIZE(Carray) (sizeof(Carray) / sizeof(*Carray))
-#define LANGUAGE_DATA(name, languageSourceArray) { name, languageSourceArray, ARRAY_SIZE(languageSourceArray) }
-#define U(x) ((const UChar*)L##x)
-
-static const UChar* simpleQuotes[] = {U("\""), U("\""), U("'"), U("'")};
-
-static const UChar* englishQuotes[] = {U("\x201C"), U("\x201D"), U("\x2018"), U("\x2019")};
-static const UChar* norwegianQuotes[] = { U("\x00AB"), U("\x00BB"), U("\x2039"), U("\x203A") };
-static const UChar* romanianQuotes[] = { U("\x201E"), U("\x201D")};
-static const UChar* russianQuotes[] = { U("\x00AB"), U("\x00BB"), U("\x201E"), U("\x201C") };
-#undef U
-
-struct LanguageData {
-    const char *name;
-    const UChar* const* const array;
-    const int arraySize;
-    bool operator<(const LanguageData& compareTo) const
-    {
-        return strcmp(name, compareTo.name);
-    }
-};
-
-// Data mast be alphabetically sorted and in all lower case for fast comparison
-LanguageData languageData[] = {
-    LANGUAGE_DATA("en", englishQuotes),
-    LANGUAGE_DATA("no", norwegianQuotes),
-    LANGUAGE_DATA("ro", romanianQuotes),
-    LANGUAGE_DATA("ru", russianQuotes)
-};
-#undef LANGUAGE_DATA
-const LanguageData* const languageDataEnd = languageData + ARRAY_SIZE(languageData);
-
-#define defaultLanguageQuotesSource simpleQuotes
-#define defaultLanguageQuotesCount ARRAY_SIZE(defaultLanguageQuotesSource)
-
-static QuotesData* defaultLanguageQuotesValue = 0;
-static const QuotesData* defaultLanguageQuotes()
-{
-    if (!defaultLanguageQuotesValue) {
-        defaultLanguageQuotesValue = QuotesData::create(defaultLanguageQuotesCount);
-        if (!defaultLanguageQuotesValue)
-            return 0;
-        String* data = defaultLanguageQuotesValue->data();
-        for (size_t i = 0; i < defaultLanguageQuotesCount; ++i)
-            data[i] = defaultLanguageQuotesSource[i];
-    }
-    return defaultLanguageQuotesValue;
-}
-#undef defaultLanguageQuotesSource
-#undef defaultLanguageQuotesCount
-
-typedef HashMap<RefPtr<AtomicStringImpl>, QuotesData* > QuotesMap;
+typedef HashMap<AtomicString, const QuotesData*, CaseFoldingHash> QuotesMap;
 
-static QuotesMap& quotesMap()
+static const QuotesMap& quotesDataLanguageMap()
 {
     DEFINE_STATIC_LOCAL(QuotesMap, staticQuotesMap, ());
+    if (staticQuotesMap.size())
+        return staticQuotesMap;
+    // FIXME: Expand this table to include all the languages in https://bug-3234-attachments.webkit.org/attachment.cgi?id=2135
+    staticQuotesMap.set("en", QuotesData::create(U("\x201C"), U("\x201D"), U("\x2018"), U("\x2019")).leakRef());
+    staticQuotesMap.set("no", QuotesData::create(U("\x00AB"), U("\x00BB"), U("\x2039"), U("\x203A")).leakRef());
+    staticQuotesMap.set("ro", QuotesData::create(U("\x201E"), U("\x201D")).leakRef());
+    staticQuotesMap.set("ru", QuotesData::create(U("\x00AB"), U("\x00BB"), U("\x201E"), U("\x201C")).leakRef());
     return staticQuotesMap;
 }
 
-static const QuotesData* quotesForLanguage(AtomicStringImpl* language)
+static const QuotesData* basicQuotesData()
 {
-    QuotesData* returnValue;
-    AtomicString lower(language->lower());
-    returnValue = quotesMap().get(lower.impl());
-    if (returnValue)
-        return returnValue;
-    CString s(static_cast<const String&>(lower).ascii());
-    LanguageData request = { s.buffer()->data(), 0, 0 };
-    const LanguageData* lowerBound = std::lower_bound<const LanguageData*, const LanguageData>(languageData, languageDataEnd, request);
-    if (lowerBound == languageDataEnd)
-        return defaultLanguageQuotes();
-    if (strncmp(lowerBound->name, request.name, strlen(lowerBound->name)))
-        return defaultLanguageQuotes();
-    returnValue = QuotesData::create(lowerBound->arraySize);
-    if (!returnValue)
-        return defaultLanguageQuotes();
-    String* data = returnValue->data();
-    for (int i = 0; i < lowerBound->arraySize; ++i)
-        data[i] = lowerBound->array[i];
-    quotesMap().set(lower.impl(), returnValue);
-    return returnValue;
-}
-#undef ARRAY_SIZE
-
-static const QuotesData* defaultQuotes(const RenderObject* object)
-{
-    DEFINE_STATIC_LOCAL(String, langString, ("lang"));
-    Node* node =  object->generatingNode();
-    Element* element;
-    if (!node) {
-        element = object->document()->body();
-        if (!element)
-            element = object->document()->documentElement();
-    } else if (!node->isElementNode()) {
-        element = node->parentElement();
-        if (!element)
-            return defaultLanguageQuotes();
-    } else
-      element = toElement(node);
-    const AtomicString* language;
-    while ((language = &element->getAttribute(langString)) && language->isNull()) {
-        element = element->parentElement();
-        if (!element)
-            return defaultLanguageQuotes();
-    }
-    return quotesForLanguage(language->impl());
+    static const QuotesData* staticBasicQuotes = QuotesData::create(U("\""), U("\""), U("'"), U("'")).leakRef();
+    return staticBasicQuotes;
 }
 
 PassRefPtr<StringImpl> RenderQuote::originalText() const
 {
-    if (!parent())
-        return 0;
-    ASSERT(m_depth != UNKNOWN_DEPTH);
-    const QuotesData* quotes = style()->quotes();
-    if (!quotes)
-        quotes = defaultQuotes(this);
-    if (!quotes->length)
-        return emptyAtom.impl();
-    int index = m_depth * 2;
     switch (m_type) {
     case NO_OPEN_QUOTE:
     case NO_CLOSE_QUOTE:
-        return emptyString().impl();
+        return StringImpl::empty();
     case CLOSE_QUOTE:
-        if (index)
-            --index;
-        else
-            ++index;
-        break;
+        // FIXME: When m_depth is 0 we should return empty string.
+        return quotesData()->getCloseQuote(std::max(m_depth - 1, 0)).impl();
     case OPEN_QUOTE:
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-        return emptyAtom.impl();
+        return quotesData()->getOpenQuote(m_depth).impl();
     }
-    if (index >= quotes->length)
-        index = (quotes->length-2) | (index & 1);
-    if (index < 0)
-        return emptyAtom.impl();
-    return quotes->data()[index].impl();
+    ASSERT_NOT_REACHED();
+    return StringImpl::empty();
 }
 
 void RenderQuote::computePreferredLogicalWidths(float lead)
 {
+    if (!m_attached)
+        attachQuote();
     setTextInternal(originalText());
     RenderText::computePreferredLogicalWidths(lead);
 }
 
-void RenderQuote::rendererSubtreeAttached(RenderObject* renderer)
+const QuotesData* RenderQuote::quotesData() const
+{
+    if (QuotesData* customQuotes = style()->quotes())
+        return customQuotes;
+
+    AtomicString language = style()->locale();
+    if (language.isNull())
+        return basicQuotesData();
+    const QuotesData* quotes = quotesDataLanguageMap().get(language);
+    if (!quotes)
+        return basicQuotesData();
+    return quotes;
+}
+
+void RenderQuote::attachQuote()
 {
-    ASSERT(renderer->view());
-    if (!renderer->view()->hasRenderQuotes())
+    ASSERT(view());
+    ASSERT(!m_attached);
+    ASSERT(!m_next && !m_previous);
+
+    // FIXME: Don't set pref widths dirty during layout. See updateDepth() for
+    // more detail.
+    if (!isRooted()) {
+        setNeedsLayoutAndPrefWidthsRecalc();
         return;
-    for (RenderObject* descendant = renderer; descendant; descendant = descendant->nextInPreOrder(renderer))
-        if (descendant->isQuote()) {
-            toRenderQuote(descendant)->placeQuote();
-            break;
-        }
+    }
+
+    if (!view()->renderQuoteHead()) {
+        view()->setRenderQuoteHead(this);
+        m_attached = true;
+        return;
+    }
+
+    for (RenderObject* predecessor = previousInPreOrder(); predecessor; predecessor = predecessor->previousInPreOrder()) {
+        // Skip unattached predecessors to avoid having stale m_previous pointers
+        // if the previous node is never attached and is then destroyed.
+        if (!predecessor->isQuote() || !toRenderQuote(predecessor)->isAttached())
+            continue;
+        m_previous = toRenderQuote(predecessor);
+        m_next = m_previous->m_next;
+        m_previous->m_next = this;
+        if (m_next)
+            m_next->m_previous = this;
+        break;
+    }
+
+    if (!m_previous) {
+        m_next = view()->renderQuoteHead();
+        view()->setRenderQuoteHead(this);
+        if (m_next)
+            m_next->m_previous = this;
+    }
+    m_attached = true;
+
+    for (RenderQuote* quote = this; quote; quote = quote->m_next)
+        quote->updateDepth();
+
+    ASSERT(!m_next || m_next->m_attached);
+    ASSERT(!m_next || m_next->m_previous == this);
+    ASSERT(!m_previous || m_previous->m_attached);
+    ASSERT(!m_previous || m_previous->m_next == this);
 }
 
-void RenderQuote::rendererRemovedFromTree(RenderObject* renderer)
+void RenderQuote::detachQuote()
 {
-    ASSERT(renderer->view());
-    if (!renderer->view()->hasRenderQuotes())
+    ASSERT(!m_next || m_next->m_attached);
+    ASSERT(!m_previous || m_previous->m_attached);
+    if (!m_attached)
         return;
-    for (RenderObject* descendant = renderer; descendant; descendant = descendant->nextInPreOrder(renderer))
-        if (descendant->isQuote()) {
-            RenderQuote* removedQuote = toRenderQuote(descendant);
-            RenderQuote* lastQuoteBefore = removedQuote->m_previous;
-            removedQuote->m_previous = 0;
-            int depth = removedQuote->m_depth;
-            for (descendant = descendant->nextInPreOrder(renderer); descendant; descendant = descendant->nextInPreOrder(renderer))
-                if (descendant->isQuote())
-                    removedQuote = toRenderQuote(descendant);
-            RenderQuote* quoteAfter = removedQuote->m_next;
-            removedQuote->m_next = 0;
-            if (lastQuoteBefore)
-                lastQuoteBefore->m_next = quoteAfter;
-            if (quoteAfter) {
-                quoteAfter->m_previous = lastQuoteBefore;
-                do {
-                    if (depth == quoteAfter->m_depth)
-                        break;
-                    quoteAfter->m_depth = depth;
-                    quoteAfter->setNeedsLayoutAndPrefWidthsRecalc();
-                    adjustDepth(depth, quoteAfter->m_type);
-                    quoteAfter = quoteAfter->m_next;
-                } while (quoteAfter);
-            }
-            break;
-        }
+    if (m_previous)
+        m_previous->m_next = m_next;
+    else if (view())
+        view()->setRenderQuoteHead(m_next);
+    if (m_next)
+        m_next->m_previous = m_previous;
+    if (!documentBeingDestroyed()) {
+        for (RenderQuote* quote = m_next; quote; quote = quote->m_next)
+            quote->updateDepth();
+    }
+    m_attached = false;
+    m_next = 0;
+    m_previous = 0;
+    m_depth = 0;
 }
 
-void RenderQuote::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+void RenderQuote::updateDepth()
 {
-    const QuotesData* newQuotes = style()->quotes();
-    const QuotesData* oldQuotes = oldStyle ? oldStyle->quotes() : 0;
-    if (!QuotesData::equal(newQuotes, oldQuotes))
+    ASSERT(m_attached);
+    int oldDepth = m_depth;
+    m_depth = 0;
+    if (m_previous) {
+        m_depth = m_previous->m_depth;
+        switch (m_previous->m_type) {
+        case OPEN_QUOTE:
+        case NO_OPEN_QUOTE:
+            m_depth++;
+            break;
+        case CLOSE_QUOTE:
+        case NO_CLOSE_QUOTE:
+            if (m_depth)
+                m_depth--;
+            break;
+        }
+    }
+    // FIXME: Don't call setNeedsLayout or dirty our preferred widths during layout.
+    // This is likely to fail anyway as one of our ancestor will call setNeedsLayout(false),
+    // preventing the future layout to occur on |this|. The solution is to move that to a
+    // pre-layout phase.
+    if (oldDepth != m_depth)
         setNeedsLayoutAndPrefWidthsRecalc();
-    RenderText::styleDidChange(diff, oldStyle);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderQuote.h b/Source/WebCore/rendering/RenderQuote.h
index 10e22d1c7..cf7032ca7 100644
--- a/Source/WebCore/rendering/RenderQuote.h
+++ b/Source/WebCore/rendering/RenderQuote.h
@@ -21,6 +21,9 @@
 #ifndef RenderQuote_h
 #define RenderQuote_h
 
+#include "Document.h"
+#include "QuotesData.h"
+#include "RenderStyle.h"
 #include "RenderStyleConstants.h"
 #include "RenderText.h"
 
@@ -30,22 +33,25 @@ class RenderQuote : public RenderText {
 public:
     RenderQuote(Document*, const QuoteType);
     virtual ~RenderQuote();
+    void attachQuote();
+    void detachQuote();
 
-    static void rendererSubtreeAttached(RenderObject*);
-    static void rendererRemovedFromTree(RenderObject*);
-protected:
-    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
-    virtual void willBeDestroyed();
 private:
-    virtual const char* renderName() const;
-    virtual bool isQuote() const { return true; };
-    virtual PassRefPtr<StringImpl> originalText() const;
-    virtual void computePreferredLogicalWidths(float leadWidth);
+    virtual void willBeDestroyed() OVERRIDE;
+    virtual const char* renderName() const OVERRIDE { return "RenderQuote"; };
+    virtual bool isQuote() const OVERRIDE { return true; };
+    virtual PassRefPtr<StringImpl> originalText() const OVERRIDE;
+    virtual void computePreferredLogicalWidths(float leadWidth) OVERRIDE;
+
+    const QuotesData* quotesData() const;
+    void updateDepth();
+    bool isAttached() { return m_attached; }
+
     QuoteType m_type;
     int m_depth;
     RenderQuote* m_next;
     RenderQuote* m_previous;
-    void placeQuote();
+    bool m_attached;
 };
 
 inline RenderQuote* toRenderQuote(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderRegion.cpp b/Source/WebCore/rendering/RenderRegion.cpp
index 5362836a4..aa4e05077 100644
--- a/Source/WebCore/rendering/RenderRegion.cpp
+++ b/Source/WebCore/rendering/RenderRegion.cpp
@@ -49,7 +49,6 @@ RenderRegion::RenderRegion(Node* node, RenderFlowThread* flowThread)
     , m_isValid(false)
     , m_hasCustomRegionStyle(false)
     , m_regionState(RegionUndefined)
-    , m_dispatchRegionLayoutUpdateEvent(false)
 {
 }
 
@@ -63,13 +62,14 @@ LayoutUnit RenderRegion::logicalHeightForFlowThreadContent() const
     return m_flowThread->isHorizontalWritingMode() ? contentHeight() : contentWidth();
 }
 
-LayoutRect RenderRegion::regionOverflowRect() const
+LayoutRect RenderRegion::regionOversetRect() const
 {
     // FIXME: Would like to just use hasOverflowClip() but we aren't a block yet. When RenderRegion is eliminated and
     // folded into RenderBlock, switch to hasOverflowClip().
     bool clipX = style()->overflowX() != OVISIBLE;
     bool clipY = style()->overflowY() != OVISIBLE;
-    if ((clipX && clipY) || !isValid() || !m_flowThread)
+    bool isLastRegionWithRegionOverflowBreak = (isLastRegion() && (style()->regionOverflow() == BreakRegionOverflow));
+    if ((clipX && clipY) || !isValid() || !m_flowThread || isLastRegionWithRegionOverflowBreak)
         return regionRect();
 
     LayoutRect flowThreadOverflow = m_flowThread->visualOverflowRect();
@@ -141,6 +141,18 @@ bool RenderRegion::nodeAtPoint(const HitTestRequest& request, HitTestResult& res
     return false;
 }
 
+void RenderRegion::checkRegionStyle()
+{
+    ASSERT(m_flowThread);
+    bool customRegionStyle = false;
+    if (node()) {
+        Element* regionElement = static_cast<Element*>(node());
+        customRegionStyle = view()->document()->styleResolver()->checkRegionStyle(regionElement);
+    }
+    setHasCustomRegionStyle(customRegionStyle);
+    m_flowThread->checkRegionsWithStyling();
+}
+
 void RenderRegion::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderReplaced::styleDidChange(diff, oldStyle);
@@ -153,13 +165,7 @@ void RenderRegion::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
         return;
     }
 
-    bool customRegionStyle = false;
-    if (node()) {
-        Element* regionElement = static_cast<Element*>(node());
-        customRegionStyle = view()->document()->styleResolver()->checkRegionStyle(regionElement);
-    }
-    setHasCustomRegionStyle(customRegionStyle);
-    m_flowThread->checkRegionsWithStyling();
+    checkRegionStyle();
 }
 
 void RenderRegion::layout()
@@ -187,9 +193,19 @@ void RenderRegion::layout()
 
 void RenderRegion::attachRegion()
 {
-    if (!m_flowThread)
+    if (documentBeingDestroyed())
         return;
 
+    ASSERT(!m_flowThread);
+    // Initialize the flow thread reference and create the flow thread object if needed.
+    // The flow thread lifetime is influenced by the number of regions attached to it,
+    // and we are attaching the region to the flow thread.
+    m_flowThread = view()->flowThreadController()->ensureRenderFlowThreadWithName(style()->regionThread());
+
+    // A region is valid if it is not part of a circular reference, which is checked below
+    // and in RenderNamedFlowThread::addRegionToThread.
+    setIsValid(false);
+
     // By now the flow thread should already be added to the rendering tree,
     // so we go up the rendering parents and check that this region is not part of the same
     // flow that it actually needs to display. It would create a circular reference.
@@ -202,6 +218,8 @@ void RenderRegion::attachRegion()
             // cannot change, so it is not worth adding it to the list.
             if (m_flowThread == m_parentNamedFlowThread) {
                 m_flowThread = 0;
+                // This region is not valid for this flow thread (as being part of a circular dependency).
+                setIsValid(false);
                 return;
             }
             break;
@@ -209,12 +227,17 @@ void RenderRegion::attachRegion()
     }
 
     m_flowThread->addRegionToThread(this);
+
+    // The region just got attached to the flow thread, lets check whether
+    // it has region styling rules associated.
+    checkRegionStyle();
 }
 
 void RenderRegion::detachRegion()
 {
     if (m_flowThread)
         m_flowThread->removeRegionFromThread(this);
+    m_flowThread = 0;
 }
 
 RenderBoxRegionInfo* RenderRegion::renderBoxRegionInfo(const RenderBox* box) const
diff --git a/Source/WebCore/rendering/RenderRegion.h b/Source/WebCore/rendering/RenderRegion.h
index 826e98072..6093a9c03 100644
--- a/Source/WebCore/rendering/RenderRegion.h
+++ b/Source/WebCore/rendering/RenderRegion.h
@@ -52,7 +52,7 @@ public:
 
     void setRegionRect(const LayoutRect& rect) { m_regionRect = rect; }
     LayoutRect regionRect() const { return m_regionRect; }
-    LayoutRect regionOverflowRect() const;
+    LayoutRect regionOversetRect() const;
 
     void attachRegion();
     void detachRegion();
@@ -88,13 +88,11 @@ public:
         RegionUndefined,
         RegionEmpty,
         RegionFit,
-        RegionOverflow
+        RegionOverset
     };
 
     RegionState regionState() const { return isValid() ? m_regionState : RegionUndefined; }
     void setRegionState(RegionState regionState) { m_regionState = regionState; }
-    void setDispatchRegionLayoutUpdateEvent(bool value) { m_dispatchRegionLayoutUpdateEvent = value; }
-    bool shouldDispatchRegionLayoutUpdateEvent() { return m_dispatchRegionLayoutUpdateEvent; }
     
     virtual LayoutUnit logicalWidthForFlowThreadContent() const;
     virtual LayoutUnit logicalHeightForFlowThreadContent() const;
@@ -108,6 +106,9 @@ private:
     void restoreRegionObjectsOriginalStyle();
     void setObjectStyleInRegion(RenderObject*, PassRefPtr<RenderStyle>, bool objectRegionStyleCached);
     void printRegionObjectsStyles();
+
+    void checkRegionStyle();
+
     RenderFlowThread* m_flowThread;
 
     // If this RenderRegion is displayed as part of another named flow,
@@ -139,7 +140,6 @@ private:
     bool m_isValid;
     bool m_hasCustomRegionStyle;
     RegionState m_regionState;
-    bool m_dispatchRegionLayoutUpdateEvent;
 };
 
 inline RenderRegion* toRenderRegion(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderReplaced.cpp b/Source/WebCore/rendering/RenderReplaced.cpp
index 35716be52..bcd967e6a 100644
--- a/Source/WebCore/rendering/RenderReplaced.cpp
+++ b/Source/WebCore/rendering/RenderReplaced.cpp
@@ -297,8 +297,11 @@ void RenderReplaced::computeAspectRatioInformationForRenderBox(RenderBox* conten
         }
     } else {
         computeIntrinsicRatioInformation(intrinsicSize, intrinsicRatio, isPercentageIntrinsicSize);
-        if (intrinsicRatio)
+        if (intrinsicRatio) {
             ASSERT(!isPercentageIntrinsicSize);
+            if (!intrinsicSize.isEmpty())
+                m_intrinsicSize = isHorizontalWritingMode() ? flooredIntSize(intrinsicSize) : flooredIntSize(intrinsicSize).transposedSize(); // FIXME: This introduces precision errors. We should convert m_intrinsicSize to be a float.
+        }
     }
 
     // Now constrain the intrinsic size along each axis according to minimum and maximum width/heights along the
diff --git a/Source/WebCore/rendering/RenderSlider.cpp b/Source/WebCore/rendering/RenderSlider.cpp
index f78ba5c75..1abca2fdb 100644
--- a/Source/WebCore/rendering/RenderSlider.cpp
+++ b/Source/WebCore/rendering/RenderSlider.cpp
@@ -59,6 +59,11 @@ RenderSlider::~RenderSlider()
 {
 }
 
+bool RenderSlider::canBeReplacedWithInlineRunIn() const
+{
+    return false;
+}
+
 LayoutUnit RenderSlider::baselinePosition(FontBaseline, bool /*firstLine*/, LineDirectionMode, LinePositionMode) const
 {
     // FIXME: Patch this function for writing-mode.
diff --git a/Source/WebCore/rendering/RenderSlider.h b/Source/WebCore/rendering/RenderSlider.h
index 5709e2d13..ebd0bd856 100644
--- a/Source/WebCore/rendering/RenderSlider.h
+++ b/Source/WebCore/rendering/RenderSlider.h
@@ -39,6 +39,7 @@ namespace WebCore {
     private:
         virtual const char* renderName() const { return "RenderSlider"; }
         virtual bool isSlider() const { return true; }
+        virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
 
         virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
         virtual void computePreferredLogicalWidths();
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index e939004db..2cda8dcc7 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -1206,16 +1206,33 @@ void RenderTable::updateFirstLetter()
 {
 }
 
-enum LineBox { FirstLineBox, LastLineBox };
+LayoutUnit RenderTable::baselinePosition(FontBaseline baselineType, bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
+{
+    LayoutUnit baseline = firstLineBoxBaseline();
+    if (baseline != -1)
+        return baseline;
+
+    return RenderBox::baselinePosition(baselineType, firstLine, direction, linePositionMode);
+}
+
+LayoutUnit RenderTable::lastLineBoxBaseline() const
+{
+    // Tables don't contribute their baseline towards the computation of an inline-block's baseline.
+    return -1;
+}
 
-static LayoutUnit getLineBoxBaseline(const RenderTable* table, LineBox lineBox)
+LayoutUnit RenderTable::firstLineBoxBaseline() const
 {
-    if (table->isWritingModeRoot())
+    // The baseline of a 'table' is the same as the 'inline-table' baseline per CSS 3 Flexbox (CSS 2.1
+    // doesn't define the baseline of a 'table' only an 'inline-table').
+    // This is also needed to properly determine the baseline of a cell if it has a table child.
+
+    if (isWritingModeRoot())
         return -1;
 
-    table->recalcSectionsIfNeeded();
+    recalcSectionsIfNeeded();
 
-    const RenderTableSection* topNonEmptySection = table->topNonEmptySection();
+    const RenderTableSection* topNonEmptySection = this->topNonEmptySection();
     if (!topNonEmptySection)
         return -1;
 
@@ -1223,26 +1240,10 @@ static LayoutUnit getLineBoxBaseline(const RenderTable* table, LineBox lineBox)
     if (baseline > 0)
         return topNonEmptySection->logicalTop() + baseline;
 
-    // The 'first' linebox baseline in a table in the absence of any text in the first section
-    // is the top of the table.
-    if (lineBox == FirstLineBox)
-        return topNonEmptySection->logicalTop();
-
-    // The 'last' linebox baseline in a table is the baseline of text in the first
-    // cell in the first row/section, so if there is no text do not return a baseline.
+    // FIXME: A table row always has a baseline per CSS 2.1. Will this return the right value?
     return -1;
 }
 
-LayoutUnit RenderTable::lastLineBoxBaseline() const
-{
-    return getLineBoxBaseline(this, LastLineBox);
-}
-
-LayoutUnit RenderTable::firstLineBoxBaseline() const
-{
-    return getLineBoxBaseline(this, FirstLineBox);
-}
-
 LayoutRect RenderTable::overflowClipRect(const LayoutPoint& location, RenderRegion* region, OverlayScrollbarSizeRelevancy relevancy)
 {
     LayoutRect rect = RenderBlock::overflowClipRect(location, region, relevancy);
diff --git a/Source/WebCore/rendering/RenderTable.h b/Source/WebCore/rendering/RenderTable.h
index 87418f068..e4c70f47f 100644
--- a/Source/WebCore/rendering/RenderTable.h
+++ b/Source/WebCore/rendering/RenderTable.h
@@ -251,6 +251,7 @@ private:
     virtual void computePreferredLogicalWidths();
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
+    virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const OVERRIDE;
     virtual LayoutUnit firstLineBoxBaseline() const OVERRIDE;
     virtual LayoutUnit lastLineBoxBaseline() const OVERRIDE;
 
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index 1f1379e48..80e6465ec 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -587,9 +587,9 @@ void RenderTableSection::layoutRows()
                 }
             }
 
-            if (HashSet<RenderBox*>* percentHeightDescendants = cell->percentHeightDescendants()) {
-                HashSet<RenderBox*>::iterator end = percentHeightDescendants->end();
-                for (HashSet<RenderBox*>::iterator it = percentHeightDescendants->begin(); it != end; ++it) {
+            if (ListHashSet<RenderBox*>* percentHeightDescendants = cell->percentHeightDescendants()) {
+                ListHashSet<RenderBox*>::iterator end = percentHeightDescendants->end();
+                for (ListHashSet<RenderBox*>::iterator it = percentHeightDescendants->begin(); it != end; ++it) {
                     RenderBox* box = *it;
                     if (!box->isReplaced() && !box->scrollsOverflow() && !flexAllChildren)
                         continue;
diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
index f93704dc2..73e57754a 100644
--- a/Source/WebCore/rendering/RenderText.cpp
+++ b/Source/WebCore/rendering/RenderText.cpp
@@ -678,15 +678,11 @@ LayoutRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, Lay
 
     RenderBlock* cb = containingBlock();
     RenderStyle* cbStyle = cb->style();
+
     float leftEdge;
     float rightEdge;
-    if (style()->autoWrap()) {
-        leftEdge = 0;
-        rightEdge = cb->logicalWidth();
-    } else {
-        leftEdge = min(static_cast<float>(0), rootLeft);
-        rightEdge = max(static_cast<float>(cb->logicalWidth()), rootRight);
-    }
+    leftEdge = min<float>(0, rootLeft);
+    rightEdge = max<float>(cb->logicalWidth(), rootRight);
 
     bool rightAligned = false;
     switch (cbStyle->textAlign()) {
diff --git a/Source/WebCore/rendering/RenderTextControl.cpp b/Source/WebCore/rendering/RenderTextControl.cpp
index 8b138352e..10a420aa8 100644
--- a/Source/WebCore/rendering/RenderTextControl.cpp
+++ b/Source/WebCore/rendering/RenderTextControl.cpp
@@ -81,7 +81,7 @@ static inline bool updateUserModifyProperty(Node* node, RenderStyle* style)
     if (node->isElementNode()) {
         Element* element = static_cast<Element*>(node);
         isEnabled = element->isEnabledFormControl();
-        isReadOnlyControl = element->isReadOnlyFormControl();
+        isReadOnlyControl = element->isTextFormControl() && static_cast<HTMLTextFormControlElement*>(element)->readOnly();
     }
 
     style->setUserModify((isReadOnlyControl || !isEnabled) ? READ_ONLY : READ_WRITE_PLAINTEXT_ONLY);
@@ -299,4 +299,9 @@ RenderObject* RenderTextControl::layoutSpecialExcludedChild(bool relayoutChildre
     return placeholderRenderer;
 }
 
+bool RenderTextControl::canBeReplacedWithInlineRunIn() const
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderTextControl.h b/Source/WebCore/rendering/RenderTextControl.h
index 1a48f5dbe..b8f1f3025 100644
--- a/Source/WebCore/rendering/RenderTextControl.h
+++ b/Source/WebCore/rendering/RenderTextControl.h
@@ -72,6 +72,7 @@ private:
     virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
     virtual bool avoidsFloats() const { return true; }
     virtual bool canHaveGeneratedChildren() const OVERRIDE { return false; }
+    virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
     
     virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
diff --git a/Source/WebCore/rendering/RenderTheme.cpp b/Source/WebCore/rendering/RenderTheme.cpp
index f1661722e..3382d3fbd 100644
--- a/Source/WebCore/rendering/RenderTheme.cpp
+++ b/Source/WebCore/rendering/RenderTheme.cpp
@@ -828,7 +828,7 @@ bool RenderTheme::isReadOnlyControl(const RenderObject* o) const
     Node* node = o->node();
     if (!node || !node->isElementNode())
         return false;
-    return static_cast<Element*>(node)->isReadOnlyFormControl();
+    return static_cast<Element*>(node)->shouldMatchReadOnlySelector();
 }
 
 bool RenderTheme::isHovered(const RenderObject* o) const
@@ -963,6 +963,11 @@ bool RenderTheme::paintMeter(RenderObject*, const PaintInfo&, const IntRect&)
 #endif
 
 #if ENABLE(DATALIST_ELEMENT)
+LayoutUnit RenderTheme::sliderTickSnappingThreshold() const
+{
+    return 0;
+}
+
 void RenderTheme::paintSliderTicks(RenderObject* o, const PaintInfo& paintInfo, const IntRect& rect)
 {
     Node* node = o->node();
@@ -1024,13 +1029,13 @@ void RenderTheme::paintSliderTicks(RenderObject* o, const PaintInfo& paintInfo,
         if (!input->isValidValue(value))
             continue;
         double parsedValue = parseToDoubleForNumberType(input->sanitizeValue(value));
-        double tickPosition = (parsedValue - min) / (max - min);
-        if (!o->style()->isLeftToRightDirection())
-            tickPosition = 1.0 - tickPosition;
+        double tickFraction = (parsedValue - min) / (max - min);
+        double tickRatio = isHorizontal && o->style()->isLeftToRightDirection() ? tickFraction : 1.0 - tickFraction;
+        double tickPosition = round(tickRegionSideMargin + tickRegionWidth * tickRatio);
         if (isHorizontal)
-            tickRect.setX(floor(tickRegionSideMargin + tickRegionWidth * tickPosition));
+            tickRect.setX(tickPosition);
         else
-            tickRect.setY(floor(tickRegionSideMargin + tickRegionWidth * tickPosition));
+            tickRect.setY(tickPosition);
         paintInfo.context->fillRect(tickRect);
     }
 }
diff --git a/Source/WebCore/rendering/RenderTheme.h b/Source/WebCore/rendering/RenderTheme.h
index 3d3976266..6facf5280 100644
--- a/Source/WebCore/rendering/RenderTheme.h
+++ b/Source/WebCore/rendering/RenderTheme.h
@@ -215,6 +215,8 @@ public:
 #endif
 
 #if ENABLE(DATALIST_ELEMENT)
+    // Returns the threshold distance for snapping to a slider tick mark.
+    virtual LayoutUnit sliderTickSnappingThreshold() const;
     // Returns size of one slider tick mark for a horizontal track.
     // For vertical tracks we rotate it and use it. i.e. Width is always length along the track.
     virtual IntSize sliderTickSize() const = 0;
diff --git a/Source/WebCore/rendering/RenderThemeChromiumCommon.cpp b/Source/WebCore/rendering/RenderThemeChromiumCommon.cpp
index 368c2b566..68de37b12 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumCommon.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumCommon.cpp
@@ -32,10 +32,18 @@ namespace WebCore {
 
 bool RenderThemeChromiumCommon::supportsDataListUI(const AtomicString& type)
 {
-    // FIXME: We still need to support datetime, date, month, week, time, datetime-local, color.
+    // FIXME: We still need to support datetime, date, month, week, time, datetime-local.
     return type == InputTypeNames::text() || type == InputTypeNames::search() || type == InputTypeNames::url()
         || type == InputTypeNames::telephone() || type == InputTypeNames::email() || type == InputTypeNames::number()
+#if ENABLE(INPUT_TYPE_COLOR)
+        || type == InputTypeNames::color()
+#endif
         || type == InputTypeNames::range();
 }
 
+LayoutUnit RenderThemeChromiumCommon::sliderTickSnappingThreshold()
+{
+    return 5;
+}
+
 }
diff --git a/Source/WebCore/rendering/RenderThemeChromiumCommon.h b/Source/WebCore/rendering/RenderThemeChromiumCommon.h
index be099a8e2..80aeca952 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumCommon.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumCommon.h
@@ -27,6 +27,7 @@
 #ifndef RenderThemeChromiumCommon_h
 #define RenderThemeChromiumCommon_h
 
+#include "LayoutTypes.h"
 #include <wtf/text/AtomicString.h>
 
 namespace WebCore {
@@ -34,6 +35,7 @@ namespace WebCore {
 class RenderThemeChromiumCommon {
 public:
     static bool supportsDataListUI(const AtomicString& type);
+    static LayoutUnit sliderTickSnappingThreshold();
 };
 
 }
diff --git a/Source/WebCore/rendering/RenderThemeChromiumMac.h b/Source/WebCore/rendering/RenderThemeChromiumMac.h
index 973299a31..e19ffa303 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumMac.h
@@ -71,6 +71,9 @@ private:
     virtual Color disabledTextColor(const Color& textColor, const Color&) const OVERRIDE { return textColor; }
     virtual void updateActiveState(NSCell*, const RenderObject*);
     virtual String extraDefaultStyleSheet();
+#if ENABLE(DATALIST_ELEMENT)
+    virtual LayoutUnit sliderTickSnappingThreshold() const OVERRIDE;
+#endif
 #if ENABLE(CALENDAR_PICKER)
     virtual CString extraCalendarPickerStyleSheet() OVERRIDE;
 #endif
diff --git a/Source/WebCore/rendering/RenderThemeChromiumMac.mm b/Source/WebCore/rendering/RenderThemeChromiumMac.mm
index 05a9589db..fc01e6fa9 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/Source/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -192,6 +192,13 @@ String RenderThemeChromiumMac::extraDefaultStyleSheet()
            String(themeChromiumUserAgentStyleSheet, sizeof(themeChromiumUserAgentStyleSheet));
 }
 
+#if ENABLE(DATALIST_ELEMENT)
+LayoutUnit RenderThemeChromiumMac::sliderTickSnappingThreshold() const
+{
+    return RenderThemeChromiumCommon::sliderTickSnappingThreshold();
+}
+#endif
+
 #if ENABLE(CALENDAR_PICKER)
 CString RenderThemeChromiumMac::extraCalendarPickerStyleSheet()
 {
diff --git a/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp b/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 7ce2a0cd5..3eaae4111 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -591,6 +591,13 @@ bool RenderThemeChromiumSkia::shouldShowPlaceholderWhenFocused() const
     return true;
 }
 
+#if ENABLE(DATALIST_ELEMENT)
+LayoutUnit RenderThemeChromiumSkia::sliderTickSnappingThreshold() const
+{
+    return RenderThemeChromiumCommon::sliderTickSnappingThreshold();
+}
+#endif
+
 #if ENABLE(PROGRESS_ELEMENT)
 
 //
diff --git a/Source/WebCore/rendering/RenderThemeChromiumSkia.h b/Source/WebCore/rendering/RenderThemeChromiumSkia.h
index 489738c85..ee9b11c37 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -174,6 +174,10 @@ private:
     virtual Color disabledTextColor(const Color& textColor, const Color&) const OVERRIDE { return textColor; }
     virtual bool shouldShowPlaceholderWhenFocused() const OVERRIDE;
 
+#if ENABLE(DATALIST_ELEMENT)
+    virtual LayoutUnit sliderTickSnappingThreshold() const OVERRIDE;
+#endif
+
     int menuListInternalPadding(RenderStyle*, int paddingType) const;
     bool paintMediaButtonInternal(GraphicsContext*, const IntRect&, Image*);
     IntRect convertToPaintingRect(RenderObject* inputRenderer, const RenderObject* partRenderer, LayoutRect partRect, const IntRect& localOffset) const;
diff --git a/Source/WebCore/rendering/RenderThemeMac.mm b/Source/WebCore/rendering/RenderThemeMac.mm
index 1b92006f1..25b03b737 100644
--- a/Source/WebCore/rendering/RenderThemeMac.mm
+++ b/Source/WebCore/rendering/RenderThemeMac.mm
@@ -1571,7 +1571,7 @@ bool RenderThemeMac::paintSearchFieldCancelButton(RenderObject* o, const PaintIn
 
     NSSearchFieldCell* search = this->search();
 
-    if (input->isEnabledFormControl() && !input->isReadOnlyFormControl()) {
+    if (input->isEnabledFormControl() && (input->isTextFormControl() && !static_cast<HTMLTextFormControlElement*>(input)->readOnly())) {
         updateActiveState([search cancelButtonCell], o);
         updatePressedState([search cancelButtonCell], o);
     }
diff --git a/Source/WebCore/rendering/RenderView.cpp b/Source/WebCore/rendering/RenderView.cpp
index 8bd49ccfa..048f6e1ce 100644
--- a/Source/WebCore/rendering/RenderView.cpp
+++ b/Source/WebCore/rendering/RenderView.cpp
@@ -62,7 +62,7 @@ RenderView::RenderView(Node* node, FrameView* view)
     , m_pageLogicalHeightChanged(false)
     , m_layoutState(0)
     , m_layoutStateDisableCount(0)
-    , m_renderQuoteCount(0)
+    , m_renderQuoteHead(0)
     , m_renderCounterCount(0)
 {
     // Clear our anonymous bit, set because RenderObject assumes
@@ -165,20 +165,20 @@ void RenderView::layout()
     setNeedsLayout(false);
 }
 
-void RenderView::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState, ApplyContainerFlipOrNot, bool* wasFixed) const
+void RenderView::mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState& transformState, MapLocalToContainerFlags mode, bool* wasFixed) const
 {
     // If a container was specified, and was not 0 or the RenderView,
     // then we should have found it by now.
     ASSERT_ARG(repaintContainer, !repaintContainer || repaintContainer == this);
-    ASSERT_UNUSED(wasFixed, !wasFixed || *wasFixed == fixed);
+    ASSERT_UNUSED(wasFixed, !wasFixed || *wasFixed == (mode & IsFixed));
 
-    if (!repaintContainer && useTransforms && shouldUseTransformFromContainer(0)) {
+    if (!repaintContainer && mode & UseTransforms && shouldUseTransformFromContainer(0)) {
         TransformationMatrix t;
         getTransformFromContainer(0, LayoutSize(), t);
         transformState.applyTransform(t);
     }
     
-    if (fixed && m_frameView)
+    if (mode & IsFixed && m_frameView)
         transformState.move(m_frameView->scrollOffsetForFixedPosition());
 }
 
@@ -961,12 +961,12 @@ void RenderView::setFixedPositionedObjectsNeedLayout()
 {
     ASSERT(m_frameView);
 
-    PositionedObjectsListHashSet* positionedObjects = this->positionedObjects();
+    ListHashSet<RenderBox*>* positionedObjects = this->positionedObjects();
     if (!positionedObjects)
         return;
 
-    PositionedObjectsListHashSet::const_iterator end = positionedObjects->end();
-    for (PositionedObjectsListHashSet::const_iterator it = positionedObjects->begin(); it != end; ++it) {
+    ListHashSet<RenderBox*>::const_iterator end = positionedObjects->end();
+    for (ListHashSet<RenderBox*>::const_iterator it = positionedObjects->begin(); it != end; ++it) {
         RenderBox* currBox = *it;
         currBox->setNeedsLayout(true);
     }
diff --git a/Source/WebCore/rendering/RenderView.h b/Source/WebCore/rendering/RenderView.h
index 04a806e9b..e8e422765 100644
--- a/Source/WebCore/rendering/RenderView.h
+++ b/Source/WebCore/rendering/RenderView.h
@@ -32,6 +32,7 @@ namespace WebCore {
 
 class FlowThreadController;
 class RenderWidget;
+class RenderQuote;
 
 #if USE(ACCELERATED_COMPOSITING)
 class RenderLayerCompositor;
@@ -194,19 +195,19 @@ public:
 
     void setFixedPositionedObjectsNeedLayout();
 
-    // FIXME: This is a work around because the current implementation of counters and quotes
+    void setRenderQuoteHead(RenderQuote* head) { m_renderQuoteHead = head; }
+    RenderQuote* renderQuoteHead() const { return m_renderQuoteHead; }
+
+    // FIXME: This is a work around because the current implementation of counters
     // requires walking the entire tree repeatedly and most pages don't actually use either
     // feature so we shouldn't take the performance hit when not needed. Long term we should
     // rewrite the counter and quotes code.
-    void addRenderQuote() { m_renderQuoteCount++; }
-    void removeRenderQuote() { ASSERT(m_renderQuoteCount > 0); m_renderQuoteCount--; }
-    bool hasRenderQuotes() { return m_renderQuoteCount; }
     void addRenderCounter() { m_renderCounterCount++; }
     void removeRenderCounter() { ASSERT(m_renderCounterCount > 0); m_renderCounterCount--; }
     bool hasRenderCounters() { return m_renderCounterCount; }
 
 protected:
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&, ApplyContainerFlipOrNot = ApplyContainerFlip, bool* wasFixed = 0) const;
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState&, MapLocalToContainerFlags mode = ApplyContainerFlip, bool* wasFixed = 0) const OVERRIDE;
     virtual const RenderObject* pushMappingToContainer(const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap&) const;
     virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
     virtual bool requiresColumns(int desiredColumnCount) const OVERRIDE;
@@ -301,7 +302,7 @@ private:
     OwnPtr<FlowThreadController> m_flowThreadController;
     RefPtr<IntervalArena> m_intervalArena;
 
-    unsigned m_renderQuoteCount;
+    RenderQuote* m_renderQuoteHead;
     unsigned m_renderCounterCount;
 };
 
diff --git a/Source/WebCore/rendering/TextAutosizer.cpp b/Source/WebCore/rendering/TextAutosizer.cpp
index 0824aa336..82399c739 100644
--- a/Source/WebCore/rendering/TextAutosizer.cpp
+++ b/Source/WebCore/rendering/TextAutosizer.cpp
@@ -68,6 +68,8 @@ void TextAutosizer::processBlock(RenderBlock* block, const IntSize& windowSize)
 {
     int windowLogicalWidth = block->isHorizontalWritingMode() ? windowSize.width() : windowSize.height();
     float multiplier = static_cast<float>(block->logicalWidth()) / windowLogicalWidth; // FIXME: This is overly simplistic.
+    multiplier *= m_document->settings()->textAutosizingFontScaleFactor();
+
     if (multiplier < 1)
         return;
     for (RenderObject* descendant = traverseNext(block, block, treatAsInline); descendant; descendant = traverseNext(descendant, block, treatAsInline)) {
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp b/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
index a4f927407..08885e001 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
@@ -194,9 +194,19 @@ LayoutUnit RenderMathMLBlock::preferredLogicalHeightAfterSizing(RenderObject* ch
         ASSERT(!child->needsLayout());
         return toRenderBox(child)->logicalHeight();
     }
+    // This currently ignores -webkit-line-box-contain:
     return child->style()->fontSize();
 }
 
+LayoutUnit RenderMathMLBlock::baselinePosition(FontBaseline baselineType, bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
+{
+    // mathml.css sets math { -webkit-line-box-contain: glyphs replaced; line-height: 0; }, so when linePositionMode == PositionOfInteriorLineBoxes we want to
+    // return 0 here to match our line-height. This matters when RootInlineBox::ascentAndDescentForBox is called on a RootInlineBox for an inline-block.
+    if (linePositionMode == PositionOfInteriorLineBoxes)
+        return 0;
+    return RenderBlock::baselinePosition(baselineType, firstLine, direction, linePositionMode);
+}
+
 const char* RenderMathMLBlock::renderName() const
 {
     EDisplay display = style()->display();
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLBlock.h b/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
index 45f729643..25ec75039 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
@@ -76,6 +76,8 @@ public:
     // computePreferredLogicalWidths() in derived classes must ensure m_preferredLogicalHeight is set to < 0 or its correct value.
     virtual void computePreferredLogicalWidths() OVERRIDE;
     
+    virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const OVERRIDE;
+    
 #if ENABLE(DEBUG_MATH_LAYOUT)
     virtual void paint(PaintInfo&, const LayoutPoint&);
 #endif
@@ -83,26 +85,6 @@ public:
     // Create a new RenderMathMLBlock, with a new style inheriting from this->style().
     RenderMathMLBlock* createAnonymousMathMLBlock(EDisplay = BLOCK);
     
-protected:
-    static LayoutUnit getBoxModelObjectHeight(const RenderObject* object)
-    {
-        if (object && object->isBoxModelObject()) {
-            const RenderBoxModelObject* box = toRenderBoxModelObject(object);
-            return box->offsetHeight();
-        }
-        
-        return 0;
-    }
-    static LayoutUnit getBoxModelObjectWidth(const RenderObject* object)
-    {
-        if (object && object->isBoxModelObject()) {
-            const RenderBoxModelObject* box = toRenderBoxModelObject(object);
-            return box->offsetWidth();
-        }
-        
-        return 0;
-    }
-
 private:
     virtual const char* renderName() const OVERRIDE;
     
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp b/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
index ffc4f1bc8..77bebd84f 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
@@ -197,7 +197,7 @@ LayoutUnit RenderMathMLFraction::baselinePosition(FontBaseline, bool firstLine,
         int shift = int(ceil((refStyle->fontMetrics().xHeight() + 1) / 2));
         return numeratorWrapper->pixelSnappedOffsetHeight() + shift;
     }
-    return RenderBlock::baselinePosition(AlphabeticBaseline, firstLine, lineDirection, linePositionMode);
+    return RenderMathMLBlock::baselinePosition(AlphabeticBaseline, firstLine, lineDirection, linePositionMode);
 }
 
 }
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp b/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
index 1160aa1cf..196783804 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
@@ -331,7 +331,7 @@ void RenderMathMLOperator::updateFromElement()
     setNeedsLayoutAndPrefWidthsRecalc();
 }
 
-PassRefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int lineHeight, int maxHeightForRenderer, int topRelative)
+PassRefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int /* lineHeight */, int maxHeightForRenderer, int topRelative)
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
@@ -343,8 +343,7 @@ PassRefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int lineHeigh
     desc.setComputedSize(gGlyphFontSize);
     newStyle->setFontDescription(desc);
     newStyle->font().update(style()->font().fontSelector());
-    newStyle->setLineHeight(Length(lineHeight, Fixed));
-    newStyle->setVerticalAlign(TOP);
+    // FIXME: With -webkit-line-box-contain, this method's lineHeight argument is no longer used. It should be removed in a future patch.
 
     if (maxHeightForRenderer > 0)
         newStyle->setMaxHeight(Length(maxHeightForRenderer, Fixed));
@@ -387,7 +386,7 @@ LayoutUnit RenderMathMLOperator::baselinePosition(FontBaseline, bool firstLine,
 {
     if (m_isStacked)
         return m_stretchHeight * 2 / 3 - (m_stretchHeight - static_cast<int>(m_stretchHeight / gOperatorExpansion)) / 2;    
-    return RenderBlock::baselinePosition(AlphabeticBaseline, firstLine, lineDirection, linePositionMode);
+    return RenderMathMLBlock::baselinePosition(AlphabeticBaseline, firstLine, lineDirection, linePositionMode);
 }
     
 }
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
index efeed1a1f..b9346b935 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
@@ -32,6 +32,7 @@
 
 #include "GraphicsContext.h"
 #include "PaintInfo.h"
+#include "RenderMathMLRow.h"
 
 using namespace std;
 
@@ -70,6 +71,20 @@ RenderMathMLRoot::RenderMathMLRoot(Element* element)
 {
 }
 
+void RenderMathMLRoot::addChild(RenderObject* newChild, RenderObject* beforeChild)
+{
+    // Insert an implicit <mrow> for <mroot> as well as <msqrt>, to ensure firstChild() will have a box
+    // to measure and store a glyph-based height for preferredLogicalHeightAfterSizing.
+    if (!firstChild())
+        RenderMathMLBlock::addChild(RenderMathMLRow::createAnonymousWithParentRenderer(this));
+    
+    // An <mroot>'s index has { position: absolute }.
+    if (newChild->style()->position() == AbsolutePosition)
+        RenderMathMLBlock::addChild(newChild);
+    else
+        firstChild()->addChild(newChild, beforeChild && beforeChild->style()->position() != AbsolutePosition ? beforeChild : 0);
+}
+
 RenderBoxModelObject* RenderMathMLRoot::index() const
 {
     if (!firstChild())
@@ -86,7 +101,7 @@ void RenderMathMLRoot::computePreferredLogicalWidths()
     
     computeChildrenPreferredLogicalHeights();
     
-    int baseHeight = firstChild() ? roundToInt(preferredLogicalHeightAfterSizing(firstChild())) : 0;
+    int baseHeight = firstChild() ? roundToInt(preferredLogicalHeightAfterSizing(firstChild())) : style()->fontSize();
     
     int frontWidth = lroundf(gFrontWidthEms * style()->fontSize());
     
@@ -150,9 +165,9 @@ void RenderMathMLRoot::paint(PaintInfo& info, const LayoutPoint& paintOffset)
     
     int startX = adjustedPaintOffset.x();
     int frontWidth = lroundf(gFrontWidthEms * style()->fontSize());
-    int overbarWidth = roundToInt(getBoxModelObjectWidth(firstChild())) + m_overbarLeftPointShift;
+    int overbarWidth = roundToInt(contentLogicalWidth()) + m_overbarLeftPointShift;
     
-    int baseHeight = roundToInt(getBoxModelObjectHeight(firstChild()));
+    int baseHeight = roundToInt(contentLogicalHeight());
     int rootPad = lroundf(gSpaceAboveEms * style()->fontSize());
     adjustedPaintOffset.setY(adjustedPaintOffset.y() - rootPad);
     
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRoot.h b/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
index cd5d6e6e2..2ae303aa8 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
@@ -37,6 +37,8 @@ class RenderMathMLRoot : public RenderMathMLBlock {
 public:
     RenderMathMLRoot(Element*);
     
+    virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0) OVERRIDE;
+    
 protected:
     virtual void layout() OVERRIDE;
     
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
index b4b07a2cf..da7504520 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
@@ -30,8 +30,6 @@
 
 #include "RenderMathMLSquareRoot.h"
 
-#include "RenderMathMLRow.h"
-
 namespace WebCore {
     
 RenderMathMLSquareRoot::RenderMathMLSquareRoot(Element* element)
@@ -39,22 +37,6 @@ RenderMathMLSquareRoot::RenderMathMLSquareRoot(Element* element)
 {
 }
 
-void RenderMathMLSquareRoot::addChild(RenderObject* newChild, RenderObject* beforeChild)
-{
-    if (!firstChild()) {
-        RenderMathMLRow* newMRow = RenderMathMLRow::createAnonymousWithParentRenderer(this);
-        
-        RenderMathMLRoot::addChild(newMRow);
-        
-        // newMRow->isAnonymousBlock() is false because newMRow's display is INLINE_BLOCK,
-        // so we don't need to worry about removeLeftoverAnonymousBlock().
-        ASSERT(!newMRow->isAnonymousBlock());
-    }
-    
-    ASSERT(firstChild() && firstChild()->isAnonymous() && firstChild()->isRenderMathMLBlock() && toRenderMathMLBlock(firstChild())->isRenderMathMLRow());
-    firstChild()->addChild(newChild, beforeChild);
-}
-
 }
 
 #endif // ENABLE(MATHML)
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
index cbb2c5706..90e186c6b 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
@@ -37,8 +37,6 @@ class RenderMathMLSquareRoot : public RenderMathMLRoot {
 public:
     RenderMathMLSquareRoot(Element*);
     
-    virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0) OVERRIDE;
-    
 private:
     virtual const char* renderName() const { return "RenderMathMLSquareRoot"; }
 };
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
index da406003a..d8dab715a 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
@@ -140,24 +140,18 @@ void RenderMathMLSubSup::layout()
     
     if (m_kind != SubSup || !m_scripts)
         return;
-    RenderBoxModelObject* base = this->base();
-    RenderObject* superscriptWrapper = m_scripts->firstChild();
-    RenderObject* subscriptWrapper = m_scripts->lastChild();
-    if (!base || !superscriptWrapper || !subscriptWrapper || superscriptWrapper == subscriptWrapper)
-        return;
-    ASSERT(superscriptWrapper->isRenderMathMLBlock());
-    ASSERT(subscriptWrapper->isRenderMathMLBlock());
-    RenderObject* superscript = superscriptWrapper->firstChild();
-    RenderObject* subscript = subscriptWrapper->firstChild();
-    if (!superscript || !subscript)
+    RenderMathMLBlock* baseWrapper = toRenderMathMLBlock(firstChild());
+    RenderMathMLBlock* superscriptWrapper = toRenderMathMLBlock(m_scripts->firstChild());
+    RenderMathMLBlock* subscriptWrapper = toRenderMathMLBlock(m_scripts->lastChild());
+    if (!baseWrapper || !superscriptWrapper || !subscriptWrapper || superscriptWrapper == subscriptWrapper)
         return;
     
-    LineDirectionMode lineDirection = style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
-    LayoutUnit baseBaseline = base->baselinePosition(AlphabeticBaseline, true, lineDirection);
-    LayoutUnit baseExtendUnderBaseline = getBoxModelObjectHeight(base) - baseBaseline;
+    LayoutUnit baseWrapperBaseline = toRenderBox(firstChild())->firstLineBoxBaseline();
+    LayoutUnit baseBaseline = baseWrapperBaseline - baseWrapper->paddingBefore();
+    LayoutUnit baseExtendUnderBaseline = baseWrapper->logicalHeight() - baseWrapperBaseline;
     LayoutUnit axis = style()->fontMetrics().xHeight() / 2;
-    LayoutUnit superscriptHeight = getBoxModelObjectHeight(superscript);
-    LayoutUnit subscriptHeight = getBoxModelObjectHeight(subscript);
+    LayoutUnit superscriptHeight = superscriptWrapper->logicalHeight() - superscriptWrapper->paddingAfter();
+    LayoutUnit subscriptHeight = subscriptWrapper->logicalHeight();
     
     // Our layout rules are: Don't let the superscript go below the "axis" (half x-height above the
     // baseline), or the subscript above the axis. Also, don't let the superscript's top edge be
@@ -181,7 +175,6 @@ void RenderMathMLSubSup::layout()
     
     setChildNeedsLayout(true, MarkOnlyThis);
     
-    RenderObject* baseWrapper = firstChild();
     baseWrapper->style()->setPaddingTop(Length(basePaddingTop, Fixed));
     baseWrapper->setNeedsLayout(true, MarkOnlyThis);
     
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp
index 272032db6..e07d1cc5c 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp
@@ -35,8 +35,6 @@ namespace WebCore {
 
 using namespace MathMLNames;
     
-static const double gOverSpacingAdjustment = 0.5;
-    
 RenderMathMLUnderOver::RenderMathMLUnderOver(Element* element)
     : RenderMathMLBlock(element)
 {
@@ -143,133 +141,24 @@ inline int getOffsetHeight(RenderObject* obj)
     return 0;
 }
 
-void RenderMathMLUnderOver::layout() 
-{
-    RenderBlock::layout();
-    RenderObject* over = 0;
-    RenderObject* base = 0;
-    switch (m_kind) {
-    case Over:
-        // We need to calculate the baseline over the over versus the start of the base and 
-        // adjust the placement of the base.
-        over = firstChild();
-        if (over) {
-            // FIXME: descending glyphs intrude into base (e.g. lowercase y over base)
-            // FIXME: bases that ascend higher than the line box intrude into the over
-            if (!over->firstChild() || !over->firstChild()->isBoxModelObject())
-                break;
-            
-            LayoutUnit overSpacing = static_cast<LayoutUnit>(gOverSpacingAdjustment * (getOffsetHeight(over) - toRenderBoxModelObject(over->firstChild())->baselinePosition(AlphabeticBaseline, true, HorizontalLine)));
-            
-            // base row wrapper
-            base = over->nextSibling();
-            if (base) {
-                if (overSpacing > 0) 
-                    base->style()->setMarginTop(Length(-overSpacing, Fixed));
-                else 
-                    base->style()->setMarginTop(Length(0, Fixed));
-            }
-            
-        }
-        break;
-    case Under:
-        // FIXME: Non-ascending glyphs in the under should be moved closer to the base
-
-        // We need to calculate the baseline of the base versus the start of the under block and
-        // adjust the placement of the under block.
-        
-        // base row wrapper
-        base = firstChild();
-        if (base) {
-            int baseHeight = getOffsetHeight(base);
-            // actual base
-            base = base->firstChild();
-            if (!base || !base->isBoxModelObject())
-                break;
-            
-            // FIXME: We need to look at the space between a single maximum height of
-            //        the line boxes and the baseline and squeeze them together
-            LayoutUnit underSpacing = baseHeight - toRenderBoxModelObject(base)->baselinePosition(AlphabeticBaseline, true, HorizontalLine);
-            
-            // adjust the base's intrusion into the under
-            RenderObject* under = lastChild();
-            if (under && underSpacing > 0)
-                under->style()->setMarginTop(Length(-underSpacing, Fixed));
-        }
-        break;
-    case UnderOver:
-        // FIXME: Non-descending glyphs in the over should be moved closer to the base
-        // FIXME: Non-ascending glyphs in the under should be moved closer to the base
-        
-        // We need to calculate the baseline of the over versus the start of the base and 
-        // adjust the placement of the base.
-        
-        over = firstChild();
-        if (over) {
-            // FIXME: descending glyphs intrude into base (e.g. lowercase y over base)
-            // FIXME: bases that ascend higher than the line box intrude into the over
-            if (!over->firstChild() || !over->firstChild()->isBoxModelObject())
-                break;
-            LayoutUnit overSpacing = static_cast<LayoutUnit>(gOverSpacingAdjustment * (getOffsetHeight(over) - toRenderBoxModelObject(over->firstChild())->baselinePosition(AlphabeticBaseline, true, HorizontalLine)));
-            
-            // base row wrapper
-            base = over->nextSibling();
-            
-            if (base) {
-                if (overSpacing > 0)
-                    base->style()->setMarginTop(Length(-overSpacing, Fixed));
-                
-                // We need to calculate the baseline of the base versus the start of the under block and
-                // adjust the placement of the under block.
-                
-                int baseHeight = getOffsetHeight(base);
-                // actual base
-                base = base->firstChild();
-                if (!base || !base->isBoxModelObject())
-                    break;
-
-                // FIXME: We need to look at the space between a single maximum height of
-                //        the line boxes and the baseline and squeeze them together
-                LayoutUnit underSpacing = baseHeight - toRenderBoxModelObject(base)->baselinePosition(AlphabeticBaseline, true, HorizontalLine);
-                
-                RenderObject* under = lastChild();
-                if (under && under->firstChild() && under->firstChild()->isRenderInline() && underSpacing > 0)
-                    under->style()->setMarginTop(Length(-underSpacing, Fixed));
-                
-            }
-        }
-        break;
-    }
-    setNeedsLayout(true);
-    RenderBlock::layout();
-}
-
-LayoutUnit RenderMathMLUnderOver::baselinePosition(FontBaseline, bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
+LayoutUnit RenderMathMLUnderOver::baselinePosition(FontBaseline baselineType, bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
 {
     RenderObject* current = firstChild();
     if (!current || linePositionMode == PositionOfInteriorLineBoxes)
-        return RenderBlock::baselinePosition(AlphabeticBaseline, firstLine, direction, linePositionMode);
+        return RenderMathMLBlock::baselinePosition(baselineType, firstLine, direction, linePositionMode);
 
-    LayoutUnit baseline = 0;
+    LayoutUnit baseline = direction == HorizontalLine ? marginTop() : marginRight();
     switch (m_kind) {
     case UnderOver:
     case Over:
-        baseline += getOffsetHeight(current);
-        current = current->nextSibling();
-        if (current) {
-            // actual base
-            RenderObject* base = current->firstChild();
-            if (!base || !base->isBoxModelObject())
-                break;
-            baseline += toRenderBoxModelObject(base)->baselinePosition(AlphabeticBaseline, firstLine, HorizontalLine, linePositionMode);
-            // added the negative top margin
-            baseline += current->style()->marginTop().value();
+        if (current->nextSibling()) {
+            baseline += getOffsetHeight(current);
+            current = current->nextSibling();
         }
-        break;
+        // fall through
     case Under:
-        RenderObject* base = current->firstChild();
-        if (base && base->isBoxModelObject())
-            baseline += toRenderBoxModelObject(base)->baselinePosition(AlphabeticBaseline, true, HorizontalLine);
+        ASSERT(current->isRenderBlock());
+        baseline += toRenderBox(current)->firstLineBoxBaseline();
     }
 
     return baseline;
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h
index b450689c9..07107b94a 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h
@@ -39,7 +39,6 @@ public:
     
     virtual RenderMathMLOperator* unembellishedOperator();
 
-    virtual void layout();
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
     
 private:
diff --git a/Source/WebCore/rendering/style/QuotesData.cpp b/Source/WebCore/rendering/style/QuotesData.cpp
index 4e81f7567..c854bd53c 100644
--- a/Source/WebCore/rendering/style/QuotesData.cpp
+++ b/Source/WebCore/rendering/style/QuotesData.cpp
@@ -1,5 +1,6 @@
 /**
  * Copyright (C) 2011 Nokia Inc.  All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,38 +24,53 @@
 
 namespace WebCore {
 
-QuotesData* QuotesData::create(int stringCount)
+PassRefPtr<QuotesData> QuotesData::create(String open, String close)
 {
-    char* tmp = new char[sizeof(QuotesData)+sizeof(String)*stringCount];
-    if (!tmp)
-        return 0;
-    QuotesData* ret = new (tmp) QuotesData(stringCount);
-    for (int i = 0; i < stringCount; ++i)
-        new (tmp +sizeof(QuotesData) + sizeof(String)*i) String();
-    return ret;
+    RefPtr<QuotesData> data = QuotesData::create();
+    data->addPair(std::make_pair(open, close));
+    return data;
 }
 
-bool QuotesData::equal(const QuotesData* quotesData1, const QuotesData* quotesData2)
+PassRefPtr<QuotesData> QuotesData::create(String open1, String close1, String open2, String close2)
 {
-    if (quotesData1 == quotesData2)
-        return true;
-    if (!quotesData1 || !quotesData2)
-        return false;
-    if (quotesData1->length != quotesData2->length)
-        return false;
-    const String* data1 = quotesData1->data();
-    const String* data2 = quotesData2->data();
-    for (int i = quotesData1->length - 1; i >= 0; --i)
-        if (data1[i] != data2[i])
-            return false;
-    return true;
+    RefPtr<QuotesData> data = QuotesData::create();
+    data->addPair(std::make_pair(open1, close1));
+    data->addPair(std::make_pair(open2, close2));
+    return data;
+}
+
+void QuotesData::addPair(std::pair<String, String> quotePair)
+{
+    m_quotePairs.append(quotePair);
+}
+
+const String QuotesData::getOpenQuote(int index) const
+{
+    ASSERT(index >= 0);
+    if (!m_quotePairs.size())
+        return emptyString();
+    if ((size_t)index >= m_quotePairs.size())
+        return m_quotePairs.last().first;
+    return m_quotePairs.at(index).first;
 }
 
-QuotesData::~QuotesData()
+const String QuotesData::getCloseQuote(int index) const
 {
-    String* p = data();
-    for (int i = 0; i < length; ++i)
-        p[i].~String();
+    ASSERT(index >= 0);
+    if (!m_quotePairs.size())
+        return emptyString();
+    if ((size_t)index >= m_quotePairs.size())
+        return m_quotePairs.last().second;
+    return m_quotePairs.at(index).second;
+}
+
+bool QuotesData::equals(const QuotesData* a, const QuotesData* b)
+{
+    if (a == b)
+        return true;
+    if (!a || !b)
+        return false;
+    return a->m_quotePairs == b->m_quotePairs;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/style/QuotesData.h b/Source/WebCore/rendering/style/QuotesData.h
index f817996f0..5699f3245 100644
--- a/Source/WebCore/rendering/style/QuotesData.h
+++ b/Source/WebCore/rendering/style/QuotesData.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2011 Nokia Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,24 +22,32 @@
 #ifndef QuotesData_h
 #define QuotesData_h
 
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
 class QuotesData : public RefCounted<QuotesData> {
 public:
-    virtual ~QuotesData();
-    static QuotesData* create(int stringCount);
-    String* data() { return reinterpret_cast<String*>(this+1); }
-    const String* data() const { return reinterpret_cast<const String*>(this+1); }
-    int length;
-    void operator delete(void* p) { delete[] static_cast<char*>(p); }
-    static bool equal(const QuotesData*, const QuotesData*);
+    static PassRefPtr<QuotesData> create() { return adoptRef(new QuotesData()); }
+    static PassRefPtr<QuotesData> create(const String open, const String close);
+    static PassRefPtr<QuotesData> create(const String open1, const String close1, const String open2, const String close2);
+
+    // FIXME: this should be an operator==.
+    static bool equals(const QuotesData*, const QuotesData*);
+
+    void addPair(const std::pair<String, String> quotePair);
+    const String getOpenQuote(int index) const;
+    const String getCloseQuote(int index) const;
+
 private:
-    QuotesData(int stringCount) : length(stringCount) {}
+    QuotesData() { }
+
+    Vector<std::pair<String, String> > m_quotePairs;
 };
 
-}
+} // namespace WebCore
+
 #endif // QuotesData_h
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index 8e5a90e8c..2303ffa04 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -28,6 +28,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSWrapShapes.h"
 #include "FontSelector.h"
+#include "MemoryInstrumentation.h"
 #include "QuotesData.h"
 #include "RenderArena.h"
 #include "RenderObject.h"
@@ -444,7 +445,7 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
         }
 #endif
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
         // If regions change, trigger a relayout to re-calc regions.
         if (rareNonInheritedData->m_dashboardRegions != other->rareNonInheritedData->m_dashboardRegions)
             return StyleDifferenceLayout;
@@ -579,6 +580,9 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
         return StyleDifferenceLayout;
     }
 
+    if (!QuotesData::equals(rareInheritedData->quotes.get(), other->rareInheritedData->quotes.get()))
+        return StyleDifferenceLayout;
+
 #if ENABLE(SVG)
     // SVGRenderStyle::diff() might have returned StyleDifferenceRepaint, eg. if fill changes.
     // If eg. the font-size changed at the same time, we're not allowed to return StyleDifferenceRepaint,
@@ -700,7 +704,7 @@ void RenderStyle::setCursorList(PassRefPtr<CursorList> other)
 
 void RenderStyle::setQuotes(PassRefPtr<QuotesData> q)
 {
-    if (QuotesData::equal(rareInheritedData->quotes.get(), q.get()))
+    if (QuotesData::equals(rareInheritedData->quotes.get(), q.get()))
         return;
     rareInheritedData.access()->quotes = q;
 }
@@ -1049,7 +1053,7 @@ const AtomicString& RenderStyle::textEmphasisMarkString() const
     return nullAtom;
 }
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 const Vector<StyleDashboardRegion>& RenderStyle::initialDashboardRegions()
 {
     DEFINE_STATIC_LOCAL(Vector<StyleDashboardRegion>, emptyList, ());
@@ -1486,4 +1490,24 @@ LayoutBoxExtent RenderStyle::imageOutsets(const NinePieceImage& image) const
                            NinePieceImage::computeOutset(image.outset().left(), borderLeftWidth()));
 }
 
+void RenderStyle::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_box);
+    info.addMember(visual);
+    // FIXME: m_background contains RefPtr<StyleImage> that might need to be instrumented.
+    info.addMember(m_background);
+    // FIXME: surrond contains some fields e.g. BorderData that might need to be instrumented.
+    info.addMember(surround);
+    info.addInstrumentedMember(rareNonInheritedData);
+    info.addInstrumentedMember(rareInheritedData);
+    // FIXME: inherited contains StyleImage and Font fields that might need to be instrumented.
+    info.addMember(inherited);
+    if (m_cachedPseudoStyles)
+        info.addVectorPtr(m_cachedPseudoStyles.get());
+#if ENABLE(SVG)
+    info.addMember(m_svgStyle);
+#endif
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index d56d2d3c1..5c0bd5dcf 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -78,7 +78,7 @@
 #include "StyleFilterData.h"
 #endif
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 #include "StyleDashboardRegion.h"
 #endif
 
@@ -105,6 +105,7 @@ class BorderData;
 class CounterContent;
 class CursorList;
 class IntRect;
+class MemoryObjectInfo;
 class Pair;
 class ShadowData;
 class StyleImage;
@@ -798,7 +799,7 @@ public:
     EBoxOrient boxOrient() const { return static_cast<EBoxOrient>(rareNonInheritedData->m_deprecatedFlexibleBox->orient); }
     EBoxPack boxPack() const { return static_cast<EBoxPack>(rareNonInheritedData->m_deprecatedFlexibleBox->pack); }
 
-    float order() const { return rareNonInheritedData->m_order; }
+    int order() const { return rareNonInheritedData->m_order; }
     float flexGrow() const { return rareNonInheritedData->m_flexibleBox->m_flexGrow; }
     float flexShrink() const { return rareNonInheritedData->m_flexibleBox->m_flexShrink; }
     Length flexBasis() const { return rareNonInheritedData->m_flexibleBox->m_flexBasis; }
@@ -1011,7 +1012,7 @@ public:
     void setMinHeight(Length v) { SET_VAR(m_box, m_minHeight, v) }
     void setMaxHeight(Length v) { SET_VAR(m_box, m_maxHeight, v) }
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     Vector<StyleDashboardRegion> dashboardRegions() const { return rareNonInheritedData->m_dashboardRegions; }
     void setDashboardRegions(Vector<StyleDashboardRegion> regions) { SET_VAR(rareNonInheritedData, m_dashboardRegions, regions); }
 
@@ -1268,7 +1269,7 @@ public:
     void setFlexGrow(float f) { SET_VAR(rareNonInheritedData.access()->m_flexibleBox, m_flexGrow, f); }
     void setFlexShrink(float f) { SET_VAR(rareNonInheritedData.access()->m_flexibleBox, m_flexShrink, f); }
     void setFlexBasis(Length length) { SET_VAR(rareNonInheritedData.access()->m_flexibleBox, m_flexBasis, length); }
-    void setOrder(float o) { SET_VAR(rareNonInheritedData, m_order, o); }
+    void setOrder(int o) { SET_VAR(rareNonInheritedData, m_order, o); }
     void setAlignContent(EAlignContent p) { SET_VAR(rareNonInheritedData, m_alignContent, p); }
     void setAlignItems(EAlignItems a) { SET_VAR(rareNonInheritedData, m_alignItems, a); }
     void setAlignSelf(EAlignItems a) { SET_VAR(rareNonInheritedData, m_alignSelf, a); }
@@ -1483,22 +1484,9 @@ public:
 
     StyleDifference diff(const RenderStyle*, unsigned& changedContextSensitiveProperties) const;
 
-    bool isDisplayReplacedType() const
-    {
-        return display() == INLINE_BLOCK || display() == INLINE_BOX || display() == INLINE_TABLE || display() == INLINE_GRID;
-    }
-
-    bool isDisplayInlineType() const
-    {
-        return display() == INLINE || isDisplayReplacedType();
-    }
-
-    bool isOriginalDisplayInlineType() const
-    {
-        return originalDisplay() == INLINE || originalDisplay() == INLINE_BLOCK
-            || originalDisplay() == INLINE_BOX || originalDisplay() == INLINE_TABLE || originalDisplay() == INLINE_GRID;
-    }
-
+    bool isDisplayReplacedType() const { return isDisplayReplacedType(display()); }
+    bool isDisplayInlineType() const { return isDisplayInlineType(display()); }
+    bool isOriginalDisplayInlineType() const { return isDisplayInlineType(originalDisplay()); }
     bool isDisplayRegionType() const
     {
         return display() == BLOCK || display() == INLINE_BLOCK
@@ -1541,6 +1529,8 @@ public:
 
     void setHasExplicitlyInheritedProperties() { m_bitfields.setExplicitInheritance(true); }
     bool hasExplicitlyInheritedProperties() const { return m_bitfields.explicitInheritance(); }
+
+    void reportMemoryUsage(MemoryObjectInfo*) const;
     
     // Initial values for all the properties
     static EBorderCollapse initialBorderCollapse() { return BSEPARATE; }
@@ -1610,7 +1600,7 @@ public:
     static float initialFlexGrow() { return 0; }
     static float initialFlexShrink() { return 1; }
     static Length initialFlexBasis() { return Length(Auto); }
-    static float initialOrder() { return 0; }
+    static int initialOrder() { return 0; }
     static EAlignContent initialAlignContent() { return AlignContentStretch; }
     static EAlignItems initialAlignItems() { return AlignStretch; }
     static EAlignItems initialAlignSelf() { return AlignAuto; }
@@ -1715,7 +1705,7 @@ public:
 #if ENABLE(OVERFLOW_SCROLLING)
     static bool initialUseTouchOverflowScrolling() { return false; }
 #endif
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     static const Vector<StyleDashboardRegion>& initialDashboardRegions();
     static const Vector<StyleDashboardRegion>& noneDashboardRegions();
 #endif
@@ -1748,6 +1738,20 @@ private:
         return isHorizontalWritingMode() ? getShadowVerticalExtent(shadow, logicalTop, logicalBottom) : getShadowHorizontalExtent(shadow, logicalTop, logicalBottom);
     }
 
+    bool isDisplayReplacedType(EDisplay display) const
+    {
+        return display == INLINE_BLOCK || display == INLINE_BOX
+#if ENABLE(CSS3_FLEXBOX)
+            || display == INLINE_FLEX
+#endif
+            || display == INLINE_TABLE || display == INLINE_GRID;
+    }
+
+    bool isDisplayInlineType(EDisplay display) const
+    {
+        return display == INLINE || isDisplayReplacedType(display);
+    }
+
     // Color accessors are all private to make sure callers use visitedDependentColor instead to access them.
     Color invalidColor() const { static Color invalid; return invalid; }
     Color borderLeftColor() const { return surround->border.left().color(); }
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index 149cd4471..f71934a3c 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -198,7 +198,7 @@ enum EUserDrag {
 // CSS3 User Select Values
 
 enum EUserSelect {
-    SELECT_NONE, SELECT_TEXT
+    SELECT_NONE, SELECT_TEXT, SELECT_ALL
 };
 
 // Word Break Values. Matches WinIE, rather than CSS3
diff --git a/Source/WebCore/rendering/style/StyleCachedImage.cpp b/Source/WebCore/rendering/style/StyleCachedImage.cpp
index 2e3abb943..4e353e99a 100644
--- a/Source/WebCore/rendering/style/StyleCachedImage.cpp
+++ b/Source/WebCore/rendering/style/StyleCachedImage.cpp
@@ -24,6 +24,7 @@
 #include "config.h"
 #include "StyleCachedImage.h"
 
+#include "CachedImage.h"
 #include "RenderObject.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/rendering/style/StyleCachedImage.h b/Source/WebCore/rendering/style/StyleCachedImage.h
index c9913fd82..0943b0e67 100644
--- a/Source/WebCore/rendering/style/StyleCachedImage.h
+++ b/Source/WebCore/rendering/style/StyleCachedImage.h
@@ -24,12 +24,14 @@
 #ifndef StyleCachedImage_h
 #define StyleCachedImage_h
 
-#include "CachedImage.h"
+#include "CachedImageClient.h"
 #include "CachedResourceHandle.h"
 #include "StyleImage.h"
 
 namespace WebCore {
 
+class CachedImage;
+
 class StyleCachedImage : public StyleImage, private CachedImageClient {
     WTF_MAKE_FAST_ALLOCATED;
 public:
diff --git a/Source/WebCore/rendering/style/StyleCachedImageSet.h b/Source/WebCore/rendering/style/StyleCachedImageSet.h
index d35947fb3..7e7cafcd2 100644
--- a/Source/WebCore/rendering/style/StyleCachedImageSet.h
+++ b/Source/WebCore/rendering/style/StyleCachedImageSet.h
@@ -28,7 +28,7 @@
 
 #if ENABLE(CSS_IMAGE_SET)
 
-#include "CachedImage.h"
+#include "CachedImageClient.h"
 #include "CachedResourceHandle.h"
 #include "StyleImage.h"
 
diff --git a/Source/WebCore/rendering/style/StyleCustomFilterProgram.h b/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
index bff09a98c..1cbe01d35 100644
--- a/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
+++ b/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
@@ -45,9 +45,9 @@ namespace WebCore {
 class StyleCustomFilterProgram : public CustomFilterProgram, public CachedResourceClient {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassRefPtr<StyleCustomFilterProgram> create(PassRefPtr<StyleShader> vertexShader, PassRefPtr<StyleShader> fragmentShader)
+    static PassRefPtr<StyleCustomFilterProgram> create(PassRefPtr<StyleShader> vertexShader, PassRefPtr<StyleShader> fragmentShader, CustomFilterProgramMixSettings mixSettings)
     {
-        return adoptRef(new StyleCustomFilterProgram(vertexShader, fragmentShader));
+        return adoptRef(new StyleCustomFilterProgram(vertexShader, fragmentShader, mixSettings));
     }
     
     void setVertexShader(PassRefPtr<StyleShader> shader) { m_vertexShader = shader; }
@@ -106,9 +106,10 @@ public:
     {
         if (resource->errorOccurred())
             return;
+        // Note that m_cachedVertexShader might be equal to m_cachedFragmentShader and it would only get one event in that case.
         if (resource == m_cachedVertexShader.get())
             m_isVertexShaderLoaded = true;
-        else if (resource == m_cachedFragmentShader.get())
+        if (resource == m_cachedFragmentShader.get())
             m_isFragmentShaderLoaded = true;
         if (isLoaded())
             notifyClients();
@@ -125,8 +126,9 @@ public:
     }
 
 private:
-    StyleCustomFilterProgram(PassRefPtr<StyleShader> vertexShader, PassRefPtr<StyleShader> fragmentShader)
-        : m_vertexShader(vertexShader)
+    StyleCustomFilterProgram(PassRefPtr<StyleShader> vertexShader, PassRefPtr<StyleShader> fragmentShader, CustomFilterProgramMixSettings mixSettings)
+        : CustomFilterProgram(mixSettings)
+        , m_vertexShader(vertexShader)
         , m_fragmentShader(fragmentShader)
         , m_isVertexShaderLoaded(false)
         , m_isFragmentShaderLoaded(false)
diff --git a/Source/WebCore/rendering/style/StyleDashboardRegion.h b/Source/WebCore/rendering/style/StyleDashboardRegion.h
index bbb0cda0c..552fdeb82 100644
--- a/Source/WebCore/rendering/style/StyleDashboardRegion.h
+++ b/Source/WebCore/rendering/style/StyleDashboardRegion.h
@@ -24,7 +24,7 @@
 
 #ifndef StyleDashboardRegion_h
 #define StyleDashboardRegion_h
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 
 #include "LengthBox.h"
 #include "PlatformString.h"
@@ -57,5 +57,5 @@ struct StyleDashboardRegion {
 
 } // namespace WebCore
 
-#endif // ENABLE(DASHBOARD_SUPPORT)
+#endif // ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 #endif // StyleDashboardRegion_h
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
index 97de42d3c..14cb67d88 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -23,6 +23,7 @@
 #include "StyleRareInheritedData.h"
 
 #include "CursorList.h"
+#include "MemoryInstrumentation.h"
 #include "QuotesData.h"
 #include "RenderStyle.h"
 #include "RenderStyleConstants.h"
@@ -233,7 +234,7 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && hyphenationString == o.hyphenationString
         && locale == o.locale
         && textEmphasisCustomMark == o.textEmphasisCustomMark
-        && QuotesData::equal(quotes.get(), o.quotes.get())
+        && QuotesData::equals(quotes.get(), o.quotes.get())
         && m_tabSize == o.m_tabSize
         && m_lineGrid == o.m_lineGrid
 #if ENABLE(CSS_IMAGE_ORIENTATION)
@@ -261,4 +262,20 @@ bool StyleRareInheritedData::shadowDataEquivalent(const StyleRareInheritedData&
     return true;
 }
 
+void StyleRareInheritedData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(textShadow);
+    info.addMember(highlight);
+    info.addMember(cursorData);
+    info.addMember(hyphenationString);
+    info.addMember(locale);
+    info.addMember(textEmphasisCustomMark);
+    info.addMember(quotes);
+    info.addMember(m_lineGrid);
+#if ENABLE(CSS_VARIABLES)
+    info.addMember(m_variables);
+#endif
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.h b/Source/WebCore/rendering/style/StyleRareInheritedData.h
index b30982df9..39e096ea4 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.h
@@ -39,6 +39,7 @@
 namespace WebCore {
 
 class CursorList;
+class MemoryObjectInfo;
 class QuotesData;
 class ShadowData;
 
@@ -58,6 +59,8 @@ public:
     }
     bool shadowDataEquivalent(const StyleRareInheritedData&) const;
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
     Color textStrokeColor;
     float textStrokeWidth;
     Color textFillColor;
@@ -86,7 +89,7 @@ public:
     unsigned khtmlLineBreak : 1; // EKHTMLLineBreak
     unsigned textSizeAdjust : 1; // An Apple extension.
     unsigned resize : 2; // EResize
-    unsigned userSelect : 1;  // EUserSelect
+    unsigned userSelect : 2; // EUserSelect
     unsigned colorSpace : 1; // ColorSpace
     unsigned speak : 3; // ESpeak
     unsigned hyphens : 2; // Hyphens
diff --git a/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
index 22b3272e8..8d57922e3 100644
--- a/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
@@ -23,6 +23,7 @@
 #include "StyleRareNonInheritedData.h"
 
 #include "ContentData.h"
+#include "MemoryInstrumentation.h"
 #include "RenderCounter.h"
 #include "RenderStyle.h"
 #include "ShadowData.h"
@@ -166,7 +167,7 @@ bool StyleRareNonInheritedData::operator==(const StyleRareNonInheritedData& o) c
         && m_perspectiveOriginX == o.m_perspectiveOriginX
         && m_perspectiveOriginY == o.m_perspectiveOriginY
         && lineClamp == o.lineClamp
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
         && m_dashboardRegions == o.m_dashboardRegions
 #endif
         && m_deprecatedFlexibleBox == o.m_deprecatedFlexibleBox
@@ -286,4 +287,32 @@ bool StyleRareNonInheritedData::transitionDataEquivalent(const StyleRareNonInher
     return true;
 }
 
+void StyleRareNonInheritedData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+#if ENABLE(DASHBOARD_SUPPORT)
+    info.addVector(m_dashboardRegions);
+#endif
+    info.addMember(m_deprecatedFlexibleBox);
+    info.addMember(m_flexibleBox);
+    info.addMember(m_marquee);
+    info.addMember(m_multiCol);
+    info.addMember(m_transform);
+#if ENABLE(CSS_FILTERS)
+    info.addMember(m_filter);
+#endif
+    info.addMember(m_grid);
+    info.addMember(m_gridItem);
+    info.addMember(m_content);
+    info.addMember(m_counterDirectives);
+    info.addMember(m_boxShadow);
+    info.addMember(m_boxReflect);
+    info.addMember(m_animations);
+    info.addMember(m_transitions);
+    info.addMember(m_wrapShapeInside);
+    info.addMember(m_wrapShapeOutside);
+    info.addMember(m_flowThread);
+    info.addMember(m_regionThread);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
index 5e6fde2a6..a206015ec 100644
--- a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
@@ -39,6 +39,7 @@
 namespace WebCore {
 
 class AnimationList;
+class MemoryObjectInfo;
 class ShadowData;
 class StyleDeprecatedFlexibleBoxData;
 #if ENABLE(CSS_FILTERS)
@@ -56,7 +57,7 @@ class StyleTransformData;
 class ContentData;
 struct LengthSize;
 
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
 struct StyleDashboardRegion;
 #endif
 
@@ -89,6 +90,8 @@ public:
     bool animationDataEquivalent(const StyleRareNonInheritedData&) const;
     bool transitionDataEquivalent(const StyleRareNonInheritedData&) const;
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
     float opacity; // Whether or not we're transparent.
 
     float m_aspectRatioDenominator;
@@ -102,7 +105,7 @@ public:
     Length m_perspectiveOriginY;
 
     LineClampValue lineClamp; // An Apple extension.
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(WIDGET_REGION)
     Vector<StyleDashboardRegion> m_dashboardRegions;
 #endif
 
@@ -146,7 +149,7 @@ public:
     Color m_visitedLinkBorderTopColor;
     Color m_visitedLinkBorderBottomColor;
 
-    float m_order;
+    int m_order;
 
     AtomicString m_flowThread;
     AtomicString m_regionThread;
diff --git a/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp b/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
index d66056615..0a975f415 100644
--- a/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
@@ -190,7 +190,7 @@ bool RenderSVGForeignObject::nodeAtPoint(const HitTestRequest&, HitTestResult&,
     return false;
 }
 
-void RenderSVGForeignObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool /* fixed */, bool /* useTransforms */, TransformState& transformState, ApplyContainerFlipOrNot, bool* wasFixed) const
+void RenderSVGForeignObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState& transformState, MapLocalToContainerFlags, bool* wasFixed) const
 {
     SVGRenderSupport::mapLocalToContainer(this, repaintContainer, transformState, wasFixed);
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGForeignObject.h b/Source/WebCore/rendering/svg/RenderSVGForeignObject.h
index 80ddfd630..7da36eac6 100644
--- a/Source/WebCore/rendering/svg/RenderSVGForeignObject.h
+++ b/Source/WebCore/rendering/svg/RenderSVGForeignObject.h
@@ -54,7 +54,7 @@ public:
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
     virtual bool isSVGForeignObject() const { return true; }
 
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState&, ApplyContainerFlipOrNot = ApplyContainerFlip, bool* wasFixed = 0) const;
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState&, MapLocalToContainerFlags mode = ApplyContainerFlip, bool* wasFixed = 0) const OVERRIDE;
     virtual const RenderObject* pushMappingToContainer(const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap&) const;
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGInline.cpp b/Source/WebCore/rendering/svg/RenderSVGInline.cpp
index 057bfda00..2c6312eeb 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInline.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGInline.cpp
@@ -79,7 +79,7 @@ void RenderSVGInline::computeFloatRectForRepaint(RenderBoxModelObject* repaintCo
     SVGRenderSupport::computeFloatRectForRepaint(this, repaintContainer, repaintRect, fixed);
 }
 
-void RenderSVGInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool /* useTransforms */, bool /* fixed */, TransformState& transformState, ApplyContainerFlipOrNot, bool* wasFixed) const
+void RenderSVGInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState& transformState, MapLocalToContainerFlags, bool* wasFixed) const
 {
     SVGRenderSupport::mapLocalToContainer(this, repaintContainer, transformState, wasFixed);
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGInline.h b/Source/WebCore/rendering/svg/RenderSVGInline.h
index 533a99aa6..3dc7dda80 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInline.h
+++ b/Source/WebCore/rendering/svg/RenderSVGInline.h
@@ -47,7 +47,7 @@ public:
 
     virtual LayoutRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const;
     virtual void computeFloatRectForRepaint(RenderBoxModelObject* repaintContainer, FloatRect&, bool fixed = false) const;
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&, ApplyContainerFlipOrNot = ApplyContainerFlip, bool* wasFixed = 0) const;
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState&, MapLocalToContainerFlags mode = ApplyContainerFlip, bool* wasFixed = 0) const OVERRIDE;
     virtual const RenderObject* pushMappingToContainer(const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap&) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp b/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
index 18e7ecace..7314179c8 100644
--- a/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
@@ -55,7 +55,7 @@ void RenderSVGModelObject::computeFloatRectForRepaint(RenderBoxModelObject* repa
     SVGRenderSupport::computeFloatRectForRepaint(this, repaintContainer, repaintRect, fixed);
 }
 
-void RenderSVGModelObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool /* fixed */, bool /* useTransforms */, TransformState& transformState, ApplyContainerFlipOrNot, bool* wasFixed) const
+void RenderSVGModelObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState& transformState, MapLocalToContainerFlags, bool* wasFixed) const
 {
     SVGRenderSupport::mapLocalToContainer(this, repaintContainer, transformState, wasFixed);
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGModelObject.h b/Source/WebCore/rendering/svg/RenderSVGModelObject.h
index 0d8192609..b4c3f68aa 100644
--- a/Source/WebCore/rendering/svg/RenderSVGModelObject.h
+++ b/Source/WebCore/rendering/svg/RenderSVGModelObject.h
@@ -58,7 +58,7 @@ public:
     virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
 
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&, ApplyContainerFlipOrNot = ApplyContainerFlip, bool* wasFixed = 0) const;
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState&, MapLocalToContainerFlags mode = ApplyContainerFlip, bool* wasFixed = 0) const OVERRIDE;
     virtual const RenderObject* pushMappingToContainer(const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap&) const;
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
index 707da886e..5d56b5ce7 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
@@ -395,12 +395,12 @@ void RenderSVGRoot::computeFloatRectForRepaint(RenderBoxModelObject* repaintCont
 // This method expects local CSS box coordinates.
 // Callers with local SVG viewport coordinates should first apply the localToBorderBoxTransform
 // to convert from SVG viewport coordinates to local CSS box coordinates.
-void RenderSVGRoot::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState, ApplyContainerFlipOrNot, bool* wasFixed) const
+void RenderSVGRoot::mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState& transformState, MapLocalToContainerFlags mode, bool* wasFixed) const
 {
-    ASSERT(!fixed); // We should have no fixed content in the SVG rendering tree.
-    ASSERT(useTransforms); // mapping a point through SVG w/o respecting trasnforms is useless.
+    ASSERT(mode & ~IsFixed); // We should have no fixed content in the SVG rendering tree.
+    ASSERT(mode & UseTransforms); // mapping a point through SVG w/o respecting trasnforms is useless.
 
-    RenderReplaced::mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState, ApplyContainerFlip, wasFixed);
+    RenderReplaced::mapLocalToContainer(repaintContainer, transformState, mode | ApplyContainerFlip, wasFixed);
 }
 
 const RenderObject* RenderSVGRoot::pushMappingToContainer(const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap& geometryMap) const
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.h b/Source/WebCore/rendering/svg/RenderSVGRoot.h
index 9aa7e7c18..3e2f3c70d 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.h
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.h
@@ -95,7 +95,7 @@ private:
     virtual LayoutRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const;
     virtual void computeFloatRectForRepaint(RenderBoxModelObject* repaintContainer, FloatRect& repaintRect, bool fixed) const;
 
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&, ApplyContainerFlipOrNot = ApplyContainerFlip, bool* wasFixed = 0) const;
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState&, MapLocalToContainerFlags mode = ApplyContainerFlip, bool* wasFixed = 0) const OVERRIDE;
     virtual const RenderObject* pushMappingToContainer(const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap&) const;
 
     virtual bool canBeSelectionLeaf() const { return false; }
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.cpp b/Source/WebCore/rendering/svg/RenderSVGText.cpp
index d30ba1cd6..398babe03 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGText.cpp
@@ -111,7 +111,7 @@ void RenderSVGText::computeFloatRectForRepaint(RenderBoxModelObject* repaintCont
     SVGRenderSupport::computeFloatRectForRepaint(this, repaintContainer, repaintRect, fixed);
 }
 
-void RenderSVGText::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool /* fixed */, bool /* useTransforms */, TransformState& transformState, ApplyContainerFlipOrNot, bool* wasFixed) const
+void RenderSVGText::mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState& transformState, MapLocalToContainerFlags, bool* wasFixed) const
 {
     SVGRenderSupport::mapLocalToContainer(this, repaintContainer, transformState, wasFixed);
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.h b/Source/WebCore/rendering/svg/RenderSVGText.h
index 93cb64f8f..ee2dbda23 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGText.h
@@ -75,7 +75,7 @@ private:
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, LayoutRect&, bool fixed = false) const;
     virtual void computeFloatRectForRepaint(RenderBoxModelObject* repaintContainer, FloatRect&, bool fixed = false) const;
 
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&, ApplyContainerFlipOrNot = ApplyContainerFlip, bool* wasFixed = 0) const;
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, TransformState&, MapLocalToContainerFlags mode = ApplyContainerFlip, bool* wasFixed = 0) const OVERRIDE;
     virtual const RenderObject* pushMappingToContainer(const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap&) const;
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject*) OVERRIDE;
diff --git a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
index 0bfb0a527..d88371429 100644
--- a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
+++ b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
@@ -83,7 +83,7 @@ void SVGRenderSupport::mapLocalToContainer(const RenderObject* object, RenderBox
     if (parent->isSVGRoot())
         transformState.applyTransform(toRenderSVGRoot(parent)->localToBorderBoxTransform());
     
-    parent->mapLocalToContainer(repaintContainer, false, true, transformState, RenderObject::DoNotApplyContainerFlip, wasFixed);
+    parent->mapLocalToContainer(repaintContainer, transformState, UseTransforms, wasFixed);
 }
 
 const RenderObject* SVGRenderSupport::pushMappingToContainer(const RenderObject* object, const RenderBoxModelObject* ancestorToStopAt, RenderGeometryMap& geometryMap)
@@ -207,6 +207,7 @@ void SVGRenderSupport::layoutChildren(RenderObject* start, bool selfNeedsLayout)
 
     for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) {
         bool needsLayout = selfNeedsLayout;
+        bool childEverHadLayout = child->everHadLayout();
 
         if (transformChanged) {
             // If the transform changed we need to update the text metrics (note: this also happens for layoutSizeChanged=true).
@@ -232,15 +233,19 @@ void SVGRenderSupport::layoutChildren(RenderObject* start, bool selfNeedsLayout)
             }
         }
 
-        if (needsLayout) {
+        if (needsLayout)
             child->setNeedsLayout(true, MarkOnlyThis);
+
+        if (child->needsLayout()) {
             child->layout();
-        } else {
-            if (child->needsLayout())
-                child->layout();
-            else if (layoutSizeChanged)
-                notlayoutedObjects.add(child);
-        }
+            // Renderers are responsible for repainting themselves when changing, except
+            // for the initial paint to avoid potential double-painting caused by non-sensical "old" bounds.
+            // We could handle this in the individual objects, but for now it's easier to have
+            // parent containers call repaint().  (RenderBlock::layout* has similar logic.)
+            if (!childEverHadLayout)
+                child->repaint();
+        } else if (layoutSizeChanged)
+            notlayoutedObjects.add(child);
 
         ASSERT(!child->needsLayout());
     }
diff --git a/Source/WebCore/storage/StorageArea.h b/Source/WebCore/storage/StorageArea.h
index 3b2492a67..2ea911725 100644
--- a/Source/WebCore/storage/StorageArea.h
+++ b/Source/WebCore/storage/StorageArea.h
@@ -56,6 +56,8 @@ namespace WebCore {
 
         virtual bool disabledByPrivateBrowsingInFrame(const Frame* sourceFrame) const = 0;
 
+        virtual size_t memoryBytesUsedByCache() const = 0;
+
         virtual void incrementAccessCount() { }
         virtual void decrementAccessCount() { }
     };
diff --git a/Source/WebCore/storage/StorageAreaImpl.cpp b/Source/WebCore/storage/StorageAreaImpl.cpp
index 694a97a6b..37c4f596c 100644
--- a/Source/WebCore/storage/StorageAreaImpl.cpp
+++ b/Source/WebCore/storage/StorageAreaImpl.cpp
@@ -264,6 +264,11 @@ void StorageAreaImpl::blockUntilImportComplete() const
         m_storageAreaSync->blockUntilImportComplete();
 }
 
+size_t StorageAreaImpl::memoryBytesUsedByCache() const
+{
+    return 0;
+}
+
 void StorageAreaImpl::incrementAccessCount()
 {
     m_accessCount++;
diff --git a/Source/WebCore/storage/StorageAreaImpl.h b/Source/WebCore/storage/StorageAreaImpl.h
index 4c90e5bc0..1f2b7e080 100644
--- a/Source/WebCore/storage/StorageAreaImpl.h
+++ b/Source/WebCore/storage/StorageAreaImpl.h
@@ -54,6 +54,8 @@ namespace WebCore {
 
         virtual bool disabledByPrivateBrowsingInFrame(const Frame* sourceFrame) const;
 
+        virtual size_t memoryBytesUsedByCache() const;
+
         virtual void incrementAccessCount();
         virtual void decrementAccessCount();
 
diff --git a/Source/WebCore/svg/SVGAElement.cpp b/Source/WebCore/svg/SVGAElement.cpp
index a714d7287..849a839be 100644
--- a/Source/WebCore/svg/SVGAElement.cpp
+++ b/Source/WebCore/svg/SVGAElement.cpp
@@ -175,19 +175,15 @@ void SVGAElement::defaultEventHandler(Event* event)
                     return;
             }
 
-            // FIXME: Why does the SVG anchor element have this special logic
-            // for middle click that the HTML anchor element does not have?
-            // Making a middle click open a link in a new window or tab is
-            // properly handled at the client level, not inside WebKit; this
-            // code should be deleted.
-            String target = isMiddleMouseButtonEvent(event) ? "_blank" : this->target();
-
-            // FIXME: It's not clear why setting target to "_self" is ever
-            // helpful.
-            if (target.isEmpty())
-                target = (fastGetAttribute(XLinkNames::showAttr) == "new") ? "_blank" : "_self";
-
-            handleLinkClick(event, document(), url, target);
+            String target = this->target();
+            if (target.isEmpty() && fastGetAttribute(XLinkNames::showAttr) == "new")
+                target = "_blank";
+            event->setDefaultHandled();
+
+            Frame* frame = document()->frame();
+            if (!frame)
+                return;
+            frame->loader()->urlSelected(document()->completeURL(url), target, event, false, false, MaybeSendReferrer);
             return;
         }
     }
diff --git a/Source/WebCore/svg/SVGColor.cpp b/Source/WebCore/svg/SVGColor.cpp
index 2572b7bbf..25192e170 100644
--- a/Source/WebCore/svg/SVGColor.cpp
+++ b/Source/WebCore/svg/SVGColor.cpp
@@ -25,6 +25,7 @@
 #include "SVGColor.h"
 
 #include "CSSParser.h"
+#include "MemoryInstrumentation.h"
 #include "RGBColor.h"
 #include "SVGException.h"
 
@@ -104,6 +105,11 @@ PassRefPtr<SVGColor> SVGColor::cloneForCSSOM() const
     return adoptRef(new SVGColor(SVGColorClass, *this));
 }
 
+void SVGColor::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGColor.h b/Source/WebCore/svg/SVGColor.h
index cffac5385..7dddcd7a9 100644
--- a/Source/WebCore/svg/SVGColor.h
+++ b/Source/WebCore/svg/SVGColor.h
@@ -75,6 +75,8 @@ public:
     
     PassRefPtr<SVGColor> cloneForCSSOM() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
     friend class CSSComputedStyleDeclaration;
 
diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
index c80b257da..1c09c619b 100644
--- a/Source/WebCore/svg/SVGElement.cpp
+++ b/Source/WebCore/svg/SVGElement.cpp
@@ -477,6 +477,22 @@ void SVGElement::sendSVGLoadEventIfPossible(bool sendParentLoadEvents)
     }
 }
 
+void SVGElement::sendSVGLoadEventIfPossibleAsynchronously()
+{
+    svgLoadEventTimer()->startOneShot(0);
+}
+
+void SVGElement::svgLoadEventTimerFired(Timer<SVGElement>*)
+{
+    sendSVGLoadEventIfPossible();
+}
+
+Timer<SVGElement>* SVGElement::svgLoadEventTimer()
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 void SVGElement::finishParsingChildren()
 {
     StyledElement::finishParsingChildren();
diff --git a/Source/WebCore/svg/SVGElement.h b/Source/WebCore/svg/SVGElement.h
index 470235aef..900b61454 100644
--- a/Source/WebCore/svg/SVGElement.h
+++ b/Source/WebCore/svg/SVGElement.h
@@ -27,6 +27,7 @@
 #include "SVGParsingError.h"
 #include "SVGPropertyInfo.h"
 #include "StyledElement.h"
+#include "Timer.h"
 #include <wtf/HashMap.h>
 
 namespace WebCore {
@@ -72,6 +73,9 @@ public:
     virtual void animatedPropertyTypeForAttribute(const QualifiedName&, Vector<AnimatedPropertyType>&);
 
     void sendSVGLoadEventIfPossible(bool sendParentLoadEvents = false);
+    void sendSVGLoadEventIfPossibleAsynchronously();
+    void svgLoadEventTimerFired(Timer<SVGElement>*);
+    virtual Timer<SVGElement>* svgLoadEventTimer();
 
     virtual AffineTransform* supplementalTransform() { return 0; }
 
diff --git a/Source/WebCore/svg/SVGElementInstance.h b/Source/WebCore/svg/SVGElementInstance.h
index 1c89c7ccd..f8e489b6b 100644
--- a/Source/WebCore/svg/SVGElementInstance.h
+++ b/Source/WebCore/svg/SVGElementInstance.h
@@ -38,7 +38,7 @@ class SVGElementInstanceList;
 class SVGStyledElement;
 
 // SVGElementInstance mimics Node, but without providing all its functionality
-class SVGElementInstance : public TreeShared<SVGElementInstance, SVGElementInstance>, public EventTarget {
+class SVGElementInstance : public EventTarget, public TreeShared<SVGElementInstance, SVGElementInstance> {
 public:
     static PassRefPtr<SVGElementInstance> create(SVGUseElement* correspondingUseElement, SVGUseElement* directUseElement, PassRefPtr<SVGElement> originalElement)
     {
diff --git a/Source/WebCore/svg/SVGElementInstance.idl b/Source/WebCore/svg/SVGElementInstance.idl
index 9c7175c7b..db081b966 100644
--- a/Source/WebCore/svg/SVGElementInstance.idl
+++ b/Source/WebCore/svg/SVGElementInstance.idl
@@ -29,10 +29,13 @@ module svg {
     interface [
         Conditional=SVG,
         JSCustomMarkFunction,
-        JSGenerateToNativeObject
+        JSGenerateToNativeObject,
+        JSGenerateToJSObject
     ] SVGElementInstance
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         : Object, EventTarget
+#else
+        : EventTarget
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
     {
         readonly attribute SVGElement correspondingElement;
@@ -86,15 +89,6 @@ module svg {
         attribute [NotEnumerable] EventListener onselectstart;
         attribute [NotEnumerable] EventListener onsubmit;
         attribute [NotEnumerable] EventListener onunload;
-
-        void addEventListener(in DOMString type, 
-                              in EventListener listener, 
-                              in [Optional] boolean useCapture);
-        void removeEventListener(in DOMString type, 
-                                 in EventListener listener, 
-                                 in [Optional] boolean useCapture);
-        boolean dispatchEvent(in Event event)
-            raises(EventException);
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
     };
 }
diff --git a/Source/WebCore/svg/SVGExternalResourcesRequired.cpp b/Source/WebCore/svg/SVGExternalResourcesRequired.cpp
index 469eb8734..e186c5335 100644
--- a/Source/WebCore/svg/SVGExternalResourcesRequired.cpp
+++ b/Source/WebCore/svg/SVGExternalResourcesRequired.cpp
@@ -103,7 +103,7 @@ void SVGExternalResourcesRequired::insertedIntoDocument(SVGElement* targetElemen
     if (externalResourcesRequiredBaseValue())
         return;
     setHaveFiredLoadEvent(true);
-    targetElement->sendSVGLoadEventIfPossible();
+    targetElement->sendSVGLoadEventIfPossibleAsynchronously();
 }
 
 void SVGExternalResourcesRequired::finishParsingChildren()
diff --git a/Source/WebCore/svg/SVGPaint.cpp b/Source/WebCore/svg/SVGPaint.cpp
index 8cf3d7e56..4d84f5221 100644
--- a/Source/WebCore/svg/SVGPaint.cpp
+++ b/Source/WebCore/svg/SVGPaint.cpp
@@ -24,6 +24,7 @@
 #if ENABLE(SVG)
 #include "SVGPaint.h"
 
+#include "MemoryInstrumentation.h"
 #include "SVGException.h"
 #include "SVGURIReference.h"
 #include <wtf/text/WTFString.h>
@@ -111,6 +112,12 @@ PassRefPtr<SVGPaint> SVGPaint::cloneForCSSOM() const
     return adoptRef(new SVGPaint(*this));
 }
 
+void SVGPaint::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+    info.addMember(m_uri);
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGPaint.h b/Source/WebCore/svg/SVGPaint.h
index b053cbd77..ac5675b59 100644
--- a/Source/WebCore/svg/SVGPaint.h
+++ b/Source/WebCore/svg/SVGPaint.h
@@ -95,6 +95,8 @@ public:
 
     PassRefPtr<SVGPaint> cloneForCSSOM() const;
 
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     friend class CSSComputedStyleDeclaration;
 
diff --git a/Source/WebCore/svg/SVGSVGElement.cpp b/Source/WebCore/svg/SVGSVGElement.cpp
index 8cde7d516..cde9aa664 100644
--- a/Source/WebCore/svg/SVGSVGElement.cpp
+++ b/Source/WebCore/svg/SVGSVGElement.cpp
@@ -474,8 +474,15 @@ RenderObject* SVGSVGElement::createRenderer(RenderArena* arena, RenderStyle*)
 
 Node::InsertionNotificationRequest SVGSVGElement::insertedInto(ContainerNode* rootParent)
 {
-    if (rootParent->inDocument())
+    if (rootParent->inDocument()) {
         document()->accessSVGExtensions()->addTimeContainer(this);
+
+        // Animations are started at the end of document parsing and after firing the load event,
+        // but if we miss that train (deferred programmatic element insertion for example) we need
+        // to initialize the time container here.
+        if (!document()->parsing() && !document()->processingLoadEvent() && document()->loadEventFinished())
+            timeContainer()->begin();
+    }
     return SVGStyledLocatableElement::insertedInto(rootParent);
 }
 
diff --git a/Source/WebCore/svg/SVGScriptElement.cpp b/Source/WebCore/svg/SVGScriptElement.cpp
index ff9834ccc..de2a58cf5 100644
--- a/Source/WebCore/svg/SVGScriptElement.cpp
+++ b/Source/WebCore/svg/SVGScriptElement.cpp
@@ -47,6 +47,7 @@ END_REGISTER_ANIMATED_PROPERTIES
 inline SVGScriptElement::SVGScriptElement(const QualifiedName& tagName, Document* document, bool wasInsertedByParser, bool alreadyStarted)
     : SVGElement(tagName, document)
     , ScriptElement(this, wasInsertedByParser, alreadyStarted)
+    , m_svgLoadEventTimer(this, &SVGElement::svgLoadEventTimerFired)
 {
     ASSERT(hasTagName(SVGNames::scriptTag));
     registerAnimatedPropertiesForSVGScriptElement();
diff --git a/Source/WebCore/svg/SVGScriptElement.h b/Source/WebCore/svg/SVGScriptElement.h
index 503598fac..05506ec75 100644
--- a/Source/WebCore/svg/SVGScriptElement.h
+++ b/Source/WebCore/svg/SVGScriptElement.h
@@ -75,6 +75,7 @@ private:
     virtual void setHaveFiredLoadEvent(bool haveFiredLoadEvent) { ScriptElement::setHaveFiredLoadEvent(haveFiredLoadEvent); }
     virtual bool isParserInserted() const { return ScriptElement::isParserInserted(); }
     virtual bool haveFiredLoadEvent() const { return ScriptElement::haveFiredLoadEvent(); }
+    virtual Timer<SVGElement>* svgLoadEventTimer() OVERRIDE { return &m_svgLoadEventTimer; }
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGScriptElement)
         DECLARE_ANIMATED_STRING(Href, href)
@@ -82,6 +83,7 @@ private:
     END_DECLARE_ANIMATED_PROPERTIES
 
     String m_type;
+    Timer<SVGElement> m_svgLoadEventTimer;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGStyleElement.cpp b/Source/WebCore/svg/SVGStyleElement.cpp
index ce0023207..e4d6f6bc0 100644
--- a/Source/WebCore/svg/SVGStyleElement.cpp
+++ b/Source/WebCore/svg/SVGStyleElement.cpp
@@ -37,6 +37,7 @@ namespace WebCore {
 inline SVGStyleElement::SVGStyleElement(const QualifiedName& tagName, Document* document, bool createdByParser)
     : SVGElement(tagName, document)
     , StyleElement(document, createdByParser)
+    , m_svgLoadEventTimer(this, &SVGElement::svgLoadEventTimerFired)
 {
     ASSERT(hasTagName(SVGNames::styleTag));
 }
diff --git a/Source/WebCore/svg/SVGStyleElement.h b/Source/WebCore/svg/SVGStyleElement.h
index 3cf5b9fc8..66883654d 100644
--- a/Source/WebCore/svg/SVGStyleElement.h
+++ b/Source/WebCore/svg/SVGStyleElement.h
@@ -63,6 +63,9 @@ private:
     virtual bool isLoading() const { return StyleElement::isLoading(); }
     virtual bool sheetLoaded() { return StyleElement::sheetLoaded(document()); }
     virtual void startLoadingDynamicSheet() { StyleElement::startLoadingDynamicSheet(document()); }
+    virtual Timer<SVGElement>* svgLoadEventTimer() OVERRIDE { return &m_svgLoadEventTimer; }
+
+    Timer<SVGElement> m_svgLoadEventTimer;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGStyledElement.cpp b/Source/WebCore/svg/SVGStyledElement.cpp
index 0818384ab..fb57a6605 100644
--- a/Source/WebCore/svg/SVGStyledElement.cpp
+++ b/Source/WebCore/svg/SVGStyledElement.cpp
@@ -76,7 +76,7 @@ SVGStyledElement::SVGStyledElement(const QualifiedName& tagName, Document* docum
 
 SVGStyledElement::~SVGStyledElement()
 {
-    if (needsPendingResourceHandling() && hasPendingResources() && document())
+    if (hasPendingResources() && document())
         document()->accessSVGExtensions()->removeElementFromPendingResources(this);
 
     ASSERT(!hasPendingResources());
@@ -389,7 +389,7 @@ void SVGStyledElement::removedFrom(ContainerNode* rootParent)
     SVGElement::removedFrom(rootParent);
     SVGElementInstance::invalidateAllInstancesOfElement(this);
     Document* document = this->document();
-    if (!rootParent->inDocument() || !needsPendingResourceHandling() || !document)
+    if (!rootParent->inDocument() || !document)
         return;
 
     document->accessSVGExtensions()->removeElementFromPendingResources(this);
diff --git a/Source/WebCore/svg/SVGTRefElement.cpp b/Source/WebCore/svg/SVGTRefElement.cpp
index 836cfbbd4..dc023162e 100644
--- a/Source/WebCore/svg/SVGTRefElement.cpp
+++ b/Source/WebCore/svg/SVGTRefElement.cpp
@@ -49,13 +49,6 @@ BEGIN_REGISTER_ANIMATED_PROPERTIES(SVGTRefElement)
     REGISTER_PARENT_ANIMATED_PROPERTIES(SVGTextPositioningElement)
 END_REGISTER_ANIMATED_PROPERTIES
 
-inline SVGTRefElement::SVGTRefElement(const QualifiedName& tagName, Document* document)
-    : SVGTextPositioningElement(tagName, document)
-{
-    ASSERT(hasTagName(SVGNames::trefTag));
-    registerAnimatedPropertiesForSVGTRefElement();
-}
-
 PassRefPtr<SVGTRefElement> SVGTRefElement::create(const QualifiedName& tagName, Document* document)
 {
     RefPtr<SVGTRefElement> element = adoptRef(new SVGTRefElement(tagName, document));
@@ -63,59 +56,83 @@ PassRefPtr<SVGTRefElement> SVGTRefElement::create(const QualifiedName& tagName,
     return element.release();
 }
 
-class TargetListener : public EventListener {
+class SVGTRefTargetEventListener : public EventListener {
 public:
-    static PassRefPtr<TargetListener> create(SVGTRefElement* trefElement, String targetId)
+    static PassRefPtr<SVGTRefTargetEventListener> create(SVGTRefElement* trefElement)
     {
-        return adoptRef(new TargetListener(trefElement, targetId));
+        return adoptRef(new SVGTRefTargetEventListener(trefElement));
     }
 
-    static const TargetListener* cast(const EventListener* listener)
+    static const SVGTRefTargetEventListener* cast(const EventListener* listener)
     {
-        return listener->type() == CPPEventListenerType ? static_cast<const TargetListener*>(listener) : 0;
+        return listener->type() == SVGTRefTargetEventListenerType
+                ? static_cast<const SVGTRefTargetEventListener*>(listener) : 0;
     }
 
-    virtual bool operator==(const EventListener&);
-
-    void clear()
-    {
-        Element* target = m_trefElement->treeScope()->getElementById(m_targetId);
-        if (target) {
-            target->removeEventListener(eventNames().DOMSubtreeModifiedEvent, this, false);
-            target->removeEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, this, false);
-        }
-        
-        m_trefElement = 0;
-        m_targetId = String();
-    }
+    void attach(Element* target, String& targetId);
+    void detach();
+    bool isAttached() const { return m_attached; }
 
 private:
-    TargetListener(SVGTRefElement* trefElement, String targetId)
-        : EventListener(CPPEventListenerType)
-        , m_trefElement(trefElement)
-        , m_targetId(targetId)
-    {
-    }
+    SVGTRefTargetEventListener(SVGTRefElement* trefElement);
 
-    virtual void handleEvent(ScriptExecutionContext*, Event*);
+    virtual void handleEvent(ScriptExecutionContext*, Event*) OVERRIDE;
+    virtual bool operator==(const EventListener&) OVERRIDE;
 
     SVGTRefElement* m_trefElement;
     String m_targetId;
+    bool m_attached;
 };
 
-bool TargetListener::operator==(const EventListener& listener)
+SVGTRefTargetEventListener::SVGTRefTargetEventListener(SVGTRefElement* trefElement)
+    : EventListener(SVGTRefTargetEventListenerType)
+    , m_trefElement(trefElement)
+    , m_attached(false)
 {
-    if (const TargetListener* subtreeModificationEventListener = TargetListener::cast(&listener))
-        return m_trefElement == subtreeModificationEventListener->m_trefElement;
+    ASSERT(m_trefElement);
+}
+
+void SVGTRefTargetEventListener::attach(Element* target, String& targetId)
+{
+    ASSERT(!isAttached());
+    ASSERT(target);
+    ASSERT(target->inDocument());
+    ASSERT(!targetId.isEmpty());
+
+    target->addEventListener(eventNames().DOMSubtreeModifiedEvent, this, false);
+    target->addEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, this, false);
+    m_targetId = targetId;
+    m_attached = true;
+}
+
+void SVGTRefTargetEventListener::detach()
+{
+    if (!isAttached())
+        return;
+
+    if (Element* target = m_trefElement->treeScope()->getElementById(m_targetId)) {
+        target->removeEventListener(eventNames().DOMSubtreeModifiedEvent, this, false);
+        target->removeEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, this, false);
+    }
+
+    m_targetId = emptyString();
+    m_attached = false;
+}
+
+bool SVGTRefTargetEventListener::operator==(const EventListener& listener)
+{
+    if (const SVGTRefTargetEventListener* targetListener = SVGTRefTargetEventListener::cast(&listener))
+        return m_trefElement == targetListener->m_trefElement;
     return false;
 }
 
-void TargetListener::handleEvent(ScriptExecutionContext*, Event* event)
+void SVGTRefTargetEventListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
-    if (m_trefElement && event->type() == eventNames().DOMSubtreeModifiedEvent && m_trefElement != event->target())
-        m_trefElement->updateReferencedText();
+    ASSERT(isAttached());
 
-    if (m_trefElement && event->type() == eventNames().DOMNodeRemovedFromDocumentEvent)
+    if (event->type() == eventNames().DOMSubtreeModifiedEvent && m_trefElement != event->target())
+        m_trefElement->updateReferencedText();
+    else if (event->type() == eventNames().DOMNodeRemovedFromDocumentEvent)
         m_trefElement->detachTarget();
 }
 
@@ -148,9 +165,17 @@ void SVGShadowText::willRecalcTextStyle(StyleChange change)
     }
 }
 
+inline SVGTRefElement::SVGTRefElement(const QualifiedName& tagName, Document* document)
+    : SVGTextPositioningElement(tagName, document)
+    , m_targetListener(SVGTRefTargetEventListener::create(this))
+{
+    ASSERT(hasTagName(SVGNames::trefTag));
+    registerAnimatedPropertiesForSVGTRefElement();
+}
+
 SVGTRefElement::~SVGTRefElement()
 {
-    clearEventListener();
+    m_targetListener->detach();
 }
 
 void SVGTRefElement::createShadowSubtree()
@@ -175,7 +200,7 @@ void SVGTRefElement::updateReferencedText()
 void SVGTRefElement::detachTarget()
 {
     // Remove active listeners and clear the text content.
-    clearEventListener();
+    m_targetListener->detach();
 
     String emptyContent;
     ExceptionCode ignore = 0;
@@ -185,7 +210,8 @@ void SVGTRefElement::detachTarget()
     if (container)
         container->setTextContent(emptyContent, ignore);
 
-    ASSERT(inDocument());
+    if (!inDocument())
+        return;
 
     // Mark the referenced ID as pending.
     String id;
@@ -263,7 +289,7 @@ bool SVGTRefElement::rendererIsNeeded(const NodeRenderingContext& context)
 void SVGTRefElement::buildPendingResource()
 {
     // Remove any existing event listener.
-    clearEventListener();
+    m_targetListener->detach();
 
     // If we're not yet in a document, this function will be called again from insertedInto().
     if (!inDocument())
@@ -280,17 +306,14 @@ void SVGTRefElement::buildPendingResource()
         return;
     }
 
-    updateReferencedText();
-
     // Don't set up event listeners if this is a shadow tree node.
     // SVGUseElement::transferEventListenersToShadowTree() handles this task, and addEventListener()
     // expects every element instance to have an associated shadow tree element - which is not the
     // case when we land here from SVGUseElement::buildShadowTree().
-    if (!isInShadowTree()) {
-        m_eventListener = TargetListener::create(this, id);
-        target->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
-        target->addEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, m_eventListener.get(), false);
-    }
+    if (!isInShadowTree())
+        m_targetListener->attach(target, id);
+
+    updateReferencedText();
 }
 
 Node::InsertionNotificationRequest SVGTRefElement::insertedInto(ContainerNode* rootParent)
@@ -305,15 +328,7 @@ void SVGTRefElement::removedFrom(ContainerNode* rootParent)
 {
     SVGStyledElement::removedFrom(rootParent);
     if (rootParent->inDocument())
-        clearEventListener();
-}
-
-void SVGTRefElement::clearEventListener()
-{
-    if (m_eventListener) {
-        m_eventListener->clear();
-        m_eventListener = 0;
-    }
+        m_targetListener->detach();
 }
 
 }
diff --git a/Source/WebCore/svg/SVGTRefElement.h b/Source/WebCore/svg/SVGTRefElement.h
index 0a3f7ff48..3a4601db4 100644
--- a/Source/WebCore/svg/SVGTRefElement.h
+++ b/Source/WebCore/svg/SVGTRefElement.h
@@ -27,7 +27,7 @@
 
 namespace WebCore {
 
-class TargetListener;
+class SVGTRefTargetEventListener;
 
 class SVGTRefElement : public SVGTextPositioningElement,
                        public SVGURIReference {
@@ -35,7 +35,7 @@ public:
     static PassRefPtr<SVGTRefElement> create(const QualifiedName&, Document*);
 
 private:
-    friend class TargetListener;
+    friend class SVGTRefTargetEventListener;
 
     SVGTRefElement(const QualifiedName&, Document*);
     virtual ~SVGTRefElement();
@@ -53,8 +53,6 @@ private:
     virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
     virtual void removedFrom(ContainerNode*) OVERRIDE;
 
-    void clearEventListener();
-
     void updateReferencedText();
 
     void detachTarget();
@@ -65,7 +63,7 @@ private:
         DECLARE_ANIMATED_STRING(Href, href)
     END_DECLARE_ANIMATED_PROPERTIES
 
-    RefPtr<TargetListener> m_eventListener;
+    RefPtr<SVGTRefTargetEventListener> m_targetListener;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index 562c0834b..d19ea195d 100755
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -89,6 +89,7 @@ inline SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* docu
     , m_wasInsertedByParser(wasInsertedByParser)
     , m_haveFiredLoadEvent(false)
     , m_needsShadowTreeRecreation(false)
+    , m_svgLoadEventTimer(this, &SVGElement::svgLoadEventTimerFired)
 {
     ASSERT(hasCustomCallbacks());
     ASSERT(hasTagName(SVGNames::useTag));
diff --git a/Source/WebCore/svg/SVGUseElement.h b/Source/WebCore/svg/SVGUseElement.h
index 8eb6469f4..46ee8b341 100755
--- a/Source/WebCore/svg/SVGUseElement.h
+++ b/Source/WebCore/svg/SVGUseElement.h
@@ -124,12 +124,14 @@ private:
     virtual void setHaveFiredLoadEvent(bool haveFiredLoadEvent) { m_haveFiredLoadEvent = haveFiredLoadEvent; }
     virtual bool isParserInserted() const { return m_wasInsertedByParser; }
     virtual bool haveFiredLoadEvent() const { return m_haveFiredLoadEvent; }
+    virtual Timer<SVGElement>* svgLoadEventTimer() OVERRIDE { return &m_svgLoadEventTimer; }
 
     bool m_wasInsertedByParser;
     bool m_haveFiredLoadEvent;
     bool m_needsShadowTreeRecreation;
     RefPtr<SVGElementInstance> m_targetElementInstance;
     CachedResourceHandle<CachedSVGDocument> m_cachedDocument;
+    Timer<SVGElement> m_svgLoadEventTimer;
 };
 
 }
diff --git a/Source/WebCore/svg/graphics/SVGImage.cpp b/Source/WebCore/svg/graphics/SVGImage.cpp
index 57c579d0e..3527913c6 100644
--- a/Source/WebCore/svg/graphics/SVGImage.cpp
+++ b/Source/WebCore/svg/graphics/SVGImage.cpp
@@ -34,6 +34,7 @@
 #include "EmptyClients.h"
 #include "FrameView.h"
 #include "ImageBuffer.h"
+#include "ImageObserver.h"
 #include "RenderSVGRoot.h"
 #include "SVGDocument.h"
 #include "SVGSVGElement.h"
diff --git a/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h b/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h
index 8b6dc6992..6be9b1c31 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h
@@ -66,8 +66,7 @@ public:
 
     void detachListWrappers(unsigned newListSize)
     {
-        if (m_baseVal)
-            static_cast<ListProperty*>(m_baseVal.get())->detachListWrappers(newListSize);
+        ListProperty::detachListWrappersAndResize(&m_wrappers, newListSize);
     }
 
     PropertyType& currentAnimatedValue()
diff --git a/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h b/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h
index 261a4006a..bbbd45b2e 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h
@@ -55,18 +55,7 @@ struct SVGSynchronizableAnimatedProperty {
 
     void synchronize(SVGElement* ownerElement, const QualifiedName& attrName, const AtomicString& value)
     {
-        // If the attribute already exists on the element, we change the
-        // Attribute directly to avoid a call to Element::attributeChanged
-        // that could cause the SVGElement to erroneously reset its properties.
-        // svg/dom/SVGStringList-basics.xhtml exercises this behavior.
-        ElementAttributeData* attributeData = ownerElement->mutableAttributeData();
-        Attribute* old = attributeData->getAttributeItem(attrName);
-        if (old && value.isNull())
-            attributeData->removeAttribute(old->name(), ownerElement);
-        else if (!old && !value.isNull())
-            attributeData->addAttribute(Attribute(attrName, value), ownerElement);
-        else if (old && !value.isNull())
-            old->setValue(value);
+        ownerElement->setSynchronizedLazyAttribute(attrName, value);
     }
 
     PropertyType value;
diff --git a/Source/WebCore/svg/properties/SVGListProperty.h b/Source/WebCore/svg/properties/SVGListProperty.h
index aed4ad49e..1587a40ac 100644
--- a/Source/WebCore/svg/properties/SVGListProperty.h
+++ b/Source/WebCore/svg/properties/SVGListProperty.h
@@ -52,21 +52,26 @@ public:
         return true;
     }
 
-    void detachListWrappers(unsigned newListSize)
+    static void detachListWrappersAndResize(ListWrapperCache* wrappers, unsigned newListSize = 0)
     {
-        // See SVGPropertyTearOff::detachWrapper() for an explaination what's happening here.
-        ASSERT(m_wrappers);
-        unsigned size = m_wrappers->size();
+        // See SVGPropertyTearOff::detachWrapper() for an explanation about what's happening here.
+        ASSERT(wrappers);
+        unsigned size = wrappers->size();
         for (unsigned i = 0; i < size; ++i) {
-            if (ListItemTearOff* item = m_wrappers->at(i).get())
+            if (ListItemTearOff* item = wrappers->at(i).get())
                 item->detachWrapper();
         }
 
         // Reinitialize the wrapper cache to be equal to the new values size, after the XML DOM changed the list.
         if (newListSize)
-            m_wrappers->fill(0, newListSize);
+            wrappers->fill(0, newListSize);
         else
-            m_wrappers->clear();
+            wrappers->clear();
+    }
+
+    void detachListWrappers(unsigned newListSize)
+    {
+        detachListWrappersAndResize(m_wrappers, newListSize);
     }
 
     void setValuesAndWrappers(PropertyType* values, ListWrapperCache* wrappers, bool shouldOwnValues)
diff --git a/Source/WebCore/testing/InternalSettings.cpp b/Source/WebCore/testing/InternalSettings.cpp
index 552c13a55..3592d05dd 100755
--- a/Source/WebCore/testing/InternalSettings.cpp
+++ b/Source/WebCore/testing/InternalSettings.cpp
@@ -77,6 +77,7 @@ InternalSettings::Backup::Backup(Page* page, Settings* settings)
     , m_originalCSSExclusionsEnabled(RuntimeEnabledFeatures::cssExclusionsEnabled())
 #if ENABLE(SHADOW_DOM)
     , m_originalShadowDOMEnabled(RuntimeEnabledFeatures::shadowDOMEnabled())
+    , m_originalAuthorShadowDOMForAnyElementEnabled(RuntimeEnabledFeatures::authorShadowDOMForAnyElementEnabled())
 #endif
     , m_originalEditingBehavior(settings->editingBehaviorType())
     , m_originalFixedPositionCreatesStackingContext(settings->fixedPositionCreatesStackingContext())
@@ -90,6 +91,7 @@ InternalSettings::Backup::Backup(Page* page, Settings* settings)
 #if ENABLE(TEXT_AUTOSIZING)
     , m_originalTextAutosizingEnabled(settings->textAutosizingEnabled())
     , m_originalTextAutosizingWindowSizeOverride(settings->textAutosizingWindowSizeOverride())
+    , m_originalTextAutosizingFontScaleFactor(settings->textAutosizingFontScaleFactor())
 #endif
 #if ENABLE(DIALOG_ELEMENT)
     , m_originalDialogElementEnabled(RuntimeEnabledFeatures::dialogElementEnabled())
@@ -105,6 +107,7 @@ void InternalSettings::Backup::restoreTo(Page* page, Settings* settings)
     RuntimeEnabledFeatures::setCSSExclusionsEnabled(m_originalCSSExclusionsEnabled);
 #if ENABLE(SHADOW_DOM)
     RuntimeEnabledFeatures::setShadowDOMEnabled(m_originalShadowDOMEnabled);
+    RuntimeEnabledFeatures::setAuthorShadowDOMForAnyElementEnabled(m_originalAuthorShadowDOMForAnyElementEnabled);
 #endif
     settings->setEditingBehaviorType(m_originalEditingBehavior);
     settings->setFixedPositionCreatesStackingContext(m_originalFixedPositionCreatesStackingContext);
@@ -119,6 +122,7 @@ void InternalSettings::Backup::restoreTo(Page* page, Settings* settings)
 #if ENABLE(TEXT_AUTOSIZING)
     settings->setTextAutosizingEnabled(m_originalTextAutosizingEnabled);
     settings->setTextAutosizingWindowSizeOverride(m_originalTextAutosizingWindowSizeOverride);
+    settings->setTextAutosizingFontScaleFactor(m_originalTextAutosizingFontScaleFactor);
 #endif
 #if ENABLE(DIALOG_ELEMENT)
     RuntimeEnabledFeatures::setDialogElementEnabled(m_originalDialogElementEnabled);
@@ -273,6 +277,15 @@ void InternalSettings::setShadowDOMEnabled(bool enabled, ExceptionCode& ec)
 #endif
 }
 
+void InternalSettings::setAuthorShadowDOMForAnyElementEnabled(bool isEnabled)
+{
+#if ENABLE(SHADOW_DOM)
+    RuntimeEnabledFeatures::setAuthorShadowDOMForAnyElementEnabled(isEnabled);
+#else
+    UNUSED_PARAM(isEnabled);
+#endif
+}
+
 void InternalSettings::setTouchEventEmulationEnabled(bool enabled, ExceptionCode& ec)
 {
 #if ENABLE(TOUCH_EVENTS)
@@ -369,6 +382,17 @@ void InternalSettings::setTextAutosizingWindowSizeOverride(int width, int height
 #endif
 }
 
+void InternalSettings::setTextAutosizingFontScaleFactor(float fontScaleFactor, ExceptionCode& ec)
+{
+#if ENABLE(TEXT_AUTOSIZING)
+    InternalSettingsGuardForSettings();
+    settings()->setTextAutosizingFontScaleFactor(fontScaleFactor);
+#else
+    UNUSED_PARAM(fontScaleFactor);
+    UNUSED_PARAM(ec);
+#endif
+}
+
 void InternalSettings::setEnableScrollAnimator(bool enabled, ExceptionCode& ec)
 {
 #if ENABLE(SMOOTH_SCROLLING)
@@ -596,4 +620,10 @@ void InternalSettings::setMemoryInfoEnabled(bool enabled, ExceptionCode& ec)
     settings()->setMemoryInfoEnabled(enabled);
 }
 
+void InternalSettings::setThirdPartyStorageBlockingEnabled(bool enabled, ExceptionCode& ec)
+{
+    InternalSettingsGuardForSettings();
+    settings()->setThirdPartyStorageBlockingEnabled(enabled);
+}
+
 }
diff --git a/Source/WebCore/testing/InternalSettings.h b/Source/WebCore/testing/InternalSettings.h
index c3d0cb58d..7b0f72aeb 100755
--- a/Source/WebCore/testing/InternalSettings.h
+++ b/Source/WebCore/testing/InternalSettings.h
@@ -59,6 +59,7 @@ public:
         bool m_originalCSSExclusionsEnabled;
 #if ENABLE(SHADOW_DOM)
         bool m_originalShadowDOMEnabled;
+        bool m_originalAuthorShadowDOMForAnyElementEnabled;
 #endif
         EditingBehaviorType m_originalEditingBehavior;
         bool m_originalFixedPositionCreatesStackingContext;
@@ -72,6 +73,7 @@ public:
 #if ENABLE(TEXT_AUTOSIZING)
         bool m_originalTextAutosizingEnabled;
         IntSize m_originalTextAutosizingWindowSizeOverride;
+        float m_originalTextAutosizingFontScaleFactor;
 #endif
 #if ENABLE(DIALOG_ELEMENT)
         bool m_originalDialogElementEnabled;
@@ -104,6 +106,7 @@ public:
     void setDeviceSupportsTouch(bool enabled, ExceptionCode&);
     void setDeviceSupportsMouse(bool enabled, ExceptionCode&);
     void setShadowDOMEnabled(bool enabled, ExceptionCode&);
+    void setAuthorShadowDOMForAnyElementEnabled(bool);
     void setStandardFontFamily(const String& family, const String& script, ExceptionCode&);
     void setSerifFontFamily(const String& family, const String& script, ExceptionCode&);
     void setSansSerifFontFamily(const String& family, const String& script, ExceptionCode&);
@@ -113,6 +116,7 @@ public:
     void setPictographFontFamily(const String& family, const String& script, ExceptionCode&);
     void setTextAutosizingEnabled(bool enabled, ExceptionCode&);
     void setTextAutosizingWindowSizeOverride(int width, int height, ExceptionCode&);
+    void setTextAutosizingFontScaleFactor(float fontScaleFactor, ExceptionCode&);
     void setEnableScrollAnimator(bool enabled, ExceptionCode&);
     bool scrollAnimatorEnabled(ExceptionCode&);
     void setCSSExclusionsEnabled(bool enabled, ExceptionCode&);
@@ -135,6 +139,7 @@ public:
     void setEnableMockPagePopup(bool, ExceptionCode&);
     String configurationForViewport(float devicePixelRatio, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight, ExceptionCode&);
     void setMemoryInfoEnabled(bool, ExceptionCode&);
+    void setThirdPartyStorageBlockingEnabled(bool, ExceptionCode&);
 private:
     explicit InternalSettings(Page*);
     virtual void hostDestroyed() OVERRIDE { m_page = 0; }
diff --git a/Source/WebCore/testing/InternalSettings.idl b/Source/WebCore/testing/InternalSettings.idl
index dd139c066..6acda9885 100755
--- a/Source/WebCore/testing/InternalSettings.idl
+++ b/Source/WebCore/testing/InternalSettings.idl
@@ -44,6 +44,7 @@ module window {
         void setDeviceSupportsTouch(in boolean enabled) raises(DOMException);
         void setDeviceSupportsMouse(in boolean enabled) raises(DOMException);
         void setShadowDOMEnabled(in boolean enabled) raises(DOMException);
+        void setAuthorShadowDOMForAnyElementEnabled(in boolean isEnabled);
         void setStandardFontFamily(in DOMString family, in DOMString script) raises(DOMException);
         void setSerifFontFamily(in DOMString family, in DOMString script) raises(DOMException);
         void setSansSerifFontFamily(in DOMString family, in DOMString script) raises(DOMException);
@@ -53,6 +54,7 @@ module window {
         void setPictographFontFamily(in DOMString family, in DOMString script) raises(DOMException);
         void setTextAutosizingEnabled(in boolean enabled) raises(DOMException);
         void setTextAutosizingWindowSizeOverride(in long width, in long height) raises(DOMException);
+        void setTextAutosizingFontScaleFactor(in float fontScaleFactor) raises(DOMException);
         void setEnableScrollAnimator(in boolean enabled) raises(DOMException);
         boolean scrollAnimatorEnabled() raises(DOMException);
         void setCSSExclusionsEnabled(in boolean enabled) raises(DOMException);
@@ -76,6 +78,7 @@ module window {
         boolean shouldDisplayTrackKind(in DOMString trackKind) raises (DOMException);
 #endif
         void setMemoryInfoEnabled(in boolean enabled) raises(DOMException);
+        void setThirdPartyStorageBlockingEnabled(in boolean enabled) raises(DOMException);
     };
 }
 
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index c0502a79f..6aaa7f172 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -30,7 +30,6 @@
 #include "ClientRect.h"
 #include "ClientRectList.h"
 #include "ComposedShadowTreeWalker.h"
-#include "DOMNodeHighlighter.h"
 #include "DOMStringList.h"
 #include "Document.h"
 #include "DocumentMarker.h"
@@ -50,6 +49,7 @@
 #include "InspectorController.h"
 #include "InspectorCounters.h"
 #include "InspectorInstrumentation.h"
+#include "InspectorOverlay.h"
 #include "InstrumentingAgents.h"
 #include "InternalSettings.h"
 #include "IntRect.h"
@@ -60,6 +60,7 @@
 #include "Range.h"
 #include "RenderObject.h"
 #include "RenderTreeAsText.h"
+#include "RuntimeEnabledFeatures.h"
 #include "SchemeRegistry.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
diff --git a/Source/WebCore/testing/v8/WebCoreTestSupport.cpp b/Source/WebCore/testing/v8/WebCoreTestSupport.cpp
index 218c51ce1..41762ffe8 100644
--- a/Source/WebCore/testing/v8/WebCoreTestSupport.cpp
+++ b/Source/WebCore/testing/v8/WebCoreTestSupport.cpp
@@ -27,6 +27,7 @@
 #include "WebCoreTestSupport.h"
 
 #include "Document.h"
+#include "Frame.h"
 #include "InternalSettings.h"
 #include "Internals.h"
 #include "ScriptExecutionContext.h"
diff --git a/Source/WebCore/workers/DedicatedWorkerContext.cpp b/Source/WebCore/workers/DedicatedWorkerContext.cpp
index f2b2a65f2..d31da76cb 100644
--- a/Source/WebCore/workers/DedicatedWorkerContext.cpp
+++ b/Source/WebCore/workers/DedicatedWorkerContext.cpp
@@ -41,8 +41,16 @@
 
 namespace WebCore {
 
-DedicatedWorkerContext::DedicatedWorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, DedicatedWorkerThread* thread, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
-    : WorkerContext(url, userAgent, settings, thread, contentSecurityPolicy, contentSecurityPolicyType)
+// static
+PassRefPtr<DedicatedWorkerContext> DedicatedWorkerContext::create(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, DedicatedWorkerThread* thread, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+{
+    RefPtr<DedicatedWorkerContext> context = adoptRef(new DedicatedWorkerContext(url, userAgent, settings, thread));
+    context->applyContentSecurityPolicyFromString(contentSecurityPolicy, contentSecurityPolicyType);
+    return context.release();
+}
+
+DedicatedWorkerContext::DedicatedWorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, DedicatedWorkerThread* thread)
+    : WorkerContext(url, userAgent, settings, thread)
 {
 }
 
diff --git a/Source/WebCore/workers/DedicatedWorkerContext.h b/Source/WebCore/workers/DedicatedWorkerContext.h
index 4f7c2c36f..fdd1189c5 100644
--- a/Source/WebCore/workers/DedicatedWorkerContext.h
+++ b/Source/WebCore/workers/DedicatedWorkerContext.h
@@ -44,10 +44,7 @@ namespace WebCore {
     class DedicatedWorkerContext : public WorkerContext {
     public:
         typedef WorkerContext Base;
-        static PassRefPtr<DedicatedWorkerContext> create(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, DedicatedWorkerThread* thread, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
-        {
-            return adoptRef(new DedicatedWorkerContext(url, userAgent, settings, thread, contentSecurityPolicy, contentSecurityPolicyType));
-        }
+        static PassRefPtr<DedicatedWorkerContext> create(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, DedicatedWorkerThread*, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType);
 
         virtual bool isDedicatedWorkerContext() const { return true; }
 
@@ -66,7 +63,7 @@ namespace WebCore {
 
         DedicatedWorkerThread* thread();
     private:
-        DedicatedWorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, DedicatedWorkerThread*, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        DedicatedWorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, DedicatedWorkerThread*);
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/workers/SharedWorkerContext.cpp b/Source/WebCore/workers/SharedWorkerContext.cpp
index 64fce221b..cbd2a340a 100644
--- a/Source/WebCore/workers/SharedWorkerContext.cpp
+++ b/Source/WebCore/workers/SharedWorkerContext.cpp
@@ -50,8 +50,16 @@ PassRefPtr<MessageEvent> createConnectEvent(PassRefPtr<MessagePort> port)
     return event.release();
 }
 
-SharedWorkerContext::SharedWorkerContext(const String& name, const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, SharedWorkerThread* thread, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
-    : WorkerContext(url, userAgent, settings, thread, contentSecurityPolicy, contentSecurityPolicyType)
+// static
+PassRefPtr<SharedWorkerContext> SharedWorkerContext::create(const String& name, const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, SharedWorkerThread* thread, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+{
+    RefPtr<SharedWorkerContext> context = adoptRef(new SharedWorkerContext(name, url, userAgent, settings, thread));
+    context->applyContentSecurityPolicyFromString(contentSecurityPolicy, contentSecurityPolicyType);
+    return context.release();
+}
+
+SharedWorkerContext::SharedWorkerContext(const String& name, const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, SharedWorkerThread* thread)
+    : WorkerContext(url, userAgent, settings, thread)
     , m_name(name)
 {
 }
diff --git a/Source/WebCore/workers/SharedWorkerContext.h b/Source/WebCore/workers/SharedWorkerContext.h
index 0ae0c39cc..87ebecbd9 100644
--- a/Source/WebCore/workers/SharedWorkerContext.h
+++ b/Source/WebCore/workers/SharedWorkerContext.h
@@ -44,10 +44,7 @@ namespace WebCore {
     class SharedWorkerContext : public WorkerContext {
     public:
         typedef WorkerContext Base;
-        static PassRefPtr<SharedWorkerContext> create(const String& name, const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, SharedWorkerThread* thread, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
-        {
-            return adoptRef(new SharedWorkerContext(name, url, userAgent, settings, thread, contentSecurityPolicy, contentSecurityPolicyType));
-        }
+        static PassRefPtr<SharedWorkerContext> create(const String& name, const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, SharedWorkerThread*, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType);
         virtual ~SharedWorkerContext();
 
         virtual bool isSharedWorkerContext() const { return true; }
@@ -61,8 +58,7 @@ namespace WebCore {
 
         SharedWorkerThread* thread();
     private:
-        SharedWorkerContext(const String& name, const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, SharedWorkerThread*, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
-
+        SharedWorkerContext(const String& name, const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, SharedWorkerThread*);
         virtual void logExceptionToConsole(const String& errorMessage, const String& sourceURL, int lineNumber, PassRefPtr<ScriptCallStack>);
 
         String m_name;
diff --git a/Source/WebCore/workers/WorkerContext.cpp b/Source/WebCore/workers/WorkerContext.cpp
index 45e5ebedd..e5bd15ea6 100644
--- a/Source/WebCore/workers/WorkerContext.cpp
+++ b/Source/WebCore/workers/WorkerContext.cpp
@@ -85,7 +85,7 @@ public:
     virtual bool isCleanupTask() const { return true; }
 };
 
-WorkerContext::WorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, WorkerThread* thread, const String& policy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+WorkerContext::WorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, WorkerThread* thread)
     : m_url(url)
     , m_userAgent(userAgent)
     , m_groupSettings(settings)
@@ -98,8 +98,6 @@ WorkerContext::WorkerContext(const KURL& url, const String& userAgent, PassOwnPt
     , m_eventQueue(WorkerEventQueue::create(this))
 {
     setSecurityOrigin(SecurityOrigin::create(url));
-    setContentSecurityPolicy(ContentSecurityPolicy::create(this));
-    contentSecurityPolicy()->didReceiveHeader(policy, contentSecurityPolicyType);
 }
 
 WorkerContext::~WorkerContext()
@@ -113,6 +111,12 @@ WorkerContext::~WorkerContext()
     thread()->workerReportingProxy().workerContextDestroyed();
 }
 
+void WorkerContext::applyContentSecurityPolicyFromString(const String& policy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+{
+    setContentSecurityPolicy(ContentSecurityPolicy::create(this));
+    contentSecurityPolicy()->didReceiveHeader(policy, contentSecurityPolicyType);
+}
+
 ScriptExecutionContext* WorkerContext::scriptExecutionContext() const
 {
     return const_cast<WorkerContext*>(this);
@@ -226,6 +230,7 @@ void WorkerContext::clearInterval(int timeoutId)
 
 void WorkerContext::importScripts(const Vector<String>& urls, ExceptionCode& ec)
 {
+    ASSERT(contentSecurityPolicy());
     ec = 0;
     Vector<String>::const_iterator urlsEnd = urls.end();
     Vector<KURL> completedURLs;
diff --git a/Source/WebCore/workers/WorkerContext.h b/Source/WebCore/workers/WorkerContext.h
index a63ecd80f..34819d07c 100644
--- a/Source/WebCore/workers/WorkerContext.h
+++ b/Source/WebCore/workers/WorkerContext.h
@@ -139,7 +139,8 @@ namespace WebCore {
         void notifyObserversOfStop();
 
     protected:
-        WorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, WorkerThread*, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        WorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, WorkerThread*);
+        void applyContentSecurityPolicyFromString(const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
 
         virtual void logExceptionToConsole(const String& errorMessage, const String& sourceURL, int lineNumber, PassRefPtr<ScriptCallStack>);
         void addMessageToWorkerConsole(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack>);
diff --git a/Source/WebCore/workers/WorkerContext.idl b/Source/WebCore/workers/WorkerContext.idl
index 65a64fdc0..f96a853ca 100644
--- a/Source/WebCore/workers/WorkerContext.idl
+++ b/Source/WebCore/workers/WorkerContext.idl
@@ -89,7 +89,8 @@ module threads {
         attribute FileReaderSyncConstructor FileReaderSync;
 #endif
 
-        attribute [Conditional=BLOB] DOMURLConstructor webkitURL;
+        attribute [Conditional=BLOB] DOMURLConstructor URL;
+        attribute [Conditional=BLOB] DOMURLConstructor webkitURL; // FIXME: deprecate this.
 
         attribute ArrayBufferConstructor ArrayBuffer; // Usable with new operator
         attribute Int8ArrayConstructor Int8Array; // Usable with new operator
diff --git a/Source/WebCore/xml/XPathGrammar.y b/Source/WebCore/xml/XPathGrammar.y
index 2eba5b35b..d558211db 100644
--- a/Source/WebCore/xml/XPathGrammar.y
+++ b/Source/WebCore/xml/XPathGrammar.y
@@ -34,6 +34,7 @@
 #include "XPathParser.h"
 #include "XPathPath.h"
 #include "XPathPredicate.h"
+#include "XPathStep.h"
 #include "XPathVariableReference.h"
 #include <wtf/FastMalloc.h>
 
@@ -44,8 +45,6 @@
 #define YYLTYPE_IS_TRIVIAL 1
 #define YYDEBUG 0
 #define YYMAXDEPTH 10000
-#define YYPARSE_PARAM parserParameter
-#define PARSER static_cast<Parser*>(parserParameter)
 
 using namespace WebCore;
 using namespace XPath;
@@ -53,6 +52,7 @@ using namespace XPath;
 %}
 
 %pure_parser
+%parse-param { WebCore::XPath::Parser* parser }
 
 %union
 {
@@ -71,7 +71,7 @@ using namespace XPath;
 %{
 
 static int xpathyylex(YYSTYPE* yylval) { return Parser::current()->lex(yylval); }
-static void xpathyyerror(const char*) { }
+static void xpathyyerror(void*, const char*) { }
     
 %}
 
@@ -118,7 +118,7 @@ static void xpathyyerror(const char*) { }
 Expr:
     OrExpr
     {
-        PARSER->m_topExpr = $1;
+        parser->m_topExpr = $1;
     }
     ;
 
@@ -138,7 +138,7 @@ AbsoluteLocationPath:
     '/'
     {
         $$ = new LocationPath;
-        PARSER->registerParseNode($$);
+        parser->registerParseNode($$);
     }
     |
     '/' RelativeLocationPath
@@ -150,7 +150,7 @@ AbsoluteLocationPath:
     {
         $$ = $2;
         $$->insertFirstStep($1);
-        PARSER->unregisterParseNode($1);
+        parser->unregisterParseNode($1);
     }
     ;
 
@@ -159,22 +159,22 @@ RelativeLocationPath:
     {
         $$ = new LocationPath;
         $$->appendStep($1);
-        PARSER->unregisterParseNode($1);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->registerParseNode($$);
     }
     |
     RelativeLocationPath '/' Step
     {
         $$->appendStep($3);
-        PARSER->unregisterParseNode($3);
+        parser->unregisterParseNode($3);
     }
     |
     RelativeLocationPath DescendantOrSelf Step
     {
         $$->appendStep($2);
         $$->appendStep($3);
-        PARSER->unregisterParseNode($2);
-        PARSER->unregisterParseNode($3);
+        parser->unregisterParseNode($2);
+        parser->unregisterParseNode($3);
     }
     ;
 
@@ -183,58 +183,58 @@ Step:
     {
         if ($2) {
             $$ = new Step(Step::ChildAxis, *$1, *$2);
-            PARSER->deletePredicateVector($2);
+            parser->deletePredicateVector($2);
         } else
             $$ = new Step(Step::ChildAxis, *$1);
-        PARSER->deleteNodeTest($1);
-        PARSER->registerParseNode($$);
+        parser->deleteNodeTest($1);
+        parser->registerParseNode($$);
     }
     |
     NAMETEST OptionalPredicateList
     {
         String localName;
         String namespaceURI;
-        if (!PARSER->expandQName(*$1, localName, namespaceURI)) {
-            PARSER->m_gotNamespaceError = true;
+        if (!parser->expandQName(*$1, localName, namespaceURI)) {
+            parser->m_gotNamespaceError = true;
             YYABORT;
         }
         
         if ($2) {
             $$ = new Step(Step::ChildAxis, Step::NodeTest(Step::NodeTest::NameTest, localName, namespaceURI), *$2);
-            PARSER->deletePredicateVector($2);
+            parser->deletePredicateVector($2);
         } else
             $$ = new Step(Step::ChildAxis, Step::NodeTest(Step::NodeTest::NameTest, localName, namespaceURI));
-        PARSER->deleteString($1);
-        PARSER->registerParseNode($$);
+        parser->deleteString($1);
+        parser->registerParseNode($$);
     }
     |
     AxisSpecifier NodeTest OptionalPredicateList
     {
         if ($3) {
             $$ = new Step($1, *$2, *$3);
-            PARSER->deletePredicateVector($3);
+            parser->deletePredicateVector($3);
         } else
             $$ = new Step($1, *$2);
-        PARSER->deleteNodeTest($2);
-        PARSER->registerParseNode($$);
+        parser->deleteNodeTest($2);
+        parser->registerParseNode($$);
     }
     |
     AxisSpecifier NAMETEST OptionalPredicateList
     {
         String localName;
         String namespaceURI;
-        if (!PARSER->expandQName(*$2, localName, namespaceURI)) {
-            PARSER->m_gotNamespaceError = true;
+        if (!parser->expandQName(*$2, localName, namespaceURI)) {
+            parser->m_gotNamespaceError = true;
             YYABORT;
         }
 
         if ($3) {
             $$ = new Step($1, Step::NodeTest(Step::NodeTest::NameTest, localName, namespaceURI), *$3);
-            PARSER->deletePredicateVector($3);
+            parser->deletePredicateVector($3);
         } else
             $$ = new Step($1, Step::NodeTest(Step::NodeTest::NameTest, localName, namespaceURI));
-        PARSER->deleteString($2);
-        PARSER->registerParseNode($$);
+        parser->deleteString($2);
+        parser->registerParseNode($$);
     }
     |
     AbbreviatedStep
@@ -259,23 +259,23 @@ NodeTest:
         else if (*$1 == "comment")
             $$ = new Step::NodeTest(Step::NodeTest::CommentNodeTest);
 
-        PARSER->deleteString($1);
-        PARSER->registerNodeTest($$);
+        parser->deleteString($1);
+        parser->registerNodeTest($$);
     }
     |
     PI '(' ')'
     {
         $$ = new Step::NodeTest(Step::NodeTest::ProcessingInstructionNodeTest);
-        PARSER->deleteString($1);        
-        PARSER->registerNodeTest($$);
+        parser->deleteString($1);
+        parser->registerNodeTest($$);
     }
     |
     PI '(' LITERAL ')'
     {
         $$ = new Step::NodeTest(Step::NodeTest::ProcessingInstructionNodeTest, $3->stripWhiteSpace());
-        PARSER->deleteString($1);        
-        PARSER->deleteString($3);
-        PARSER->registerNodeTest($$);
+        parser->deleteString($1);
+        parser->deleteString($3);
+        parser->registerNodeTest($$);
     }
     ;
 
@@ -293,14 +293,14 @@ PredicateList:
     {
         $$ = new Vector<Predicate*>;
         $$->append(new Predicate($1));
-        PARSER->unregisterParseNode($1);
-        PARSER->registerPredicateVector($$);
+        parser->unregisterParseNode($1);
+        parser->registerPredicateVector($$);
     }
     |
     PredicateList Predicate
     {
         $$->append(new Predicate($2));
-        PARSER->unregisterParseNode($2);
+        parser->unregisterParseNode($2);
     }
     ;
 
@@ -315,7 +315,7 @@ DescendantOrSelf:
     SLASHSLASH
     {
         $$ = new Step(Step::DescendantOrSelfAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
-        PARSER->registerParseNode($$);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -323,13 +323,13 @@ AbbreviatedStep:
     '.'
     {
         $$ = new Step(Step::SelfAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
-        PARSER->registerParseNode($$);
+        parser->registerParseNode($$);
     }
     |
     DOTDOT
     {
         $$ = new Step(Step::ParentAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
-        PARSER->registerParseNode($$);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -337,8 +337,8 @@ PrimaryExpr:
     VARIABLEREFERENCE
     {
         $$ = new VariableReference(*$1);
-        PARSER->deleteString($1);
-        PARSER->registerParseNode($$);
+        parser->deleteString($1);
+        parser->registerParseNode($$);
     }
     |
     '(' Expr ')'
@@ -349,15 +349,15 @@ PrimaryExpr:
     LITERAL
     {
         $$ = new StringExpression(*$1);
-        PARSER->deleteString($1);
-        PARSER->registerParseNode($$);
+        parser->deleteString($1);
+        parser->registerParseNode($$);
     }
     |
     NUMBER
     {
         $$ = new Number($1->toDouble());
-        PARSER->deleteString($1);
-        PARSER->registerParseNode($$);
+        parser->deleteString($1);
+        parser->registerParseNode($$);
     }
     |
     FunctionCall
@@ -369,8 +369,8 @@ FunctionCall:
         $$ = createFunction(*$1);
         if (!$$)
             YYABORT;
-        PARSER->deleteString($1);
-        PARSER->registerParseNode($$);
+        parser->deleteString($1);
+        parser->registerParseNode($$);
     }
     |
     FUNCTIONNAME '(' ArgumentList ')'
@@ -378,9 +378,9 @@ FunctionCall:
         $$ = createFunction(*$1, *$3);
         if (!$$)
             YYABORT;
-        PARSER->deleteString($1);
-        PARSER->deleteExpressionVector($3);
-        PARSER->registerParseNode($$);
+        parser->deleteString($1);
+        parser->deleteExpressionVector($3);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -389,14 +389,14 @@ ArgumentList:
     {
         $$ = new Vector<Expression*>;
         $$->append($1);
-        PARSER->unregisterParseNode($1);
-        PARSER->registerExpressionVector($$);
+        parser->unregisterParseNode($1);
+        parser->registerExpressionVector($$);
     }
     |
     ArgumentList ',' Argument
     {
         $$->append($3);
-        PARSER->unregisterParseNode($3);
+        parser->unregisterParseNode($3);
     }
     ;
 
@@ -412,9 +412,9 @@ UnionExpr:
         $$ = new Union;
         $$->addSubExpression($1);
         $$->addSubExpression($3);
-        PARSER->unregisterParseNode($1);
-        PARSER->unregisterParseNode($3);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->unregisterParseNode($3);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -430,9 +430,9 @@ PathExpr:
     {
         $3->setAbsolute(true);
         $$ = new Path(static_cast<Filter*>($1), $3);
-        PARSER->unregisterParseNode($1);
-        PARSER->unregisterParseNode($3);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->unregisterParseNode($3);
+        parser->registerParseNode($$);
     }
     |
     FilterExpr DescendantOrSelf RelativeLocationPath
@@ -440,10 +440,10 @@ PathExpr:
         $3->insertFirstStep($2);
         $3->setAbsolute(true);
         $$ = new Path(static_cast<Filter*>($1), $3);
-        PARSER->unregisterParseNode($1);
-        PARSER->unregisterParseNode($2);
-        PARSER->unregisterParseNode($3);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->unregisterParseNode($2);
+        parser->unregisterParseNode($3);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -453,9 +453,9 @@ FilterExpr:
     PrimaryExpr PredicateList
     {
         $$ = new Filter($1, *$2);
-        PARSER->unregisterParseNode($1);
-        PARSER->deletePredicateVector($2);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->deletePredicateVector($2);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -465,9 +465,9 @@ OrExpr:
     OrExpr OR AndExpr
     {
         $$ = new LogicalOp(LogicalOp::OP_Or, $1, $3);
-        PARSER->unregisterParseNode($1);
-        PARSER->unregisterParseNode($3);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->unregisterParseNode($3);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -477,9 +477,9 @@ AndExpr:
     AndExpr AND EqualityExpr
     {
         $$ = new LogicalOp(LogicalOp::OP_And, $1, $3);
-        PARSER->unregisterParseNode($1);
-        PARSER->unregisterParseNode($3);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->unregisterParseNode($3);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -489,9 +489,9 @@ EqualityExpr:
     EqualityExpr EQOP RelationalExpr
     {
         $$ = new EqTestOp($2, $1, $3);
-        PARSER->unregisterParseNode($1);
-        PARSER->unregisterParseNode($3);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->unregisterParseNode($3);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -501,9 +501,9 @@ RelationalExpr:
     RelationalExpr RELOP AdditiveExpr
     {
         $$ = new EqTestOp($2, $1, $3);
-        PARSER->unregisterParseNode($1);
-        PARSER->unregisterParseNode($3);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->unregisterParseNode($3);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -513,17 +513,17 @@ AdditiveExpr:
     AdditiveExpr PLUS MultiplicativeExpr
     {
         $$ = new NumericOp(NumericOp::OP_Add, $1, $3);
-        PARSER->unregisterParseNode($1);
-        PARSER->unregisterParseNode($3);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->unregisterParseNode($3);
+        parser->registerParseNode($$);
     }
     |
     AdditiveExpr MINUS MultiplicativeExpr
     {
         $$ = new NumericOp(NumericOp::OP_Sub, $1, $3);
-        PARSER->unregisterParseNode($1);
-        PARSER->unregisterParseNode($3);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->unregisterParseNode($3);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -533,9 +533,9 @@ MultiplicativeExpr:
     MultiplicativeExpr MULOP UnaryExpr
     {
         $$ = new NumericOp($2, $1, $3);
-        PARSER->unregisterParseNode($1);
-        PARSER->unregisterParseNode($3);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($1);
+        parser->unregisterParseNode($3);
+        parser->registerParseNode($$);
     }
     ;
 
@@ -546,8 +546,8 @@ UnaryExpr:
     {
         $$ = new Negative;
         $$->addSubExpression($2);
-        PARSER->unregisterParseNode($2);
-        PARSER->registerParseNode($$);
+        parser->unregisterParseNode($2);
+        parser->registerParseNode($$);
     }
     ;
 
diff --git a/Source/WebCore/xml/XPathParser.cpp b/Source/WebCore/xml/XPathParser.cpp
index 62d8ee37f..b5e6a9237 100644
--- a/Source/WebCore/xml/XPathParser.cpp
+++ b/Source/WebCore/xml/XPathParser.cpp
@@ -32,24 +32,21 @@
 #include "XPathEvaluator.h"
 #include "XPathException.h"
 #include "XPathNSResolver.h"
+#include "XPathPath.h"
 #include "XPathStep.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/StringHash.h>
 
-int xpathyyparse(void*);
-
+using namespace WebCore;
 using namespace WTF;
 using namespace Unicode;
+using namespace XPath;
 
-namespace WebCore {
-namespace XPath {
-
-class LocationPath;
-
-#include "XPathGrammar.h"    
+extern int xpathyyparse(WebCore::XPath::Parser*);
+#include "XPathGrammar.h"
 
 Parser* Parser::currentParser = 0;
-    
+
 enum XMLCat { NameStart, NameCont, NotPartOfName };
 
 typedef HashMap<String, Step::Axis> AxisNamesMap;
@@ -630,5 +627,3 @@ void Parser::deleteNodeTest(Step::NodeTest* t)
     delete t;
 }
 
-}
-}
diff --git a/Source/WebCore/xml/parser/CharacterReferenceParserInlineMethods.h b/Source/WebCore/xml/parser/CharacterReferenceParserInlineMethods.h
index d83cecb6e..92df6361c 100644
--- a/Source/WebCore/xml/parser/CharacterReferenceParserInlineMethods.h
+++ b/Source/WebCore/xml/parser/CharacterReferenceParserInlineMethods.h
@@ -68,7 +68,7 @@ bool consumeCharacterReference(SegmentedString& source, StringBuilder& decodedCh
     StringBuilder consumedCharacters;
     
     while (!source.isEmpty()) {
-        UChar cc = *source;
+        UChar cc = source.currentChar();
         switch (entityState) {
         case Initial: {
             if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ' || cc == '<' || cc == '&')
diff --git a/Source/WebCore/xml/parser/MarkupTokenizerBase.h b/Source/WebCore/xml/parser/MarkupTokenizerBase.h
index 0a3cadaff..93a0ed580 100644
--- a/Source/WebCore/xml/parser/MarkupTokenizerBase.h
+++ b/Source/WebCore/xml/parser/MarkupTokenizerBase.h
@@ -66,7 +66,7 @@ protected:
         {
         }
 
-        UChar nextInputCharacter() const { return m_nextInputCharacter; }
+        ALWAYS_INLINE UChar nextInputCharacter() const { return m_nextInputCharacter; }
 
         // Returns whether we succeeded in peeking at the next character.
         // The only way we can fail to peek is if there are no more
@@ -74,7 +74,7 @@ protected:
         ALWAYS_INLINE bool peek(SegmentedString& source)
         {
         PeekAgain:
-            m_nextInputCharacter = *source;
+            m_nextInputCharacter = source.currentChar();
 
             // Every branch in this function is expensive, so we have a
             // fast-reject branch for characters that don't require special
@@ -91,7 +91,7 @@ protected:
                 source.advancePastNewlineAndUpdateLineNumber();
                 if (source.isEmpty())
                     return false;
-                m_nextInputCharacter = *source;
+                m_nextInputCharacter = source.currentChar();
             }
             if (m_nextInputCharacter == '\r') {
                 m_nextInputCharacter = '\n';
@@ -116,7 +116,7 @@ protected:
         }
 
         // Returns whether there are more characters in |source| after advancing.
-        bool advance(SegmentedString& source)
+        ALWAYS_INLINE bool advance(SegmentedString& source)
         {
             source.advanceAndUpdateLineNumber();
             if (source.isEmpty())
diff --git a/Source/WebKit/CMakeLists.txt b/Source/WebKit/CMakeLists.txt
index 03797a374..a7983d9f0 100644
--- a/Source/WebKit/CMakeLists.txt
+++ b/Source/WebKit/CMakeLists.txt
@@ -31,6 +31,7 @@ SET(WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/graphics/filters"
     "${WEBCORE_DIR}/platform/graphics/harfbuzz"
     "${WEBCORE_DIR}/platform/graphics/harfbuzz/ng"
+    "${WEBCORE_DIR}/platform/graphics/opengl"
     "${WEBCORE_DIR}/platform/graphics/transforms"
     "${WEBCORE_DIR}/platform/network"
     "${WEBCORE_DIR}/platform/sql"
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index 19994d1e6..3c5e06ce2 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,115 @@
+2012-08-10  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [WebGL] Add support for EXT_robustness
+        https://bugs.webkit.org/show_bug.cgi?id=93379
+
+        Reviewed by George Staikos.
+
+        RIM PR# 147510
+        Internally reviewed by Arvid Nilsson.
+
+        * CMakeLists.txt: Build system adaptation.
+
+2012-08-10  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Introduce JavaScriptVariant object.
+        https://bugs.webkit.org/show_bug.cgi?id=93644
+
+        The JavaScriptVariant can be used for functions that return results from
+        JavaScript such as executeJavaScript or functions that take arguments
+        to pass a variable to JavaScript and they want to make sure the type
+        is correct.
+
+        Convert executeJavaScriptFunction() to use this data type as the
+        example, other functions will be converted in the future.
+
+        PR 14929
+
+        Internally reviewed by Joe Mason
+        Reviewed by Adam Treat
+
+        * PlatformBlackBerry.cmake:
+
+2012-08-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [BlackBerry] Fix wrong include path for notifications.
+        https://bugs.webkit.org/show_bug.cgi?id=93714
+
+        Reviewed by Rob Buis.
+
+        * PlatformBlackBerry.cmake: Change path from notifications to Modules/notifications.
+
+2012-08-08  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Tie up the scrolling machinery to the graphics tree when applicable for in-region scroll
+        https://bugs.webkit.org/show_bug.cgi?id=93482
+
+        Reviewed by Rob Buis.
+
+        * PlatformBlackBerry.cmake: Build system adaptation.
+
+2012-08-07  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Remove PlatformTouchEventEfl and PlatformTouchPointEfl
+        https://bugs.webkit.org/show_bug.cgi?id=93270
+
+        Reviewed by Eric Seidel.
+
+        * PlatformEfl.cmake: Added ewk_touch_event.cpp
+
+2012-08-07  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] InspectorOverlay class duplicated in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=93124
+
+        Reviewed by Rob Buis.
+
+        Updated InspectorOverlay build path.
+
+        * PlatformBlackBerry.cmake:
+
+2012-08-07  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Make it possible to build without QtQuick
+
+        Reviewed by Simon Hausmann.
+
+        * WebKit1.pri:
+
+2012-07-19  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove Qt 4 specific code paths
+        https://bugs.webkit.org/show_bug.cgi?id=88161
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * WebKit.pri:
+        * WebKit1.pri:
+        * WebKit1.pro:
+
+2012-08-07  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        CUSTOM_SCHEME_HANDLER flag should depend on REGISTER_PROTOCOL_HANDLER
+        https://bugs.webkit.org/show_bug.cgi?id=93081
+
+        Reviewed by Adam Barth.
+
+        Modified PlatformEfl.cmake so that CUSTOM_SCHEME_HANDLER flag cannot act without REGISTER_PROTOCOL_HANDLER being set.
+
+        * PlatformEfl.cmake:
+
+2012-08-01  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Implement InRegionScroller class as a in-region scroll controller
+        https://bugs.webkit.org/show_bug.cgi?id=92889
+        PR #186587
+
+        Reviewed by Yong Li.
+
+        Internally reviewed by Arvid Nilsson.
+
+        * PlatformBlackBerry.cmake: Added InRegionScroller.cpp|h to the build system.
+
 2012-07-30  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Unreviewed Qt/Mac build fix: Use libWebKitSystemInterfaceMountainLion.a
diff --git a/Source/WebKit/PlatformBlackBerry.cmake b/Source/WebKit/PlatformBlackBerry.cmake
index 05aaed8a9..d133d0fa9 100644
--- a/Source/WebKit/PlatformBlackBerry.cmake
+++ b/Source/WebKit/PlatformBlackBerry.cmake
@@ -10,15 +10,15 @@ LIST(APPEND WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/html/canvas"
     "${WEBCORE_DIR}/html/parser" # For HTMLParserIdioms.h
     "${WEBCORE_DIR}/loader/appcache"
-    "${WEBCORE_DIR}/notifications"
     "${WEBCORE_DIR}/platform/blackberry"
     "${WEBCORE_DIR}/platform/graphics/blackberry"
     "${WEBCORE_DIR}/platform/graphics/blackberry/skia"
     "${WEBCORE_DIR}/platform/graphics/skia"
     "${WEBCORE_DIR}/platform/network/blackberry"
-    "${WEBCORE_DIR}/Modules/websockets"
     "${WEBCORE_DIR}/Modules/geolocation"
+    "${WEBCORE_DIR}/Modules/notifications"
     "${WEBCORE_DIR}/Modules/vibration"
+    "${WEBCORE_DIR}/Modules/websockets"
     "${WEBKIT_DIR}/blackberry/Api"
     "${WEBKIT_DIR}/blackberry/WebCoreSupport"
     "${WEBKIT_DIR}/blackberry/WebKitSupport"
@@ -57,6 +57,7 @@ ADD_DEFINITIONS(-DUSER_PROCESSES)
 LIST(APPEND WebKit_SOURCES
     blackberry/Api/BackingStore.cpp
     blackberry/Api/BlackBerryGlobal.cpp
+    blackberry/Api/InRegionScroller.cpp
     blackberry/Api/WebAnimation.cpp
     blackberry/Api/WebKitMIMETypeConverter.cpp
     blackberry/Api/WebKitTextCodec.cpp
@@ -68,6 +69,7 @@ LIST(APPEND WebKit_SOURCES
     blackberry/Api/WebSettings.cpp
     blackberry/Api/WebString.cpp
     blackberry/Api/WebViewportArguments.cpp
+    blackberry/Api/JavaScriptVariant.cpp
     blackberry/WebCoreSupport/AutofillManager.cpp
     blackberry/WebCoreSupport/CacheClientBlackBerry.cpp
     blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
@@ -84,7 +86,6 @@ LIST(APPEND WebKit_SOURCES
     blackberry/WebCoreSupport/GeolocationControllerClientBlackBerry.cpp
     blackberry/WebCoreSupport/IconDatabaseClientBlackBerry.cpp
     blackberry/WebCoreSupport/InspectorClientBlackBerry.cpp
-    blackberry/WebCoreSupport/InspectorOverlay.cpp
     blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.cpp
     blackberry/WebCoreSupport/NotificationPresenterImpl.cpp
     blackberry/WebCoreSupport/VibrationClientBlackBerry.cpp
@@ -100,6 +101,8 @@ LIST(APPEND WebKit_SOURCES
     blackberry/WebKitSupport/FrameLayers.cpp
     blackberry/WebKitSupport/InPageSearchManager.cpp
     blackberry/WebKitSupport/InputHandler.cpp
+    blackberry/WebKitSupport/InRegionScrollableArea.cpp
+    blackberry/WebKitSupport/InspectorOverlay.cpp
     blackberry/WebKitSupport/RenderQueue.cpp
     blackberry/WebKitSupport/SelectionHandler.cpp
     blackberry/WebKitSupport/SelectionOverlay.cpp
diff --git a/Source/WebKit/PlatformEfl.cmake b/Source/WebKit/PlatformEfl.cmake
index a7005228f..1706cda3a 100644
--- a/Source/WebKit/PlatformEfl.cmake
+++ b/Source/WebKit/PlatformEfl.cmake
@@ -88,7 +88,7 @@ IF (ENABLE_BATTERY_STATUS)
   )
 ENDIF ()
 
-IF (ENABLE_REGISTER_PROTOCOL_HANDLER OR ENABLE_CUSTOM_SCHEME_HANDLER)
+IF (ENABLE_REGISTER_PROTOCOL_HANDLER)
   LIST(APPEND WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/Modules/protocolhandler"
   )
@@ -136,6 +136,7 @@ LIST(APPEND WebKit_SOURCES
     efl/ewk/ewk_tiled_backing_store.cpp
     efl/ewk/ewk_tiled_matrix.cpp
     efl/ewk/ewk_tiled_model.cpp
+    efl/ewk/ewk_touch_event.cpp
     efl/ewk/ewk_util.cpp
     efl/ewk/ewk_view.cpp
     efl/ewk/ewk_view_single.cpp
diff --git a/Source/WebKit/WebKit.pri b/Source/WebKit/WebKit.pri
index a2d9d4bdf..5a8f4dfe3 100644
--- a/Source/WebKit/WebKit.pri
+++ b/Source/WebKit/WebKit.pri
@@ -37,7 +37,7 @@ HEADERS += \
     $$PWD/qt/Api/qwebplugindatabase_p.h \
     $$PWD/qt/Api/qhttpheader_p.h
 
-haveQt(5): contains(CONFIG, accessibility) {
+contains(CONFIG, accessibility) {
     SOURCES += $$PWD/qt/Api/qwebviewaccessible.cpp
     HEADERS += $$PWD/qt/Api/qwebviewaccessible_p.h
 }
diff --git a/Source/WebKit/WebKit1.pri b/Source/WebKit/WebKit1.pri
index b16d6f130..992fb56a2 100644
--- a/Source/WebKit/WebKit1.pri
+++ b/Source/WebKit/WebKit1.pri
@@ -30,22 +30,17 @@ contains(DEFINES, ENABLE_VIDEO=1):contains(DEFINES, WTF_USE_QTKIT=1) {
 }
 
 contains(DEFINES, ENABLE_DEVICE_ORIENTATION=1)|contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1) {
-    haveQt(5) {
-        QT += sensors
-    } else {
-        CONFIG *= mobility
-        MOBILITY *= sensors
-    }
+    QT += sensors
 }
 
-contains(DEFINES, ENABLE_GEOLOCATION=1):haveQt(5): QT += location
+contains(DEFINES, ENABLE_GEOLOCATION=1): QT += location
 
 contains(CONFIG, texmap): DEFINES += WTF_USE_TEXTURE_MAPPER=1
 
 plugin_backend_xlib: PKGCONFIG += x11
 
-QT += network
-haveQt(5): QT += widgets printsupport quick
+QT += network widgets printsupport
+contains(DEFINES, HAVE_QTQUICK=1): QT += quick
 
 contains(DEFINES, WTF_USE_TEXTURE_MAPPER_GL=1)|contains(DEFINES, ENABLE_WEBGL=1) {
     QT *= opengl
diff --git a/Source/WebKit/WebKit1.pro b/Source/WebKit/WebKit1.pro
index 8b030bfc9..82cd0cd0c 100644
--- a/Source/WebKit/WebKit1.pro
+++ b/Source/WebKit/WebKit1.pro
@@ -94,7 +94,7 @@ HEADERS += \
     $$PWD/qt/WebCoreSupport/PlatformStrategiesQt.h \
     $$PWD/qt/WebCoreSupport/WebEventConversion.h
 
-haveQt(5): contains(QT_CONFIG,accessibility) {
+contains(QT_CONFIG,accessibility) {
     SOURCES += $$PWD/qt/Api/qwebviewaccessible.cpp
     HEADERS += $$PWD/qt/Api/qwebviewaccessible_p.h 
 }
diff --git a/Source/WebKit/blackberry/Api/BackingStore.cpp b/Source/WebKit/blackberry/Api/BackingStore.cpp
index a0fa295e3..878665054 100644
--- a/Source/WebKit/blackberry/Api/BackingStore.cpp
+++ b/Source/WebKit/blackberry/Api/BackingStore.cpp
@@ -209,7 +209,6 @@ BackingStorePrivate::BackingStorePrivate()
     , m_hasBlitJobs(false)
     , m_currentWindowBackBuffer(0)
     , m_preferredTileMatrixDimension(Vertical)
-    , m_blitGeneration(-1)
 #if USE(ACCELERATED_COMPOSITING)
     , m_needsDrawLayersOnCommit(false)
     , m_isDirectRenderingAnimationMessageScheduled(false)
@@ -226,14 +225,6 @@ BackingStorePrivate::BackingStorePrivate()
     pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_RECURSIVE);
     pthread_mutex_init(&m_mutex, &attr);
     pthread_mutexattr_destroy(&attr);
-
-    pthread_mutex_init(&m_blitGenerationLock, 0);
-
-    pthread_condattr_t condattr;
-    pthread_condattr_init(&condattr);
-    pthread_condattr_setclock(&condattr, CLOCK_MONOTONIC);
-    pthread_cond_init(&m_blitGenerationCond, &condattr);
-    pthread_condattr_destroy(&condattr);
 }
 
 BackingStorePrivate::~BackingStorePrivate()
@@ -246,8 +237,6 @@ BackingStorePrivate::~BackingStorePrivate()
     delete back;
     m_backState = 0;
 
-    pthread_cond_destroy(&m_blitGenerationCond);
-    pthread_mutex_destroy(&m_blitGenerationLock);
     pthread_mutex_destroy(&m_mutex);
 }
 
@@ -1141,26 +1130,11 @@ bool BackingStorePrivate::render(const Platform::IntRect& rect)
         BlackBerry::Platform::Graphics::Buffer* nativeBuffer
             = tile->backBuffer()->nativeBuffer();
 
-        // This code is only needed for EGLImage code path, and only effective if we are swapping the render target.
-        // This combination is only true if there's a GLES2Usage window.
-        // FIXME: Use an EGL fence instead, PR152132
-        Window* window = m_webPage->client()->window();
-        if (window && window->windowUsage() == Window::GLES2Usage) {
-            pthread_mutex_lock(&m_blitGenerationLock);
-            while (m_blitGeneration == tile->backBuffer()->blitGeneration()) {
-                int err = pthread_cond_timedwait(&m_blitGenerationCond, &m_blitGenerationLock, &m_currentBlitEnd);
-                if (err == ETIMEDOUT) {
-                    ++m_blitGeneration;
-                    break;
-                }
-                if (err) {
-                    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical,
-                                              "cond_timedwait failed (%s)", strerror(err));
-                    break;
-                }
-            }
-            pthread_mutex_unlock(&m_blitGenerationLock);
-        }
+        // TODO: This code is only needed for EGLImage code path, but preferrably BackingStore
+        // should not know that, and the synchronization should be in BlackBerry::Platform::Graphics
+        // if possible.
+        if (isOpenGLCompositing())
+            SurfacePool::globalSurfacePool()->waitForBuffer(tile->backBuffer());
 
         // Modify the buffer only after we've waited for the buffer to become available above.
 
@@ -1433,14 +1407,17 @@ void BackingStorePrivate::blitContents(const Platform::IntRect& dstRect,
             // Blit checkered to those parts that are not covered by the backingStoreRect.
             IntRectList checkeredRects = checkeredRegion.rects();
             for (size_t i = 0; i < checkeredRects.size(); ++i) {
-                Platform::IntRect dstRect = transformation.mapRect(Platform::IntRect(
+                Platform::IntRect clippedDstRect = transformation.mapRect(Platform::IntRect(
                     Platform::IntPoint(checkeredRects.at(i).x() - origin.x(), checkeredRects.at(i).y() - origin.y()),
                                        checkeredRects.at(i).size()));
+                // To eliminate 1 pixel inflation due to transformation rounding.
+                clippedDstRect.intersect(dstRect);
 #if DEBUG_CHECKERBOARD
                 blitCheckered = true;
 #endif
+
                 fillWindow(BlackBerry::Platform::Graphics::CheckerboardPattern,
-                    dstRect, checkeredRects.at(i).location(), transformation.a());
+                    clippedDstRect, checkeredRects.at(i).location(), transformation.a());
             }
         }
 
@@ -1561,6 +1538,12 @@ void BackingStorePrivate::blitContents(const Platform::IntRect& dstRect,
         }
     }
 
+    // TODO: This code is only needed for EGLImage code path, but preferrably BackingStore
+    // should not know that, and the synchronization should be in BlackBerry::Platform::Graphics
+    // if possible.
+    if (isOpenGLCompositing())
+        SurfacePool::globalSurfacePool()->notifyBuffersComposited(blittedTiles);
+
 #if USE(ACCELERATED_COMPOSITING)
     if (WebPageCompositorPrivate* compositor = m_webPage->d->compositor()) {
         WebCore::FloatRect contentsRect = m_webPage->d->mapFromTransformedFloatRect(WebCore::FloatRect(WebCore::IntRect(contents)));
@@ -1628,28 +1611,6 @@ void BackingStorePrivate::blitContents(const Platform::IntRect& dstRect,
 #endif
 
     invalidateWindow(dstRect);
-
-    // This code is only needed for EGLImage code path, and only effective if we are swapping the render target.
-    // This combination is only true if there's a GLES2Usage window.
-    // FIXME: Use an EGL fence instead
-    Window* window = m_webPage->client()->window();
-    if (window && window->windowUsage() == Window::GLES2Usage && !blittedTiles.isEmpty()) {
-        pthread_mutex_lock(&m_blitGenerationLock);
-
-        ++m_blitGeneration;
-        for (unsigned int i = 0; i < blittedTiles.size(); ++i)
-            blittedTiles[i]->setBlitGeneration(m_blitGeneration);
-
-        clock_gettime(CLOCK_MONOTONIC, &m_currentBlitEnd);
-        m_currentBlitEnd.tv_nsec += 30 * 1000 * 1000;
-        if (m_currentBlitEnd.tv_nsec >= 1000000000L) {
-            m_currentBlitEnd.tv_sec  += 1;
-            m_currentBlitEnd.tv_nsec -= 1000000000L;
-        }
-
-        pthread_mutex_unlock(&m_blitGenerationLock);
-        pthread_cond_signal(&m_blitGenerationCond);
-    }
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -1669,6 +1630,7 @@ void BackingStorePrivate::compositeContents(WebCore::LayerRenderer* layerRendere
 
     BackingStoreGeometry* currentState = frontState();
     TileMap currentMap = currentState->tileMap();
+    Vector<TileBuffer*> compositedTiles;
 
     Platform::IntRectRegion transformedContentsRegion = transformedContents;
     Platform::IntRectRegion backingStoreRegion = currentState->backingStoreRect();
@@ -1708,7 +1670,7 @@ void BackingStorePrivate::compositeContents(WebCore::LayerRenderer* layerRendere
             layerRenderer->drawCheckerboardPattern(transform, m_webPage->d->mapFromTransformedFloatRect(Platform::FloatRect(dirtyRect)));
         else {
             layerRenderer->compositeBuffer(transform, m_webPage->d->mapFromTransformedFloatRect(Platform::FloatRect(wholeRect)), tileBuffer->nativeBuffer(), contentsOpaque, 1.0f);
-
+            compositedTiles.append(tileBuffer);
             // Intersect the rendered region.
             Platform::IntRectRegion notRenderedRegion = Platform::IntRectRegion::subtractRegions(dirtyTileRect, tileBuffer->renderedRegion());
             IntRectList notRenderedRects = notRenderedRegion.rects();
@@ -1716,6 +1678,8 @@ void BackingStorePrivate::compositeContents(WebCore::LayerRenderer* layerRendere
                 layerRenderer->drawCheckerboardPattern(transform, m_webPage->d->mapFromTransformedFloatRect(Platform::FloatRect(notRenderedRects.at(i))));
         }
     }
+
+    SurfacePool::globalSurfacePool()->notifyBuffersComposited(compositedTiles);
 }
 #endif
 
diff --git a/Source/WebKit/blackberry/Api/BackingStore_p.h b/Source/WebKit/blackberry/Api/BackingStore_p.h
index 67913b986..c29684717 100644
--- a/Source/WebKit/blackberry/Api/BackingStore_p.h
+++ b/Source/WebKit/blackberry/Api/BackingStore_p.h
@@ -369,11 +369,6 @@ public:
 
     pthread_mutex_t m_mutex;
 
-    int m_blitGeneration;
-    pthread_mutex_t m_blitGenerationLock;
-    pthread_cond_t m_blitGenerationCond;
-    struct timespec m_currentBlitEnd;
-
 #if USE(ACCELERATED_COMPOSITING)
     mutable bool m_needsDrawLayersOnCommit; // Not thread safe, WebKit thread only
     bool m_isDirectRenderingAnimationMessageScheduled;
diff --git a/Source/WebKit/blackberry/Api/InRegionScroller.cpp b/Source/WebKit/blackberry/Api/InRegionScroller.cpp
new file mode 100644
index 000000000..09012c1fd
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/InRegionScroller.cpp
@@ -0,0 +1,393 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "InRegionScroller.h"
+
+#include "BackingStoreClient.h"
+#include "Frame.h"
+#include "HTMLFrameOwnerElement.h"
+#include "HitTestResult.h"
+#include "InRegionScrollableArea.h"
+#include "InRegionScroller_p.h"
+#include "LayerCompositingThread.h"
+#include "Page.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
+#include "RenderObject.h"
+#include "RenderView.h"
+#include "WebPage_p.h"
+
+using namespace WebCore;
+
+namespace BlackBerry {
+namespace WebKit {
+
+static bool canScrollInnerFrame(Frame*);
+static bool canScrollRenderBox(RenderBox*);
+static RenderLayer* parentLayer(RenderLayer*);
+static Node* enclosingLayerNode(RenderLayer*);
+static bool isNonRenderViewFixedPositionedContainer(RenderLayer*);
+static void pushBackInRegionScrollable(std::vector<Platform::ScrollViewBase*>&, InRegionScrollableArea*, InRegionScrollerPrivate*);
+
+InRegionScroller::InRegionScroller(WebPagePrivate* webPagePrivate)
+    : d(new InRegionScrollerPrivate(webPagePrivate))
+{
+    ASSERT(webPagePrivate);
+}
+
+InRegionScroller::~InRegionScroller()
+{
+    delete d;
+}
+
+bool InRegionScroller::compositedSetScrollPosition(unsigned camouflagedLayer, const Platform::IntPoint& scrollPosition)
+{
+    ASSERT(Platform::userInterfaceThreadMessageClient()->isCurrentThread());
+    return d->compositedSetScrollPosition(camouflagedLayer, d->m_webPage->mapFromTransformed(scrollPosition));
+}
+
+InRegionScrollerPrivate::InRegionScrollerPrivate(WebPagePrivate* webPagePrivate)
+    : m_webPage(webPagePrivate)
+{
+}
+
+void InRegionScrollerPrivate::setNode(WebCore::Node* node)
+{
+    m_inRegionScrollStartingNode = node;
+}
+
+WebCore::Node* InRegionScrollerPrivate::node() const
+{
+    return m_inRegionScrollStartingNode.get();
+}
+
+void InRegionScrollerPrivate::reset()
+{
+    setNode(0);
+}
+
+bool InRegionScrollerPrivate::hasNode() const
+{
+    return !!m_inRegionScrollStartingNode;
+}
+
+bool InRegionScrollerPrivate::canScroll() const
+{
+    return hasNode();
+}
+
+bool InRegionScrollerPrivate::compositedSetScrollPosition(unsigned camouflagedLayer, const WebCore::IntPoint& scrollPosition)
+{
+    LayerCompositingThread* scrollLayer = reinterpret_cast<LayerCompositingThread*>(camouflagedLayer);
+    scrollLayer->override()->setBoundsOrigin(WebCore::FloatPoint(scrollPosition.x(), scrollPosition.y()));
+
+    m_webPage->scheduleCompositingRun();
+    return true;
+}
+
+bool InRegionScrollerPrivate::scrollBy(const Platform::IntSize& delta)
+{
+    ASSERT(Platform::webkitThreadMessageClient()->isCurrentThread());
+
+    if (!canScroll())
+        return false;
+
+    return scrollNodeRecursively(node(), delta);
+}
+
+std::vector<Platform::ScrollViewBase*> InRegionScrollerPrivate::inRegionScrollableAreasForPoint(const WebCore::IntPoint& point)
+{
+    std::vector<Platform::ScrollViewBase*> validReturn;
+    std::vector<Platform::ScrollViewBase*> emptyReturn;
+
+    HitTestResult result = m_webPage->m_mainFrame->eventHandler()->hitTestResultAtPoint(m_webPage->mapFromViewportToContents(point), false /*allowShadowContent*/);
+    Node* node = result.innerNonSharedNode();
+    if (!node || !node->renderer())
+        return emptyReturn;
+
+    RenderLayer* layer = node->renderer()->enclosingLayer();
+    do {
+        RenderObject* renderer = layer->renderer();
+
+        if (renderer->isRenderView()) {
+            if (RenderView* renderView = toRenderView(renderer)) {
+                FrameView* view = renderView->frameView();
+                if (!view)
+                    return emptyReturn;
+
+                if (canScrollInnerFrame(view->frame())) {
+                    pushBackInRegionScrollable(validReturn, new InRegionScrollableArea(m_webPage, layer), this);
+                    continue;
+                }
+            }
+        } else if (canScrollRenderBox(layer->renderBox())) {
+            pushBackInRegionScrollable(validReturn, new InRegionScrollableArea(m_webPage, layer), this);
+            continue;
+        }
+
+        // If we run into a fix positioned layer, set the last scrollable in-region object
+        // as not able to propagate scroll to its parent scrollable.
+        if (isNonRenderViewFixedPositionedContainer(layer) && validReturn.size()) {
+            Platform::ScrollViewBase* end = validReturn.back();
+            end->setCanPropagateScrollingToEnclosingScrollable(false);
+        }
+
+    } while (layer = parentLayer(layer));
+
+    if (validReturn.empty())
+        return emptyReturn;
+
+    // Post-calculate the visible window rects in reverse hit test order so
+    // we account for all and any clipping rects.
+    WebCore::IntRect recursiveClippingRect(WebCore::IntPoint::zero(), m_webPage->transformedViewportSize());
+
+    std::vector<Platform::ScrollViewBase*>::reverse_iterator rend = validReturn.rend();
+    for (std::vector<Platform::ScrollViewBase*>::reverse_iterator rit = validReturn.rbegin(); rit != rend; ++rit) {
+
+        InRegionScrollableArea* curr = static_cast<InRegionScrollableArea*>(*rit);
+        RenderLayer* layer = curr->layer();
+
+        if (layer && layer->renderer()->isRenderView()) { // #document case
+            FrameView* view = toRenderView(layer->renderer())->frameView();
+            ASSERT(view);
+            ASSERT(canScrollInnerFrame(view->frame()));
+
+            WebCore::IntRect frameWindowRect = m_webPage->mapToTransformed(m_webPage->getRecursiveVisibleWindowRect(view));
+            frameWindowRect.intersect(recursiveClippingRect);
+            curr->setVisibleWindowRect(frameWindowRect);
+            recursiveClippingRect = frameWindowRect;
+
+        } else { // RenderBox-based elements case (scrollable boxes (div's, p's, textarea's, etc)).
+
+            RenderBox* box = layer->renderBox();
+            ASSERT(box);
+            ASSERT(canScrollRenderBox(box));
+
+            WebCore::IntRect visibleWindowRect = enclosingIntRect(box->absoluteClippedOverflowRect());
+            visibleWindowRect = box->frame()->view()->contentsToWindow(visibleWindowRect);
+            visibleWindowRect = m_webPage->mapToTransformed(visibleWindowRect);
+            visibleWindowRect.intersect(recursiveClippingRect);
+
+            curr->setVisibleWindowRect(visibleWindowRect);
+            recursiveClippingRect = visibleWindowRect;
+        }
+    }
+
+    return validReturn;
+}
+
+bool InRegionScrollerPrivate::scrollNodeRecursively(WebCore::Node* node, const WebCore::IntSize& delta)
+{
+    if (delta.isZero())
+        return true;
+
+    if (!node)
+        return false;
+
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+        return false;
+
+    FrameView* view = renderer->view()->frameView();
+    if (!view)
+        return false;
+
+    // Try scrolling the renderer.
+    if (scrollRenderer(renderer, delta))
+        return true;
+
+    // We've hit the page, don't scroll it and return false.
+    if (view == m_webPage->m_mainFrame->view())
+        return false;
+
+    // Try scrolling the FrameView.
+    if (canScrollInnerFrame(view->frame())) {
+        IntSize viewDelta = delta;
+        IntPoint newViewOffset = view->scrollPosition();
+        IntPoint maxViewOffset = view->maximumScrollPosition();
+        adjustScrollDelta(maxViewOffset, newViewOffset, viewDelta);
+
+        if (!viewDelta.isZero()) {
+            view->setCanBlitOnScroll(false);
+
+            BackingStoreClient* backingStoreClient = m_webPage->backingStoreClientForFrame(view->frame());
+            if (backingStoreClient) {
+                backingStoreClient->setIsClientGeneratedScroll(true);
+                backingStoreClient->setIsScrollNotificationSuppressed(true);
+            }
+
+            setNode(view->frame()->document());
+
+            view->scrollBy(viewDelta);
+
+            if (backingStoreClient) {
+                backingStoreClient->setIsClientGeneratedScroll(false);
+                backingStoreClient->setIsScrollNotificationSuppressed(false);
+            }
+
+            return true;
+        }
+    }
+
+    // Try scrolling the node of the enclosing frame.
+    Frame* frame = node->document()->frame();
+    if (frame) {
+        Node* ownerNode = frame->ownerElement();
+        if (scrollNodeRecursively(ownerNode, delta))
+            return true;
+    }
+
+    return false;
+}
+
+bool InRegionScrollerPrivate::scrollRenderer(WebCore::RenderObject* renderer, const WebCore::IntSize& delta)
+{
+    RenderLayer* layer = renderer->enclosingLayer();
+    if (!layer)
+        return false;
+
+    // Try to scroll layer.
+    bool restrictedByLineClamp = false;
+    if (renderer->parent())
+        restrictedByLineClamp = !renderer->parent()->style()->lineClamp().isNone();
+
+    if (renderer->hasOverflowClip() && !restrictedByLineClamp) {
+        IntSize layerDelta = delta;
+        IntPoint maxOffset(layer->scrollWidth() - layer->renderBox()->clientWidth(), layer->scrollHeight() - layer->renderBox()->clientHeight());
+        IntPoint currentOffset(layer->scrollXOffset(), layer->scrollYOffset());
+        adjustScrollDelta(maxOffset, currentOffset, layerDelta);
+        if (!layerDelta.isZero()) {
+            setNode(enclosingLayerNode(layer));
+            IntPoint newOffset = currentOffset + layerDelta;
+            layer->scrollToOffset(IntSize(newOffset.x(), newOffset.y()));
+            renderer->repaint(true);
+            return true;
+        }
+    }
+
+    while (layer = layer->parent()) {
+        if (canScrollRenderBox(layer->renderBox()))
+            return scrollRenderer(layer->renderBox(), delta);
+    }
+
+    return false;
+}
+
+void InRegionScrollerPrivate::adjustScrollDelta(const WebCore::IntPoint& maxOffset, const WebCore::IntPoint& currentOffset, WebCore::IntSize& delta) const
+{
+    if (currentOffset.x() + delta.width() > maxOffset.x())
+        delta.setWidth(std::min(maxOffset.x() - currentOffset.x(), delta.width()));
+
+    if (currentOffset.x() + delta.width() < 0)
+        delta.setWidth(std::max(-currentOffset.x(), delta.width()));
+
+    if (currentOffset.y() + delta.height() > maxOffset.y())
+        delta.setHeight(std::min(maxOffset.y() - currentOffset.y(), delta.height()));
+
+    if (currentOffset.y() + delta.height() < 0)
+        delta.setHeight(std::max(-currentOffset.y(), delta.height()));
+}
+
+static bool canScrollInnerFrame(Frame* frame)
+{
+    if (!frame || !frame->view())
+        return false;
+
+    // Not having an owner element means that we are on the mainframe.
+    if (!frame->ownerElement())
+        return false;
+
+    ASSERT(frame != frame->page()->mainFrame());
+
+    IntSize visibleSize = frame->view()->visibleContentRect().size();
+    IntSize contentsSize = frame->view()->contentsSize();
+
+    bool canBeScrolled = contentsSize.height() > visibleSize.height() || contentsSize.width() > visibleSize.width();
+
+    // Lets also consider the 'overflow-{x,y} property set directly to the {i}frame tag.
+    return canBeScrolled && (frame->ownerElement()->scrollingMode() != ScrollbarAlwaysOff);
+}
+
+// The RenderBox::canbeScrolledAndHasScrollableArea method returns true for the
+// following scenario, for example:
+// (1) a div that has a vertical overflow but no horizontal overflow
+//     with overflow-y: hidden and overflow-x: auto set.
+// The version below fixes it.
+// FIXME: Fix RenderBox::canBeScrolledAndHasScrollableArea method instead.
+static bool canScrollRenderBox(RenderBox* box)
+{
+    if (!box || !box->hasOverflowClip())
+        return false;
+
+    if (box->scrollsOverflowX() && (box->scrollWidth() != box->clientWidth())
+        || box->scrollsOverflowY() && (box->scrollHeight() != box->clientHeight()))
+        return true;
+
+    Node* node = box->node();
+    return node && (node->rendererIsEditable() || node->isDocumentNode());
+}
+
+static RenderLayer* parentLayer(RenderLayer* layer)
+{
+    ASSERT(layer);
+    if (layer->parent())
+        return layer->parent();
+
+    RenderObject* renderer = layer->renderer();
+    if (renderer->document() && renderer->document()->ownerElement() && renderer->document()->ownerElement()->renderer())
+        return renderer->document()->ownerElement()->renderer()->enclosingLayer();
+
+    return 0;
+}
+
+// FIXME: Make RenderLayer::enclosingElement public so this one can be removed.
+static Node* enclosingLayerNode(RenderLayer* layer)
+{
+    for (RenderObject* r = layer->renderer(); r; r = r->parent()) {
+        if (Node* e = r->node())
+            return e;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static bool isNonRenderViewFixedPositionedContainer(RenderLayer* layer)
+{
+    RenderObject* o = layer->renderer();
+    if (o->isRenderView())
+        return false;
+
+    return o->isOutOfFlowPositioned() && o->style()->position() == FixedPosition;
+}
+
+static void pushBackInRegionScrollable(std::vector<Platform::ScrollViewBase*>& vector, InRegionScrollableArea* scrollableArea, InRegionScrollerPrivate* scroller)
+{
+    ASSERT(scroller);
+    ASSERT(!scrollableArea->isNull());
+
+    scrollableArea->setCanPropagateScrollingToEnclosingScrollable(!isNonRenderViewFixedPositionedContainer(scrollableArea->layer()));
+    vector.push_back(scrollableArea);
+    if (vector.size() == 1) {
+        // FIXME: Use RenderLayer::renderBox()->node() instead?
+        scroller->setNode(enclosingLayerNode(scrollableArea->layer()));
+    }
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/Api/InRegionScroller.h b/Source/WebKit/blackberry/Api/InRegionScroller.h
new file mode 100644
index 000000000..c3d93a797
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/InRegionScroller.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef InRegionScroller_h
+#define InRegionScroller_h
+
+#include "BlackBerryGlobal.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+class InRegionScrollerPrivate;
+class TouchEventHandler;
+class WebPagePrivate;
+
+class BLACKBERRY_EXPORT InRegionScroller {
+public:
+    InRegionScroller(WebPagePrivate*);
+    ~InRegionScroller();
+
+    bool compositedSetScrollPosition(unsigned /*camouflagedLayer*/, const Platform::IntPoint& /*scrollPosition*/);
+
+private:
+    friend class WebPagePrivate;
+    friend class TouchEventHandler;
+    InRegionScrollerPrivate *d;
+};
+
+}
+}
+
+#endif
diff --git a/Source/WebKit/blackberry/Api/InRegionScroller_p.h b/Source/WebKit/blackberry/Api/InRegionScroller_p.h
new file mode 100644
index 000000000..bc47f9651
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/InRegionScroller_p.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef InRegionScroller_p_h
+#define InRegionScroller_p_h
+
+#include "IntSize.h"
+#include "IntPoint.h"
+
+#include <interaction/ScrollViewBase.h>
+#include <vector>
+
+namespace WebCore {
+class Frame;
+class Node;
+class RenderObject;
+}
+
+namespace BlackBerry {
+namespace WebKit {
+
+class WebPagePrivate;
+
+class InRegionScrollerPrivate {
+public:
+    InRegionScrollerPrivate(WebPagePrivate*);
+
+    void setNode(WebCore::Node*);
+    WebCore::Node* node() const;
+    void reset();
+
+    bool canScroll() const;
+    bool hasNode() const;
+
+    bool scrollBy(const Platform::IntSize& delta);
+    bool compositedSetScrollPosition(unsigned camouflagedLayer, const WebCore::IntPoint& scrollPosition);
+
+    std::vector<Platform::ScrollViewBase*> inRegionScrollableAreasForPoint(const WebCore::IntPoint&);
+
+    WebPagePrivate* m_webPage;
+
+private:
+    bool scrollNodeRecursively(WebCore::Node*, const WebCore::IntSize& delta);
+    bool scrollRenderer(WebCore::RenderObject*, const WebCore::IntSize& delta);
+    void adjustScrollDelta(const WebCore::IntPoint& maxOffset, const WebCore::IntPoint& currentOffset, WebCore::IntSize& delta) const;
+
+    RefPtr<WebCore::Node> m_inRegionScrollStartingNode;
+};
+
+}
+}
+
+#endif
diff --git a/Source/WebKit/blackberry/Api/JavaScriptVariant.cpp b/Source/WebKit/blackberry/Api/JavaScriptVariant.cpp
new file mode 100644
index 000000000..1967ae09b
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/JavaScriptVariant.cpp
@@ -0,0 +1,215 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JavaScriptVariant.h"
+
+#include "JavaScriptVariant_p.h"
+#include "WebPage.h"
+#include <JSStringRef.h>
+#include <JSValueRef.h>
+#include <stdlib.h>
+#include <wtf/Vector.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+JavaScriptVariant JSValueRefToBlackBerryJavaScriptVariant(const JSGlobalContextRef& ctx, const JSValueRef& value)
+{
+    JavaScriptVariant returnValue;
+
+    switch (JSValueGetType(ctx, value)) {
+    case kJSTypeNull:
+        returnValue.setType(JavaScriptVariant::Null);
+        break;
+    case kJSTypeBoolean:
+        returnValue.setBoolean(JSValueToBoolean(ctx, value));
+        break;
+    case kJSTypeNumber:
+        returnValue.setDouble(JSValueToNumber(ctx, value, 0));
+        break;
+    case kJSTypeString: {
+        JSStringRef stringRef = JSValueToStringCopy(ctx, value, 0);
+        size_t bufferSize = JSStringGetMaximumUTF8CStringSize(stringRef);
+        WTF::Vector<char> buffer(bufferSize);
+        JSStringGetUTF8CString(stringRef, buffer.data(), bufferSize);
+        returnValue.setString(WebString::fromUtf8(buffer.data()).utf8().c_str());
+        break;
+    }
+    case kJSTypeObject:
+        returnValue.setType(JavaScriptVariant::Object);
+        break;
+    case kJSTypeUndefined:
+        returnValue.setType(JavaScriptVariant::Undefined);
+        break;
+    }
+    return returnValue;
+}
+
+JSValueRef BlackBerryJavaScriptVariantToJSValueRef(const JSGlobalContextRef& ctx, const JavaScriptVariant& variant)
+{
+    JSValueRef ref = 0;
+    switch (variant.type()) {
+    case JavaScriptVariant::Undefined:
+        ref = JSValueMakeUndefined(ctx);
+        break;
+    case JavaScriptVariant::Null:
+        ref = JSValueMakeNull(ctx);
+        break;
+    case JavaScriptVariant::Boolean:
+        ref = JSValueMakeBoolean(ctx, variant.booleanValue());
+        break;
+    case JavaScriptVariant::Number:
+        ref = JSValueMakeNumber(ctx, variant.doubleValue());
+        break;
+    case JavaScriptVariant::String: {
+        JSStringRef str = JSStringCreateWithUTF8CString(variant.stringValue());
+        ref = JSValueMakeString(ctx, str);
+        JSStringRelease(str);
+        break;
+    }
+    case JavaScriptVariant::Exception:
+    case JavaScriptVariant::Object:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+    return ref;
+}
+
+JavaScriptVariant::JavaScriptVariant()
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+}
+
+JavaScriptVariant::JavaScriptVariant(double value)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    setDouble(value);
+}
+
+JavaScriptVariant::JavaScriptVariant(int value)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    setDouble(value);
+}
+
+JavaScriptVariant::JavaScriptVariant(const char* value)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    setString(value);
+}
+
+JavaScriptVariant::JavaScriptVariant(const std::string& value)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    setString(value.c_str());
+}
+
+JavaScriptVariant::JavaScriptVariant(bool value)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    setBoolean(value);
+}
+
+JavaScriptVariant::JavaScriptVariant(const JavaScriptVariant &v)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    this->operator=(v);
+}
+
+JavaScriptVariant::~JavaScriptVariant()
+{
+    // Prevent memory leaks if we have strings
+    setType(Undefined);
+}
+
+JavaScriptVariant& JavaScriptVariant::operator=(const JavaScriptVariant& v)
+{
+    switch (v.type()) {
+    case Boolean:
+        setBoolean(v.booleanValue());
+        break;
+    case Number:
+        setDouble(v.doubleValue());
+        break;
+    case String:
+        setString(v.stringValue());
+        break;
+    default:
+        setType(v.type());
+        break;
+    }
+
+    return *this;
+}
+
+void JavaScriptVariant::setType(const DataType& type)
+{
+    if (m_type == String)
+        free(m_stringValue);
+    m_type = type;
+    m_stringValue = 0;
+}
+
+JavaScriptVariant::DataType JavaScriptVariant::type() const
+{
+    return m_type;
+}
+
+void JavaScriptVariant::setDouble(double value)
+{
+    setType(Number);
+    m_doubleValue = value;
+}
+
+double JavaScriptVariant::doubleValue() const
+{
+    return m_doubleValue;
+}
+
+void JavaScriptVariant::setString(const char* value)
+{
+    setType(String);
+    m_stringValue = strdup(value);
+}
+
+char* JavaScriptVariant::stringValue() const
+{
+    return m_stringValue;
+}
+
+void JavaScriptVariant::setBoolean(bool value)
+{
+    setType(Boolean);
+    m_booleanValue = value;
+}
+
+bool JavaScriptVariant::booleanValue() const
+{
+    return m_booleanValue;
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/Api/JavaScriptVariant.h b/Source/WebKit/blackberry/Api/JavaScriptVariant.h
new file mode 100644
index 000000000..7623a56b0
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/JavaScriptVariant.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JavaScriptVariant_h
+#define JavaScriptVariant_h
+
+#include "BlackBerryGlobal.h"
+
+#include <string>
+
+namespace BlackBerry {
+namespace WebKit {
+
+class BLACKBERRY_EXPORT JavaScriptVariant {
+public:
+    enum DataType {
+        Undefined = 0,
+        Null,
+        Boolean,
+        Number,
+        String,
+        Object,
+        Exception
+    };
+
+    JavaScriptVariant();
+    JavaScriptVariant(const JavaScriptVariant&);
+    JavaScriptVariant(double);
+    JavaScriptVariant(int);
+    JavaScriptVariant(const char*);
+    JavaScriptVariant(bool);
+    JavaScriptVariant(const std::string&);
+    ~JavaScriptVariant();
+
+    JavaScriptVariant& operator=(const JavaScriptVariant&);
+
+    void setType(const DataType&);
+    DataType type() const;
+
+    void setDouble(double);
+    double doubleValue() const;
+
+    void setString(const char*);
+    char* stringValue() const;
+
+    void setBoolean(bool);
+    bool booleanValue() const;
+
+private:
+    DataType m_type;
+
+    union {
+        bool m_booleanValue;
+        double m_doubleValue;
+        char* m_stringValue;
+    };
+};
+
+}
+}
+
+#endif // JavaScriptVariant_h
diff --git a/Source/WebCore/bindings/js/ScriptControllerBlackBerry.cpp b/Source/WebKit/blackberry/Api/JavaScriptVariant_p.h
index 3183e8dae..024b878cd 100644
--- a/Source/WebCore/bindings/js/ScriptControllerBlackBerry.cpp
+++ b/Source/WebKit/blackberry/Api/JavaScriptVariant_p.h
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
- * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -17,21 +16,21 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
-#include "config.h"
-#include "ScriptController.h"
+#ifndef JavaScriptVariant_p_h
+#define JavaScriptVariant_p_h
 
-#include "Bridge.h"
-#include "PluginView.h"
-#include "runtime_root.h"
+#include "JavaScriptVariant.h"
 
-namespace WebCore {
+#include <JSContextRef.h>
+#include <JSValueRef.h>
 
-PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(Widget* widget)
-{
-    if (!widget->isPluginView())
-        return 0;
+namespace BlackBerry {
+namespace WebKit {
 
-    return static_cast<PluginView*>(widget)->bindingInstance();
-}
+JavaScriptVariant JSValueRefToBlackBerryJavaScriptVariant(const JSGlobalContextRef&, const JSValueRef&);
+JSValueRef BlackBerryJavaScriptVariantToJSValueRef(const JSGlobalContextRef&, const JavaScriptVariant&);
 
 }
+}
+
+#endif // JavaScriptVariant_p_h
diff --git a/Source/WebKit/blackberry/Api/WebOverlay.cpp b/Source/WebKit/blackberry/Api/WebOverlay.cpp
index f8bdbead4..abafe7139 100644
--- a/Source/WebKit/blackberry/Api/WebOverlay.cpp
+++ b/Source/WebKit/blackberry/Api/WebOverlay.cpp
@@ -232,15 +232,10 @@ void WebOverlayPrivate::drawContents(SkCanvas* canvas)
 
 void WebOverlayPrivate::scheduleCompositingRun()
 {
-    if (WebPagePrivate* page = this->page()) {
-        if (WebPageCompositorClient* compositorClient = page->compositor()->client()) {
-            double animationTime = compositorClient->requestAnimationFrame();
-            compositorClient->invalidate(animationTime);
-            return;
-        }
+    if (!page())
+        return;
 
-        page->blitVisibleContents();
-    }
+    page()->scheduleCompositingRun();
 }
 
 WebOverlayPrivateWebKitThread::WebOverlayPrivateWebKitThread(GraphicsLayerClient* client)
diff --git a/Source/WebKit/blackberry/Api/WebPage.cpp b/Source/WebKit/blackberry/Api/WebPage.cpp
index a8d44aff1..3819523ae 100644
--- a/Source/WebKit/blackberry/Api/WebPage.cpp
+++ b/Source/WebKit/blackberry/Api/WebPage.cpp
@@ -71,12 +71,14 @@
 #include "IconDatabaseClientBlackBerry.h"
 #include "InPageSearchManager.h"
 #include "InRegionScrollableArea.h"
+#include "InRegionScroller_p.h"
 #include "InputHandler.h"
 #include "InspectorBackendDispatcher.h"
 #include "InspectorClientBlackBerry.h"
 #include "InspectorController.h"
 #include "InspectorOverlay.h"
 #include "JavaScriptDebuggerBlackBerry.h"
+#include "JavaScriptVariant_p.h"
 #include "LayerWebKitThread.h"
 #include "NetworkManager.h"
 #include "NodeRenderStyle.h"
@@ -104,6 +106,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "ScrollTypes.h"
+#include "SecurityPolicy.h"
 #include "SelectionHandler.h"
 #include "SelectionOverlay.h"
 #include "Settings.h"
@@ -144,6 +147,7 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 #include "FrameLayers.h"
+#include "WebPageCompositorClient.h"
 #include "WebPageCompositor_p.h"
 #endif
 
@@ -370,9 +374,6 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
 #if ENABLE(EVENT_MODE_METATAGS)
     , m_cursorEventMode(ProcessedCursorEvents)
     , m_touchEventMode(ProcessedTouchEvents)
-#if ENABLE(FULLSCREEN_API)
-    , m_touchEventModePriorGoingFullScreen(ProcessedTouchEvents)
-#endif
 #endif
 #if ENABLE(FULLSCREEN_API) && ENABLE(VIDEO)
     , m_scaleBeforeFullScreen(-1.0)
@@ -392,7 +393,6 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
     , m_lastUserEventTimestamp(0.0)
     , m_pluginMouseButtonPressed(false)
     , m_pluginMayOpenNewTab(false)
-    , m_inRegionScrollStartingNode(0)
 #if USE(ACCELERATED_COMPOSITING)
     , m_rootLayerCommitTimer(adoptPtr(new Timer<WebPagePrivate>(this, &WebPagePrivate::rootLayerCommitTimerFired)))
     , m_needsOneShotDrawingSynchronization(false)
@@ -536,6 +536,7 @@ void WebPagePrivate::init(const WebString& pageGroupName)
 
     m_webSettings = WebSettings::createFromStandardSettings();
     m_webSettings->setUserAgentString(defaultUserAgent());
+    m_page->setDeviceScaleFactor(m_webSettings->devicePixelRatio());
 
 #if USE(ACCELERATED_COMPOSITING)
     m_tapHighlight = DefaultTapHighlight::create(this);
@@ -557,6 +558,8 @@ void WebPagePrivate::init(const WebString& pageGroupName)
     frameLoaderClient->setFrame(m_mainFrame, this);
     m_mainFrame->init();
 
+    m_inRegionScroller = adoptPtr(new InRegionScroller(this));
+
 #if ENABLE(WEBGL)
     Platform::Settings* settings = Platform::Settings::instance();
     m_page->settings()->setWebGLEnabled(settings && settings->isWebGLSupported());
@@ -844,24 +847,25 @@ bool WebPage::executeJavaScriptInIsolatedWorld(const char* script, JavaScriptDat
     return d->executeJavaScriptInIsolatedWorld(sourceCode, returnType, returnValue);
 }
 
-bool WebPage::executeJavaScriptFunction(const std::vector<std::string> &function, const std::vector<std::string> &args, JavaScriptDataType& returnType, WebString& returnValue)
+void WebPage::executeJavaScriptFunction(const std::vector<std::string> &function, const std::vector<JavaScriptVariant> &args, JavaScriptVariant& returnValue)
 {
-    if (!d->m_mainFrame)
-        return false;
+    if (!d->m_mainFrame) {
+        returnValue.setType(JavaScriptVariant::Exception);
+        return;
+    }
+
     JSC::Bindings::RootObject* root = d->m_mainFrame->script()->bindingRootObject();
-    if (!root)
-        return false;
+    if (!root) {
+        returnValue.setType(JavaScriptVariant::Exception);
+        return;
+    }
+
     JSC::ExecState* exec = root->globalObject()->globalExec();
     JSGlobalContextRef ctx = toGlobalRef(exec);
 
-    WTF::Vector<JSStringRef> argList(args.size());
     WTF::Vector<JSValueRef> argListRef(args.size());
-    for (unsigned i = 0; i < args.size(); ++i) {
-        JSStringRef str = JSStringCreateWithUTF8CString(args[i].c_str());
-        argList[i] = str;
-        JSValueRef strRef = JSValueMakeString(ctx, str);
-        argListRef[i] = strRef;
-    }
+    for (unsigned i = 0; i < args.size(); ++i)
+        argListRef[i] = BlackBerryJavaScriptVariantToJSValueRef(ctx, args[i]);
 
     JSValueRef windowObjectValue = windowObject();
     JSObjectRef obj = JSValueToObject(ctx, windowObjectValue, 0);
@@ -880,49 +884,13 @@ bool WebPage::executeJavaScriptFunction(const std::vector<std::string> &function
     if (functionObject && thisObject)
         result = JSObjectCallAsFunction(ctx, functionObject, thisObject, args.size(), argListRef.data(), 0);
 
-    for (unsigned i = 0; i < args.size(); ++i)
-        JSStringRelease(argList[i]);
-
     JSC::JSValue value = toJS(exec, result);
-
     if (!value) {
-        returnType = JSException;
-        return false;
-    }
-
-    JSType type = JSValueGetType(ctx, result);
-
-    switch (type) {
-    case kJSTypeNull:
-        returnType = JSNull;
-        break;
-    case kJSTypeBoolean:
-        returnType = JSBoolean;
-        break;
-    case kJSTypeNumber:
-        returnType = JSNumber;
-        break;
-    case kJSTypeString:
-        returnType = JSString;
-        break;
-    case kJSTypeObject:
-        returnType = JSObject;
-        break;
-    case kJSTypeUndefined:
-    default:
-        returnType = JSUndefined;
-        break;
-    }
-
-    if (returnType == JSBoolean || returnType == JSNumber || returnType == JSString || returnType == JSObject) {
-        JSStringRef stringRef = JSValueToStringCopy(ctx, result, 0);
-        size_t bufferSize = JSStringGetMaximumUTF8CStringSize(stringRef);
-        WTF::Vector<char> buffer(bufferSize);
-        JSStringGetUTF8CString(stringRef, buffer.data(), bufferSize);
-        returnValue = WebString::fromUtf8(buffer.data());
+        returnValue.setType(JavaScriptVariant::Exception);
+        return;
     }
 
-    return true;
+    returnValue = JSValueRefToBlackBerryJavaScriptVariant(ctx, result);
 }
 
 void WebPagePrivate::stopCurrentLoad()
@@ -1002,6 +970,36 @@ void WebPage::enableCrossSiteXHR()
     d->enableCrossSiteXHR();
 }
 
+void WebPagePrivate::addOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains)
+{
+    RefPtr<SecurityOrigin> source = SecurityOrigin::createFromString(sourceOrigin);
+    if (source->isUnique())
+        return;
+
+    KURL destination(KURL(), destinationOrigin);
+    SecurityPolicy::addOriginAccessWhitelistEntry(*source, destination.protocol(), destination.host(), allowDestinationSubdomains);
+}
+
+void WebPage::addOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains)
+{
+    d->addOriginAccessWhitelistEntry(sourceOrigin, destinationOrigin, allowDestinationSubdomains);
+}
+
+void WebPagePrivate::removeOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains)
+{
+    RefPtr<SecurityOrigin> source = SecurityOrigin::createFromString(sourceOrigin);
+    if (source->isUnique())
+        return;
+
+    KURL destination(KURL(), destinationOrigin);
+    SecurityPolicy::removeOriginAccessWhitelistEntry(*source, destination.protocol(), destination.host(), allowDestinationSubdomains);
+}
+
+void WebPage::removeOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains)
+{
+    d->removeOriginAccessWhitelistEntry(sourceOrigin, destinationOrigin, allowDestinationSubdomains);
+}
+
 void WebPagePrivate::setLoadState(LoadState state)
 {
     if (m_loadState == state)
@@ -1491,15 +1489,13 @@ bool WebPagePrivate::scrollBy(int deltaX, int deltaY, bool scrollMainFrame)
             delta.width() < 0 ? -untransformedCopiedDelta.width() : untransformedCopiedDelta.width(),
             delta.height() < 0 ? -untransformedCopiedDelta.height(): untransformedCopiedDelta.height());
 
-        if (m_inRegionScrollStartingNode) {
-            if (scrollNodeRecursively(m_inRegionScrollStartingNode.get(), delta)) {
-                m_selectionHandler->selectionPositionChanged();
-                // FIXME: We have code in place to handle scrolling and clipping tap highlight
-                // on in-region scrolling. As soon as it is fast enough (i.e. we have it backed by
-                // a backing store), we can reliably make use of it in the real world.
-                // m_touchEventHandler->drawTapHighlight();
-                return true;
-            }
+        if (m_inRegionScroller->d->scrollBy(delta)) {
+            m_selectionHandler->selectionPositionChanged();
+            // FIXME: We have code in place to handle scrolling and clipping tap highlight
+            // on in-region scrolling. As soon as it is fast enough (i.e. we have it backed by
+            // a backing store), we can reliably make use of it in the real world.
+            // m_touchEventHandler->drawTapHighlight();
+            return true;
         }
 
         return false;
@@ -1519,9 +1515,9 @@ bool WebPage::scrollBy(const Platform::IntSize& delta, bool scrollMainFrame)
 
 void WebPagePrivate::notifyInRegionScrollStatusChanged(bool status)
 {
-    if (!status && m_inRegionScrollStartingNode) {
-        enqueueRenderingOfClippedContentOfScrollableNodeAfterInRegionScrolling(m_inRegionScrollStartingNode.get());
-        m_inRegionScrollStartingNode = 0;
+    if (!status && m_inRegionScroller->d->hasNode()) {
+        enqueueRenderingOfClippedContentOfScrollableNodeAfterInRegionScrolling(m_inRegionScroller->d->node());
+        m_inRegionScroller->d->reset();
     }
 }
 
@@ -2085,7 +2081,6 @@ void WebPagePrivate::notifyTransformedContentsSizeChanged()
     const IntSize size = transformedContentsSize();
     m_backingStore->d->contentsSizeChanged(size);
     m_client->contentsSizeChanged(size);
-    m_selectionHandler->selectionPositionChanged();
 }
 
 void WebPagePrivate::notifyTransformedScrollChanged()
@@ -2357,6 +2352,20 @@ Platform::WebContext WebPagePrivate::webContext(TargetDetectionStrategy strategy
     if (!m_currentContextNode)
         return context;
 
+    // Send an onContextMenu event to the current context ndoe and get the result. Since we've already figured out
+    // which node we want, we can send it directly to the node and not do a hit test. The onContextMenu event doesn't require
+    // mouse positions so we just set the position at (0,0)
+    PlatformMouseEvent mouseEvent(IntPoint(), IntPoint(), PlatformEvent::MouseMoved, 0, NoButton, TouchScreen);
+    if (m_currentContextNode->dispatchMouseEvent(mouseEvent, eventNames().contextmenuEvent, 0)) {
+        context.setFlag(Platform::WebContext::IsOnContextMenuPrevented);
+        return context;
+    }
+
+    // Unpress the mouse button if we're actually getting context.
+    EventHandler* eventHandler = focusedOrMainFrame()->eventHandler();
+    if (eventHandler->mousePressed())
+        eventHandler->setMousePressed(false);
+
     requestLayoutIfNeeded();
 
     bool nodeAllowSelectionOverride = false;
@@ -2591,8 +2600,8 @@ void WebPagePrivate::clearDocumentData(const Document* documentGoingAway)
     if (m_currentBlockZoomAdjustedNode && m_currentBlockZoomAdjustedNode->document() == documentGoingAway)
         m_currentBlockZoomAdjustedNode = 0;
 
-    if (m_inRegionScrollStartingNode && m_inRegionScrollStartingNode->document() == documentGoingAway)
-        m_inRegionScrollStartingNode = 0;
+    if (m_inRegionScroller->d->hasNode() && m_inRegionScroller->d->node()->document() == documentGoingAway)
+        m_inRegionScroller->d->reset();
 
     if (documentGoingAway->frame())
         m_inputHandler->frameUnloaded(documentGoingAway->frame());
@@ -2612,15 +2621,6 @@ static bool isPositionedContainer(RenderLayer* layer)
     return o->isRenderView() || o->isOutOfFlowPositioned() || o->isRelPositioned() || layer->hasTransform();
 }
 
-static bool isNonRenderViewFixedPositionedContainer(RenderLayer* layer)
-{
-    RenderObject* o = layer->renderer();
-    if (o->isRenderView())
-        return false;
-
-    return o->isOutOfFlowPositioned() && o->style()->position() == FixedPosition;
-}
-
 static bool isFixedPositionedContainer(RenderLayer* layer)
 {
     RenderObject* o = layer->renderer();
@@ -2761,10 +2761,6 @@ PassRefPtr<Node> WebPagePrivate::contextNode(TargetDetectionStrategy strategy)
     const FatFingersResult lastFatFingersResult = m_touchEventHandler->lastFatFingersResult();
     bool isTouching = lastFatFingersResult.isValid() && strategy == RectBased;
 
-    // Unpress the mouse button always.
-    if (eventHandler->mousePressed())
-        eventHandler->setMousePressed(false);
-
     // Check if we're using LinkToLink and the user is not touching the screen.
     if (m_webSettings->doesGetFocusNodeContext() && !isTouching) {
         RefPtr<Node> node;
@@ -3392,7 +3388,7 @@ void WebPagePrivate::updateDelegatedOverlays(bool dispatched)
     if (Platform::webKitThreadMessageClient()->isCurrentThread()) {
         // Must be called on the WebKit thread.
         if (m_selectionHandler->isSelectionActive())
-            m_selectionHandler->selectionPositionChanged(true /* visualChangeOnly */);
+            m_selectionHandler->selectionPositionChanged();
         if (m_inspectorOverlay)
             m_inspectorOverlay->update();
 
@@ -3536,16 +3532,13 @@ void WebPage::resetVirtualViewportOnCommitted(bool reset)
 IntSize WebPagePrivate::recomputeVirtualViewportFromViewportArguments()
 {
     static const ViewportArguments defaultViewportArguments;
-    if (m_viewportArguments == defaultViewportArguments) {
-        m_page->setDeviceScaleFactor(1.0);
+    if (m_viewportArguments == defaultViewportArguments)
         return IntSize();
-    }
 
     int desktopWidth = defaultMaxLayoutSize().width();
     int deviceWidth = Platform::Graphics::Screen::primaryScreen()->width();
     int deviceHeight = Platform::Graphics::Screen::primaryScreen()->height();
     ViewportAttributes result = computeViewportAttributes(m_viewportArguments, desktopWidth, deviceWidth, deviceHeight, m_webSettings->devicePixelRatio(), m_defaultLayoutSize);
-    m_page->setDeviceScaleFactor(result.devicePixelRatio);
 
     setUserScalable(m_userScalable && result.userScalable);
     if (result.initialScale > 0)
@@ -3891,6 +3884,8 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
         IntRect actualVisibleRect = enclosingIntRect(rotationMatrix.inverse().mapRect(FloatRect(viewportRect)));
         m_mainFrame->view()->setFixedReportedSize(actualVisibleRect.size());
         m_mainFrame->view()->repaintFixedElementsAfterScrolling();
+        requestLayoutIfNeeded();
+        m_mainFrame->view()->updateFixedElementsAfterScrolling();
     }
 
     // We're going to need to send a resize event to JavaScript because
@@ -4183,12 +4178,12 @@ bool WebPage::touchEvent(const Platform::TouchEvent& event)
 
 void WebPagePrivate::setScrollOriginPoint(const Platform::IntPoint& point)
 {
-    m_inRegionScrollStartingNode = 0;
+    m_inRegionScroller->d->reset();
 
     if (!m_hasInRegionScrollableAreas)
         return;
 
-    m_client->notifyInRegionScrollingStartingPointChanged(inRegionScrollableAreasForPoint(point));
+    m_client->notifyInRegionScrollingStartingPointChanged(m_inRegionScroller->d->inRegionScrollableAreasForPoint(point));
 }
 
 void WebPage::setScrollOriginPoint(const Platform::IntPoint& point)
@@ -4358,120 +4353,6 @@ void WebPage::setForcedTextEncoding(const char* encoding)
         return d->focusedOrMainFrame()->loader()->reloadWithOverrideEncoding(encoding);
 }
 
-bool WebPagePrivate::scrollNodeRecursively(Node* node, const IntSize& delta)
-{
-    if (delta.isZero())
-        return true;
-
-    if (!node)
-        return false;
-
-    RenderObject* renderer = node->renderer();
-    if (!renderer)
-        return false;
-
-    FrameView* view = renderer->view()->frameView();
-    if (!view)
-        return false;
-
-    // Try scrolling the renderer.
-    if (scrollRenderer(renderer, delta))
-        return true;
-
-    // We've hit the page, don't scroll it and return false.
-    if (view == m_mainFrame->view())
-        return false;
-
-    // Try scrolling the FrameView.
-    if (canScrollInnerFrame(view->frame())) {
-        IntSize viewDelta = delta;
-        IntPoint newViewOffset = view->scrollPosition();
-        IntPoint maxViewOffset = view->maximumScrollPosition();
-        adjustScrollDelta(maxViewOffset, newViewOffset, viewDelta);
-
-        if (!viewDelta.isZero()) {
-            view->setCanBlitOnScroll(false);
-
-            BackingStoreClient* backingStoreClient = backingStoreClientForFrame(view->frame());
-            if (backingStoreClient) {
-                backingStoreClient->setIsClientGeneratedScroll(true);
-                backingStoreClient->setIsScrollNotificationSuppressed(true);
-            }
-
-            m_inRegionScrollStartingNode = view->frame()->document();
-
-            view->scrollBy(viewDelta);
-
-            if (backingStoreClient) {
-                backingStoreClient->setIsClientGeneratedScroll(false);
-                backingStoreClient->setIsScrollNotificationSuppressed(false);
-            }
-
-            return true;
-        }
-    }
-
-    // Try scrolling the node of the enclosing frame.
-    Frame* frame = node->document()->frame();
-    if (frame) {
-        Node* ownerNode = frame->ownerElement();
-        if (scrollNodeRecursively(ownerNode, delta))
-            return true;
-    }
-
-    return false;
-}
-
-void WebPagePrivate::adjustScrollDelta(const IntPoint& maxOffset, const IntPoint& currentOffset, IntSize& delta) const
-{
-    if (currentOffset.x() + delta.width() > maxOffset.x())
-        delta.setWidth(min(maxOffset.x() - currentOffset.x(), delta.width()));
-
-    if (currentOffset.x() + delta.width() < 0)
-        delta.setWidth(max(-currentOffset.x(), delta.width()));
-
-    if (currentOffset.y() + delta.height() > maxOffset.y())
-        delta.setHeight(min(maxOffset.y() - currentOffset.y(), delta.height()));
-
-    if (currentOffset.y() + delta.height() < 0)
-        delta.setHeight(max(-currentOffset.y(), delta.height()));
-}
-
-static Node* enclosingLayerNode(RenderLayer*);
-
-bool WebPagePrivate::scrollRenderer(RenderObject* renderer, const IntSize& delta)
-{
-    RenderLayer* layer = renderer->enclosingLayer();
-    if (!layer)
-        return false;
-
-    // Try to scroll layer.
-    bool restrictedByLineClamp = false;
-    if (renderer->parent())
-        restrictedByLineClamp = !renderer->parent()->style()->lineClamp().isNone();
-
-    if (renderer->hasOverflowClip() && !restrictedByLineClamp) {
-        IntSize layerDelta = delta;
-        IntPoint maxOffset(layer->scrollWidth() - layer->renderBox()->clientWidth(), layer->scrollHeight() - layer->renderBox()->clientHeight());
-        IntPoint currentOffset(layer->scrollXOffset(), layer->scrollYOffset());
-        adjustScrollDelta(maxOffset, currentOffset, layerDelta);
-        if (!layerDelta.isZero()) {
-            m_inRegionScrollStartingNode = enclosingLayerNode(layer);
-            IntPoint newOffset = currentOffset + layerDelta;
-            layer->scrollToOffset(toSize(newOffset));
-            renderer->repaint(true);
-            return true;
-        }
-    }
-
-    while (layer = layer->parent()) {
-        if (canScrollRenderBox(layer->renderBox()))
-            return scrollRenderer(layer->renderBox(), delta);
-    }
-
-    return false;
-}
-
 static void handleScrolling(unsigned short character, WebPagePrivate* scroller)
 {
     const int scrollFactor = 20;
@@ -4735,172 +4616,14 @@ void WebPage::selectAtPoint(const Platform::IntPoint& location)
     d->m_selectionHandler->selectAtPoint(selectionLocation);
 }
 
-// FIXME: Move to DOMSupport.
-bool WebPagePrivate::canScrollInnerFrame(Frame* frame) const
-{
-    if (!frame || !frame->view())
-        return false;
-
-    // Not having an owner element means that we are on the mainframe.
-    if (!frame->ownerElement())
-        return false;
-
-    ASSERT(frame != m_mainFrame);
-
-    IntSize visibleSize = frame->view()->visibleContentRect().size();
-    IntSize contentsSize = frame->view()->contentsSize();
-
-    bool canBeScrolled = contentsSize.height() > visibleSize.height() || contentsSize.width() > visibleSize.width();
-
-    // Lets also consider the 'overflow-{x,y} property set directly to the {i}frame tag.
-    return canBeScrolled && (frame->ownerElement()->scrollingMode() != ScrollbarAlwaysOff);
-}
-
-// The RenderBox::canbeScrolledAndHasScrollableArea method returns true for the
-// following scenario, for example:
-// (1) a div that has a vertical overflow but no horizontal overflow
-//     with overflow-y: hidden and overflow-x: auto set.
-// The version below fixes it.
-// FIXME: Fix RenderBox::canBeScrolledAndHasScrollableArea method instead.
-bool WebPagePrivate::canScrollRenderBox(RenderBox* box)
-{
-    if (!box || !box->hasOverflowClip())
-        return false;
-
-    if (box->scrollsOverflowX() && (box->scrollWidth() != box->clientWidth())
-        || box->scrollsOverflowY() && (box->scrollHeight() != box->clientHeight()))
-        return true;
-
-    Node* node = box->node();
-    return node && (node->rendererIsEditable() || node->isDocumentNode());
-}
-
-static RenderLayer* parentLayer(RenderLayer* layer)
-{
-    ASSERT(layer);
-    if (layer->parent())
-        return layer->parent();
-
-    RenderObject* renderer = layer->renderer();
-    if (renderer->document() && renderer->document()->ownerElement() && renderer->document()->ownerElement()->renderer())
-        return renderer->document()->ownerElement()->renderer()->enclosingLayer();
-
-    return 0;
-}
-
-// FIXME: Make RenderLayer::enclosingElement public so this one can be removed.
-static Node* enclosingLayerNode(RenderLayer* layer)
-{
-    for (RenderObject* r = layer->renderer(); r; r = r->parent()) {
-        if (Node* e = r->node())
-            return e;
-    }
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-static void pushBackInRegionScrollable(std::vector<Platform::ScrollViewBase*>& vector, InRegionScrollableArea* scroller, WebPagePrivate* webPage)
-{
-    ASSERT(webPage);
-    ASSERT(!scroller.isNull());
-
-    scroller->setCanPropagateScrollingToEnclosingScrollable(!isNonRenderViewFixedPositionedContainer(scroller->layer()));
-    vector.push_back(scroller);
-    if (vector.size() == 1) {
-        // FIXME: Use RenderLayer::renderBox()->node() instead?
-        webPage->m_inRegionScrollStartingNode = enclosingLayerNode(scroller->layer());
-    }
-}
-
-std::vector<Platform::ScrollViewBase*> WebPagePrivate::inRegionScrollableAreasForPoint(const Platform::IntPoint& point)
+BackingStore* WebPage::backingStore() const
 {
-    std::vector<Platform::ScrollViewBase*> validReturn;
-    std::vector<Platform::ScrollViewBase*> emptyReturn;
-
-    HitTestResult result = m_mainFrame->eventHandler()->hitTestResultAtPoint(mapFromViewportToContents(point), false /*allowShadowContent*/);
-    Node* node = result.innerNonSharedNode();
-    if (!node)
-        return emptyReturn;
-
-    RenderObject* renderer = node->renderer();
-    // FIXME: Validate with elements with visibility:hidden.
-    if (!renderer)
-        return emptyReturn;
-
-    RenderLayer* layer = renderer->enclosingLayer();
-    do {
-        RenderObject* renderer = layer->renderer();
-
-        if (renderer->isRenderView()) {
-            if (RenderView* renderView = toRenderView(renderer)) {
-                FrameView* view = renderView->frameView();
-                if (!view)
-                    return emptyReturn;
-
-                if (canScrollInnerFrame(view->frame())) {
-                    pushBackInRegionScrollable(validReturn, new InRegionScrollableArea(this, layer), this);
-                    continue;
-                }
-            }
-        } else if (canScrollRenderBox(layer->renderBox())) {
-            pushBackInRegionScrollable(validReturn, new InRegionScrollableArea(this, layer), this);
-            continue;
-        }
-
-        // If we run into a fix positioned layer, set the last scrollable in-region object
-        // as not able to propagate scroll to its parent scrollable.
-        if (isNonRenderViewFixedPositionedContainer(layer) && validReturn.size()) {
-            Platform::ScrollViewBase* end = validReturn.back();
-            end->setCanPropagateScrollingToEnclosingScrollable(false);
-        }
-
-    } while (layer = parentLayer(layer));
-
-    if (validReturn.empty())
-        return emptyReturn;
-
-    // Post-calculate the visible window rects in reverse hit test order so
-    // we account for all and any clipping rects.
-    WebCore::IntRect recursiveClippingRect(WebCore::IntPoint::zero(), transformedViewportSize());
-
-    std::vector<Platform::ScrollViewBase*>::reverse_iterator rend = validReturn.rend();
-    for (std::vector<Platform::ScrollViewBase*>::reverse_iterator rit = validReturn.rbegin(); rit != rend; ++rit) {
-
-        InRegionScrollableArea* curr = static_cast<InRegionScrollableArea*>(*rit);
-        RenderLayer* layer = curr->layer();
-
-        if (layer && layer->renderer()->isRenderView()) { // #document case
-            FrameView* view = toRenderView(layer->renderer())->frameView();
-            ASSERT(view);
-            ASSERT(canScrollInnerFrame(view->frame()));
-
-            WebCore::IntRect frameWindowRect = mapToTransformed(getRecursiveVisibleWindowRect(view));
-            frameWindowRect.intersect(recursiveClippingRect);
-            curr->setVisibleWindowRect(frameWindowRect);
-            recursiveClippingRect = frameWindowRect;
-
-        } else { // RenderBox-based elements case (scrollable boxes (div's, p's, textarea's, etc)).
-
-            RenderBox* box = layer->renderBox();
-            ASSERT(box);
-            ASSERT(canScrollRenderBox(box));
-
-            WebCore::IntRect visibleWindowRect = box->absoluteClippedOverflowRect();
-            visibleWindowRect = box->frame()->view()->contentsToWindow(visibleWindowRect);
-            visibleWindowRect = mapToTransformed(visibleWindowRect);
-            visibleWindowRect.intersect(recursiveClippingRect);
-
-            curr->setVisibleWindowRect(visibleWindowRect);
-            recursiveClippingRect = visibleWindowRect;
-        }
-    }
-
-    return validReturn;
+    return d->m_backingStore;
 }
 
-BackingStore* WebPage::backingStore() const
+InRegionScroller* WebPage::inRegionScroller() const
 {
-    return d->m_backingStore;
+    return d->m_inRegionScroller.get();
 }
 
 bool WebPage::zoomToFit()
@@ -5391,13 +5114,12 @@ JSValueRef WebPage::windowObject() const
 // Serialize only the members of HistoryItem which are needed by the client,
 // and copy them into a SharedArray. Also include the HistoryItem pointer which
 // will be used by the client as an opaque reference to identify the item.
-void WebPage::getBackForwardList(SharedArray<BackForwardEntry>& result, unsigned int& resultSize) const
+void WebPage::getBackForwardList(SharedArray<BackForwardEntry>& result) const
 {
     HistoryItemVector entries = static_cast<BackForwardListImpl*>(d->m_page->backForward()->client())->entries();
-    resultSize = entries.size();
-    result.reset(new BackForwardEntry[resultSize]);
+    result.reset(new BackForwardEntry[entries.size()], entries.size());
 
-    for (unsigned i = 0; i < resultSize; ++i) {
+    for (unsigned i = 0; i < entries.size(); ++i) {
         RefPtr<HistoryItem> entry = entries[i];
         BackForwardEntry& resultEntry = result[i];
         resultEntry.url = entry->urlString();
@@ -5871,10 +5593,8 @@ LayerRenderingResults WebPagePrivate::lastCompositingResults() const
 
 GraphicsLayer* WebPagePrivate::overlayLayer()
 {
-    // The overlay layer has no GraphicsLayerClient, it's just a container
-    // for various overlays.
     if (!m_overlayLayer)
-        m_overlayLayer = GraphicsLayer::create(0);
+        m_overlayLayer = GraphicsLayer::create(this);
 
     return m_overlayLayer.get();
 }
@@ -5993,6 +5713,10 @@ bool WebPagePrivate::commitRootLayerIfNeeded()
     if (!view)
         return false;
 
+    // This can do pretty much anything depending on the overlay,
+    // so in case it causes relayout or schedule a commit, call it early.
+    updateDelegatedOverlays();
+
     // If we sync compositing layers when a layout is pending, we may cause painting of compositing
     // layer content to occur before layout has happened, which will cause paintContents() to bail.
     if (needsLayoutRecursive(view)) {
@@ -6015,7 +5739,6 @@ bool WebPagePrivate::commitRootLayerIfNeeded()
     if (m_frameLayers && m_frameLayers->hasLayer())
         m_frameLayers->commitOnWebKitThread(scale);
 
-    updateDelegatedOverlays();
     if (m_overlayLayer)
         m_overlayLayer->platformLayer()->commitOnWebKitThread(scale);
 
@@ -6236,6 +5959,21 @@ void WebPagePrivate::setNeedsOneShotDrawingSynchronization()
     m_needsCommit = true;
     m_needsOneShotDrawingSynchronization = true;
 }
+
+void WebPagePrivate::notifySyncRequired(const GraphicsLayer*)
+{
+    scheduleRootLayerCommit();
+}
+
+bool WebPagePrivate::showDebugBorders(const GraphicsLayer*) const
+{
+    return m_page->settings()->showDebugBorders();
+}
+
+bool WebPagePrivate::showRepaintCounter(const GraphicsLayer*) const
+{
+    return m_page->settings()->showRepaintCounter();
+}
 #endif // USE(ACCELERATED_COMPOSITING)
 
 void WebPagePrivate::enterFullscreenForNode(Node* node)
@@ -6318,19 +6056,12 @@ void WebPagePrivate::enterFullScreenForElement(Element* element)
         // is so that exitFullScreenForElement() gets called later.
         enterFullscreenForNode(element);
     } else {
-        // When an element goes fullscreen, it gets cloned and added to a higher index
-        // wrapper/container node, created out of the DOM tree. This wrapper is fixed
-        // position, but since our fixed position logic respects only the 'y' coordinate,
-        // we temporarily scroll the WebPage to x:0 so that the wrapper gets properly
-        // positioned. The original scroll position is restored once element leaves fullscreen.
+        // When an element goes fullscreen, the viewport size changes and the scroll
+        // position might change. So we keep track of it here, in order to restore it
+        // once element leaves fullscreen.
         WebCore::IntPoint scrollPosition = m_mainFrame->view()->scrollPosition();
         m_xScrollOffsetBeforeFullScreen = scrollPosition.x();
-        m_mainFrame->view()->setScrollPosition(WebCore::IntPoint(0, scrollPosition.y()));
 
-#if ENABLE(EVENT_MODE_METATAGS)
-        m_touchEventModePriorGoingFullScreen = m_touchEventMode;
-        didReceiveTouchEventMode(PureTouchEventsWithMouseConversion);
-#endif
         // The current scale can be clamped to a greater minimum scale when we relayout contents during
         // the change of the viewport size. Cache the current scale so that we can restore it when
         // leaving fullscreen. Otherwise, it is possible that we will use the wrong scale.
@@ -6365,10 +6096,6 @@ void WebPagePrivate::exitFullScreenForElement(Element* element)
             WebCore::IntPoint(m_xScrollOffsetBeforeFullScreen, scrollPosition.y()));
         m_xScrollOffsetBeforeFullScreen = -1;
 
-#if ENABLE(EVENT_MODE_METATAGS)
-        didReceiveTouchEventMode(m_touchEventModePriorGoingFullScreen);
-        m_touchEventModePriorGoingFullScreen = ProcessedTouchEvents;
-#endif
         if (m_scaleBeforeFullScreen > 0) {
             // Restore the scale when leaving fullscreen. We can't use TransformationMatrix::scale(double) here, as it
             // will multiply the scale rather than set the scale.
@@ -6535,6 +6262,18 @@ void WebPagePrivate::blitVisibleContents()
 
     m_backingStore->d->blitVisibleContents();
 }
+
+void WebPagePrivate::scheduleCompositingRun()
+{
+    if (WebPageCompositorClient* compositorClient = compositor()->client()) {
+        double animationTime = compositorClient->requestAnimationFrame();
+        compositorClient->invalidate(animationTime);
+        return;
+    }
+
+    blitVisibleContents();
+}
+
 #endif
 
 void WebPage::setWebGLEnabled(bool enabled)
@@ -6663,11 +6402,11 @@ PagePopupBlackBerry* WebPage::popup()
     return d->m_selectPopup;
 }
 
-void WebPagePrivate::setInspectorOverlayClient(WebCore::InspectorOverlay::InspectorOverlayClient* inspectorOverlayClient)
+void WebPagePrivate::setInspectorOverlayClient(InspectorOverlay::InspectorOverlayClient* inspectorOverlayClient)
 {
     if (inspectorOverlayClient) {
         if (!m_inspectorOverlay)
-            m_inspectorOverlay = WebCore::InspectorOverlay::create(this, inspectorOverlayClient);
+            m_inspectorOverlay = InspectorOverlay::create(this, inspectorOverlayClient);
         else
             m_inspectorOverlay->setClient(inspectorOverlayClient);
         m_inspectorOverlay->update();
@@ -6693,5 +6432,35 @@ void WebPagePrivate::setTextZoomFactor(float textZoomFactor)
 
     m_mainFrame->setTextZoomFactor(textZoomFactor);
 }
+
+void WebPagePrivate::restoreHistoryViewState(Platform::IntSize contentsSize, Platform::IntPoint scrollPosition, double scale, bool shouldReflowBlock)
+{
+    if (!m_mainFrame)
+        return;
+
+    m_backingStore->d->suspendScreenAndBackingStoreUpdates(); // don't flash checkerboard for the setScrollPosition call
+    m_mainFrame->view()->setContentsSizeFromHistory(contentsSize);
+
+    // Here we need to set scroll position what we asked for.
+    // So we use ScrollView::constrainsScrollingToContentEdge(false).
+    bool oldConstrainsScrollingToContentEdge = m_mainFrame->view()->constrainsScrollingToContentEdge();
+    m_mainFrame->view()->setConstrainsScrollingToContentEdge(false);
+    setScrollPosition(scrollPosition);
+    m_mainFrame->view()->setConstrainsScrollingToContentEdge(oldConstrainsScrollingToContentEdge);
+
+    m_shouldReflowBlock = shouldReflowBlock;
+
+    bool didZoom = zoomAboutPoint(scale, m_mainFrame->view()->scrollPosition(), true /* enforceScaleClamping */, true /*forceRendering*/, true /*isRestoringZoomLevel*/);
+    // If we're already at that scale, then we should still force rendering
+    // since our scroll position changed.
+    m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
+
+    if (!didZoom) {
+        // We need to notify the client of the scroll position and content size change(s) above even if we didn't scale.
+        notifyTransformedContentsSizeChanged();
+        notifyTransformedScrollChanged();
+    }
+}
+
 }
 }
diff --git a/Source/WebKit/blackberry/Api/WebPage.h b/Source/WebKit/blackberry/Api/WebPage.h
index c7227fe8d..06aabeb94 100644
--- a/Source/WebKit/blackberry/Api/WebPage.h
+++ b/Source/WebKit/blackberry/Api/WebPage.h
@@ -20,6 +20,7 @@
 #define WebPage_h
 
 #include "BlackBerryGlobal.h"
+#include "JavaScriptVariant.h"
 #include "WebString.h"
 
 #include <BlackBerryPlatformGuardedPointer.h>
@@ -63,6 +64,7 @@ namespace WebKit {
 class BackingStore;
 class BackingStoreClient;
 class BackingStorePrivate;
+class InRegionScroller;
 class RenderQueue;
 class WebOverlay;
 class WebPageClient;
@@ -105,7 +107,7 @@ public:
     // Takes a UTF16 encoded script that is used explicitly by the pattern matching code
     bool executeJavaScriptInIsolatedWorld(const std::wstring& script, JavaScriptDataType& returnType, WebString& returnValue);
 
-    bool executeJavaScriptFunction(const std::vector<std::string> &script, const std::vector<std::string> &args, JavaScriptDataType& returnType, WebString& returnValue);
+    void executeJavaScriptFunction(const std::vector<std::string> &function, const std::vector<JavaScriptVariant> &args, JavaScriptVariant& returnValue);
 
     void initializeIconDataBase();
 
@@ -117,6 +119,8 @@ public:
     void prepareToDestroy();
 
     void enableCrossSiteXHR();
+    void addOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains);
+    void removeOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains);
 
     void reload();
     void reloadFromCache();
@@ -177,6 +181,8 @@ public:
 
     BackingStore* backingStore() const;
 
+    InRegionScroller* inRegionScroller() const;
+
     bool zoomToFit();
     bool zoomToOneOne();
     void zoomToInitialScale();
@@ -299,7 +305,7 @@ public:
     void goToBackForwardEntry(BackForwardId);
 
     int backForwardListLength() const;
-    void getBackForwardList(SharedArray<BackForwardEntry>& result, unsigned& resultLength) const;
+    void getBackForwardList(SharedArray<BackForwardEntry>& result) const;
     void releaseBackForwardEntry(BackForwardId) const;
     void clearBackForwardList(bool keepCurrentPage) const;
 
diff --git a/Source/WebKit/blackberry/Api/WebPageClient.h b/Source/WebKit/blackberry/Api/WebPageClient.h
index 96fba7a52..0da7318b2 100644
--- a/Source/WebKit/blackberry/Api/WebPageClient.h
+++ b/Source/WebKit/blackberry/Api/WebPageClient.h
@@ -167,9 +167,9 @@ public:
     virtual void openDateTimePopup(int type, const WebString& value, const WebString& min, const WebString& max, double step) = 0;
     virtual void openColorPopup(const WebString& value) = 0;
 
-    virtual bool chooseFilenames(bool allowMultiple, const WebString& acceptTypes, const SharedArray<WebString>& initialFiles, unsigned initialFileSize, SharedArray<WebString>& chosenFiles, unsigned& chosenFileSize) = 0;
+    virtual bool chooseFilenames(bool allowMultiple, const SharedArray<WebString>& acceptTypes, const SharedArray<WebString>& initialFiles, const WebString& capture, SharedArray<WebString>& chosenFiles) = 0;
 
-    virtual void loadPluginForMimetype(int, int width, int height, const SharedArray<WebString>& paramNames, const SharedArray<WebString>& paramValues, int size, const char* url) = 0;
+    virtual void loadPluginForMimetype(int, int width, int height, const SharedArray<WebString>& paramNames, const SharedArray<WebString>& paramValues, const char* url) = 0;
     virtual void notifyPluginRectChanged(int, Platform::IntRect rectChanged) = 0;
     virtual void destroyPlugin(int) = 0;
     virtual void playMedia(int) = 0;
@@ -187,7 +187,7 @@ public:
     virtual unsigned long long databaseQuota(const unsigned short* origin, unsigned originLength, const unsigned short* databaseName, unsigned databaseNameLength, unsigned long long totalUsage, unsigned long long originUsage, unsigned long long estimatedSize) = 0;
 
     virtual void setIconForUrl(const char* originalPageUrl, const char* finalPageUrl, const char* iconUrl) = 0;
-    virtual void setFavicon(int width, int height, unsigned char* iconData, const char* url) = 0;
+    virtual void setFavicon(const char* dataInBase64, const char* url) = 0;
     virtual void setLargeIcon(const char* iconUrl) = 0;
     virtual void setWebAppCapable() = 0;
     virtual void setSearchProviderDetails(const char* title, const char* documentUrl) = 0;
diff --git a/Source/WebKit/blackberry/Api/WebPage_p.h b/Source/WebKit/blackberry/Api/WebPage_p.h
index 4ca76d39c..271ed0a39 100644
--- a/Source/WebKit/blackberry/Api/WebPage_p.h
+++ b/Source/WebKit/blackberry/Api/WebPage_p.h
@@ -20,10 +20,12 @@
 #define WebPage_p_h
 
 #include "ChromeClient.h"
+#include "InRegionScroller.h"
 #include "InspectorClientBlackBerry.h"
 #include "InspectorOverlay.h"
 #if USE(ACCELERATED_COMPOSITING)
 #include "GLES2Context.h"
+#include "GraphicsLayerClient.h"
 #include "LayerRenderer.h"
 #include <EGL/egl.h>
 #endif
@@ -82,7 +84,12 @@ class WebPageCompositorPrivate;
 // In WebPagePrivate, the screen size is called the transformedViewportSize,
 // the viewport position is called the transformedScrollPosition,
 // and the viewport size is called the transformedActualVisibleSize.
-class WebPagePrivate : public PageClientBlackBerry, public WebSettingsDelegate, public Platform::GuardedPointerBase {
+class WebPagePrivate : public PageClientBlackBerry
+                     , public WebSettingsDelegate
+#if USE(ACCELERATED_COMPOSITING)
+                     , public WebCore::GraphicsLayerClient
+#endif
+                     , public Platform::GuardedPointerBase {
 public:
     enum ViewMode { Mobile, Desktop, FixedDesktop };
     enum LoadState { None /* on instantiation of page */, Provisional, Committed, Finished, Failed };
@@ -106,6 +113,8 @@ public:
     void prepareToDestroy();
 
     void enableCrossSiteXHR();
+    void addOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains);
+    void removeOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains);
 
     LoadState loadState() const { return m_loadState; }
     bool isLoading() const { return m_loadState == WebPagePrivate::Provisional || m_loadState == WebPagePrivate::Committed; }
@@ -126,7 +135,7 @@ public:
     WebCore::IntPoint calculateReflowedScrollPosition(const WebCore::FloatPoint& anchorOffset, double inverseScale);
     void setTextReflowAnchorPoint(const Platform::IntPoint& focalPoint);
 
-    void schedulePinchZoomAboutPoint(double scale, const WebCore::IntPoint& anchor);
+    void restoreHistoryViewState(Platform::IntSize contentsSize, Platform::IntPoint scrollPosition, double scale, bool shouldReflowBlock);
 
     // Perform actual zoom for block zoom.
     void zoomBlock();
@@ -141,7 +150,6 @@ public:
     bool scrollBy(int deltaX, int deltaY, bool scrollMainFrame = true);
 
     void enqueueRenderingOfClippedContentOfScrollableNodeAfterInRegionScrolling(WebCore::Node*);
-    std::vector<Platform::ScrollViewBase*> inRegionScrollableAreasForPoint(const Platform::IntPoint&);
     void notifyInRegionScrollStatusChanged(bool status);
     void setScrollOriginPoint(const Platform::IntPoint&);
     void setHasInRegionScrollableAreas(bool);
@@ -328,13 +336,6 @@ public:
     WebCore::Frame* focusedOrMainFrame() const;
     WebCore::Frame* mainFrame() const { return m_mainFrame; }
 
-    bool scrollNodeRecursively(WebCore::Node* originalNode, const WebCore::IntSize& delta);
-    bool scrollRenderer(WebCore::RenderObject* renderer, const WebCore::IntSize& delta);
-    void adjustScrollDelta(const WebCore::IntPoint& maxOffset, const WebCore::IntPoint& currentOffset, WebCore::IntSize& delta) const;
-
-    bool canScrollRenderBox(WebCore::RenderBox*);
-    bool canScrollInnerFrame(WebCore::Frame*) const;
-
 #if ENABLE(EVENT_MODE_METATAGS)
     void didReceiveCursorEventMode(WebCore::CursorEventMode);
     void didReceiveTouchEventMode(WebCore::TouchEventMode);
@@ -391,6 +392,13 @@ public:
     WebCore::LayerRenderingResults lastCompositingResults() const;
     WebCore::GraphicsLayer* overlayLayer();
 
+    // Fallback GraphicsLayerClient implementation, used for various overlay layers.
+    virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
+    virtual void notifySyncRequired(const WebCore::GraphicsLayer*);
+    virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip) { }
+    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
+    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
+
     // WebKit thread, plumbed through from ChromeClientBlackBerry.
     void setRootLayerWebKitThread(WebCore::Frame*, WebCore::LayerWebKitThread*);
     void setNeedsOneShotDrawingSynchronization();
@@ -415,6 +423,8 @@ public:
     void suspendRootLayerCommit();
     void resumeRootLayerCommit();
     void blitVisibleContents();
+
+    void scheduleCompositingRun();
 #endif
 
     bool dispatchTouchEventToFullScreenPlugin(WebCore::PluginView*, const Platform::TouchEvent&);
@@ -446,7 +456,7 @@ public:
 
     void deferredTasksTimerFired(WebCore::Timer<WebPagePrivate>*);
 
-    void setInspectorOverlayClient(WebCore::InspectorOverlay::InspectorOverlayClient*);
+    void setInspectorOverlayClient(InspectorOverlay::InspectorOverlayClient*);
 
     void applySizeOverride(int overrideWidth, int overrideHeight);
     void setTextZoomFactor(float);
@@ -508,9 +518,6 @@ public:
 #endif
 
 #if ENABLE(FULLSCREEN_API)
-#if ENABLE(EVENT_MODE_METATAGS)
-    WebCore::TouchEventMode m_touchEventModePriorGoingFullScreen;
-#endif
 #if ENABLE(VIDEO)
     double m_scaleBeforeFullScreen;
     int m_xScrollOffsetBeforeFullScreen;
@@ -554,7 +561,7 @@ public:
 
     HashSet<WebCore::PluginView*> m_pluginViews;
 
-    RefPtr<WebCore::Node> m_inRegionScrollStartingNode;
+    OwnPtr<InRegionScroller> m_inRegionScroller;
 
 #if USE(ACCELERATED_COMPOSITING)
     bool m_isAcceleratedCompositingActive;
@@ -587,7 +594,7 @@ public:
     RefPtr<WebCore::DOMWrapperWorld> m_isolatedWorld;
     bool m_hasInRegionScrollableAreas;
     bool m_updateDelegatedOverlaysDispatched;
-    OwnPtr<WebCore::InspectorOverlay> m_inspectorOverlay;
+    OwnPtr<InspectorOverlay> m_inspectorOverlay;
 
     // There is no need to initialize the following members in WebPagePrivate's constructor,
     // because they are only used by WebPageTasks and the tasks will initialize them when
diff --git a/Source/WebKit/blackberry/Api/WebSettings.cpp b/Source/WebKit/blackberry/Api/WebSettings.cpp
index dd3a9c49a..de6f505d7 100644
--- a/Source/WebKit/blackberry/Api/WebSettings.cpp
+++ b/Source/WebKit/blackberry/Api/WebSettings.cpp
@@ -161,6 +161,7 @@ WebSettings* WebSettings::standardSettings()
     settings = new WebSettings;
     settings->m_private->impl = new WebSettingsPrivate::WebSettingsPrivateImpl();
     settings->m_private->copyOnWrite = false;
+    settings->m_private->setBoolean(BlackBerryAllowCrossSiteRequests, false);
     settings->m_private->setUnsigned(BlackBerryBackgroundColor, WebCore::Color::white);
     settings->m_private->setBoolean(BlackBerryCookiesEnabled, true);
     settings->m_private->setDouble(BlackBerryInitialScale, -1);
diff --git a/Source/WebKit/blackberry/ChangeLog b/Source/WebKit/blackberry/ChangeLog
index ffaee6de6..ad8655511 100644
--- a/Source/WebKit/blackberry/ChangeLog
+++ b/Source/WebKit/blackberry/ChangeLog
@@ -1,3 +1,820 @@
+2012-08-10  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Introduce JavaScriptVariant object.
+        https://bugs.webkit.org/show_bug.cgi?id=93644
+
+        The JavaScriptVariant can be used for functions that return results from
+        JavaScript such as executeJavaScript or functions that take arguments
+        to pass a variable to JavaScript and they want to make sure the type
+        is correct.
+
+        Convert executeJavaScriptFunction() to use this data type as the
+        example, other functions will be converted in the future.
+
+        PR 14929
+
+        Internally reviewed by Joe Mason
+        Reviewed by Adam Treat
+
+        * Api/JavaScriptVariant.cpp: Added.
+        (WebKit):
+        (BlackBerry::WebKit::JSValueRefToBlackBerryJavaScriptVariant):
+        (BlackBerry::WebKit::BlackBerryJavaScriptVariantToJSValueRef):
+        (BlackBerry::WebKit::JavaScriptVariant::JavaScriptVariant):
+        (BlackBerry::WebKit::JavaScriptVariant::~JavaScriptVariant):
+        (BlackBerry::WebKit::JavaScriptVariant::operator=):
+        (BlackBerry::WebKit::JavaScriptVariant::setType):
+        (BlackBerry::WebKit::JavaScriptVariant::type):
+        (BlackBerry::WebKit::JavaScriptVariant::setDouble):
+        (BlackBerry::WebKit::JavaScriptVariant::doubleValue):
+        (BlackBerry::WebKit::JavaScriptVariant::setString):
+        (BlackBerry::WebKit::JavaScriptVariant::stringValue):
+        (BlackBerry::WebKit::JavaScriptVariant::setBoolean):
+        (BlackBerry::WebKit::JavaScriptVariant::booleanValue):
+        * Api/JavaScriptVariant.h: Added.
+        (WebKit):
+        * Api/JavaScriptVariant_p.h: Added.
+        (WebKit):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::executeJavaScriptFunction):
+        * Api/WebPage.h:
+
+2012-08-09  Leo Yang  <leoyang@rim.com>
+
+        [BlackBerry] Export InRegionScroller to fix build
+        https://bugs.webkit.org/show_bug.cgi?id=93635
+
+        Reviewed by Antonio Gomes.
+
+        Build fix.
+
+        * Api/InRegionScroller.h:
+
+2012-08-08  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] Implement about:memory-live
+        https://bugs.webkit.org/show_bug.cgi?id=93153
+
+        Reviewed by Yong Li.
+        Patch by Jacky Jiang  <zhajiang@rim.com>
+
+        Implementing about:memory-live to track memory peaks:
+        - about:memory-live/start: start tracking memory peaks.
+        - about:memory-live: show memory peaks every 30ms.
+        - about:memory-live/stop: stop tracking and show memory peaks.
+
+        Mainly track the following memory peaks:
+        - Total used memory (malloc + JSC).
+        - Total committed memory.
+        - Total mapped memory.
+
+        Add total committed memory for about:memory
+
+        * WebKitSupport/AboutData.cpp:
+        (BlackBerry::WebKit::memoryPage):
+        (WebKit):
+        (MemoryTracker):
+        (BlackBerry::WebKit::MemoryTracker::isActive):
+        (BlackBerry::WebKit::MemoryTracker::clear):
+        (BlackBerry::WebKit::MemoryTracker::peakTotalUsedMemory):
+        (BlackBerry::WebKit::MemoryTracker::peakTotalCommittedMemory):
+        (BlackBerry::WebKit::MemoryTracker::peakTotalMappedMemory):
+        (BlackBerry::WebKit::MemoryTracker::MemoryTracker):
+        (BlackBerry::WebKit::MemoryTracker::instance):
+        (BlackBerry::WebKit::MemoryTracker::start):
+        (BlackBerry::WebKit::MemoryTracker::stop):
+        (BlackBerry::WebKit::MemoryTracker::updateMemoryPeaks):
+        (BlackBerry::WebKit::memoryPeaksToHtmlTable):
+        (BlackBerry::WebKit::memoryLivePage):
+        (BlackBerry::WebKit::aboutData):
+
+2012-08-08  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Tie up the scrolling machinery to the graphics tree when applicable for in-region scroll
+        https://bugs.webkit.org/show_bug.cgi?id=93482
+        PR #187672
+        Make InRegionScroller a simple public webkit/ API
+        PR #188677
+
+        Reviewed by Rob Buis.
+
+        In order to prepare InRegionScroller to be a public API
+        in webkit/, the patch:
+
+        1) Renamed the current InRegionScroller class to InRegionScrollerPrivate;
+        2) Moved InRegionScroller.cpp|h from WebKitSupport/ to Api/;
+        3) Renamed InRegionScroller.h to InRegionScroller_p.h;
+        4) Added a new public class implementation to InRegionScroller.h;
+        5) Adapted WebPage and TouchEventHandler classes to use InRegionScroller::d directly.
+
+        The most important API here is '::compositedSetScrollPosition'
+
+        It is a  UI/Compositing thread method only and sets the associated LayerCompositingThread
+        (camouflaged as a unsigned) for each created InRegionScrollableArea that supports
+        composited scrolling.
+
+        The way ::compositedSetScrollPosition "scrolls" a layer is by setting the boundsOrigin
+        property to the LayerCompositingThread's 'override' property in the UI/Compositing thread.
+
+        * Api/InRegionScroller.cpp: Renamed from Source/WebKit/blackberry/WebKitSupport/InRegionScroller.cpp.
+        (WebKit):
+        (BlackBerry::WebKit::InRegionScroller::InRegionScroller):
+        (BlackBerry::WebKit::InRegionScroller::~InRegionScroller):
+        (BlackBerry::WebKit::InRegionScroller::compositedSetScrollPosition):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::InRegionScrollerPrivate):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::setNode):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::node):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::reset):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::hasNode):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::canScroll):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::compositedSetScrollPosition):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::scrollBy):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::inRegionScrollableAreasForPoint):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::scrollNodeRecursively):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::scrollRenderer):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::adjustScrollDelta):
+        (BlackBerry::WebKit::canScrollInnerFrame):
+        (BlackBerry::WebKit::canScrollRenderBox):
+        (BlackBerry::WebKit::parentLayer):
+        (BlackBerry::WebKit::enclosingLayerNode):
+        (BlackBerry::WebKit::isNonRenderViewFixedPositionedContainer):
+        (BlackBerry::WebKit::pushBackInRegionScrollable):
+        * Api/InRegionScroller.h: Copied from Source/WebKit/blackberry/WebKitSupport/InRegionScroller.h.
+        (WebKit):
+        (InRegionScroller):
+        * Api/InRegionScroller_p.h: Renamed from Source/WebKit/blackberry/WebKitSupport/InRegionScroller.h.
+        (WebCore):
+        (WebKit):
+        (InRegionScrollerPrivate):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::scrollBy):
+        (BlackBerry::WebKit::WebPagePrivate::notifyInRegionScrollStatusChanged):
+        (BlackBerry::WebKit::WebPagePrivate::clearDocumentData):
+        (BlackBerry::WebKit::WebPagePrivate::setScrollOriginPoint):
+        (BlackBerry::WebKit::WebPage::inRegionScroller):
+        (WebKit):
+        * Api/WebPage.h:
+        (WebKit):
+        * WebKitSupport/InRegionScrollableArea.cpp:
+        (BlackBerry::WebKit::InRegionScrollableArea::InRegionScrollableArea):
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::drawTapHighlight):
+
+2012-08-08  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Make WebOverlayPrivate::scheduleCompositingRun a WebPagePrivate method.
+        https://bugs.webkit.org/show_bug.cgi?id=93480
+        PR #188682
+
+        Reviewed by Rob Buis.
+
+        ... this way it can be used by others.
+
+        No behavioural change. Another preparation patch.
+
+        * Api/WebOverlay.cpp:
+        (BlackBerry::WebKit::WebOverlayPrivate::scheduleCompositingRun):
+        * Api/WebPage.cpp:
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::scheduleCompositingRun):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+
+2012-08-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124887.
+        http://trac.webkit.org/changeset/124887
+        https://bugs.webkit.org/show_bug.cgi?id=93504
+
+        Dependent API being removed. (Requested by mfenton on
+        #webkit).
+
+        * Api/WebPageClient.h:
+        * WebKitSupport/InputHandler.cpp:
+        * WebKitSupport/InputHandler.h:
+        (InputHandler):
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):
+        (BlackBerry::WebKit::TouchEventHandler::spellCheck):
+        (WebKit):
+        * WebKitSupport/TouchEventHandler.h:
+        (TouchEventHandler):
+
+2012-08-08  Ed Baker  <edbaker@rim.com>
+
+        [BlackBerry] Add relayout after updating fixed reported size
+        https://bugs.webkit.org/show_bug.cgi?id=93116
+        PR #160059
+        
+        Reviewed by Antonio Gomes.
+        
+        Reviewed internally by Antonio Gomes.
+
+        On an orientation change and after fixed reported size is
+        updated perform a layout and update the fixed elements after
+        scrolling. This will recalculate the height and width of
+        fixed position elements using percentage values with the
+        new fixed reported size. Otherwise using the old fixed reported
+        size in the new orientation overflowing or clipping could occur.
+        
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setViewportSize):
+
+2012-08-07  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] always set PolicyAction to PolicyIgnore if the chrome returns false for acceptNavigationRequest
+        https://bugs.webkit.org/show_bug.cgi?id=93251
+
+        Reviewed by George Staikos.
+
+        In acceptNavigationRequest(), webkit will ask if the chrome will accept the navigation request.
+        We will take this chance to see if the request is an internal-webkit protocol, otherwise,
+        we will try to launch an external application to handle the request, and ask webkit to ignore
+        the request by returning false in acceptNavigationRequest().
+
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDecidePolicyForNavigationAction):
+
+2012-08-07  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Change how devicePixelRatio is set.
+        https://bugs.webkit.org/show_bug.cgi?id=93385
+
+        Reviewed by Antonio Gomes.
+
+        Change devicePixelRatio to be set immediately after the page is created based
+        on the WebSetting.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::init):
+        (BlackBerry::WebKit::WebPagePrivate::recomputeVirtualViewportFromViewportArguments):
+
+2012-08-07  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] [FullScreen] No need to scroll 'x' to 0 before entering fullscreen
+        https://bugs.webkit.org/show_bug.cgi?id=91750
+        PR #178293
+
+        Reviewed by Rob Buis.
+
+        We are not adjusting the 'left' CSS property of the fullscreen wrapper
+        properly, so no need to scroll 'x' to 0 anymore.
+
+        Internally reviewed by Jacky Jiang.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::enterFullScreenForElement):
+
+2012-08-07  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry][FullScreen] Remove the set/reset of touch modes code when entering/leaving fullscreen
+        https://bugs.webkit.org/show_bug.cgi?id=92520
+        PR #184511
+
+        Reviewed by Yong Li.
+        Internally reviewed by Gen Mak.
+
+        Remove touch mode set/reset when entering/leaving fullscreen
+        for media elements through the new FULLSCREEN_API code path.
+        The client now handles it.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+        (BlackBerry::WebKit::WebPagePrivate::enterFullScreenForElement):
+        (BlackBerry::WebKit::WebPagePrivate::exitFullScreenForElement):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+
+2012-08-07  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Add missing include in FrameLoaderClienBlackBerry after Base64 moved.
+        https://bugs.webkit.org/show_bug.cgi?id=93383
+
+        Reviewed by Rob Buis.
+
+        Base64 moved from platform/text to wtf/text, need to add mssing
+        include.
+
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+
+2012-08-07  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] InspectorOverlay class duplicated in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=93124
+
+        Reviewed by Rob Buis.
+
+        Moved files to better align with namespace names.
+
+        * WebKitSupport/InspectorOverlay.cpp: Renamed from Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.cpp.
+        (WebKit):
+        (BlackBerry::WebKit::InspectorOverlay::create):
+        (BlackBerry::WebKit::InspectorOverlay::InspectorOverlay):
+        (BlackBerry::WebKit::InspectorOverlay::notifySyncRequired):
+        (BlackBerry::WebKit::InspectorOverlay::paintContents):
+        (BlackBerry::WebKit::InspectorOverlay::showDebugBorders):
+        (BlackBerry::WebKit::InspectorOverlay::showRepaintCounter):
+        (BlackBerry::WebKit::InspectorOverlay::~InspectorOverlay):
+        (BlackBerry::WebKit::InspectorOverlay::clear):
+        (BlackBerry::WebKit::InspectorOverlay::update):
+        * WebKitSupport/InspectorOverlay.h: Renamed from Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.h.
+        (WebCore):
+        (WebKit):
+        (InspectorOverlay):
+        (InspectorOverlayClient):
+        (BlackBerry::WebKit::InspectorOverlay::setClient):
+        (BlackBerry::WebKit::InspectorOverlay::notifyAnimationStarted):
+
+2012-08-07  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Update API for spell checking suggestions.
+        https://bugs.webkit.org/show_bug.cgi?id=93356
+
+        Reviewed by Antonio Gomes.
+
+        PR 163283.
+
+        Add connections for updated spell checking options request API.  Move
+        all this logic into InputHandler.
+
+        Reviewed Internally by Gen Mak and Nima Ghanavatian.
+
+        * Api/WebPageClient.h:
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::shouldRequestSpellCheckingOptionsForPoint):
+        (WebKit):
+        (BlackBerry::WebKit::InputHandler::requestSpellingCheckingOptions):
+        * WebKitSupport/InputHandler.h:
+        (Platform):
+        (InputHandler):
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):
+        * WebKitSupport/TouchEventHandler.h:
+        (TouchEventHandler):
+
+2012-08-06  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] About: shows PAGE_CACHE not enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=93216
+
+        Reviewed by Antonio Gomes.
+
+        Page cache is a feature that can be enabled/disabled at runtime, there's no
+        MACRO named PAGE_CACHE to control the feature.
+
+        * WebCoreSupport/AboutDataEnableFeatures.in:
+
+2012-08-03  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] FrameLoaderClient::restoreViewState() shouldn't trigger painting
+        https://bugs.webkit.org/show_bug.cgi?id=93141
+
+        Reviewed by Rob Buis.
+
+        PR# 172041.
+        It is not always safe to render the page at this point. So we post a message
+        instead.
+
+        * Api/WebPage.cpp:
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::restoreHistoryViewState):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::restoreViewState):
+
+2012-08-03  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] InspectorOverlay class duplicated in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=93124
+
+        Reviewed by Rob Buis.
+
+        Changed namespace of InspectorOverlay from WebCore to
+        BlackBerry::WebKit
+
+        * Api/WebPage.cpp:
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::setInspectorOverlayClient):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebCoreSupport/InspectorClientBlackBerry.h:
+        * WebCoreSupport/InspectorOverlay.cpp:
+        (BlackBerry::WebKit::InspectorOverlay::create):
+        (BlackBerry::WebKit::InspectorOverlay::InspectorOverlay):
+        (BlackBerry::WebKit::InspectorOverlay::notifySyncRequired):
+        (BlackBerry::WebKit::InspectorOverlay::paintContents):
+        (BlackBerry::WebKit::InspectorOverlay::showDebugBorders):
+        (BlackBerry::WebKit::InspectorOverlay::showRepaintCounter):
+        (BlackBerry::WebKit::InspectorOverlay::contentsVisible):
+        (BlackBerry::WebKit::InspectorOverlay::update):
+        * WebCoreSupport/InspectorOverlay.h:
+        (WebKit):
+        (InspectorOverlayClient):
+        (InspectorOverlay):
+        (BlackBerry::WebKit::InspectorOverlay::notifyAnimationStarted):
+
+2012-08-03  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Overlays display checkerboard that doesn't resolve
+        https://bugs.webkit.org/show_bug.cgi?id=93099
+
+        Reviewed by Antonio Gomes.
+
+        The WebKit-thread overlays, like tap highlight, inspector highlight and
+        selection are all part of a separate graphics layer tree rooted in
+        WebPagePrivate::m_overlayLayer.
+
+        When LayerRenderer needs to schedule a commit to reactively render
+        tiles and resolve checkerboard, it does so through the root layer.
+        Since the overlay layer root didn't have a GraphicsLayerClient, there
+        was no implementation of GraphicsLayerClient::notifySyncRequired() to
+        call, and a commit was never scheduled, thus checkerboard never
+        resolved.
+
+        Fixed by adding a fallback implementation of GraphicsLayerClient in
+        WebPagePrivate and hooking up the overlay root to it. Also, this
+        implementation can be shared by the various overlays to avoide code
+        duplication, specifically to implement notifySyncRequired(),
+        showDebugBorders() and showRepaintCounter() only once.
+
+        Fixing this revealed a bug where the web page would get stuck in an
+        endless sequence of commits. It turned out that
+        WebPagePrivate::updateDelegatedOverlays() was called right in the
+        middle of the commit operation, after performing the webkit thread part
+        of the commit operation but before we continued on the compositing
+        thread. Since updateDelegatedOverlays() typically mutates layers, this
+        is very bad (layers should not be mutated mid-commit). The mutations
+        also cause a new commit to scheduled from within the current, which
+        results in an endless sequence of commits.
+
+        Fixed this latter bug by moving the updateDelegatedOverlays() call to
+        the beginning of the method where it can cause no harm. This is before
+        we mark the web page as no longer needing commit, so even if the
+        implementation flips the "needs commit" bit, we will immediately flip
+        it back and proceed with commit as usual.
+
+        PR 187458, 184377
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::overlayLayer):
+        (BlackBerry::WebKit::WebPagePrivate::commitRootLayerIfNeeded):
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::notifySyncRequired):
+        (BlackBerry::WebKit::WebPagePrivate::showDebugBorders):
+        (BlackBerry::WebKit::WebPagePrivate::showRepaintCounter):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        (BlackBerry::WebKit::WebPagePrivate::notifyAnimationStarted):
+        (BlackBerry::WebKit::WebPagePrivate::paintContents):
+        * WebCoreSupport/InspectorOverlay.cpp:
+        (WebCore::InspectorOverlay::notifySyncRequired):
+        (WebCore::InspectorOverlay::showDebugBorders):
+        (WebCore::InspectorOverlay::showRepaintCounter):
+        * WebKitSupport/DefaultTapHighlight.cpp:
+        (BlackBerry::WebKit::DefaultTapHighlight::notifySyncRequired):
+        (BlackBerry::WebKit::DefaultTapHighlight::showDebugBorders):
+        (WebKit):
+        (BlackBerry::WebKit::DefaultTapHighlight::showRepaintCounter):
+        * WebKitSupport/DefaultTapHighlight.h:
+        (DefaultTapHighlight):
+        * WebKitSupport/SelectionOverlay.cpp:
+        (BlackBerry::WebKit::SelectionOverlay::notifySyncRequired):
+        (BlackBerry::WebKit::SelectionOverlay::showDebugBorders):
+        (WebKit):
+        (BlackBerry::WebKit::SelectionOverlay::showRepaintCounter):
+        * WebKitSupport/SelectionOverlay.h:
+        (SelectionOverlay):
+
+2012-08-02  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Add default implementation of GraphicsLayerClient::contentsVisible()
+        https://bugs.webkit.org/show_bug.cgi?id=93036
+
+        Reviewed by George Staikos.
+
+        Remove implementation of GraphicsLayerClient::contentsVisible() now
+        that it has a default implementation.
+
+        This also fixes a bug where memory usage for the inspector highlight
+        overlay would balloon because it returned true from contentsVisible()
+        which would cause the LayerTiler to populate all tiles. The default
+        implementation returns false instead.
+
+        PR 187458, 184377
+
+        * WebCoreSupport/InspectorOverlay.cpp:
+        (WebCore::InspectorOverlay::showRepaintCounter):
+        * WebCoreSupport/InspectorOverlay.h:
+        (InspectorOverlay):
+        * WebKitSupport/DefaultTapHighlight.h:
+        * WebKitSupport/SelectionOverlay.h:
+
+2012-08-02  Antonio Gomes  <agomes@rim.com>
+
+        Unreviewed debug build fix (bug 92889)
+
+        * WebKitSupport/InRegionScroller.cpp:
+        (BlackBerry::WebKit::pushBackInRegionScrollable):
+
+2012-08-02  Leo Yang  <leoyang@rim.com>
+
+        [BlackBerry] Rounding error of destination rect of checkerboard
+        https://bugs.webkit.org/show_bug.cgi?id=93012
+
+        Reviewed by Rob Buis.
+
+        Reviewed internally by Jakob Petsovits.
+
+        Intersect with the destination rectangle to eliminate the rounding error.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::blitContents):
+
+2012-08-01  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Implement InRegionScroller class as a in-region scroll controller
+        https://bugs.webkit.org/show_bug.cgi?id=92889
+        PR #186587
+
+        Reviewed by Yong Li.
+
+        Internally reviewed by Arvid Nilsson.
+
+        Moved all in-region scrolling code out of WebPagePrivate to the just
+        created InRegionScroller class. This class aims to:
+
+        1) Centralize all in-region scroll code and clean up WebPagePrivate as a consequence.
+        2) Be the bases to add UI/Compositing thread driven scrolls to in-region.
+
+        The patch does not change any functionallity change.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+        (BlackBerry::WebKit::WebPagePrivate::init):
+        (BlackBerry::WebKit::WebPagePrivate::scrollBy):
+        (BlackBerry::WebKit::WebPagePrivate::notifyInRegionScrollStatusChanged):
+        (BlackBerry::WebKit::WebPagePrivate::clearDocumentData):
+        (BlackBerry::WebKit::WebPagePrivate::setScrollOriginPoint):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebKitSupport/InRegionScrollableArea.cpp:
+        (BlackBerry::WebKit::InRegionScrollableArea::layer):
+        * WebKitSupport/InRegionScroller.cpp: Added.
+        (WebKit):
+        (BlackBerry::WebKit::canScrollInnerFrame):
+        (BlackBerry::WebKit::canScrollRenderBox):
+        (BlackBerry::WebKit::parentLayer):
+        (BlackBerry::WebKit::enclosingLayerNode):
+        (BlackBerry::WebKit::isNonRenderViewFixedPositionedContainer):
+        (BlackBerry::WebKit::pushBackInRegionScrollable):
+        (BlackBerry::WebKit::InRegionScroller::InRegionScroller):
+        (BlackBerry::WebKit::InRegionScroller::setNode):
+        (BlackBerry::WebKit::InRegionScroller::node):
+        (BlackBerry::WebKit::InRegionScroller::reset):
+        (BlackBerry::WebKit::InRegionScroller::isNull):
+        (BlackBerry::WebKit::InRegionScroller::scrollBy):
+        (BlackBerry::WebKit::InRegionScroller::inRegionScrollableAreasForPoint):
+        (BlackBerry::WebKit::InRegionScroller::scrollNodeRecursively):
+        (BlackBerry::WebKit::InRegionScroller::scrollRenderer):
+        (BlackBerry::WebKit::InRegionScroller::adjustScrollDelta):
+        * WebKitSupport/InRegionScroller.h: Added.
+        (WebCore):
+        (WebKit):
+        (InRegionScroller):
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::drawTapHighlight):
+
+2012-08-01  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Favicon should be Base64 encoded for cross-process passing
+        https://bugs.webkit.org/show_bug.cgi?id=92857
+
+        Reviewed by George Staikos.
+
+        The current implementation just passes the internal of SkPixels data to the client,
+        which can't be passed accross the process boundary to chrome for processing.
+        This patch makes the favicon Base64 encoded so that can be passed to chrome in another process.
+
+        * Api/WebPageClient.h:
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDidReceiveIcon):
+
+2012-08-01  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] Allow client side to add and remove origin access whitelist entries
+        https://bugs.webkit.org/show_bug.cgi?id=92790
+
+        Reviewed by Yong Li.
+
+        PR: 172658
+        Add two new APIs to add and remove origin access whitelist entries.
+        Initialize the BlackBerryAllowCrossSiteRequests WebSetting to false.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::addOriginAccessWhitelistEntry):
+        (WebKit):
+        (BlackBerry::WebKit::WebPage::addOriginAccessWhitelistEntry):
+        (BlackBerry::WebKit::WebPagePrivate::removeOriginAccessWhitelistEntry):
+        (BlackBerry::WebKit::WebPage::removeOriginAccessWhitelistEntry):
+        * Api/WebPage.h:
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * Api/WebSettings.cpp:
+        (BlackBerry::WebKit::WebSettings::standardSettings):
+
+2012-08-01  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Consolidate suppression of keyboard requests.
+        https://bugs.webkit.org/show_bug.cgi?id=92871
+
+        Reviewed by Antonio Gomes.
+
+        Reduce VKB requests even more by applying the filter on
+        all requests during processing.
+
+        Reviewed Internally by Gen Mak.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::focusedNodeChanged):
+        (BlackBerry::WebKit::InputHandler::notifyClientOfKeyboardVisibilityChange):
+
+2012-08-01  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Disable tap highlight when transparent color is specified
+        https://bugs.webkit.org/show_bug.cgi?id=92849
+
+        Reviewed by Antonio Gomes.
+
+        When the web page specifies -webkit-tap-highlight-color:rgba(0,0,0,0)
+        or any color with alpha value 0, we should disable the tap highlight.
+
+        * WebKitSupport/DefaultTapHighlight.cpp:
+        (BlackBerry::WebKit::DefaultTapHighlight::draw):
+
+2012-07-31  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Pass all file chooser settings to clients
+        https://bugs.webkit.org/show_bug.cgi?id=92237
+
+        Reviewed by Rob Buis.
+
+        Expose all file chooser settings to clients.
+
+        * Api/WebPageClient.h:
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::runOpenPanel):
+
+2012-07-31  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Fix crash in InputHandler spell checking.
+        https://bugs.webkit.org/show_bug.cgi?id=92763
+
+        Reviewed by Antonio Gomes.
+
+        PR 185574.
+
+        Fix crash in getSpellChecker by guarding the calling paths
+        to ensure that m_currentFocusElement is valid.
+
+        Also add ASSERTs for previous crash.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::spellCheckingRequestProcessed):
+        (BlackBerry::WebKit::InputHandler::spellCheckingRequestCancelled):
+        (BlackBerry::WebKit::InputHandler::getSpellChecker):
+
+2012-07-31  Genevieve Mak  <gmak@rim.com>
+
+        Send an onContextMenu event to the page content
+        so that context menus can be prevented. We use
+        the node's event handler because we want to use
+        the fat finger's node. If we use  the EventHandler's
+        sendContextMenuEvent it will hit test with the mouse
+        position which may not be what we want.
+        PR #184032
+        https://bugs.webkit.org/show_bug.cgi?id=92766
+
+        Reviewed by Antonio Gomes.
+        Reviewed Internally by Antonio Gomes.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::webContext):
+        (BlackBerry::WebKit::WebPagePrivate::contextNode):
+
+2012-07-31  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Backing store output flickers when using WebPageCompositor
+        https://bugs.webkit.org/show_bug.cgi?id=90291
+
+        Reviewed by Antonio Gomes.
+
+        The backing store doesn't know when the API client swaps the buffers,
+        so it doesn't know when to signal the blit generation condition
+        variable. Fixed by using EGL fence sync instead, when available, so we
+        don't have to know.
+
+        Reviewed internally by Filip Spacek.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::BackingStorePrivate):
+        (BlackBerry::WebKit::BackingStorePrivate::~BackingStorePrivate):
+        (BlackBerry::WebKit::BackingStorePrivate::render):
+        (BlackBerry::WebKit::BackingStorePrivate::blitContents):
+        (BlackBerry::WebKit::BackingStorePrivate::compositeContents):
+        * Api/BackingStore_p.h:
+        (BackingStorePrivate):
+        * WebKitSupport/BackingStoreTile.cpp:
+        (BlackBerry::WebKit::TileBuffer::TileBuffer):
+        * WebKitSupport/BackingStoreTile.h:
+        (BlackBerry::WebKit::TileBuffer::syncObject):
+        (BlackBerry::WebKit::TileBuffer::setSyncObject):
+        (TileBuffer):
+        * WebKitSupport/SurfacePool.cpp:
+        (WebKit):
+        (BlackBerry::WebKit::SurfacePool::SurfacePool):
+        (BlackBerry::WebKit::SurfacePool::initialize):
+        (BlackBerry::WebKit::SurfacePool::waitForBuffer):
+        (BlackBerry::WebKit::SurfacePool::notifyBuffersComposited):
+        * WebKitSupport/SurfacePool.h:
+        (SurfacePool):
+
+2012-07-30  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Get rid of Element::isReadOnlyFormControl other than CSS related
+        https://bugs.webkit.org/show_bug.cgi?id=92612
+
+        Reviewed by Kent Tamura.
+
+        This patch replaces Element::isReadOnlyFormControl() to
+        HTMLFormControlElement::readOnly() for preparation of introducing
+        Element::shouldMatchReadWriteSelector(), bug 92602.
+
+        * WebKitSupport/DOMSupport.cpp:
+        (BlackBerry::WebKit::DOMSupport::isTextBasedContentEditableElement): Replaced isReadOnlyFormControl() by HTMLTextFormControlElement::readOnly().
+
+2012-07-30  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Optimize the generation of selection details generation.
+        https://bugs.webkit.org/show_bug.cgi?id=92522
+
+        Reviewed by Antonio Gomes.
+
+        PR 179264.
+
+        Reduce the number of times we generate selection details notifications.
+
+        This removes several notifications that are handled by the standard
+        notification path and makes skipping duplicate notifications the default
+        so that only those that must generate a response do.
+
+        Reviewed Internally by Gen Mak.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::notifyTransformedContentsSizeChanged):
+        (BlackBerry::WebKit::WebPagePrivate::updateDelegatedOverlays):
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::setElementUnfocused):
+        * WebKitSupport/SelectionHandler.cpp:
+        (BlackBerry::WebKit::SelectionHandler::setCaretPosition):
+        (BlackBerry::WebKit::SelectionHandler::updateOrHandleInputSelection):
+        (BlackBerry::WebKit::SelectionHandler::setSelection):
+        (BlackBerry::WebKit::SelectionHandler::selectionPositionChanged):
+        * WebKitSupport/SelectionHandler.h:
+        (SelectionHandler):
+
+2012-07-30  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Adapt to changes in the SharedArray platform API
+        https://bugs.webkit.org/show_bug.cgi?id=92631
+
+        Reviewed by Rob Buis.
+
+        Adapt to changes in the SharedArray platform API. No behavioural change.
+
+        Reviewed internally by Joe Mason.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::getBackForwardList):
+        * Api/WebPage.h:
+        * Api/WebPageClient.h:
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::runOpenPanel):
+
+2012-07-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Replace UnicodeWinCE with UnicodeWchar
+        https://bugs.webkit.org/show_bug.cgi?id=92539
+
+        Reviewed by Ryosuke Niwa.
+
+        UnicodeWinCE never contained WinCE specific code. UnicodeWchar
+        is a replacement for it, which is mainly based on the functions
+        from <wchar.h>. It is ment as a minimal Unicode backend, which
+        can be used very easy and has no external dependencies.
+
+        * WebCoreSupport/AboutDataUseFeatures.in:
+
 2012-07-27  Eli Fidler  <efidler@rim.com>
 
         [BlackBerry] Adapt to change in the FontInfo platform API.
diff --git a/Source/WebKit/blackberry/WebCoreSupport/AboutDataEnableFeatures.in b/Source/WebKit/blackberry/WebCoreSupport/AboutDataEnableFeatures.in
index 1c1fa37ff..9319c0001 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/AboutDataEnableFeatures.in
+++ b/Source/WebKit/blackberry/WebCoreSupport/AboutDataEnableFeatures.in
@@ -134,7 +134,6 @@ OPCODE_STATS
 ORIENTATION_EVENTS
 OSR_ENTRY
 OVERFLOW_SCROLLING
-PAGE_CACHE
 PAGE_POPUP
 PAGE_VISIBILITY_API
 PAN_SCROLLING
diff --git a/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in b/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in
index 66f957519..ee6a3df2b 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in
+++ b/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in
@@ -111,7 +111,7 @@ WEBAUDIO_IPP
 WEBAUDIO_MKL
 WEBKIT_IMAGE_DECODERS
 WEBP
-WINCE_UNICODE
+WCHAR_UNICODE
 WININET
 WK_SCROLLBAR_PAINTER
 WTFURL
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
index 2b7c8f992..b0dae6097 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
@@ -507,26 +507,36 @@ void ChromeClientBlackBerry::exceededDatabaseQuota(Frame* frame, const String& n
 void ChromeClientBlackBerry::runOpenPanel(Frame*, PassRefPtr<FileChooser> chooser)
 {
     SharedArray<WebString> initialFiles;
-    unsigned int initialFileSize = chooser->settings().selectedFiles.size();
-    if (initialFileSize > 0)
-        initialFiles.reset(new WebString[initialFileSize]);
-    for (unsigned i = 0; i < initialFileSize; ++i)
+    unsigned numberOfInitialFiles = chooser->settings().selectedFiles.size();
+    if (numberOfInitialFiles > 0)
+        initialFiles.reset(new WebString[numberOfInitialFiles], numberOfInitialFiles);
+    for (unsigned i = 0; i < numberOfInitialFiles; ++i)
         initialFiles[i] = chooser->settings().selectedFiles[i];
 
+    SharedArray<WebString> acceptMIMETypes;
+    unsigned numberOfTypes = chooser->settings().acceptMIMETypes.size();
+    if (numberOfTypes > 0)
+        acceptMIMETypes.reset(new WebString[numberOfTypes], numberOfTypes);
+    for (unsigned i = 0; i < numberOfTypes; ++i)
+        acceptMIMETypes[i] = chooser->settings().acceptMIMETypes[i];
+
+    WebString capture;
+#if ENABLE(MEDIA_CAPTURE)
+    capture = chooser->settings().capture;
+#endif
+
     SharedArray<WebString> chosenFiles;
-    unsigned int chosenFileSize;
 
     {
         PageGroupLoadDeferrer deferrer(m_webPagePrivate->m_page, true);
         TimerBase::fireTimersInNestedEventLoop();
 
-        // FIXME: Use chooser->settings().acceptMIMETypes instead of WebString() for the second parameter.
-        if (!m_webPagePrivate->m_client->chooseFilenames(chooser->settings().allowsMultipleFiles, WebString(), initialFiles, initialFileSize, chosenFiles, chosenFileSize))
+        if (!m_webPagePrivate->m_client->chooseFilenames(chooser->settings().allowsMultipleFiles, acceptMIMETypes, initialFiles, capture, chosenFiles))
             return;
     }
 
-    Vector<String> files(chosenFileSize);
-    for (unsigned i = 0; i < chosenFileSize; ++i)
+    Vector<String> files(chosenFiles.length());
+    for (unsigned i = 0; i < chosenFiles.length(); ++i)
         files[i] = chosenFiles[i];
     chooser->chooseFiles(files);
 }
diff --git a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
index cf22ab6ad..90ee06964 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
@@ -58,6 +58,9 @@
 #include "ProtectionSpace.h"
 #include "ScopePointer.h"
 #include "SharedBuffer.h"
+#include "SkData.h"
+#include "SkImageEncoder.h"
+#include "SkStream.h"
 #include "TextEncoding.h"
 #include "TouchEventHandler.h"
 #if ENABLE(WEBDOM)
@@ -65,12 +68,15 @@
 #endif
 #include "WebPageClient.h"
 
+#include <BlackBerryPlatformExecutableMessage.h>
 #include <BlackBerryPlatformLog.h>
 #include <BlackBerryPlatformMediaDocument.h>
+#include <BlackBerryPlatformMessageClient.h>
 #include <BlackBerryPlatformScreen.h>
 #include <JavaScriptCore/APICast.h>
 #include <network/FilterStream.h>
 #include <network/NetworkRequest.h>
+#include <wtf/text/Base64.h>
 
 using WTF::String;
 using namespace WebCore;
@@ -208,24 +214,23 @@ void FrameLoaderClientBlackBerry::dispatchDecidePolicyForNavigationAction(FrameP
         bool isFragmentScroll = url.hasFragmentIdentifier() && url != currentUrl && equalIgnoringFragmentIdentifier(currentUrl, url);
         decision = decidePolicyForExternalLoad(request, isFragmentScroll);
 
-        // Let the client have a chance to say whether this navigation should
-        // be ignored or not.
+        // Let the client have a chance to say whether this navigation should be ignored or not.
         NetworkRequest platformRequest;
         request.initializePlatformRequest(platformRequest, cookiesEnabled());
         if (platformRequest.getTargetType() == NetworkRequest::TargetIsUnknown)
             platformRequest.setTargetType(isMainFrame() ? NetworkRequest::TargetIsMainFrame : NetworkRequest::TargetIsSubframe);
 
-        if (isMainFrame() && !m_webPagePrivate->m_client->acceptNavigationRequest(
-            platformRequest, BlackBerry::Platform::NavigationType(action.type()))) {
-            if (action.type() == NavigationTypeFormSubmitted
-                || action.type() == NavigationTypeFormResubmitted)
-                m_frame->loader()->resetMultipleFormSubmissionProtection();
-
-            if (action.type() == NavigationTypeLinkClicked && url.hasFragmentIdentifier()) {
-                ResourceRequest emptyRequest;
-                m_frame->loader()->activeDocumentLoader()->setLastCheckedRequest(emptyRequest);
-            }
+        if (!m_webPagePrivate->m_client->acceptNavigationRequest(platformRequest, BlackBerry::Platform::NavigationType(action.type()))) {
             decision = PolicyIgnore;
+            if (isMainFrame()) {
+                if (action.type() == NavigationTypeFormSubmitted || action.type() == NavigationTypeFormResubmitted)
+                    m_frame->loader()->resetMultipleFormSubmissionProtection();
+
+                if (action.type() == NavigationTypeLinkClicked && url.hasFragmentIdentifier()) {
+                    ResourceRequest emptyRequest;
+                    m_frame->loader()->activeDocumentLoader()->setLastCheckedRequest(emptyRequest);
+                }
+            }
         }
     }
 
@@ -1082,28 +1087,10 @@ void FrameLoaderClientBlackBerry::restoreViewState()
     // When rotate happens, only zoom when previous page was zoomToFitScale, otherwise keep old scale.
     if (orientationChanged && viewState.isZoomToFitScale)
         scale = BlackBerry::Platform::Graphics::Screen::primaryScreen()->width() * scale / static_cast<double>(BlackBerry::Platform::Graphics::Screen::primaryScreen()->height());
-    m_webPagePrivate->m_backingStore->d->suspendScreenAndBackingStoreUpdates(); // don't flash checkerboard for the setScrollPosition call
-    m_frame->view()->setContentsSizeFromHistory(contentsSize);
-
-    // Here we need to set scroll position what we asked for.
-    // So we use ScrollView::setCanOverscroll(true).
-    bool oldCanOverscroll = m_frame->view()->canOverScroll();
-    m_frame->view()->setCanOverscroll(true);
-    m_webPagePrivate->setScrollPosition(scrollPosition);
-    m_frame->view()->setCanOverscroll(oldCanOverscroll);
-
-    m_webPagePrivate->m_shouldReflowBlock = viewState.shouldReflowBlock;
-
-    bool didZoom = m_webPagePrivate->zoomAboutPoint(scale, m_frame->view()->scrollPosition(), true /* enforceScaleClamping */, true /*forceRendering*/, true /*isRestoringZoomLevel*/);
-    // If we're already at that scale, then we should still force rendering
-    // since our scroll position changed.
-    m_webPagePrivate->m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
-
-    if (!didZoom) {
-        // We need to notify the client of the scroll position and content size change(s) above even if we didn't scale.
-        m_webPagePrivate->notifyTransformedContentsSizeChanged();
-        m_webPagePrivate->notifyTransformedScrollChanged();
-    }
+
+    // It is not safe to render the page at this point. So we post a message instead. Messages have higher priority than timers.
+    BlackBerry::Platform::webKitThreadMessageClient()->dispatchMessage(BlackBerry::Platform::createMethodCallMessage(
+        &WebPagePrivate::restoreHistoryViewState, m_webPagePrivate, contentsSize, scrollPosition, scale, viewState.shouldReflowBlock));
 }
 
 PolicyAction FrameLoaderClientBlackBerry::decidePolicyForExternalLoad(const ResourceRequest& request, bool isFragmentScroll)
@@ -1184,13 +1171,22 @@ void FrameLoaderClientBlackBerry::dispatchDidReceiveIcon()
 {
     String url = m_frame->document()->url().string();
     NativeImageSkia* bitmap = iconDatabase().synchronousNativeIconForPageURL(url, IntSize(10, 10));
-    if (!bitmap)
+    if (!bitmap || bitmap->bitmap().empty())
         return;
 
-    bitmap->lockPixels();
+    SkAutoLockPixels locker(bitmap->bitmap());
+    SkDynamicMemoryWStream writer;
+    if (!SkImageEncoder::EncodeStream(&writer, bitmap->bitmap(), SkImageEncoder::kPNG_Type, 100)) {
+        BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelInfo, "Failed to convert the icon to PNG format.");
+        return;
+    }
+    SkData* data = writer.copyToData();
+    Vector<char> out;
+    base64Encode(static_cast<const char*>(data->data()), data->size(), out);
+    out.append('\0'); // Make it null-terminated.
     String iconUrl = iconDatabase().synchronousIconURLForPageURL(url);
-    m_webPagePrivate->m_client->setFavicon(img->width(), img->height(), (unsigned char*)bitmap->getPixels(), iconUrl.utf8().data());
-    bitmap->unlockPixels();
+    m_webPagePrivate->m_client->setFavicon(out.data(), iconUrl.utf8().data());
+    data->unref();
 }
 
 bool FrameLoaderClientBlackBerry::canCachePage() const
diff --git a/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h
index e51631541..2af37526a 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h
@@ -34,7 +34,7 @@ class WebPagePrivate;
 
 namespace WebCore {
 
-class InspectorClientBlackBerry : public InspectorClient, public InspectorFrontendChannel, public InspectorOverlay::InspectorOverlayClient {
+class InspectorClientBlackBerry : public InspectorClient, public InspectorFrontendChannel, public BlackBerry::WebKit::InspectorOverlay::InspectorOverlayClient {
 public:
     InspectorClientBlackBerry(BlackBerry::WebKit::WebPagePrivate*);
     virtual void inspectorDestroyed();
diff --git a/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp b/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp
index 5f565c94b..1502e3db3 100644
--- a/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp
@@ -255,7 +255,9 @@ static String memoryPage()
 
     page += "<div class='box'><div class='box-title'>Process memory usage summary</div><table class='fixed-table'><col width=75%><col width=25%>";
 
-    page += numberToHTMLTr("Total memory usage (malloc + JSC)", mallocInfo.usmblks + mallocInfo.uordblks + jscMemoryStat.stackBytes + jscMemoryStat.JITBytes + mainHeap.capacity());
+    page += numberToHTMLTr("Total used memory (malloc + JSC)", mallocInfo.usmblks + mallocInfo.uordblks + jscMemoryStat.stackBytes + jscMemoryStat.JITBytes + mainHeap.capacity());
+
+    page += numberToHTMLTr("Total committed memory", BlackBerry::Platform::totalCommittedMemory());
 
     struct stat processInfo;
     if (!stat(String::format("/proc/%u/as", getpid()).latin1().data(), &processInfo))
@@ -307,6 +309,125 @@ static String memoryPage()
     return page;
 }
 
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
+class MemoryTracker {
+public:
+    static MemoryTracker& instance();
+    void start();
+    void stop();
+    bool isActive() const { return m_memoryTrackingTimer.isActive(); }
+    void clear() { m_peakTotalUsedMemory = 0; m_peakTotalCommittedMemory = 0; m_peakTotalMappedMemory = 0; }
+    void updateMemoryPeaks(Timer<MemoryTracker>*);
+    unsigned peakTotalUsedMemory() const { return m_peakTotalUsedMemory; }
+    unsigned peakTotalCommittedMemory() const {return m_peakTotalCommittedMemory; }
+    unsigned peakTotalMappedMemory() const { return m_peakTotalMappedMemory; }
+
+private:
+    MemoryTracker();
+    Timer<MemoryTracker> m_memoryTrackingTimer;
+    unsigned m_peakTotalUsedMemory;
+    unsigned m_peakTotalCommittedMemory;
+    unsigned m_peakTotalMappedMemory;
+};
+
+MemoryTracker::MemoryTracker()
+    : m_memoryTrackingTimer(this, &MemoryTracker::updateMemoryPeaks)
+    , m_peakTotalUsedMemory(0)
+    , m_peakTotalCommittedMemory(0)
+    , m_peakTotalMappedMemory(0)
+{
+}
+
+MemoryTracker& MemoryTracker::instance()
+{
+    DEFINE_STATIC_LOCAL(MemoryTracker, s_memoryTracker, ());
+    return s_memoryTracker;
+}
+
+void MemoryTracker::start()
+{
+    clear();
+    if (!m_memoryTrackingTimer.isActive())
+        m_memoryTrackingTimer.start(0, 0.01);
+}
+
+void MemoryTracker::stop()
+{
+    m_memoryTrackingTimer.stop();
+}
+
+void MemoryTracker::updateMemoryPeaks(Timer<MemoryTracker>*)
+{
+    // JS engine memory usage.
+    JSC::GlobalMemoryStatistics jscMemoryStat = JSC::globalMemoryStatistics();
+    JSC::Heap& mainHeap = JSDOMWindow::commonJSGlobalData()->heap;
+
+    // Malloc info.
+    struct mallinfo mallocInfo = mallinfo();
+
+    // Malloc and JSC memory.
+    unsigned totalUsedMemory = static_cast<unsigned>(mallocInfo.usmblks + mallocInfo.uordblks + jscMemoryStat.stackBytes + jscMemoryStat.JITBytes + mainHeap.capacity());
+    if (totalUsedMemory > m_peakTotalUsedMemory)
+        m_peakTotalUsedMemory = totalUsedMemory;
+
+    unsigned totalCommittedMemory = BlackBerry::Platform::totalCommittedMemory();
+    if (totalCommittedMemory > m_peakTotalCommittedMemory)
+        m_peakTotalCommittedMemory = totalCommittedMemory;
+
+    struct stat processInfo;
+    if (!stat(String::format("/proc/%u/as", getpid()).latin1().data(), &processInfo)) {
+        unsigned totalMappedMemory = static_cast<unsigned>(processInfo.st_size);
+        if (totalMappedMemory > m_peakTotalMappedMemory)
+            m_peakTotalMappedMemory = totalMappedMemory;
+    }
+}
+
+static String memoryPeaksToHtmlTable(MemoryTracker& memoryTracker)
+{
+    return String("<table class='fixed-table'><col width=75%><col width=25%>")
+        + numberToHTMLTr("Total used memory(malloc + JSC):", memoryTracker.peakTotalUsedMemory())
+        + numberToHTMLTr("Total committed memory:", memoryTracker.peakTotalCommittedMemory())
+        + numberToHTMLTr("Total mapped memory:", memoryTracker.peakTotalMappedMemory())
+        + "</table>";
+}
+
+static String memoryLivePage(String memoryLiveCommand)
+{
+    String page;
+
+    page = writeHeader("Memory Live Page")
+        + "<div class='box'><div class='box-title'>Memory Peaks</div>"
+        + "<div style='font-size:12px;color:#1BE0C9'>\"about:memory-live/start\": start tracking memory peaks.</div>"
+        + "<div style='font-size:12px;color:#1BE0C9'>\"about:memory-live\": show memory peaks every 30ms.</div>"
+        + "<div style='font-size:12px;color:#1BE0C9'>\"about:memory-live/stop\": stop tracking and show memory peaks.</div><br>";
+
+    MemoryTracker& memoryTracker = MemoryTracker::instance();
+    if (memoryLiveCommand.isEmpty()) {
+        if (!memoryTracker.isActive())
+            page += "<div style='font-size:15px;color:#E6F032'>Memory tracker isn't running, please use \"about:memory-live/start\" to start the tracker.</div>";
+        else {
+            page += memoryPeaksToHtmlTable(memoryTracker);
+            page += "<script type=\"text/javascript\">setInterval(function(){window.location.reload()},30);</script>";
+        }
+    } else if (equalIgnoringCase(memoryLiveCommand, "/start")) {
+        memoryTracker.start();
+        page += "<div style='font-size:15px;color:#E6F032'>Memory tracker is running.</div>";
+    } else if (equalIgnoringCase(memoryLiveCommand, "/stop")) {
+        if (!memoryTracker.isActive())
+            page += "<div style='font-size:15px;color:#E6F032'>Memory tracker isn't running.</div>";
+        else {
+            memoryTracker.stop();
+            page += memoryPeaksToHtmlTable(memoryTracker);
+            page += "<div style='font-size:15px;color:#E6F032'>Memory tracker is stopped.</div>";
+        }
+    } else
+        page += "<div style='font-size:15spx;color:#E6F032'>Unknown command! Please input a correct command!</div>";
+
+    page += "</div><br></div></body></html>";
+    return page;
+}
+#endif
+
 static String cachePage(String cacheCommand)
 {
     String result;
@@ -409,6 +530,9 @@ String aboutData(String aboutWhat)
 
     if (BlackBerry::Platform::debugSetting() > 0 && equalIgnoringCase(aboutWhat, "config"))
         return configPage();
+
+    if (aboutWhat.startsWith("memory-live"))
+        return memoryLivePage(aboutWhat.substring(11));
 #endif
 
     return String();
diff --git a/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.cpp b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.cpp
index a02f93a1c..0897df6f8 100644
--- a/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.cpp
@@ -29,8 +29,8 @@ namespace WebKit {
 
 TileBuffer::TileBuffer(const Platform::IntSize& size)
     : m_size(size)
+    , m_syncObject(0)
     , m_buffer(0)
-    , m_blitGeneration(0)
 {
 }
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.h b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.h
index 7a0a42f5d..eb10809ea 100644
--- a/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.h
+++ b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.h
@@ -47,14 +47,14 @@ class TileBuffer {
 
         Platform::Graphics::Buffer* nativeBuffer() const;
 
-        void setBlitGeneration(int g) const { m_blitGeneration = g; }
-        int blitGeneration() const { return m_blitGeneration; }
+        void* syncObject() const { return m_syncObject; }
+        void setSyncObject(void* syncObject) { m_syncObject = syncObject; }
 
     private:
         Platform::IntSize m_size;
         Platform::IntRectRegion m_renderedRegion;
+        void* m_syncObject;
         mutable Platform::Graphics::Buffer* m_buffer;
-        mutable int m_blitGeneration;
 };
 
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
index 2b54c337c..99411f01f 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
@@ -231,7 +231,10 @@ bool isTextBasedContentEditableElement(Element* element)
     if (!element)
         return false;
 
-    if (element->isReadOnlyFormControl() || !element->isEnabledFormControl())
+    if (element->isTextFormControl() && static_cast<HTMLTextFormControlElement*>(element)->readOnly())
+        return false;
+
+    if (!element->isEnabledFormControl())
         return false;
 
     if (isPopupInputField(element))
diff --git a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
index 74c1bfae3..5b8eeb5b5 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
@@ -61,6 +61,12 @@ void DefaultTapHighlight::draw(const Platform::IntRectRegion& region, int red, i
     if (rect.isEmpty())
         return;
 
+    // Transparent color means disable the tap highlight.
+    if (!m_color.alpha()) {
+        hide();
+        return;
+    }
+
     {
         MutexLocker lock(m_mutex);
         m_visible = true;
@@ -104,9 +110,9 @@ void DefaultTapHighlight::hide()
         m_overlay->override()->addAnimation(fadeAnimation);
 }
 
-void DefaultTapHighlight::notifySyncRequired(const GraphicsLayer*)
+void DefaultTapHighlight::notifySyncRequired(const GraphicsLayer* layer)
 {
-    m_page->scheduleRootLayerCommit();
+    m_page->notifySyncRequired(layer);
 }
 
 void DefaultTapHighlight::paintContents(const GraphicsLayer*, GraphicsContext& c, GraphicsLayerPaintingPhase, const IntRect& /*inClip*/)
@@ -142,6 +148,16 @@ void DefaultTapHighlight::paintContents(const GraphicsLayer*, GraphicsContext& c
     c.restore();
 }
 
+bool DefaultTapHighlight::showDebugBorders(const GraphicsLayer* layer) const
+{
+    return m_page->showDebugBorders(layer);
+}
+
+bool DefaultTapHighlight::showRepaintCounter(const GraphicsLayer* layer) const
+{
+    return m_page->showRepaintCounter(layer);
+}
+
 } // namespace WebKit
 } // namespace BlackBerry
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
index 72ea40251..c04f6377c 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
+++ b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
@@ -56,10 +56,8 @@ public:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
     virtual void notifySyncRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const { return false; }
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const { return false; }
-    virtual bool contentsVisible(const WebCore::GraphicsLayer*, const WebCore::IntRect& contentRect) const { return true; }
-
+    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
+    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 
 private:
     DefaultTapHighlight(WebPagePrivate*);
diff --git a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
index f58cae891..d42059e6a 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
@@ -20,9 +20,11 @@
 #include "InRegionScrollableArea.h"
 
 #include "Frame.h"
-#include "NotImplemented.h"
+#include "LayerCompositingThread.h"
+#include "LayerWebKitThread.h"
 #include "RenderBox.h"
 #include "RenderLayer.h"
+#include "RenderLayerBacking.h"
 #include "RenderObject.h"
 #include "RenderView.h"
 #include "WebPage_p.h"
@@ -69,6 +71,8 @@ InRegionScrollableArea::InRegionScrollableArea(WebPagePrivate* webPage, RenderLa
         m_scrollsVertically = view->contentsHeight() > view->visibleHeight();
 
         m_overscrollLimitFactor = 0.0; // FIXME eventually support overscroll
+        m_cachedCompositedScrollableLayer = 0; // FIXME: Needs composited layer for inner frames.
+
     } else { // RenderBox-based elements case (scrollable boxes (div's, p's, textarea's, etc)).
 
         RenderBox* box = m_layer->renderBox();
@@ -83,7 +87,13 @@ InRegionScrollableArea::InRegionScrollableArea(WebPagePrivate* webPage, RenderLa
         m_scrollsHorizontally = box->scrollWidth() != box->clientWidth() && box->scrollsOverflowX();
         m_scrollsVertically = box->scrollHeight() != box->clientHeight() && box->scrollsOverflowY();
 
-        m_overscrollLimitFactor = 0.0; // FIXME eventually support overscroll
+        if (m_layer->usesCompositedScrolling()) {
+            m_supportsCompositedScrolling = true;
+            ASSERT(m_layer->backing()->hasScrollingLayer());
+            m_cachedCompositedScrollableLayer = reinterpret_cast<unsigned>(m_layer->backing()->scrollingLayer()->platformLayer()->layerCompositingThread());
+        }
+
+        m_overscrollLimitFactor = 0.0;
     }
 }
 
@@ -104,6 +114,6 @@ RenderLayer* InRegionScrollableArea::layer() const
     ASSERT(!m_isNull);
     return m_layer;
 }
-}
 
 }
+}
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
index 3955752a8..37d5d30ad 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
@@ -362,8 +362,7 @@ void InputHandler::focusedNodeChanged()
     Node* node = frame->document()->focusedNode();
 
     if (isActiveTextEdit() && m_currentFocusElement == node) {
-        if (!processingChange())
-            notifyClientOfKeyboardVisibilityChange(true);
+        notifyClientOfKeyboardVisibilityChange(true);
         return;
     }
 
@@ -577,7 +576,7 @@ int32_t InputHandler::convertTransactionIdToSequenceId(int32_t transactionId)
 
 void InputHandler::spellCheckingRequestProcessed(int32_t transactionId, spannable_string_t* spannableString)
 {
-    if (!spannableString) {
+    if (!spannableString || !isActiveTextEdit()) {
         spellCheckingRequestCancelled(transactionId, false /* isSequenceId */);
         return;
     }
@@ -625,6 +624,9 @@ void InputHandler::spellCheckingRequestProcessed(int32_t transactionId, spannabl
 
 void InputHandler::spellCheckingRequestCancelled(int32_t id, bool isSequenceId)
 {
+    if (!isActiveTextEdit())
+        return;
+
     int32_t sequenceId = isSequenceId ? id : convertTransactionIdToSequenceId(id);
     SpellChecker* sp = getSpellChecker();
     if (!sp) {
@@ -636,6 +638,9 @@ void InputHandler::spellCheckingRequestCancelled(int32_t id, bool isSequenceId)
 
 SpellChecker* InputHandler::getSpellChecker()
 {
+    ASSERT(m_currentFocusElement);
+    ASSERT(m_currentFocusElement->document());
+
     if (Frame* frame = m_currentFocusElement->document()->frame())
         if (Editor* editor = frame->editor())
             return editor->spellChecker();
@@ -659,7 +664,6 @@ void InputHandler::setElementUnfocused(bool refocusOccuring)
             notifyClientOfKeyboardVisibilityChange(false);
 
         m_webPage->m_client->inputFocusLost();
-        m_webPage->m_selectionHandler->selectionPositionChanged();
 
         // If the frame selection isn't focused, focus it.
         if (!m_currentFocusElement->document()->frame()->selection()->isFocused())
@@ -1029,6 +1033,11 @@ void InputHandler::notifyClientOfKeyboardVisibilityChange(bool visible)
     if (!isInputModeEnabled() && visible)
         return;
 
+    if (processingChange()) {
+        ASSERT(visible);
+        return;
+    }
+
     if (!m_delayKeyboardVisibilityChange) {
         m_webPage->showVirtualKeyboard(visible);
         return;
diff --git a/Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.cpp b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlay.cpp
index fa48cd6aa..ee5d33346 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlay.cpp
@@ -24,52 +24,46 @@
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
-#include "Page.h"
-#include "Settings.h"
 #include "WebPage_p.h"
 
 
-namespace WebCore {
+namespace BlackBerry {
+namespace WebKit {
 
-PassOwnPtr<InspectorOverlay> InspectorOverlay::create(BlackBerry::WebKit::WebPagePrivate* page, InspectorOverlayClient* client)
+PassOwnPtr<InspectorOverlay> InspectorOverlay::create(WebPagePrivate* page, InspectorOverlayClient* client)
 {
     return adoptPtr(new InspectorOverlay(page, client));
 }
 
-InspectorOverlay::InspectorOverlay(BlackBerry::WebKit::WebPagePrivate* page, InspectorOverlayClient* client)
+InspectorOverlay::InspectorOverlay(WebPagePrivate* page, InspectorOverlayClient* client)
     : m_webPage(page)
     , m_client(client)
 {
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-void InspectorOverlay::notifySyncRequired(const GraphicsLayer*)
+void InspectorOverlay::notifySyncRequired(const WebCore::GraphicsLayer* layer)
 {
-    m_webPage->scheduleRootLayerCommit();
+    m_webPage->notifySyncRequired(layer);
 }
 
-void InspectorOverlay::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase, const IntRect& inClip)
+void InspectorOverlay::paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext& context, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip)
 {
     context.save();
-    IntPoint scrollPosition = m_webPage->focusedOrMainFrame()->view()->scrollPosition();
+    WebCore::IntPoint scrollPosition = m_webPage->focusedOrMainFrame()->view()->scrollPosition();
     context.translate(scrollPosition.x(), scrollPosition.y());
     m_client->paintInspectorOverlay(context);
     context.restore();
 }
 
-bool InspectorOverlay::showDebugBorders(const GraphicsLayer*) const
+bool InspectorOverlay::showDebugBorders(const WebCore::GraphicsLayer* layer) const
 {
-    return m_webPage->m_page->settings()->showDebugBorders();
+    return m_webPage->showDebugBorders(layer);
 }
 
-bool InspectorOverlay::showRepaintCounter(const GraphicsLayer*) const
+bool InspectorOverlay::showRepaintCounter(const WebCore::GraphicsLayer* layer) const
 {
-    return m_webPage->m_page->settings()->showRepaintCounter();
-}
-
-bool InspectorOverlay::contentsVisible(const GraphicsLayer*, const IntRect& contentRect) const
-{
-    return true;
+    return m_webPage->showRepaintCounter(layer);
 }
 #endif
 
@@ -89,9 +83,9 @@ void InspectorOverlay::update()
 {
 #if USE(ACCELERATED_COMPOSITING)
     if (!m_overlay) {
-        m_overlay = adoptPtr(new BlackBerry::WebKit::WebOverlay(this));
-        const IntSize size = m_webPage->contentsSize();
-        m_overlay->setSize(FloatSize(size.width(), size.height()));
+        m_overlay = adoptPtr(new WebOverlay(this));
+        const WebCore::IntSize size = m_webPage->contentsSize();
+        m_overlay->setSize(WebCore::FloatSize(size.width(), size.height()));
         m_webPage->m_webPage->addOverlay(m_overlay.get());
     }
 
@@ -102,3 +96,4 @@ void InspectorOverlay::update()
 }
 
 }
+}
diff --git a/Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.h b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlay.h
index 7f91e3541..e341f364f 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.h
+++ b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlay.h
@@ -24,25 +24,23 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
-namespace BlackBerry {
-namespace WebKit {
-class WebPagePrivate;
-}
-}
-
 namespace WebCore {
 class GraphicsContext;
 class GraphicsLayer;
+}
 
+namespace BlackBerry {
+namespace WebKit {
+class WebPagePrivate;
 
 class InspectorOverlay : public WebCore::GraphicsLayerClient {
 public:
     class InspectorOverlayClient {
     public:
-        virtual void paintInspectorOverlay(GraphicsContext&) = 0;
+        virtual void paintInspectorOverlay(WebCore::GraphicsContext&) = 0;
     };
 
-    static PassOwnPtr<InspectorOverlay> create(BlackBerry::WebKit::WebPagePrivate*, InspectorOverlayClient*);
+    static PassOwnPtr<InspectorOverlay> create(WebPagePrivate*, InspectorOverlayClient*);
 
     ~InspectorOverlay();
 
@@ -50,28 +48,26 @@ public:
 
     void clear();
     void update();
-    void paintWebFrame(GraphicsContext&);
+    void paintWebFrame(WebCore::GraphicsContext&);
 
 #if USE(ACCELERATED_COMPOSITING)
-    virtual void notifyAnimationStarted(const GraphicsLayer*, double time) { }
-    virtual void notifySyncRequired(const GraphicsLayer*);
-    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip);
-    virtual bool showDebugBorders(const GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const GraphicsLayer*) const;
-
-    virtual bool contentsVisible(const WebCore::GraphicsLayer*, const WebCore::IntRect& contentRect) const;
+    virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
+    virtual void notifySyncRequired(const WebCore::GraphicsLayer*);
+    virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
+    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
+    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 #endif
 
 private:
-    InspectorOverlay(BlackBerry::WebKit::WebPagePrivate*, InspectorOverlayClient*);
+    InspectorOverlay(WebPagePrivate*, InspectorOverlayClient*);
     void invalidateWebFrame();
 
-    BlackBerry::WebKit::WebPagePrivate* m_webPage;
+    WebPagePrivate* m_webPage;
     InspectorOverlayClient* m_client;
-    OwnPtr<BlackBerry::WebKit::WebOverlay> m_overlay;
+    OwnPtr<WebOverlay> m_overlay;
 };
 
-} // namespace WebCore
-
+} // namespace WebKit
+} // namespace BlackBerry
 
 #endif /* InspectorOverlay_h */
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
index 7047204e7..3b04247be 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
@@ -243,7 +243,7 @@ void SelectionHandler::setCaretPosition(const WebCore::IntPoint &position)
     WebCore::IntRect currentCaretRect = controller->selection().visibleStart().absoluteCaretBounds();
 
     if (relativePoint == DOMSupport::InvalidPoint || !shouldUpdateSelectionOrCaretForPoint(relativePoint, currentCaretRect)) {
-        selectionPositionChanged();
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
         return;
     }
 
@@ -253,13 +253,15 @@ void SelectionHandler::setCaretPosition(const WebCore::IntPoint &position)
         if (unsigned short character = directionOfPointRelativeToRect(relativePoint, currentCaretRect))
             m_webPage->m_inputHandler->handleKeyboardInput(Platform::KeyboardEvent(character));
 
-        selectionPositionChanged();
+        // Send the selection changed in case this does not trigger a selection change to
+        // ensure the caret position is accurate. This may be a duplicate event.
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
         return;
     }
 
     VisibleSelection newSelection(visibleCaretPosition);
     if (controller->selection() == newSelection) {
-        selectionPositionChanged();
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
         return;
     }
 
@@ -403,7 +405,7 @@ bool SelectionHandler::updateOrHandleInputSelection(VisibleSelection& newSelecti
     // Check if the handle movement is valid.
     if (!shouldUpdateSelectionOrCaretForPoint(relativeStart, currentStartCaretRect, true /* startCaret */)
         || !shouldUpdateSelectionOrCaretForPoint(relativeEnd, currentEndCaretRect, false /* startCaret */)) {
-        selectionPositionChanged();
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
         return true;
     }
 
@@ -438,9 +440,9 @@ bool SelectionHandler::updateOrHandleInputSelection(VisibleSelection& newSelecti
     if (shouldExtendSelectionInDirection(controller->selection(), character))
         m_webPage->m_inputHandler->handleKeyboardInput(Platform::KeyboardEvent(character, Platform::KeyboardEvent::KeyDown, KEYMOD_SHIFT));
 
-    // Must send the selectionPositionChanged every time, sometimes this will duplicate but an accepted
-    // handleNavigationMove may not make an actual selection change.
-    selectionPositionChanged();
+    // Send the selection changed in case this does not trigger a selection change to
+    // ensure the caret position is accurate. This may be a duplicate event.
+    selectionPositionChanged(true /* forceUpdateWithoutChange */);
     return true;
 }
 
@@ -513,7 +515,7 @@ void SelectionHandler::setSelection(const WebCore::IntPoint& start, const WebCor
     }
 
     if (controller->selection() == newSelection) {
-        selectionPositionChanged();
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
         return;
     }
 
@@ -525,20 +527,21 @@ void SelectionHandler::setSelection(const WebCore::IntPoint& start, const WebCor
 
     IntRectRegion unclippedRegion;
     regionForTextQuads(quads, unclippedRegion, false /* shouldClipToVisibleContent */);
-    if (!unclippedRegion.isEmpty()) {
-        // Check if the handles reversed position.
-        if (m_selectionActive && !newSelection.isBaseFirst())
-            m_webPage->m_client->notifySelectionHandlesReversed();
-
-        controller->setSelection(newSelection);
 
-        SelectionLog(LogLevelInfo, "SelectionHandler::setSelection selection points valid, selection updated.");
-    } else {
+    if (unclippedRegion.isEmpty()) {
         // Requested selection results in an empty selection, skip this change.
-        selectionPositionChanged();
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
 
         SelectionLog(LogLevelWarn, "SelectionHandler::setSelection selection points invalid, selection not updated.");
+        return;
     }
+
+    // Check if the handles reversed position.
+    if (m_selectionActive && !newSelection.isBaseFirst())
+        m_webPage->m_client->notifySelectionHandlesReversed();
+
+    controller->setSelection(newSelection);
+    SelectionLog(LogLevelInfo, "SelectionHandler::setSelection selection points valid, selection updated.");
 }
 
 // FIXME re-use this in context. Must be updated to include an option to return the href.
@@ -838,9 +841,9 @@ bool SelectionHandler::inputNodeOverridesTouch() const
 
 // Note: This is the only function in SelectionHandler in which the coordinate
 // system is not entirely WebKit.
-void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
+void SelectionHandler::selectionPositionChanged(bool forceUpdateWithoutChange)
 {
-    SelectionLog(LogLevelInfo, "SelectionHandler::selectionPositionChanged visibleChangeOnly = %s", visualChangeOnly ? "true" : "false");
+    SelectionLog(LogLevelInfo, "SelectionHandler::selectionPositionChanged forceUpdateWithoutChange = %s", forceUpdateWithoutChange ? "true" : "false");
 
     // This method can get called during WebPage shutdown process.
     // If that is the case, just bail out since the client is not
@@ -883,7 +886,7 @@ void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
 
     // If there is no change in selected text and the visual rects
     // have not changed then don't bother notifying anything.
-    if (visualChangeOnly && m_lastSelectionRegion.isEqual(unclippedRegion))
+    if (!forceUpdateWithoutChange && m_lastSelectionRegion.isEqual(unclippedRegion))
         return;
 
     m_lastSelectionRegion = unclippedRegion;
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h
index b0833c2c1..36895e3a5 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h
@@ -65,7 +65,7 @@ public:
     void selectObject(WebCore::TextGranularity);
     void selectObject(WebCore::Node*);
 
-    void selectionPositionChanged(bool visualChangeOnly = false);
+    void selectionPositionChanged(bool forceUpdateWithoutChange = false);
 
     void setCaretPosition(const WebCore::IntPoint&);
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
index 58fd28e26..cd8c35d93 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
@@ -94,9 +94,9 @@ void SelectionOverlay::hide()
     m_page->m_webPage->removeOverlay(m_overlay.get());
 }
 
-void SelectionOverlay::notifySyncRequired(const GraphicsLayer*)
+void SelectionOverlay::notifySyncRequired(const GraphicsLayer* layer)
 {
-    m_page->scheduleRootLayerCommit();
+    m_page->notifySyncRequired(layer);
 }
 
 void SelectionOverlay::paintContents(const GraphicsLayer*, GraphicsContext& c, GraphicsLayerPaintingPhase, const IntRect& inClip)
@@ -133,6 +133,16 @@ void SelectionOverlay::paintContents(const GraphicsLayer*, GraphicsContext& c, G
     c.restore();
 }
 
+bool SelectionOverlay::showDebugBorders(const GraphicsLayer* layer) const
+{
+    return m_page->showDebugBorders(layer);
+}
+
+bool SelectionOverlay::showRepaintCounter(const GraphicsLayer* layer) const
+{
+    return m_page->showRepaintCounter(layer);
+}
+
 } // namespace WebKit
 } // namespace BlackBerry
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
index 12731c581..be61e764b 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
@@ -52,10 +52,8 @@ public:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
     virtual void notifySyncRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const { return false; }
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const { return false; }
-    virtual bool contentsVisible(const WebCore::GraphicsLayer*, const WebCore::IntRect& contentRect) const { return true; }
-
+    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
+    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 
 private:
     SelectionOverlay(WebPagePrivate*);
diff --git a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
index de4fe5caa..e4c99ed7b 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
@@ -25,16 +25,29 @@
 #include "BackingStoreCompositingSurface.h"
 #endif
 
+#include <BlackBerryPlatformGraphics.h>
 #include <BlackBerryPlatformLog.h>
 #include <BlackBerryPlatformMisc.h>
 #include <BlackBerryPlatformScreen.h>
 #include <BlackBerryPlatformSettings.h>
+#include <BlackBerryPlatformThreading.h>
+#include <errno.h>
+
+#if BLACKBERRY_PLATFORM_GRAPHICS_EGL
+#include <EGL/eglext.h>
+#endif
 
 #define SHARED_PIXMAP_GROUP "webkit_backingstore_group"
 
 namespace BlackBerry {
 namespace WebKit {
 
+#if BLACKBERRY_PLATFORM_GRAPHICS_EGL
+static PFNEGLCREATESYNCKHRPROC eglCreateSyncKHR;
+static PFNEGLDESTROYSYNCKHRPROC eglDestroySyncKHR;
+static PFNEGLCLIENTWAITSYNCKHRPROC eglClientWaitSyncKHR;
+#endif
+
 #if USE(ACCELERATED_COMPOSITING) && ENABLE_COMPOSITING_SURFACE
 static PassRefPtr<BackingStoreCompositingSurface> createCompositingSurface()
 {
@@ -60,6 +73,7 @@ SurfacePool::SurfacePool()
     , m_backBuffer(0)
     , m_initialized(false)
     , m_buffersSuspended(false)
+    , m_hasFenceExtension(false)
 {
 }
 
@@ -95,6 +109,21 @@ void SurfacePool::initialize(const BlackBerry::Platform::IntSize& tileSize)
 
     for (size_t i = 0; i < numberOfTiles; ++i)
         m_tilePool.append(BackingStoreTile::create(tileSize, BackingStoreTile::DoubleBuffered));
+
+#if BLACKBERRY_PLATFORM_GRAPHICS_EGL
+    const char* extensions = eglQueryString(Platform::Graphics::eglDisplay(), EGL_EXTENSIONS);
+    if (strstr(extensions, "EGL_KHR_fence_sync")) {
+        // We assume GL_OES_EGL_sync is present, but we don't check for it because
+        // no GL context is current at this point.
+        // TODO: check for it
+        eglCreateSyncKHR = (PFNEGLCREATESYNCKHRPROC) eglGetProcAddress("eglCreateSyncKHR");
+        eglDestroySyncKHR = (PFNEGLDESTROYSYNCKHRPROC) eglGetProcAddress("eglDestroySyncKHR");
+        eglClientWaitSyncKHR = (PFNEGLCLIENTWAITSYNCKHRPROC) eglGetProcAddress("eglClientWaitSyncKHR");
+        m_hasFenceExtension = eglCreateSyncKHR && eglDestroySyncKHR && eglClientWaitSyncKHR;
+    }
+#endif
+
+    pthread_mutex_init(&m_mutex, 0);
 }
 
 PlatformGraphicsContext* SurfacePool::createPlatformGraphicsContext(BlackBerry::Platform::Graphics::Drawable* drawable) const
@@ -199,5 +228,71 @@ void SurfacePool::releaseBuffers()
     }
 }
 
+void SurfacePool::waitForBuffer(TileBuffer* tileBuffer)
+{
+    if (!m_hasFenceExtension)
+        return;
+
+#if BLACKBERRY_PLATFORM_GRAPHICS_EGL
+    EGLSyncKHR syncObject;
+
+    {
+        Platform::MutexLocker locker(&m_mutex);
+        syncObject = tileBuffer->syncObject();
+        if (!syncObject)
+            return;
+
+        // Stale references to this sync object may remain with other tiles, don't wait for it again.
+        for (unsigned int i = 0; i < m_tilePool.size(); ++i) {
+            TileBuffer* tileBuffer = m_tilePool[i]->frontBuffer();
+            if (tileBuffer->syncObject() == syncObject)
+                tileBuffer->setSyncObject(0);
+        }
+        if (backBuffer()->syncObject() == syncObject)
+            backBuffer()->setSyncObject(0);
+    }
+
+    eglClientWaitSyncKHR(Platform::Graphics::eglDisplay(), syncObject, 0, 100000000LL);
+
+    // Instead of assuming eglDestroySyncKHR is thread safe, we add it to
+    // a garbage list for later collection on the thread that created it.
+    {
+        Platform::MutexLocker locker(&m_mutex);
+        m_syncObjectsToDestroy.insert(syncObject);
+    }
+#endif
+}
+
+void SurfacePool::notifyBuffersComposited(const Vector<TileBuffer*>& tileBuffers)
+{
+    if (!m_hasFenceExtension)
+        return;
+
+#if BLACKBERRY_PLATFORM_GRAPHICS_EGL
+    Platform::MutexLocker locker(&m_mutex);
+
+    EGLDisplay display = Platform::Graphics::eglDisplay();
+
+    // The EGL_KHR_fence_sync spec is nice enough to specify that the sync object
+    // is not actually deleted until everyone has stopped using it.
+    for (std::set<void*>::const_iterator it = m_syncObjectsToDestroy.begin(); it != m_syncObjectsToDestroy.end(); ++it)
+        eglDestroySyncKHR(display, *it);
+    m_syncObjectsToDestroy.clear();
+
+    // If we didn't blit anything, we don't need to create a new sync object.
+    if (tileBuffers.isEmpty())
+        return;
+
+    EGLSyncKHR syncObject = eglCreateSyncKHR(display, EGL_SYNC_FENCE_KHR, 0);
+
+    for (unsigned int i = 0; i < tileBuffers.size(); ++i) {
+        if (EGLSyncKHR previousSyncObject = tileBuffers[i]->syncObject())
+            m_syncObjectsToDestroy.insert(previousSyncObject);
+
+        tileBuffers[i]->setSyncObject(syncObject);
+    }
+#endif
+}
+
 }
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.h b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.h
index fa88a5d6a..1c50df81b 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.h
+++ b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.h
@@ -25,6 +25,8 @@
 
 #include <BlackBerryPlatformGraphics.h>
 #include <BlackBerryPlatformPrimitives.h>
+#include <pthread.h>
+#include <set>
 #include <wtf/Vector.h>
 
 #define ENABLE_COMPOSITING_SURFACE 1
@@ -71,6 +73,16 @@ public:
     void releaseBuffers();
     void createBuffers();
 
+    // EGLImage synchronization between WebKit and compositing threads
+    // TODO: Figure out how to improve the BlackBerry::Platform::Graphics with API that can encapsulate
+    // this kind of synchronisation mechanism.
+
+    // WebKit thread must waitForBuffer() before rendering to EGLImage
+    void waitForBuffer(TileBuffer*);
+
+    // Compositing thread must notify the SurfacePool when EGLImages are composited
+    void notifyBuffersComposited(const Vector<TileBuffer*>& buffers);
+
 private:
     // This is necessary so BackingStoreTile can atomically swap buffers with m_backBuffer.
     friend class BackingStoreTile;
@@ -86,6 +98,10 @@ private:
     unsigned m_backBuffer;
     bool m_initialized; // SurfacePool has been set up, with or without buffers.
     bool m_buffersSuspended; // Buffer objects exist, but pixel memory has been freed.
+
+    std::set<void*> m_syncObjectsToDestroy;
+    bool m_hasFenceExtension;
+    mutable pthread_mutex_t m_mutex;
 };
 }
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
index c8668be85..492aeaa36 100644
--- a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
@@ -31,6 +31,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
+#include "InRegionScroller_p.h"
 #include "InputHandler.h"
 #include "IntRect.h"
 #include "IntSize.h"
@@ -363,7 +364,7 @@ void TouchEventHandler::drawTapHighlight()
     // On the client side, this info is being used to hide the tap highlight window on scroll.
     RenderLayer* layer = m_webPage->enclosingFixedPositionedAncestorOrSelfIfFixedPositioned(renderer->enclosingLayer());
     bool shouldHideTapHighlightRightAfterScrolling = !layer->renderer()->isRenderView();
-    shouldHideTapHighlightRightAfterScrolling |= !!m_webPage->m_inRegionScrollStartingNode.get();
+    shouldHideTapHighlightRightAfterScrolling |= !!m_webPage->m_inRegionScroller->d->node();
 
     IntPoint framePos(m_webPage->frameOffset(elementFrame));
 
diff --git a/Source/WebKit/chromium/.gitignore b/Source/WebKit/chromium/.gitignore
index eece02216..4def72c92 100644
--- a/Source/WebKit/chromium/.gitignore
+++ b/Source/WebKit/chromium/.gitignore
@@ -15,6 +15,7 @@ WebKitUnitTests.xcodeproj
 .gclient
 .gclient_entries
 base/
+cc/
 chromium_deps/
 crypto/
 depot_tools/
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index c9b02eb2e..3d9ea37fa 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,2462 @@
+2012-08-09  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove forwarding headers for compositor-related WebKit API and update includes
+        https://bugs.webkit.org/show_bug.cgi?id=93669
+
+        Reviewed by Adam Barth.
+
+        This updates all includes for compositor-related headers to refer consistently to the Platform API location and
+        removes the now-unneeded forwarding headers in the client API location. I also updated and resorted other
+        platform API includes in modified header blocks.
+
+        * WebKit.gyp:
+        * public/WebCompositor.h: Removed.
+        * public/platform/WebContentLayer.h: Removed.
+        * public/platform/WebContentLayerClient.h: Removed.
+        * public/platform/WebExternalTextureLayer.h: Removed.
+        * public/platform/WebLayer.h: Removed.
+        * public/platform/WebLayerTreeView.h: Removed.
+        * public/platform/WebLayerTreeViewClient.h: Removed.
+        * public/platform/WebSolidColorLayer.h: Removed.
+        * src/WebCompositorInputHandlerImpl.h:
+        * src/WebContentLayerImpl.cpp:
+        * src/WebLayer.cpp:
+        * src/WebLayerTreeView.cpp:
+        * src/WebLayerTreeViewImpl.cpp:
+        * src/WebLayerTreeViewImpl.h:
+        * src/WebSolidColorLayer.cpp:
+        * src/WebViewImpl.h:
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        * tests/GraphicsLayerChromiumTest.cpp:
+        * tests/TextureLayerChromiumTest.cpp:
+
+2012-08-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-10  Iain Merrick  <husky@google.com>
+
+        [chromium] Upstream Android changes to WebFrameImpl::selectRange
+        https://bugs.webkit.org/show_bug.cgi?id=92513
+
+        Reviewed by Ryosuke Niwa.
+
+        This change is driven by the Chromium port on the Android platform,
+        but it should be suitable for other touch-based platforms. We reuse
+        selectionExtentRespectingEditingBoundary (extracted from EventHandler
+        into VisibleSelection).
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::selectRange):
+        (WebKit::WebFrameImpl::visiblePositionForWindowPoint):
+
+2012-08-10  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Remove targetSurface pointer from CCRenderPass
+        https://bugs.webkit.org/show_bug.cgi?id=93734
+
+        Reviewed by Adrienne Walker.
+
+        Use the RenderPass's damageRect instead of the surface's damageRect
+        directly to test the same things without requiring a pointer to
+        the surface that generated the RenderPass.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r125310.
+        http://trac.webkit.org/changeset/125310
+        https://bugs.webkit.org/show_bug.cgi?id=93739
+
+        The DEPS roll broke Android. One does not simply break
+        Android. (Requested by fmalita_ on #webkit).
+
+        * DEPS:
+
+2012-08-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-10  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Remove scissor from the namings in CCOcclusionTracker
+        https://bugs.webkit.org/show_bug.cgi?id=93630
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebKitTests::TestCCOcclusionTrackerWithClip::TestCCOcclusionTrackerWithClip):
+        (WebKitTests::TestCCOcclusionTrackerWithClip::setLayerClipRect):
+        (WebKitTests::TestCCOcclusionTrackerWithClip::useDefaultLayerClipRect):
+        (WebKitTests::TestCCOcclusionTrackerWithClip::layerClipRectInTarget):
+        (TestCCOcclusionTrackerWithClip):
+        (WebKitTests::CCOcclusionTrackerTestIdentityTransforms::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestRotatedChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestTranslatedChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestChildInRotatedChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestVisitTargetTwoTimes::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceRotatedOffAxis::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceWithTwoOpaqueChildren::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestOverlappingSurfaceSiblings::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestOverlappingSurfaceSiblingsWithTwoTransforms::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestFilters::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestReplicaDoesOcclude::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestReplicaWithClipping::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestReplicaWithMask::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerClipRectOutsideChild::runMyTest):
+        (WebKitTests):
+        (WebKitTests::CCOcclusionTrackerTestViewportRectOutsideChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerClipRectOverChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestViewportRectOverChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerClipRectPartlyOverChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestViewportRectPartlyOverChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerClipRectOverNothing::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestViewportRectOverNothing::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerClipRectForLayerOffOrigin::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestOpaqueContentsRegionEmpty::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestOpaqueContentsRegionNonEmpty::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTest3dTransform::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestUnsorted3dLayers::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestPerspectiveTransform::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestPerspectiveTransformBehindCamera::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerBehindCameraDoesNotOcclude::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLargePixelsOccludeInsideClipRect::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestAnimationOpacity1OnMainThread::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestAnimationOpacity0OnMainThread::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestAnimationTranslateOnMainThread::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceOcclusionTranslatesToParent::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceOcclusionTranslatesWithClipping::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestReplicaOccluded::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceWithReplicaUnoccluded::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceAndReplicaOccludedDifferently::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceChildOfSurface::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestTopmostSurfaceIsClippedToViewport::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceChildOfClippingSurface::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestDontOccludePixelsNeededForBackgroundFilter::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestTwoBackgroundFiltersReduceOcclusionTwice::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestDontOccludePixelsNeededForBackgroundFilterWithClip::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestDontReduceOcclusionBelowBackgroundFilter::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestDontReduceOcclusionIfBackgroundFilterIsOccluded::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestReduceOcclusionWhenBackgroundFilterIsPartiallyOccluded::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestMinimumTrackingSize::runMyTest):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r125230 and r125238.
+        http://trac.webkit.org/changeset/125230
+        http://trac.webkit.org/changeset/125238
+        https://bugs.webkit.org/show_bug.cgi?id=93698
+
+        Broke ChromiumOS browser tests. (Requested by yutak on
+        #webkit).
+
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-09  Eric Penner  <epenner@google.com>
+
+        [chromium] Paint animated layers immediately to avoid animation hiccups.
+        https://bugs.webkit.org/show_bug.cgi?id=93028
+
+        Reviewed by Adrienne Walker.
+
+        Replaced one test. Test painting full animated layer.
+
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-09  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Remove missing files from WebKit.gyp introduced by r125219
+        https://bugs.webkit.org/show_bug.cgi?id=93671
+
+        Unreviewed. Fixing windows build.
+
+        * WebKit.gyp:
+
+2012-08-09  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: add AssertMatchingEnums for Direction and TaskType
+        https://bugs.webkit.org/show_bug.cgi?id=93618
+
+        Reviewed by Tony Chang.
+
+        These chromium enums were introduced in a separate patch.
+
+        * src/AssertMatchingEnums.cpp:
+
+2012-08-06  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Expose CCGraphicsContext as WebCompositorOutputSurface
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Reviewed by James Robinson.
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebSettings.h:
+        * public/WebViewClient.h:
+        (WebKit):
+        (WebViewClient):
+        (WebKit::WebViewClient::createOutputSurface):
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::Settings::operator CCLayerTreeSettings):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit):
+        (WebGraphicsContextToOutputSurfaceAdapter):
+        (WebKit::WebGraphicsContextToOutputSurfaceAdapter::WebGraphicsContextToOutputSurfaceAdapter):
+        (WebKit::WebLayerTreeViewClientAdapter::WebLayerTreeViewClientAdapter):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::WebSettingsImpl):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::createOutputSurface):
+        (WebKit):
+        (WebKit::WebViewImpl::didRebindGraphicsContext):
+        (WebKit::WebViewImpl::didRecreateOutputSurface):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF):
+        (WTF::CCLayerTreeHostTestSetSingleLostContext::didRecreateOutputSurface):
+        (WTF::CCLayerTreeHostTestSetRepeatedLostContext::didRecreateOutputSurface):
+        * tests/CCResourceProviderTest.cpp:
+        (WebKit::CCResourceProviderTest::CCResourceProviderTest):
+        * tests/CCTextureUpdateControllerTest.cpp:
+        * tests/CCThreadedTest.cpp:
+        (WebKitTests::TestHooks::createOutputSurface):
+        * tests/CCThreadedTest.h:
+        (WebKitTests::TestHooks::didRecreateOutputSurface):
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        (Canvas2DLayerBridgeTest::fullLifecycleTest):
+        * tests/FakeCCGraphicsContext.h:
+        (WebKit::createFakeCCGraphicsContext):
+        * tests/FakeCCLayerTreeHostClient.h:
+        * tests/FakeWebCompositorOutputSurface.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h.
+        (WebKit):
+        (FakeWebCompositorOutputSurface):
+        (WebKit::FakeWebCompositorOutputSurface::create):
+        (WebKit::FakeWebCompositorOutputSurface::FakeWebCompositorOutputSurface):
+        * tests/LayerRendererChromiumTest.cpp:
+        (LayerRendererChromiumTest::LayerRendererChromiumTest):
+        (TEST):
+        * tests/WebLayerTest.cpp:
+        * tests/WebLayerTreeViewTest.cpp:
+
+2012-08-09  Nat Duca  <nduca@chromium.org>
+
+        Unreviewed, rolling out r125212.
+        http://trac.webkit.org/changeset/125212
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Compile failure on mac dbg builder
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebSettings.h:
+        * public/WebViewClient.h:
+        (WebKit):
+        (WebViewClient):
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::Settings::operator CCLayerTreeSettings):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit::WebLayerTreeViewClientAdapter::WebLayerTreeViewClientAdapter):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::WebSettingsImpl):
+        (WebKit::WebSettingsImpl::setForceSoftwareCompositing):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebKit::WebSettingsImpl::forceSoftwareCompositing):
+        (WebSettingsImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::createCompositorGraphicsContext3D):
+        (WebKit::WebViewImpl::createContext3D):
+        (WebKit::WebViewImpl::didRebindGraphicsContext):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF):
+        (WTF::CCLayerTreeHostTestSetSingleLostContext::didRecreateContext):
+        (WTF::CCLayerTreeHostTestSetRepeatedLostContext::didRecreateContext):
+        * tests/CCResourceProviderTest.cpp:
+        (WebKit::CCResourceProviderTest::CCResourceProviderTest):
+        * tests/CCTextureUpdateControllerTest.cpp:
+        * tests/CCThreadedTest.cpp:
+        (WebKitTests::TestHooks::createContext):
+        * tests/CCThreadedTest.h:
+        (WebKitTests::TestHooks::didRecreateContext):
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        (Canvas2DLayerBridgeTest::fullLifecycleTest):
+        * tests/FakeCCGraphicsContext.h:
+        (WebKit::createFakeCCGraphicsContext):
+        * tests/FakeCCLayerTreeHostClient.h:
+        * tests/FakeWebCompositorOutputSurface.h: Removed.
+        * tests/LayerRendererChromiumTest.cpp:
+        (LayerRendererChromiumTest::LayerRendererChromiumTest):
+        (TEST):
+        * tests/WebLayerTest.cpp:
+        * tests/WebLayerTreeViewTest.cpp:
+
+2012-08-09  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Rename V8BindingPerIsolateData to V8PerIsolateData
+        https://bugs.webkit.org/show_bug.cgi?id=93592
+
+        Reviewed by Adam Barth.
+
+        For a better name. See discussion in bug 93333.
+
+        No tests. No change in behavior.
+
+        * src/WebKit.cpp:
+        (WebKit::initialize):
+
+2012-08-06  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Expose CCGraphicsContext as WebCompositorOutputSurface
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Reviewed by James Robinson.
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebSettings.h:
+        * public/WebViewClient.h:
+        (WebKit):
+        (WebViewClient):
+        (WebKit::WebViewClient::createOutputSurface):
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::Settings::operator CCLayerTreeSettings):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit):
+        (WebGraphicsContextToOutputSurfaceAdapter):
+        (WebKit::WebGraphicsContextToOutputSurfaceAdapter::WebGraphicsContextToOutputSurfaceAdapter):
+        (WebKit::WebLayerTreeViewClientAdapter::WebLayerTreeViewClientAdapter):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::WebSettingsImpl):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::createOutputSurface):
+        (WebKit):
+        (WebKit::WebViewImpl::didRebindGraphicsContext):
+        (WebKit::WebViewImpl::didRecreateOutputSurface):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF):
+        (WTF::CCLayerTreeHostTestSetSingleLostContext::didRecreateOutputSurface):
+        (WTF::CCLayerTreeHostTestSetRepeatedLostContext::didRecreateOutputSurface):
+        * tests/CCResourceProviderTest.cpp:
+        (WebKit::CCResourceProviderTest::CCResourceProviderTest):
+        * tests/CCTextureUpdateControllerTest.cpp:
+        * tests/CCThreadedTest.cpp:
+        (WebKitTests::TestHooks::createOutputSurface):
+        * tests/CCThreadedTest.h:
+        (WebKitTests::TestHooks::didRecreateOutputSurface):
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        (Canvas2DLayerBridgeTest::fullLifecycleTest):
+        * tests/FakeCCGraphicsContext.h:
+        (WebKit::createFakeCCGraphicsContext):
+        * tests/FakeCCLayerTreeHostClient.h:
+        * tests/FakeWebCompositorOutputSurface.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h.
+        (WebKit):
+        (FakeWebCompositorOutputSurface):
+        (WebKit::FakeWebCompositorOutputSurface::create):
+        (WebKit::FakeWebCompositorOutputSurface::FakeWebCompositorOutputSurface):
+        * tests/LayerRendererChromiumTest.cpp:
+        (LayerRendererChromiumTest::LayerRendererChromiumTest):
+        (TEST):
+        * tests/WebLayerTest.cpp:
+        * tests/WebLayerTreeViewTest.cpp:
+
+2012-08-09  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: additional chromium signature for openCursor
+        https://bugs.webkit.org/show_bug.cgi?id=93637
+
+        Reviewed by Adam Barth.
+
+        Stub out the TaskType-based openCursor in the chromium API.
+
+        * src/WebIDBObjectStoreImpl.cpp:
+        (WebKit::WebIDBObjectStoreImpl::openCursor):
+        * src/WebIDBObjectStoreImpl.h:
+        (WebKit::WebIDBObjectStoreImpl::openCursor):
+        (WebIDBObjectStoreImpl):
+
+2012-08-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Do partial-swap scissoring on quads during draw instead of on layers
+        https://bugs.webkit.org/show_bug.cgi?id=91800
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCDamageTrackerTest.cpp:
+        (WebKitTests::executeCalculateDrawTransformsAndVisibility):
+        * tests/CCLayerIteratorTest.cpp:
+        * tests/CCLayerTreeHostCommonTest.cpp:
+        Removed tests of the scissor rect here, as they are no longer
+        computed within CCLayerTreeHostCommon. Verify that the scissor
+        does not affect texture caching in CCLayerTreeHostImplTest now.
+        Previous scissor would affect the texture cache decisions, but
+        this was incorrect, as damaged areas are always inside the
+        scissor rect, and anything outside the scissor rect should
+        be considered as valid and complete (assuming no external
+        occlusion, which is computed outside the scissor rect now also).
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        Removed didDrawNotCalledOnScissoredLayer test, as this no longer
+        applies. didDraw will be called on layers that are outside the
+        partial swap rect, regardless.
+
+        Removed partialSwapNoUpdate test, and merged its functionality into
+        the partialSwap test while updating its expectations.
+
+        Added textureCachingWithScissor, which is loosely based on the
+        CCLayerTreeHostCommonTest.scissorRectWithClip test.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebKitTests::CCOcclusionTrackerTest::calcDrawEtc):
+        (WebKitTests::CCOcclusionTrackerTestChildInRotatedChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestVisitTargetTwoTimes::runMyTest):
+        * tests/CCQuadCullerTest.cpp:
+        * tests/CCRenderSurfaceTest.cpp:
+        * tests/CCSolidColorLayerImplTest.cpp:
+        (CCLayerTestCommon::TEST):
+        * tests/CCTiledLayerImplTest.cpp:
+        (CCLayerTestCommon::createLayer):
+        * tests/LayerRendererChromiumTest.cpp:
+        (LayerRendererChromiumTest::swapBuffers):
+        (TEST_F):
+        (TEST):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-09  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Pass mask scale and offset to shaders for correct masking
+        https://bugs.webkit.org/show_bug.cgi?id=93558
+
+        Reviewed by Adrienne Walker.
+
+        Updated one unit test that needed additional args in a
+        constructor, but no change in behavior of the test.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: add codemirror library as an experiment
+        https://bugs.webkit.org/show_bug.cgi?id=93620
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebKit.gyp:
+
+2012-08-09  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed, rolling out r125171.
+        http://trac.webkit.org/changeset/125171
+
+        Broke the Chromium Android build.
+
+        * DEPS:
+
+2012-08-09  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-09  Keishi Hattori  <keishi@webkit.org>
+
+        Page popups can show up at wrong locations
+        https://bugs.webkit.org/show_bug.cgi?id=93556
+
+        Reviewed by Kent Tamura.
+
+        We were showing the popup at wrong positions. When there isn't enough
+        room below and above the element it adjusts the position but we weren't
+        resetting the adjustment when we resize the popup. This patch will make
+        the popup adjust the popup position each time we resize.
+
+        * src/ColorChooserUIController.cpp:
+        (WebKit::ColorChooserUIController::contentSize):
+        * src/WebPagePopupImpl.cpp:
+        (WevKit::PagePopupChromeClient::setWindowRect):
+        (WebKit::WebPagePopupImpl::init): Use reposition().
+        (WebKit::WebPagePopupImpl::reposition): Repositions the page popup based on the popup size.
+        (WebKit):
+        (WebKit::WebPagePopupImpl::resize): Use reposition().
+        * src/WebPagePopupImpl.h:
+        (WebPagePopupImpl):
+
+2012-08-09  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Pull in the android_tools directory for Android
+        https://bugs.webkit.org/show_bug.cgi?id=84843
+
+        Reviewed by Jochen Eisinger.
+
+        Pull in the android_tools directory for Chromium Android checkouts. This
+        repository, living in Chromium's, contains checked in versions of the
+        Android NDK and SDK meant to make builds and updates easier.
+
+        * DEPS:
+
+2012-08-08  Shane Stephens  <shanestephens@google.com>
+
+        Compile flag for CSS Hierarchies
+        https://bugs.webkit.org/show_bug.cgi?id=92433
+
+        Reviewed by Tony Chang.
+
+        * features.gypi:
+
+2012-08-08  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-mac] Switch to LocalizedNumberMac from LocalizedNumberICU
+        https://bugs.webkit.org/show_bug.cgi?id=93432
+
+        Reviewed by Hajime Morita.
+
+        * tests/LocaleMacTest.cpp:
+        Add some tests for number localization. They are similar to tests in
+        LocaleWinTest and LocalizedNumberICUTest.cpp
+        (LocaleMacTest):
+        (LocaleMacTest::decimalSeparator):
+        (TEST_F):
+        (testNumberIsReversible):
+        (testNumbers):
+
+2012-08-08  Adrienne Walker  <enne@google.com>
+
+        [chromium] Move scrollbar pointer into WebScrollbarThemePainter
+        https://bugs.webkit.org/show_bug.cgi?id=93541
+
+        Reviewed by James Robinson.
+
+        Fix WebScrollbarThemePainter implementation to make direct calls on
+        the scrollbar rather than through the WebScrollbarThemeClientImpl
+        adapter.
+
+        * src/WebScrollbarThemePainter.cpp:
+        (WebKit::WebScrollbarThemePainter::assign):
+        (WebKit::WebScrollbarThemePainter::paintScrollbarBackground):
+        (WebKit::WebScrollbarThemePainter::paintTrackBackground):
+        (WebKit::WebScrollbarThemePainter::paintBackTrackPart):
+        (WebKit::WebScrollbarThemePainter::paintForwardTrackPart):
+        (WebKit::WebScrollbarThemePainter::paintBackButtonStart):
+        (WebKit::WebScrollbarThemePainter::paintBackButtonEnd):
+        (WebKit::WebScrollbarThemePainter::paintForwardButtonStart):
+        (WebKit::WebScrollbarThemePainter::paintForwardButtonEnd):
+        (WebKit::WebScrollbarThemePainter::paintTickmarks):
+        (WebKit::WebScrollbarThemePainter::paintThumb):
+        (WebKit::WebScrollbarThemePainter::WebScrollbarThemePainter):
+        * tests/ScrollbarLayerChromiumTest.cpp:
+        (WebCore::TEST):
+
+2012-08-08  Alexei Svitkine  <asvitkine@chromium.org>
+
+        [chromium/mac] Map NSEventPhaseMayBegin appropriately on 10.8
+        https://bugs.webkit.org/show_bug.cgi?id=93535
+
+        Reviewed by Dimitri Glazkov.
+
+        This enables putting two fingers on the track pad to show overlay scroll bars on 10.8+.
+
+        * src/mac/WebInputEventFactory.mm:
+        (WebKit::phaseForNSEventPhase):
+
+2012-08-08  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Fix up includes and types in chromium compositor unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=93553
+
+        Reviewed by Adrienne Walker.
+
+        This removes some unused GraphicsContext3DPrivate.h includes and adds some includes that were being implicitely
+        depending upon - mostly for wtf/PassOwnPtr.h.
+
+        * tests/CCLayerTreeHostTest.cpp:
+        (::CCLayerTreeHostTestCommit::beginTest):
+        (::CCLayerTreeHostTestCommit::commitCompleteOnCCThread):
+        * tests/CCRenderSurfaceFiltersTest.cpp:
+        * tests/CompositorFakeWebGraphicsContext3D.h:
+        * tests/FakeGraphicsContext3DTest.cpp:
+        * tests/FakeWebScrollbarThemeGeometry.h:
+        * tests/TextureCopierTest.cpp:
+        * tests/ThrottledTextureUploaderTest.cpp:
+
+2012-08-08  Eric Penner  <epenner@google.com>
+
+        [chromium] Refactor tile flags.
+        https://bugs.webkit.org/show_bug.cgi?id=93059
+
+        Reviewed by Adrienne Walker.
+
+        Minor fixes to existing tests.
+
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-08  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Clean up WebKit.h and WebKitPlatformSupport.h includes in chromium/src
+        https://bugs.webkit.org/show_bug.cgi?id=93539
+
+        Reviewed by Adam Barth.
+
+        Most of these files don't need either WebKit.h or WebKitPlatformSupport.h. Some need <public/Platform.h>, and
+        some are relying on the forwarding headers. This updates includes to what is actually needed and points platform
+        includes at <public/Foo.h> instead of "platform/Foo.h" where possible.
+
+        * src/ApplicationCacheHostInternal.h:
+        * src/AssociatedURLLoader.cpp:
+        * src/AsyncFileSystemChromium.cpp:
+        (WebCore::AsyncFileSystemChromium::AsyncFileSystemChromium):
+        * src/BlobRegistryProxy.cpp:
+        * src/ChromiumCurrentTime.cpp:
+        * src/ChromiumOSRandomSource.cpp:
+        * src/ChromiumThreading.cpp:
+        * src/EditorClientImpl.cpp:
+        * src/FrameLoaderClientImpl.cpp:
+        * src/IDBFactoryBackendProxy.cpp:
+        * src/LocalizedStrings.cpp:
+        * src/PlatformMessagePortChannel.cpp:
+        * src/WebCompositorInputHandlerImpl.cpp:
+        * src/WebMediaPlayerClientImpl.cpp:
+        * src/WebPluginContainerImpl.cpp:
+        * src/WebViewImpl.cpp:
+        * src/WebWorkerClientImpl.cpp:
+        * src/WorkerAsyncFileSystemChromium.cpp:
+        * src/WorkerFileWriterCallbacksBridge.cpp:
+
+2012-08-08  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Clean up includes in compositor unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=93531
+
+        Reviewed by Adrienne Walker.
+
+        This removes unused includes and updates Platform API headers to use the <public/Web...> style paths.
+
+        * tests/CCAnimationTestCommon.cpp:
+        * tests/CCKeyframedAnimationCurveTest.cpp:
+        * tests/CCLayerAnimationControllerTest.cpp:
+        * tests/CCLayerTreeHostCommonTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::CCLayerTreeHostTestLayerAddedWithAnimation::beginTest):
+        * tests/CCOcclusionTrackerTest.cpp:
+        * tests/CCTextureUpdateControllerTest.cpp:
+        * tests/CCThreadedTest.cpp:
+        * tests/FakeWebGraphicsContext3D.h:
+        * tests/LayerChromiumTest.cpp:
+        * tests/LayerRendererChromiumTest.cpp:
+        * tests/TiledLayerChromiumTest.cpp:
+        * tests/WebCompositorInputHandlerImplTest.cpp:
+        * tests/WebLayerTest.cpp:
+        * tests/WebLayerTreeViewTest.cpp:
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Only use public Platform API in NonCompositedContentHost
+        https://bugs.webkit.org/show_bug.cgi?id=93423
+
+        Reviewed by Adrienne Walker.
+
+        Switches to using Web*Layer APIs in NonCompositedContentHost instead of reaching in to the LayerChromium and
+        updates unit tests for the nonCompositedContent->useLCDText flag rename.
+
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::NonCompositedContentHost):
+        * src/WebContentLayer.cpp:
+        (WebKit::WebContentLayer::setUseLCDText):
+        (WebKit):
+        (WebKit::WebContentLayer::setDrawCheckerboardForMissingTiles):
+        * src/WebViewImpl.cpp:
+        * tests/CCLayerImplTest.cpp:
+        (WebCore::TEST):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/LayerChromiumTest.cpp:
+
+2012-08-08  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: new enums and openCursor stub
+        https://bugs.webkit.org/show_bug.cgi?id=93410
+
+        Reviewed by Adam Barth.
+
+        This stubs out the TaskType and Direction enums that will be
+        required to land the chromium side of
+        https://bugs.webkit.org/show_bug.cgi?id=91125.
+
+        * public/WebIDBCursor.h:
+        * public/WebIDBObjectStore.h:
+        (WebKit::WebIDBObjectStore::setIndexKeys):
+        (WebKit::WebIDBObjectStore::setIndexesReady):
+        (WebIDBObjectStore):
+        (WebKit::WebIDBObjectStore::openCursor):
+        * public/WebIDBTransaction.h:
+
+2012-08-08  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Enable occlusion tracker in the occlusion tests for surface cacheing
+        https://bugs.webkit.org/show_bug.cgi?id=93500
+
+        Reviewed by Adrienne Walker.
+
+        The occlusion tracker is not being used in these tests except to do
+        scissoring. We want to test occlusion with these occlusion tests,
+        and when scissoring is not part of occlusion tracker, these
+        tests would become useless otherwise.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-08  Adam Barth  <abarth@webkit.org>
+
+        Crash when reloading a Chromium "platform" app
+        https://bugs.webkit.org/show_bug.cgi?id=93497
+
+        Reviewed by Eric Seidel.
+
+        Test that we don't crash when executing script during the
+        didCreateScriptContext callback.
+
+        * tests/WebFrameTest.cpp:
+        * tests/data/hello_world.html: Added.
+
+2012-08-07  Joshua Bell  <jsbell@chromium.org>
+
+        Layout Test storage/indexeddb/intversion-omit-parameter.html is flaky
+        https://bugs.webkit.org/show_bug.cgi?id=92952
+
+        Reviewed by Tony Chang.
+
+        Added test to exercise WebCore::IDBRequest event callbacks after
+        the script context has stopped and ensure no asserts are hit.
+
+        * WebKit.gypi:
+        * tests/IDBRequestTest.cpp: Added.
+        (WebCore):
+        (WebCore::TEST):
+
+2012-08-07  Fady Samuel  <fsamuel@chromium.org>
+
+        Allow plugins to decide whether they are keyboard focusable
+        https://bugs.webkit.org/show_bug.cgi?id=88958
+
+        Reviewed by Anders Carlsson.
+
+        * public/WebPlugin.h:
+        (WebKit::WebPlugin::supportsKeyboardFocus):
+        * src/WebInputEventConversion.cpp:
+        (WebKit::WebKeyboardEventBuilder::WebKeyboardEventBuilder):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::supportsKeyboardFocus):
+        (WebKit):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Implement V8Proxy::registerExtensionIfNeeded() and remove redundant methods
+        https://bugs.webkit.org/show_bug.cgi?id=93209
+
+        Reviewed by Adam Barth.
+
+        By implementing V8Proxy::registerExtensionIfNeeded(), we can remove
+        registeredExtensionWithV8() and registerExtension().
+
+        No tests. No change in behavior.
+
+        * src/WebScriptController.cpp:
+        (WebKit::WebScriptController::registerExtension):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Add new gclient-managed cc directory to Source/WebKit/chromium/.gitignore
+        https://bugs.webkit.org/show_bug.cgi?id=93403
+
+        Reviewed by Eric Seidel.
+
+        * .gitignore:
+
+2012-08-07  Mihai Parparita  <mihaip@chromium.org>
+
+        [Chromium] Clean up WebScriptController.h comments
+        https://bugs.webkit.org/show_bug.cgi?id=93399
+
+        Reviewed by Adam Barth.
+
+        Remove references to overloaded WebScriptController::registerExtension
+        variants. They were removed in r68666.
+
+        * public/WebScriptController.h:
+        (WebScriptController):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove #include Frame.h from V8Binding.h
+        https://bugs.webkit.org/show_bug.cgi?id=93326
+
+        Reviewed by Adam Barth.
+
+        We want to remove unnecessary #include in V8Binding.h
+        to avoid circular include dependency.
+
+        No tests. No change in behavior.
+
+        * src/WebBindings.cpp:
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Switch PlatformLayer typedef to Platform API type for PLATFORM(CHROMIUM)
+        https://bugs.webkit.org/show_bug.cgi?id=93335
+
+        Reviewed by Adrienne Walker.
+
+        Update for new PlatformLayer typedef. This removes knowledge of WebCore::LayerChromium from all classes
+        except for NonCompositedContentHost, which still punches through for a few minor APIs that I'll address
+        in a separate patch.
+
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::NonCompositedContentHost):
+        (WebKit::NonCompositedContentHost::setScrollLayer):
+        (WebKit::NonCompositedContentHost::scrollLayer):
+        (WebKit::NonCompositedContentHost::notifySyncRequired):
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::platformLayer):
+        * src/WebMediaPlayerClientImpl.h:
+        (WebMediaPlayerClientImpl):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::platformLayer):
+        * src/WebPluginContainerImpl.h:
+        (WebCore):
+        (WebPluginContainerImpl):
+        * src/WebScrollableLayer.cpp:
+        (WebKit::WebScrollableLayer::setNonFastScrollableRegion):
+        (WebKit):
+        (WebKit::WebScrollableLayer::setIsContainerForFixedPositionLayers):
+        (WebKit::WebScrollableLayer::setFixedToContainerLayer):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setRootGraphicsLayer):
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        * tests/GraphicsLayerChromiumTest.cpp:
+        (WebKitTests::GraphicsLayerChromiumTest::GraphicsLayerChromiumTest):
+        (WebKitTests::TEST_F):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use WebCompositor interface in Platform API instead of CCProxy to query threaded compositor status
+        https://bugs.webkit.org/show_bug.cgi?id=93398
+
+        Reviewed by Adam Barth.
+
+        Converts non-compositor code that cares about threaded compositing status over to query WebCompositor instead of
+        CCProxy.
+
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::supportsType):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::composite):
+        (WebKit::WebViewImpl::scheduleAnimation):
+        (WebKit::WebViewImpl::scheduleComposite):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move WebCompositor interface into Platform AP
+        https://bugs.webkit.org/show_bug.cgi?id=93391
+
+        Reviewed by Adam Barth.
+
+        * WebKit.gyp:
+        * public/WebCompositor.h:
+        * src/WebLayerTreeViewImpl.cpp:
+
+2012-08-07  Joshua Bell  <jsbell@chromium.org>
+
+        REGRESSION(r124865): It broke the ARM Chromium build
+        https://bugs.webkit.org/show_bug.cgi?id=93364
+
+        Reviewed by Csaba Osztrogonác.
+
+        Mark large constant with LL to satisfy a picky compiler.
+
+        * tests/IDBLevelDBCodingTest.cpp:
+        (IDBLevelDBCoding::TEST):
+
+2012-08-07  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: make the MemoryClassInfo class a not-template
+        https://bugs.webkit.org/show_bug.cgi?id=93265
+
+        Reviewed by Yury Semikhatsky.
+
+        * tests/MemoryInstrumentationTest.cpp:
+        (WebCore::Instrumented::reportMemoryUsage):
+        (WebCore::InstrumentedRefPtr::reportMemoryUsage):
+        (WebCore::InstrumentedWithOwnPtr::reportMemoryUsage):
+        (WebCore::InstrumentedOther::reportMemoryUsage):
+        (WebCore::InstrumentedDOM::reportMemoryUsage):
+        (WebCore::NonVirtualInstrumented::reportMemoryUsage):
+
+2012-08-06  Yuta Kitamura  <yutak@chromium.org>
+
+        WebSocket.send() should accept ArrayBufferView
+        https://bugs.webkit.org/show_bug.cgi?id=90877
+
+        Reviewed by Kent Tamura.
+
+        * src/WebSocketImpl.cpp:
+        (WebKit::WebSocketImpl::sendArrayBuffer):
+        Apply change in function signature of WebSocketChannel::send().
+
+2012-08-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove lingering unwrap<>() calls in GraphicsLayerChromium.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=93319
+
+        Reviewed by Adrienne Walker.
+
+        * src/WebLayer.cpp:
+        (WebKit::WebLayer::setChildren):
+        (WebKit):
+        (WebKit::WebLayer::setReplicaLayer):
+        (WebKit::WebLayer::setDebugName):
+        (WebKit::WebLayer::clearRenderSurface):
+
+2012-08-06  Adrienne Walker  <enne@google.com>
+
+        [chromium] Convert WebScrollbarThemeGeometry from a concrete class to an interface
+        https://bugs.webkit.org/show_bug.cgi?id=93308
+
+        Reviewed by James Robinson.
+
+        Now that WebScrollbarThemeGeometry can have different implementations,
+        create a FakeWebScrollbarThemeGeometry for testing purposes rather
+        than just overriding a geometry-related virtual.
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * src/WebScrollbarLayer.cpp:
+        (WebKit::WebScrollbarLayer::create):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/FakeWebScrollbarThemeGeometry.h: Added.
+        (WebKit):
+        (FakeWebScrollbarThemeGeometry):
+        (WebKit::FakeWebScrollbarThemeGeometry::create):
+        * tests/ScrollbarLayerChromiumTest.cpp:
+        (WebCore::TEST):
+
+2012-08-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Update chromium DEPS r150037 -> r150169
+        https://bugs.webkit.org/show_bug.cgi?id=93309
+
+        As the title says. Unreviewed.
+
+        * DEPS:
+
+2012-08-06  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Rename CCTextureUpdater to CCTextureUpdateQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=93293
+
+        Reviewed by Adrienne Walker.
+
+        * src/WebExternalTextureLayer.cpp:
+        (WebKit::WebTextureUpdaterImpl::WebTextureUpdaterImpl):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::CCLayerTreeHostTestLayerOcclusion::beginTest):
+        (WTF::CCLayerTreeHostTestLayerOcclusionWithFilters::beginTest):
+        (WTF::CCLayerTreeHostTestManySurfaces::beginTest):
+        * tests/CCTextureUpdateControllerTest.cpp:
+        * tests/CCThreadedTest.cpp:
+        * tests/CCTiledLayerTestCommon.cpp:
+        (WebKitTests::FakeTiledLayerChromium::update):
+        * tests/CCTiledLayerTestCommon.h:
+        (FakeTiledLayerChromium):
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-06  Bear Travis  <betravis@adobe.com>
+
+        [CSS Exclusions] Add a command-line flag to enable / disable exclusions
+        https://bugs.webkit.org/show_bug.cgi?id=91420
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the interface code to expose the css exclusions runtime flag to
+        Chromium.
+
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures): Adding getters/setters for cssExclusions
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::enableCSSExclusions):
+        (WebKit):
+        (WebKit::WebRuntimeFeatures::isCSSExclusionsEnabled):
+
+2012-08-06  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] WebTouchCandidatesInfo should be part of the Client API
+        https://bugs.webkit.org/show_bug.cgi?id=93088
+
+        Reviewed by Eric Seidel.
+
+        * WebKit.gyp:
+        * public/WebTouchCandidatesInfo.h: Copied from Source/Platform/chromium/public/WebTouchCandidatesInfo.h.
+        * src/WebViewImpl.cpp:
+
+2012-08-06  Adrienne Walker  <enne@google.com>
+
+        [chromium] REGRESSION(r124714): webkit_unit_tests asserts in Debug
+        https://bugs.webkit.org/show_bug.cgi?id=93297
+
+        Reviewed by James Robinson.
+
+        This is a quick fix to get debug unit tests working again by
+        implementing a virtual function that has ASSERT_NOT_REACHED in the
+        base class version.
+
+        * tests/ScrollAnimatorNoneTest.cpp:
+        (MockScrollableArea::scrollPosition):
+
+2012-08-06  Nasko Oskov  <nasko@chromium.org>
+
+        Adding APIs to Chromium WebKit API to allow for creating and monitoring frame hierarchy.
+        https://bugs.webkit.org/show_bug.cgi?id=93127
+
+        Reviewed by Adam Barth.
+
+        Add support in the API to monitor and create frame hierarchy to allow replicating it
+        across different instances of WebKit.
+
+        * public/WebDocument.h:
+        (WebDocument): Added createElement.
+        * public/WebFrame.h: Added assignedName.
+        * public/WebFrameClient.h:
+        (WebFrameClient):
+        (WebKit::WebFrameClient::didCreateFrame): Added to allow embedders to know when frames are created.
+        (WebKit::WebFrameClient::willCheckAndDispatchMessageEvent): Added the target frame as a parameter.
+        * public/WebNode.h:
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::willCheckAndDispatchMessageEvent):
+        * src/WebDocument.cpp:
+        (WebKit::WebDocument::createElement): Added to allow for creating frame elements.
+        (WebKit):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::uniqueName): Added to migrate callers to the matching WebCore API.
+        (WebKit):
+        (WebKit::WebFrameImpl::assignedName): Returns the name given to a frame, as opposed 
+        to the unique name, generated by WebKit.
+        (WebKit::WebFrameImpl::createChildFrame): Added call to the frame client's didCreateFrame.
+        * src/WebFrameImpl.h:
+        (WebFrameImpl):
+        * src/WebNode.cpp:
+        (WebKit::WebNode::appendChild): Added to allow for adding elements to the DOM.
+        (WebKit):
+        * tests/WebFrameTest.cpp:
+
+2012-08-06  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Refactor CCTextureUpdater into CCTextureUpdater and CCTextureUpdateController.
+        https://bugs.webkit.org/show_bug.cgi?id=92596
+
+        Reviewed by Adrienne Walker.
+
+        * WebKit.gypi:
+        * src/WebExternalTextureLayer.cpp:
+        * tests/CCTextureUpdateControllerTest.cpp: Renamed from Source/WebKit/chromium/tests/CCTextureUpdaterTest.cpp.
+        * tests/CCTiledLayerTestCommon.h:
+        (WebKitTests::FakeTextureCopier::copyTexture):
+        (WebKitTests::FakeTextureUploader::uploadTexture):
+        * tests/TextureCopierTest.cpp:
+        (TEST):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-06  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Non-preserves-3d requires explicit flattening of screen-space transform.
+        https://bugs.webkit.org/show_bug.cgi?id=85808
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCLayerTreeHostCommonTest.cpp:
+
+2012-08-06  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: rename WorkerAgent.setWorkerInspectionEnabled to WorkerAgent.enable and make it return error
+        https://bugs.webkit.org/show_bug.cgi?id=92545
+
+        Reviewed by Pavel Feldman.
+
+        Replaced Preferences.exposeWorkersInspection with InspectorFrontendHost.canInspectWorkers()
+        that tells if inspector front-end on the given platform can launch dedicated worker
+        front-end.
+
+        * src/InspectorFrontendClientImpl.cpp:
+        (WebKit::InspectorFrontendClientImpl::canInspectWorkers):
+        (WebKit):
+        * src/InspectorFrontendClientImpl.h:
+        (InspectorFrontendClientImpl):
+        * src/js/DevTools.js:
+
+2012-08-06  Keishi Hattori  <keishi@webkit.org>
+
+        Remove minimum window size for PagePopup
+        https://bugs.webkit.org/show_bug.cgi?id=93100
+
+        Reviewed by Kent Tamura.
+
+        * src/WebPagePopupImpl.cpp: Returns 0x0 so the page popup can be smaller than 100x100.
+
+2012-08-05  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-win] Use system locale for number representation
+        https://bugs.webkit.org/show_bug.cgi?id=93085
+
+        Reviewed by Hajime Morita.
+
+        * WebKit.gypi:
+        Don't include Localized*ICUTest.cpp in Windows and OSX. They are unnecessary.
+        * tests/LocaleWinTest.cpp:
+        (LocaleWinTest): Add some LCID symbols.
+        (LocaleWinTest::decimalSeparator):
+        A helper for LocaleWinTest.decimalSeparator.
+        (TEST_F(LocaleWinTest, decimalSeparator)):
+        A test for LocaleWin::localizedDecimalSeparator(). This is a copy of the
+        corresponding test in LocalizedNumberICUTest.cpp.
+        (testNumberIsReversible):
+        A test helper LocaleWinTest.localizedNumberRoundTrip. This is a copy of
+        the corresponding test in LocalizedNumberICUTest.cpp.
+        (testNumbers): ditto.
+        (TEST_F(LocaleWinTest, localizedNumberRoundTrip)):
+        Tests for LocaleWin changes. This is a copy of the corresponding tests
+        in LocalizedNumberICUTest.cpp.
+
+2012-08-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-03  Nico Weber  <thakis@chromium.org>
+
+        [chromium] Add API to make it possible to request all variants of a WebImage
+        https://bugs.webkit.org/show_bug.cgi?id=92933
+
+        Reviewed by Adam Barth.
+
+        Part of http://crbug.com/138550
+
+        * src/WebImageSkia.cpp:
+        (WebKit::WebImage::framesFromData):
+        (WebKit):
+
+2012-08-03  Yaron Friedman  <yfriedman@chromium.org>
+
+        [Chrome-Android] - Prepare apk tests for switch to checked in SDK.
+        https://bugs.webkit.org/show_bug.cgi?id=92931
+
+        Reviewed by Adam Barth.
+
+        Pass Android-specific gyp variables to the native test generator
+        avoiding any dependencies on environment variables during build time.
+
+        * WebKitUnitTests.gyp:
+
+2012-08-03  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Core upgradeneeded logic
+        https://bugs.webkit.org/show_bug.cgi?id=92558
+
+        Reviewed by Ojan Vafai.
+
+        Update overridden methods to match new signatures.
+
+        * tests/IDBAbortOnCorruptTest.cpp:
+        (WebCore::FailingBackingStore::createIDBDatabaseMetaData):
+        * tests/IDBFakeBackingStore.h:
+
+2012-08-03  Rick Byers  <rbyers@chromium.org>
+
+        Double tap gesture should send dblclick event
+        https://bugs.webkit.org/show_bug.cgi?id=92412
+
+        Reviewed by Adam Barth.
+
+        Tweak comment to more completely describe the (lame) overloaded use
+        of deltaX in WebGestureEvent, and add a FIXME with the bug to track
+        cleaning it up.
+        * public/WebInputEvent.h:
+        (WebGestureEvent):
+
+2012-08-03  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Remove assert when getting hardware renderingStats in software mode.
+        https://bugs.webkit.org/show_bug.cgi?id=92325
+
+        Reviewed by Adrienne Walker.
+
+        If a page caused hardware mode to be turned on, then off, the hardware stats are still valid, so we don't need to assert that we're in hardware mode. Checking if the LayerTreeView is null should be sufficient.
+
+        * public/WebWidget.h:
+        (WebWidget):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::renderingStats):
+        (WebKit::WebViewImpl::paint):
+        * src/WebViewImpl.h:
+
+2012-08-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124632.
+        http://trac.webkit.org/changeset/124632
+        https://bugs.webkit.org/show_bug.cgi?id=93154
+
+        Added new WebFrameTest.SelectRange which fails on bots
+        (Requested by dimich on #webkit).
+
+        * tests/WebFrameTest.cpp:
+        * tests/data/select_range_basic.html: Removed.
+        * tests/data/select_range_iframe.html: Removed.
+        * tests/data/select_range_scroll.html: Removed.
+
+2012-08-03  Terry Anderson  <tdanderson@chromium.org>
+
+        Apply target fuzzing when sending a context menu event
+        https://bugs.webkit.org/show_bug.cgi?id=92914
+
+        Reviewed by Antonio Gomes.
+
+        When constructing a PlatformEvent::GestureLongPress in WebInputEventConversion.cpp,
+        use |boundingBox| to specify |m_area|.
+
+        * src/WebInputEventConversion.cpp:
+        (WebKit::PlatformGestureEventBuilder::PlatformGestureEventBuilder):
+
+2012-08-03  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        [Chromium] Add stubs for the find-in-page match rects API
+        https://bugs.webkit.org/show_bug.cgi?id=93110
+
+        Reviewed by Adam Barth.
+
+        The Android port allows tapping on the find-in-page result tickmarks taking
+        the user to the corresponding matches. This patch introduces stubs for the
+        new required methods in order to achieve WebKit API compatibility for this
+        port as soon as possible. The implementation of these methods will be added
+        later in https://bugs.webkit.org/show_bug.cgi?id=93111.
+
+        * public/WebFrame.h:
+        (WebKit):
+        (WebFrame):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::findMatchMarkersVersion):
+        (WebKit):
+        (WebKit::WebFrameImpl::activeFindMatchRect):
+        (WebKit::WebFrameImpl::findMatchRects):
+        (WebKit::WebFrameImpl::selectNearestFindMatch):
+        * src/WebFrameImpl.h:
+        (WebFrameImpl):
+
+2012-08-03  Mike West  <mkwst@chromium.org>
+
+        Blocking a plugin via CSP should result in one (and only one) console message.
+        https://bugs.webkit.org/show_bug.cgi?id=92649
+
+        Reviewed by Adam Barth.
+
+        * src/LocalizedStrings.cpp:
+        (WebCore::blockedPluginByContentSecurityPolicyText):
+        (WebCore):
+            Adding a stub for the newly added string.
+
+2012-08-03  Oli Lan  <olilan@chromium.org>
+
+        [chromium] Add a test to WebFrameTest for selectRange and visiblePositionForWindowPoint.
+        https://bugs.webkit.org/show_bug.cgi?id=93108
+
+        Reviewed by Adam Barth.
+
+        Adds a new test WebFrameTest.SelectRange. This tests WebFrameImpl::selectRange, and also
+        serves to test WebFrameImpl::visiblePositionForWindowPoint as it is used by selectRange.
+
+        The test uses sample files that contain selected text on load. The test uses
+        WebViewImpl::selectionBounds to retrieve the ends of the selection, then unselects
+        and calls WebFrameImpl::selectRange to attempt to reselect the same text.
+
+        Three cases are tested: the normal case, the case where the selected text is offscreen
+        due to a scroll, and the case where the selected text is in an iframe. This allows the
+        problem cases and fix in https://bugs.webkit.org/show_bug.cgi?id=79117 to be tested.
+
+        * tests/WebFrameTest.cpp:
+        * tests/data/select_range_basic.html: Added.
+        * tests/data/select_range_iframe.html: Added.
+        * tests/data/select_range_scroll.html: Added.
+
+2012-08-03  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: eliminate visitBaseClass method from NMI. It introduces unnecessary complexity.
+        https://bugs.webkit.org/show_bug.cgi?id=93129
+
+        Reviewed by Yury Semikhatsky.
+
+        * tests/MemoryInstrumentationTest.cpp:
+        (WebCore::InstrumentedWithOwnPtr::reportMemoryUsage):
+
+2012-08-03  Adam Barth  <abarth@webkit.org>
+
+        V8Proxy::retrieve(*) leads to really obfuscated code and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=93072
+
+        Reviewed by Eric Seidel.
+
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgentImpl::didCreateScriptContext):
+
+2012-08-02  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: extend test coverage for nmi code and fix 2 bugs.
+        https://bugs.webkit.org/show_bug.cgi?id=92994
+
+        Reviewed by Yury Semikhatsky.
+
+        1) owner object type propagation.
+        If a class with object-type DOM has an instrumented member with object-type Other then it has to be recorded as DOM.
+        Sample: We have SharedBuffer class and we don't know the object-type for it but we know that it is owned by an object with object-type CachedResourceImage.
+
+        2) the first member of an instrumented non virtual class was skipped even if it was reported properly.
+        it happened because the first member has the same address as it's owner
+
+        * tests/MemoryInstrumentationTest.cpp:
+        (WebCore::TEST):
+        (WebCore):
+        (InstrumentedOther):
+        (WebCore::InstrumentedOther::InstrumentedOther):
+        (WebCore::InstrumentedOther::reportMemoryUsage):
+        (InstrumentedDOM):
+        (WebCore::InstrumentedDOM::InstrumentedDOM):
+        (WebCore::InstrumentedDOM::reportMemoryUsage):
+        (NonVirtualInstrumented):
+        (WebCore::NonVirtualInstrumented::reportMemoryUsage):
+
+2012-08-02  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: remove leftover chromium stubs from putIndexWithKeys
+        https://bugs.webkit.org/show_bug.cgi?id=93032
+
+        Reviewed by Darin Fisher.
+
+        Remove old chromium APIs that are no longer called by chrome.
+
+        * public/WebIDBCursor.h:
+        * public/WebIDBObjectStore.h:
+        * public/WebIDBTransaction.h:
+
+2012-08-02  Antoine Labour  <piman@chromium.org>
+
+        [chromium] add lost context test case for HW video decoder
+        https://bugs.webkit.org/show_bug.cgi?id=93057
+
+        Reviewed by Adrienne Walker.
+
+        We check that we don't use resources after a lost context (assuming
+        proper WebVideoFrameProvider behavior).
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124540.
+        http://trac.webkit.org/changeset/124540
+        https://bugs.webkit.org/show_bug.cgi?id=93055
+
+        Broke compile on Chromium Win bot (Requested by dimich on
+        #webkit).
+
+        * tests/IDBAbortOnCorruptTest.cpp:
+        (WebCore::FailingBackingStore::createIDBDatabaseMetaData):
+        * tests/IDBFakeBackingStore.h:
+
+2012-08-02  Alexandre Elias  <aelias@google.com>
+
+        [chromium] deviceViewportSize cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=92794
+
+        Reviewed by Adrienne Walker.
+
+        In the future, CSS layout size will become increasingly disassociated
+        from physical device size, and it will become impossible to infer one
+        from the other inside the compositor.  Therefore, this patch allows
+        deviceViewportSize to be explicitly passed in by the outside client.
+
+        I also renamed the existing viewportSize field to "layoutViewportSize"
+        for clarity, and converted its uses to deviceViewportSize since
+        that is more appropriate.
+
+        I had to add some default-value scaffolding to WebLayerTreeView in
+        order to avoid breaking ui/compositor.  We can delete it once that's
+        updated.
+
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::setViewportSize):
+        (WebKit::WebLayerTreeView::layoutViewportSize):
+        (WebKit):
+        (WebKit::WebLayerTreeView::deviceViewportSize):
+        (WebKit::WebLayerTreeView::setDeviceScaleFactor):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::paint):
+        (WebKit::WebViewImpl::updateLayerTreeViewport):
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        V8Proxy::currentContext() doesn't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=93041
+
+        Reviewed by Eric Seidel.
+
+        * src/WebBindings.cpp:
+        (WebKit::makeIntArrayImpl):
+        (WebKit::makeStringArrayImpl):
+
+2012-08-02  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Core upgradeneeded logic
+        https://bugs.webkit.org/show_bug.cgi?id=92558
+
+        Reviewed by Ojan Vafai.
+
+        Update overridden methods to match new signatures.
+
+        * tests/IDBAbortOnCorruptTest.cpp:
+        (WebCore::FailingBackingStore::createIDBDatabaseMetaData):
+        * tests/IDBFakeBackingStore.h:
+
+2012-08-02  Vincent Scheib  <scheib@chromium.org>
+
+        Remove old Pointer Lock API.
+        https://bugs.webkit.org/show_bug.cgi?id=88892
+
+        Reviewed by Adam Barth.
+
+        * src/WebViewImpl.cpp:
+            Removed #include to old API header.
+
+2012-08-02  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] Add CCScrollbarAnimationController class for compositor scrollbar animation
+        https://bugs.webkit.org/show_bug.cgi?id=91688
+
+        Reviewed by Adrienne Walker.
+
+        New unit test ScrollbarLayerChromiumTest.scrollOffsetSynchronization to verify
+        scroll offset is updated during tree synchronization and threaded scrolling.
+        Another new unit test CCScrollbarAnimationControllerLinearFadeTest to verify
+        opacity animates as intended.
+
+        * tests/ScrollbarLayerChromiumTest.cpp:
+
+2012-08-02  Adrienne Walker  <enne@google.com>
+
+        [chromium] Make CCScrollbarLayerImpl handle lost contexts properly
+        https://bugs.webkit.org/show_bug.cgi?id=93021
+
+        Reviewed by James Robinson.
+
+        Add CCScrollbarLayerImpl to the dontUseOldResourceAfterLostContext
+        test. Additionally, modify this test so that stale resource ids
+        properly point at invalid texture ids so that the test actually tests
+        what it is supposed to be testing.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        The generic bindings shouldn't use templates
+        https://bugs.webkit.org/show_bug.cgi?id=93016
+
+        Reviewed by Eric Seidel.
+
+        Update #include.
+
+        * src/WebBindings.cpp:
+
+2012-08-02  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Add a stub for WebView::getTouchHighlightQuads()
+        https://bugs.webkit.org/show_bug.cgi?id=92997
+
+        Reviewed by Adam Barth.
+
+        Chrome on Android will be using this method for the link preview
+        implementation, discussion about which is available in Bug 79150. Since
+        that system is fairly big, will require refactoring, and the unavailable
+        APIs are blocking API compatibility, add a stub for now.
+
+        Together with the WebView API, also add the "WebTouchCandidatesInfo"
+        structure which is being used by it.
+
+        * public/WebView.h:
+        (WebKit):
+        (WebView):
+        * src/WebViewImpl.cpp:
+        (WebKit):
+        (WebKit::WebViewImpl::getTouchHighlightQuads):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-08-02  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: Fire speech start event at the same time as sound start event
+        https://bugs.webkit.org/show_bug.cgi?id=92971
+
+        Reviewed by Adam Barth.
+
+        Chromium's speech recognizer doesn't differentiate between "sound
+        started" and "speech started". Just fire those events at the same
+        time, and don't provide functions for them in
+        WebSpeechRecognizerClient.
+
+        * public/WebSpeechRecognizerClient.h:
+        * src/SpeechRecognitionClientProxy.cpp:
+        (WebKit::SpeechRecognitionClientProxy::didStartSound):
+        (WebKit::SpeechRecognitionClientProxy::didEndSound):
+        * src/SpeechRecognitionClientProxy.h:
+        (SpeechRecognitionClientProxy):
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] WebViewImpl::showTouchHighlightQuads isn't needed for Android
+        https://bugs.webkit.org/show_bug.cgi?id=92921
+
+        Reviewed by Nate Chapin.
+
+        We originally added a stub implementation of this function to make
+        merging detectContentOnTouch easier, but showTouchHighlightQuads is
+        being removed from the chromium-android branch in favor of the code in
+        https://bugs.webkit.org/show_bug.cgi?id=84487. This patch removes the
+        stub.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::detectContentIntentOnTouch):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-08-02  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Toggle the type of ant compile for webkit_unit_tests and TestWebKitAPI
+        https://bugs.webkit.org/show_bug.cgi?id=92858
+
+        Reviewed by Adam Barth.
+
+        Now that the sdk_build variable is available, we can remove these two differences
+        as well. This goes together with Adam's bug 90920.
+
+        After this patch, the whole Tools/ directory will be unforked :-).
+
+        * WebKitUnitTests.gyp:
+
+2012-08-02  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: count RenderStyle objects in the native memory profiler
+        https://bugs.webkit.org/show_bug.cgi?id=91759
+
+        Reviewed by Yury Semikhatsky.
+
+        Add a test for DataRef<T> wrapped member instrumentation.
+
+        * tests/MemoryInstrumentationTest.cpp:
+        (WebCore::InstrumentedRefPtr::create):
+        (WebCore::TEST):
+        (WebCore):
+
+2012-08-02  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-01  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: test native memory instrumentation code with help of unittests
+        https://bugs.webkit.org/show_bug.cgi?id=92743
+
+        Reviewed by Yury Semikhatsky.
+
+        Test a part of existing Native Memory Instrumentation code with help of unit tests.
+        6 tests were added and two bugs were fixed.
+        a drive-by improvement: the method MemoryInstrumentation::addInstrumentedObject
+        was marked as private and addRootObject was introduced instead of it.
+        The new function also calls processDeferedPointers.
+
+        * WebKit.gypi:
+        * tests/MemoryInstrumentationTest.cpp: Added.
+        (WebCore):
+        (NotInstrumented):
+        (Instrumented):
+        (WebCore::Instrumented::Instrumented):
+        (WebCore::Instrumented::~Instrumented):
+        (WebCore::Instrumented::reportMemoryUsage):
+        (WebCore::TEST):
+        (InstrumentedWithOwnPtr):
+        (WebCore::InstrumentedWithOwnPtr::InstrumentedWithOwnPtr):
+        (WebCore::InstrumentedWithOwnPtr::reportMemoryUsage):
+
+2012-08-01  Xingnan Wang  <xingnan.wang@intel.com>
+
+        IndexedDB: ObjectStoreMetaDataKey::m_metaDataType should use byte type
+        https://bugs.webkit.org/show_bug.cgi?id=92725
+
+        Reviewed by Kentaro Hara.
+
+        Add two new tests in IDBLevelDBCodingTest.cpp. One for an added function decodeByte() and 
+        another for verifying that encodeByte() and encodeVarInt() are indentical when the encoded 
+        values are <= 127.
+
+        * tests/IDBLevelDBCodingTest.cpp:
+        (IDBLevelDBCoding::TEST):
+        (IDBLevelDBCoding):
+
+2012-08-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use new-style tracing macros with explicit category
+        https://bugs.webkit.org/show_bug.cgi?id=92928
+
+        Reviewed by Adam Barth.
+
+        Set the category explicitly in traces.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::updateAnimations):
+        (WebKit::WebViewImpl::layout):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+
+2012-08-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move compositor HUD font atlas initialization code out of compositor core
+        https://bugs.webkit.org/show_bug.cgi?id=92924
+
+        Reviewed by Adrienne Walker.
+
+        This initializes the compositor's font atlas when initialization the compositor if the "Show FPS counter" or
+        "Show layer tree" settings are true.
+
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::setFontAtlas):
+        (WebKit):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        [chromium] Make WebKit API support draggable region change update
+        https://bugs.webkit.org/show_bug.cgi?id=92813
+
+        Reviewed by Adam Barth.
+
+        Introduce WebDraggableRegion and delegate the draggable region update
+        call to the new method draggableRegionsChanged in WebViewClient.
+
+        * public/WebDocument.h:
+        (WebDocument):
+        * public/WebDraggableRegion.h: Added.
+        (WebKit):
+        (WebDraggableRegion):
+        * public/WebViewClient.h:
+        (WebViewClient):
+        (WebKit::WebViewClient::draggableRegionsChanged):
+        * src/ChromeClientImpl.cpp:
+        (WebKit):
+        (WebKit::ChromeClientImpl::dashboardRegionsChanged):
+        * src/ChromeClientImpl.h:
+        (ChromeClientImpl):
+        * src/WebDocument.cpp:
+        (WebKit::WebDocument::draggableRegions):
+        (WebKit):
+
+2012-08-01  Antoine Labour  <piman@chromium.org>
+
+        [chromium] factor out the optimization pass in CCRenderSurfaceFilters::apply
+        https://bugs.webkit.org/show_bug.cgi?id=92453
+
+        Reviewed by James Robinson.
+
+        This separates the "optimization" pass in CCRenderSurfaceFilters::apply
+        to resolve a succession of color matrix filters into a single operation.
+        This allows testing of that code.
+        This introduces a new generic color matrix WebFilterOperation, which can
+        also be used on its own.
+
+        * WebKit.gypi:
+        * tests/CCRenderSurfaceFiltersTest.cpp: Added.
+        (WebKit):
+        (WebKit::isCombined):
+        (WebKit::TEST):
+
+2012-08-01  Daniel Murphy  <dmurph@chromium.org>
+
+        Fix for drawing invalid layers in WebViewBenchmarkSupportImpl
+        https://bugs.webkit.org/show_bug.cgi?id=92920
+
+        Reviewed by Adrienne Walker.
+
+        The GraphicsLayers without content needed to be skipped.
+
+        * src/WebViewBenchmarkSupportImpl.cpp:
+        (WebKit::WebViewBenchmarkSupportImpl::acceleratedPaintUnclipped):
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port
+        https://bugs.webkit.org/show_bug.cgi?id=90298
+
+        Reviewed by Adam Barth.
+
+        * features.gypi: Add ENABLE_WIDGET_REGION define.
+
+2012-08-01  Antoine Labour  <piman@chromium.org>
+
+        [chromium] Fix lost context handling on hud layer
+        https://bugs.webkit.org/show_bug.cgi?id=92915
+
+        Reviewed by Adrienne Walker.
+
+        On lost context we need to release CCScopedTextures, otherwise later on
+        we will try to re-allocate it using a stale CCResourceProvider.
+
+        Test CCLayerTreeHostImplTest.dontUseOldResourcesAfterLostContext
+        extended.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-01  Nico Weber  <thakis@chromium.org>
+
+        [chromium/mac] Delete WebImageCG.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=92910
+
+        Reviewed by James Robinson.
+
+        It's been unused since the switch to skia.
+        Also remove now-unneeded *CG.cpp exclusion rule.
+
+        * WebKit.gyp:
+        * src/WebImageCG.cpp: Removed.
+
+2012-08-01  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: API stubs to simplify WebIDBCursor API
+        https://bugs.webkit.org/show_bug.cgi?id=92414
+
+        Reviewed by Adam Barth.
+
+        Prep work to unblock Chromium changes so that http://webkit.org/b/92278 can land.
+        Adds no-op methods which will later be implemented; during the landing sequence,
+        Chromium will call both the new methods and the old ones. The end goal is that
+        the success callbacks for cursors will include the new key/primaryKey/value rather
+        than requiring the callee to call back into the cursor backend to fetch them.
+
+        * public/WebIDBCallbacks.h:
+        (WebIDBCallbacks):
+        (WebKit::WebIDBCallbacks::onSuccess):
+
+2012-08-01  Peter Beverloo  <peter@chromium.org>
+
+        [Text Autosizing] Provide an API for influencing the font scale factor
+        https://bugs.webkit.org/show_bug.cgi?id=92882
+
+        Reviewed by Adam Barth.
+
+        Add an API to change Text Autosizing's font scale factor.
+
+        The font scale factor applied to Text Autosizing influences the sizing
+        of text, and will influence the scaling of boosted blocks once the
+        implementation progresses. For Android, it will be set to the font size
+        chosen in the user's system-wide preferences.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setTextAutosizingFontScaleFactor):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-08-01  Dirk Pranke  <dpranke@chromium.org>
+
+        Roll chromium DEPS to 149416.
+
+        Unreviewed.
+
+        * DEPS:
+
+2012-08-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124334.
+        http://trac.webkit.org/changeset/124334
+        https://bugs.webkit.org/show_bug.cgi?id=92879
+
+        Broke MemoryInstrumentationTest.sizeOf from webkit_unit_tests
+        on Chromium canaries (Requested by apavlov1 on #webkit).
+
+        * WebKit.gypi:
+        * tests/MemoryInstrumentationTest.cpp: Removed.
+
+2012-08-01  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: test native memory instrumentation code with help of unittests
+        https://bugs.webkit.org/show_bug.cgi?id=92743
+
+        Reviewed by Yury Semikhatsky.
+
+        Test a part of existing Native Memory Instrumentation code with help of unit tests.
+        6 tests were added and two bugs were fixed.
+
+        * WebKit.gypi:
+        * tests/MemoryInstrumentationTest.cpp: Added.
+        (WebCore):
+        (MemoryInstrumentationImpl):
+        (WebCore::MemoryInstrumentationImpl::MemoryInstrumentationImpl):
+        (WebCore::MemoryInstrumentationImpl::reportedSize):
+        (WebCore::MemoryInstrumentationImpl::countObjectSize):
+        (WebCore::MemoryInstrumentationImpl::processDeferredInstrumentedPointers):
+        (NotInstrumented):
+        (Instrumented):
+        (WebCore::Instrumented::Instrumented):
+        (WebCore::Instrumented::~Instrumented):
+        (WebCore::Instrumented::reportMemoryUsage):
+        (WebCore::TEST):
+        (InstrumentedWithOwnPtr):
+        (WebCore::InstrumentedWithOwnPtr::InstrumentedWithOwnPtr):
+        (WebCore::InstrumentedWithOwnPtr::reportMemoryUsage):
+
+2012-08-01  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: count DOM storage cache memory for native snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=91617
+
+        Reviewed by Yury Semikhatsky.
+
+        Add memory size used for DOM storage cache reporting interface.
+
+        * src/StorageAreaProxy.cpp:
+        (WebCore::StorageAreaProxy::memoryBytesUsedByCache):
+        (WebCore):
+        * src/StorageAreaProxy.h:
+        (StorageAreaProxy):
+
+2012-07-31  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Chromium] Enable ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS
+        https://bugs.webkit.org/show_bug.cgi?id=92822
+
+        Reviewed by Kent Tamura.
+
+        This patch enables ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS for Chromium
+        port except for Android.
+
+        * features.gypi: Add ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS=1 to "feature_defines"
+        block of OS != "android".
+
+2012-07-31  Yusuf Ozuysal  <yusufo@google.com>
+
+        [chromium]Upstream WebViewImpl:StartPageScaleAnimation changes for Chrome for Android
+        https://bugs.webkit.org/show_bug.cgi?id=92698
+
+        Reviewed by Adam Barth.
+
+        Enforce the maximum and minimum scroll positions after the scale has changed.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::startPageScaleAnimation):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-07-31  Terry Anderson  <tdanderson@chromium.org>
+
+        [chromium] Use the event bounding box when constructing a PlatformEvent::GestureTap
+        https://bugs.webkit.org/show_bug.cgi?id=92151
+
+        Reviewed by Darin Fisher.
+
+        Now that gesture events store a bounding box, use |boundingBox| instead of
+        |deltaX| and |deltaY| when specifying |m_area|.
+
+        * public/WebInputEvent.h:
+        (WebGestureEvent):
+        * src/WebInputEventConversion.cpp:
+        (WebKit::PlatformGestureEventBuilder::PlatformGestureEventBuilder):
+
+2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-07-31  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Hit test points are being clipped by layers that should not clip
+        https://bugs.webkit.org/show_bug.cgi?id=92786
+
+        Reviewed by James Robinson.
+
+        * tests/CCLayerTreeHostCommonTest.cpp: adds a test where the
+          hit-testable layer does not overlap its parent. The parent does
+          not clip, so the layer should still be hittable.
+
+2012-07-31  Chris Rogers  <crogers@google.com>
+
+        Allow AudioDestination to support local/live audio input
+        https://bugs.webkit.org/show_bug.cgi?id=90318
+
+        Reviewed by Kenneth Russell.
+
+        * src/AudioDestinationChromium.cpp:
+        (WebCore::AudioDestination::create):
+        (WebCore::AudioDestinationChromium::AudioDestinationChromium):
+        (WebCore::AudioDestinationChromium::provideInput):
+        (WebCore):
+        * src/AudioDestinationChromium.h:
+        (AudioDestinationChromium):
+
+2012-07-31  Adam Barth  <abarth@webkit.org>
+
+        [Chromium-Android] We should hueristically detect content intents on touch
+        https://bugs.webkit.org/show_bug.cgi?id=92346
+
+        Reviewed by Nate Chapin.
+
+        On Android, when the user touches a block of text, we run a bunch of
+        OS-provided hueristics to detect content intents, such as telephone
+        numbers and mailing addresses.
+
+        This patch introduces the WebViewClient functions and the
+        detectContentIntentOnTouch function, but does not wire the code into
+        the event system. There are some decisions to make about how to wire it
+        into the event system, we'll tackle in the next patch.
+
+        * public/WebViewClient.h:
+        (WebKit::WebViewClient::detectContentIntentAround):
+        (WebViewClient):
+        (WebKit::WebViewClient::scheduleContentIntent):
+        (WebKit::WebViewClient::cancelScheduledContentIntents):
+        * src/WebViewImpl.cpp:
+        (WebKit):
+        (WebKit::tapHighlightColorForNode):
+        (WebKit::WebViewImpl::showTouchHighlightQuads):
+        (WebKit::WebViewImpl::detectContentIntentOnTouch):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-07-31  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Use WebAnimation and related classes in GraphicsLayerChromium and AnimTranslationUtil
+        https://bugs.webkit.org/show_bug.cgi?id=90468
+
+        Reviewed by James Robinson.
+
+        * src/WebAnimation.cpp:
+        (WebKit::WebAnimation::targetProperty):
+        (WebKit):
+        (WebKit::WebAnimation::initialize):
+        * src/WebLayer.cpp:
+        (WebKit::WebLayer::setAnimationDelegate):
+        (WebKit):
+        (WebKit::WebLayer::addAnimation):
+        (WebKit::WebLayer::removeAnimation):
+        (WebKit::WebLayer::pauseAnimation):
+        (WebKit::WebLayer::suspendAnimations):
+        (WebKit::WebLayer::resumeAnimations):
+        (WebKit::WebLayer::transferAnimationsTo):
+        * tests/CCThreadedTest.cpp:
+        * tests/CCThreadedTest.h:
+        (TestHooks):
+        * tests/WebAnimationTest.cpp:
+        (WebKit::TEST):
+
+2012-07-30  Adam Barth  <abarth@webkit.org>
+
+        Typo: doubleTa*b*ZoomAnimationDurationInSeconds in WebViewImpl.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=92135
+
+        Reviewed by Kentaro Hara.
+
+        This patch fixes a typo.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::animateZoomAroundPoint):
+
+2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124179.
+        http://trac.webkit.org/changeset/124179
+        https://bugs.webkit.org/show_bug.cgi?id=92730
+
+        Breaks Chromium Linux 32 bots with "error: integer constant is
+        too large for 'long' type" in IDBLevelDBCodingTest.cpp
+        (Requested by apavlov on #webkit).
+
+        * tests/IDBLevelDBCodingTest.cpp:
+        (IDBLevelDBCoding::TEST):
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        Integrated ColorChooserProxy and WebColorChooserClientImpl into ColorChooserUIController.
+        ColorChooserUIController can control whether to open the color suggestion picker
+        popup or the color chooser depending on the responses from ColorChooserClient.
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createColorChooser): Returns ColorChooserUIController which is a ColorChooser.
+        (WebKit::ChromeClientImpl::createWebColorChooser): Returns WebColorChooser that was created by Chromium.
+        * src/ChromeClientImpl.h:
+        (WebKit):
+        (ChromeClientImpl):
+        * src/ColorChooserProxy.cpp: Removed.
+        * src/ColorChooserProxy.h: Removed.
+        * src/ColorChooserUIController.cpp: Added.
+        (WebKit):
+        (WebKit::ColorChooserUIController::ColorChooserUIController): Controls the UI for color chooser. Opens the color suggestion picker popup or color chooser depending on the ColorChooserClient.
+        (WebKit::ColorChooserUIController::~ColorChooserUIController):
+        (WebKit::ColorChooserUIController::setSelectedColor):
+        (WebKit::ColorChooserUIController::endChooser): This is called by WebCore so we close both the popup and the color chooser.
+        (WebKit::ColorChooserUIController::didChooseColor):
+        (WebKit::ColorChooserUIController::didEndChooser):
+        (WebKit::ColorChooserUIController::contentSize): The popup will be resized later from JS so we return an arbitrary size.
+        (WebKit::ColorChooserUIController::writeDocument):
+        (WebKit::ColorChooserUIController::setValueAndClosePopup): Performs action based on the numValue.
+        (WebKit::ColorChooserUIController::didClosePopup):
+        (WebKit::ColorChooserUIController::openPopup): Opens color chooser suggestion popup.
+        (WebKit::ColorChooserUIController::closePopup):
+        (WebKit::ColorChooserUIController::openColorChooser): Opens color chooser.
+        * src/ColorChooserUIController.h: Renamed from Source/WebKit/chromium/src/WebColorChooserClientImpl.h.
+        (WebCore):
+        (WebKit):
+        (ColorChooserUIController):
+        * src/WebColorChooserClientImpl.cpp: Removed.
+
+2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Roll out the DEPS roll (r124164) for now since it broke Chromium Mac builds.
+
+        * DEPS:
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-07-30  Adrienne Walker  <enne@google.com>
+
+        [chromium] Wrap ScrollbarLayerChromium in WebScrollbarLayer
+        https://bugs.webkit.org/show_bug.cgi?id=91032
+
+        Reviewed by James Robinson.
+
+        Add implementation of WebScrollbarLayer to the client API.
+
+        * WebKit.gyp:
+        * src/WebScrollbarLayer.cpp: Added.
+        (WebKit):
+        (WebKit::WebScrollbarLayer::setScrollLayer):
+        (WebKit::WebScrollbarLayer::create):
+        (WebKit::WebScrollbarLayer::WebScrollbarLayer):
+        (WebKit::WebScrollbarLayer::operator=):
+        (WebKit::WebScrollbarLayer::operator PassRefPtr<ScrollbarLayerChromium>):
+
+2012-07-30  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Propagate gesture events to plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=92281
+
+        Reviewed by Adam Barth.
+
+        Propagate gesture events to plugins.
+
+        * src/WebInputEventConversion.cpp:
+        (WebKit):
+        (WebKit::WebGestureEventBuilder::WebGestureEventBuilder):
+        * src/WebInputEventConversion.h:
+        (WebCore):
+        (WebKit):
+        (WebGestureEventBuilder):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::handleEvent):
+        * src/WebPluginContainerImpl.h:
+        (WebCore):
+        (WebPluginContainerImpl):
+
+2012-07-30  John Bates  <jbates@google.com>
+
+        Plumb vsync-enabled flag up to compositor thread and support disable-vsync
+        https://bugs.webkit.org/show_bug.cgi?id=92323
+
+        Reviewed by James Robinson.
+
+        * public/WebSettings.h:
+        * tests/CCFrameRateControllerTest.cpp:
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::Settings::operator CCLayerTreeSettings):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::WebSettingsImpl):
+        (WebKit::WebSettingsImpl::setRenderVSyncEnabled):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        (WebKit::WebSettingsImpl::renderVSyncEnabled):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+
+2012-07-30  Adrienne Walker  <enne@google.com>
+
+        [chromium] Remove dependency on ScrollbarTheme from the compositor
+        https://bugs.webkit.org/show_bug.cgi?id=90528
+
+        Reviewed by James Robinson.
+
+        Add implementations for WebScrollbarThemeGeometry and
+        WebScrollbarThemePainter. Fill out additional API calls for
+        WebPluginScrollbarImpl since it derives from WebScrollbar.
+
+        Add WebScrollbarImpl to the client API to wrap and own an existing
+        WebCore Scrollbar object and provide the WebScrollbar interface.
+
+        By keeping WebScrollbar separate from WebScrollbarThemeGeometry, the
+        compositor thread can create its own thread-safe data bag version of a
+        WebScrollbar (CCScrollbarLayerImpl::CCScrollbar), but this requires
+        WebScrollbarThemeClientImpl.
+
+        WebScrollbarThemeClientImpl does the reverse of WebScrollbarImpl; it
+        wraps a WebScrollbar and provides the ScrollbarThemeClient interface.
+        This is so that a WebScrollbar can be passed to the geometry and
+        painter functions. Then, internally the WebScrollbarThemeClientImpl
+        can be used to adapt the WebScrollbar to the ScrollbarThemeClient
+        interface so the geometry and painter functions can call direct
+        functions on ScrollbarThemeComposite.
+
+        * WebKit.gyp:
+        * src/AssertMatchingEnums.cpp:
+        * src/ExternalPopupMenu.h:
+        (WebKit):
+        * src/WebPluginScrollbarImpl.cpp:
+        (WebKit::WebPluginScrollbarImpl::WebPluginScrollbarImpl):
+        (WebKit::WebPluginScrollbarImpl::location):
+        (WebKit):
+        (WebKit::WebPluginScrollbarImpl::size):
+        (WebKit::WebPluginScrollbarImpl::enabled):
+        (WebKit::WebPluginScrollbarImpl::maximum):
+        (WebKit::WebPluginScrollbarImpl::totalSize):
+        (WebKit::WebPluginScrollbarImpl::isScrollViewScrollbar):
+        (WebKit::WebPluginScrollbarImpl::isScrollableAreaActive):
+        (WebKit::WebPluginScrollbarImpl::getTickmarks):
+        (WebKit::WebPluginScrollbarImpl::controlSize):
+        (WebKit::WebPluginScrollbarImpl::pressedPart):
+        (WebKit::WebPluginScrollbarImpl::hoveredPart):
+        (WebKit::WebPluginScrollbarImpl::scrollbarOverlayStyle):
+        (WebKit::WebPluginScrollbarImpl::orientation):
+        (WebKit::WebPluginScrollbarImpl::isCustomScrollbar):
+        (WebKit::WebPluginScrollbarImpl::onMouseUp):
+        (WebKit::WebPluginScrollbarImpl::onMouseMove):
+        (WebKit::WebPluginScrollbarImpl::onMouseLeave):
+        * src/WebPluginScrollbarImpl.h:
+        (WebPluginScrollbarImpl):
+        * src/WebScrollbarImpl.cpp: Added.
+        (WebKit):
+        (WebKit::WebScrollbar::create):
+        (WebKit::WebScrollbarImpl::WebScrollbarImpl):
+        (WebKit::WebScrollbarImpl::isOverlay):
+        (WebKit::WebScrollbarImpl::value):
+        (WebKit::WebScrollbarImpl::location):
+        (WebKit::WebScrollbarImpl::size):
+        (WebKit::WebScrollbarImpl::enabled):
+        (WebKit::WebScrollbarImpl::maximum):
+        (WebKit::WebScrollbarImpl::totalSize):
+        (WebKit::WebScrollbarImpl::isScrollViewScrollbar):
+        (WebKit::WebScrollbarImpl::isScrollableAreaActive):
+        (WebKit::WebScrollbarImpl::getTickmarks):
+        (WebKit::WebScrollbarImpl::controlSize):
+        (WebKit::WebScrollbarImpl::pressedPart):
+        (WebKit::WebScrollbarImpl::hoveredPart):
+        (WebKit::WebScrollbarImpl::scrollbarOverlayStyle):
+        (WebKit::WebScrollbarImpl::orientation):
+        (WebKit::WebScrollbarImpl::isCustomScrollbar):
+        * src/WebScrollbarImpl.h: Copied from Source/Platform/chromium/public/WebScrollbar.h.
+        (WebCore):
+        (WebKit):
+        (WebScrollbarImpl):
+        * src/WebScrollbarThemeClientImpl.cpp: Added.
+        (WebKit):
+        (WebKit::WebScrollbarThemeClientImpl::WebScrollbarThemeClientImpl):
+        (WebKit::WebScrollbarThemeClientImpl::x):
+        (WebKit::WebScrollbarThemeClientImpl::y):
+        (WebKit::WebScrollbarThemeClientImpl::width):
+        (WebKit::WebScrollbarThemeClientImpl::height):
+        (WebKit::WebScrollbarThemeClientImpl::size):
+        (WebKit::WebScrollbarThemeClientImpl::location):
+        (WebKit::WebScrollbarThemeClientImpl::parent):
+        (WebKit::WebScrollbarThemeClientImpl::root):
+        (WebKit::WebScrollbarThemeClientImpl::setFrameRect):
+        (WebKit::WebScrollbarThemeClientImpl::frameRect):
+        (WebKit::WebScrollbarThemeClientImpl::invalidate):
+        (WebKit::WebScrollbarThemeClientImpl::invalidateRect):
+        (WebKit::WebScrollbarThemeClientImpl::scrollbarOverlayStyle):
+        (WebKit::WebScrollbarThemeClientImpl::getTickmarks):
+        (WebKit::WebScrollbarThemeClientImpl::isScrollableAreaActive):
+        (WebKit::WebScrollbarThemeClientImpl::isScrollViewScrollbar):
+        (WebKit::WebScrollbarThemeClientImpl::convertFromContainingWindow):
+        (WebKit::WebScrollbarThemeClientImpl::isCustomScrollbar):
+        (WebKit::WebScrollbarThemeClientImpl::orientation):
+        (WebKit::WebScrollbarThemeClientImpl::value):
+        (WebKit::WebScrollbarThemeClientImpl::currentPos):
+        (WebKit::WebScrollbarThemeClientImpl::visibleSize):
+        (WebKit::WebScrollbarThemeClientImpl::totalSize):
+        (WebKit::WebScrollbarThemeClientImpl::maximum):
+        (WebKit::WebScrollbarThemeClientImpl::controlSize):
+        (WebKit::WebScrollbarThemeClientImpl::lineStep):
+        (WebKit::WebScrollbarThemeClientImpl::pageStep):
+        (WebKit::WebScrollbarThemeClientImpl::pressedPart):
+        (WebKit::WebScrollbarThemeClientImpl::hoveredPart):
+        (WebKit::WebScrollbarThemeClientImpl::styleChanged):
+        (WebKit::WebScrollbarThemeClientImpl::enabled):
+        (WebKit::WebScrollbarThemeClientImpl::setEnabled):
+        (WebKit::WebScrollbarThemeClientImpl::isOverlayScrollbar):
+        * src/WebScrollbarThemeClientImpl.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebScrollbarThemeClientImpl):
+        * src/WebScrollbarThemeGeometry.cpp: Added.
+        (WebKit):
+        (WebKit::WebScrollbarThemeGeometry::assign):
+        (WebKit::WebScrollbarThemeGeometry::thumbPosition):
+        (WebKit::WebScrollbarThemeGeometry::thumbLength):
+        (WebKit::WebScrollbarThemeGeometry::trackPosition):
+        (WebKit::WebScrollbarThemeGeometry::trackLength):
+        (WebKit::WebScrollbarThemeGeometry::hasButtons):
+        (WebKit::WebScrollbarThemeGeometry::hasThumb):
+        (WebKit::WebScrollbarThemeGeometry::trackRect):
+        (WebKit::WebScrollbarThemeGeometry::thumbRect):
+        (WebKit::WebScrollbarThemeGeometry::minimumThumbLength):
+        (WebKit::WebScrollbarThemeGeometry::scrollbarThickness):
+        (WebKit::WebScrollbarThemeGeometry::backButtonStartRect):
+        (WebKit::WebScrollbarThemeGeometry::backButtonEndRect):
+        (WebKit::WebScrollbarThemeGeometry::forwardButtonStartRect):
+        (WebKit::WebScrollbarThemeGeometry::forwardButtonEndRect):
+        (WebKit::WebScrollbarThemeGeometry::constrainTrackRectToTrackPieces):
+        (WebKit::WebScrollbarThemeGeometry::splitTrack):
+        (WebKit::WebScrollbarThemeGeometry::WebScrollbarThemeGeometry):
+        * src/WebScrollbarThemePainter.cpp: Added.
+        (WebKit):
+        (WebKit::WebScrollbarThemePainter::assign):
+        (WebKit::WebScrollbarThemePainter::paintScrollbarBackground):
+        (WebKit::WebScrollbarThemePainter::paintTrackBackground):
+        (WebKit::WebScrollbarThemePainter::paintBackTrackPart):
+        (WebKit::WebScrollbarThemePainter::paintForwardTrackPart):
+        (WebKit::WebScrollbarThemePainter::paintBackButtonStart):
+        (WebKit::WebScrollbarThemePainter::paintBackButtonEnd):
+        (WebKit::WebScrollbarThemePainter::paintForwardButtonStart):
+        (WebKit::WebScrollbarThemePainter::paintForwardButtonEnd):
+        (WebKit::WebScrollbarThemePainter::paintTickmarks):
+        (WebKit::WebScrollbarThemePainter::paintThumb):
+        (WebKit::WebScrollbarThemePainter::WebScrollbarThemePainter):
+        * tests/ScrollbarLayerChromiumTest.cpp:
+        (WebCore::MockScrollbar::convertFromContainingWindow):
+        (WebCore::MockScrollbar::isOverlayScrollbar):
+        (MockScrollbar):
+        (WebCore::TEST):
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124025.
+        http://trac.webkit.org/changeset/124025
+        https://bugs.webkit.org/show_bug.cgi?id=92658
+
+        Causes color-suggestion-picker-appearance layout test to time
+        out on all Chromium platforms (Requested by tomhudson_ on
+        #webkit).
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createColorChooser):
+        * src/ChromeClientImpl.h:
+        (WebCore):
+        (ChromeClientImpl):
+        * src/ColorChooserProxy.cpp: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (WebKit::ColorChooserProxy::ColorChooserProxy):
+        (WebKit::ColorChooserProxy::~ColorChooserProxy):
+        (WebKit::ColorChooserProxy::setSelectedColor):
+        (WebKit::ColorChooserProxy::endChooser):
+        * src/ColorChooserProxy.h: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (ColorChooserProxy):
+        * src/ColorChooserUIController.cpp: Removed.
+        * src/WebColorChooserClientImpl.cpp: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (WebKit::WebColorChooserClientImpl::WebColorChooserClientImpl):
+        (WebKit::WebColorChooserClientImpl::~WebColorChooserClientImpl):
+        (WebKit::WebColorChooserClientImpl::didChooseColor):
+        (WebKit::WebColorChooserClientImpl::didEndChooser):
+        * src/WebColorChooserClientImpl.h: Renamed from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebCore):
+        (WebKit):
+        (WebColorChooserClientImpl):
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        Integrated ColorChooserProxy and WebColorChooserClientImpl into ColorChooserUIController.
+        ColorChooserUIController can control whether to open the color suggestion picker
+        popup or the color chooser depending on the responses from ColorChooserClient.
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createColorChooser): Returns ColorChooserUIController which is a ColorChooser.
+        (WebKit::ChromeClientImpl::createWebColorChooser): Returns WebColorChooser that was created by Chromium.
+        * src/ChromeClientImpl.h:
+        (WebKit):
+        (ChromeClientImpl):
+        * src/ColorChooserProxy.cpp: Removed.
+        * src/ColorChooserProxy.h: Removed.
+        * src/ColorChooserUIController.cpp: Added.
+        (WebKit):
+        (WebKit::ColorChooserUIController::ColorChooserUIController): Controls the UI for color chooser. Opens the color suggestion picker popup or color chooser depending on the ColorChooserClient.
+        (WebKit::ColorChooserUIController::~ColorChooserUIController):
+        (WebKit::ColorChooserUIController::setSelectedColor):
+        (WebKit::ColorChooserUIController::endChooser): This is called by WebCore so we close both the popup and the color chooser.
+        (WebKit::ColorChooserUIController::didChooseColor):
+        (WebKit::ColorChooserUIController::didEndChooser):
+        (WebKit::ColorChooserUIController::contentSize): The popup will be resized later from JS so we return an arbitrary size.
+        (WebKit::ColorChooserUIController::writeDocument):
+        (WebKit::ColorChooserUIController::setValueAndClosePopup): Performs action based on the numValue.
+        (WebKit::ColorChooserUIController::didClosePopup):
+        (WebKit::ColorChooserUIController::openPopup): Opens color chooser suggestion popup.
+        (WebKit::ColorChooserUIController::closePopup):
+        (WebKit::ColorChooserUIController::openColorChooser): Opens color chooser.
+        * src/ColorChooserUIController.h: Renamed from Source/WebKit/chromium/src/WebColorChooserClientImpl.h.
+        (WebCore):
+        (WebKit):
+        (ColorChooserUIController):
+        * src/WebColorChooserClientImpl.cpp: Removed.
+
+2012-07-30  Kaustubh Atrawalkar  <kaustubh@motorola.com>
+
+        [DRT] LTC:: pageNumberForElementById() could be moved to Internals
+        https://bugs.webkit.org/show_bug.cgi?id=92091
+
+        Reviewed by Hajime Morita.
+
+        Move the pageNumberForElementById from LayoutTestCotroller to Internals and
+        remove the old platform specific implementations as it exclusively tests WebCore functionality.
+
+        * public/WebFrame.h:
+        (WebFrame):
+        * src/WebFrameImpl.cpp:
+        (WebKit):
+        * src/WebFrameImpl.h:
+        (WebFrameImpl):
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124004.
+        http://trac.webkit.org/changeset/124004
+        https://bugs.webkit.org/show_bug.cgi?id=92622
+
+        Broke Android build (Requested by keishi on #webkit).
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createColorChooser):
+        * src/ChromeClientImpl.h:
+        (WebCore):
+        (ChromeClientImpl):
+        * src/ColorChooserProxy.cpp: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (WebKit::ColorChooserProxy::ColorChooserProxy):
+        (WebKit::ColorChooserProxy::~ColorChooserProxy):
+        (WebKit::ColorChooserProxy::setSelectedColor):
+        (WebKit::ColorChooserProxy::endChooser):
+        * src/ColorChooserProxy.h: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (ColorChooserProxy):
+        * src/ColorChooserUIController.cpp: Removed.
+        * src/WebColorChooserClientImpl.cpp: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (WebKit::WebColorChooserClientImpl::WebColorChooserClientImpl):
+        (WebKit::WebColorChooserClientImpl::~WebColorChooserClientImpl):
+        (WebKit::WebColorChooserClientImpl::didChooseColor):
+        (WebKit::WebColorChooserClientImpl::didEndChooser):
+        * src/WebColorChooserClientImpl.h: Renamed from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebCore):
+        (WebKit):
+        (WebColorChooserClientImpl):
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        Integrated ColorChooserProxy and WebColorChooserClientImpl into ColorChooserUIController.
+        ColorChooserUIController can control whether to open the color suggestion picker
+        popup or the color chooser depending on the responses from ColorChooserClient.
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createColorChooser): Returns ColorChooserUIController which is a ColorChooser.
+        (WebKit::ChromeClientImpl::createWebColorChooser): Returns WebColorChooser that was created by Chromium.
+        * src/ChromeClientImpl.h:
+        (WebKit):
+        (ChromeClientImpl):
+        * src/ColorChooserProxy.cpp: Removed.
+        * src/ColorChooserProxy.h: Removed.
+        * src/ColorChooserUIController.cpp: Added.
+        (WebKit):
+        (WebKit::ColorChooserUIController::ColorChooserUIController): Controls the UI for color chooser. Opens the color suggestion picker popup or color chooser depending on the ColorChooserClient.
+        (WebKit::ColorChooserUIController::~ColorChooserUIController):
+        (WebKit::ColorChooserUIController::setSelectedColor):
+        (WebKit::ColorChooserUIController::endChooser): This is called by WebCore so we close both the popup and the color chooser.
+        (WebKit::ColorChooserUIController::didChooseColor):
+        (WebKit::ColorChooserUIController::didEndChooser):
+        (WebKit::ColorChooserUIController::contentSize): The popup will be resized later from JS so we return an arbitrary size.
+        (WebKit::ColorChooserUIController::writeDocument):
+        (WebKit::ColorChooserUIController::setValueAndClosePopup): Performs action based on the numValue.
+        (WebKit::ColorChooserUIController::didClosePopup):
+        (WebKit::ColorChooserUIController::openPopup): Opens color chooser suggestion popup.
+        (WebKit::ColorChooserUIController::closePopup):
+        (WebKit::ColorChooserUIController::openColorChooser): Opens color chooser.
+        * src/ColorChooserUIController.h: Renamed from Source/WebKit/chromium/src/WebColorChooserClientImpl.h.
+        (WebCore):
+        (WebKit):
+        (ColorChooserUIController):
+        * src/WebColorChooserClientImpl.cpp: Removed.
+
 2012-07-29  Lu Guanqun  <guanqun.lu@intel.com>
 
         [chromium] pass acceleratePainting info to settings
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index 2aabb4d59..3f938525d 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '148739'
+  'chromium_rev': '151128'
 }
 
 deps = {
@@ -87,6 +87,8 @@ deps = {
   # webkit dependencies
   'webkit': Var('chromium_svn')+'/webkit@'+Var('chromium_rev'),
 
+  'cc':
+    Var('chromium_svn')+'/cc@'+Var('chromium_rev'),
   'gpu':
     Var('chromium_svn')+'/gpu@'+Var('chromium_rev'),
   'ipc':
@@ -116,7 +118,7 @@ deps = {
   'tools/win':
     Var('chromium_svn')+'/tools/win@'+Var('chromium_rev'),
   'ui':
-    Var('chromium_svn')+'/ui@'+Var('chromium_rev'), # needed by app
+    Var('chromium_svn')+'/ui@'+Var('chromium_rev'),
 
   # other third party
   'third_party/pyftpdlib/src':
@@ -177,12 +179,14 @@ deps_os = {
       From('chromium_deps', 'src/third_party/openssl'),
   },
   'android': {
-    'tools/android':
-      Var('chromium_svn') + '/tools/android@' + Var('chromium_rev'),
-    'third_party/freetype':
-      From('chromium_deps', 'src/third_party/freetype'),
+    'third_party/android_tools':
+      From('chromium_deps', 'src/third_party/android_tools'),
     'third_party/aosp':
       From('chromium_deps', 'src/third_party/aosp'),
+    'third_party/freetype':
+      From('chromium_deps', 'src/third_party/freetype'),
+    'tools/android':
+      Var('chromium_svn') + '/tools/android@' + Var('chromium_rev'),
   },
 }
 
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index 45b949866..36ecf80f5 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -112,8 +112,6 @@
                 'public/WebColorName.h',
                 'public/WebCommonWorkerClient.h',
                 'public/WebCompositionUnderline.h',
-                'public/WebCompositor.h',
-                'public/WebCompositorClient.h',
                 'public/WebCompositorInputHandler.h',
                 'public/WebCompositorInputHandlerClient.h',
                 'public/WebConsoleMessage.h',
@@ -275,6 +273,7 @@
                 'public/WebTextInputType.h',
                 'public/WebTextRun.h',
                 'public/WebTimeRange.h',
+                'public/WebTouchCandidatesInfo.h',
                 'public/WebURLLoaderOptions.h',
                 'public/WebUserMediaClient.h',
                 'public/WebUserMediaRequest.h',
@@ -300,10 +299,7 @@
                 'public/platform/WebCanvas.h',
                 'public/platform/WebColor.h',
                 'public/platform/WebCommon.h',
-                'public/platform/WebContentLayer.h',
-                'public/platform/WebContentLayerClient.h',
                 'public/platform/WebData.h',
-                'public/platform/WebExternalTextureLayer.h',
                 'public/platform/WebFloatPoint.h',
                 'public/platform/WebFloatQuad.h',
                 'public/platform/WebFloatRect.h',
@@ -314,9 +310,6 @@
                 'public/platform/WebHTTPHeaderVisitor.h',
                 'public/platform/WebHTTPLoadInfo.h',
                 'public/platform/WebKitPlatformSupport.h',
-                'public/platform/WebLayer.h',
-                'public/platform/WebLayerTreeView.h',
-                'public/platform/WebLayerTreeViewClient.h',
                 'public/platform/WebNonCopyable.h',
                 'public/platform/WebPoint.h',
                 'public/platform/WebPrivateOwnPtr.h',
@@ -328,7 +321,6 @@
                 'public/platform/WebSocketStreamError.h',
                 'public/platform/WebSocketStreamHandle.h',
                 'public/platform/WebSocketStreamHandleClient.h',
-                'public/platform/WebSolidColorLayer.h',
                 'public/platform/WebString.h',
                 'public/platform/WebThread.h',
                 'public/platform/WebThreadSafeData.h',
@@ -363,15 +355,13 @@
                 'src/BatteryClientImpl.h',
                 'src/BlobRegistryProxy.cpp',
                 'src/BlobRegistryProxy.h',
-                'src/CCThreadImpl.cpp',
-                'src/CCThreadImpl.h',
                 'src/ChromeClientImpl.cpp',
                 'src/ChromeClientImpl.h',
-                'src/ColorChooserProxy.cpp',
-                'src/ColorChooserProxy.h',
                 'src/ChromiumCurrentTime.cpp',
                 'src/ChromiumOSRandomSource.cpp',
                 'src/ChromiumThreading.cpp',
+                'src/ColorChooserUIController.cpp',
+                'src/ColorChooserUIController.h',
                 'src/CompositionUnderlineBuilder.h',
                 'src/CompositionUnderlineVectorBuilder.cpp',
                 'src/CompositionUnderlineVectorBuilder.h',
@@ -489,12 +479,8 @@
                 'src/WebBlob.cpp',
                 'src/WebBlobData.cpp',
                 'src/WebCache.cpp',
-                'src/WebColorChooserClientImpl.cpp',
-                'src/WebColorChooserClientImpl.h',
                 'src/WebColorName.cpp',
                 'src/WebCommon.cpp',
-                'src/WebCompositorImpl.cpp',
-                'src/WebCompositorImpl.h',
                 'src/WebCompositorInputHandlerImpl.cpp',
                 'src/WebCompositorInputHandlerImpl.h',
                 'src/WebContentLayer.cpp',
@@ -576,7 +562,6 @@
                 'src/WebIDBTransactionCallbacksImpl.cpp',
                 'src/WebIDBTransactionCallbacksImpl.h',
                 'src/WebIOSurfaceLayer.cpp',
-                'src/WebImageCG.cpp',
                 'src/WebImageDecoder.cpp',
                 'src/WebImageLayer.cpp',
                 'src/WebImageSkia.cpp',
@@ -630,7 +615,13 @@
                 'src/WebScopedMicrotaskSuppression.cpp',
                 'src/WebScopedUserGesture.cpp',
                 'src/WebScriptController.cpp',
+                'src/WebScrollbarLayer.cpp',
                 'src/WebScrollableLayer.cpp',
+                'src/WebScrollbarImpl.cpp',
+                'src/WebScrollbarImpl.h',
+                'src/WebScrollbarThemeClientImpl.cpp',
+                'src/WebScrollbarThemeClientImpl.h',
+                'src/WebScrollbarThemePainter.cpp',
                 'src/WebSearchableFormData.cpp',
                 'src/WebSecurityOrigin.cpp',
                 'src/WebSecurityPolicy.cpp',
@@ -821,18 +812,13 @@
                         ['exclude', '/android/'],
                     ],
                 }],
-                # TODO: we exclude CG.cpp on both sides of the below conditional. Move elsewhere?
                 ['OS=="mac"', {
                     'include_dirs': [
                         'public/mac',
                     ],
-                    'sources/': [
-                        ['exclude', 'CG\\.cpp$'],
-                    ],
                 }, { # else: OS!="mac"
                     'sources/': [
                         ['exclude', '/mac/'],
-                        ['exclude', 'CG\\.cpp$'],
                     ],
                 }],
                 ['OS=="win"', {
@@ -984,6 +970,7 @@
                     '<(PRODUCT_DIR)/resources/inspector/ScriptFormatterWorker.js',
                     '<(PRODUCT_DIR)/resources/inspector/devTools.css',
                     '<(PRODUCT_DIR)/resources/inspector/devtools_extension_api.js',
+                    '<@(webinspector_standalone_js_files)',
                     '<@(webinspector_standalone_css_files)',
                 ],
                 'images': [
@@ -1099,6 +1086,12 @@
                         'outputs': ['<(PRODUCT_DIR)/resources/inspector/DevTools.js'],
                         'action': ['python', '<@(_script_name)', '<@(_input_page)', '<@(_search_path)', '<@(_outputs)'],
                     }],
+                    'copies': [{
+                        'destination': '<(PRODUCT_DIR)/resources/inspector',
+                        'files': [
+                            '<@(webinspector_standalone_js_files)',
+                        ],
+                    }],
                 },
                 {
                     'target_name': 'concatenated_heap_snapshot_worker_js',
diff --git a/Source/WebKit/chromium/WebKit.gypi b/Source/WebKit/chromium/WebKit.gypi
index b507189db..9d041a18d 100644
--- a/Source/WebKit/chromium/WebKit.gypi
+++ b/Source/WebKit/chromium/WebKit.gypi
@@ -77,15 +77,17 @@
             'tests/CCOcclusionTrackerTest.cpp',
             'tests/CCOcclusionTrackerTestCommon.h',
             'tests/CCQuadCullerTest.cpp',
+            'tests/CCRenderSurfaceFiltersTest.cpp',
             'tests/CCRenderSurfaceTest.cpp',
             'tests/CCResourceProviderTest.cpp',
             'tests/CCSchedulerStateMachineTest.cpp',
             'tests/CCSchedulerTestCommon.h',
             'tests/CCSchedulerTest.cpp',
             'tests/CCScopedTextureTest.cpp',
+            'tests/CCScrollbarAnimationControllerLinearFadeTest.cpp',
             'tests/CCSolidColorLayerImplTest.cpp',
             'tests/CCTestCommon.h',
-            'tests/CCTextureUpdaterTest.cpp',
+            'tests/CCTextureUpdateControllerTest.cpp',
             'tests/CCTiledLayerImplTest.cpp',
             'tests/CCTiledLayerTestCommon.h',
             'tests/CCTiledLayerTestCommon.cpp',
@@ -102,7 +104,9 @@
             'tests/EventListenerTest.cpp',
             'tests/FakeCCLayerTreeHostClient.h',
             'tests/FakeGraphicsContext3DTest.cpp',
+            'tests/FakeWebCompositorOutputSurface.h',
             'tests/FakeWebGraphicsContext3D.h',
+            'tests/FakeWebScrollbarThemeGeometry.h',
             'tests/FilterOperationsTest.cpp',
             'tests/FloatQuadTest.cpp',
             'tests/FrameLoaderClientImplTest.cpp',
@@ -115,6 +119,7 @@
             'tests/IDBFakeBackingStore.h',
             'tests/IDBKeyPathTest.cpp',
             'tests/IDBLevelDBCodingTest.cpp',
+            'tests/IDBRequestTest.cpp',
             'tests/ImageLayerChromiumTest.cpp',
             'tests/KeyboardTest.cpp',
             'tests/KURLTest.cpp',
@@ -123,9 +128,8 @@
             'tests/LevelDBTest.cpp',
             'tests/LinkHighlightTest.cpp',
             'tests/ListenerLeakTest.cpp',
-            'tests/LocalizedDateICUTest.cpp',
-            'tests/LocalizedNumberICUTest.cpp',
             'tests/MemoryInfo.cpp',
+            'tests/MemoryInstrumentationTest.cpp',
             'tests/MockCCQuadCuller.h',
             'tests/OpaqueRectTrackingContentLayerDelegateTest.cpp',
             'tests/OpenTypeVerticalDataTest.cpp',
@@ -192,6 +196,12 @@
                     'tests/ScrollAnimatorNoneTest.cpp',
                 ],
             }],
+            ['os_posix==1 and OS!="mac"', {
+                'webkit_unittest_files': [
+                    'tests/LocalizedDateICUTest.cpp',
+                    'tests/LocalizedNumberICUTest.cpp',
+                ],
+            }],
             ['toolkit_uses_gtk == 1', {
                 'webkit_unittest_files': [
                     'tests/WebInputEventFactoryTestGtk.cpp',
diff --git a/Source/WebKit/chromium/WebKitUnitTests.gyp b/Source/WebKit/chromium/WebKitUnitTests.gyp
index 81be90a0d..b05a55271 100644
--- a/Source/WebKit/chromium/WebKitUnitTests.gyp
+++ b/Source/WebKit/chromium/WebKitUnitTests.gyp
@@ -172,8 +172,18 @@
                         '--output',
                         '<(PRODUCT_DIR)/webkit_unit_tests_apk',
                         '--ant-args',
+                        '-DANDROID_SDK=<(android_sdk)',
+                        '--ant-args',
+                        '-DANDROID_SDK_ROOT=<(android_sdk_root)',
+                        '--ant-args',
+                        '-DANDROID_SDK_TOOLS=<(android_sdk_tools)',
+                        '--ant-args',
+                        '-DANDROID_SDK_VERSION=<(android_sdk_version)',
+                        '--ant-args',
+                        '-DANDROID_TOOLCHAIN=<(android_toolchain)',
+                        '--ant-args',
                         '-DPRODUCT_DIR=<(ant_build_out)',
-                        '--ant-compile',
+                        '--sdk-build=<(sdk_build)',
                         '--app_abi',
                         '<(android_app_abi)',
                     ],
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index 6aa57be3d..8dc7e2f6f 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -40,9 +40,10 @@
       'ENABLE_CSP_NEXT=1',
       'ENABLE_CSS3_FLEXBOX=1',
       'ENABLE_CSS_BOX_DECORATION_BREAK=1',
+      'ENABLE_CSS_COMPOSITING=0',
       'ENABLE_CSS_EXCLUSIONS=1',
       'ENABLE_CSS_FILTERS=1',
-      'ENABLE_CSS_COMPOSITING=0',
+      'ENABLE_CSS_HIERARCHIES=0',
       'ENABLE_CSS_IMAGE_SET=1',
       'ENABLE_CSS_IMAGE_RESOLUTION=0',
       'ENABLE_CSS_REGIONS=1',
@@ -114,6 +115,7 @@
       'ENABLE_WEB_INTENTS=1',
       'ENABLE_WEB_SOCKETS=1',
       'ENABLE_WEB_TIMING=1',
+      'ENABLE_WIDGET_REGION=1',
       'ENABLE_WORKERS=1',
       'ENABLE_XHR_RESPONSE_BLOB=1',
       'ENABLE_XSLT=1',
@@ -170,6 +172,7 @@
           'ENABLE_CALENDAR_PICKER=1',
           'ENABLE_INPUT_SPEECH=1',
           'ENABLE_INPUT_TYPE_COLOR=1',
+          'ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS=1',
           'ENABLE_JAVASCRIPT_I18N_API=1',
           'ENABLE_LEGACY_NOTIFICATIONS=1',
           'ENABLE_MEDIA_CAPTURE=0',
diff --git a/Source/WebKit/chromium/public/WebDocument.h b/Source/WebKit/chromium/public/WebDocument.h
index f2296b7ee..e0c444250 100644
--- a/Source/WebKit/chromium/public/WebDocument.h
+++ b/Source/WebKit/chromium/public/WebDocument.h
@@ -31,6 +31,7 @@
 #ifndef WebDocument_h
 #define WebDocument_h
 
+#include "WebDraggableRegion.h"
 #include "WebNode.h"
 #include "WebSecurityOrigin.h"
 #include "platform/WebReferrerPolicy.h"
@@ -104,6 +105,7 @@ public:
     WEBKIT_EXPORT WebElement fullScreenElement() const;
     WEBKIT_EXPORT WebDOMEvent createEvent(const WebString& eventType);
     WEBKIT_EXPORT WebReferrerPolicy referrerPolicy() const;
+    WEBKIT_EXPORT WebElement createElement(const WebString& tagName);
 
     // Accessibility support. These methods should only be called on the
     // top-level document, because one accessibility cache spans all of
@@ -120,6 +122,8 @@ public:
     // WebView.
     WEBKIT_EXPORT void insertUserStyleSheet(const WebString& sourceCode, UserStyleLevel);
 
+    WEBKIT_EXPORT WebVector<WebDraggableRegion> draggableRegions() const;
+
 #if WEBKIT_IMPLEMENTATION
     WebDocument(const WTF::PassRefPtr<WebCore::Document>&);
     WebDocument& operator=(const WTF::PassRefPtr<WebCore::Document>&);
diff --git a/Source/WebKit/chromium/public/WebDraggableRegion.h b/Source/WebKit/chromium/public/WebDraggableRegion.h
new file mode 100644
index 000000000..0437f8973
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebDraggableRegion.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDraggableRegion_h
+#define WebDraggableRegion_h
+
+#include "platform/WebCommon.h"
+#include "platform/WebRect.h"
+#include "platform/WebString.h"
+
+namespace WebKit {
+
+struct WebDraggableRegion {
+    WebString label;
+    WebRect bounds;
+    WebRect clip;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebFrame.h b/Source/WebKit/chromium/public/WebFrame.h
index b03fb7c69..c0b8e2aa7 100644
--- a/Source/WebKit/chromium/public/WebFrame.h
+++ b/Source/WebKit/chromium/public/WebFrame.h
@@ -75,6 +75,8 @@ class WebURLRequest;
 class WebView;
 struct WebConsoleMessage;
 struct WebFindOptions;
+struct WebFloatPoint;
+struct WebFloatRect;
 struct WebPoint;
 struct WebPrintParams;
 struct WebRect;
@@ -133,6 +135,16 @@ public:
     // The name of this frame.
     virtual WebString name() const = 0;
 
+    // The unique name of this frame.
+    //
+    // This is temporarily identical to the above name() function. Once this
+    // change makes it over to the Chromium tree, I will change all callers to
+    // use this function and will subsequently move assignedName() to name().
+    virtual WebString uniqueName() const = 0;
+
+    // The name of this frame. If no name is given, empty string is returned.
+    virtual WebString assignedName() const = 0;
+
     // Sets the name of this frame. For child frames (frames that are not a
     // top-most frame) the actual name may have a suffix appended to make the
     // frame name unique within the hierarchy.
@@ -575,6 +587,30 @@ public:
     // of matches found during the scoping effort.
     virtual void resetMatchCount() = 0;
 
+    // Returns a counter that is incremented when the find-in-page markers are
+    // changed on any frame. Switching the active marker doesn't change the
+    // current version. Should be called only on the main frame.
+    virtual int findMatchMarkersVersion() const = 0;
+
+    // Returns the bounding box of the active find-in-page match marker or an
+    // empty rect if no such marker exists. The rect is returned in find-in-page
+    // coordinates whatever frame the active marker is.
+    // Should be called only on the main frame.
+    virtual WebFloatRect activeFindMatchRect() = 0;
+
+    // Swaps the contents of the provided vector with the bounding boxes of the
+    // find-in-page match markers from all frames. The bounding boxes are returned
+    // in find-in-page coordinates. This method should be called only on the main frame.
+    virtual void findMatchRects(WebVector<WebFloatRect>&) = 0;
+
+    // Selects the find-in-page match in the appropriate frame closest to the
+    // provided point in find-in-page coordinates. Returns the ordinal of such
+    // match or -1 if none could be found. If not null, selectionRect is set to
+    // the bounding box of the selected match in window coordinates.
+    // This method should be called only on the main frame.
+    virtual int selectNearestFindMatch(const WebFloatPoint&,
+                                       WebRect* selectionRect) = 0;
+
     // OrientationChange event ---------------------------------------------
 
     // Orientation is the interface orientation in degrees.
@@ -630,12 +666,6 @@ public:
     // Calls markerTextForListItem() defined in WebCore/rendering/RenderTreeAsText.h.
     virtual WebString markerTextForListItem(const WebElement&) const = 0;
 
-    // Returns the number of page where the specified element will be put.
-    // This method is used to support layout tests.
-    virtual int pageNumberForElementById(const WebString& id,
-                                         float pageWidthInPixels,
-                                         float pageHeightInPixels) const = 0;
-
     // Prints all of the pages into the canvas, with page boundaries drawn as
     // one pixel wide blue lines. This method exists to support layout tests.
     virtual void printPagesWithBoundaries(WebCanvas*, const WebSize&) = 0;
diff --git a/Source/WebKit/chromium/public/WebFrameClient.h b/Source/WebKit/chromium/public/WebFrameClient.h
index bc32d6d84..cc8923d80 100644
--- a/Source/WebKit/chromium/public/WebFrameClient.h
+++ b/Source/WebKit/chromium/public/WebFrameClient.h
@@ -93,7 +93,7 @@ public:
     // May return null.
     virtual WebApplicationCacheHost* createApplicationCacheHost(WebFrame*, WebApplicationCacheHostClient*) { return 0; }
 
-    
+
     // Services ------------------------------------------------------------
 
     // A frame specific cookie jar.  May return null, in which case
@@ -103,13 +103,15 @@ public:
 
     // General notifications -----------------------------------------------
 
-    // This frame has been detached from the view.
-    //
-    // FIXME: Do not use this in new code. Currently this is used by code in
-    // Chromium that errantly caches WebKit objects.
+    // A child frame was created in this frame. This is called when the frame
+    // is created and initialized.
+    virtual void didCreateFrame(WebFrame* parent, WebFrame* child) { }
+
+    // This frame has been detached from the view, but has not been closed yet.
     virtual void frameDetached(WebFrame*) { }
 
-    // This frame is about to be closed.
+    // This frame is about to be closed. This is called after frameDetached,
+    // when the document is being unloaded, due to new one committing.
     virtual void willClose(WebFrame*) { }
 
     // Load commands -------------------------------------------------------
@@ -406,6 +408,15 @@ public:
         WebSecurityOrigin target,
         WebDOMMessageEvent) { return false; }
 
+    virtual bool willCheckAndDispatchMessageEvent(
+        WebFrame* sourceFrame,
+        WebFrame* targetFrame,
+        WebSecurityOrigin target,
+        WebDOMMessageEvent event)
+    {
+        return willCheckAndDispatchMessageEvent(sourceFrame, target, event);
+    }
+
     // Asks the embedder if a specific user agent should be used for the given
     // URL. Non-empty strings indicate an override should be used. Otherwise,
     // WebKitPlatformSupport::userAgent() will be called to provide one.
diff --git a/Source/WebKit/chromium/public/WebIDBCallbacks.h b/Source/WebKit/chromium/public/WebIDBCallbacks.h
index ce100f295..655b009e0 100644
--- a/Source/WebKit/chromium/public/WebIDBCallbacks.h
+++ b/Source/WebKit/chromium/public/WebIDBCallbacks.h
@@ -51,12 +51,16 @@ public:
     virtual void onError(const WebIDBDatabaseError&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebDOMStringList&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(WebIDBCursor*) { WEBKIT_ASSERT_NOT_REACHED(); }
+    // FIXME: Temporary no-op method to allow callers to update before WK92278 lands.
+    virtual void onSuccess(WebIDBCursor*, const WebIDBKey& key, const WebIDBKey& primaryKey, const WebSerializedScriptValue&) { }
     virtual void onSuccess(WebIDBDatabase*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebIDBKey&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(WebIDBTransaction*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebSerializedScriptValue&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebSerializedScriptValue&, const WebIDBKey&, const WebIDBKeyPath&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccessWithContinuation() { WEBKIT_ASSERT_NOT_REACHED(); }
+    // FIXME: Temporary no-op method to allow callers to update before WK92278 lands.
+    virtual void onSuccess(const WebIDBKey& key, const WebIDBKey& primaryKey, const WebSerializedScriptValue&) { }
     virtual void onBlocked() { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onBlocked(long long oldVersion) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccessWithPrefetch(const WebVector<WebIDBKey>& keys, const WebVector<WebIDBKey>& primaryKeys, const WebVector<WebSerializedScriptValue>& values) { WEBKIT_ASSERT_NOT_REACHED(); }
diff --git a/Source/WebKit/chromium/public/WebIDBCursor.h b/Source/WebKit/chromium/public/WebIDBCursor.h
index dfad19383..ac89d7955 100644
--- a/Source/WebKit/chromium/public/WebIDBCursor.h
+++ b/Source/WebKit/chromium/public/WebIDBCursor.h
@@ -40,6 +40,13 @@ class WebIDBCursor {
 public:
     virtual ~WebIDBCursor() { }
 
+    enum Direction {
+        Next = 0,
+        NextNoDuplicate = 1,
+        Prev = 2,
+        PrevNoDuplicate = 3,
+    };
+
     virtual WebIDBKey key() const
     {
         WEBKIT_ASSERT_NOT_REACHED();
@@ -56,7 +63,6 @@ public:
         return WebSerializedScriptValue();
     }
 
-    virtual void update(const WebSerializedScriptValue&, WebIDBCallbacks*, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void advance(unsigned long, WebIDBCallbacks*, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void continueFunction(const WebIDBKey&, WebIDBCallbacks*, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void deleteFunction(WebIDBCallbacks*, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
diff --git a/Source/WebKit/chromium/public/WebIDBObjectStore.h b/Source/WebKit/chromium/public/WebIDBObjectStore.h
index 3893c9595..ba59c15ee 100644
--- a/Source/WebKit/chromium/public/WebIDBObjectStore.h
+++ b/Source/WebKit/chromium/public/WebIDBObjectStore.h
@@ -26,10 +26,12 @@
 #ifndef WebIDBObjectStore_h
 #define WebIDBObjectStore_h
 
-#include "WebExceptionCode.h"
 #include "WebDOMStringList.h"
+#include "WebExceptionCode.h"
 #include "WebIDBCallbacks.h"
+#include "WebIDBCursor.h"
 #include "WebIDBKeyPath.h"
+#include "WebIDBTransaction.h"
 #include "platform/WebCommon.h"
 #include "platform/WebString.h"
 
@@ -53,7 +55,6 @@ public:
 
     typedef WebVector<WebIDBKey> WebIndexKeys;
 
-    virtual void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void putWithIndexKeys(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, const WebVector<WebString>& indexNames, const WebVector<WebIndexKeys>&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void deleteFunction(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
@@ -62,6 +63,8 @@ public:
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
+    virtual void setIndexKeys(const WebIDBKey&, const WebVector<WebString>&, const WebVector<WebIndexKeys>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void setIndexesReady(const WebVector<WebString>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); };
     // Transfers ownership of the WebIDBIndex to the caller.
     virtual WebIDBIndex* index(const WebString& name, WebExceptionCode&)
     {
@@ -69,7 +72,9 @@ public:
         return 0;
     }
     virtual void deleteIndex(const WebString& name, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    // FIXME: Remove this version of openCursor when TaskType is plumbed through chromium.
     virtual void openCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void openCursor(const WebIDBKeyRange&, WebIDBCursor::Direction direction, WebIDBCallbacks*, WebIDBTransaction::TaskType, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void count(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
 
 protected:
diff --git a/Source/WebKit/chromium/public/WebIDBTransaction.h b/Source/WebKit/chromium/public/WebIDBTransaction.h
index 4ddcd8c56..816a32814 100644
--- a/Source/WebKit/chromium/public/WebIDBTransaction.h
+++ b/Source/WebKit/chromium/public/WebIDBTransaction.h
@@ -41,11 +41,11 @@ class WebIDBTransaction {
 public:
     virtual ~WebIDBTransaction() { }
 
-    virtual int mode() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return 0;
-    }
+    enum TaskType {
+        NormalTask = 0,
+        PreemptiveTask
+    };
+
     virtual WebIDBObjectStore* objectStore(const WebString& name, WebExceptionCode&)
     {
         WEBKIT_ASSERT_NOT_REACHED();
diff --git a/Source/WebKit/chromium/public/WebInputEvent.h b/Source/WebKit/chromium/public/WebInputEvent.h
index 40a6fdb3e..09048cded 100644
--- a/Source/WebKit/chromium/public/WebInputEvent.h
+++ b/Source/WebKit/chromium/public/WebInputEvent.h
@@ -370,7 +370,11 @@ public:
     int globalX;
     int globalY;
 
-    // NOTE: |deltaX| and |deltaY| represents the amount to scroll for Scroll gesture events. For Pinch gesture events, |deltaX| represents the scaling/magnification factor. For a GestureTap event, |deltaX| and |deltaY| represent the horizontal and vertical radii of the touch region.
+    // NOTE: |deltaX| and |deltaY| represents the amount to scroll for Scroll gesture events.
+    // For Pinch gesture events, |deltaX| represents the scaling/magnification factor.
+    // For a GestureTap event, |deltaX| represents the tap count.
+    // For a FlingStart event, |deltaX| and |deltaY| represent the velocity.
+    // FIXME: Avoid overloading 'delta' in this way. http://wkb.ug/93123
     float deltaX;
     float deltaY;
     WebRect boundingBox;
diff --git a/Source/WebKit/chromium/public/WebNode.h b/Source/WebKit/chromium/public/WebNode.h
index 5281db199..902b37669 100644
--- a/Source/WebKit/chromium/public/WebNode.h
+++ b/Source/WebKit/chromium/public/WebNode.h
@@ -98,6 +98,7 @@ public:
     WEBKIT_EXPORT WebNode nextSibling() const;
     WEBKIT_EXPORT bool hasChildNodes() const;
     WEBKIT_EXPORT WebNodeList childNodes();
+    WEBKIT_EXPORT bool appendChild(const WebNode& child);
     WEBKIT_EXPORT WebString createMarkup() const;
     WEBKIT_EXPORT bool isLink() const;
     WEBKIT_EXPORT bool isTextNode() const;
diff --git a/Source/WebKit/chromium/public/WebPlugin.h b/Source/WebKit/chromium/public/WebPlugin.h
index 5ef884c73..8abaf3bfe 100644
--- a/Source/WebKit/chromium/public/WebPlugin.h
+++ b/Source/WebKit/chromium/public/WebPlugin.h
@@ -65,6 +65,7 @@ public:
     // from the plugin. The value would be associated with the name attribute
     // of the corresponding object element.
     virtual bool getFormValue(WebString&) { return false; }
+    virtual bool supportsKeyboardFocus() const { return false; }
 
     virtual void paint(WebCanvas*, const WebRect&) = 0;
 
diff --git a/Source/WebKit/chromium/public/WebRuntimeFeatures.h b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
index c3d61d85a..7152249e5 100644
--- a/Source/WebKit/chromium/public/WebRuntimeFeatures.h
+++ b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
@@ -157,6 +157,9 @@ public:
     WEBKIT_EXPORT static void enableDialogElement(bool);
     WEBKIT_EXPORT static bool isDialogElementEnabled();
 
+    WEBKIT_EXPORT static void enableCSSExclusions(bool);
+    WEBKIT_EXPORT static bool isCSSExclusionsEnabled();
+
 private:
     WebRuntimeFeatures();
 };
diff --git a/Source/WebKit/chromium/public/WebScriptController.h b/Source/WebKit/chromium/public/WebScriptController.h
index da3ac1cdd..1299ae9cb 100644
--- a/Source/WebKit/chromium/public/WebScriptController.h
+++ b/Source/WebKit/chromium/public/WebScriptController.h
@@ -39,18 +39,11 @@ class Extension;
 
 namespace WebKit {
 
-class WebString;
-
 class WebScriptController {
 public:
-    // Registers a v8 extension to be available on webpages. The three forms
-    // offer various restrictions on what types of contexts the extension is
-    // loaded into. If a scheme is provided, only pages whose URL has the given
-    // scheme will match. If extensionGroup is provided, the extension will only
-    // be loaded into scripts run via WebFrame::ExecuteInNewWorld with the
-    // matching group.
-    // Will only affect v8 contexts initialized after this call. Takes ownership
-    // of the v8::Extension object passed.
+    // Registers a v8 extension to be available on webpages. Will only affect
+    // v8 contexts initialized after this call. Takes ownership of the
+    // v8::Extension object passed.
     WEBKIT_EXPORT static void registerExtension(v8::Extension*);
 
     // Enables special settings which are only applicable if V8 is executed
diff --git a/Source/WebKit/chromium/public/WebSettings.h b/Source/WebKit/chromium/public/WebSettings.h
index 88ed9639d..e1e74a9b9 100644
--- a/Source/WebKit/chromium/public/WebSettings.h
+++ b/Source/WebKit/chromium/public/WebSettings.h
@@ -53,7 +53,6 @@ public:
         EditingBehaviorUnix
     };
 
-    virtual bool forceSoftwareCompositing() const = 0;
     virtual bool scrollAnimatorEnabled() const = 0;
     virtual bool viewportEnabled() const = 0;
     virtual void setAccelerated2dCanvasEnabled(bool) = 0;
@@ -102,7 +101,6 @@ public:
     virtual void setFixedPositionCreatesStackingContext(bool) = 0;
     virtual void setFontRenderingModeNormal() = 0;
     virtual void setForceCompositingMode(bool) = 0;
-    virtual void setForceSoftwareCompositing(bool) = 0;
     virtual void setFrameFlatteningEnabled(bool) = 0;
     virtual void setFullScreenEnabled(bool) = 0;
     virtual void setHyperlinkAuditingEnabled(bool) = 0;
@@ -132,6 +130,7 @@ public:
     virtual void setPictographFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
     virtual void setPluginsEnabled(bool) = 0;
     virtual void setPrivilegedWebGLExtensionsEnabled(bool) = 0;
+    virtual void setRenderVSyncEnabled(bool) = 0;
     virtual void setSansSerifFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
     virtual void setSerifFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
     virtual void setShouldPrintBackgrounds(bool) = 0;
@@ -144,6 +143,7 @@ public:
     virtual void setSyncXHRInDocumentsEnabled(bool) = 0;
     virtual void setTextAreasAreResizable(bool) = 0;
     virtual void setTextAutosizingEnabled(bool) = 0;
+    virtual void setTextAutosizingFontScaleFactor(float) = 0;
     virtual void setTextDirectionSubmenuInclusionBehaviorNeverIncluded() = 0;
     virtual void setUnifiedTextCheckerEnabled(bool) = 0;
     virtual void setUserStyleSheetLocation(const WebURL&) = 0;
diff --git a/Source/WebKit/chromium/public/WebSpeechRecognizerClient.h b/Source/WebKit/chromium/public/WebSpeechRecognizerClient.h
index 608bfb481..3fe1244a7 100644
--- a/Source/WebKit/chromium/public/WebSpeechRecognizerClient.h
+++ b/Source/WebKit/chromium/public/WebSpeechRecognizerClient.h
@@ -59,13 +59,6 @@ public:
     // This is expected to be called after didStartAudio.
     virtual void didStartSound(const WebSpeechRecognitionHandle&) = 0;
 
-    // To be called when speech has been detected.
-    // This is expected to be called after didStartSound.
-    virtual void didStartSpeech(const WebSpeechRecognitionHandle&) = 0;
-
-    // To be called when speech is no longer detected.
-    virtual void didEndSpeech(const WebSpeechRecognitionHandle&) = 0;
-
     // To be called when sound is no longer detected.
     // This is expected to be called after didEndSpeech.
     virtual void didEndSound(const WebSpeechRecognitionHandle&) = 0;
diff --git a/Source/Platform/chromium/public/WebCompositorCheckerboardQuad.h b/Source/WebKit/chromium/public/WebTouchCandidatesInfo.h
index e7e02bbff..65d4024a2 100644
--- a/Source/Platform/chromium/public/WebCompositorCheckerboardQuad.h
+++ b/Source/WebKit/chromium/public/WebTouchCandidatesInfo.h
@@ -23,33 +23,32 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCompositorCheckerboardQuad_h
-#define WebCompositorCheckerboardQuad_h
+#ifndef WebTouchCandidatesInfo_h
+#define WebTouchCandidatesInfo_h
 
-#include "WebCompositorQuad.h"
-#if WEBKIT_IMPLEMENTATION
-#include <wtf/PassOwnPtr.h>
-#endif
+#include "platform/WebRect.h"
 
 namespace WebKit {
 
-#pragma pack(push, 4)
+struct WebTouchCandidatesInfo {
+    // The number of possible touch receivers from the last touch.
+    int numberOfCandidates;
 
-class WebCompositorCheckerboardQuad : public WebCompositorQuad {
-public:
-#if WEBKIT_IMPLEMENTATION
-    static PassOwnPtr<WebCompositorCheckerboardQuad> create(const WebCompositorSharedQuadState*, const WebCore::IntRect&);
-#endif
+    // The bounds of the possible touch candidates. This will enclose the
+    // rects of any possible touch candidates for a press.
+    WebRect unitedBounds;
 
-    static const WebCompositorCheckerboardQuad* materialCast(const WebCompositorQuad*);
-private:
-#if WEBKIT_IMPLEMENTATION
-    WebCompositorCheckerboardQuad(const WebCompositorSharedQuadState*, const WebCore::IntRect&);
-#endif
-};
+    // The smallest dimension (either width or height) of any of the
+    // available touch targets.
+    int smallestDimension;
 
-#pragma pack(pop)
+    WebTouchCandidatesInfo()
+        : numberOfCandidates(0)
+        , smallestDimension(0)
+    {
+    }
+};
 
-}
+} // namespace WebKit
 
 #endif
diff --git a/Source/WebKit/chromium/public/WebView.h b/Source/WebKit/chromium/public/WebView.h
index 4da3363dd..e8f791fa6 100644
--- a/Source/WebKit/chromium/public/WebView.h
+++ b/Source/WebKit/chromium/public/WebView.h
@@ -60,9 +60,11 @@ class WebString;
 class WebTextFieldDecoratorClient;
 class WebViewClient;
 struct WebActiveWheelFlingParameters;
+struct WebFloatQuad;
 struct WebMediaPlayerAction;
 struct WebPluginAction;
 struct WebPoint;
+struct WebTouchCandidatesInfo;
 
 class WebView : public WebWidget {
 public:
@@ -461,10 +463,24 @@ public:
 
     virtual bool isSelectionEditable() const = 0;
 
-    // Benchmarking support --------------------------------------------
+    // Benchmarking support -------------------------------------------------
 
     virtual WebViewBenchmarkSupport* benchmarkSupport() { return 0; }
 
+
+    // Touch ----------------------------------------------------------------
+
+    // Returns a list of layout bounding boxes of the event target node touched by
+    // the input point with the padding. If no target node is found, an empty
+    // list is returned. If the node is of an inline type, each line box is returned
+    // separately. Otherwise, one bounding box is returned. Also returns information
+    // about the found candidates and their dimension, and the highlight color to use.
+    virtual WebVector<WebFloatQuad> getTouchHighlightQuads(const WebPoint&,
+                                                           int padding,
+                                                           WebTouchCandidatesInfo& outTouchInfo,
+                                                           WebColor& outTapHighlightColor) = 0;
+
+
     // Visibility -----------------------------------------------------------
 
     // Sets the visibility of the WebView.
diff --git a/Source/WebKit/chromium/public/WebViewClient.h b/Source/WebKit/chromium/public/WebViewClient.h
index 65964a128..726cc6482 100644
--- a/Source/WebKit/chromium/public/WebViewClient.h
+++ b/Source/WebKit/chromium/public/WebViewClient.h
@@ -53,6 +53,7 @@ class WebAccessibilityObject;
 class WebBatteryStatusClient;
 class WebColorChooser;
 class WebColorChooserClient;
+class WebCompositorOutputSurface;
 class WebDeviceOrientationClient;
 class WebDragData;
 class WebElement;
@@ -118,9 +119,11 @@ public:
     // Create a session storage namespace object associated with this WebView.
     virtual WebStorageNamespace* createSessionStorageNamespace(unsigned quota) { return 0; }
 
-    // Creates a graphics context that renders to the client's WebView.
+    // DEPRECATED: Creates a graphics context that renders to the client's WebView.
     virtual WebGraphicsContext3D* createGraphicsContext3D(const WebGraphicsContext3D::Attributes&) { return 0; }
 
+    // Creates the output surface that renders to the client's WebView.
+    virtual WebCompositorOutputSurface* createOutputSurface() { return 0; }
 
     // Misc ----------------------------------------------------------------
 
@@ -373,7 +376,18 @@ public:
     // around a hit test result. The embedder should use platform-specific
     // content detectors (e.g., from the Android intent system) to analyze the
     // region around the hit test result.
-    virtual WebContentDetectionResult detectContentAround(const WebHitTestResult&) { return WebContentDetectionResult(); }
+    virtual WebContentDetectionResult detectContentIntentAround(const WebHitTestResult&) { return WebContentDetectionResult(); }
+
+    // Schedules a new content intent with the provided url.
+    virtual void scheduleContentIntent(const WebURL&) { }
+
+    // Cancels any previously scheduled content intents that have not yet launched.
+    virtual void cancelScheduledContentIntents() { }
+
+    // Draggable regions ----------------------------------------------------
+
+    // Informs the browser that the draggable regions have been updated.
+    virtual void draggableRegionsChanged() { }
 
 protected:
     ~WebViewClient() { }
diff --git a/Source/WebKit/chromium/public/WebWidget.h b/Source/WebKit/chromium/public/WebWidget.h
index b2a57d66e..8e4fecac7 100644
--- a/Source/WebKit/chromium/public/WebWidget.h
+++ b/Source/WebKit/chromium/public/WebWidget.h
@@ -222,8 +222,9 @@ public:
     // following the call to instrumentBeginFrame().
     virtual void instrumentCancelFrame() { }
 
-    // Fills in a WebRenderingStats struct containing information about the state of the compositor.
-    // This call is relatively expensive in threaded mode as it blocks on the compositor thread.
+    // Fills in a WebRenderingStats struct containing information about rendering, e.g. count of frames rendered, time spent painting.
+    // This call is relatively expensive in threaded compositing mode, as it blocks on the compositor thread.
+    // It is safe to call in software mode, but will only give stats for rendering done in compositing mode.
     virtual void renderingStats(WebRenderingStats&) const { }
 
     // The page background color. Can be used for filling in areas without
diff --git a/Source/WebKit/chromium/public/platform/WebLayerTreeView.h b/Source/WebKit/chromium/public/platform/WebLayerTreeView.h
deleted file mode 100644
index 2ea2915e1..000000000
--- a/Source/WebKit/chromium/public/platform/WebLayerTreeView.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebLayerTreeView.h"
diff --git a/Source/WebKit/chromium/public/platform/WebLayerTreeViewClient.h b/Source/WebKit/chromium/public/platform/WebLayerTreeViewClient.h
deleted file mode 100644
index 36c61f584..000000000
--- a/Source/WebKit/chromium/public/platform/WebLayerTreeViewClient.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebLayerTreeViewClient.h"
diff --git a/Source/WebKit/chromium/public/platform/WebSolidColorLayer.h b/Source/WebKit/chromium/public/platform/WebSolidColorLayer.h
deleted file mode 100644
index f4edbd489..000000000
--- a/Source/WebKit/chromium/public/platform/WebSolidColorLayer.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebSolidColorLayer.h"
diff --git a/Source/WebKit/chromium/src/ApplicationCacheHostInternal.h b/Source/WebKit/chromium/src/ApplicationCacheHostInternal.h
index b9dee63a4..54b5f1c7d 100644
--- a/Source/WebKit/chromium/src/ApplicationCacheHostInternal.h
+++ b/Source/WebKit/chromium/src/ApplicationCacheHostInternal.h
@@ -35,9 +35,7 @@
 #include "WebApplicationCacheHostClient.h"
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebURL.h"
+#include <public/WebURL.h>
 
 namespace WebCore {
 
diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index 5f250351a..8f2dc5e86 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -49,11 +49,13 @@
 #include "GeolocationError.h"
 #include "GeolocationPosition.h"
 #include "HTMLInputElement.h"
+#include "IDBCursor.h"
 #include "IDBDatabaseException.h"
 #include "IDBFactoryBackendInterface.h"
 #include "IDBKey.h"
 #include "IDBKeyPath.h"
 #include "IDBMetadata.h"
+#include "IDBTransactionBackendInterface.h"
 #include "IceOptions.h"
 #include "IconURL.h"
 #include "MediaPlayer.h"
@@ -84,11 +86,13 @@
 #include "WebFontDescription.h"
 #include "WebGeolocationError.h"
 #include "WebGeolocationPosition.h"
+#include "WebIDBCursor.h"
 #include "WebIDBDatabaseException.h"
 #include "WebIDBFactory.h"
 #include "WebIDBKey.h"
 #include "WebIDBKeyPath.h"
 #include "WebIDBMetadata.h"
+#include "WebIDBTransaction.h"
 #include "WebIconURL.h"
 #include "WebInputElement.h"
 #include "WebMediaPlayer.h"
@@ -433,6 +437,23 @@ COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollByPage, ScrollByPage);
 COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollByDocument, ScrollByDocument);
 COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollByPixel, ScrollByPixel);
 
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::RegularScrollbar, RegularScrollbar);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::SmallScrollbar, SmallScrollbar);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::NoPart, NoPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::BackButtonStartPart, BackButtonStartPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ForwardButtonStartPart, ForwardButtonStartPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::BackTrackPart, BackTrackPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ThumbPart, ThumbPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ForwardTrackPart, ForwardTrackPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::BackButtonEndPart, BackButtonEndPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ForwardButtonEndPart, ForwardButtonEndPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollbarBGPart, ScrollbarBGPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::TrackBGPart, TrackBGPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::AllParts, AllParts);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollbarOverlayStyleDefault, ScrollbarOverlayStyleDefault);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollbarOverlayStyleDark, ScrollbarOverlayStyleDark);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollbarOverlayStyleLight, ScrollbarOverlayStyleLight);
+
 COMPILE_ASSERT_MATCHING_ENUM(WebSettings::EditingBehaviorMac, EditingMacBehavior);
 COMPILE_ASSERT_MATCHING_ENUM(WebSettings::EditingBehaviorWin, EditingWindowsBehavior);
 COMPILE_ASSERT_MATCHING_ENUM(WebSettings::EditingBehaviorUnix, EditingUnixBehavior);
@@ -465,6 +486,14 @@ COMPILE_ASSERT_MATCHING_ENUM(WebIDBKeyPath::StringType, IDBKeyPath::StringType);
 COMPILE_ASSERT_MATCHING_ENUM(WebIDBKeyPath::ArrayType, IDBKeyPath::ArrayType);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebIDBMetadata::NoIntVersion, IDBDatabaseMetadata::NoIntVersion);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBCursor::Next, IDBCursor::NEXT);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBCursor::NextNoDuplicate, IDBCursor::NEXT_NO_DUPLICATE);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBCursor::Prev, IDBCursor::PREV);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBCursor::PrevNoDuplicate, IDBCursor::PREV_NO_DUPLICATE);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBTransaction::PreemptiveTask, IDBTransactionBackendInterface::PreemptiveTask);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBTransaction::NormalTask, IDBTransactionBackendInterface::NormalTask);
 #endif
 
 #if ENABLE(FILE_SYSTEM)
diff --git a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
index 086e79e7d..b2ceab78b 100644
--- a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
+++ b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
@@ -40,16 +40,14 @@
 #include "WebApplicationCacheHost.h"
 #include "WebDataSource.h"
 #include "WebFrameImpl.h"
-#include "WebKit.h"
 #include "WrappedResourceRequest.h"
 #include "WrappedResourceResponse.h"
 #include "XMLHttpRequest.h"
-#include "platform/WebHTTPHeaderVisitor.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebString.h"
-#include "platform/WebURLError.h"
-#include "platform/WebURLLoaderClient.h"
-#include "platform/WebURLRequest.h"
+#include <public/WebHTTPHeaderVisitor.h>
+#include <public/WebString.h>
+#include <public/WebURLError.h>
+#include <public/WebURLLoaderClient.h>
+#include <public/WebURLRequest.h>
 #include <wtf/HashSet.h>
 #include <wtf/text/WTFString.h>
 
diff --git a/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp b/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
index 5f608a3d9..a6b9b64f9 100644
--- a/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
@@ -41,9 +41,6 @@
 #include "WebFileInfo.h"
 #include "WebFileSystemCallbacksImpl.h"
 #include "WebFileWriter.h"
-#include "WebKit.h"
-#include "platform/WebFileSystem.h"
-#include "platform/WebKitPlatformSupport.h"
 #include <public/Platform.h>
 #include <public/WebFileSystem.h>
 #include <wtf/text/CString.h>
@@ -102,7 +99,7 @@ PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create()
 }
 
 AsyncFileSystemChromium::AsyncFileSystemChromium()
-    : m_webFileSystem(WebKit::webKitPlatformSupport()->fileSystem())
+    : m_webFileSystem(WebKit::Platform::current()->fileSystem())
 {
     ASSERT(m_webFileSystem);
 }
diff --git a/Source/WebKit/chromium/src/AudioDestinationChromium.cpp b/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
index cadb2e3a9..646e9ef0d 100644
--- a/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
+++ b/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
@@ -52,13 +52,14 @@ const size_t fifoSize = 8192;
 const unsigned numberOfChannels = 2;
 
 // Factory method: Chromium-implementation
-PassOwnPtr<AudioDestination> AudioDestination::create(AudioSourceProvider& provider, float sampleRate)
+PassOwnPtr<AudioDestination> AudioDestination::create(AudioIOCallback& callback, float sampleRate)
 {
-    return adoptPtr(new AudioDestinationChromium(provider, sampleRate));
+    return adoptPtr(new AudioDestinationChromium(callback, sampleRate));
 }
 
-AudioDestinationChromium::AudioDestinationChromium(AudioSourceProvider& provider, float sampleRate)
-    : m_renderBus(numberOfChannels, renderBufferSize, false)
+AudioDestinationChromium::AudioDestinationChromium(AudioIOCallback& callback, float sampleRate)
+    : m_callback(callback)
+    , m_renderBus(numberOfChannels, renderBufferSize, false)
     , m_sampleRate(sampleRate)
     , m_isPlaying(false)
 {
@@ -78,7 +79,7 @@ AudioDestinationChromium::AudioDestinationChromium(AudioSourceProvider& provider
     // contains enough data, the data will be provided directly.
     // Otherwise, the FIFO will call the provider enough times to
     // satisfy the request for data.
-    m_fifo = adoptPtr(new AudioPullFIFO(provider, numberOfChannels, fifoSize, renderBufferSize));
+    m_fifo = adoptPtr(new AudioPullFIFO(*this, numberOfChannels, fifoSize, renderBufferSize));
 }
 
 AudioDestinationChromium::~AudioDestinationChromium()
@@ -127,6 +128,12 @@ void AudioDestinationChromium::render(const WebVector<float*>& audioData, size_t
     m_fifo->consume(&m_renderBus, numberOfFrames);
 }
 
+void AudioDestinationChromium::provideInput(AudioBus* bus, size_t framesToProcess)
+{
+    // FIXME: Add support for local/live audio input.
+    m_callback.render(0, bus, framesToProcess);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebKit/chromium/src/AudioDestinationChromium.h b/Source/WebKit/chromium/src/AudioDestinationChromium.h
index be4cc4b84..fd676d102 100644
--- a/Source/WebKit/chromium/src/AudioDestinationChromium.h
+++ b/Source/WebKit/chromium/src/AudioDestinationChromium.h
@@ -31,6 +31,7 @@
 
 #include "AudioBus.h"
 #include "AudioDestination.h"
+#include "AudioIOCallback.h"
 #include "AudioSourceProvider.h"
 #include "platform/WebAudioDevice.h"
 #include "platform/WebVector.h"
@@ -43,9 +44,9 @@ class AudioPullFIFO;
 
 // An AudioDestination using Chromium's audio system
 
-class AudioDestinationChromium : public AudioDestination, public WebKit::WebAudioDevice::RenderCallback {
+class AudioDestinationChromium : public AudioDestination, public WebKit::WebAudioDevice::RenderCallback, public AudioSourceProvider {
 public:
-    AudioDestinationChromium(AudioSourceProvider&, float sampleRate);
+    AudioDestinationChromium(AudioIOCallback&, float sampleRate);
     virtual ~AudioDestinationChromium();
 
     virtual void start();
@@ -57,7 +58,11 @@ public:
     // WebKit::WebAudioDevice::RenderCallback
     virtual void render(const WebKit::WebVector<float*>& audioData, size_t numberOfFrames);
 
+    // WebCore::AudioSourceProvider
+    virtual void provideInput(AudioBus*, size_t framesToProcess);
+
 private:
+    AudioIOCallback& m_callback;
     AudioBus m_renderBus;
     float m_sampleRate;
     bool m_isPlaying;
diff --git a/Source/WebKit/chromium/src/BlobRegistryProxy.cpp b/Source/WebKit/chromium/src/BlobRegistryProxy.cpp
index 05fbb3638..a78bde36e 100644
--- a/Source/WebKit/chromium/src/BlobRegistryProxy.cpp
+++ b/Source/WebKit/chromium/src/BlobRegistryProxy.cpp
@@ -37,11 +37,10 @@
 #include "BlobData.h"
 #include "KURL.h"
 #include "ResourceHandle.h"
-#include "WebKit.h"
-#include "platform/WebURL.h"
 #include <public/Platform.h>
 #include <public/WebBlobData.h>
 #include <public/WebBlobRegistry.h>
+#include <public/WebURL.h>
 #include <wtf/MainThread.h>
 #include <wtf/StdLibExtras.h>
 
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index f7cb94bbc..ad1000e63 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -37,7 +37,7 @@
 #if ENABLE(INPUT_TYPE_COLOR)
 #include "ColorChooser.h"
 #include "ColorChooserClient.h"
-#include "ColorChooserProxy.h"
+#include "ColorChooserUIController.h"
 #endif
 #include "Console.h"
 #include "Cursor.h"
@@ -77,7 +77,6 @@
 #include "WebAccessibilityObject.h"
 #if ENABLE(INPUT_TYPE_COLOR)
 #include "WebColorChooser.h"
-#include "WebColorChooserClientImpl.h"
 #endif
 #include "WebConsoleMessage.h"
 #include "WebCursorInfo.h"
@@ -694,17 +693,16 @@ void ChromeClientImpl::reachedApplicationCacheOriginQuota(SecurityOrigin*, int64
 }
 
 #if ENABLE(INPUT_TYPE_COLOR)
-PassOwnPtr<ColorChooser> ChromeClientImpl::createColorChooser(ColorChooserClient* chooserClient, const Color& initialColor)
+PassOwnPtr<ColorChooser> ChromeClientImpl::createColorChooser(ColorChooserClient* chooserClient, const Color&)
+{
+    return adoptPtr(new ColorChooserUIController(this, chooserClient));
+}
+PassOwnPtr<WebColorChooser> ChromeClientImpl::createWebColorChooser(WebColorChooserClient* chooserClient, const WebColor& initialColor)
 {
     WebViewClient* client = m_webView->client();
     if (!client)
         return nullptr;
-    WebColorChooserClientImpl* chooserClientProxy = new WebColorChooserClientImpl(chooserClient);
-    WebColor webColor = static_cast<WebColor>(initialColor.rgb());
-    WebColorChooser* chooser = client->createColorChooser(chooserClientProxy, webColor);
-    if (!chooser)
-        return nullptr;
-    return adoptPtr(new ColorChooserProxy(adoptPtr(chooser)));
+    return adoptPtr(client->createColorChooser(chooserClient, initialColor));
 }
 #endif
 
@@ -1114,6 +1112,15 @@ bool ChromeClientImpl::isPointerLocked()
 }
 #endif
 
+#if ENABLE(WIDGET_REGION)
+void ChromeClientImpl::dashboardRegionsChanged()
+{
+    WebViewClient* client = m_webView->client();
+    if (client)
+        client->draggableRegionsChanged();
+}
+#endif
+
 #if ENABLE(REGISTER_PROTOCOL_HANDLER)
 PassOwnPtr<RegisterProtocolHandlerClientImpl> RegisterProtocolHandlerClientImpl::create(WebViewImpl* webView)
 {
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.h b/Source/WebKit/chromium/src/ChromeClientImpl.h
index 30315d394..a786dc5eb 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.h
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.h
@@ -37,14 +37,13 @@
 #include "RegisterProtocolHandlerClient.h"
 #include "SearchPopupMenu.h"
 #include "WebNavigationPolicy.h"
+#include <public/WebColor.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 class AccessibilityObject;
-#if ENABLE(INPUT_TYPE_COLOR)
 class ColorChooser;
 class ColorChooserClient;
-#endif
 class Element;
 class FileChooser;
 class PopupContainer;
@@ -55,6 +54,8 @@ struct WindowFeatures;
 }
 
 namespace WebKit {
+class WebColorChooser;
+class WebColorChooserClient;
 class WebViewImpl;
 struct WebCursorInfo;
 struct WebPopupMenuInfo;
@@ -135,9 +136,13 @@ public:
         WebCore::Frame*, const WTF::String& databaseName);
     virtual void reachedMaxAppCacheSize(int64_t spaceNeeded);
     virtual void reachedApplicationCacheOriginQuota(WebCore::SecurityOrigin*, int64_t totalSpaceNeeded);
+#if ENABLE(WIDGET_REGION)
+    virtual void dashboardRegionsChanged();
+#endif
     virtual bool paintCustomOverhangArea(WebCore::GraphicsContext*, const WebCore::IntRect&, const WebCore::IntRect&, const WebCore::IntRect&);
 #if ENABLE(INPUT_TYPE_COLOR)
     virtual PassOwnPtr<WebCore::ColorChooser> createColorChooser(WebCore::ColorChooserClient*, const WebCore::Color&) OVERRIDE;
+    PassOwnPtr<WebColorChooser> createWebColorChooser(WebColorChooserClient*, const WebColor&);
 #endif
     virtual void runOpenPanel(WebCore::Frame*, PassRefPtr<WebCore::FileChooser>);
     virtual void loadIconForFiles(const Vector<WTF::String>&, WebCore::FileIconLoader*);
diff --git a/Source/WebKit/chromium/src/ChromiumCurrentTime.cpp b/Source/WebKit/chromium/src/ChromiumCurrentTime.cpp
index 25090fdd0..c1ab19609 100644
--- a/Source/WebKit/chromium/src/ChromiumCurrentTime.cpp
+++ b/Source/WebKit/chromium/src/ChromiumCurrentTime.cpp
@@ -29,10 +29,9 @@
  */
 
 #include "config.h"
-#include <wtf/CurrentTime.h>
 
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
+#include <public/Platform.h>
+#include <wtf/CurrentTime.h>
 
 namespace WTF {
 
diff --git a/Source/WebKit/chromium/src/ChromiumOSRandomSource.cpp b/Source/WebKit/chromium/src/ChromiumOSRandomSource.cpp
index 9a31f4ae4..00691b49e 100644
--- a/Source/WebKit/chromium/src/ChromiumOSRandomSource.cpp
+++ b/Source/WebKit/chromium/src/ChromiumOSRandomSource.cpp
@@ -31,8 +31,6 @@
 #include "config.h"
 #include <wtf/OSRandomSource.h>
 
-#include "WebKit.h"
-
 #include <public/Platform.h>
 
 namespace WTF {
diff --git a/Source/WebKit/chromium/src/ChromiumThreading.cpp b/Source/WebKit/chromium/src/ChromiumThreading.cpp
index bc677f3c9..d6520e2b3 100644
--- a/Source/WebKit/chromium/src/ChromiumThreading.cpp
+++ b/Source/WebKit/chromium/src/ChromiumThreading.cpp
@@ -29,12 +29,9 @@
  */
 
 #include "config.h"
-#include <wtf/chromium/ChromiumThreading.h>
-
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
 
-#include <wtf/MainThread.h>
+#include <public/Platform.h>
+#include <wtf/chromium/ChromiumThreading.h>
 
 namespace WTF {
 
diff --git a/Source/WebKit/chromium/src/ColorChooserProxy.cpp b/Source/WebKit/chromium/src/ColorChooserProxy.cpp
deleted file mode 100644
index 6cf72d524..000000000
--- a/Source/WebKit/chromium/src/ColorChooserProxy.cpp
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ColorChooserProxy.h"
-
-#include "Color.h"
-#include "WebColorChooser.h"
-#include "platform/WebColor.h"
-
-#if ENABLE(INPUT_TYPE_COLOR)
-
-namespace WebKit {
-
-ColorChooserProxy::ColorChooserProxy(PassOwnPtr<WebColorChooser> chooser) : m_chooser(chooser)
-{
-}
-
-ColorChooserProxy::~ColorChooserProxy()
-{
-}
-
-void ColorChooserProxy::setSelectedColor(const WebCore::Color& color)
-{
-    if (!m_chooser)
-        return;
-    WebColor webColor = static_cast<WebColor>(color.rgb());
-    m_chooser->setSelectedColor(webColor);
-}
-
-void ColorChooserProxy::endChooser()
-{
-    if (!m_chooser)
-        return;
-    m_chooser->endChooser();
-}
-
-}
-
-#endif // ENABLE(INPUT_TYPE_COLOR)
diff --git a/Source/WebKit/chromium/src/ColorChooserUIController.cpp b/Source/WebKit/chromium/src/ColorChooserUIController.cpp
new file mode 100644
index 000000000..28cdc3840
--- /dev/null
+++ b/Source/WebKit/chromium/src/ColorChooserUIController.cpp
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ColorChooserUIController.h"
+
+#if ENABLE(INPUT_TYPE_COLOR)
+
+#include "ChromeClientImpl.h"
+#include "Color.h"
+#include "ColorChooserClient.h"
+#include "ColorSuggestionPicker.h"
+#include "IntRect.h"
+#include "LocalizedStrings.h"
+#include "WebColorChooser.h"
+#include "platform/WebColor.h"
+#include "platform/WebKitPlatformSupport.h"
+#include <public/WebLocalizedString.h>
+
+namespace WebKit {
+
+// Keep in sync with Actions in colorSuggestionPicker.js.
+enum ColorPickerPopupAction {
+    ColorPickerPopupActionChooseOtherColor = -2,
+    ColorPickerPopupActionCancel = -1,
+    ColorPickerPopupActionSetValue = 0
+};
+
+ColorChooserUIController::ColorChooserUIController(ChromeClientImpl* chromeClient, WebCore::ColorChooserClient* client)
+    : m_chromeClient(chromeClient)
+    , m_client(client)
+    , m_popup(0)
+{
+    if (m_client->shouldShowSuggestions())
+        openPopup();
+    else
+        openColorChooser();
+}
+
+ColorChooserUIController::~ColorChooserUIController()
+{
+}
+
+void ColorChooserUIController::setSelectedColor(const WebCore::Color& color)
+{
+    ASSERT(m_chooser);
+    m_chooser->setSelectedColor(static_cast<WebColor>(color.rgb()));
+}
+
+void ColorChooserUIController::endChooser()
+{
+    if (m_chooser)
+        m_chooser->endChooser();
+    if (m_popup)
+        closePopup();
+}
+
+void ColorChooserUIController::didChooseColor(const WebColor& color)
+{
+    ASSERT(m_client);
+    m_client->didChooseColor(WebCore::Color(static_cast<WebCore::RGBA32>(color)));
+}
+
+void ColorChooserUIController::didEndChooser()
+{
+    ASSERT(m_client);
+    m_chooser = nullptr;
+    m_client->didEndChooser();
+}
+
+WebCore::IntSize ColorChooserUIController::contentSize()
+{
+    return WebCore::IntSize(0, 0);
+}
+
+void ColorChooserUIController::writeDocument(WebCore::DocumentWriter& writer)
+{
+    Vector<WebCore::Color> suggestions = m_client->suggestions();
+    Vector<String> suggestionValues;
+    for (unsigned i = 0; i < suggestions.size(); i++)
+        suggestionValues.append(suggestions[i].serialized());
+    
+    WebCore::PagePopupClient::addString("<!DOCTYPE html><head><meta charset='UTF-8'><style>\n", writer);
+    writer.addData(WebCore::colorSuggestionPickerCss, sizeof(WebCore::colorSuggestionPickerCss));
+    WebCore::PagePopupClient::addString("</style></head><body><div id=main>Loading...</div><script>\n"
+                                      "window.dialogArguments = {\n", writer);
+    WebCore::PagePopupClient::addProperty("values", suggestionValues, writer);       
+    WebCore::PagePopupClient::addProperty("otherColorLabel", Platform::current()->queryLocalizedString(WebLocalizedString::OtherColorLabel), writer);
+    WebCore::PagePopupClient::addString("};\n", writer);
+    writer.addData(WebCore::colorSuggestionPickerJs, sizeof(WebCore::colorSuggestionPickerJs));
+    WebCore::PagePopupClient::addString("</script></body>\n", writer);
+}
+
+void ColorChooserUIController::setValueAndClosePopup(int numValue, const String& stringValue)
+{
+    ASSERT(m_popup);
+    ASSERT(m_client);
+    if (numValue == ColorPickerPopupActionSetValue)
+        m_client->didChooseColor(WebCore::Color(stringValue));
+    if (numValue == ColorPickerPopupActionChooseOtherColor)
+        openColorChooser();
+    closePopup();
+}
+
+void ColorChooserUIController::didClosePopup()
+{
+    m_popup = 0;
+
+    if (!m_chooser)
+        didEndChooser();
+}
+
+void ColorChooserUIController::openPopup()
+{
+    ASSERT(!m_popup);
+    m_popup = m_chromeClient->openPagePopup(this, m_client->elementRectRelativeToRootView());
+}
+
+void ColorChooserUIController::closePopup()
+{
+    if (!m_popup)
+        return;
+    m_chromeClient->closePagePopup(m_popup);
+}
+
+void ColorChooserUIController::openColorChooser()
+{
+    ASSERT(!m_chooser);
+    m_chooser = m_chromeClient->createWebColorChooser(this, static_cast<WebColor>(m_client->currentColor().rgb()));
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(INPUT_TYPE_COLOR)
diff --git a/Source/WebKit/chromium/src/WebColorChooserClientImpl.h b/Source/WebKit/chromium/src/ColorChooserUIController.h
index d5a085da8..98adb6714 100644
--- a/Source/WebKit/chromium/src/WebColorChooserClientImpl.h
+++ b/Source/WebKit/chromium/src/ColorChooserUIController.h
@@ -23,33 +23,59 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebColorChooserClientImpl_h
-#define WebColorChooserClientImpl_h
-
-#include "WebColorChooserClient.h"
+#ifndef ColorChooserUIController_h
+#define ColorChooserUIController_h
 
 #if ENABLE(INPUT_TYPE_COLOR)
 
+#include "ColorChooser.h"
+#include "PagePopupClient.h"
+#include "WebColorChooserClient.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
 namespace WebCore {
 class ColorChooserClient;
+class PagePopup;
 }
 
 namespace WebKit {
 
-class WebColorChooserClientImpl : public WebColorChooserClient {
+class ChromeClientImpl;
+class WebColorChooser;
+
+class ColorChooserUIController : public WebColorChooserClient, public WebCore::ColorChooser, public WebCore::PagePopupClient {
 public:
-    WebColorChooserClientImpl(WebCore::ColorChooserClient*);
-    virtual ~WebColorChooserClientImpl();
+    ColorChooserUIController(ChromeClientImpl*, WebCore::ColorChooserClient*);
+    virtual ~ColorChooserUIController();
+
+    // ColorChooser functions:
+    virtual void setSelectedColor(const WebCore::Color&) OVERRIDE;
+    virtual void endChooser() OVERRIDE;
 
+    // WebColorChooserClient functions:
     virtual void didChooseColor(const WebColor&) OVERRIDE;
     virtual void didEndChooser() OVERRIDE;
 
+    // PagePopupClient functions:
+    virtual WebCore::IntSize contentSize() OVERRIDE;
+    virtual void writeDocument(WebCore::DocumentWriter&) OVERRIDE;
+    virtual void setValueAndClosePopup(int, const String&) OVERRIDE;
+    virtual void didClosePopup() OVERRIDE;
+
 private:
+    void openPopup();
+    void closePopup();
+    void openColorChooser();
+
+    ChromeClientImpl* m_chromeClient;
     WebCore::ColorChooserClient* m_client;
+    OwnPtr<WebColorChooser> m_chooser;
+    WebCore::PagePopup* m_popup;
 };
 
 }
 
 #endif // ENABLE(INPUT_TYPE_COLOR)
 
-#endif // WebColorChooserClientImpl_h
+#endif // ColorChooserUIController_h
diff --git a/Source/WebKit/chromium/src/EditorClientImpl.cpp b/Source/WebKit/chromium/src/EditorClientImpl.cpp
index b2d060f0e..b5eaf595f 100644
--- a/Source/WebKit/chromium/src/EditorClientImpl.cpp
+++ b/Source/WebKit/chromium/src/EditorClientImpl.cpp
@@ -49,9 +49,9 @@
 #include "WebElement.h"
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
-#include "WebKit.h"
 #include "WebInputElement.h"
 #include "WebInputEventConversion.h"
+#include "WebKit.h"
 #include "WebNode.h"
 #include "WebPermissionClient.h"
 #include "WebRange.h"
diff --git a/Source/WebKit/chromium/src/ExternalPopupMenu.h b/Source/WebKit/chromium/src/ExternalPopupMenu.h
index aefd35e12..382bf4cbf 100644
--- a/Source/WebKit/chromium/src/ExternalPopupMenu.h
+++ b/Source/WebKit/chromium/src/ExternalPopupMenu.h
@@ -33,6 +33,8 @@
 
 #include "PopupMenu.h"
 #include "WebExternalPopupMenuClient.h"
+#include <public/WebCanvas.h>
+#include <public/WebScrollbar.h>
 
 namespace WebCore {
 class FrameView;
@@ -45,6 +47,7 @@ namespace WebKit {
 class WebExternalPopupMenu;
 class WebViewClient;
 struct WebPopupMenuInfo;
+class WebInputEvent;
 
 // The ExternalPopupMenu connects the actual implementation of the popup menu
 // to the WebCore popup menu.
@@ -76,7 +79,7 @@ private:
 
     // The actual implementor of the show menu.
     WebExternalPopupMenu* m_webExternalPopupMenu;
-}; 
+};
 
 } // namespace WebKit
 
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index b67798e74..1e315660a 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -52,7 +52,6 @@
 #include "MessageEvent.h"
 #include "MouseEvent.h"
 #include "Page.h"
-#include "PlatformString.h"
 #include "PluginData.h"
 #include "PluginDataChromium.h"
 #include "ProgressTracker.h"
@@ -69,7 +68,6 @@
 #include "WebFrameImpl.h"
 #include "WebIntentRequest.h"
 #include "WebIntentServiceInfo.h"
-#include "WebKit.h"
 #include "WebNode.h"
 #include "WebPermissionClient.h"
 #include "WebPlugin.h"
@@ -83,14 +81,15 @@
 #include "WindowFeatures.h"
 #include "WrappedResourceRequest.h"
 #include "WrappedResourceResponse.h"
-#include "platform/WebKitPlatformSupport.h"
 #include "platform/WebURL.h"
 #include "platform/WebURLError.h"
 #include "platform/WebVector.h"
+#include <public/Platform.h>
 #include <public/WebMimeRegistry.h>
 
 #include <wtf/StringExtras.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
 
 #if USE(V8)
 #include <v8.h>
@@ -1606,7 +1605,7 @@ bool FrameLoaderClientImpl::willCheckAndDispatchMessageEvent(
     if (event && event->source() && event->source()->document())
         source = WebFrameImpl::fromFrame(event->source()->document()->frame());
     return m_webFrame->client()->willCheckAndDispatchMessageEvent(
-        source, WebSecurityOrigin(target), WebDOMMessageEvent(event));
+        source, m_webFrame, WebSecurityOrigin(target), WebDOMMessageEvent(event));
 }
 
 #if ENABLE(WEB_INTENTS_TAG)
diff --git a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
index e2c9bb9e2..c1bec1077 100755
--- a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
@@ -43,9 +43,7 @@
 #include "WebIDBDatabaseError.h"
 #include "WebIDBFactory.h"
 #include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
 #include "WebPermissionClient.h"
-#include "platform/WebVector.h"
 #include "WebViewImpl.h"
 #include "WebWorkerBase.h"
 #include "WebWorkerClientImpl.h"
@@ -53,6 +51,8 @@
 #include "WorkerLoaderProxy.h"
 #include "WorkerScriptController.h"
 #include "WorkerThread.h"
+#include "platform/WebKitPlatformSupport.h"
+#include <public/WebVector.h>
 
 
 using namespace WebCore;
diff --git a/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp b/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
index e3f7f1318..0338d3f2d 100644
--- a/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
+++ b/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
@@ -143,6 +143,11 @@ void InspectorFrontendClientImpl::append(const String& url, const String& conten
     m_client->append(url, content);
 }
 
+bool InspectorFrontendClientImpl::canInspectWorkers()
+{
+    return true;
+}
+
 void InspectorFrontendClientImpl::inspectedURLChanged(const String& url)
 {
     m_frontendPage->mainFrame()->document()->setTitle("Developer Tools - " + url);
diff --git a/Source/WebKit/chromium/src/InspectorFrontendClientImpl.h b/Source/WebKit/chromium/src/InspectorFrontendClientImpl.h
index 4f66e1bcd..55e57e696 100644
--- a/Source/WebKit/chromium/src/InspectorFrontendClientImpl.h
+++ b/Source/WebKit/chromium/src/InspectorFrontendClientImpl.h
@@ -72,6 +72,7 @@ public:
     virtual bool canSave();
     virtual void save(const WTF::String& urk, const WTF::String& content, bool forceSaveAs);
     virtual void append(const WTF::String& urk, const WTF::String& content);
+    virtual bool canInspectWorkers();
 
     virtual void inspectedURLChanged(const WTF::String&);
 
diff --git a/Source/WebKit/chromium/src/LocalizedStrings.cpp b/Source/WebKit/chromium/src/LocalizedStrings.cpp
index 081a67b8a..2a4432d8a 100644
--- a/Source/WebKit/chromium/src/LocalizedStrings.cpp
+++ b/Source/WebKit/chromium/src/LocalizedStrings.cpp
@@ -34,11 +34,9 @@
 #include "IntSize.h"
 #include "NotImplemented.h"
 
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebString.h"
-
+#include <public/Platform.h>
 #include <public/WebLocalizedString.h>
+#include <public/WebString.h>
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/WTFString.h>
 
@@ -215,6 +213,12 @@ String crashedPluginText()
     return String("Plug-in Failure");
 }
 
+String blockedPluginByContentSecurityPolicyText()
+{
+    notImplemented();
+    return String();
+}
+
 String insecurePluginVersionText()
 {
     notImplemented();
diff --git a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
index 899315d29..fb9c12de6 100644
--- a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
+++ b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
@@ -30,10 +30,9 @@
 #include "FloatPoint.h"
 #include "FloatRect.h"
 #include "GraphicsLayer.h"
-#include "LayerChromium.h"
 #include "PlatformContextSkia.h"
 #include "WebViewImpl.h"
-#include "cc/CCLayerTreeHost.h"
+#include <public/WebContentLayer.h>
 #include <public/WebFloatPoint.h>
 
 namespace WebKit {
@@ -49,10 +48,11 @@ NonCompositedContentHost::NonCompositedContentHost(WebViewImpl* webView)
     m_graphicsLayer->setName("non-composited content");
 #endif
     m_graphicsLayer->setDrawsContent(true);
-    m_graphicsLayer->platformLayer()->setIsNonCompositedContent(true);
-    m_graphicsLayer->platformLayer()->setOpaque(true);
+    WebContentLayer layer = m_graphicsLayer->platformLayer()->to<WebContentLayer>();
+    layer.setUseLCDText(true);
+    layer.setOpaque(true);
 #if !OS(ANDROID)
-    m_graphicsLayer->platformLayer()->setDrawCheckerboardForMissingTiles(true);
+    layer.setDrawCheckerboardForMissingTiles(true);
 #endif
 }
 
@@ -77,11 +77,10 @@ void NonCompositedContentHost::setScrollLayer(WebCore::GraphicsLayer* layer)
 
     if (!layer) {
         m_graphicsLayer->removeFromParent();
-        m_graphicsLayer->platformLayer()->setLayerTreeHost(0);
         return;
     }
 
-    if (WebScrollableLayer(layer->platformLayer()) == scrollLayer())
+    if (*layer->platformLayer() == scrollLayer())
         return;
 
     layer->addChildAtIndex(m_graphicsLayer.get(), 0);
@@ -152,7 +151,7 @@ WebScrollableLayer NonCompositedContentHost::scrollLayer()
 {
     if (!m_graphicsLayer->parent())
         return WebScrollableLayer();
-    return WebScrollableLayer(m_graphicsLayer->parent()->platformLayer());
+    return m_graphicsLayer->parent()->platformLayer()->to<WebScrollableLayer>();
 }
 
 void NonCompositedContentHost::invalidateRect(const WebCore::IntRect& rect)
@@ -169,9 +168,7 @@ void NonCompositedContentHost::notifyAnimationStarted(const WebCore::GraphicsLay
 
 void NonCompositedContentHost::notifySyncRequired(const WebCore::GraphicsLayer*)
 {
-    WebCore::CCLayerTreeHost* layerTreeHost = m_graphicsLayer->platformLayer()->layerTreeHost();
-    if (layerTreeHost)
-        layerTreeHost->setNeedsCommit();
+    m_webView->scheduleCompositingLayerSync();
 }
 
 void NonCompositedContentHost::paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext& context, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect)
diff --git a/Source/WebKit/chromium/src/PlatformMessagePortChannel.cpp b/Source/WebKit/chromium/src/PlatformMessagePortChannel.cpp
index cd903c221..deb9031cc 100644
--- a/Source/WebKit/chromium/src/PlatformMessagePortChannel.cpp
+++ b/Source/WebKit/chromium/src/PlatformMessagePortChannel.cpp
@@ -35,8 +35,6 @@
 #include "ScriptExecutionContext.h"
 #include "SerializedScriptValue.h"
 
-#include "WebKit.h"
-
 #include <public/Platform.h>
 #include <public/WebMessagePortChannel.h>
 #include <public/WebString.h>
diff --git a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp
index 0888e3033..aa9b189a7 100644
--- a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp
+++ b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp
@@ -85,23 +85,13 @@ void SpeechRecognitionClientProxy::didStartSound(const WebSpeechRecognitionHandl
 {
     RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
     recognition->didStartSound();
-}
-
-void SpeechRecognitionClientProxy::didStartSpeech(const WebSpeechRecognitionHandle& handle)
-{
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
     recognition->didStartSpeech();
 }
 
-void SpeechRecognitionClientProxy::didEndSpeech(const WebSpeechRecognitionHandle& handle)
-{
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
-    recognition->didEndSpeech();
-}
-
 void SpeechRecognitionClientProxy::didEndSound(const WebSpeechRecognitionHandle& handle)
 {
     RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
+    recognition->didEndSpeech();
     recognition->didEndSound();
 }
 
diff --git a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h
index 8063e71ed..750cbae5c 100644
--- a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h
+++ b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h
@@ -53,8 +53,6 @@ public:
     // WebSpeechRecognizerClient:
     virtual void didStartAudio(const WebSpeechRecognitionHandle&) OVERRIDE;
     virtual void didStartSound(const WebSpeechRecognitionHandle&) OVERRIDE;
-    virtual void didStartSpeech(const WebSpeechRecognitionHandle&) OVERRIDE;
-    virtual void didEndSpeech(const WebSpeechRecognitionHandle&) OVERRIDE;
     virtual void didEndSound(const WebSpeechRecognitionHandle&) OVERRIDE;
     virtual void didEndAudio(const WebSpeechRecognitionHandle&) OVERRIDE;
     virtual void didReceiveResult(const WebSpeechRecognitionHandle&, const WebSpeechRecognitionResult&, unsigned long resultIndex, const WebVector<WebSpeechRecognitionResult>& resultHistory) OVERRIDE;
diff --git a/Source/WebKit/chromium/src/StorageAreaProxy.cpp b/Source/WebKit/chromium/src/StorageAreaProxy.cpp
index 576105c4d..722e80f53 100644
--- a/Source/WebKit/chromium/src/StorageAreaProxy.cpp
+++ b/Source/WebKit/chromium/src/StorageAreaProxy.cpp
@@ -120,6 +120,11 @@ bool StorageAreaProxy::canAccessStorage(Frame* frame) const
     return !webView->permissionClient() || webView->permissionClient()->allowStorage(webFrame, m_storageType == LocalStorage);
 }
 
+size_t StorageAreaProxy::memoryBytesUsedByCache() const
+{
+    return m_storageArea->memoryBytesUsedByCache();
+}
+
 void StorageAreaProxy::dispatchLocalStorageEvent(PageGroup* pageGroup, const String& key, const String& oldValue, const String& newValue,
                                                  SecurityOrigin* securityOrigin, const KURL& pageURL, WebKit::WebStorageArea* sourceAreaInstance, bool originatedInProcess)
 {
diff --git a/Source/WebKit/chromium/src/StorageAreaProxy.h b/Source/WebKit/chromium/src/StorageAreaProxy.h
index 83f2eae17..cae359358 100644
--- a/Source/WebKit/chromium/src/StorageAreaProxy.h
+++ b/Source/WebKit/chromium/src/StorageAreaProxy.h
@@ -58,6 +58,8 @@ public:
 
     virtual bool disabledByPrivateBrowsingInFrame(const Frame*) const { return false; }
 
+    virtual size_t memoryBytesUsedByCache() const;
+
     static void dispatchLocalStorageEvent(
             PageGroup*, const String& key, const String& oldValue, const String& newValue,
             SecurityOrigin*, const KURL& pageURL, WebKit::WebStorageArea* sourceAreaInstance, bool originatedInProcess);
diff --git a/Source/WebKit/chromium/src/WebAnimation.cpp b/Source/WebKit/chromium/src/WebAnimation.cpp
index 7dddfc241..610201512 100644
--- a/Source/WebKit/chromium/src/WebAnimation.cpp
+++ b/Source/WebKit/chromium/src/WebAnimation.cpp
@@ -38,6 +38,11 @@ using WebCore::CCActiveAnimation;
 
 namespace WebKit {
 
+WebAnimation::TargetProperty WebAnimation::targetProperty() const
+{
+    return static_cast<WebAnimation::TargetProperty>(m_private->targetProperty());
+}
+
 int WebAnimation::iterations() const
 {
     return m_private->iterations();
@@ -87,10 +92,12 @@ WebAnimation::operator PassOwnPtr<WebCore::CCActiveAnimation>() const
 
 void WebAnimation::initialize(const WebAnimationCurve& curve, TargetProperty targetProperty)
 {
-    m_private.reset(CCActiveAnimation::create(curve,
-                                              AnimationIdVendor::getNextAnimationId(),
-                                              AnimationIdVendor::getNextGroupId(),
-                                              static_cast<WebCore::CCActiveAnimation::TargetProperty>(targetProperty)).leakPtr());
+    initialize(curve, AnimationIdVendor::getNextAnimationId(), AnimationIdVendor::getNextGroupId(), targetProperty);
+}
+
+void WebAnimation::initialize(const WebAnimationCurve& curve, int animationId, int groupId, TargetProperty targetProperty)
+{
+    m_private.reset(CCActiveAnimation::create(curve, animationId, groupId, static_cast<WebCore::CCActiveAnimation::TargetProperty>(targetProperty)).leakPtr());
 }
 
 void WebAnimation::destroy()
diff --git a/Source/WebKit/chromium/src/WebBindings.cpp b/Source/WebKit/chromium/src/WebBindings.cpp
index 926db3b11..786a4175b 100644
--- a/Source/WebKit/chromium/src/WebBindings.cpp
+++ b/Source/WebKit/chromium/src/WebBindings.cpp
@@ -35,18 +35,20 @@
 #include "npruntime_priv.h"
 
 #if USE(V8)
-#include <wtf/ArrayBufferView.h>
+#include "BindingState.h"
 #include "DOMWindow.h"
+#include "Frame.h"
 #include "NPV8Object.h"  // for PrivateIdentifier
 #include "Range.h"
 #include "V8ArrayBuffer.h"
 #include "V8ArrayBufferView.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8Element.h"
 #include "V8NPUtils.h"
 #include "V8Proxy.h"
 #include "V8Range.h"
+#include <wtf/ArrayBufferView.h>
+// FIXME: Remove the USE(JSC) ifdefs because we don't support USE(JSC) anymore.
 #elif USE(JSC)
 #include "bridge/c/c_utility.h"
 #endif
@@ -288,7 +290,7 @@ static NPObject* makeIntArrayImpl(const WebVector<int>& data)
     for (size_t i = 0; i < data.size(); ++i)
         result->Set(i, v8::Number::New(data[i]));
 
-    DOMWindow* window = V8Proxy::retrieveWindow(V8Proxy::currentContext());
+    DOMWindow* window = V8Proxy::retrieveWindow(v8::Context::GetCurrent());
     return npCreateV8ScriptObject(0, result, window);
 }
 
@@ -299,7 +301,7 @@ static NPObject* makeStringArrayImpl(const WebVector<WebString>& data)
     for (size_t i = 0; i < data.size(); ++i)
         result->Set(i, data[i].data() ? v8::String::New(reinterpret_cast<const uint16_t*>((data[i].data())), data[i].length()) : v8::String::New(""));
 
-    DOMWindow* window = V8Proxy::retrieveWindow(V8Proxy::currentContext());
+    DOMWindow* window = V8Proxy::retrieveWindow(v8::Context::GetCurrent());
     return npCreateV8ScriptObject(0, result, window);
 }
 
diff --git a/Source/WebKit/chromium/src/WebColorChooserClientImpl.cpp b/Source/WebKit/chromium/src/WebColorChooserClientImpl.cpp
deleted file mode 100644
index c7ec47149..000000000
--- a/Source/WebKit/chromium/src/WebColorChooserClientImpl.cpp
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "WebColorChooserClientImpl.h"
-
-#include "Color.h"
-#include "ColorChooserClient.h"
-
-#if ENABLE(INPUT_TYPE_COLOR)
-
-namespace WebKit {
-
-WebColorChooserClientImpl::WebColorChooserClientImpl(WebCore::ColorChooserClient* client) : m_client(client)
-{
-}
-
-WebColorChooserClientImpl::~WebColorChooserClientImpl()
-{
-}
-
-void WebColorChooserClientImpl::didChooseColor(const WebColor& color)
-{
-    if (!m_client)
-        return;
-    m_client->didChooseColor(WebCore::Color(static_cast<WebCore::RGBA32>(color)));
-}
-
-void WebColorChooserClientImpl::didEndChooser()
-{
-    if (!m_client)
-        return;
-    m_client->didEndChooser();
-}
-
-}
-
-#endif // ENABLE(INPUT_TYPE_COLOR)
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
index 63bf270fe..25b31d5e9 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
@@ -33,10 +33,8 @@
 #include "WebCompositorImpl.h"
 #include "WebCompositorInputHandlerClient.h"
 #include "WebInputEvent.h"
-#include "WebKit.h"
 #include "cc/CCActiveGestureAnimation.h"
 #include "cc/CCProxy.h"
-#include "platform/WebKitPlatformSupport.h"
 #include <wtf/ThreadingPrimitives.h>
 
 using namespace WebCore;
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
index 64647105b..6bb09ab5c 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
@@ -27,11 +27,11 @@
 #define WebCompositorInputHandlerImpl_h
 
 #include "WebActiveWheelFlingParameters.h"
-#include "WebCompositor.h"
 #include "WebCompositorInputHandler.h"
 #include "WebInputEvent.h"
 #include "cc/CCGestureCurve.h"
 #include "cc/CCInputHandler.h"
+#include <public/WebCompositor.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
diff --git a/Source/WebKit/chromium/src/WebContentLayer.cpp b/Source/WebKit/chromium/src/WebContentLayer.cpp
index 14ce98039..efa7465b1 100644
--- a/Source/WebKit/chromium/src/WebContentLayer.cpp
+++ b/Source/WebKit/chromium/src/WebContentLayer.cpp
@@ -53,6 +53,16 @@ void WebContentLayer::setContentsScale(float scale)
     m_private->setContentsScale(scale);
 }
 
+void WebContentLayer::setUseLCDText(bool enable)
+{
+    m_private->setUseLCDText(enable);
+}
+
+void WebContentLayer::setDrawCheckerboardForMissingTiles(bool enable)
+{
+    m_private->setDrawCheckerboardForMissingTiles(enable);
+}
+
 WebContentLayer::WebContentLayer(const PassRefPtr<ContentLayerChromium>& node)
     : WebScrollableLayer(node)
 {
diff --git a/Source/WebKit/chromium/src/WebContentLayerImpl.cpp b/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
index ecf099a4a..69da1ea3f 100644
--- a/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
@@ -26,12 +26,9 @@
 #include "config.h"
 #include "WebContentLayerImpl.h"
 
-#include "platform/WebContentLayerClient.h"
-#include "platform/WebFloatRect.h"
-#include "platform/WebRect.h"
-#include "GraphicsContext.h"
-#include "platform/WebCanvas.h"
-#include "PlatformContextSkia.h"
+#include <public/WebContentLayerClient.h>
+#include <public/WebFloatRect.h>
+#include <public/WebRect.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index 7a4617ddc..d4366f99a 100644
--- a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -423,8 +423,8 @@ void WebDevToolsAgentImpl::didCreateScriptContext(WebFrameImpl* webframe, int wo
     // Skip non main world contexts.
     if (worldId)
         return;
-    if (WebCore::V8Proxy* proxy = WebCore::V8Proxy::retrieve(webframe->frame()))
-        proxy->setContextDebugId(m_hostId);
+    if (WebCore::Frame* frame = webframe->frame())
+        frame->script()->proxy()->setContextDebugId(m_hostId);
 }
 
 void WebDevToolsAgentImpl::mainFrameViewCreated(WebFrameImpl* webFrame)
diff --git a/Source/WebKit/chromium/src/WebDocument.cpp b/Source/WebKit/chromium/src/WebDocument.cpp
index 063f71892..691701715 100644
--- a/Source/WebKit/chromium/src/WebDocument.cpp
+++ b/Source/WebKit/chromium/src/WebDocument.cpp
@@ -44,6 +44,7 @@
 #include "HTMLFormElement.h"
 #include "HTMLHeadElement.h"
 #include "NodeList.h"
+#include "RenderObject.h"
 #include "SecurityOrigin.h"
 #include "StyleSheetContents.h"
 #include "WebAccessibilityObject.h"
@@ -228,6 +229,15 @@ WebReferrerPolicy WebDocument::referrerPolicy() const
     return static_cast<WebReferrerPolicy>(constUnwrap<Document>()->referrerPolicy());
 }
 
+WebElement WebDocument::createElement(const WebString& tagName)
+{
+    ExceptionCode ec = 0;
+    WebElement element(unwrap<Document>()->createElement(tagName, ec));
+    if (ec)
+        return WebElement();
+    return element;
+}
+
 WebAccessibilityObject WebDocument::accessibilityObject() const
 {
     const Document* document = constUnwrap<Document>();
@@ -242,6 +252,25 @@ WebAccessibilityObject WebDocument::accessibilityObjectFromID(int axID) const
         document->axObjectCache()->objectFromAXID(axID));
 }
 
+WebVector<WebDraggableRegion> WebDocument::draggableRegions() const
+{
+    WebVector<WebDraggableRegion> draggableRegions;
+#if ENABLE(WIDGET_REGION)
+    const Document* document = constUnwrap<Document>();
+    if (document->hasDashboardRegions()) {
+        const Vector<DashboardRegionValue>& regions = document->dashboardRegions();
+        draggableRegions = WebVector<WebDraggableRegion>(regions.size());
+        for (size_t i = 0; i < regions.size(); i++) {
+            const DashboardRegionValue& value = regions[i];
+            draggableRegions[i].label = value.label;
+            draggableRegions[i].bounds = WebCore::IntRect(value.bounds);
+            draggableRegions[i].clip = WebCore::IntRect(value.clip);
+        }
+    }
+#endif
+    return draggableRegions;
+}
+
 WebDocument::WebDocument(const PassRefPtr<Document>& elem)
     : WebNode(elem)
 {
diff --git a/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp b/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
index d9cea3bb1..bbd1f8ddb 100644
--- a/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
+++ b/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
@@ -27,7 +27,7 @@
 #include <public/WebExternalTextureLayer.h>
 
 #include "TextureLayerChromium.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateQueue.h"
 #include <public/WebExternalTextureLayerClient.h>
 #include <public/WebFloatRect.h>
 #include <public/WebSize.h>
@@ -38,18 +38,19 @@ namespace WebKit {
 
 class WebTextureUpdaterImpl : public WebTextureUpdater {
 public:
-    explicit WebTextureUpdaterImpl(CCTextureUpdater& updater)
-        : m_updater(updater)
+    explicit WebTextureUpdaterImpl(CCTextureUpdateQueue& queue)
+        : m_queue(queue)
     {
     }
 
     virtual void appendCopy(unsigned sourceTexture, unsigned destinationTexture, WebSize size) OVERRIDE
     {
-        m_updater.appendCopy(sourceTexture, destinationTexture, size);
+        TextureCopier::Parameters copy = { sourceTexture, destinationTexture, size };
+        m_queue.appendCopy(copy);
     }
 
 private:
-    CCTextureUpdater& m_updater;
+    CCTextureUpdateQueue& m_queue;
 };
 
 class WebExternalTextureLayerImpl : public TextureLayerChromiumClient, public TextureLayerChromium {
@@ -60,9 +61,9 @@ public:
     {
     }
 
-    virtual unsigned prepareTexture(CCTextureUpdater& updater) OVERRIDE
+    virtual unsigned prepareTexture(CCTextureUpdateQueue& queue) OVERRIDE
     {
-        WebTextureUpdaterImpl updaterImpl(updater);
+        WebTextureUpdaterImpl updaterImpl(queue);
         return m_client->prepareTexture(updaterImpl);
     }
 
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index f821562f6..fb2a29540 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -169,6 +169,8 @@
 #include "XPathResult.h"
 #include "markup.h"
 #include "painting/GraphicsContextBuilder.h"
+#include "platform/WebFloatPoint.h"
+#include "platform/WebFloatRect.h"
 #include "platform/WebPoint.h"
 #include "platform/WebRect.h"
 #include "platform/WebSerializedScriptValue.h"
@@ -588,6 +590,16 @@ WebString WebFrameImpl::name() const
     return m_frame->tree()->uniqueName();
 }
 
+WebString WebFrameImpl::uniqueName() const
+{
+    return m_frame->tree()->uniqueName();
+}
+
+WebString WebFrameImpl::assignedName() const
+{
+    return m_frame->tree()->name();
+}
+
 void WebFrameImpl::setName(const WebString& name)
 {
     m_frame->tree()->setName(name);
@@ -1446,11 +1458,22 @@ bool WebFrameImpl::selectWordAroundCaret()
 
 void WebFrameImpl::selectRange(const WebPoint& start, const WebPoint& end)
 {
-    VisibleSelection selection(visiblePositionForWindowPoint(start),
-                               visiblePositionForWindowPoint(end));
+    VisiblePosition startPosition = visiblePositionForWindowPoint(start);
+    VisiblePosition endPosition = visiblePositionForWindowPoint(end);
+
+    // To correctly handle editable boundaries, we adjust the selection by setting its extent
+    // while keeping its base fixed. For a touch-based UI, this means that moving the selection
+    // handles behaves like a drag-select with the mouse, which is what we want here. If both
+    // endpoints changed, we need to set the extent twice.
+    // FIXME: the WebFrame::SelectRange API should explicitly state which endpoint is moving.
+    VisibleSelection newSelection = frame()->selection()->selection();
+    if (startPosition != newSelection.visibleStart())
+        newSelection = VisibleSelection(newSelection.visibleEnd(), startPosition);
+    if (endPosition != newSelection.visibleEnd())
+        newSelection = VisibleSelection(newSelection.visibleStart(), endPosition);
 
-    if (frame()->selection()->shouldChangeSelection(selection))
-        frame()->selection()->setSelection(selection, CharacterGranularity);
+    if (frame()->selection()->shouldChangeSelection(newSelection))
+        frame()->selection()->setSelection(newSelection, CharacterGranularity);
 }
 
 void WebFrameImpl::selectRange(const WebRange& webRange)
@@ -1472,13 +1495,9 @@ VisiblePosition WebFrameImpl::visiblePositionForWindowPoint(const WebPoint& poin
 
     frame()->document()->renderView()->layer()->hitTest(request, result);
 
-    // Matching the logic in MouseEventWithHitTestResults::targetNode()
-    Node* node = result.innerNode();
+    Node* node = EventHandler::targetNode(result);
     if (!node)
         return VisiblePosition();
-    Element* element = node->parentElement();
-    if (!node->inDocument() && element && element->inDocument())
-        node = element;
 
     return node->renderer()->positionForPoint(result.localPoint());
 }
@@ -1938,6 +1957,29 @@ void WebFrameImpl::dispatchMessageEventWithOriginCheck(const WebSecurityOrigin&
     m_frame->domWindow()->dispatchMessageEventWithOriginCheck(intendedTargetOrigin.get(), event, 0);
 }
 
+int WebFrameImpl::findMatchMarkersVersion() const
+{
+    // FIXME: Implement this as part of https://bugs.webkit.org/show_bug.cgi?id=93111.
+    return 0;
+}
+
+WebFloatRect WebFrameImpl::activeFindMatchRect()
+{
+    // FIXME: Implement this as part of https://bugs.webkit.org/show_bug.cgi?id=93111.
+    return WebFloatRect();
+}
+
+void WebFrameImpl::findMatchRects(WebVector<WebFloatRect>& outputRects)
+{
+    // FIXME: Implement this as part of https://bugs.webkit.org/show_bug.cgi?id=93111.
+}
+
+int WebFrameImpl::selectNearestFindMatch(const WebFloatPoint& point, WebRect* selectionRect)
+{
+    // FIXME: Implement this as part of https://bugs.webkit.org/show_bug.cgi?id=93111.
+    return 0;
+}
+
 void WebFrameImpl::deliverIntent(const WebIntent& intent, WebMessagePortChannelArray* ports, WebDeliveredIntentClient* intentClient)
 {
 #if ENABLE(WEB_INTENTS)
@@ -2001,21 +2043,6 @@ WebString WebFrameImpl::markerTextForListItem(const WebElement& webElement) cons
     return WebCore::markerTextForListItem(const_cast<Element*>(webElement.constUnwrap<Element>()));
 }
 
-int WebFrameImpl::pageNumberForElementById(const WebString& id,
-                                           float pageWidthInPixels,
-                                           float pageHeightInPixels) const
-{
-    if (!m_frame)
-        return -1;
-
-    Element* element = m_frame->document()->getElementById(id);
-    if (!element)
-        return -1;
-
-    FloatSize pageSize(pageWidthInPixels, pageHeightInPixels);
-    return PrintContext::pageNumberForElement(element, pageSize);
-}
-
 void WebFrameImpl::printPagesWithBoundaries(WebCanvas* canvas, const WebSize& pageSizeInPixels)
 {
     ASSERT(m_printContext.get());
@@ -2142,6 +2169,9 @@ PassRefPtr<Frame> WebFrameImpl::createChildFrame(
     if (!childFrame->tree()->parent())
         return 0;
 
+    if (m_client)
+        m_client->didCreateFrame(this, webframe.get());
+
     return childFrame.release();
 }
 
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.h b/Source/WebKit/chromium/src/WebFrameImpl.h
index 9dbf68336..0aba56f4c 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.h
+++ b/Source/WebKit/chromium/src/WebFrameImpl.h
@@ -72,6 +72,8 @@ class WebFrameImpl : public WebFrame, public RefCounted<WebFrameImpl> {
 public:
     // WebFrame methods:
     virtual WebString name() const;
+    virtual WebString uniqueName() const;
+    virtual WebString assignedName() const;
     virtual void setName(const WebString&);
     virtual long long identifier() const;
     virtual WebVector<WebIconURL> iconURLs(int iconTypes) const;
@@ -210,6 +212,10 @@ public:
     virtual void cancelPendingScopingEffort();
     virtual void increaseMatchCount(int count, int identifier);
     virtual void resetMatchCount();
+    virtual int findMatchMarkersVersion() const;
+    virtual WebFloatRect activeFindMatchRect();
+    virtual void findMatchRects(WebVector<WebFloatRect>&);
+    virtual int selectNearestFindMatch(const WebFloatPoint&, WebRect* selectionRect);
 
     virtual void sendOrientationChangeEvent(int orientation);
 
@@ -228,9 +234,6 @@ public:
     virtual WebString contentAsMarkup() const;
     virtual WebString renderTreeAsText(RenderAsTextControls toShow = RenderAsTextNormal) const;
     virtual WebString markerTextForListItem(const WebElement&) const;
-    virtual int pageNumberForElementById(const WebString& id,
-                                         float pageWidthInPixels,
-                                         float pageHeightInPixels) const;
     virtual WebRect selectionBoundsRect() const;
 
     virtual bool selectionStartHasSpellingMarkerFor(int from, int length) const;
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index 22a066807..c327eba84 100755
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -106,8 +106,9 @@ void WebIDBObjectStoreImpl::deleteIndex(const WebString& name, const WebIDBTrans
     m_objectStore->deleteIndex(name, transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::openCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
+void WebIDBObjectStoreImpl::openCursor(const WebIDBKeyRange& keyRange, WebIDBCursor::Direction direction, WebIDBCallbacks* callbacks, WebIDBTransaction::TaskType, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
+    // FIXME: Pass along TaskType when the API becomes available.
     m_objectStore->openCursor(keyRange, direction, IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
index 934cffa99..482b22380 100644
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
@@ -54,7 +54,11 @@ public:
     WebIDBIndex* index(const WebString& name, WebExceptionCode&);
     void deleteIndex(const WebString& name, const WebIDBTransaction&, WebExceptionCode&);
 
-    void openCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    void openCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
+    {
+        openCursor(range, static_cast<WebIDBCursor::Direction>(direction), callbacks, WebIDBTransaction::NormalTask, transaction, ec);
+    }
+    void openCursor(const WebIDBKeyRange&, WebIDBCursor::Direction, WebIDBCallbacks*, WebIDBTransaction::TaskType, const WebIDBTransaction&, WebExceptionCode&);
     void count(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
  private:
diff --git a/Source/WebKit/chromium/src/WebImageCG.cpp b/Source/WebKit/chromium/src/WebImageCG.cpp
deleted file mode 100644
index 242a68304..000000000
--- a/Source/WebKit/chromium/src/WebImageCG.cpp
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include "Image.h"
-#include "ImageSource.h"
-#include "SharedBuffer.h"
-
-#include "platform/WebData.h"
-#include "platform/WebSize.h"
-
-#include <CoreGraphics/CGImage.h>
-
-#include <public/WebImage.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RetainPtr.h>
-
-using namespace WebCore;
-
-namespace WebKit {
-
-WebImage WebImage::fromData(const WebData& data, const WebSize& desiredSize)
-{
-    ImageSource source;
-    source.setData(PassRefPtr<SharedBuffer>(data).get(), true);
-    if (!source.isSizeAvailable())
-        return WebImage();
-
-    // Frames are arranged by decreasing size, then decreasing bit depth.
-    // Pick the frame closest to |desiredSize|'s area without being smaller,
-    // which has the highest bit depth.
-    const size_t frameCount = source.frameCount();
-    size_t index = 0; // Default to first frame if none are large enough.
-    int frameAreaAtIndex = 0;
-    for (size_t i = 0; i < frameCount; ++i) {
-        const IntSize frameSize = source.frameSizeAtIndex(i);
-        if (WebSize(frameSize) == desiredSize) {
-            index = i;
-            break; // Perfect match.
-        }
-        const int frameArea = frameSize.width() * frameSize.height();
-        if (frameArea < (desiredSize.width * desiredSize.height))
-            break; // No more frames that are large enough.
-
-        if (!i || (frameArea < frameAreaAtIndex)) {
-            index = i; // Closer to desired area than previous best match.
-            frameAreaAtIndex = frameArea;
-        }
-    }
-
-    RetainPtr<CGImageRef> frame(AdoptCF, source.createFrameAtIndex(index));
-    if (!frame)
-        return WebImage();
-
-    return WebImage(frame.get());
-}
-
-void WebImage::reset()
-{
-    CGImageRelease(m_imageRef);
-    m_imageRef = 0;
-}
-
-void WebImage::assign(const WebImage& image)
-{
-    assign(image.m_imageRef);
-}
-
-bool WebImage::isNull() const
-{
-    return !m_imageRef;
-}
-
-WebSize WebImage::size() const
-{
-    return WebSize(CGImageGetWidth(m_imageRef), CGImageGetHeight(m_imageRef));
-}
-
-WebImage::WebImage(const PassRefPtr<Image>& image)
-    : m_imageRef(0)
-{
-    NativeImagePtr p;
-    if (image && (p = image->nativeImageForCurrentFrame()))
-        assign(p);
-}
-
-WebImage& WebImage::operator=(const PassRefPtr<Image>& image)
-{
-    NativeImagePtr p;
-    if (image && (p = image->nativeImageForCurrentFrame()))
-        assign(p);
-    else
-        reset();
-    return *this;
-}
-
-void WebImage::assign(CGImageRef imageRef)
-{
-    // Make sure to retain the imageRef first incase m_imageRef == imageRef.
-    CGImageRetain(imageRef);
-    CGImageRelease(m_imageRef);
-    m_imageRef = imageRef;
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebImageSkia.cpp b/Source/WebKit/chromium/src/WebImageSkia.cpp
index 36dabac3e..e1a926050 100644
--- a/Source/WebKit/chromium/src/WebImageSkia.cpp
+++ b/Source/WebKit/chromium/src/WebImageSkia.cpp
@@ -38,10 +38,12 @@
 #include "platform/WebData.h"
 #include "platform/WebSize.h"
 
+#include <algorithm>
 #include <public/WebImage.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/Vector.h>
 
 using namespace WebCore;
 
@@ -84,6 +86,36 @@ WebImage WebImage::fromData(const WebData& data, const WebSize& desiredSize)
     return WebImage(frame->bitmap());
 }
 
+WebVector<WebImage> WebImage::framesFromData(const WebData& data)
+{
+    // This is to protect from malicious images. It should be big enough that it's never hit in pracice.
+    const size_t maxFrameCount = 8;
+
+    ImageSource source;
+    source.setData(PassRefPtr<SharedBuffer>(data).get(), true);
+    if (!source.isSizeAvailable())
+        return WebVector<WebImage>();
+
+    // Frames are arranged by decreasing size, then decreasing bit depth.
+    // Keep the first frame at every size, has the highest bit depth.
+    const size_t frameCount = source.frameCount();
+    IntSize lastSize;
+
+    Vector<WebImage> frames;
+    for (size_t i = 0; i < std::min(frameCount, maxFrameCount); ++i) {
+        const IntSize frameSize = source.frameSizeAtIndex(i);
+        if (frameSize == lastSize)
+            continue;
+        lastSize = frameSize;
+
+        OwnPtr<NativeImageSkia> frame = adoptPtr(source.createFrameAtIndex(i));
+        if (frame)
+            frames.append(WebImage(frame->bitmap()));
+    }
+
+    return frames;
+}
+
 void WebImage::reset()
 {
     m_bitmap.reset();
diff --git a/Source/WebKit/chromium/src/WebInputEventConversion.cpp b/Source/WebKit/chromium/src/WebInputEventConversion.cpp
index 207d81ca3..0391c285b 100644
--- a/Source/WebKit/chromium/src/WebInputEventConversion.cpp
+++ b/Source/WebKit/chromium/src/WebInputEventConversion.cpp
@@ -32,6 +32,7 @@
 #include "WebInputEventConversion.h"
 
 #include "EventNames.h"
+#include "GestureEvent.h"
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
@@ -151,7 +152,7 @@ PlatformGestureEventBuilder::PlatformGestureEventBuilder(Widget* widget, const W
         break;
     case WebInputEvent::GestureTap:
         m_type = PlatformEvent::GestureTap;
-        m_area = IntSize(e.deltaX * 2, e.deltaY * 2);
+        m_area = IntSize(e.boundingBox.width, e.boundingBox.height);
         break;
     case WebInputEvent::GestureTapDown:
         m_type = PlatformEvent::GestureTapDown;
@@ -164,6 +165,7 @@ PlatformGestureEventBuilder::PlatformGestureEventBuilder(Widget* widget, const W
         break;
     case WebInputEvent::GestureLongPress:
         m_type = PlatformEvent::GestureLongPress;
+        m_area = IntSize(e.boundingBox.width, e.boundingBox.height);
         break;
     case WebInputEvent::GesturePinchBegin:
         m_type = PlatformEvent::GesturePinchBegin;
@@ -462,6 +464,7 @@ WebKeyboardEventBuilder::WebKeyboardEventBuilder(const KeyboardEvent& event)
         text[i] = event.keyEvent()->text()[i];
         unmodifiedText[i] = event.keyEvent()->unmodifiedText()[i];
     }
+    memcpy(keyIdentifier, event.keyIdentifier().ascii().data(), event.keyIdentifier().length());
 }
 
 #if ENABLE(TOUCH_EVENTS)
@@ -512,4 +515,31 @@ WebTouchEventBuilder::WebTouchEventBuilder(const Widget* widget, const TouchEven
 
 #endif // ENABLE(TOUCH_EVENTS)
 
+#if ENABLE(GESTURE_EVENTS)
+WebGestureEventBuilder::WebGestureEventBuilder(const Widget* widget, const GestureEvent& event)
+{
+    if (event.type() == eventNames().gesturetapEvent)
+        type = GestureTap;
+    else if (event.type() == eventNames().gesturetapdownEvent)
+        type = GestureTapDown;
+    else if (event.type() == eventNames().gesturescrollstartEvent)
+        type = GestureScrollBegin;
+    else if (event.type() == eventNames().gesturescrollendEvent)
+        type = GestureScrollEnd;
+    else if (event.type() == eventNames().gesturescrollupdateEvent)
+        type = GestureScrollUpdate;
+
+    timeStampSeconds = event.timeStamp() / millisPerSecond;
+    modifiers = getWebInputModifiers(event);
+
+    globalX = event.screenX();
+    globalY = event.screenY();
+    x = event.absoluteLocation().x() - widget->location().x();
+    y = event.absoluteLocation().y() - widget->location().y();
+
+    deltaX = event.deltaX();
+    deltaY = event.deltaY();
+}
+#endif // ENABLE(GESTURE_EVENTS)
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebInputEventConversion.h b/Source/WebKit/chromium/src/WebInputEventConversion.h
index d47bda814..48975a404 100644
--- a/Source/WebKit/chromium/src/WebInputEventConversion.h
+++ b/Source/WebKit/chromium/src/WebInputEventConversion.h
@@ -39,6 +39,7 @@
 #include "WebInputEvent.h"
 
 namespace WebCore {
+class GestureEvent;
 class KeyboardEvent;
 class MouseEvent;
 class ScrollView;
@@ -131,6 +132,15 @@ public:
 };
 #endif // ENABLE(TOUCH_EVENTS)
 
+#if ENABLE(GESTURE_EVENTS)
+// Converts WebCore::GestureEvent to a corresponding WebGestureEvent.
+// NOTE: If event mapping fails, the type will be set to Undefined.
+class WebGestureEventBuilder : public WebGestureEvent {
+public:
+    WebGestureEventBuilder(const WebCore::Widget*, const WebCore::GestureEvent&);
+};
+#endif // ENABLE(GESTURE_EVENTS)
+
 } // namespace WebKit
 
 #endif
diff --git a/Source/WebKit/chromium/src/WebKit.cpp b/Source/WebKit/chromium/src/WebKit.cpp
index a3f0f8391..9331d053a 100644
--- a/Source/WebKit/chromium/src/WebKit.cpp
+++ b/Source/WebKit/chromium/src/WebKit.cpp
@@ -105,7 +105,7 @@ void initialize(WebKitPlatformSupport* webKitPlatformSupport)
 
     v8::V8::SetEntropySource(&generateEntropy);
     v8::V8::Initialize();
-    WebCore::V8BindingPerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
+    WebCore::V8PerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
 
 #if ENABLE(MUTATION_OBSERVERS)
     // currentThread will always be non-null in production, but can be null in Chromium unit tests.
diff --git a/Source/WebKit/chromium/src/WebLayer.cpp b/Source/WebKit/chromium/src/WebLayer.cpp
index 5b8d55cf4..d77c25eb9 100644
--- a/Source/WebKit/chromium/src/WebLayer.cpp
+++ b/Source/WebKit/chromium/src/WebLayer.cpp
@@ -24,12 +24,10 @@
  */
 
 #include "config.h"
-#include "platform/WebLayer.h"
+#include <public/WebLayer.h>
 
-#include "Color.h"
 #include "LayerChromium.h"
 #include "SkMatrix44.h"
-#include "TransformationMatrix.h"
 #include "WebLayerImpl.h"
 #include <public/WebFilterOperations.h>
 #include <public/WebFloatPoint.h>
@@ -144,6 +142,14 @@ void WebLayer::replaceChild(const WebLayer& reference, const WebLayer& newLayer)
     m_private->replaceChild(ref.unwrap<LayerChromium>(), newLayer);
 }
 
+void WebLayer::setChildren(const WebVector<WebLayer>& webChildren)
+{
+    Vector<RefPtr<LayerChromium> > children(webChildren.size());
+    for (size_t i = 0; i < webChildren.size(); ++i)
+        children[i] = webChildren[i].unwrap<LayerChromium>();
+    m_private->setChildren(children);
+}
+
 void WebLayer::removeFromParent()
 {
     m_private->removeFromParent();
@@ -205,6 +211,12 @@ WebLayer WebLayer::maskLayer() const
     return WebLayer(m_private->maskLayer());
 }
 
+void WebLayer::setReplicaLayer(const WebLayer& replicaLayer)
+{
+    WebLayer ref = replicaLayer;
+    m_private->setReplicaLayer(ref.unwrap<LayerChromium>());
+}
+
 void WebLayer::setOpacity(float opacity)
 {
     m_private->setOpacity(opacity);
@@ -310,6 +322,53 @@ void WebLayer::setDebugBorderWidth(float width)
     m_private->setDebugBorderWidth(width);
 }
 
+void WebLayer::setDebugName(WebString name)
+{
+    m_private->setDebugName(name);
+}
+
+void WebLayer::setAnimationDelegate(WebAnimationDelegate* delegate)
+{
+    m_private->setLayerAnimationDelegate(delegate);
+}
+
+bool WebLayer::addAnimation(const WebAnimation& animation)
+{
+    return m_private->addAnimation(animation);
+}
+
+void WebLayer::removeAnimation(int animationId)
+{
+    m_private->removeAnimation(animationId);
+}
+
+void WebLayer::removeAnimation(int animationId, WebAnimation::TargetProperty targetProperty)
+{
+    m_private->layerAnimationController()->removeAnimation(animationId, static_cast<CCActiveAnimation::TargetProperty>(targetProperty));
+}
+
+void WebLayer::pauseAnimation(int animationId, double timeOffset)
+{
+    m_private->pauseAnimation(animationId, timeOffset);
+}
+
+void WebLayer::suspendAnimations(double monotonicTime)
+{
+    m_private->suspendAnimations(monotonicTime);
+}
+
+void WebLayer::resumeAnimations(double monotonicTime)
+{
+    m_private->resumeAnimations(monotonicTime);
+}
+
+void WebLayer::transferAnimationsTo(WebLayer* other)
+{
+    ASSERT(other);
+    if (other)
+        other->m_private->setLayerAnimationController(m_private->releaseLayerAnimationController());
+}
+
 void WebLayer::setAlwaysReserveTextures(bool reserve)
 {
     m_private->setAlwaysReserveTextures(reserve);
@@ -320,6 +379,11 @@ void WebLayer::setForceRenderSurface(bool forceRenderSurface)
     m_private->setForceRenderSurface(forceRenderSurface);
 }
 
+void WebLayer::clearRenderSurface()
+{
+    m_private->clearRenderSurface();
+}
+
 WebLayer::WebLayer(const PassRefPtr<LayerChromium>& node)
     : m_private(node)
 {
diff --git a/Source/WebKit/chromium/src/WebLayerTreeView.cpp b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
index b87df0f1b..edd43df20 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeView.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
@@ -24,19 +24,19 @@
  */
 
 #include "config.h"
-#include "platform/WebLayerTreeView.h"
+#include <public/WebLayerTreeView.h>
 
-#include "GraphicsContext3DPrivate.h"
 #include "LayerChromium.h"
 #include "WebLayerTreeViewImpl.h"
+#include "cc/CCFontAtlas.h"
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCRenderingStats.h"
-#include "platform/WebLayer.h"
-#include "platform/WebPoint.h"
-#include "platform/WebRect.h"
-#include "platform/WebSize.h"
+#include <public/WebLayer.h>
+#include <public/WebPoint.h>
+#include <public/WebRect.h>
 #include <public/WebRenderingStats.h>
+#include <public/WebSize.h>
 
 using namespace WebCore;
 
@@ -45,10 +45,10 @@ namespace WebKit {
 WebLayerTreeView::Settings::operator CCLayerTreeSettings() const
 {
     CCLayerTreeSettings settings;
-    settings.forceSoftwareCompositing = forceSoftwareCompositing;
     settings.showFPSCounter = showFPSCounter;
     settings.showPlatformLayerTree = showPlatformLayerTree;
     settings.showPaintRects = showPaintRects;
+    settings.renderVSyncEnabled = renderVSyncEnabled;
     settings.refreshRate = refreshRate;
     settings.defaultTileSize = defaultTileSize;
     settings.maxUntiledLayerSize = maxUntiledLayerSize;
@@ -93,14 +93,22 @@ int WebLayerTreeView::compositorIdentifier()
     return m_private->layerTreeHost()->compositorIdentifier();
 }
 
-void WebLayerTreeView::setViewportSize(const WebSize& viewportSize)
+void WebLayerTreeView::setViewportSize(const WebSize& layoutViewportSize, const WebSize& deviceViewportSize)
 {
-    m_private->layerTreeHost()->setViewportSize(viewportSize);
+    if (!deviceViewportSize.isEmpty())
+        m_private->layerTreeHost()->setViewportSize(layoutViewportSize, deviceViewportSize);
+    else
+        m_private->layerTreeHost()->setViewportSize(layoutViewportSize, layoutViewportSize);
+}
+
+WebSize WebLayerTreeView::layoutViewportSize() const
+{
+    return WebSize(m_private->layerTreeHost()->layoutViewportSize());
 }
 
-WebSize WebLayerTreeView::viewportSize() const
+WebSize WebLayerTreeView::deviceViewportSize() const
 {
-    return WebSize(m_private->layerTreeHost()->viewportSize());
+    return WebSize(m_private->layerTreeHost()->deviceViewportSize());
 }
 
 void WebLayerTreeView::setDeviceScaleFactor(const float deviceScaleFactor)
@@ -188,6 +196,15 @@ void WebLayerTreeView::renderingStats(WebRenderingStats& stats) const
     stats.totalRasterizeTimeInSeconds = ccStats.totalRasterizeTimeInSeconds;
 }
 
+void WebLayerTreeView::setFontAtlas(SkBitmap bitmap, WebRect asciiToWebRectTable[128], int fontHeight)
+{
+    IntRect asciiToRectTable[128];
+    for (int i = 0; i < 128; ++i)
+        asciiToRectTable[i] = asciiToWebRectTable[i];
+    OwnPtr<CCFontAtlas> fontAtlas = CCFontAtlas::create(bitmap, asciiToRectTable, fontHeight);
+    m_private->layerTreeHost()->setFontAtlas(fontAtlas.release());
+}
+
 void WebLayerTreeView::loseCompositorContext(int numTimes)
 {
     m_private->layerTreeHost()->loseContext(numTimes);
diff --git a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
index 825fc01ef..a7bf64d36 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
@@ -26,26 +26,71 @@
 #include "config.h"
 #include "WebLayerTreeViewImpl.h"
 
-#include "CCThreadImpl.h"
-#include "GraphicsContext3DPrivate.h"
 #include "LayerChromium.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCThreadProxy.h"
-#include "platform/WebGraphicsContext3D.h"
-#include "platform/WebLayer.h"
-#include "platform/WebLayerTreeView.h"
-#include "platform/WebLayerTreeViewClient.h"
-#include "platform/WebSize.h"
-#include "platform/WebThread.h"
+#include <public/WebGraphicsContext3D.h>
+#include <public/WebLayer.h>
+#include <public/WebLayerTreeView.h>
+#include <public/WebLayerTreeViewClient.h>
+#include <public/WebSize.h>
+#include <public/WebThread.h>
 
 using namespace WebCore;
 
+namespace {
+
+// Adapts a pure WebGraphicsContext3D into a WebCompositorOutputSurface until
+// downstream code can be updated to produce output surfaces directly.
+class WebGraphicsContextToOutputSurfaceAdapter : public WebKit::WebCompositorOutputSurface {
+public:
+    explicit WebGraphicsContextToOutputSurfaceAdapter(PassOwnPtr<WebKit::WebGraphicsContext3D> context)
+        : m_context3D(context)
+        , m_client(0)
+    {
+    }
+
+    virtual bool bindToClient(WebKit::WebCompositorOutputSurfaceClient* client) OVERRIDE
+    {
+        ASSERT(client);
+        if (!m_context3D->makeContextCurrent())
+            return false;
+        m_client = client;
+        return true;
+    }
+
+    virtual const Capabilities& capabilities() const OVERRIDE
+    {
+        return m_capabilities;
+    }
+
+    virtual WebKit::WebGraphicsContext3D* context3D() const OVERRIDE
+    {
+        return m_context3D.get();
+    }
+
+    virtual void sendFrameToParentCompositor(const WebKit::WebCompositorFrame&) OVERRIDE
+    {
+    }
+
+private:
+    OwnPtr<WebKit::WebGraphicsContext3D> m_context3D;
+    Capabilities m_capabilities;
+    WebKit::WebCompositorOutputSurfaceClient* m_client;
+};
+
+}
+
 namespace WebKit {
 
 // Converts messages from CCLayerTreeHostClient to WebLayerTreeViewClient.
 class WebLayerTreeViewClientAdapter : public WebCore::CCLayerTreeHostClient {
 public:
-    WebLayerTreeViewClientAdapter(WebLayerTreeViewClient* client) : m_client(client) { }
+    WebLayerTreeViewClientAdapter(WebLayerTreeViewClient* client)
+        : m_client(client)
+        , m_usingRealOutputSurface(false)
+    {
+    }
     virtual ~WebLayerTreeViewClientAdapter() { }
 
     // CCLayerTreeHostClient implementation
@@ -54,11 +99,33 @@ public:
     virtual void updateAnimations(double monotonicFrameBeginTime) OVERRIDE { m_client->updateAnimations(monotonicFrameBeginTime); }
     virtual void layout() OVERRIDE { m_client->layout(); }
     virtual void applyScrollAndScale(const WebCore::IntSize& scrollDelta, float pageScale) OVERRIDE { m_client->applyScrollAndScale(scrollDelta, pageScale); }
-    virtual PassOwnPtr<WebGraphicsContext3D> createContext3D() OVERRIDE
+    virtual PassOwnPtr<WebCompositorOutputSurface> createOutputSurface() OVERRIDE
+    {
+        WebCompositorOutputSurface* outputSurface = m_client->createOutputSurface();
+        if (outputSurface) {
+            m_usingRealOutputSurface = true;
+            return adoptPtr(outputSurface);
+        }
+
+        // Temporarily, if the output surface can't be created, create a WebGraphicsContext3D
+        // directly. This allows bootstrapping the output surface system while downstream
+        // users of the API still use the old approach.
+        WebGraphicsContext3D* context = m_client->createContext3D();
+        if (!context)
+            return nullptr;
+
+        m_usingRealOutputSurface = false;
+        return adoptPtr(new WebGraphicsContextToOutputSurfaceAdapter(adoptPtr(context)));
+    }
+
+    virtual void didRecreateOutputSurface(bool success) OVERRIDE
     {
-        return adoptPtr(m_client->createContext3D());
+        if (m_usingRealOutputSurface) {
+            m_client->didRecreateOutputSurface(success);
+            return;
+        }
+        m_client->didRebindGraphicsContext(success);
     }
-    virtual void didRecreateContext(bool success) OVERRIDE { m_client->didRebindGraphicsContext(success); }
     virtual void willCommit() OVERRIDE { m_client->willCommit(); }
     virtual void didCommit() OVERRIDE { m_client->didCommit(); }
     virtual void didCommitAndDrawFrame() OVERRIDE { m_client->didCommitAndDrawFrame(); }
@@ -67,6 +134,7 @@ public:
 
 private:
     WebLayerTreeViewClient* m_client;
+    bool m_usingRealOutputSurface;
 };
 
 PassOwnPtr<WebLayerTreeViewImpl> WebLayerTreeViewImpl::create(WebLayerTreeViewClient* client, const WebLayer& root, const WebLayerTreeView::Settings& settings)
diff --git a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
index 1184342e8..3bc43410d 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
+++ b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
@@ -26,7 +26,7 @@
 #ifndef WebLayerTreeViewImpl_h
 #define WebLayerTreeViewImpl_h
 
-#include "platform/WebLayerTreeView.h"
+#include <public/WebLayerTreeView.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index 3ca9f5d0f..c48aa8967 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -23,18 +23,16 @@
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
 #include "WebHelperPluginImpl.h"
-#include "WebKit.h"
 #include "WebMediaPlayer.h"
 #include "WebViewImpl.h"
-#include "cc/CCProxy.h"
-#include "platform/WebCString.h"
-#include "platform/WebCanvas.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebRect.h"
-#include "platform/WebSize.h"
-#include "platform/WebString.h"
-#include "platform/WebURL.h"
+#include <public/Platform.h>
+#include <public/WebCString.h>
+#include <public/WebCanvas.h>
 #include <public/WebMimeRegistry.h>
+#include <public/WebRect.h>
+#include <public/WebSize.h>
+#include <public/WebString.h>
+#include <public/WebURL.h>
 
 #if USE(ACCELERATED_COMPOSITING)
 #include "RenderLayerCompositor.h"
@@ -342,10 +340,10 @@ void WebMediaPlayerClientImpl::cancelLoad()
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-LayerChromium* WebMediaPlayerClientImpl::platformLayer() const
+WebLayer* WebMediaPlayerClientImpl::platformLayer() const
 {
     ASSERT(m_supportsAcceleratedCompositing);
-    return m_videoLayer.unwrap<LayerChromium>();
+    return const_cast<WebVideoLayer*>(&m_videoLayer);
 }
 #endif
 
@@ -841,14 +839,12 @@ void WebMediaPlayerClientImpl::startDelayedLoad()
 void WebMediaPlayerClientImpl::didReceiveFrame()
 {
     // No lock since this gets called on the client's thread.
-    ASSERT(CCProxy::isImplThread());
     m_videoFrameProviderClient->didReceiveFrame();
 }
 
 void WebMediaPlayerClientImpl::didUpdateMatrix(const float* matrix)
 {
     // No lock since this gets called on the client's thread.
-    ASSERT(CCProxy::isImplThread());
     m_videoFrameProviderClient->didUpdateMatrix(matrix);
 }
 
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
index b3c94fe58..2df54cd20 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -98,7 +98,7 @@ public:
     virtual void load(const WTF::String& url);
     virtual void cancelLoad();
 #if USE(ACCELERATED_COMPOSITING)
-    virtual WebCore::PlatformLayer* platformLayer() const;
+    virtual WebKit::WebLayer* platformLayer() const;
 #endif
     virtual WebCore::PlatformMedia platformMedia() const;
     virtual void play();
diff --git a/Source/WebKit/chromium/src/WebNode.cpp b/Source/WebKit/chromium/src/WebNode.cpp
index 14da1d570..c5e836d4a 100644
--- a/Source/WebKit/chromium/src/WebNode.cpp
+++ b/Source/WebKit/chromium/src/WebNode.cpp
@@ -136,6 +136,13 @@ WebNodeList WebNode::childNodes()
     return WebNodeList(m_private->childNodes());
 }
 
+bool WebNode::appendChild(const WebNode& child) 
+{
+    ExceptionCode exceptionCode = 0;
+    m_private->appendChild(child, exceptionCode);
+    return !exceptionCode;
+}
+
 WebString WebNode::createMarkup() const
 {
     return WebCore::createMarkup(m_private.get());
diff --git a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
index fd5d2f2ad..18f5de20a 100644
--- a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
@@ -78,11 +78,7 @@ private:
 
     virtual void setWindowRect(const FloatRect& rect) OVERRIDE
     {
-        IntRect intRect(rect);
-        const WebRect currentRect = m_popup->m_windowRectInScreen;
-        if (intRect.x() == currentRect.x && intRect.y() == currentRect.y && m_popup->m_isPutAboveOrigin)
-            intRect.setY(currentRect.y + currentRect.height - intRect.height());
-        m_popup->m_windowRectInScreen = intRect;
+        m_popup->m_windowRectInScreen = IntRect(rect);
         m_popup->widgetClient()->setWindowRect(m_popup->m_windowRectInScreen);
     }
 
@@ -123,6 +119,11 @@ private:
         return m_popup->m_webView;
     }
 
+    virtual FloatSize minimumWindowSize() const OVERRIDE
+    {
+        return FloatSize(0, 0);
+    }
+
     WebPagePopupImpl* m_popup;
 };
 
@@ -141,7 +142,6 @@ bool PagePopupFeaturesClient::isEnabled(Document*, ContextFeatures::FeatureType
 
 WebPagePopupImpl::WebPagePopupImpl(WebWidgetClient* client)
     : m_widgetClient(client)
-    , m_isPutAboveOrigin(false)
 {
     ASSERT(client);
 }
@@ -157,24 +157,13 @@ bool WebPagePopupImpl::init(WebViewImpl* webView, PagePopupClient* popupClient,
     ASSERT(popupClient);
     m_webView = webView;
     m_popupClient = popupClient;
+    m_originBoundsInRootView = originBoundsInRootView;
 
-    WebSize rootViewSize = webView->size();
-    IntSize popupSize = popupClient->contentSize();
-    IntRect popupBoundsInRootView(IntPoint(max(0, originBoundsInRootView.x()), max(0, originBoundsInRootView.maxY())), popupSize);
-    if (popupBoundsInRootView.maxY() > rootViewSize.height) {
-        popupBoundsInRootView.setY(max(0, originBoundsInRootView.y() - popupSize.height()));
-        m_isPutAboveOrigin = true;
-    }
-    if (popupBoundsInRootView.maxX() > rootViewSize.width)
-        popupBoundsInRootView.setX(max(0, rootViewSize.width - popupSize.width()));
-    IntRect boundsInScreen = webView->page()->chrome()->rootViewToScreen(popupBoundsInRootView);
+    reposition(m_popupClient->contentSize());
 
-    m_widgetClient->setWindowRect(boundsInScreen);
-    m_windowRectInScreen = boundsInScreen;
     if (!initPage())
         return false;
     m_widgetClient->show(WebNavigationPolicy());
-
     setFocus(true);
 
     return true;
@@ -242,8 +231,23 @@ void WebPagePopupImpl::paint(WebCanvas* canvas, const WebRect& rect)
     PageWidgetDelegate::paint(m_page.get(), 0, canvas, rect, PageWidgetDelegate::Opaque);
 }
 
+void WebPagePopupImpl::reposition(const WebSize& popupSize)
+{
+    WebSize rootViewSize = m_webView->size();
+    IntRect popupBoundsInRootView(IntPoint(max(0, m_originBoundsInRootView.x()), max(0, m_originBoundsInRootView.maxY())), popupSize);
+    if (popupBoundsInRootView.maxY() > rootViewSize.height)
+        popupBoundsInRootView.setY(max(0, m_originBoundsInRootView.y() - popupSize.height));
+    if (popupBoundsInRootView.maxX() > rootViewSize.width)
+        popupBoundsInRootView.setX(max(0, rootViewSize.width - popupSize.width));
+    IntRect boundsInScreen = m_webView->page()->chrome()->rootViewToScreen(popupBoundsInRootView);
+    m_widgetClient->setWindowRect(boundsInScreen);
+    m_windowRectInScreen = boundsInScreen;
+}
+
 void WebPagePopupImpl::resize(const WebSize& newSize)
 {
+    reposition(newSize);
+
     if (m_page)
         m_page->mainFrame()->view()->resize(newSize);
     m_widgetClient->didInvalidateRect(WebRect(0, 0, newSize.width, newSize.height));
diff --git a/Source/WebKit/chromium/src/WebPagePopupImpl.h b/Source/WebKit/chromium/src/WebPagePopupImpl.h
index 2552bacf1..76936a4cd 100644
--- a/Source/WebKit/chromium/src/WebPagePopupImpl.h
+++ b/Source/WebKit/chromium/src/WebPagePopupImpl.h
@@ -87,14 +87,15 @@ private:
 
     explicit WebPagePopupImpl(WebWidgetClient*);
     bool initPage();
+    void reposition(const WebSize&);
 
     WebWidgetClient* m_widgetClient;
     WebRect m_windowRectInScreen;
+    WebCore::IntRect m_originBoundsInRootView;
     WebViewImpl* m_webView;
     OwnPtr<WebCore::Page> m_page;
     OwnPtr<PagePopupChromeClient> m_chromeClient;
     WebCore::PagePopupClient* m_popupClient;
-    bool m_isPutAboveOrigin;
 
     friend class WebPagePopup;
     friend class PagePopupChromeClient;
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 29489e25a..71361780b 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -39,14 +39,7 @@
 #include "WebElement.h"
 #include "WebInputEvent.h"
 #include "WebInputEventConversion.h"
-#include "WebKit.h"
 #include "WebPlugin.h"
-#include "platform/WebRect.h"
-#include "platform/WebString.h"
-#include "platform/WebURL.h"
-#include "platform/WebURLError.h"
-#include "platform/WebURLRequest.h"
-#include "platform/WebVector.h"
 #include "WebViewImpl.h"
 #include "WrappedResourceResponse.h"
 
@@ -56,6 +49,7 @@
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "FrameView.h"
+#include "GestureEvent.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
 #include "HostWindow.h"
@@ -77,6 +71,12 @@
 #include "WheelEvent.h"
 #include <public/Platform.h>
 #include <public/WebClipboard.h>
+#include <public/WebRect.h>
+#include <public/WebString.h>
+#include <public/WebURL.h>
+#include <public/WebURLError.h>
+#include <public/WebURLRequest.h>
+#include <public/WebVector.h>
 
 #if ENABLE(GESTURE_EVENTS)
 #include "PlatformGestureEvent.h"
@@ -188,6 +188,8 @@ void WebPluginContainerImpl::handleEvent(Event* event)
         handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
     else if (eventNames().isTouchEventType(event->type()))
         handleTouchEvent(static_cast<TouchEvent*>(event));
+    else if (eventNames().isGestureEventType(event->type()))
+        handleGestureEvent(static_cast<GestureEvent*>(event));
 
     // FIXME: it would be cleaner if Widget::handleEvent returned true/false and
     // HTMLPluginElement called setDefaultHandled or defaultEventHandler.
@@ -557,6 +559,11 @@ bool WebPluginContainerImpl::getFormValue(String& value)
     return false;
 }
 
+bool WebPluginContainerImpl::supportsKeyboardFocus() const
+{
+    return m_webPlugin->supportsKeyboardFocus();
+}
+
 void WebPluginContainerImpl::willDestroyPluginLoadObserver(WebPluginLoadObserver* observer)
 {
     size_t pos = m_pluginLoadObservers.find(observer);
@@ -566,12 +573,12 @@ void WebPluginContainerImpl::willDestroyPluginLoadObserver(WebPluginLoadObserver
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-WebCore::LayerChromium* WebPluginContainerImpl::platformLayer() const
+WebLayer* WebPluginContainerImpl::platformLayer() const
 {
     if (m_textureId)
-        return m_textureLayer.unwrap<LayerChromium>();
+        return const_cast<WebExternalTextureLayer*>(&m_textureLayer);
     if (m_ioSurfaceId)
-        return m_ioSurfaceLayer.unwrap<LayerChromium>();
+        return const_cast<WebIOSurfaceLayer*>(&m_ioSurfaceLayer);
     return 0;
 }
 #endif
@@ -736,6 +743,17 @@ void WebPluginContainerImpl::handleTouchEvent(TouchEvent* event)
     // FIXME: Can a plugin change the cursor from a touch-event callback?
 }
 
+void WebPluginContainerImpl::handleGestureEvent(GestureEvent* event)
+{
+    WebGestureEventBuilder webEvent(this, *event);
+    if (webEvent.type == WebInputEvent::Undefined)
+        return;
+    WebCursorInfo cursorInfo;
+    if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
+        event->setDefaultHandled();
+    // FIXME: Can a plugin change the cursor from a touch-event callback?
+}
+
 void WebPluginContainerImpl::calculateGeometry(const IntRect& frameRect,
                                                IntRect& windowRect,
                                                IntRect& clipRect,
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.h b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
index 4c2aaeb4a..074a0ccdc 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -45,10 +45,10 @@
 struct NPObject;
 
 namespace WebCore {
+class GestureEvent;
 class HTMLPlugInElement;
 class IntRect;
 class KeyboardEvent;
-class LayerChromium;
 class MouseEvent;
 class ResourceError;
 class ResourceResponse;
@@ -77,6 +77,7 @@ public:
 
     // PluginViewBase methods
     virtual bool getFormValue(String&);
+    virtual bool supportsKeyboardFocus() const;
 
     // Widget methods
     virtual void setFrameRect(const WebCore::IntRect&);
@@ -149,7 +150,7 @@ public:
     void willDestroyPluginLoadObserver(WebPluginLoadObserver*);
 
 #if USE(ACCELERATED_COMPOSITING)
-    virtual WebCore::LayerChromium* platformLayer() const;
+    virtual WebLayer* platformLayer() const;
 #endif
 
     ScrollbarGroup* scrollbarGroup();
@@ -167,6 +168,7 @@ private:
     void handleWheelEvent(WebCore::WheelEvent*);
     void handleKeyboardEvent(WebCore::KeyboardEvent*);
     void handleTouchEvent(WebCore::TouchEvent*);
+    void handleGestureEvent(WebCore::GestureEvent*);
 
     void calculateGeometry(const WebCore::IntRect& frameRect,
                            WebCore::IntRect& windowRect,
diff --git a/Source/WebKit/chromium/src/WebPluginScrollbarImpl.cpp b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.cpp
index b0f63a7e4..f34dbfdc7 100644
--- a/Source/WebKit/chromium/src/WebPluginScrollbarImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.cpp
@@ -69,8 +69,8 @@ WebPluginScrollbarImpl::WebPluginScrollbarImpl(Orientation orientation,
 {
     m_scrollbar = Scrollbar::createNativeScrollbar(
         static_cast<ScrollableArea*>(m_group),
-        static_cast<ScrollbarOrientation>(orientation),
-        RegularScrollbar);
+        static_cast<WebCore::ScrollbarOrientation>(orientation),
+        WebCore::RegularScrollbar);
     m_group->scrollbarCreated(this);
 }
 
@@ -123,6 +123,78 @@ int WebPluginScrollbarImpl::value() const
     return m_scrollOffset;
 }
 
+WebPoint WebPluginScrollbarImpl::location() const
+{
+    return m_scrollbar->frameRect().location();
+}
+
+WebSize WebPluginScrollbarImpl::size() const
+{
+    return m_scrollbar->frameRect().size();
+}
+
+bool WebPluginScrollbarImpl::enabled() const
+{
+    return m_scrollbar->enabled();
+}
+
+int WebPluginScrollbarImpl::maximum() const
+{
+    return m_scrollbar->maximum();
+}
+
+int WebPluginScrollbarImpl::totalSize() const
+{
+    return m_scrollbar->totalSize();
+}
+
+bool WebPluginScrollbarImpl::isScrollViewScrollbar() const
+{
+    return m_scrollbar->isScrollViewScrollbar();
+}
+
+bool WebPluginScrollbarImpl::isScrollableAreaActive() const
+{
+    return m_scrollbar->isScrollableAreaActive();
+}
+
+void WebPluginScrollbarImpl::getTickmarks(WebVector<WebRect>& tickmarks) const
+{
+    m_client->getTickmarks(const_cast<WebPluginScrollbarImpl*>(this), &tickmarks);
+}
+
+WebScrollbar::ScrollbarControlSize WebPluginScrollbarImpl::controlSize() const
+{
+    return static_cast<WebScrollbar::ScrollbarControlSize>(m_scrollbar->controlSize());
+}
+
+WebScrollbar::ScrollbarPart WebPluginScrollbarImpl::pressedPart() const
+{
+    return static_cast<WebScrollbar::ScrollbarPart>(m_scrollbar->pressedPart());
+}
+
+WebScrollbar::ScrollbarPart WebPluginScrollbarImpl::hoveredPart() const
+{
+    return static_cast<WebScrollbar::ScrollbarPart>(m_scrollbar->hoveredPart());
+}
+
+WebScrollbar::ScrollbarOverlayStyle WebPluginScrollbarImpl::scrollbarOverlayStyle() const
+{
+    return static_cast<WebScrollbar::ScrollbarOverlayStyle>(m_scrollbar->scrollbarOverlayStyle());
+}
+
+WebScrollbar::Orientation WebPluginScrollbarImpl::orientation() const
+{
+    if (m_scrollbar->orientation() == WebCore::HorizontalScrollbar)
+        return WebScrollbar::Horizontal;
+    return WebScrollbar::Vertical;
+}
+
+bool WebPluginScrollbarImpl::isCustomScrollbar() const
+{
+    return m_scrollbar->isCustomScrollbar();
+}
+
 void WebPluginScrollbarImpl::setLocation(const WebRect& rect)
 {
     IntRect oldRect = m_scrollbar->frameRect();
@@ -211,7 +283,7 @@ bool WebPluginScrollbarImpl::onMouseDown(const WebInputEvent& event)
 bool WebPluginScrollbarImpl::onMouseUp(const WebInputEvent& event)
 {
     WebMouseEvent mouseup = *static_cast<const WebMouseEvent*>(&event);
-    if (m_scrollbar->pressedPart() == NoPart)
+    if (m_scrollbar->pressedPart() == WebCore::NoPart)
         return false;
 
     return m_scrollbar->mouseUp(PlatformMouseEventBuilder(m_scrollbar.get(), mouseup));
@@ -221,20 +293,20 @@ bool WebPluginScrollbarImpl::onMouseMove(const WebInputEvent& event)
 {
     WebMouseEvent mousemove = *static_cast<const WebMouseEvent*>(&event);
     if (m_scrollbar->frameRect().contains(mousemove.x, mousemove.y)
-        || m_scrollbar->pressedPart() != NoPart) {
+        || m_scrollbar->pressedPart() != WebCore::NoPart) {
         mousemove.x -= m_scrollbar->x();
         mousemove.y -= m_scrollbar->y();
         return m_scrollbar->mouseMoved(PlatformMouseEventBuilder(m_scrollbar.get(), mousemove));
     }
 
-    if (m_scrollbar->hoveredPart() != NoPart && !m_scrollbar->isOverlayScrollbar())
+    if (m_scrollbar->hoveredPart() != WebCore::NoPart && !m_scrollbar->isOverlayScrollbar())
         m_scrollbar->mouseExited();
     return false;
 }
 
 bool WebPluginScrollbarImpl::onMouseLeave(const WebInputEvent& event)
 {
-    if (m_scrollbar->hoveredPart() != NoPart)
+    if (m_scrollbar->hoveredPart() != WebCore::NoPart)
         m_scrollbar->mouseExited();
 
     return false;
diff --git a/Source/WebKit/chromium/src/WebPluginScrollbarImpl.h b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.h
index b42cb82fd..43e3fd7b2 100644
--- a/Source/WebKit/chromium/src/WebPluginScrollbarImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.h
@@ -49,6 +49,7 @@ public:
 
     void setScrollOffset(int);
     void invalidateScrollbarRect(const WebCore::IntRect&);
+    // FIXME: Combine this with the other getTickmarks method
     void getTickmarks(Vector<WebCore::IntRect>&) const;
     WebCore::IntPoint convertFromContainingViewToScrollbar(const WebCore::IntPoint& parentPoint) const;
     void scrollbarStyleChanged();
@@ -57,16 +58,30 @@ public:
     WebCore::Scrollbar* scrollbar() { return m_scrollbar.get(); }
 
     // WebKit::WebScrollbar methods
-    virtual bool isOverlay() const;
-    virtual int value() const;
+    virtual bool isOverlay() const OVERRIDE;
+    virtual int value() const OVERRIDE;
+    virtual WebPoint location() const OVERRIDE;
+    virtual WebSize size() const OVERRIDE;
+    virtual bool enabled() const OVERRIDE;
+    virtual int maximum() const OVERRIDE;
+    virtual int totalSize() const OVERRIDE;
+    virtual bool isScrollViewScrollbar() const OVERRIDE;
+    virtual bool isScrollableAreaActive() const OVERRIDE;
+    virtual void getTickmarks(WebVector<WebRect>& tickmarks) const OVERRIDE;
+    virtual WebScrollbar::ScrollbarControlSize controlSize() const OVERRIDE;
+    virtual WebScrollbar::ScrollbarPart pressedPart() const OVERRIDE;
+    virtual WebScrollbar::ScrollbarPart hoveredPart() const OVERRIDE;
+    virtual WebScrollbar::ScrollbarOverlayStyle scrollbarOverlayStyle() const OVERRIDE;
+    virtual WebScrollbar::Orientation orientation() const OVERRIDE;
+    virtual bool isCustomScrollbar() const OVERRIDE;
 
     // WebKit::WebPluginScrollbar methods
-    virtual void setLocation(const WebRect&);
-    virtual void setValue(int position);
-    virtual void setDocumentSize(int);
-    virtual void scroll(ScrollDirection, ScrollGranularity, float multiplier);
-    virtual void paint(WebCanvas*, const WebRect&);
-    virtual bool handleInputEvent(const WebInputEvent&);
+    virtual void setLocation(const WebRect&) OVERRIDE;
+    virtual void setValue(int position) OVERRIDE;
+    virtual void setDocumentSize(int) OVERRIDE;
+    virtual void scroll(ScrollDirection, ScrollGranularity, float multiplier) OVERRIDE;
+    virtual void paint(WebCanvas*, const WebRect&) OVERRIDE;
+    virtual bool handleInputEvent(const WebInputEvent&) OVERRIDE;
 
 private:
     bool onMouseDown(const WebInputEvent&);
diff --git a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
index ec08f0a0e..8bc880c75 100644
--- a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -639,5 +639,14 @@ bool WebRuntimeFeatures::isDialogElementEnabled()
 #endif
 }
 
+void WebRuntimeFeatures::enableCSSExclusions(bool enable)
+{
+    RuntimeEnabledFeatures::setCSSExclusionsEnabled(enable);
+}
+
+bool WebRuntimeFeatures::isCSSExclusionsEnabled()
+{
+    return RuntimeEnabledFeatures::cssExclusionsEnabled();
+}
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScriptController.cpp b/Source/WebKit/chromium/src/WebScriptController.cpp
index 5d36bbe0d..804e27821 100644
--- a/Source/WebKit/chromium/src/WebScriptController.cpp
+++ b/Source/WebKit/chromium/src/WebScriptController.cpp
@@ -43,7 +43,7 @@ namespace WebKit {
 
 void WebScriptController::registerExtension(v8::Extension* extension)
 {
-    V8Proxy::registerExtension(extension);
+    V8Proxy::registerExtensionIfNeeded(extension);
 }
 
 void WebScriptController::enableV8SingleThreadMode()
diff --git a/Source/WebKit/chromium/src/WebScrollableLayer.cpp b/Source/WebKit/chromium/src/WebScrollableLayer.cpp
index 19e410aa5..a20e81d81 100644
--- a/Source/WebKit/chromium/src/WebScrollableLayer.cpp
+++ b/Source/WebKit/chromium/src/WebScrollableLayer.cpp
@@ -27,7 +27,7 @@
 #include <public/WebScrollableLayer.h>
 
 #include "LayerChromium.h"
-
+#include "Region.h"
 
 namespace WebKit {
 
@@ -51,4 +51,25 @@ void WebScrollableLayer::setShouldScrollOnMainThread(bool shouldScrollOnMainThre
     m_private->setShouldScrollOnMainThread(shouldScrollOnMainThread);
 }
 
+void WebScrollableLayer::setNonFastScrollableRegion(const WebVector<WebRect>& rects)
+{
+    WebCore::Region region;
+    for (size_t i = 0; i < rects.size(); ++i) {
+        WebCore::IntRect rect = rects[i];
+        region.unite(rect);
+    }
+    m_private->setNonFastScrollableRegion(region);
+
+}
+
+void WebScrollableLayer::setIsContainerForFixedPositionLayers(bool enable)
+{
+    m_private->setIsContainerForFixedPositionLayers(enable);
+}
+
+void WebScrollableLayer::setFixedToContainerLayer(bool enable)
+{
+    m_private->setFixedToContainerLayer(enable);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScrollbarImpl.cpp b/Source/WebKit/chromium/src/WebScrollbarImpl.cpp
new file mode 100644
index 000000000..73b92697e
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebScrollbarImpl.cpp
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WebScrollbarImpl.h"
+
+#include "IntRect.h"
+#include "Scrollbar.h"
+
+namespace WebKit {
+
+PassOwnPtr<WebScrollbar> WebScrollbar::create(WebCore::Scrollbar* scrollbar)
+{
+    return adoptPtr(new WebScrollbarImpl(scrollbar));
+}
+
+WebScrollbarImpl::WebScrollbarImpl(WebCore::Scrollbar* scrollbar)
+    : m_scrollbar(scrollbar)
+{
+}
+
+bool WebScrollbarImpl::isOverlay() const
+{
+    return m_scrollbar->isOverlayScrollbar();
+}
+
+int WebScrollbarImpl::value() const
+{
+    return m_scrollbar->value();
+}
+
+WebPoint WebScrollbarImpl::location() const
+{
+    return m_scrollbar->location();
+}
+
+WebSize WebScrollbarImpl::size() const
+{
+    return m_scrollbar->size();
+}
+
+bool WebScrollbarImpl::enabled() const
+{
+    return m_scrollbar->enabled();
+}
+
+int WebScrollbarImpl::maximum() const
+{
+    return m_scrollbar->maximum();
+}
+
+int WebScrollbarImpl::totalSize() const
+{
+    return m_scrollbar->totalSize();
+}
+
+bool WebScrollbarImpl::isScrollViewScrollbar() const
+{
+    return m_scrollbar->isScrollViewScrollbar();
+}
+
+bool WebScrollbarImpl::isScrollableAreaActive() const
+{
+    return m_scrollbar->isScrollableAreaActive();
+}
+
+void WebScrollbarImpl::getTickmarks(WebVector<WebRect>& webTickmarks) const
+{
+    Vector<WebCore::IntRect> tickmarks;
+    m_scrollbar->getTickmarks(tickmarks);
+
+    WebVector<WebRect> result(tickmarks.size());
+    for (size_t i = 0; i < tickmarks.size(); ++i)
+        result[i] = tickmarks[i];
+
+    webTickmarks.swap(result);
+}
+
+WebScrollbar::ScrollbarControlSize WebScrollbarImpl::controlSize() const
+{
+    return static_cast<WebScrollbar::ScrollbarControlSize>(m_scrollbar->controlSize());
+}
+
+WebScrollbar::ScrollbarPart WebScrollbarImpl::pressedPart() const
+{
+    return static_cast<WebScrollbar::ScrollbarPart>(m_scrollbar->pressedPart());
+}
+
+WebScrollbar::ScrollbarPart WebScrollbarImpl::hoveredPart() const
+{
+    return static_cast<WebScrollbar::ScrollbarPart>(m_scrollbar->hoveredPart());
+}
+
+WebScrollbar::ScrollbarOverlayStyle WebScrollbarImpl::scrollbarOverlayStyle() const
+{
+    return static_cast<WebScrollbar::ScrollbarOverlayStyle>(m_scrollbar->scrollbarOverlayStyle());
+}
+
+WebScrollbar::Orientation WebScrollbarImpl::orientation() const
+{
+    return static_cast<WebScrollbar::Orientation>(m_scrollbar->orientation());
+}
+
+bool WebScrollbarImpl::isCustomScrollbar() const
+{
+    return m_scrollbar->isCustomScrollbar();
+}
+
+} // namespace WebKit
diff --git a/Source/WebCore/page/PointerLock.cpp b/Source/WebKit/chromium/src/WebScrollbarImpl.h
index 9cff8ed0c..5c9231aaa 100644
--- a/Source/WebCore/page/PointerLock.cpp
+++ b/Source/WebKit/chromium/src/WebScrollbarImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -22,59 +22,43 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "PointerLock.h"
+#ifndef WebScrollbarImpl_h
+#define WebScrollbarImpl_h
 
-#include "Frame.h"
-#include "Page.h"
-#include "PointerLockController.h"
-
-#if ENABLE(POINTER_LOCK)
+#include <public/WebScrollbar.h>
 
 namespace WebCore {
-
-PointerLock::PointerLock(Frame* frame)
-    : DOMWindowProperty(frame)
-    , m_controller(0)
-{
-    ASSERT(m_frame);
-    m_controller = frame->page()->pointerLockController();
+class Scrollbar;
 }
 
-PointerLock::~PointerLock()
-{
-    ASSERT(!m_controller);
-}
+namespace WebKit {
 
-void PointerLock::disconnectFrameForPageCache()
-{
-    DOMWindowProperty::disconnectFrameForPageCache();
-    m_controller = 0;
-}
+class WebScrollbarImpl : public WebScrollbar {
+public:
+    WebScrollbarImpl(WebCore::Scrollbar*);
 
-void PointerLock::willDestroyGlobalObjectInFrame()
-{
-    DOMWindowProperty::willDestroyGlobalObjectInFrame();
-    m_controller = 0;
-}
+    // Implement WebKit::WebScrollbar methods
+    virtual bool isOverlay() const OVERRIDE;
+    virtual int value() const OVERRIDE;
+    virtual WebPoint location() const OVERRIDE;
+    virtual WebSize size() const OVERRIDE;
+    virtual bool enabled() const OVERRIDE;
+    virtual int maximum() const OVERRIDE;
+    virtual int totalSize() const OVERRIDE;
+    virtual bool isScrollViewScrollbar() const OVERRIDE;
+    virtual bool isScrollableAreaActive() const OVERRIDE;
+    virtual void getTickmarks(WebVector<WebRect>& tickmarks) const OVERRIDE;
+    virtual ScrollbarControlSize controlSize() const OVERRIDE;
+    virtual ScrollbarPart pressedPart() const OVERRIDE;
+    virtual ScrollbarPart hoveredPart() const OVERRIDE;
+    virtual ScrollbarOverlayStyle scrollbarOverlayStyle() const OVERRIDE;
+    virtual Orientation orientation() const OVERRIDE;
+    virtual bool isCustomScrollbar() const OVERRIDE;
 
-void PointerLock::lock(Element* target, PassRefPtr<VoidCallback> successCallback, PassRefPtr<VoidCallback> failureCallback)
-{
-    if (m_controller)
-        m_controller->requestPointerLock(target, successCallback, failureCallback);
-}
+private:
+    RefPtr<WebCore::Scrollbar> m_scrollbar;
+};
 
-void PointerLock::unlock()
-{
-    if (m_controller)
-        m_controller->requestPointerUnlock();
-}
-
-bool PointerLock::isLocked()
-{
-    return m_controller && m_controller->isLocked();
-}
-
-}
+} // namespace WebKit
 
-#endif // ENABLE(POINTER_LOCK)
+#endif
diff --git a/Source/WebKit/chromium/src/WebScrollbarLayer.cpp b/Source/WebKit/chromium/src/WebScrollbarLayer.cpp
new file mode 100644
index 000000000..2bd1b20fb
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebScrollbarLayer.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include <public/WebScrollbarLayer.h>
+
+#include "ScrollbarLayerChromium.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebScrollbarLayer::setScrollLayer(const WebLayer layer)
+{
+    int id = layer.isNull() ? 0 : layer.constUnwrap<LayerChromium>()->id();
+    unwrap<ScrollbarLayerChromium>()->setScrollLayerId(id);
+}
+
+WebScrollbarLayer WebScrollbarLayer::create(WebCore::Scrollbar* scrollbar, WebScrollbarThemePainter painter, PassOwnPtr<WebScrollbarThemeGeometry> geometry)
+{
+    return WebScrollbarLayer(ScrollbarLayerChromium::create(WebScrollbar::create(scrollbar), painter, geometry, 0));
+}
+
+WebScrollbarLayer::WebScrollbarLayer(const WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>& layer)
+    : WebLayer(layer)
+{
+}
+
+WebScrollbarLayer& WebScrollbarLayer::operator=(const WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>& layer)
+{
+    m_private = layer;
+    return *this;
+}
+
+WebScrollbarLayer::operator PassRefPtr<ScrollbarLayerChromium>() const
+{
+    return unwrap<ScrollbarLayerChromium>();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.cpp b/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.cpp
new file mode 100644
index 000000000..68c9458d0
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.cpp
@@ -0,0 +1,221 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WebScrollbarThemeClientImpl.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebScrollbarThemeClientImpl::WebScrollbarThemeClientImpl(WebScrollbar* scrollbar)
+    : m_scrollbar(scrollbar)
+{
+}
+
+int WebScrollbarThemeClientImpl::x() const
+{
+    return location().x();
+}
+
+int WebScrollbarThemeClientImpl::y() const
+{
+    return location().y();
+}
+
+int WebScrollbarThemeClientImpl::width() const
+{
+    return size().width();
+}
+
+int WebScrollbarThemeClientImpl::height() const
+{
+    return size().height();
+}
+
+IntSize WebScrollbarThemeClientImpl::size() const
+{
+    return m_scrollbar->size();
+}
+
+IntPoint WebScrollbarThemeClientImpl::location() const
+{
+    return m_scrollbar->location();
+}
+
+ScrollView* WebScrollbarThemeClientImpl::parent() const
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+ScrollView* WebScrollbarThemeClientImpl::root() const
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+void WebScrollbarThemeClientImpl::setFrameRect(const IntRect&)
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+}
+
+IntRect WebScrollbarThemeClientImpl::frameRect() const
+{
+    return IntRect(location(), size());
+}
+
+void WebScrollbarThemeClientImpl::invalidate()
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+}
+
+void WebScrollbarThemeClientImpl::invalidateRect(const IntRect&)
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+}
+
+WebCore::ScrollbarOverlayStyle WebScrollbarThemeClientImpl::scrollbarOverlayStyle() const
+{
+    return static_cast<WebCore::ScrollbarOverlayStyle>(m_scrollbar->scrollbarOverlayStyle());
+}
+
+void WebScrollbarThemeClientImpl::getTickmarks(Vector<IntRect>& tickmarks) const
+{
+    WebVector<WebRect> webTickmarks;
+    m_scrollbar->getTickmarks(webTickmarks);
+    tickmarks.resize(webTickmarks.size());
+    for (size_t i = 0; i < webTickmarks.size(); ++i)
+        tickmarks[i] = webTickmarks[i];
+}
+
+bool WebScrollbarThemeClientImpl::isScrollableAreaActive() const
+{
+    return m_scrollbar->isScrollableAreaActive();
+}
+
+bool WebScrollbarThemeClientImpl::isScrollViewScrollbar() const
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+IntPoint WebScrollbarThemeClientImpl::convertFromContainingWindow(const IntPoint& windowPoint)
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+    return windowPoint;
+}
+
+bool WebScrollbarThemeClientImpl::isCustomScrollbar() const
+{
+    return m_scrollbar->isCustomScrollbar();
+}
+
+WebCore::ScrollbarOrientation WebScrollbarThemeClientImpl::orientation() const
+{
+    return static_cast<WebCore::ScrollbarOrientation>(m_scrollbar->orientation());
+}
+
+int WebScrollbarThemeClientImpl::value() const
+{
+    return m_scrollbar->value();
+}
+
+float WebScrollbarThemeClientImpl::currentPos() const
+{
+    return value();
+}
+
+int WebScrollbarThemeClientImpl::visibleSize() const
+{
+    return totalSize() - maximum();
+}
+
+int WebScrollbarThemeClientImpl::totalSize() const
+{
+    return m_scrollbar->totalSize();
+}
+
+int WebScrollbarThemeClientImpl::maximum() const
+{
+    return m_scrollbar->maximum();
+}
+
+WebCore::ScrollbarControlSize WebScrollbarThemeClientImpl::controlSize() const
+{
+    return static_cast<WebCore::ScrollbarControlSize>(m_scrollbar->controlSize());
+}
+
+int WebScrollbarThemeClientImpl::lineStep() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+int WebScrollbarThemeClientImpl::pageStep() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+WebCore::ScrollbarPart WebScrollbarThemeClientImpl::pressedPart() const
+{
+    return static_cast<WebCore::ScrollbarPart>(m_scrollbar->pressedPart());
+}
+
+WebCore::ScrollbarPart WebScrollbarThemeClientImpl::hoveredPart() const
+{
+    return static_cast<WebCore::ScrollbarPart>(m_scrollbar->hoveredPart());
+}
+
+void WebScrollbarThemeClientImpl::styleChanged()
+{
+    ASSERT_NOT_REACHED();
+}
+
+bool WebScrollbarThemeClientImpl::enabled() const
+{
+    return m_scrollbar->enabled();
+}
+
+void WebScrollbarThemeClientImpl::setEnabled(bool)
+{
+    ASSERT_NOT_REACHED();
+}
+
+bool WebScrollbarThemeClientImpl::isOverlayScrollbar() const
+{
+    return m_scrollbar->isOverlay();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.h b/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.h
new file mode 100644
index 000000000..b3a6ac956
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScrollbarThemeClientImpl_h
+#define WebScrollbarThemeClientImpl_h
+
+#include "ScrollbarThemeClient.h"
+#include <public/WebScrollbar.h>
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+class ScrollView;
+}
+
+namespace WebKit {
+
+// Adapts a WebScrollbar to the ScrollbarThemeClient interface
+class WebScrollbarThemeClientImpl : public WebCore::ScrollbarThemeClient {
+    WTF_MAKE_NONCOPYABLE(WebScrollbarThemeClientImpl);
+public:
+    // Caller must retain ownership of this pointer and ensure that its lifetime
+    // exceeds this instance.
+    WebScrollbarThemeClientImpl(WebScrollbar*);
+
+    // Implement WebCore::ScrollbarThemeClient interface
+    virtual int x() const OVERRIDE;
+    virtual int y() const OVERRIDE;
+    virtual int width() const OVERRIDE;
+    virtual int height() const OVERRIDE;
+    virtual WebCore::IntSize size() const OVERRIDE;
+    virtual WebCore::IntPoint location() const OVERRIDE;
+    virtual WebCore::ScrollView* parent() const OVERRIDE;
+    virtual WebCore::ScrollView* root() const OVERRIDE;
+    virtual void setFrameRect(const WebCore::IntRect&) OVERRIDE;
+    virtual WebCore::IntRect frameRect() const OVERRIDE;
+    virtual void invalidate() OVERRIDE;
+    virtual void invalidateRect(const WebCore::IntRect&) OVERRIDE;
+    virtual WebCore::ScrollbarOverlayStyle scrollbarOverlayStyle() const OVERRIDE;
+    virtual void getTickmarks(Vector<WebCore::IntRect>&) const OVERRIDE;
+    virtual bool isScrollableAreaActive() const OVERRIDE;
+    virtual bool isScrollViewScrollbar() const OVERRIDE;
+    virtual WebCore::IntPoint convertFromContainingWindow(const WebCore::IntPoint&) OVERRIDE;
+    virtual bool isCustomScrollbar() const OVERRIDE;
+    virtual WebCore::ScrollbarOrientation orientation() const OVERRIDE;
+    virtual int value() const OVERRIDE;
+    virtual float currentPos() const OVERRIDE;
+    virtual int visibleSize() const OVERRIDE;
+    virtual int totalSize() const OVERRIDE;
+    virtual int maximum() const OVERRIDE;
+    virtual WebCore::ScrollbarControlSize controlSize() const OVERRIDE;
+    virtual int lineStep() const OVERRIDE;
+    virtual int pageStep() const OVERRIDE;
+    virtual WebCore::ScrollbarPart pressedPart() const OVERRIDE;
+    virtual WebCore::ScrollbarPart hoveredPart() const OVERRIDE;
+    virtual void styleChanged() OVERRIDE;
+    virtual bool enabled() const OVERRIDE;
+    virtual void setEnabled(bool) OVERRIDE;
+    virtual bool isOverlayScrollbar() const OVERRIDE;
+
+private:
+    WebKit::WebScrollbar* m_scrollbar;
+};
+
+}
+
+#endif // WebScrollbarThemeClientImpl_h
diff --git a/Source/WebKit/chromium/src/WebScrollbarThemePainter.cpp b/Source/WebKit/chromium/src/WebScrollbarThemePainter.cpp
new file mode 100644
index 000000000..a96fdca45
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebScrollbarThemePainter.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <public/WebScrollbarThemePainter.h>
+
+#include "PlatformContextSkia.h"
+#include "Scrollbar.h"
+#include "ScrollbarThemeComposite.h"
+#include <public/WebRect.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebScrollbarThemePainter::assign(const WebScrollbarThemePainter& painter)
+{
+    // This is a pointer to a static object, so no ownership transferral.
+    m_theme = painter.m_theme;
+    m_scrollbar = painter.m_scrollbar;
+}
+
+void WebScrollbarThemePainter::paintScrollbarBackground(WebCanvas* canvas, const WebRect& rect)
+{
+    SkRect clip = SkRect::MakeXYWH(rect.x, rect.y, rect.width, rect.height);
+    canvas->clipRect(clip);
+
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintScrollbarBackground(&context, m_scrollbar);
+}
+
+void WebScrollbarThemePainter::paintTrackBackground(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintTrackBackground(&context, m_scrollbar, IntRect(rect));
+}
+
+void WebScrollbarThemePainter::paintBackTrackPart(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintTrackPiece(&context, m_scrollbar, IntRect(rect), WebCore::BackTrackPart);
+}
+
+void WebScrollbarThemePainter::paintForwardTrackPart(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintTrackPiece(&context, m_scrollbar, IntRect(rect), WebCore::ForwardTrackPart);
+}
+
+void WebScrollbarThemePainter::paintBackButtonStart(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintButton(&context, m_scrollbar, IntRect(rect), WebCore::BackButtonStartPart);
+}
+
+void WebScrollbarThemePainter::paintBackButtonEnd(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintButton(&context, m_scrollbar, IntRect(rect), WebCore::BackButtonEndPart);
+}
+
+void WebScrollbarThemePainter::paintForwardButtonStart(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintButton(&context, m_scrollbar, IntRect(rect), WebCore::ForwardButtonStartPart);
+}
+
+void WebScrollbarThemePainter::paintForwardButtonEnd(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintButton(&context, m_scrollbar, IntRect(rect), WebCore::ForwardButtonEndPart);
+}
+
+void WebScrollbarThemePainter::paintTickmarks(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintTickmarks(&context, m_scrollbar, IntRect(rect));
+}
+
+void WebScrollbarThemePainter::paintThumb(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintThumb(&context, m_scrollbar, IntRect(rect));
+}
+
+WebScrollbarThemePainter::WebScrollbarThemePainter(WebCore::ScrollbarThemeComposite* theme, WebCore::Scrollbar* scrollbar)
+    : m_theme(theme)
+    , m_scrollbar(scrollbar)
+{
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index 5c57cf8ca..eb4b7bb76 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -47,10 +47,10 @@ namespace WebKit {
 
 WebSettingsImpl::WebSettingsImpl(Settings* settings)
     : m_settings(settings)
-    , m_forceSoftwareCompositing(false)
     , m_showFPSCounter(false)
     , m_showPlatformLayerTree(false)
     , m_showPaintRects(false)
+    , m_renderVSyncEnabled(true)
     , m_viewportEnabled(false)
     , m_applyDefaultDeviceScaleFactorInCompositor(false)
     , m_defaultTileSize(WebSize(256, 256))
@@ -148,6 +148,15 @@ void WebSettingsImpl::setTextAutosizingEnabled(bool enabled)
 #endif
 }
 
+void WebSettingsImpl::setTextAutosizingFontScaleFactor(float fontScaleFactor)
+{
+#if ENABLE(TEXT_AUTOSIZING)
+    m_settings->setTextAutosizingFontScaleFactor(fontScaleFactor);
+#else
+    UNUSED_PARAM(fontScaleFactor);
+#endif
+}
+
 void WebSettingsImpl::setDefaultTextEncodingName(const WebString& encoding)
 {
     m_settings->setDefaultTextEncodingName((String)encoding);
@@ -357,6 +366,11 @@ void WebSettingsImpl::setPrivilegedWebGLExtensionsEnabled(bool enabled)
     m_settings->setPrivilegedWebGLExtensionsEnabled(enabled);
 }
 
+void WebSettingsImpl::setRenderVSyncEnabled(bool enabled)
+{
+    m_renderVSyncEnabled = enabled;
+}
+
 void WebSettingsImpl::setWebGLErrorsToConsoleEnabled(bool enabled)
 {
     m_settings->setWebGLErrorsToConsoleEnabled(enabled);
@@ -398,11 +412,6 @@ void WebSettingsImpl::setForceCompositingMode(bool enabled)
     m_settings->setForceCompositingMode(enabled);
 }
 
-void WebSettingsImpl::setForceSoftwareCompositing(bool enabled)
-{
-    m_forceSoftwareCompositing = enabled;
-}
-
 void WebSettingsImpl::setMockScrollbarsEnabled(bool enabled)
 {
     m_settings->setMockScrollbarsEnabled(enabled);
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index 76e30b52f..7bc8a649a 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -45,7 +45,6 @@ public:
     virtual ~WebSettingsImpl() { }
 
     virtual bool deviceSupportsTouch();
-    virtual bool forceSoftwareCompositing() const { return m_forceSoftwareCompositing; }
     virtual bool scrollAnimatorEnabled() const;
     virtual bool viewportEnabled() const { return m_viewportEnabled; }
     virtual void setAccelerated2dCanvasEnabled(bool);
@@ -94,7 +93,6 @@ public:
     virtual void setFixedPositionCreatesStackingContext(bool);
     virtual void setFontRenderingModeNormal();
     virtual void setForceCompositingMode(bool);
-    virtual void setForceSoftwareCompositing(bool);
     virtual void setFrameFlatteningEnabled(bool);
     virtual void setFullScreenEnabled(bool);
     virtual void setHyperlinkAuditingEnabled(bool);
@@ -124,6 +122,7 @@ public:
     virtual void setPictographFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON);
     virtual void setPluginsEnabled(bool);
     virtual void setPrivilegedWebGLExtensionsEnabled(bool);
+    virtual void setRenderVSyncEnabled(bool);
     virtual void setSansSerifFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON);
     virtual void setSerifFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON);
     virtual void setShouldDisplayCaptions(bool);
@@ -139,6 +138,7 @@ public:
     virtual void setSyncXHRInDocumentsEnabled(bool);
     virtual void setTextAreasAreResizable(bool);
     virtual void setTextAutosizingEnabled(bool);
+    virtual void setTextAutosizingFontScaleFactor(float);
     virtual void setTextDirectionSubmenuInclusionBehaviorNeverIncluded();
     virtual void setUnifiedTextCheckerEnabled(bool);
     virtual void setUserStyleSheetLocation(const WebURL&);
@@ -155,16 +155,17 @@ public:
     bool showFPSCounter() const { return m_showFPSCounter; }
     bool showPlatformLayerTree() const { return m_showPlatformLayerTree; }
     bool showPaintRects() const { return m_showPaintRects; }
+    bool renderVSyncEnabled() const { return m_renderVSyncEnabled; }
     bool applyDefaultDeviceScaleFactorInCompositor() const { return m_applyDefaultDeviceScaleFactorInCompositor; }
     WebSize defaultTileSize() const { return m_defaultTileSize; }
     WebSize maxUntiledLayerSize() const { return m_maxUntiledLayerSize; }
 
 private:
     WebCore::Settings* m_settings;
-    bool m_forceSoftwareCompositing;
     bool m_showFPSCounter;
     bool m_showPlatformLayerTree;
     bool m_showPaintRects;
+    bool m_renderVSyncEnabled;
     bool m_viewportEnabled;
     bool m_applyDefaultDeviceScaleFactorInCompositor;
     WebSize m_defaultTileSize;
diff --git a/Source/WebKit/chromium/src/WebSocketImpl.cpp b/Source/WebKit/chromium/src/WebSocketImpl.cpp
index 179303ad9..7548c6315 100644
--- a/Source/WebKit/chromium/src/WebSocketImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSocketImpl.cpp
@@ -126,7 +126,7 @@ bool WebSocketImpl::sendText(const WebString& message)
 bool WebSocketImpl::sendArrayBuffer(const WebArrayBuffer& webArrayBuffer)
 {
 #if ENABLE(WEB_SOCKETS)
-    return m_private->send(*PassRefPtr<ArrayBuffer>(webArrayBuffer)) == ThreadableWebSocketChannel::SendSuccess;
+    return m_private->send(*PassRefPtr<ArrayBuffer>(webArrayBuffer), 0, webArrayBuffer.byteLength()) == ThreadableWebSocketChannel::SendSuccess;
 #else
     ASSERT_NOT_REACHED();
 #endif
diff --git a/Source/WebKit/chromium/src/WebSolidColorLayer.cpp b/Source/WebKit/chromium/src/WebSolidColorLayer.cpp
index 11d7c1417..83914b263 100644
--- a/Source/WebKit/chromium/src/WebSolidColorLayer.cpp
+++ b/Source/WebKit/chromium/src/WebSolidColorLayer.cpp
@@ -24,10 +24,10 @@
  */
 
 #include "config.h"
-#include "platform/WebSolidColorLayer.h"
+#include <public/WebSolidColorLayer.h>
 
 #include "WebSolidColorLayerImpl.h"
-#include "platform/WebFloatRect.h"
+#include <public/WebFloatRect.h>
 
 namespace WebKit {
 
diff --git a/Source/WebKit/chromium/src/WebViewBenchmarkSupportImpl.cpp b/Source/WebKit/chromium/src/WebViewBenchmarkSupportImpl.cpp
index 9764af138..a0f7a4b0b 100644
--- a/Source/WebKit/chromium/src/WebViewBenchmarkSupportImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewBenchmarkSupportImpl.cpp
@@ -59,7 +59,8 @@ void WebViewBenchmarkSupportImpl::acceleratedPaintUnclipped(PaintClient* paintCl
     FloatSize layerSize = layer.size();
     IntRect clip(0, 0, layerSize.width(), layerSize.height());
 
-    paintLayer(paintClient, layer, clip);
+    if (layer.drawsContent())
+        paintLayer(paintClient, layer, clip);
 
     const Vector<GraphicsLayer*>& children = layer.children();
     Vector<GraphicsLayer*>::const_iterator it;
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 7c6da60d9..0bd3ea116 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -42,6 +42,7 @@
 #include "Color.h"
 #include "ColorSpace.h"
 #include "CompositionUnderlineVectorBuilder.h"
+#include "CompositorHUDFontAtlas.h"
 #include "ContextFeaturesClientImpl.h"
 #include "ContextMenu.h"
 #include "ContextMenuController.h"
@@ -81,7 +82,6 @@
 #include "InspectorInstrumentation.h"
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
-#include "LayerChromium.h"
 #include "LayerPainterChromium.h"
 #include "MIMETypeRegistry.h"
 #include "NodeRenderStyle.h"
@@ -97,7 +97,6 @@
 #include "PlatformMouseEvent.h"
 #include "PlatformThemeChromiumLinux.h"
 #include "PlatformWheelEvent.h"
-#include "PointerLock.h"
 #include "PointerLockController.h"
 #include "PopupContainer.h"
 #include "PopupMenuClient.h"
@@ -133,7 +132,6 @@
 #include "WebInputElement.h"
 #include "WebInputEvent.h"
 #include "WebInputEventConversion.h"
-#include "WebKit.h"
 #include "WebMediaPlayerAction.h"
 #include "WebNode.h"
 #include "WebPagePopupImpl.h"
@@ -145,15 +143,13 @@
 #include "WebRuntimeFeatures.h"
 #include "WebSettingsImpl.h"
 #include "WebTextInputInfo.h"
+#include "WebTouchCandidatesInfo.h"
 #include "WebViewClient.h"
 #include "WheelEvent.h"
-#include "cc/CCProxy.h"
-#include "cc/CCSettings.h"
 #include "painting/GraphicsContextBuilder.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebString.h"
-#include "platform/WebVector.h"
 #include <public/Platform.h>
+#include <public/WebCompositor.h>
+#include <public/WebCompositorOutputSurface.h>
 #include <public/WebDragData.h>
 #include <public/WebFloatPoint.h>
 #include <public/WebGraphicsContext3D.h>
@@ -162,6 +158,8 @@
 #include <public/WebLayerTreeView.h>
 #include <public/WebPoint.h>
 #include <public/WebRect.h>
+#include <public/WebString.h>
+#include <public/WebVector.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
 #include <wtf/RefPtr.h>
@@ -195,7 +193,7 @@ static const int touchPointPadding = 32;
 static const float minScaleDifference = 0.01f;
 static const float doubleTapZoomContentDefaultMargin = 5;
 static const float doubleTapZoomContentMinimumMargin = 2;
-static const double doubleTabZoomAnimationDurationInSeconds = 0.25;
+static const double doubleTapZoomAnimationDurationInSeconds = 0.25;
 
 // Constants for zooming in on a focused text field.
 static const double scrollAndScaleAnimationDurationInSeconds = 0.2;
@@ -763,15 +761,25 @@ void WebViewImpl::transferActiveWheelFlingAnimation(const WebActiveWheelFlingPar
 
 void WebViewImpl::renderingStats(WebRenderingStats& stats) const
 {
-    ASSERT(isAcceleratedCompositingActive());
     if (!m_layerTreeView.isNull())
         m_layerTreeView.renderingStats(stats);
 }
 
-void WebViewImpl::startPageScaleAnimation(const IntPoint& scroll, bool useAnchor, float newScale, double durationInSeconds)
+void WebViewImpl::startPageScaleAnimation(const IntPoint& targetPosition, bool useAnchor, float newScale, double durationInSeconds)
 {
-    if (!m_layerTreeView.isNull())
-        m_layerTreeView.startPageScaleAnimation(scroll, useAnchor, newScale, durationInSeconds);
+    if (m_layerTreeView.isNull())
+        return;
+
+    IntPoint clampedPoint = targetPosition;
+    if (!useAnchor)
+        clampedPoint = clampOffsetAtScale(targetPosition, newScale);
+
+    if (!durationInSeconds && !useAnchor) {
+        setPageScaleFactor(newScale, clampedPoint);
+        return;
+    }
+
+    m_layerTreeView.startPageScaleAnimation(targetPosition, useAnchor, newScale, durationInSeconds);
 }
 #endif
 
@@ -780,6 +788,17 @@ WebViewBenchmarkSupport* WebViewImpl::benchmarkSupport()
     return &m_benchmarkSupport;
 }
 
+WebVector<WebFloatQuad> WebViewImpl::getTouchHighlightQuads(const WebPoint& point,
+                                                            int padding,
+                                                            WebTouchCandidatesInfo& outTouchInfo,
+                                                            WebColor& outTapHighlightColor)
+{
+    // FIXME: Upstream this function from the chromium-android branch.
+    notImplemented();
+
+    return WebVector<WebFloatQuad>();
+}
+
 bool WebViewImpl::handleKeyEvent(const WebKeyboardEvent& event)
 {
     ASSERT((event.type == WebInputEvent::RawKeyDown)
@@ -1112,7 +1131,7 @@ void WebViewImpl::animateZoomAroundPoint(const IntPoint& point, AutoZoomType zoo
     computeScaleAndScrollForHitRect(WebRect(point.x(), point.y(), 0, 0), zoomType, scale, scroll);
 
     bool isDoubleTap = (zoomType == DoubleTap);
-    double durationInSeconds = isDoubleTap ? doubleTabZoomAnimationDurationInSeconds : 0;
+    double durationInSeconds = isDoubleTap ? doubleTapZoomAnimationDurationInSeconds : 0;
     startPageScaleAnimation(scroll, isDoubleTap, scale, durationInSeconds);
 #endif
 }
@@ -1611,7 +1630,7 @@ void WebViewImpl::didBeginFrame()
 void WebViewImpl::updateAnimations(double monotonicFrameBeginTime)
 {
 #if ENABLE(REQUEST_ANIMATION_FRAME)
-    TRACE_EVENT("WebViewImpl::updateAnimations", this, 0);
+    TRACE_EVENT0("webkit", "WebViewImpl::updateAnimations");
 
     WebFrameImpl* webframe = mainFrameImpl();
     if (!webframe)
@@ -1634,7 +1653,7 @@ void WebViewImpl::updateAnimations(double monotonicFrameBeginTime)
 
 void WebViewImpl::layout()
 {
-    TRACE_EVENT("WebViewImpl::layout", this, 0);
+    TRACE_EVENT0("webkit", "WebViewImpl::layout");
     PageWidgetDelegate::layout(m_page.get());
 }
 
@@ -1677,7 +1696,7 @@ void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect)
         if (canvas) {
             // Clip rect to the confines of the rootLayerTexture.
             IntRect resizeRect(rect);
-            resizeRect.intersect(IntRect(IntPoint(0, 0), m_layerTreeView.viewportSize()));
+            resizeRect.intersect(IntRect(IntPoint(0, 0), m_layerTreeView.deviceViewportSize()));
             doPixelReadbackToCanvas(canvas, resizeRect);
         }
 #endif
@@ -1704,7 +1723,7 @@ void WebViewImpl::themeChanged()
 void WebViewImpl::composite(bool)
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (CCProxy::hasImplThread())
+    if (WebCompositor::threadingEnabled())
         m_layerTreeView.setNeedsRedraw();
     else {
         ASSERT(isAcceleratedCompositingActive());
@@ -3509,7 +3528,7 @@ void WebViewImpl::setRootGraphicsLayer(GraphicsLayer* layer)
     }
 
     if (layer)
-        m_rootLayer = WebLayer(layer->platformLayer());
+        m_rootLayer = *layer->platformLayer();
 
     if (!m_layerTreeView.isNull())
         m_layerTreeView.setRootLayer(layer ? &m_rootLayer : 0);
@@ -3564,7 +3583,7 @@ WebCore::GraphicsLayer* WebViewImpl::rootGraphicsLayer()
 void WebViewImpl::scheduleAnimation()
 {
     if (isAcceleratedCompositingActive()) {
-        if (CCProxy::hasImplThread()) {
+        if (WebCompositor::threadingEnabled()) {
             ASSERT(!m_layerTreeView.isNull());
             m_layerTreeView.setNeedsAnimate();
         } else
@@ -3609,14 +3628,14 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
         m_client->didActivateCompositor(m_layerTreeView.compositorIdentifier());
     } else {
-        TRACE_EVENT("WebViewImpl::setIsAcceleratedCompositingActive(true)", this, 0);
+        TRACE_EVENT0("webkit", "WebViewImpl::setIsAcceleratedCompositingActive(true)");
 
         WebLayerTreeView::Settings layerTreeViewSettings;
         layerTreeViewSettings.acceleratePainting = page()->settings()->acceleratedDrawingEnabled();
         layerTreeViewSettings.showFPSCounter = settingsImpl()->showFPSCounter();
         layerTreeViewSettings.showPlatformLayerTree = settingsImpl()->showPlatformLayerTree();
         layerTreeViewSettings.showPaintRects = settingsImpl()->showPaintRects();
-        layerTreeViewSettings.forceSoftwareCompositing = settings()->forceSoftwareCompositing();
+        layerTreeViewSettings.renderVSyncEnabled = settingsImpl()->renderVSyncEnabled();
 
         layerTreeViewSettings.defaultTileSize = settingsImpl()->defaultTileSize();
         layerTreeViewSettings.maxUntiledLayerSize = settingsImpl()->maxUntiledLayerSize();
@@ -3646,6 +3665,15 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
             m_compositorCreationFailed = false;
             if (m_pageOverlays)
                 m_pageOverlays->update();
+
+            // Only allocate the font atlas if we have reason to use the heads-up display.
+            if (layerTreeViewSettings.showFPSCounter || layerTreeViewSettings.showPlatformLayerTree) {
+                TRACE_EVENT0("cc", "WebViewImpl::setIsAcceleratedCompositingActive(true) initialize font atlas");
+                WebRect asciiToRectTable[128];
+                int fontHeight;
+                SkBitmap bitmap = WebCore::CompositorHUDFontAtlas::generateFontAtlas(asciiToRectTable, fontHeight);
+                m_layerTreeView.setFontAtlas(bitmap, asciiToRectTable, fontHeight);
+            }
         } else {
             m_nonCompositedContentHost.clear();
             m_isAcceleratedCompositingActive = false;
@@ -3659,47 +3687,63 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
 #endif
 
-PassOwnPtr<WebKit::WebGraphicsContext3D> WebViewImpl::createCompositorGraphicsContext3D()
-{
-    if (settings()->forceSoftwareCompositing())
-        CRASH();
+namespace {
+
+// Adapts a pure WebGraphicsContext3D into a WebCompositorOutputSurface until
+// downstream code can be updated to produce output surfaces directly.
+class WebGraphicsContextToOutputSurfaceAdapter : public WebCompositorOutputSurface {
+public:
+    explicit WebGraphicsContextToOutputSurfaceAdapter(PassOwnPtr<WebGraphicsContext3D> context)
+        : m_context3D(context)
+        , m_client(0)
+    {
+    }
+
+    virtual bool bindToClient(WebCompositorOutputSurfaceClient* client) OVERRIDE
+    {
+        ASSERT(client);
+        if (!m_context3D->makeContextCurrent())
+            return false;
+        m_client = client;
+        return true;
+    }
+
+    virtual const Capabilities& capabilities() const OVERRIDE
+    {
+        return m_capabilities;
+    }
+
+    virtual WebGraphicsContext3D* context3D() const OVERRIDE
+    {
+        return m_context3D.get();
+    }
+
+    virtual void sendFrameToParentCompositor(const WebCompositorFrame&) OVERRIDE
+    {
+    }
 
-    // Explicitly disable antialiasing for the compositor. As of the time of
-    // this writing, the only platform that supported antialiasing for the
-    // compositor was Mac OS X, because the on-screen OpenGL context creation
-    // code paths on Windows and Linux didn't yet have multisampling support.
-    // Mac OS X essentially always behaves as though it's rendering offscreen.
-    // Multisampling has a heavy cost especially on devices with relatively low
-    // fill rate like most notebooks, and the Mac implementation would need to
-    // be optimized to resolve directly into the IOSurface shared between the
-    // GPU and browser processes. For these reasons and to avoid platform
-    // disparities we explicitly disable antialiasing.
+private:
+    OwnPtr<WebGraphicsContext3D> m_context3D;
+    Capabilities m_capabilities;
+    WebCompositorOutputSurfaceClient* m_client;
+};
+
+} // namespace
+
+WebGraphicsContext3D* WebViewImpl::createContext3D()
+{
+    // Temporarily, if the output surface can't be created, create a WebGraphicsContext3D
+    // directly. This allows bootstrapping the output surface system while downstream
+    // users of the API still use the old approach.
     WebKit::WebGraphicsContext3D::Attributes attributes;
     attributes.antialias = false;
     attributes.shareResources = true;
-
-    OwnPtr<WebGraphicsContext3D> webContext = adoptPtr(client()->createGraphicsContext3D(attributes));
-    if (!webContext)
-        return nullptr;
-
-    return webContext.release();
+    return m_client->createGraphicsContext3D(attributes);
 }
 
-WebKit::WebGraphicsContext3D* WebViewImpl::createContext3D()
+WebCompositorOutputSurface* WebViewImpl::createOutputSurface()
 {
-    if (settings()->forceSoftwareCompositing())
-        CRASH();
-
-    OwnPtr<WebKit::WebGraphicsContext3D> webContext;
-
-    // If we've already created an onscreen context for this view, return that.
-    if (m_temporaryOnscreenGraphicsContext3D)
-        webContext = m_temporaryOnscreenGraphicsContext3D.release();
-    else // Otherwise make a new one.
-        webContext = createCompositorGraphicsContext3D();
-    // The caller takes ownership of this object, but since there's no equivalent of PassOwnPtr<> in the WebKit API
-    // we return a raw pointer.
-    return webContext.leakPtr();
+    return m_client->createOutputSurface();
 }
 
 void WebViewImpl::applyScrollAndScale(const WebSize& scrollDelta, float pageScaleDelta)
@@ -3749,7 +3793,11 @@ void WebViewImpl::didCompleteSwapBuffers()
 
 void WebViewImpl::didRebindGraphicsContext(bool success)
 {
+    didRecreateOutputSurface(success);
+}
 
+void WebViewImpl::didRecreateOutputSurface(bool success)
+{
     // Switch back to software rendering mode, if necessary
     if (!success) {
         ASSERT(m_isAcceleratedCompositingActive);
@@ -3768,7 +3816,7 @@ void WebViewImpl::didRebindGraphicsContext(bool success)
 
 void WebViewImpl::scheduleComposite()
 {
-    ASSERT(!CCProxy::hasImplThread());
+    ASSERT(!WebCompositor::threadingEnabled());
     m_client->scheduleComposite();
 }
 
@@ -3786,7 +3834,10 @@ void WebViewImpl::updateLayerTreeViewport()
     float deviceScale = m_deviceScaleInCompositor;
     m_nonCompositedContentHost->setViewport(visibleRect.size(), view->contentsSize(), scroll, view->scrollOrigin(), deviceScale);
 
-    m_layerTreeView.setViewportSize(size());
+    IntSize layoutViewportSize = size();
+    IntSize deviceViewportSize = size();
+    deviceViewportSize.scale(deviceScale);
+    m_layerTreeView.setViewportSize(layoutViewportSize, deviceViewportSize);
     m_layerTreeView.setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
 }
 
@@ -3804,6 +3855,34 @@ void WebViewImpl::selectAutofillSuggestionAtIndex(unsigned listIndex)
         m_autofillPopupClient->valueChanged(listIndex);
 }
 
+bool WebViewImpl::detectContentIntentOnTouch(const WebPoint& position, WebInputEvent::Type touchType)
+{
+    ASSERT(touchType == WebInputEvent::GestureTap || touchType == WebInputEvent::GestureLongPress);
+    HitTestResult touchHit = hitTestResultForWindowPos(position);
+
+    if (touchHit.isContentEditable())
+        return false;
+
+    Node* node = touchHit.innerNode();
+    if (!node || !node->isTextNode())
+        return false;
+
+    // FIXME: Should we not detect content intents in nodes that have event listeners?
+
+    WebContentDetectionResult content = m_client->detectContentIntentAround(touchHit);
+    if (!content.isValid())
+        return false;
+
+    if (touchType == WebInputEvent::GestureLongPress) {
+        // Select the detected content as a block.
+        focusedFrame()->selectRange(content.range());
+        return true;
+    }
+
+    m_client->scheduleContentIntent(content.intent());
+    return true;
+}
+
 void WebViewImpl::setVisibilityState(WebPageVisibilityState visibilityState,
                                      bool isInitialState) {
     if (!page())
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index 639d5e61a..39783680f 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -31,16 +31,6 @@
 #ifndef WebViewImpl_h
 #define WebViewImpl_h
 
-#include "WebNavigationPolicy.h"
-#include "platform/WebLayer.h"
-#include "platform/WebLayerTreeView.h"
-#include "platform/WebLayerTreeViewClient.h"
-#include "platform/WebPoint.h"
-#include "platform/WebRect.h"
-#include "platform/WebSize.h"
-#include "platform/WebString.h"
-#include "WebView.h"
-
 #include "ChromeClientImpl.h"
 #include "ContextMenuClientImpl.h"
 #include "DragClientImpl.h"
@@ -56,7 +46,18 @@
 #include "PageWidgetDelegate.h"
 #include "PlatformGestureCurveTarget.h"
 #include "UserMediaClientImpl.h"
+#include "WebInputEvent.h"
+#include "WebNavigationPolicy.h"
+#include "WebView.h"
 #include "WebViewBenchmarkSupportImpl.h"
+#include <public/WebFloatQuad.h>
+#include <public/WebLayer.h>
+#include <public/WebLayerTreeView.h>
+#include <public/WebLayerTreeViewClient.h>
+#include <public/WebPoint.h>
+#include <public/WebRect.h>
+#include <public/WebSize.h>
+#include <public/WebString.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefCounted.h>
 
@@ -301,13 +302,20 @@ public:
     virtual void transferActiveWheelFlingAnimation(const WebActiveWheelFlingParameters&);
     virtual WebViewBenchmarkSupport* benchmarkSupport();
 
+    virtual WebVector<WebFloatQuad> getTouchHighlightQuads(const WebPoint&,
+                                                           int padding,
+                                                           WebTouchCandidatesInfo& outTouchInfo,
+                                                           WebColor& outTapHighlightColor);
+
     // WebLayerTreeViewClient
     virtual void willBeginFrame();
     virtual void didBeginFrame();
     virtual void updateAnimations(double monotonicFrameBeginTime);
     virtual void applyScrollAndScale(const WebSize&, float);
-    virtual WebGraphicsContext3D* createContext3D();
-    virtual void didRebindGraphicsContext(bool);
+    virtual WebGraphicsContext3D* createContext3D() OVERRIDE;
+    virtual void didRebindGraphicsContext(bool success) OVERRIDE;
+    virtual WebCompositorOutputSurface* createOutputSurface() OVERRIDE;
+    virtual void didRecreateOutputSurface(bool success) OVERRIDE;
     virtual void willCommit();
     virtual void didCommit();
     virtual void didCommitAndDrawFrame();
@@ -382,6 +390,8 @@ public:
     // Event related methods:
     void mouseContextMenu(const WebMouseEvent&);
     void mouseDoubleClick(const WebMouseEvent&);
+
+    bool detectContentIntentOnTouch(const WebPoint&, WebInputEvent::Type);
     void startPageScaleAnimation(const WebCore::IntPoint& targetPosition, bool useAnchor, float newScale, double durationInSeconds);
 
     void numberOfWheelEventHandlersChanged(unsigned);
@@ -529,8 +539,6 @@ public:
 
     virtual WebGraphicsContext3D* sharedGraphicsContext3D();
 
-    PassOwnPtr<WebGraphicsContext3D> createCompositorGraphicsContext3D();
-
     virtual void setVisibilityState(WebPageVisibilityState, bool);
 
     WebCore::PopupContainer* selectPopup() const { return m_selectPopup.get(); }
@@ -824,10 +832,6 @@ private:
     OwnPtr<SpeechRecognitionClientProxy> m_speechRecognitionClient;
 #endif
 
-    // If we attempt to fetch the on-screen GraphicsContext3D before
-    // the compositor has been turned on, we need to instantiate it
-    // early. This member holds on to the GC3D in this case.
-    OwnPtr<WebGraphicsContext3D> m_temporaryOnscreenGraphicsContext3D;
     OwnPtr<DeviceOrientationClientProxy> m_deviceOrientationClientProxy;
     OwnPtr<GeolocationClientProxy> m_geolocationClientProxy;
 #if ENABLE(BATTERY_STATUS)
diff --git a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
index 80899919b..c6fd50589 100644
--- a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
@@ -59,13 +59,11 @@
 #include "PlatformMessagePortChannel.h"
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
 #include "WebMessagePortChannel.h"
 #include "WebPermissionClient.h"
-#include "platform/WebString.h"
-#include "platform/WebURL.h"
 #include "WebViewImpl.h"
+#include <public/WebString.h>
+#include <public/WebURL.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
index 7a387c7ed..4a5f69dc2 100644
--- a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
@@ -40,8 +40,6 @@
 #include "NotImplemented.h"
 #include "WebFileSystemCallbacksImpl.h"
 #include "WebFileWriter.h"
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
 #include "WebWorkerBase.h"
 #include "WorkerAsyncFileWriterChromium.h"
 #include "WorkerContext.h"
diff --git a/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.cpp b/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.cpp
index 3ffb178c5..dd91c52a2 100644
--- a/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.cpp
+++ b/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.cpp
@@ -35,14 +35,13 @@
 
 #include "AsyncFileWriterClient.h"
 #include "CrossThreadTask.h"
-#include "platform/WebCString.h"
 #include "WebFileWriter.h"
-#include "WebKit.h"
 #include "WebWorkerBase.h"
 #include "WorkerContext.h"
 #include "WorkerLoaderProxy.h"
 #include "WorkerThread.h"
 #include <public/Platform.h>
+#include <public/WebCString.h>
 #include <public/WebFileSystem.h>
 #include <wtf/MainThread.h>
 #include <wtf/Threading.h>
diff --git a/Source/WebKit/chromium/src/js/DevTools.js b/Source/WebKit/chromium/src/js/DevTools.js
index 12293f5b1..f555419e9 100644
--- a/Source/WebKit/chromium/src/js/DevTools.js
+++ b/Source/WebKit/chromium/src/js/DevTools.js
@@ -39,7 +39,6 @@
     Preferences.localizeUI = false;
     Preferences.applicationTitle = "Developer Tools - %s";
     Preferences.exposeDisableCache = true;
-    Preferences.exposeWorkersInspection = true;
     Preferences.showDockToRight = true;
     Preferences.exposeFileSystemInspection = true;
 })();}
diff --git a/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm b/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm
index e1b94a640..babb1f6cc 100644
--- a/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm
+++ b/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm
@@ -43,8 +43,7 @@ enum {
     NSEventPhaseStationary  = 0x1 << 1,
     NSEventPhaseChanged     = 0x1 << 2,
     NSEventPhaseEnded       = 0x1 << 3,
-    NSEventPhaseCancelled   = 0x1 << 4,
-    NSEventPhaseMayBegin    = 0x1 << 5
+    NSEventPhaseCancelled   = 0x1 << 4
 };
 typedef NSUInteger NSEventPhase;
 
@@ -55,6 +54,15 @@ typedef NSUInteger NSEventPhase;
 
 #endif  // __MAC_OS_X_VERSION_MAX_ALLOWED < 1070
 
+#if __MAC_OS_X_VERSION_MAX_ALLOWED < 1080
+
+// Additional Mountain Lion APIs.
+enum {
+    NSEventPhaseMayBegin    = 0x1 << 5
+};
+
+#endif  // __MAC_OS_X_VERSION_MAX_ALLOWED < 1080
+
 // Do not __MAC_OS_X_VERSION_MAX_ALLOWED here because of a bug in the 10.5 SDK,
 // see <http://lists.webkit.org/pipermail/webkit-dev/2012-July/021442.html>.
 #if MAC_OS_X_VERSION_MAX_ALLOWED <= 1050
@@ -759,7 +767,7 @@ WebMouseEvent WebInputEventFactory::mouseEvent(NSEvent* event, NSView* view)
 
 static WebMouseWheelEvent::Phase phaseForNSEventPhase(NSEventPhase eventPhase)
 {
-    uint32_t phase = WebMouseWheelEvent::PhaseNone; 
+    uint32_t phase = WebMouseWheelEvent::PhaseNone;
     if (eventPhase & NSEventPhaseBegan)
         phase |= WebMouseWheelEvent::PhaseBegan;
     if (eventPhase & NSEventPhaseStationary)
@@ -770,6 +778,8 @@ static WebMouseWheelEvent::Phase phaseForNSEventPhase(NSEventPhase eventPhase)
         phase |= WebMouseWheelEvent::PhaseEnded;
     if (eventPhase & NSEventPhaseCancelled)
         phase |= WebMouseWheelEvent::PhaseCancelled;
+    if (eventPhase & NSEventPhaseMayBegin)
+        phase |= WebMouseWheelEvent::PhaseMayBegin;
     return static_cast<WebMouseWheelEvent::Phase>(phase);
 }
 
diff --git a/Source/WebKit/chromium/tests/CCAnimationTestCommon.cpp b/Source/WebKit/chromium/tests/CCAnimationTestCommon.cpp
index 854595380..f210c1bb7 100644
--- a/Source/WebKit/chromium/tests/CCAnimationTestCommon.cpp
+++ b/Source/WebKit/chromium/tests/CCAnimationTestCommon.cpp
@@ -26,9 +26,7 @@
 
 #include "CCAnimationTestCommon.h"
 
-#include "GraphicsLayer.h"
 #include "LayerChromium.h"
-#include "TranslateTransformOperation.h"
 #include "cc/CCKeyframedAnimationCurve.h"
 #include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerImpl.h"
diff --git a/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp b/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp
index 8294ca622..8f813b9ba 100644
--- a/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp
@@ -55,7 +55,7 @@ void executeCalculateDrawTransformsAndVisibility(CCLayerImpl* root, Vector<CCLay
     ASSERT_FALSE(renderSurfaceLayerList.size());
 
     CCLayerTreeHostCommon::calculateDrawTransforms(root, root->bounds(), 1, &layerSorter, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, root->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 }
 
 void clearDamageForAllSurfaces(CCLayerImpl* layer)
diff --git a/Source/WebKit/chromium/tests/CCDelayBasedTimeSourceTest.cpp b/Source/WebKit/chromium/tests/CCDelayBasedTimeSourceTest.cpp
index 93e84a4af..08b5d8202 100644
--- a/Source/WebKit/chromium/tests/CCDelayBasedTimeSourceTest.cpp
+++ b/Source/WebKit/chromium/tests/CCDelayBasedTimeSourceTest.cpp
@@ -199,6 +199,120 @@ TEST(CCDelayBasedTimeSource, NextDelaySaneWhenHalfAfterRequestedTime)
     EXPECT_EQ(8, thread.pendingDelayMs());
 }
 
+// If the timebase and interval are updated with a jittery source, we want to
+// make sure we do not double tick.
+TEST(CCDelayBasedTimeSource, SaneHandlingOfJitteryTimebase)
+{
+    FakeCCThread thread;
+    FakeCCTimeSourceClient client;
+    double interval = 1.0 / 60.0;
+    RefPtr<FakeCCDelayBasedTimeSource> timer = FakeCCDelayBasedTimeSource::create(interval, &thread);
+    timer->setClient(&client);
+    timer->setActive(true);
+    // Run the first task, as that activates the timer and picks up a timebase.
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    // Jitter timebase ~1ms late
+    timer->setTimebaseAndInterval(interval + 0.001, interval);
+    timer->setMonotonicallyIncreasingTime(interval);
+    thread.runPendingTask();
+
+    // Without double tick prevention, pendingDelayMs would be 1.
+    EXPECT_EQ(17, thread.pendingDelayMs());
+
+    // Jitter timebase ~1ms early
+    timer->setTimebaseAndInterval(interval * 2 - 0.001, interval);
+    timer->setMonotonicallyIncreasingTime(interval * 2);
+    thread.runPendingTask();
+
+    EXPECT_EQ(15, thread.pendingDelayMs());
+}
+
+TEST(CCDelayBasedTimeSource, HanldlesSignificantTimebaseChangesImmediately)
+{
+    FakeCCThread thread;
+    FakeCCTimeSourceClient client;
+    double interval = 1.0 / 60.0;
+    RefPtr<FakeCCDelayBasedTimeSource> timer = FakeCCDelayBasedTimeSource::create(interval, &thread);
+    timer->setClient(&client);
+    timer->setActive(true);
+    // Run the first task, as that activates the timer and picks up a timebase.
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    // Tick, then shift timebase by +7ms.
+    timer->setMonotonicallyIncreasingTime(interval);
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    client.reset();
+    thread.runPendingTaskOnOverwrite(true);
+    timer->setTimebaseAndInterval(interval + 0.0070001, interval);
+    thread.runPendingTaskOnOverwrite(false);
+
+    EXPECT_FALSE(client.tickCalled()); // Make sure pending tasks were canceled.
+    EXPECT_EQ(7, thread.pendingDelayMs());
+
+    // Tick, then shift timebase by -7ms.
+    timer->setMonotonicallyIncreasingTime(interval + 0.0070001);
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    client.reset();
+    thread.runPendingTaskOnOverwrite(true);
+    timer->setTimebaseAndInterval(interval, interval);
+    thread.runPendingTaskOnOverwrite(false);
+
+    EXPECT_FALSE(client.tickCalled()); // Make sure pending tasks were canceled.
+    EXPECT_EQ(16-7, thread.pendingDelayMs());
+}
+
+TEST(CCDelayBasedTimeSource, HanldlesSignificantIntervalChangesImmediately)
+{
+    FakeCCThread thread;
+    FakeCCTimeSourceClient client;
+    double interval = 1.0 / 60.0;
+    RefPtr<FakeCCDelayBasedTimeSource> timer = FakeCCDelayBasedTimeSource::create(interval, &thread);
+    timer->setClient(&client);
+    timer->setActive(true);
+    // Run the first task, as that activates the timer and picks up a timebase.
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    // Tick, then double the interval.
+    timer->setMonotonicallyIncreasingTime(interval);
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    client.reset();
+    thread.runPendingTaskOnOverwrite(true);
+    timer->setTimebaseAndInterval(interval, interval * 2);
+    thread.runPendingTaskOnOverwrite(false);
+
+    EXPECT_FALSE(client.tickCalled()); // Make sure pending tasks were canceled.
+    EXPECT_EQ(33, thread.pendingDelayMs());
+
+    // Tick, then halve the interval.
+    timer->setMonotonicallyIncreasingTime(interval * 3);
+    thread.runPendingTask();
+
+    EXPECT_EQ(33, thread.pendingDelayMs());
+
+    client.reset();
+    thread.runPendingTaskOnOverwrite(true);
+    timer->setTimebaseAndInterval(interval * 3, interval);
+    thread.runPendingTaskOnOverwrite(false);
+
+    EXPECT_FALSE(client.tickCalled()); // Make sure pending tasks were canceled.
+    EXPECT_EQ(16, thread.pendingDelayMs());
+}
 
 TEST(CCDelayBasedTimeSourceTest, AchievesTargetRateWithNoNoise)
 {
diff --git a/Source/WebKit/chromium/tests/CCFrameRateControllerTest.cpp b/Source/WebKit/chromium/tests/CCFrameRateControllerTest.cpp
index c9a60cfaa..20f2374a3 100644
--- a/Source/WebKit/chromium/tests/CCFrameRateControllerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCFrameRateControllerTest.cpp
@@ -139,4 +139,37 @@ TEST(CCFrameRateControllerTest, TestFrameThrottling_TwoFramesInFlight)
     EXPECT_TRUE(client.vsyncTicked());
 }
 
+TEST(CCFrameRateControllerTest, TestFrameThrottling_Unthrottled)
+{
+    FakeCCThread thread;
+    FakeCCFrameRateControllerClient client;
+    CCFrameRateController controller(&thread);
+
+    controller.setClient(&client);
+    controller.setMaxFramesPending(2);
+
+    // setActive triggers 1st frame, make sure the vsync callback is called
+    controller.setActive(true);
+    thread.runPendingTask();
+    EXPECT_TRUE(client.vsyncTicked());
+    client.reset();
+
+    // didBeginFrame triggers 2nd frame, make sure the vsync callback is called
+    controller.didBeginFrame();
+    thread.runPendingTask();
+    EXPECT_TRUE(client.vsyncTicked());
+    client.reset();
+
+    // didBeginFrame triggers 3rd frame (> maxFramesPending), make sure the vsync callback is NOT called
+    controller.didBeginFrame();
+    thread.runPendingTask();
+    EXPECT_FALSE(client.vsyncTicked());
+    client.reset();
+
+    // didFinishFrame triggers a frame, make sure the vsync callback is called
+    controller.didFinishFrame();
+    thread.runPendingTask();
+    EXPECT_TRUE(client.vsyncTicked());
+}
+
 }
diff --git a/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp b/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp
index eb6bb0363..4d2c4ddaf 100644
--- a/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp
+++ b/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp
@@ -26,9 +26,6 @@
 
 #include "cc/CCKeyframedAnimationCurve.h"
 
-#include "Length.h"
-#include "TranslateTransformOperation.h"
-
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 #include <public/WebTransformOperations.h>
diff --git a/Source/WebKit/chromium/tests/CCLayerAnimationControllerTest.cpp b/Source/WebKit/chromium/tests/CCLayerAnimationControllerTest.cpp
index 72361092a..2ce33a561 100644
--- a/Source/WebKit/chromium/tests/CCLayerAnimationControllerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerAnimationControllerTest.cpp
@@ -27,8 +27,6 @@
 #include "cc/CCLayerAnimationController.h"
 
 #include "CCAnimationTestCommon.h"
-#include "GraphicsLayer.h"
-#include "Length.h"
 #include "cc/CCActiveAnimation.h"
 #include "cc/CCAnimationCurve.h"
 
diff --git a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
index 47edeec9d..27c4a918a 100644
--- a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
@@ -103,6 +103,17 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     WebFilterOperations arbitraryFilters;
     arbitraryFilters.append(WebFilterOperation::createOpacityFilter(0.5));
 
+    // These properties are internal, and should not be considered "change" when they are used.
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setUseLCDText(true));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawOpacity(arbitraryNumber));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setRenderTarget(0));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawTransform(arbitraryTransform));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setScreenSpaceTransform(arbitraryTransform));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawableContentRect(arbitraryIntRect));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setUpdateRect(arbitraryFloatRect));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setVisibleContentRect(arbitraryIntRect));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setMaxScrollPosition(arbitraryIntSize));
+
     // Changing these properties affects the entire subtree of layers.
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setAnchorPoint(arbitraryFloatPoint));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setAnchorPointZ(arbitraryNumber));
@@ -115,7 +126,7 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setPreserves3D(true));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setDoubleSided(false)); // constructor initializes it to "true".
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->scrollBy(arbitraryIntSize));
-    EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setScrollDelta(arbitraryIntSize));
+    EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setScrollDelta(IntSize()));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setScrollPosition(arbitraryIntPoint));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setPageScaleDelta(arbitraryNumber));
 
@@ -153,7 +164,7 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setPreserves3D(true));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setTransform(arbitraryTransform));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDoubleSided(false)); // constructor initializes it to "true".
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setScrollDelta(arbitraryIntSize));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setScrollDelta(IntSize()));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setScrollPosition(arbitraryIntPoint));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setPageScaleDelta(arbitraryNumber));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setContentBounds(arbitraryIntSize));
@@ -164,17 +175,6 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawsContent(true));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setSublayerTransform(arbitraryTransform));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setBounds(arbitraryIntSize));
-
-    // These properties are internal, and should not be considered "change" when they are used.
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setIsNonCompositedContent(true));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawOpacity(arbitraryNumber));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setRenderTarget(0));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawTransform(arbitraryTransform));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setScreenSpaceTransform(arbitraryTransform));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawableContentRect(arbitraryIntRect));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setUpdateRect(arbitraryFloatRect));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setVisibleContentRect(arbitraryIntRect));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setMaxScrollPosition(arbitraryIntSize));
 }
 
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp b/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
index 73fda4cb4..b5e226916 100644
--- a/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
@@ -148,7 +148,7 @@ TEST(CCLayerIteratorTest, simpleTree)
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer.get(), rootLayer->bounds(), 1, 256, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootLayer->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     iterateBackToFront(&renderSurfaceLayerList);
     EXPECT_COUNT(rootLayer, 0, -1, 1);
@@ -191,7 +191,7 @@ TEST(CCLayerIteratorTest, complexTree)
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer.get(), rootLayer->bounds(), 1, 256, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootLayer->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     iterateBackToFront(&renderSurfaceLayerList);
     EXPECT_COUNT(rootLayer, 0, -1, 1);
@@ -247,7 +247,7 @@ TEST(CCLayerIteratorTest, complexTreeMultiSurface)
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer.get(), rootLayer->bounds(), 1, 256, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootLayer->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     iterateBackToFront(&renderSurfaceLayerList);
     EXPECT_COUNT(rootLayer, 0, -1, 1);
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
index 9e249f2d7..9fd226858 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
@@ -30,7 +30,6 @@
 #include "CCLayerTreeTestCommon.h"
 #include "ContentLayerChromium.h"
 #include "LayerChromium.h"
-#include "TranslateTransformOperation.h"
 #include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerSorter.h"
@@ -80,7 +79,7 @@ void executeCalculateDrawTransformsAndVisibility(LayerChromium* rootLayer)
     // We are probably not testing what is intended if the rootLayer bounds are empty.
     ASSERT(!rootLayer->bounds().isEmpty());
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer, rootLayer->bounds(), 1, dummyMaxTextureSize, dummyRenderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(dummyRenderSurfaceLayerList, rootLayer->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(dummyRenderSurfaceLayerList);
 }
 
 void executeCalculateDrawTransformsAndVisibility(CCLayerImpl* rootLayer)
@@ -94,7 +93,7 @@ void executeCalculateDrawTransformsAndVisibility(CCLayerImpl* rootLayer)
     // We are probably not testing what is intended if the rootLayer bounds are empty.
     ASSERT(!rootLayer->bounds().isEmpty());
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer, rootLayer->bounds(), 1, 0, dummyMaxTextureSize, dummyRenderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(dummyRenderSurfaceLayerList, rootLayer->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(dummyRenderSurfaceLayerList);
 }
 
 WebTransformationMatrix remove3DComponentOfMatrix(const WebTransformationMatrix& mat)
@@ -359,344 +358,6 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForSingleRenderSurface)
     EXPECT_TRANSFORMATION_MATRIX_EQ(parentCompositeTransform, child->renderTarget()->renderSurface()->screenSpaceTransform());
 }
 
-TEST(CCLayerTreeHostCommonTest, scissorRectWithClip)
-{
-    DebugScopedSetImplThread thisScopeIsOnImplThread;
-
-    /*
-      Layers are created as follows:
-
-         +--------------------+
-         |                  1 |
-         |  +-----------+     |
-         |  |         2 |     |
-         |  | +-------------------+
-         |  | |   3               |
-         |  | +-------------------+
-         |  |           |     |
-         |  +-----------+     |
-         |                    |
-         |                    |
-         +--------------------+
-
-         Layers 1, 2 have render surfaces
-     */
-    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
-    OwnPtr<CCLayerImpl> child = CCLayerImpl::create(2);
-    OwnPtr<CCLayerImpl> grandChild = CCLayerImpl::create(3);
-
-    IntRect rootRect(0, 0, 100, 100);
-    IntRect childRect(10, 10, 50, 50);
-    IntRect grandChildRect(5, 5, 150, 150);
-
-    root->setAnchorPoint(FloatPoint(0, 0));
-    root->setPosition(FloatPoint(rootRect.x(), rootRect.y()));
-    root->setBounds(IntSize(rootRect.width(), rootRect.height()));
-    root->setContentBounds(root->bounds());
-    root->setDrawsContent(true);
-
-    child->setAnchorPoint(FloatPoint(0, 0));
-    child->setPosition(FloatPoint(childRect.x(), childRect.y()));
-    child->setOpacity(0.5);
-    child->setBounds(IntSize(childRect.width(), childRect.height()));
-    child->setContentBounds(child->bounds());
-    child->setDrawsContent(true);
-
-    grandChild->setAnchorPoint(FloatPoint(0, 0));
-    grandChild->setPosition(IntPoint(grandChildRect.x(), grandChildRect.y()));
-    grandChild->setBounds(IntSize(grandChildRect.width(), grandChildRect.height()));
-    grandChild->setContentBounds(grandChild->bounds());
-    grandChild->setDrawsContent(true);
-
-    CCLayerImpl* childPtr = child.get();
-    CCLayerImpl* grandChildPtr = grandChild.get();
-
-    child->addChild(grandChild.release());
-    root->addChild(child.release());
-
-    root->setMasksToBounds(true);
-
-    Vector<CCLayerImpl*> renderSurfaceLayerList;
-    {
-        int dummyMaxTextureSize = 512;
-        CCLayerSorter layerSorter;
-        CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, &layerSorter, dummyMaxTextureSize, renderSurfaceLayerList);
-
-        FloatRect dummyDamageRect;
-        CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, dummyDamageRect);
-    }
-    
-    ASSERT_TRUE(childPtr->renderSurface());
-    ASSERT_TRUE(root->renderSurface());
-    ASSERT_FALSE(grandChildPtr->renderSurface());
-    
-    EXPECT_EQ(renderSurfaceLayerList.size(), 2U);
-    
-    ASSERT_EQ(root->renderSurface()->clipRect(), rootRect);
-    // Child surface's clipping rect is now set to root's
-    ASSERT_EQ(childPtr->renderSurface()->clipRect(), rootRect);
-    
-    // Damage the entire screen
-    IntRect rootDamage(rootRect);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    // Child's renderSurface would have expanded to include the 150x150 grandChild located at (5, 5), and then have been clipped by the parent.
-    IntRect expectedChildRenderSurfaceScissor = intersection(rootRect, IntRect(10, 10, 155, 155));
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), expectedChildRenderSurfaceScissor);
-    
-    EXPECT_EQ(root->scissorRect(), IntRect(rootRect));
-
-    // The child layer is not clipped by anything (that clip is already represented by the rootSurface clipping the child's surface)
-    // So here, the expected scissor is just the child layer's rect expressed in targetSurface (child surface) space.
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, childRect.width(), childRect.height()));
-
-    // Grand child is (indirectly) clipped by the root surface. But the scissor is expressed in the targetSurface (child surface) space.
-    EXPECT_INT_RECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 85, 85));
-    
-    // Empty damage
-    rootDamage = IntRect(0, 0, 0, 0);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Empty damage == empty scissor
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    
-    EXPECT_EQ(root->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(0, 0, 0, 0));
-    
-    // Partial damage within child
-    rootDamage = IntRect(10, 10, 20, 20);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Entire damage rect is within the root surface
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), rootDamage);
-    
-    // Entire damage rect is within the layer
-    EXPECT_EQ(root->scissorRect(), rootDamage);
-
-    // Entire damage rect is within the layer, but with different offset
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
-
-    // Grand child scissor is the damage intersected with the clipped grandChild layer rect (expressed in targetSurface space).
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 15, 15));
-
-    // Partial damage beyond child
-    rootDamage = IntRect(10, 10, 80, 80);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Entire damage rect is within the root surface
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), rootDamage);
-    
-    // Entire damage rect is within the layer
-    EXPECT_EQ(root->scissorRect(), rootDamage);
-
-    // Child layer overlaps a portion of the damage rect.
-    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
-
-    // Grand child scissor is the intersection of damage and grandChild rect, expressed in child surface.
-    // The damage fits entirely within the grandChild.
-    EXPECT_INT_RECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 75, 75));
-
-    // Partial damage beyond root
-    rootDamage = IntRect(10, 10, 110, 110);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Root damage rect is clipped at root layer boundary.
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-    EXPECT_EQ(root->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-
-    // Now the scissor rects are clipped by surfaces contentRect
-    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
-    EXPECT_INT_RECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 105, 105));
-}
-
-TEST(CCLayerTreeHostCommonTest, scissorRectWithClipAndSpaceTransform)
-{
-    DebugScopedSetImplThread thisScopeIsOnImplThread;
-
-    /*
-      Layers are created as follows:
-
-         +--------------------+
-         |                  1 |
-         |  +-----------+     |
-         |  |         2 |     |
-         |  | +-------------------+
-         |  | |   3,4             |
-         |  | +-------------------+
-         |  |           |     |
-         |  +-----------+     |
-         |                    |
-         |                    |
-         +--------------------+
-
-         Layers 1, 2 and 3 have render surfaces
-     */
-    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
-    OwnPtr<CCLayerImpl> child = CCLayerImpl::create(2);
-    OwnPtr<CCLayerImpl> grandChild = CCLayerImpl::create(3);
-    OwnPtr<CCLayerImpl> grandChild2 = CCLayerImpl::create(4);
-
-    IntRect rootRect(0, 0, 100, 100);
-    IntRect childRect(10, 10, 50, 50);
-    IntRect grandChildRect(5, 5, 150, 150);
-
-    root->setAnchorPoint(FloatPoint(0, 0));
-    root->setPosition(FloatPoint(rootRect.x(), rootRect.y()));
-    root->setBounds(IntSize(rootRect.width(), rootRect.height()));
-    root->setContentBounds(root->bounds());
-    root->setDrawsContent(true);
-
-    child->setAnchorPoint(FloatPoint(0, 0));
-    child->setPosition(FloatPoint(childRect.x(), childRect.y()));
-    child->setOpacity(0.5);
-    child->setBounds(IntSize(childRect.width(), childRect.height()));
-    child->setContentBounds(child->bounds());
-    child->setDrawsContent(true);
-
-    grandChild->setAnchorPoint(FloatPoint(0, 0));
-    grandChild->setPosition(IntPoint(grandChildRect.x(), grandChildRect.y()));
-    grandChild->setOpacity(0.5);
-    grandChild->setBounds(IntSize(grandChildRect.width(), grandChildRect.height()));
-    grandChild->setContentBounds(grandChild->bounds());
-    grandChild->setDrawsContent(true);
-
-    grandChild2->setAnchorPoint(FloatPoint(0, 0));
-    grandChild2->setPosition(IntPoint(grandChildRect.x(), grandChildRect.y()));
-    grandChild2->setOpacity(0.5);
-    grandChild2->setBounds(IntSize(grandChildRect.width(), grandChildRect.height()));
-    grandChild2->setContentBounds(grandChild2->bounds());
-    grandChild2->setDrawsContent(true);
-
-    CCLayerImpl* childPtr = child.get();
-    CCLayerImpl* grandChildPtr = grandChild.get();
-
-    grandChild->addChild(grandChild2.release());
-    child->addChild(grandChild.release());
-    root->addChild(child.release());
-
-    root->setMasksToBounds(true);
-
-    Vector<CCLayerImpl*> renderSurfaceLayerList;
-    {
-        int dummyMaxTextureSize = 512;
-        CCLayerSorter layerSorter;
-        CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, &layerSorter, dummyMaxTextureSize, renderSurfaceLayerList);
-
-        FloatRect dummyDamageRect;
-        CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, dummyDamageRect);
-    }
-    
-    ASSERT_TRUE(childPtr->renderSurface());
-    ASSERT_TRUE(root->renderSurface());
-    ASSERT_TRUE(grandChildPtr->renderSurface());
-    
-    EXPECT_EQ(renderSurfaceLayerList.size(), 3U);
-    
-    EXPECT_INT_RECT_EQ(root->renderSurface()->clipRect(), rootRect);
-    // Child surface's clipping rect is now set to root's
-    EXPECT_INT_RECT_EQ(childPtr->renderSurface()->clipRect(), rootRect);
-    
-    // Damage the entire screen
-    IntRect rootDamage(rootRect);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    ASSERT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    // Child's renderSurface would have expanded to include the grandChild1 and grandChild2, and then have been clipped by the parent.
-    IntRect expectedChildRenderSurfaceScissor = intersection(rootRect, IntRect(10, 10, 160, 160));
-    ASSERT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), expectedChildRenderSurfaceScissor);
-    
-    EXPECT_EQ(root->scissorRect(), IntRect(rootRect));
-
-    // The child layer is not clipped by anything (that clip is already represented by the rootSurface clipping the child's surface)
-    // So here, the expected scissor is just the child layer's rect expressed in targetSurface (child surface) space.
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, childRect.width(), childRect.height()));
-
-    // Grand child now draws to its own render surface, so the scissorRect is in that surface's space.
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(0, 0, rootRect.width() - childRect.x() - grandChildRect.x(), rootRect.height() - childRect.y() - grandChildRect.y()));
-    
-    // Empty damage
-    rootDamage = IntRect(0, 0, 0, 0);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Empty damage == empty scissor
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    
-    EXPECT_EQ(root->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(0, 0, 0, 0));
-    
-    // Partial damage within child
-    rootDamage = IntRect(10, 10, 20, 20);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Entire damage rect is within the root surface
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), rootDamage);
-    
-    // Entire damage rect is within the layer
-    EXPECT_EQ(root->scissorRect(), rootDamage);
-
-    // Entire damage rect is within the layer, but with different offset
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
-
-    // Grand child now gets scissored by its target surface as well as root
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width() - grandChildRect.x(), rootDamage.height() - grandChildRect.y()));
-
-    // Partial damage beyond child
-    rootDamage = IntRect(10, 10, 80, 80);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Entire damage rect is within the root surface
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), rootDamage);
-    
-    // Entire damage rect is within the layer
-    EXPECT_EQ(root->scissorRect(), rootDamage);
-
-    // Entire damage rect is within the layer, but it is still clipped with respect to the root.
-    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
-
-    // Grand child now gets scissored by its target surface as well as root
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width() - grandChildRect.x(), rootDamage.height() - grandChildRect.y()));
-
-    // Partial damage beyond root
-    rootDamage = IntRect(10, 10, 110, 110);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Root surface does not have a clipRect, so its contentRect will be used to intersect with damage.
-    // Result is that root damage rect is clipped at root layer boundary
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-    
-    // Root does not use layer clipping, so its content rect will be used to intersect with damage
-    // Result is that root damage rect is clipped at root layer boundary
-    EXPECT_EQ(root->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-
-    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
-
-    // Grandchild's scissor rect is clipped by its target surface
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width() - grandChildRect.x(), rootDamage.height() - grandChildRect.y()));
-}
-
 TEST(CCLayerTreeHostCommonTest, verifyTransformsForReplica)
 {
     RefPtr<LayerChromium> parent = LayerChromium::create();
@@ -903,6 +564,51 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForRenderSurfaceHierarchy)
     EXPECT_FLOAT_EQ(5, grandChildOfRS2->screenSpaceTransform().m42());
 }
 
+TEST(CCLayerTreeHostCommonTest, verifyTransformsForFlatteningLayer)
+{
+    // For layers that flatten their subtree, there should be an orthographic projection
+    // (for x and y values) in the middle of the transform sequence. Note that the way the
+    // code is currently implemented, it is not expected to use a canonical orthographic
+    // projection.
+
+    RefPtr<LayerChromium> root = LayerChromium::create();
+    RefPtr<LayerChromium> child = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> grandChild = adoptRef(new LayerChromiumWithForcedDrawsContent());
+
+    WebTransformationMatrix rotationAboutYAxis;
+    rotationAboutYAxis.rotate3d(0, 30, 0);
+
+    const WebTransformationMatrix identityMatrix;
+    setLayerPropertiesForTesting(root.get(), identityMatrix, identityMatrix, FloatPoint::zero(), FloatPoint::zero(), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(child.get(), rotationAboutYAxis, identityMatrix, FloatPoint::zero(), FloatPoint::zero(), IntSize(10, 10), false);
+    setLayerPropertiesForTesting(grandChild.get(), rotationAboutYAxis, identityMatrix, FloatPoint::zero(), FloatPoint::zero(), IntSize(10, 10), false);
+
+    root->addChild(child);
+    child->addChild(grandChild);
+    child->setForceRenderSurface(true);
+
+    // No layers in this test should preserve 3d.
+    ASSERT_FALSE(root->preserves3D());
+    ASSERT_FALSE(child->preserves3D());
+    ASSERT_FALSE(grandChild->preserves3D());
+
+    WebTransformationMatrix expectedChildDrawTransform = rotationAboutYAxis;
+    WebTransformationMatrix expectedChildScreenSpaceTransform = rotationAboutYAxis;
+    WebTransformationMatrix expectedGrandChildDrawTransform = rotationAboutYAxis; // draws onto child's renderSurface
+    WebTransformationMatrix expectedGrandChildScreenSpaceTransform = rotationAboutYAxis.to2dTransform() * rotationAboutYAxis;
+
+    executeCalculateDrawTransformsAndVisibility(root.get());
+
+    // The child's drawTransform should have been taken by its surface.
+    ASSERT_TRUE(child->renderSurface());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedChildDrawTransform, child->renderSurface()->drawTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedChildScreenSpaceTransform, child->renderSurface()->screenSpaceTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(identityMatrix, child->drawTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedChildScreenSpaceTransform, child->screenSpaceTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedGrandChildDrawTransform, grandChild->drawTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedGrandChildScreenSpaceTransform, grandChild->screenSpaceTransform());
+}
+
 TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceListForRenderSurfaceWithClippedLayer)
 {
     RefPtr<LayerChromium> parent = LayerChromium::create();
@@ -921,7 +627,7 @@ TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceListForRenderSurfaceWithClipp
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // The child layer's content is entirely outside the parent's clip rect, so the intermediate
     // render surface should not be listed here, even if it was forced to be created. Render surfaces without children or visible
@@ -949,7 +655,7 @@ TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceListForTransparentChild)
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Since the layer is transparent, renderSurface1->renderSurface() should not have gotten added anywhere.
     // Also, the drawable content rect should not have been extended by the children.
@@ -1605,7 +1311,7 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectCullsRenderSurfaces)
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
 
     ASSERT_EQ(2U, renderSurfaceLayerList.size());
@@ -1718,9 +1424,7 @@ TEST(CCLayerTreeHostCommonTest, verifyDrawableContentRectForLayers)
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
-
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     EXPECT_INT_RECT_EQ(IntRect(IntPoint(5, 5), IntSize(10, 10)), grandChild1->drawableContentRect());
     EXPECT_INT_RECT_EQ(IntRect(IntPoint(15, 15), IntSize(5, 5)), grandChild3->drawableContentRect());
@@ -1786,8 +1490,7 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectIsPropagatedCorrectlyToSurfaces)
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     ASSERT_TRUE(grandChild1->renderSurface());
     ASSERT_TRUE(grandChild2->renderSurface());
@@ -2438,8 +2141,7 @@ TEST(CCLayerTreeHostCommonTest, verifyBackFaceCullingWithAnimatingTransforms)
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     EXPECT_FALSE(child->renderSurface());
     EXPECT_TRUE(animatingSurface->renderSurface());
@@ -2560,7 +2262,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSingleLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2610,7 +2312,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForUninvertibleTransform)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2665,7 +2367,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSinglePositionedLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2713,7 +2415,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSingleRotatedLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2770,7 +2472,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSinglePerspectiveLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2835,7 +2537,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSingleLayerWithScaledContents
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     // The visibleContentRect for testLayer is actually 100x100, even though its layout size is 50x50, positioned at 25x25.
@@ -2900,7 +2602,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSimpleClippedLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2991,7 +2693,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForMultiClippedRotatedLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     // The grandChild is expected to create a renderSurface because it masksToBounds and is not axis aligned.
@@ -3039,6 +2741,70 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForMultiClippedRotatedLayer)
     EXPECT_EQ(2468, resultLayer->id());
 }
 
+TEST(CCLayerTreeHostCommonTest, verifyHitTestingForNonClippingIntermediateLayer)
+{
+    // This test checks that hit testing code does not accidentally clip to layer
+    // bounds for a layer that actually does not clip.
+    DebugScopedSetImplThread thisScopeIsOnImplThread;
+
+    WebTransformationMatrix identityMatrix;
+    FloatPoint anchor(0, 0);
+
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    setLayerPropertiesForTesting(root.get(), identityMatrix, identityMatrix, anchor, FloatPoint(0, 0), IntSize(100, 100), false);
+
+    {
+        OwnPtr<CCLayerImpl> intermediateLayer = CCLayerImpl::create(123);
+        FloatPoint position(10, 10); // this layer is positioned, and hit testing should correctly know where the layer is located.
+        IntSize bounds(50, 50);
+        setLayerPropertiesForTesting(intermediateLayer.get(), identityMatrix, identityMatrix, anchor, position, bounds, false);
+        // Sanity check the intermediate layer should not clip.
+        ASSERT_FALSE(intermediateLayer->masksToBounds());
+        ASSERT_FALSE(intermediateLayer->maskLayer());
+
+        // The child of the intermediateLayer is translated so that it does not overlap intermediateLayer at all.
+        // If child is incorrectly clipped, we would not be able to hit it successfully.
+        OwnPtr<CCLayerImpl> child = CCLayerImpl::create(456);
+        position = FloatPoint(60, 60); // 70, 70 in screen space
+        bounds = IntSize(20, 20);
+        setLayerPropertiesForTesting(child.get(), identityMatrix, identityMatrix, anchor, position, bounds, false);
+        child->setDrawsContent(true);
+        intermediateLayer->addChild(child.release());
+        root->addChild(intermediateLayer.release());
+    }
+
+    Vector<CCLayerImpl*> renderSurfaceLayerList;
+    int dummyMaxTextureSize = 512;
+    CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
+
+    // Sanity check the scenario we just created.
+    ASSERT_EQ(1u, renderSurfaceLayerList.size());
+    ASSERT_EQ(1u, root->renderSurface()->layerList().size());
+    ASSERT_EQ(456, root->renderSurface()->layerList()[0]->id());
+
+    // Hit testing for a point outside the layer should return a null pointer.
+    IntPoint testPoint(69, 69);
+    CCLayerImpl* resultLayer = CCLayerTreeHostCommon::findLayerThatIsHitByPoint(testPoint, renderSurfaceLayerList);
+    EXPECT_FALSE(resultLayer);
+
+    testPoint = IntPoint(91, 91);
+    resultLayer = CCLayerTreeHostCommon::findLayerThatIsHitByPoint(testPoint, renderSurfaceLayerList);
+    EXPECT_FALSE(resultLayer);
+
+    // Hit testing for a point inside should return the child layer.
+    testPoint = IntPoint(71, 71);
+    resultLayer = CCLayerTreeHostCommon::findLayerThatIsHitByPoint(testPoint, renderSurfaceLayerList);
+    ASSERT_TRUE(resultLayer);
+    EXPECT_EQ(456, resultLayer->id());
+
+    testPoint = IntPoint(89, 89);
+    resultLayer = CCLayerTreeHostCommon::findLayerThatIsHitByPoint(testPoint, renderSurfaceLayerList);
+    ASSERT_TRUE(resultLayer);
+    EXPECT_EQ(456, resultLayer->id());
+}
+
+
 TEST(CCLayerTreeHostCommonTest, verifyHitTestingForMultipleLayers)
 {
     DebugScopedSetImplThread thisScopeIsOnImplThread;
@@ -3091,7 +2857,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForMultipleLayers)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_TRUE(child1);
@@ -3200,7 +2966,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForMultipleLayerLists)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_TRUE(child1);
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
index 53c312cf5..2c14a1cc3 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
@@ -30,8 +30,11 @@
 #include "CCLayerTestCommon.h"
 #include "CCLayerTreeTestCommon.h"
 #include "CCTestCommon.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "FakeWebGraphicsContext3D.h"
+#include "FakeWebScrollbarThemeGeometry.h"
 #include "LayerRendererChromium.h"
+#include "cc/CCHeadsUpDisplayLayerImpl.h"
 #include "cc/CCIOSurfaceLayerImpl.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTilingData.h"
@@ -74,11 +77,12 @@ public:
 
         m_hostImpl = CCLayerTreeHostImpl::create(settings, this);
         m_hostImpl->initializeLayerRenderer(createContext(), UnthrottledUploader);
-        m_hostImpl->setViewportSize(IntSize(10, 10));
+        m_hostImpl->setViewportSize(IntSize(10, 10), IntSize(10, 10));
     }
 
     virtual void didLoseContextOnImplThread() OVERRIDE { }
     virtual void onSwapBuffersCompleteOnImplThread() OVERRIDE { }
+    virtual void onVSyncParametersChanged(double, double) OVERRIDE { }
     virtual void setNeedsRedrawOnImplThread() OVERRIDE { m_didRequestRedraw = true; }
     virtual void setNeedsCommitOnImplThread() OVERRIDE { m_didRequestCommit = true; }
     virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) OVERRIDE { }
@@ -93,7 +97,7 @@ public:
         OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
         myHostImpl->initializeLayerRenderer(graphicsContext, UnthrottledUploader);
-        myHostImpl->setViewportSize(IntSize(10, 10));
+        myHostImpl->setViewportSize(IntSize(10, 10), IntSize(10, 10));
 
         OwnPtr<CCLayerImpl> root = rootPtr;
 
@@ -174,7 +178,7 @@ public:
 protected:
     PassOwnPtr<CCGraphicsContext> createContext()
     {
-        return CCGraphicsContext::create3D(adoptPtr(new FakeWebGraphicsContext3D));
+        return FakeWebCompositorOutputSurface::create(adoptPtr(new FakeWebGraphicsContext3D));
     }
 
     DebugScopedSetImplThread m_alwaysImplThread;
@@ -256,7 +260,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollDeltaRepeatedScrolls)
 TEST_F(CCLayerTreeHostImplTest, scrollRootCallsCommitAndRedraw)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(0, 0), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollStarted);
@@ -277,7 +281,7 @@ TEST_F(CCLayerTreeHostImplTest, replaceTreeWhileScrolling)
     const int scrollLayerId = 1;
 
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     // We should not crash if the tree is replaced while we are scrolling.
@@ -297,7 +301,7 @@ TEST_F(CCLayerTreeHostImplTest, replaceTreeWhileScrolling)
 TEST_F(CCLayerTreeHostImplTest, clearRootRenderSurfaceAndScroll)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     // We should be able to scroll even if the root layer loses its render surface after the most
@@ -309,7 +313,7 @@ TEST_F(CCLayerTreeHostImplTest, clearRootRenderSurfaceAndScroll)
 TEST_F(CCLayerTreeHostImplTest, wheelEventHandlers)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
     CCLayerImpl* root = m_hostImpl->rootLayer();
 
@@ -325,7 +329,7 @@ TEST_F(CCLayerTreeHostImplTest, wheelEventHandlers)
 TEST_F(CCLayerTreeHostImplTest, shouldScrollOnMainThread)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
     CCLayerImpl* root = m_hostImpl->rootLayer();
 
@@ -338,7 +342,7 @@ TEST_F(CCLayerTreeHostImplTest, shouldScrollOnMainThread)
 TEST_F(CCLayerTreeHostImplTest, nonFastScrollableRegionBasic)
 {
     setupScrollAndContentsLayers(IntSize(200, 200));
-    m_hostImpl->setViewportSize(IntSize(100, 100));
+    m_hostImpl->setViewportSize(IntSize(100, 100), IntSize(100, 100));
     initializeLayerRendererAndDrawFrame();
     CCLayerImpl* root = m_hostImpl->rootLayer();
 
@@ -360,7 +364,7 @@ TEST_F(CCLayerTreeHostImplTest, nonFastScrollableRegionBasic)
 TEST_F(CCLayerTreeHostImplTest, nonFastScrollableRegionWithOffset)
 {
     setupScrollAndContentsLayers(IntSize(200, 200));
-    m_hostImpl->setViewportSize(IntSize(100, 100));
+    m_hostImpl->setViewportSize(IntSize(100, 100), IntSize(100, 100));
     CCLayerImpl* root = m_hostImpl->rootLayer();
 
     root->setNonFastScrollableRegion(IntRect(0, 0, 50, 50));
@@ -379,7 +383,7 @@ TEST_F(CCLayerTreeHostImplTest, nonFastScrollableRegionWithOffset)
 TEST_F(CCLayerTreeHostImplTest, pinchGesture)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     CCLayerImpl* scrollLayer = m_hostImpl->rootScrollLayer();
@@ -460,7 +464,7 @@ TEST_F(CCLayerTreeHostImplTest, pinchGesture)
 TEST_F(CCLayerTreeHostImplTest, pageScaleAnimation)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     CCLayerImpl* scrollLayer = m_hostImpl->rootScrollLayer();
@@ -510,7 +514,7 @@ TEST_F(CCLayerTreeHostImplTest, pageScaleAnimation)
 TEST_F(CCLayerTreeHostImplTest, inhibitScrollAndPageScaleUpdatesWhilePinchZooming)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     CCLayerImpl* scrollLayer = m_hostImpl->rootScrollLayer();
@@ -564,7 +568,7 @@ TEST_F(CCLayerTreeHostImplTest, inhibitScrollAndPageScaleUpdatesWhilePinchZoomin
 TEST_F(CCLayerTreeHostImplTest, inhibitScrollAndPageScaleUpdatesWhileAnimatingPageScale)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     CCLayerImpl* scrollLayer = m_hostImpl->rootScrollLayer();
@@ -696,7 +700,7 @@ TEST_F(CCLayerTreeHostImplTest, didDrawNotCalledOnHiddenLayer)
 TEST_F(CCLayerTreeHostImplTest, willDrawNotCalledOnOccludedLayer)
 {
     IntSize bigSize(1000, 1000);
-    m_hostImpl->setViewportSize(bigSize);
+    m_hostImpl->setViewportSize(bigSize, bigSize);
 
     m_hostImpl->setRootLayer(DidDrawCheckLayer::create(1));
     DidDrawCheckLayer* root = static_cast<DidDrawCheckLayer*>(m_hostImpl->rootLayer());
@@ -841,7 +845,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollNonCompositedRoot)
     IntSize surfaceSize(10, 10);
 
     OwnPtr<CCLayerImpl> contentLayer = CCLayerImpl::create(1);
-    contentLayer->setIsNonCompositedContent(true);
+    contentLayer->setUseLCDText(true);
     contentLayer->setDrawsContent(true);
     contentLayer->setPosition(FloatPoint(0, 0));
     contentLayer->setAnchorPoint(FloatPoint(0, 0));
@@ -858,7 +862,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollNonCompositedRoot)
     scrollLayer->addChild(contentLayer.release());
 
     m_hostImpl->setRootLayer(scrollLayer.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(5, 5), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollStarted);
@@ -876,7 +880,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollChildCallsCommitAndRedraw)
     root->setContentBounds(surfaceSize);
     root->addChild(createScrollableLayer(2, FloatPoint(0, 0), surfaceSize));
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(5, 5), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollStarted);
@@ -892,7 +896,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollMissesChild)
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     root->addChild(createScrollableLayer(2, FloatPoint(0, 0), surfaceSize));
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     // Scroll event is ignored because the input coordinate is outside the layer boundaries.
@@ -906,7 +910,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollMissesBackfacingChild)
     IntSize surfaceSize(10, 10);
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     OwnPtr<CCLayerImpl> child = createScrollableLayer(2, FloatPoint(0, 0), surfaceSize);
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
 
     WebTransformationMatrix matrix;
     matrix.rotate3d(180, 0, 0);
@@ -935,7 +939,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollBlockedByContentLayer)
     scrollLayer->addChild(contentLayer.release());
 
     m_hostImpl->setRootLayer(scrollLayer.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     // Scrolling fails because the content layer is asking to be scrolled on the main thread.
@@ -948,7 +952,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollRootAndChangePageScaleOnMainThread)
     float pageScale = 2;
     OwnPtr<CCLayerImpl> root = createScrollableLayer(1, FloatPoint(0, 0), surfaceSize);
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     IntSize scrollDelta(0, 10);
@@ -979,7 +983,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollRootAndChangePageScaleOnImplThread)
     float pageScale = 2;
     OwnPtr<CCLayerImpl> root = createScrollableLayer(1, FloatPoint(0, 0), surfaceSize);
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     m_hostImpl->setPageScaleFactorAndLimits(1, 1, pageScale);
     initializeLayerRendererAndDrawFrame();
 
@@ -1057,7 +1061,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollChildAndChangePageScaleOnMainThread)
     int scrollLayerId = 2;
     root->addChild(createScrollableLayer(scrollLayerId, FloatPoint(0, 0), surfaceSize));
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     CCLayerImpl* child = m_hostImpl->rootLayer()->children()[0].get();
@@ -1101,7 +1105,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollChildBeyondLimit)
 
     root->addChild(child.release());
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
     {
         IntSize scrollDelta(-3, -7);
@@ -1133,7 +1137,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollEventBubbling)
     root->addChild(child.release());
 
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
     {
         IntSize scrollDelta(0, 4);
@@ -1153,7 +1157,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollBeforeRedraw)
 {
     IntSize surfaceSize(10, 10);
     m_hostImpl->setRootLayer(createScrollableLayer(1, FloatPoint(0, 0), surfaceSize));
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
 
     // Draw one frame and then immediately rebuild the layer tree to mimic a tree synchronization.
     initializeLayerRendererAndDrawFrame();
@@ -1471,7 +1475,7 @@ TEST_F(CCLayerTreeHostImplTest, viewportCovered)
     m_hostImpl->setBackgroundColor(SK_ColorGRAY);
 
     IntSize viewportSize(1000, 1000);
-    m_hostImpl->setViewportSize(viewportSize);
+    m_hostImpl->setViewportSize(viewportSize, viewportSize);
 
     m_hostImpl->setRootLayer(BlendStateCheckLayer::create(1, m_hostImpl->resourceProvider()));
     BlendStateCheckLayer* root = static_cast<BlendStateCheckLayer*>(m_hostImpl->rootLayer());
@@ -1576,7 +1580,7 @@ public:
 // viewport size is never set.
 TEST_F(CCLayerTreeHostImplTest, reshapeNotCalledUntilDraw)
 {
-    OwnPtr<CCGraphicsContext> ccContext = CCGraphicsContext::create3D(adoptPtr(new ReshapeTrackerContext));
+    OwnPtr<CCGraphicsContext> ccContext = FakeWebCompositorOutputSurface::create(adoptPtr(new ReshapeTrackerContext));
     ReshapeTrackerContext* reshapeTracker = static_cast<ReshapeTrackerContext*>(ccContext->context3D());
     m_hostImpl->initializeLayerRenderer(ccContext.release(), UnthrottledUploader);
 
@@ -1619,7 +1623,7 @@ private:
 // where it should request to swap only the subBuffer that is damaged.
 TEST_F(CCLayerTreeHostImplTest, partialSwapReceivesDamageRect)
 {
-    OwnPtr<CCGraphicsContext> ccContext = CCGraphicsContext::create3D(adoptPtr(new PartialSwapTrackerContext));
+    OwnPtr<CCGraphicsContext> ccContext = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapTrackerContext));
     PartialSwapTrackerContext* partialSwapTracker = static_cast<PartialSwapTrackerContext*>(ccContext->context3D());
 
     // This test creates its own CCLayerTreeHostImpl, so
@@ -1628,7 +1632,7 @@ TEST_F(CCLayerTreeHostImplTest, partialSwapReceivesDamageRect)
     CCSettings::setPartialSwapEnabled(true);
     OwnPtr<CCLayerTreeHostImpl> layerTreeHostImpl = CCLayerTreeHostImpl::create(settings, this);
     layerTreeHostImpl->initializeLayerRenderer(ccContext.release(), UnthrottledUploader);
-    layerTreeHostImpl->setViewportSize(IntSize(500, 500));
+    layerTreeHostImpl->setViewportSize(IntSize(500, 500), IntSize(500, 500));
 
     CCLayerImpl* root = new FakeDrawableCCLayerImpl(1);
     CCLayerImpl* child = new FakeDrawableCCLayerImpl(2);
@@ -1677,7 +1681,7 @@ TEST_F(CCLayerTreeHostImplTest, partialSwapReceivesDamageRect)
     // Make sure that partial swap is constrained to the viewport dimensions
     // expected damage rect: IntRect(IntPoint::zero(), IntSize(500, 500));
     // expected swap rect: flipped damage rect, but also clamped to viewport
-    layerTreeHostImpl->setViewportSize(IntSize(10, 10));
+    layerTreeHostImpl->setViewportSize(IntSize(10, 10), IntSize(10, 10));
     root->setOpacity(0.7f); // this will damage everything
     EXPECT_TRUE(layerTreeHostImpl->prepareToDraw(frame));
     layerTreeHostImpl->drawLayers(frame);
@@ -1748,6 +1752,7 @@ public:
     MOCK_METHOD1(getString, WebString(WGC3Denum name));
     MOCK_METHOD0(getRequestableExtensionsCHROMIUM, WebString());
     MOCK_METHOD1(enable, void(WGC3Denum cap));
+    MOCK_METHOD1(disable, void(WGC3Denum cap));
     MOCK_METHOD4(scissor, void(WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height));
 };
 
@@ -1786,6 +1791,10 @@ public:
         // Any un-sanctioned calls to enable() are OK
         EXPECT_CALL(*m_context, enable(_))
             .WillRepeatedly(Return());
+
+        // Any un-sanctioned calls to disable() are OK
+        EXPECT_CALL(*m_context, disable(_))
+            .WillRepeatedly(Return());
     }
 
     void mustDrawSolidQuad()
@@ -1811,16 +1820,27 @@ public:
             .WillRepeatedly(Return());
     }
 
+    void mustSetNoScissor()
+    {
+        EXPECT_CALL(*m_context, disable(GraphicsContext3D::SCISSOR_TEST))
+            .WillRepeatedly(Return());
+
+        EXPECT_CALL(*m_context, enable(GraphicsContext3D::SCISSOR_TEST))
+            .Times(0);
+
+        EXPECT_CALL(*m_context, scissor(_, _, _, _))
+            .Times(0);
+    }
 };
 
 TEST_F(CCLayerTreeHostImplTest, noPartialSwap)
 {
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new MockContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new MockContext));
     MockContext* mockContext = static_cast<MockContext*>(context->context3D());
     MockContextHarness harness(mockContext);
 
     harness.mustDrawSolidQuad();
-    harness.mustSetScissor(0, 0, 10, 10);
+    harness.mustSetNoScissor();
 
     // Run test case
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = createLayerTreeHost(false, context.release(), FakeLayerWithQuads::create(1));
@@ -1834,50 +1854,35 @@ TEST_F(CCLayerTreeHostImplTest, noPartialSwap)
 
 TEST_F(CCLayerTreeHostImplTest, partialSwap)
 {
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new MockContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new MockContext));
     MockContext* mockContext = static_cast<MockContext*>(context->context3D());
     MockContextHarness harness(mockContext);
 
-    harness.mustDrawSolidQuad();
-    harness.mustSetScissor(0, 0, 10, 10);
-
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = createLayerTreeHost(true, context.release(), FakeLayerWithQuads::create(1));
 
-    CCLayerTreeHostImpl::FrameData frame;
-    EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-    myHostImpl->drawLayers(frame);
-    myHostImpl->didDrawAllLayers(frame);
+    // The first frame is not a partially-swapped one.
+    harness.mustSetNoScissor();
+    harness.mustDrawSolidQuad();
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
     Mock::VerifyAndClearExpectations(&mockContext);
-}
 
-TEST_F(CCLayerTreeHostImplTest, partialSwapNoUpdate)
-{
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new MockContext));
-    MockContext* mockContext = static_cast<MockContext*>(context->context3D());
-    MockContextHarness harness(mockContext);
+    // Damage a portion of the frame.
+    myHostImpl->rootLayer()->setUpdateRect(IntRect(0, 0, 2, 3));
 
+    // The second frame will be partially-swapped (the y coordinates are flipped).
+    harness.mustSetScissor(0, 7, 2, 3);
     harness.mustDrawSolidQuad();
-    harness.mustSetScissor(0, 8, 2, 2);
-    harness.mustDrawSolidQuad();
-    harness.mustSetScissor(0, 0, 10, 10);
-
-    OwnPtr<CCLayerTreeHostImpl> myHostImpl = createLayerTreeHost(true, context.release(), FakeLayerWithQuads::create(1));
-
-    // Draw once to make sure layer is not new
-    CCLayerTreeHostImpl::FrameData frame;
-    EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-    myHostImpl->drawLayers(frame);
-    myHostImpl->didDrawAllLayers(frame);
-
-    // Generate update in layer
-    CCLayerImpl* root = myHostImpl->rootLayer();
-    root->setUpdateRect(FloatRect(0, 0, 2, 2));
-
-    // This draw should generate no new udpates
-    EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-    myHostImpl->drawLayers(frame);
-    myHostImpl->didDrawAllLayers(frame);
-
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
     Mock::VerifyAndClearExpectations(&mockContext);
 }
 
@@ -1907,12 +1912,12 @@ static PassOwnPtr<CCLayerTreeHostImpl> setupLayersForOpacity(bool partialSwap, C
 {
     CCSettings::setPartialSwapEnabled(partialSwap);
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     CCLayerTreeSettings settings;
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, client);
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(100, 100));
+    myHostImpl->setViewportSize(IntSize(100, 100), IntSize(100, 100));
 
     /*
       Layers are created as follows:
@@ -2013,59 +2018,6 @@ TEST_F(CCLayerTreeHostImplTest, contributingLayerEmptyScissorNoPartialSwap)
     }
 }
 
-TEST_F(CCLayerTreeHostImplTest, didDrawNotCalledOnScissoredLayer)
-{
-    CCLayerTreeSettings settings;
-    CCSettings::setPartialSwapEnabled(true);
-
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
-    OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
-    myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(10, 10));
-
-    myHostImpl->setRootLayer(DidDrawCheckLayer::create(1));
-    DidDrawCheckLayer* root = static_cast<DidDrawCheckLayer*>(myHostImpl->rootLayer());
-    root->setMasksToBounds(true);
-
-    root->addChild(DidDrawCheckLayer::create(2));
-    DidDrawCheckLayer* layer = static_cast<DidDrawCheckLayer*>(root->children()[0].get());
-
-    CCLayerTreeHostImpl::FrameData frame;
-
-    EXPECT_FALSE(root->willDrawCalled());
-    EXPECT_FALSE(root->didDrawCalled());
-    EXPECT_FALSE(layer->willDrawCalled());
-    EXPECT_FALSE(layer->didDrawCalled());
-
-    // We should draw everything the first frame.
-    EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-    myHostImpl->drawLayers(frame);
-    myHostImpl->didDrawAllLayers(frame);
-
-    EXPECT_TRUE(root->willDrawCalled());
-    EXPECT_TRUE(root->didDrawCalled());
-    EXPECT_TRUE(layer->willDrawCalled());
-    EXPECT_TRUE(layer->didDrawCalled());
-
-    root->clearDidDrawCheck();
-    layer->clearDidDrawCheck();
-
-    EXPECT_FALSE(root->willDrawCalled());
-    EXPECT_FALSE(root->didDrawCalled());
-    EXPECT_FALSE(layer->willDrawCalled());
-    EXPECT_FALSE(layer->didDrawCalled());
-
-    // Drawing again, we should scissor out everything since there is no damage.
-    EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-    myHostImpl->drawLayers(frame);
-    myHostImpl->didDrawAllLayers(frame);
-
-    EXPECT_FALSE(root->willDrawCalled());
-    EXPECT_FALSE(root->didDrawCalled());
-    EXPECT_FALSE(layer->willDrawCalled());
-    EXPECT_FALSE(layer->didDrawCalled());
-}
-
 // Make sure that context lost notifications are propagated through the tree.
 class ContextLostNotificationCheckLayer : public CCLayerImpl {
 public:
@@ -2118,20 +2070,10 @@ public:
 TEST_F(CCLayerTreeHostImplTest, finishAllRenderingAfterContextLost)
 {
     // The context initialization will fail, but we should still be able to call finishAllRendering() without any ill effects.
-    m_hostImpl->initializeLayerRenderer(CCGraphicsContext::create3D(adoptPtr(new FakeWebGraphicsContext3DMakeCurrentFails)), UnthrottledUploader);
+    m_hostImpl->initializeLayerRenderer(FakeWebCompositorOutputSurface::create(adoptPtr(new FakeWebGraphicsContext3DMakeCurrentFails)), UnthrottledUploader);
     m_hostImpl->finishAllRendering();
 }
 
-class ScrollbarLayerFakePaint : public CCScrollbarLayerImpl {
-public:
-    static PassOwnPtr<ScrollbarLayerFakePaint> create(int id) { return adoptPtr(new ScrollbarLayerFakePaint(id)); }
-
-    virtual void paint(GraphicsContext*) { }
-
-private:
-    ScrollbarLayerFakePaint(int id) : CCScrollbarLayerImpl(id) { }
-};
-
 // Fake WebGraphicsContext3D that will cause a failure if trying to use a
 // resource that wasn't created by it (resources created by
 // FakeWebGraphicsContext3D have an id of 1).
@@ -2235,25 +2177,28 @@ private:
 // Fake video frame that represents a 4x4 YUV video frame.
 class FakeVideoFrame: public WebVideoFrame {
 public:
-    FakeVideoFrame() { memset(m_data, 0x80, sizeof(m_data)); }
+    FakeVideoFrame() : m_textureId(0) { memset(m_data, 0x80, sizeof(m_data)); }
     virtual ~FakeVideoFrame() { }
-    virtual Format format() const { return FormatYV12; }
+    virtual Format format() const { return m_textureId ? FormatNativeTexture : FormatYV12; }
     virtual unsigned width() const { return 4; }
     virtual unsigned height() const { return 4; }
     virtual unsigned planes() const { return 3; }
     virtual int stride(unsigned plane) const { return 4; }
     virtual const void* data(unsigned plane) const { return m_data; }
-    virtual unsigned textureId() const { return 0; }
-    virtual unsigned textureTarget() const { return 0; }
+    virtual unsigned textureId() const { return m_textureId; }
+    virtual unsigned textureTarget() const { return m_textureId ? GraphicsContext3D::TEXTURE_2D : 0; }
+
+    void setTextureId(unsigned id) { m_textureId = id; }
 
 private:
     char m_data[16];
+    unsigned m_textureId;
 };
 
 // Fake video frame provider that always provides the same FakeVideoFrame.
 class FakeVideoFrameProvider: public WebVideoFrameProvider {
 public:
-    FakeVideoFrameProvider() : m_client(0) { }
+    FakeVideoFrameProvider() : m_frame(0), m_client(0) { }
     virtual ~FakeVideoFrameProvider()
     {
         if (m_client)
@@ -2261,11 +2206,13 @@ public:
     }
 
     virtual void setVideoFrameProviderClient(Client* client) { m_client = client; }
-    virtual WebVideoFrame* getCurrentFrame() { return &m_frame; }
+    virtual WebVideoFrame* getCurrentFrame() { return m_frame; }
     virtual void putCurrentFrame(WebVideoFrame*) { }
 
+    void setFrame(WebVideoFrame* frame) { m_frame = frame; }
+
 private:
-    FakeVideoFrame m_frame;
+    WebVideoFrame* m_frame;
     Client* m_client;
 };
 
@@ -2291,6 +2238,45 @@ public:
     }
 };
 
+class FakeWebScrollbarThemeGeometryNonEmpty : public FakeWebScrollbarThemeGeometry {
+    virtual WebRect trackRect(WebScrollbar*) OVERRIDE { return WebRect(0, 0, 10, 10); }
+    virtual WebRect thumbRect(WebScrollbar*) OVERRIDE { return WebRect(0, 5, 5, 2); }
+    virtual void splitTrack(WebScrollbar*, const WebRect& track, WebRect& startTrack, WebRect& thumb, WebRect& endTrack) OVERRIDE
+    {
+        thumb = WebRect(0, 5, 5, 2);
+        startTrack = WebRect(0, 5, 0, 5);
+        endTrack = WebRect(0, 0, 0, 5);
+    }
+};
+
+class FakeScrollbarLayerImpl : public CCScrollbarLayerImpl {
+public:
+    static PassOwnPtr<FakeScrollbarLayerImpl> create(int id)
+    {
+        return adoptPtr(new FakeScrollbarLayerImpl(id));
+    }
+
+    void createResources(CCResourceProvider* provider)
+    {
+        ASSERT(provider);
+        int pool = 0;
+        IntSize size(10, 10);
+        GC3Denum format = GraphicsContext3D::RGBA;
+        CCResourceProvider::TextureUsageHint hint = CCResourceProvider::TextureUsageAny;
+        setScrollbarGeometry(FakeWebScrollbarThemeGeometryNonEmpty::create());
+
+        setBackTrackResourceId(provider->createResource(pool, size, format, hint));
+        setForeTrackResourceId(provider->createResource(pool, size, format, hint));
+        setThumbResourceId(provider->createResource(pool, size, format, hint));
+    }
+
+protected:
+    explicit FakeScrollbarLayerImpl(int id)
+        : CCScrollbarLayerImpl(id)
+    {
+    }
+};
+
 TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
 {
     OwnPtr<CCLayerImpl> rootLayer(CCLayerImpl::create(1));
@@ -2317,7 +2303,9 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
     textureLayer->setTextureId(1);
     rootLayer->addChild(textureLayer.release());
 
+    FakeVideoFrame videoFrame;
     FakeVideoFrameProvider provider;
+    provider.setFrame(&videoFrame);
     OwnPtr<CCVideoLayerImpl> videoLayer = CCVideoLayerImpl::create(4, &provider);
     videoLayer->setBounds(IntSize(10, 10));
     videoLayer->setAnchorPoint(FloatPoint(0, 0));
@@ -2326,7 +2314,18 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
     videoLayer->setLayerTreeHostImpl(m_hostImpl.get());
     rootLayer->addChild(videoLayer.release());
 
-    OwnPtr<CCIOSurfaceLayerImpl> ioSurfaceLayer = CCIOSurfaceLayerImpl::create(5);
+    FakeVideoFrame hwVideoFrame;
+    FakeVideoFrameProvider hwProvider;
+    hwProvider.setFrame(&hwVideoFrame);
+    OwnPtr<CCVideoLayerImpl> hwVideoLayer = CCVideoLayerImpl::create(5, &hwProvider);
+    hwVideoLayer->setBounds(IntSize(10, 10));
+    hwVideoLayer->setAnchorPoint(FloatPoint(0, 0));
+    hwVideoLayer->setContentBounds(IntSize(10, 10));
+    hwVideoLayer->setDrawsContent(true);
+    hwVideoLayer->setLayerTreeHostImpl(m_hostImpl.get());
+    rootLayer->addChild(hwVideoLayer.release());
+
+    OwnPtr<CCIOSurfaceLayerImpl> ioSurfaceLayer = CCIOSurfaceLayerImpl::create(6);
     ioSurfaceLayer->setBounds(IntSize(10, 10));
     ioSurfaceLayer->setAnchorPoint(FloatPoint(0, 0));
     ioSurfaceLayer->setContentBounds(IntSize(10, 10));
@@ -2335,8 +2334,27 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
     ioSurfaceLayer->setLayerTreeHostImpl(m_hostImpl.get());
     rootLayer->addChild(ioSurfaceLayer.release());
 
+    OwnPtr<CCHeadsUpDisplayLayerImpl> hudLayer = CCHeadsUpDisplayLayerImpl::create(7);
+    hudLayer->setBounds(IntSize(10, 10));
+    hudLayer->setAnchorPoint(FloatPoint(0, 0));
+    hudLayer->setContentBounds(IntSize(10, 10));
+    hudLayer->setDrawsContent(true);
+    hudLayer->setLayerTreeHostImpl(m_hostImpl.get());
+    rootLayer->addChild(hudLayer.release());
+
+    OwnPtr<FakeScrollbarLayerImpl> scrollbarLayer(FakeScrollbarLayerImpl::create(8));
+    scrollbarLayer->setLayerTreeHostImpl(m_hostImpl.get());
+    scrollbarLayer->setBounds(IntSize(10, 10));
+    scrollbarLayer->setContentBounds(IntSize(10, 10));
+    scrollbarLayer->setDrawsContent(true);
+    scrollbarLayer->setLayerTreeHostImpl(m_hostImpl.get());
+    scrollbarLayer->createResources(m_hostImpl->resourceProvider());
+    rootLayer->addChild(scrollbarLayer.release());
+
     // Use a context that supports IOSurfaces
-    m_hostImpl->initializeLayerRenderer(CCGraphicsContext::create3D(adoptPtr(new FakeWebGraphicsContext3DWithIOSurface)), UnthrottledUploader);
+    m_hostImpl->initializeLayerRenderer(FakeWebCompositorOutputSurface::create(adoptPtr(new FakeWebGraphicsContext3DWithIOSurface)), UnthrottledUploader);
+
+    hwVideoFrame.setTextureId(m_hostImpl->resourceProvider()->graphicsContext3D()->createTexture());
 
     m_hostImpl->setRootLayer(rootLayer.release());
 
@@ -2346,9 +2364,29 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
     m_hostImpl->didDrawAllLayers(frame);
     m_hostImpl->swapBuffers();
 
+    unsigned numResources = m_hostImpl->resourceProvider()->numResources();
+
     // Lose the context, replacing it with a StrictWebGraphicsContext3DWithIOSurface,
     // that will warn if any resource from the previous context gets used.
-    m_hostImpl->initializeLayerRenderer(CCGraphicsContext::create3D(adoptPtr(new StrictWebGraphicsContext3DWithIOSurface)), UnthrottledUploader);
+    m_hostImpl->initializeLayerRenderer(FakeWebCompositorOutputSurface::create(adoptPtr(new StrictWebGraphicsContext3DWithIOSurface)), UnthrottledUploader);
+
+    // Create dummy resources so that looking up an old resource will get an
+    // invalid texture id mapping.
+    for (unsigned i = 0; i < numResources; ++i)
+        m_hostImpl->resourceProvider()->createResourceFromExternalTexture(1);
+
+    // The WebVideoFrameProvider is expected to recreate its textures after a
+    // lost context (or not serve a frame).
+    hwProvider.setFrame(0);
+
+    EXPECT_TRUE(m_hostImpl->prepareToDraw(frame));
+    m_hostImpl->drawLayers(frame);
+    m_hostImpl->didDrawAllLayers(frame);
+    m_hostImpl->swapBuffers();
+
+    hwVideoFrame.setTextureId(m_hostImpl->resourceProvider()->graphicsContext3D()->createTexture());
+    hwProvider.setFrame(&hwVideoFrame);
+
     EXPECT_TRUE(m_hostImpl->prepareToDraw(frame));
     m_hostImpl->drawLayers(frame);
     m_hostImpl->didDrawAllLayers(frame);
@@ -2441,7 +2479,7 @@ TEST_F(CCLayerTreeHostImplTest, layersFreeTextures)
     rootLayer->addChild(ioSurfaceLayer.release());
 
     // Lose the context, replacing it with a TrackingWebGraphicsContext3D (which the CCLayerTreeHostImpl takes ownership of).
-    OwnPtr<CCGraphicsContext> ccContext(CCGraphicsContext::create3D(adoptPtr(new TrackingWebGraphicsContext3D)));
+    OwnPtr<CCGraphicsContext> ccContext(FakeWebCompositorOutputSurface::create(adoptPtr(new TrackingWebGraphicsContext3D)));
     TrackingWebGraphicsContext3D* trackingWebGraphicsContext = static_cast<TrackingWebGraphicsContext3D*>(ccContext->context3D());
     m_hostImpl->initializeLayerRenderer(ccContext.release(), UnthrottledUploader);
 
@@ -2469,7 +2507,7 @@ public:
 
 TEST_F(CCLayerTreeHostImplTest, hasTransparentBackground)
 {
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new MockDrawQuadsToFillScreenContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new MockDrawQuadsToFillScreenContext));
     MockDrawQuadsToFillScreenContext* mockContext = static_cast<MockDrawQuadsToFillScreenContext*>(context->context3D());
 
     // Run test case
@@ -2513,10 +2551,10 @@ static void addDrawingLayerTo(CCLayerImpl* parent, int id, const IntRect& layerR
 
 static void setupLayersForTextureCaching(CCLayerTreeHostImpl* layerTreeHostImpl, CCLayerImpl*& rootPtr, CCLayerImpl*& intermediateLayerPtr, CCLayerImpl*& surfaceLayerPtr, CCLayerImpl*& childPtr, const IntSize& rootSize)
 {
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     layerTreeHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    layerTreeHostImpl->setViewportSize(rootSize);
+    layerTreeHostImpl->setViewportSize(rootSize, rootSize);
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -2538,7 +2576,7 @@ static void setupLayersForTextureCaching(CCLayerTreeHostImpl* layerTreeHostImpl,
     surfaceLayerPtr->setOpacity(0.5f); // This will cause it to have a surface
 
     // Child of the surface layer will produce some quads
-    addDrawingLayerTo(surfaceLayerPtr, 4, IntRect(5, 5, rootSize.width(), rootSize.height()), &childPtr);
+    addDrawingLayerTo(surfaceLayerPtr, 4, IntRect(5, 5, rootSize.width() - 25, rootSize.height() - 25), &childPtr);
 }
 
 class LayerRendererChromiumWithReleaseTextures : public LayerRendererChromium {
@@ -2551,17 +2589,18 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithClipping)
     CCSettings::setPartialSwapEnabled(true);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     CCLayerImpl* rootPtr;
     CCLayerImpl* surfaceLayerPtr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(100, 100);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -2601,12 +2640,15 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithClipping)
         EXPECT_EQ(2U, frame.renderPasses[0]->quadList().size());
         ASSERT_EQ(1U, frame.renderPasses[1]->quadList().size());
 
-        // Verify that the child layers have been drawn entirely.
+        // Verify that the child layers are being clipped.
         IntRect quadVisibleRect = frame.renderPasses[0]->quadList()[0]->quadVisibleRect();
-        EXPECT_INT_RECT_EQ(IntRect(0, 0, 100, 3), quadVisibleRect);
+        EXPECT_LT(quadVisibleRect.width(), 100);
 
         quadVisibleRect = frame.renderPasses[0]->quadList()[1]->quadVisibleRect();
-        EXPECT_INT_RECT_EQ(IntRect(0, 0, 100, 3), quadVisibleRect);
+        EXPECT_LT(quadVisibleRect.width(), 100);
+
+        // Verify that the render surface texture is *not* clipped.
+        EXPECT_INT_RECT_EQ(IntRect(0, 0, 100, 100), frame.renderPasses[0]->outputRect());
 
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
@@ -2623,15 +2665,16 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithClipping)
     surfaceLayerPtr->setTransform(transform);
 
     // The surface is now aligned again, and the clipped parts are exposed.
-    // That should be OK, as we've already verified that the quads are drawn in full.
-    // Verify that the render pass is removed.
+    // Since the layers were clipped, even though the render surface size
+    // was not changed, the texture should not be saved.
     {
         CCLayerTreeHostImpl::FrameData frame;
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
-        // Must receive a single render pass using a cached texture.
-        ASSERT_EQ(1U, frame.renderPasses.size());
-        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+        // Must receive two render passes, each with one quad
+        ASSERT_EQ(2U, frame.renderPasses.size());
+        EXPECT_EQ(2U, frame.renderPasses[0]->quadList().size());
+        ASSERT_EQ(1U, frame.renderPasses[1]->quadList().size());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -2643,6 +2686,7 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusion)
     CCSettings::setPartialSwapEnabled(false);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     // Layers are structure as follows:
@@ -2663,12 +2707,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusion)
     CCLayerImpl* layerS1Ptr;
     CCLayerImpl* layerS2Ptr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(1000, 1000);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -2698,11 +2742,11 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusion)
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
         // Must receive 3 render passes.
-        // For Root, there are 2 quads; for S1, there are 3 quads; for S2, there is 1 quad.
+        // For Root, there are 2 quads; for S1, there are 2 quads (1 is occluded); for S2, there is 2 quads.
         ASSERT_EQ(3U, frame.renderPasses.size());
 
         EXPECT_EQ(2U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(3U, frame.renderPasses[1]->quadList().size());
+        EXPECT_EQ(2U, frame.renderPasses[1]->quadList().size());
         EXPECT_EQ(2U, frame.renderPasses[2]->quadList().size());
 
         myHostImpl->drawLayers(frame);
@@ -2758,6 +2802,7 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionEarlyOut)
     CCSettings::setPartialSwapEnabled(false);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     // Layers are structure as follows:
@@ -2775,12 +2820,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionEarlyOut)
     CCLayerImpl* layerS1Ptr;
     CCLayerImpl* layerS2Ptr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(1000, 1000);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -2873,6 +2918,7 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionExternalOverInternal)
     CCSettings::setPartialSwapEnabled(false);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     // Layers are structured as follows:
@@ -2888,12 +2934,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionExternalOverInternal)
     CCLayerImpl* layerS1Ptr;
     CCLayerImpl* layerS2Ptr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(1000, 1000);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -2971,12 +3017,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionExternalNotAligned)
     CCLayerImpl* rootPtr;
     CCLayerImpl* layerS1Ptr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(1000, 1000);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -3035,6 +3081,7 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
     CCSettings::setPartialSwapEnabled(true);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     // Layers are structure as follows:
@@ -3055,12 +3102,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
     CCLayerImpl* layerS1Ptr;
     CCLayerImpl* layerS2Ptr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(1000, 1000);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -3090,11 +3137,11 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
         // Must receive 3 render passes.
-        // For Root, there are 2 quads; for S1, there are 3 quads; for S2, there is 1 quad.
+        // For Root, there are 2 quads; for S1, there are 2 quads (one is occluded); for S2, there is 2 quads.
         ASSERT_EQ(3U, frame.renderPasses.size());
 
         EXPECT_EQ(2U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(3U, frame.renderPasses[1]->quadList().size());
+        EXPECT_EQ(2U, frame.renderPasses[1]->quadList().size());
         EXPECT_EQ(2U, frame.renderPasses[2]->quadList().size());
 
         myHostImpl->drawLayers(frame);
@@ -3112,12 +3159,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
         // Must receive 2 render passes.
-        // For Root, there are 2 quads
-        // For S1, the number of quads depends on what got unoccluded, so not asserted beyond being positive.
+        // For Root, there are 2 quads.
+        // For S1, there are 2 quads.
         // For S2, there is no render pass
         ASSERT_EQ(2U, frame.renderPasses.size());
 
-        EXPECT_GT(frame.renderPasses[0]->quadList().size(), 0U);
+        EXPECT_EQ(2U, frame.renderPasses[0]->quadList().size());
         EXPECT_EQ(2U, frame.renderPasses[1]->quadList().size());
 
         myHostImpl->drawLayers(frame);
@@ -3127,9 +3174,6 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
     // "Re-occlude" surface S1 and repeat draw.
     // Must remove S1's render pass since it is now available in full.
     // S2 has no change so must also be removed.
-    // FIXME: Due to partial swap, the scissor rect will cause OcclusionTracker
-    // to think there is an external occlusion in the previous step. Therefore,
-    // S1's render pass will not be removed.
     transform = layerS2Ptr->transform();
     transform.translate(-15, -15);
     layerS2Ptr->setTransform(transform);
@@ -3137,19 +3181,118 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
         CCLayerTreeHostImpl::FrameData frame;
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
-        // 2 Render passes - Root and S1.
-        ASSERT_EQ(2U, frame.renderPasses.size());
+        // Root render pass only.
+        ASSERT_EQ(1U, frame.renderPasses.size());
 
-        // Render pass for S1 contains no quads as the scissor rect is now occluded.
-        EXPECT_EQ(0U, frame.renderPasses[0]->quadList().size());
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+}
 
-        // Root contains S2 only, as S1 doesn't have any damage.
-        EXPECT_EQ(1U, frame.renderPasses[1]->quadList().size());
+TEST_F(CCLayerTreeHostImplTest, textureCachingWithScissor)
+{
+    CCSettings::setPartialSwapEnabled(false);
 
+    CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
+    OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
+
+    /*
+      Layers are created as follows:
+
+         +--------------------+
+         |                  1 |
+         |  +-----------+     |
+         |  |         2 |     |
+         |  | +-------------------+
+         |  | |   3               |
+         |  | +-------------------+
+         |  |           |     |
+         |  +-----------+     |
+         |                    |
+         |                    |
+         +--------------------+
+
+         Layers 1, 2 have render surfaces
+     */
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    OwnPtr<CCTiledLayerImpl> child = CCTiledLayerImpl::create(2);
+    OwnPtr<CCLayerImpl> grandChild = CCLayerImpl::create(3);
+
+    IntRect rootRect(0, 0, 100, 100);
+    IntRect childRect(10, 10, 50, 50);
+    IntRect grandChildRect(5, 5, 150, 150);
+
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
+    myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
+
+    root->setAnchorPoint(FloatPoint(0, 0));
+    root->setPosition(FloatPoint(rootRect.x(), rootRect.y()));
+    root->setBounds(IntSize(rootRect.width(), rootRect.height()));
+    root->setContentBounds(root->bounds());
+    root->setDrawsContent(true);
+    root->setMasksToBounds(true);
+
+    child->setAnchorPoint(FloatPoint(0, 0));
+    child->setPosition(FloatPoint(childRect.x(), childRect.y()));
+    child->setOpacity(0.5);
+    child->setBounds(IntSize(childRect.width(), childRect.height()));
+    child->setContentBounds(child->bounds());
+    child->setDrawsContent(true);
+    child->setSkipsDraw(false);
+
+    // child layer has 10x10 tiles.
+    OwnPtr<CCLayerTilingData> tiler = CCLayerTilingData::create(IntSize(10, 10), CCLayerTilingData::HasBorderTexels);
+    tiler->setBounds(child->contentBounds());
+    child->setTilingData(*tiler.get());
+
+    grandChild->setAnchorPoint(FloatPoint(0, 0));
+    grandChild->setPosition(IntPoint(grandChildRect.x(), grandChildRect.y()));
+    grandChild->setBounds(IntSize(grandChildRect.width(), grandChildRect.height()));
+    grandChild->setContentBounds(grandChild->bounds());
+    grandChild->setDrawsContent(true);
+
+    CCTiledLayerImpl* childPtr = child.get();
+
+    child->addChild(grandChild.release());
+    root->addChild(child.release());
+    myHostImpl->setRootLayer(root.release());
+    myHostImpl->setViewportSize(rootRect.size(), rootRect.size());
+
+    EXPECT_FALSE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(childPtr->id()));
+
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
     }
 
+    // We should have cached textures for surface 2.
+    EXPECT_TRUE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(childPtr->id()));
+
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+
+    // We should still have cached textures for surface 2 after drawing with no damage.
+    EXPECT_TRUE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(childPtr->id()));
+
+    // Damage a single tile of surface 2.
+    childPtr->setUpdateRect(IntRect(10, 10, 10, 10));
+
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+
+    // We should have a cached texture for surface 2 again even though it was damaged.
+    EXPECT_TRUE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(childPtr->id()));
 }
 
 TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
@@ -3157,6 +3300,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
     CCSettings::setPartialSwapEnabled(true);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     CCLayerImpl* rootPtr;
@@ -3178,7 +3322,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_TRUE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_FALSE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3189,10 +3333,14 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         CCLayerTreeHostImpl::FrameData frame;
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
-        // Must receive two EMPTY render passes
-        ASSERT_EQ(2U, frame.renderPasses.size());
-        EXPECT_EQ(0U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(0U, frame.renderPasses[1]->quadList().size());
+        // Must receive one render pass, as the other one should be culled
+        ASSERT_EQ(1U, frame.renderPasses.size());
+
+        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
+        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
+        CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3211,7 +3359,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3232,7 +3380,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_TRUE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_FALSE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3259,7 +3407,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         // Was our surface evicted?
         EXPECT_FALSE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(targetPass->id()));
@@ -3273,10 +3421,14 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         CCLayerTreeHostImpl::FrameData frame;
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
-        // Must receive two EMPTY render passes
-        ASSERT_EQ(2U, frame.renderPasses.size());
-        EXPECT_EQ(0U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(0U, frame.renderPasses[1]->quadList().size());
+        // Must receive one render pass, as the other one should be culled
+        ASSERT_EQ(1U, frame.renderPasses.size());
+
+        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
+        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
+        CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3297,7 +3449,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3309,6 +3461,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
     CCSettings::setPartialSwapEnabled(false);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     CCLayerImpl* rootPtr;
@@ -3330,7 +3483,13 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_TRUE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_FALSE(targetPass->damageRect().isEmpty());
+
+        EXPECT_FALSE(frame.renderPasses[0]->damageRect().isEmpty());
+        EXPECT_FALSE(frame.renderPasses[1]->damageRect().isEmpty());
+
+        EXPECT_FALSE(frame.renderPasses[0]->hasOcclusionFromOutsideTargetSurface());
+        EXPECT_FALSE(frame.renderPasses[1]->hasOcclusionFromOutsideTargetSurface());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3347,6 +3506,8 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         ASSERT_EQ(1U, frame.renderPasses.size());
         EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
 
+        EXPECT_TRUE(frame.renderPasses[0]->damageRect().isEmpty());
+
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
     }
@@ -3364,7 +3525,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3385,7 +3546,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_TRUE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_FALSE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3412,7 +3573,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         // Was our surface evicted?
         EXPECT_FALSE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(targetPass->id()));
@@ -3451,83 +3612,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
-
-        myHostImpl->drawLayers(frame);
-        myHostImpl->didDrawAllLayers(frame);
-    }
-}
-
-// FIXME: This test is temporary until memory management in render surfaces gets refactored.
-// It depends on implementation of TextureManager and needs to get removed as
-// it will become meaningless with a different implementation.
-TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingMemoryLimit)
-{
-    CCSettings::setPartialSwapEnabled(true);
-
-    CCLayerTreeSettings settings;
-    OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
-
-    CCLayerImpl* rootPtr;
-    CCLayerImpl* intermediateLayerPtr;
-    CCLayerImpl* surfaceLayerPtr;
-    CCLayerImpl* childPtr;
-
-    // FIXME: The number 4200 is the "magic" number which will cause render surface size
-    // to go above 64M. This will bring it above reclaimLimitBytes().
-    // We could compute this number from return value of reclaimLimitBytes(), however
-    // it takes a viewport, so it's no better as it still contains same kind of assumption
-    // (namely that reclaimLimitBytes() ignores viewport size).
-    IntSize largeSurfaceSize(4200, 4200);
-    setupLayersForTextureCaching(myHostImpl.get(), rootPtr, intermediateLayerPtr, surfaceLayerPtr, childPtr, largeSurfaceSize);
-
-    {
-        CCLayerTreeHostImpl::FrameData frame;
-        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-
-        // Must receive two render passes, each with one quad
-        ASSERT_EQ(2U, frame.renderPasses.size());
-        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(1U, frame.renderPasses[1]->quadList().size());
-
-        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
-        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
-        CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_TRUE(targetPass->targetSurface()->contentsChanged());
-
-        myHostImpl->drawLayers(frame);
-        myHostImpl->didDrawAllLayers(frame);
-    }
-
-    // Draw without any change
-    {
-        CCLayerTreeHostImpl::FrameData frame;
-        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-
-        // Must receive two EMPTY render passes
-        ASSERT_EQ(2U, frame.renderPasses.size());
-        EXPECT_EQ(0U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(0U, frame.renderPasses[1]->quadList().size());
-
-        myHostImpl->drawLayers(frame);
-        myHostImpl->didDrawAllLayers(frame);
-    }
-
-    // Change opacity and draw.
-    // If all goes well, the texture must still be available, even though it's really big.
-    surfaceLayerPtr->setOpacity(0.6f);
-    {
-        CCLayerTreeHostImpl::FrameData frame;
-        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-
-        // Must receive one render pass, as the other one should be culled
-        ASSERT_EQ(1U, frame.renderPasses.size());
-
-        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
-        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
-        CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3698,7 +3783,7 @@ static void configureRenderPassTestData(const char* testScript, RenderPassRemova
 
                 IntRect quadRect = IntRect(0, 0, 1, 1);
                 IntRect contentsChangedRect = contentsChanged ? quadRect : IntRect();
-                OwnPtr<CCRenderPassDrawQuad> quad = CCRenderPassDrawQuad::create(testData.sharedQuadState.get(), quadRect, newRenderPassId, isReplica, 1, contentsChangedRect);
+                OwnPtr<CCRenderPassDrawQuad> quad = CCRenderPassDrawQuad::create(testData.sharedQuadState.get(), quadRect, newRenderPassId, isReplica, 1, contentsChangedRect, 1, 1, 0, 0);
                 static_cast<CCTestRenderPass*>(renderPass.get())->appendQuad(quad.release());
             }
         }
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
index ea7678b02..137e6249a 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
@@ -26,20 +26,18 @@
 
 #include "cc/CCLayerTreeHost.h"
 
-#include "AnimationIdVendor.h"
 #include "CCOcclusionTrackerTestCommon.h"
 #include "CCThreadedTest.h"
 #include "ContentLayerChromium.h"
-#include "GraphicsContext3DPrivate.h"
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCSettings.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateQueue.h"
 #include "cc/CCTimingFunction.h"
-#include "platform/WebThread.h"
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 #include <public/Platform.h>
+#include <public/WebThread.h>
 #include <wtf/MainThread.h>
 #include <wtf/OwnArrayPtr.h>
 
@@ -339,7 +337,7 @@ public:
         m_numCommits++;
         if (m_numCommits == 1) {
             // Make the viewport empty so the host says it can't draw.
-            m_layerTreeHost->setViewportSize(IntSize(0, 0));
+            m_layerTreeHost->setViewportSize(IntSize(0, 0), IntSize(0, 0));
 
             OwnArrayPtr<char> pixels(adoptArrayPtr(new char[4]));
             m_layerTreeHost->compositeAndReadback(static_cast<void*>(pixels.get()), IntRect(0, 0, 1, 1));
@@ -747,7 +745,7 @@ public:
     virtual void beginTest()
     {
         m_layerTreeHost->rootLayer()->setDrawOpacity(1);
-        m_layerTreeHost->setViewportSize(IntSize(10, 10));
+        m_layerTreeHost->setViewportSize(IntSize(10, 10), IntSize(10, 10));
         m_layerTreeHost->rootLayer()->setOpacity(0);
         postAddAnimationToMainThread();
     }
@@ -1006,8 +1004,8 @@ public:
 
     virtual void beginTest()
     {
-        m_layerTreeHost->setViewportSize(IntSize(20, 20));
-        m_layerTreeHost->setBackgroundColor(Color::gray);
+        m_layerTreeHost->setViewportSize(IntSize(20, 20), IntSize(20, 20));
+        m_layerTreeHost->setBackgroundColor(SK_ColorGRAY);
         m_layerTreeHost->setPageScaleFactorAndLimits(5, 5, 5);
 
         postSetNeedsCommitToMainThread();
@@ -1015,8 +1013,8 @@ public:
 
     virtual void commitCompleteOnCCThread(CCLayerTreeHostImpl* impl)
     {
-        EXPECT_EQ(IntSize(20, 20), impl->viewportSize());
-        EXPECT_EQ(Color::gray, impl->backgroundColor());
+        EXPECT_EQ(IntSize(20, 20), impl->layoutViewportSize());
+        EXPECT_EQ(SK_ColorGRAY, impl->backgroundColor());
         EXPECT_EQ(5, impl->pageScale());
 
         endTest();
@@ -1160,9 +1158,9 @@ public:
     int paintContentsCount() { return m_paintContentsCount; }
     void resetPaintContentsCount() { m_paintContentsCount = 0; }
 
-    virtual void update(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion, CCRenderingStats& stats) OVERRIDE
+    virtual void update(CCTextureUpdateQueue& queue, const CCOcclusionTracker* occlusion, CCRenderingStats& stats) OVERRIDE
     {
-        ContentLayerChromium::update(updater, occlusion, stats);
+        ContentLayerChromium::update(queue, occlusion, stats);
         m_paintContentsCount++;
     }
 
@@ -1191,7 +1189,7 @@ public:
     virtual void beginTest()
     {
         m_layerTreeHost->setRootLayer(m_updateCheckLayer);
-        m_layerTreeHost->setViewportSize(IntSize(10, 10));
+        m_layerTreeHost->setViewportSize(IntSize(10, 10), IntSize(10, 10));
 
         postSetNeedsCommitToMainThread();
     }
@@ -1239,10 +1237,9 @@ public:
 
     virtual void beginTest()
     {
-        // The device viewport should be scaled by the device scale factor.
-        m_layerTreeHost->setViewportSize(IntSize(40, 40));
+        m_layerTreeHost->setViewportSize(IntSize(40, 40), IntSize(60, 60));
         m_layerTreeHost->setDeviceScaleFactor(1.5);
-        EXPECT_EQ(IntSize(40, 40), m_layerTreeHost->viewportSize());
+        EXPECT_EQ(IntSize(40, 40), m_layerTreeHost->layoutViewportSize());
         EXPECT_EQ(IntSize(60, 60), m_layerTreeHost->deviceViewportSize());
 
         m_rootLayer->addChild(m_childLayer);
@@ -1273,7 +1270,7 @@ public:
         ASSERT_EQ(1u, impl->rootLayer()->children().size());
 
         // Device viewport is scaled.
-        EXPECT_EQ(IntSize(40, 40), impl->viewportSize());
+        EXPECT_EQ(IntSize(40, 40), impl->layoutViewportSize());
         EXPECT_EQ(IntSize(60, 60), impl->deviceViewportSize());
 
         CCLayerImpl* root = impl->rootLayer();
@@ -1347,7 +1344,7 @@ public:
     virtual void beginTest()
     {
         m_layerTreeHost->setRootLayer(m_layer);
-        m_layerTreeHost->setViewportSize(IntSize(10, 10));
+        m_layerTreeHost->setViewportSize(IntSize(10, 10), IntSize(10, 10));
 
         postSetNeedsCommitToMainThread();
         postSetNeedsRedrawToMainThread();
@@ -1447,7 +1444,7 @@ public:
     virtual void beginTest()
     {
         m_layerTreeHost->setRootLayer(m_parent);
-        m_layerTreeHost->setViewportSize(IntSize(10, 20));
+        m_layerTreeHost->setViewportSize(IntSize(10, 20), IntSize(10, 20));
 
         WebTransformationMatrix identityMatrix;
         setLayerPropertiesForTesting(m_parent.get(), 0, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(10, 20), true);
@@ -1543,10 +1540,10 @@ public:
             break;
         case 3:
             m_child->setNeedsDisplay();
-            m_layerTreeHost->setViewportSize(IntSize(10, 10));
+            m_layerTreeHost->setViewportSize(IntSize(10, 10), IntSize(10, 10));
             break;
         case 4:
-            m_layerTreeHost->setViewportSize(IntSize(10, 20));
+            m_layerTreeHost->setViewportSize(IntSize(10, 20), IntSize(10, 20));
             break;
         default:
             ASSERT_NOT_REACHED();
@@ -1574,7 +1571,7 @@ class TestLayerChromium : public LayerChromium {
 public:
     static PassRefPtr<TestLayerChromium> create() { return adoptRef(new TestLayerChromium()); }
 
-    virtual void update(CCTextureUpdater&, const CCOcclusionTracker* occlusion, CCRenderingStats&) OVERRIDE
+    virtual void update(CCTextureUpdateQueue&, const CCOcclusionTracker* occlusion, CCRenderingStats&) OVERRIDE
     {
         // Gain access to internals of the CCOcclusionTracker.
         const TestCCOcclusionTracker* testOcclusion = static_cast<const TestCCOcclusionTracker*>(occlusion);
@@ -1627,10 +1624,10 @@ public:
         setTestLayerPropertiesForTesting(grandChild.get(), child.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
         ASSERT_TRUE(m_layerTreeHost->initializeLayerRendererIfNeeded());
-        CCTextureUpdater updater;
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        CCTextureUpdateQueue queue;
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1646,8 +1643,8 @@ public:
         setLayerPropertiesForTesting(grandChild.get(), child.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1664,8 +1661,8 @@ public:
         setTestLayerPropertiesForTesting(grandChild.get(), child.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1684,8 +1681,8 @@ public:
         setTestLayerPropertiesForTesting(grandChild.get(), child.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1706,8 +1703,8 @@ public:
         child->setMaskLayer(mask.get());
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1728,8 +1725,8 @@ public:
         child->setMaskLayer(mask.get());
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -1751,8 +1748,8 @@ public:
         child->setOpacity(0.5);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1774,8 +1771,8 @@ public:
         child->setOpacity(0.5);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -1835,10 +1832,10 @@ public:
         }
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
         ASSERT_TRUE(m_layerTreeHost->initializeLayerRendererIfNeeded());
-        CCTextureUpdater updater;
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        CCTextureUpdateQueue queue;
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -1864,8 +1861,8 @@ public:
         }
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -1924,10 +1921,10 @@ public:
         }
 
         m_layerTreeHost->setRootLayer(layers[0].get());
-        m_layerTreeHost->setViewportSize(layers[0]->bounds());
+        m_layerTreeHost->setViewportSize(layers[0]->bounds(), layers[0]->bounds());
         ASSERT_TRUE(m_layerTreeHost->initializeLayerRendererIfNeeded());
-        CCTextureUpdater updater;
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        CCTextureUpdateQueue queue;
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         for (int i = 0; i < numSurfaces-1; ++i) {
@@ -1951,7 +1948,7 @@ public:
 
 SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestManySurfaces)
 
-// A loseContext(1) should lead to a didRecreateContext(true)
+// A loseContext(1) should lead to a didRecreateOutputSurface(true)
 class CCLayerTreeHostTestSetSingleLostContext : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestSetSingleLostContext()
@@ -1968,7 +1965,7 @@ public:
         m_layerTreeHost->loseContext(1);
     }
 
-    virtual void didRecreateContext(bool succeeded)
+    virtual void didRecreateOutputSurface(bool succeeded)
     {
         EXPECT_TRUE(succeeded);
         endTest();
@@ -1984,7 +1981,7 @@ TEST_F(CCLayerTreeHostTestSetSingleLostContext, runMultiThread)
     runTest(true);
 }
 
-// A loseContext(10) should lead to a didRecreateContext(false), and
+// A loseContext(10) should lead to a didRecreateOutputSurface(false), and
 // a finishAllRendering() should not hang.
 class CCLayerTreeHostTestSetRepeatedLostContext : public CCLayerTreeHostTest {
 public:
@@ -2002,7 +1999,7 @@ public:
         m_layerTreeHost->loseContext(10);
     }
 
-    virtual void didRecreateContext(bool succeeded)
+    virtual void didRecreateOutputSurface(bool succeeded)
     {
         EXPECT_FALSE(succeeded);
         m_layerTreeHost->finishAllRendering();
@@ -2141,7 +2138,7 @@ public:
 
         // Any valid CCAnimationCurve will do here.
         OwnPtr<CCAnimationCurve> curve(CCEaseTimingFunction::create());
-        OwnPtr<CCActiveAnimation> animation(CCActiveAnimation::create(curve.release(), AnimationIdVendor::getNextAnimationId(), AnimationIdVendor::getNextGroupId(), CCActiveAnimation::Opacity));
+        OwnPtr<CCActiveAnimation> animation(CCActiveAnimation::create(curve.release(), 1, 1, CCActiveAnimation::Opacity));
         layer->layerAnimationController()->addAnimation(animation.release());
 
         // We add the animation *before* attaching the layer to the tree.
@@ -2173,7 +2170,7 @@ public:
 
     virtual void beginTest() OVERRIDE
     {
-        m_layerTreeHost->setViewportSize(IntSize(10, 10));
+        m_layerTreeHost->setViewportSize(IntSize(10, 10), IntSize(10, 10));
         m_layerTreeHost->rootLayer()->setBounds(IntSize(10, 10));
         
         m_rootScrollLayer = ContentLayerChromium::create(&m_mockDelegate);
@@ -2283,7 +2280,7 @@ public:
 
     virtual void beginTest()
     {
-        m_layerTreeHost->setViewportSize(IntSize(100, 100));
+        m_layerTreeHost->setViewportSize(IntSize(100, 100), IntSize(100, 100));
 
         m_rootLayer->setBounds(IntSize(100, 100));
         m_surfaceLayer1->setBounds(IntSize(100, 100));
diff --git a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
index 596b0692c..9d51c9970 100644
--- a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
@@ -31,7 +31,6 @@
 #include "CCOcclusionTrackerTestCommon.h"
 #include "LayerChromium.h"
 #include "Region.h"
-#include "TranslateTransformOperation.h"
 #include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHostCommon.h"
@@ -103,23 +102,23 @@ private:
 };
 
 template<typename LayerType, typename RenderSurfaceType>
-class TestCCOcclusionTrackerWithScissor : public TestCCOcclusionTrackerBase<LayerType, RenderSurfaceType> {
+class TestCCOcclusionTrackerWithClip : public TestCCOcclusionTrackerBase<LayerType, RenderSurfaceType> {
 public:
-    TestCCOcclusionTrackerWithScissor(IntRect screenScissorRect, bool recordMetricsForFrame = false)
-        : TestCCOcclusionTrackerBase<LayerType, RenderSurfaceType>(screenScissorRect, recordMetricsForFrame)
-        , m_overrideLayerScissorRect(false)
+    TestCCOcclusionTrackerWithClip(IntRect viewportRect, bool recordMetricsForFrame = false)
+        : TestCCOcclusionTrackerBase<LayerType, RenderSurfaceType>(viewportRect, recordMetricsForFrame)
+        , m_overrideLayerClipRect(false)
     {
     }
 
-    void setLayerScissorRect(const IntRect& rect) { m_overrideLayerScissorRect = true; m_layerScissorRect = rect;}
-    void useDefaultLayerScissorRect() { m_overrideLayerScissorRect = false; }
+    void setLayerClipRect(const IntRect& rect) { m_overrideLayerClipRect = true; m_layerClipRect = rect;}
+    void useDefaultLayerClipRect() { m_overrideLayerClipRect = false; }
 
 protected:
-    virtual IntRect layerScissorRectInTargetSurface(const LayerType* layer) const { return m_overrideLayerScissorRect ? m_layerScissorRect : CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::layerScissorRectInTargetSurface(layer); }
+    virtual IntRect layerClipRectInTarget(const LayerType* layer) const { return m_overrideLayerClipRect ? m_layerClipRect : CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::layerClipRectInTarget(layer); }
 
 private:
-    bool m_overrideLayerScissorRect;
-    IntRect m_layerScissorRect;
+    bool m_overrideLayerClipRect;
+    IntRect m_layerClipRect;
 };
 
 struct CCOcclusionTrackerTestMainThreadTypes {
@@ -262,8 +261,7 @@ protected:
         ASSERT(!root->renderSurface());
 
         CCLayerTreeHostCommon::calculateDrawTransforms(root, root->bounds(), 1, &layerSorter, dummyMaxTextureSize, m_renderSurfaceLayerListImpl);
-
-        CCLayerTreeHostCommon::calculateVisibleAndScissorRects(m_renderSurfaceLayerListImpl, root->renderSurface()->contentRect());
+        CCLayerTreeHostCommon::calculateVisibleRects(m_renderSurfaceLayerListImpl);
 
         m_layerIterator = m_layerIteratorBegin = Types::LayerIterator::begin(&m_renderSurfaceLayerListImpl);
     }
@@ -276,8 +274,7 @@ protected:
         ASSERT(!root->renderSurface());
 
         CCLayerTreeHostCommon::calculateDrawTransforms(root, root->bounds(), 1, dummyMaxTextureSize, m_renderSurfaceLayerListChromium);
-
-        CCLayerTreeHostCommon::calculateVisibleAndScissorRects(m_renderSurfaceLayerListChromium, root->renderSurface()->contentRect());
+        CCLayerTreeHostCommon::calculateVisibleRects(m_renderSurfaceLayerListChromium);
 
         m_layerIterator = m_layerIteratorBegin = Types::LayerIterator::begin(&m_renderSurfaceLayerListChromium);
     }
@@ -443,8 +440,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(30, 30), IntSize(500, 500), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(layer, occlusion);
         this->enterLayer(parent, occlusion);
@@ -460,13 +457,13 @@ protected:
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(31, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 31, 70, 70)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(29, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 29, 70, 70)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(31, 30, 70, 70)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 31, 70, 70)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(30, 30, 70, 70)).isEmpty());
         EXPECT_INT_RECT_EQ(IntRect(29, 30, 1, 70), occlusion.unoccludedContentRect(parent, IntRect(29, 30, 70, 70)));
@@ -496,8 +493,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(parent, layerTransform, FloatPoint(30, 30), IntSize(500, 500), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(layer, occlusion);
         this->enterLayer(parent, occlusion);
@@ -513,13 +510,13 @@ protected:
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(31, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 31, 70, 70)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(29, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 29, 70, 70)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(31, 30, 70, 70)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 31, 70, 70)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(30, 30, 70, 70)).isEmpty());
         EXPECT_INT_RECT_EQ(IntRect(29, 30, 1, 70), occlusion.unoccludedContentRect(parent, IntRect(29, 30, 70, 70)));
@@ -547,8 +544,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(parent, layerTransform, FloatPoint(30, 30), IntSize(500, 500), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(layer, occlusion);
         this->enterLayer(parent, occlusion);
@@ -564,13 +561,13 @@ protected:
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(51, 50, 50, 50)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(50, 51, 50, 50)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(50, 50, 50, 50)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(49, 50, 50, 50)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(50, 49, 50, 50)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(51, 50, 50, 50)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(50, 51, 50, 50)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(50, 50, 50, 50)).isEmpty());
         EXPECT_INT_RECT_EQ(IntRect(49, 50, 1, 50), occlusion.unoccludedContentRect(parent, IntRect(49, 50, 50, 50)));
@@ -582,7 +579,7 @@ protected:
         EXPECT_INT_RECT_EQ(IntRect(50, 100, 50, 1), occlusion.unoccludedContentRect(parent, IntRect(50, 51, 50, 50)));
         EXPECT_INT_RECT_EQ(IntRect(49, 51, 50, 50), occlusion.unoccludedContentRect(parent, IntRect(49, 51, 50, 50)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(50, 50, 50, 50)).isEmpty());
         EXPECT_INT_RECT_EQ(IntRect(49, 50, 1, 50), occlusion.unoccludedContentRect(parent, IntRect(49, 50, 50, 50)));
         EXPECT_INT_RECT_EQ(IntRect(49, 49, 50, 50), occlusion.unoccludedContentRect(parent, IntRect(49, 49, 50, 50)));
@@ -592,7 +589,7 @@ protected:
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(51, 51, 50, 50)).isEmpty());
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(50, 51, 50, 50)).isEmpty());
         EXPECT_INT_RECT_EQ(IntRect(49, 51, 1, 49), occlusion.unoccludedContentRect(parent, IntRect(49, 51, 50, 50)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
     }
 };
 
@@ -614,8 +611,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(child, this->identityMatrix, FloatPoint(10, 10), IntSize(500, 500), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(layer, occlusion);
         this->enterContributingSurface(child, occlusion);
@@ -625,20 +622,6 @@ protected:
         EXPECT_INT_RECT_EQ(IntRect(10, 430, 60, 70), occlusion.occlusionInTargetSurface().bounds());
         EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
 
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(9, 430, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(10, 429, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(10, 430, 61, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(10, 430, 60, 71)));
-
-        occlusion.useDefaultLayerScissorRect();
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(9, 430, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 429, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 61, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 60, 71)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
-
         this->leaveContributingSurface(child, occlusion);
         this->enterLayer(parent, occlusion);
 
@@ -653,13 +636,13 @@ protected:
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(31, 40, 70, 60)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 41, 70, 60)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 40, 70, 60)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(29, 40, 70, 60)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 39, 70, 60)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(31, 40, 70, 60)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 41, 70, 60)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
 
         /* Justification for the above occlusion from |layer|:
@@ -710,8 +693,8 @@ protected:
         typename Types::ContentLayerType* child2 = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(30, 30), IntSize(60, 20), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(-10, -10, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(-10, -10, 1000, 1000));
 
         this->visitLayer(child2, occlusion);
 
@@ -729,45 +712,10 @@ protected:
 
         this->enterContributingSurface(child, occlusion);
 
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(9, 430, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(10, 429, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(11, 430, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(10, 431, 60, 70)));
-
-        occlusion.useDefaultLayerScissorRect();
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(9, 430, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 429, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(11, 430, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 431, 60, 70)));
-        occlusion.setLayerScissorRect(IntRect(-10, -10, 1000, 1000));
-
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(10, 430, 60, 70)).isEmpty());
-        // This is the little piece not occluded by child2
-        EXPECT_INT_RECT_EQ(IntRect(9, 430, 1, 10), occlusion.unoccludedContentRect(child, IntRect(9, 430, 60, 70)));
-        // This extends past both sides of child2, so it will be the original rect.
-        EXPECT_INT_RECT_EQ(IntRect(9, 430, 60, 80), occlusion.unoccludedContentRect(child, IntRect(9, 430, 60, 80)));
-        // This extends past two adjacent sides of child2, and should included the unoccluded parts of each side.
-        // This also demonstrates that the rect can be arbitrary and does not get clipped to the layer's visibleContentRect().
-        EXPECT_INT_RECT_EQ(IntRect(-10, 430, 20, 70), occlusion.unoccludedContentRect(child, IntRect(-10, 430, 60, 70)));
-        // This extends past three adjacent sides of child2, so it should contain the unoccluded parts of each side. The left
-        // and bottom edges are completely unoccluded for some row/column so we get back the original query rect.
-        EXPECT_INT_RECT_EQ(IntRect(-10, 430, 60, 80), occlusion.unoccludedContentRect(child, IntRect(-10, 430, 60, 80)));
-        EXPECT_INT_RECT_EQ(IntRect(10, 429, 60, 1), occlusion.unoccludedContentRect(child, IntRect(10, 429, 60, 70)));
-        EXPECT_INT_RECT_EQ(IntRect(70, 430, 1, 70), occlusion.unoccludedContentRect(child, IntRect(11, 430, 60, 70)));
-        EXPECT_INT_RECT_EQ(IntRect(10, 500, 60, 1), occlusion.unoccludedContentRect(child, IntRect(10, 431, 60, 70)));
-
-        occlusion.useDefaultLayerScissorRect();
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(10, 430, 60, 70)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(9, 430, 60, 70)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(9, 430, 60, 80)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(-10, 430, 60, 70)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(-10, 430, 60, 80)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(10, 429, 60, 70)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(11, 430, 60, 70)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(10, 431, 60, 70)).isEmpty());
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        EXPECT_INT_RECT_EQ(IntRect(30, 30, 70, 70), occlusion.occlusionInScreenSpace().bounds());
+        EXPECT_EQ(2u, occlusion.occlusionInScreenSpace().rects().size());
+        EXPECT_INT_RECT_EQ(IntRect(10, 430, 60, 70), occlusion.occlusionInTargetSurface().bounds());
+        EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
 
         // Occlusion in |child2| should get merged with the |child| surface we are leaving now.
         this->leaveContributingSurface(child, occlusion);
@@ -856,8 +804,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(child, layerTransform, FloatPoint(0, 0), IntSize(500, 500), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         IntRect clippedLayerInChild = CCMathUtil::mapClippedRect(layerTransform, layer->visibleContentRect());
 
@@ -920,8 +868,8 @@ protected:
         typename Types::ContentLayerType* layer2 = this->createDrawingLayer(child, this->identityMatrix, FloatPoint(10, 450), IntSize(500, 60), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(layer2, occlusion);
         this->visitLayer(layer1, occlusion);
@@ -1008,8 +956,8 @@ protected:
         typename Types::ContentLayerType* layer2 = this->createDrawingLayer(child2, this->identityMatrix, FloatPoint(-10, -10), IntSize(510, 510), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(-20, -20, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(-20, -20, 1000, 1000));
 
         this->visitLayer(layer2, occlusion);
         this->enterContributingSurface(child2, occlusion);
@@ -1025,13 +973,13 @@ protected:
         EXPECT_FALSE(occlusion.occluded(child2, IntRect(-10, 420, 71, 80)));
         EXPECT_FALSE(occlusion.occluded(child2, IntRect(-10, 420, 70, 81)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(child2, IntRect(-10, 420, 70, 80)));
         EXPECT_TRUE(occlusion.occluded(child2, IntRect(-11, 420, 70, 80)));
         EXPECT_TRUE(occlusion.occluded(child2, IntRect(-10, 419, 70, 80)));
         EXPECT_TRUE(occlusion.occluded(child2, IntRect(-10, 420, 71, 80)));
         EXPECT_TRUE(occlusion.occluded(child2, IntRect(-10, 420, 70, 81)));
-        occlusion.setLayerScissorRect(IntRect(-20, -20, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(-20, -20, 1000, 1000));
 
         // There is nothing above child2's surface in the z-order.
         EXPECT_INT_RECT_EQ(IntRect(-10, 420, 70, 80), occlusion.unoccludedContributingSurfaceContentRect(child2, false, IntRect(-10, 420, 70, 80)));
@@ -1122,8 +1070,8 @@ protected:
         typename Types::ContentLayerType* layer2 = this->createDrawingLayer(child2, this->identityMatrix, FloatPoint(-10, -10), IntSize(510, 510), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(-30, -30, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(-30, -30, 1000, 1000));
 
         this->visitLayer(layer2, occlusion);
         this->enterLayer(child2, occlusion);
@@ -1236,8 +1184,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // Opacity layer won't contribute to occlusion.
         this->visitLayer(opacityLayer, occlusion);
@@ -1300,8 +1248,8 @@ protected:
         this->createReplicaLayer(surface, this->identityMatrix, FloatPoint(50, 50), IntSize());
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface, occlusion);
 
@@ -1331,8 +1279,8 @@ protected:
         this->createReplicaLayer(surface, this->identityMatrix, FloatPoint(50, 50), IntSize());
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface, occlusion);
 
@@ -1363,8 +1311,8 @@ protected:
         this->createMaskLayer(replica, IntSize(10, 10));
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface, occlusion);
 
@@ -1385,7 +1333,7 @@ protected:
 ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestReplicaWithMask);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestLayerScissorRectOutsideChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestLayerClipRectOutsideChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1393,8 +1341,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(200, 100, 100, 100));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(200, 100, 100, 100));
 
         this->enterLayer(layer, occlusion);
 
@@ -1404,9 +1352,9 @@ protected:
         EXPECT_TRUE(occlusion.occluded(layer, IntRect(100, 100, 100, 100)));
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
-        occlusion.setLayerScissorRect(IntRect(200, 100, 100, 100));
+        occlusion.setLayerClipRect(IntRect(200, 100, 100, 100));
 
         this->leaveLayer(layer, occlusion);
         this->visitContributingSurface(layer, occlusion);
@@ -1426,10 +1374,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerScissorRectOutsideChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerClipRectOutsideChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestScreenScissorRectOutsideChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestViewportRectOutsideChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1437,8 +1385,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(200, 100, 100, 100));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(200, 100, 100, 100));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->enterLayer(layer, occlusion);
 
@@ -1448,9 +1396,9 @@ protected:
         EXPECT_TRUE(occlusion.occluded(layer, IntRect(100, 100, 100, 100)));
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->leaveLayer(layer, occlusion);
         this->visitContributingSurface(layer, occlusion);
@@ -1470,10 +1418,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestScreenScissorRectOutsideChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestViewportRectOutsideChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestLayerScissorRectOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestLayerClipRectOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1481,8 +1429,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(100, 100, 100, 100));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(100, 100, 100, 100));
 
         this->enterLayer(layer, occlusion);
 
@@ -1509,10 +1457,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerScissorRectOverChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerClipRectOverChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestScreenScissorRectOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestViewportRectOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1520,8 +1468,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(100, 100, 100, 100));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(100, 100, 100, 100));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->enterLayer(layer, occlusion);
 
@@ -1548,10 +1496,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestScreenScissorRectOverChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestViewportRectOverChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestLayerScissorRectPartlyOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestLayerClipRectPartlyOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1559,8 +1507,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(50, 50, 200, 200));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(50, 50, 200, 200));
 
         this->enterLayer(layer, occlusion);
 
@@ -1591,10 +1539,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerScissorRectPartlyOverChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerClipRectPartlyOverChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestScreenScissorRectPartlyOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestViewportRectPartlyOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1602,8 +1550,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(50, 50, 200, 200));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(50, 50, 200, 200));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->enterLayer(layer, occlusion);
 
@@ -1634,10 +1582,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestScreenScissorRectPartlyOverChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestViewportRectPartlyOverChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestLayerScissorRectOverNothing : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestLayerClipRectOverNothing : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1645,8 +1593,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(500, 500, 100, 100));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(500, 500, 100, 100));
 
         this->enterLayer(layer, occlusion);
 
@@ -1677,10 +1625,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerScissorRectOverNothing);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerClipRectOverNothing);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestScreenScissorRectOverNothing : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestViewportRectOverNothing : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1688,8 +1636,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(500, 500, 100, 100));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(500, 500, 100, 100));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->enterLayer(layer, occlusion);
 
@@ -1720,10 +1668,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestScreenScissorRectOverNothing);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestViewportRectOverNothing);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestLayerScissorRectForLayerOffOrigin : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestLayerClipRectForLayerOffOrigin : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1731,12 +1679,12 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->enterLayer(layer, occlusion);
 
-        // This layer is translated when drawn into its target. So if the scissor rect given from the target surface
+        // This layer is translated when drawn into its target. So if the clip rect given from the target surface
         // is not in that target space, then after translating these query rects into the target, they will fall outside
-        // the scissor and be considered occluded.
+        // the clip and be considered occluded.
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(0, 0, 100, 100)));
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(0, 100, 100, 100)));
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(100, 0, 100, 100)));
@@ -1744,7 +1692,7 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerScissorRectForLayerOffOrigin);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerClipRectForLayerOffOrigin);
 
 template<class Types, bool opaqueLayers>
 class CCOcclusionTrackerTestOpaqueContentsRegionEmpty : public CCOcclusionTrackerTest<Types, opaqueLayers> {
@@ -1755,7 +1703,7 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), false);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->enterLayer(layer, occlusion);
 
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(0, 0, 100, 100)));
@@ -1766,10 +1714,10 @@ protected:
         // Occluded since its outside the surface bounds.
         EXPECT_TRUE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
 
-        // Test without any scissors.
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        // Test without any clip rect.
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
 
         this->leaveLayer(layer, occlusion);
         this->visitContributingSurface(layer, occlusion);
@@ -1792,7 +1740,7 @@ protected:
         this->calcDrawEtc(parent);
 
         {
-            TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+            TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
             layer->setOpaqueContentsRect(IntRect(0, 0, 100, 100));
 
             this->resetLayerIterator();
@@ -1808,7 +1756,7 @@ protected:
         }
 
         {
-            TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+            TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
             layer->setOpaqueContentsRect(IntRect(20, 20, 180, 180));
 
             this->resetLayerIterator();
@@ -1824,7 +1772,7 @@ protected:
         }
 
         {
-            TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+            TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
             layer->setOpaqueContentsRect(IntRect(150, 150, 100, 100));
 
             this->resetLayerIterator();
@@ -1856,7 +1804,7 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(container, transform, FloatPoint(100, 100), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->enterLayer(layer, occlusion);
 
         // The layer is rotated in 3d but without preserving 3d, so it only gets resized.
@@ -1890,7 +1838,7 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->visitLayer(child2, occlusion);
         EXPECT_TRUE(occlusion.occlusionInScreenSpace().isEmpty());
         EXPECT_TRUE(occlusion.occlusionInTargetSurface().isEmpty());
@@ -1922,7 +1870,7 @@ protected:
         layer->setPreserves3D(true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->enterLayer(layer, occlusion);
 
         EXPECT_INT_RECT_EQ(IntRect(0, 0, 200, 200), occlusion.unoccludedContentRect(layer, IntRect(0, 0, 200, 200)));
@@ -1953,7 +1901,7 @@ protected:
         layer->setPreserves3D(true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->enterLayer(layer, occlusion);
 
         // The bottom 11 pixel rows of this layer remain visible inside the container, after translation to the target surface. When translated back,
@@ -1982,7 +1930,7 @@ protected:
         layer->setPreserves3D(true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         // The |layer| is entirely behind the camera and should not occlude.
         this->visitLayer(layer, occlusion);
@@ -2012,7 +1960,7 @@ protected:
         layer->setPreserves3D(true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         // This is very close to the camera, so pixels in its visibleContentRect will actually go outside of the layer's clipRect.
         // Ensure that those pixels don't occlude things outside the clipRect.
@@ -2049,7 +1997,7 @@ protected:
         EXPECT_FALSE(surface->drawOpacityIsAnimating());
         EXPECT_TRUE(surface->renderSurface()->drawOpacityIsAnimating());
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(topmost, occlusion);
         this->enterLayer(parent2, occlusion);
@@ -2101,7 +2049,7 @@ protected:
         EXPECT_FALSE(surface->drawOpacityIsAnimating());
         EXPECT_TRUE(surface->renderSurface()->drawOpacityIsAnimating());
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(topmost, occlusion);
         this->enterLayer(parent2, occlusion);
@@ -2159,7 +2107,7 @@ protected:
         EXPECT_TRUE(surfaceChild->drawTransformIsAnimating());
         EXPECT_TRUE(surfaceChild->screenSpaceTransformIsAnimating());
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface2, occlusion);
         this->enterContributingSurface(surface2, occlusion);
@@ -2241,7 +2189,7 @@ protected:
         surface2->setOpaqueContentsRect(IntRect(0, 0, 200, 200));
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface2, occlusion);
         this->visitContributingSurface(surface2, occlusion);
@@ -2277,7 +2225,7 @@ protected:
         surface->setOpaqueContentsRect(IntRect(0, 0, 400, 200));
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface, occlusion);
         this->visitContributingSurface(surface, occlusion);
@@ -2302,8 +2250,8 @@ protected:
         typename Types::LayerType* topmost = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 100), IntSize(100, 100), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // |topmost| occludes the replica, but not the surface itself.
         this->visitLayer(topmost, occlusion);
@@ -2340,8 +2288,8 @@ protected:
         typename Types::LayerType* topmost = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(100, 110), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // |topmost| occludes the surface, but not the entire surface's replica.
         this->visitLayer(topmost, occlusion);
@@ -2380,8 +2328,8 @@ protected:
         typename Types::LayerType* overReplica = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 100), IntSize(50, 100), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // These occlude the surface and replica differently, so we can test each one.
         this->visitLayer(overReplica, occlusion);
@@ -2422,7 +2370,7 @@ protected:
         typename Types::LayerType* topmost = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(100, 50), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(-100, -100, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(-100, -100, 1000, 1000));
 
         // |topmost| occludes everything partially so we know occlusion is happening at all.
         this->visitLayer(topmost, occlusion);
@@ -2468,19 +2416,19 @@ protected:
 ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestSurfaceChildOfSurface);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestTopmostSurfaceIsClippedToScissor : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestTopmostSurfaceIsClippedToViewport : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
-        // This test verifies that the top-most surface is considered occluded outside of its scissor rect and outside the screen's scissor rect.
+        // This test verifies that the top-most surface is considered occluded outside of its target's clipRect and outside the viewport rect.
 
         typename Types::ContentLayerType* parent = this->createRoot(this->identityMatrix, FloatPoint(0, 0), IntSize(100, 200));
         typename Types::LayerType* surface = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(100, 300), true);
         this->calcDrawEtc(parent);
 
         {
-            // Make a screen scissor rect that is larger than the root layer's.
-            TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+            // Make a viewport rect that is larger than the root layer.
+            TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
             this->visitLayer(surface, occlusion);
 
@@ -2491,20 +2439,20 @@ protected:
         }
         this->resetLayerIterator();
         {
-            // Make a screen scissor rect that is smaller than the root layer's.
-            TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 100, 100));
+            // Make a viewport rect that is smaller than the root layer.
+            TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 100, 100));
 
             this->visitLayer(surface, occlusion);
 
             // The root layer always has a clipRect. So the parent of |surface| has a clipRect giving the surface itself a clipRect.
             this->enterContributingSurface(surface, occlusion);
-            // Make sure the screen scissor rect clips the unoccluded region of the child surface.
+            // Make sure the viewport rect clips the unoccluded region of the child surface.
             EXPECT_INT_RECT_EQ(IntRect(0, 0, 100, 100), occlusion.unoccludedContributingSurfaceContentRect(surface, false, IntRect(0, 0, 100, 300)));
         }
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestTopmostSurfaceIsClippedToScissor);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestTopmostSurfaceIsClippedToViewport);
 
 template<class Types, bool opaqueLayers>
 class CCOcclusionTrackerTestSurfaceChildOfClippingSurface : public CCOcclusionTrackerTest<Types, opaqueLayers> {
@@ -2519,8 +2467,8 @@ protected:
         typename Types::LayerType* topmost = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(100, 50), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // |topmost| occludes everything partially so we know occlusion is happening at all.
         this->visitLayer(topmost, occlusion);
@@ -2587,8 +2535,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // These layers occlude pixels directly beside the filteredSurface. Because filtered surface blends pixels in a radius, it will
         // need to see some of the pixels (up to radius far) underneath the occludingLayers.
@@ -2709,8 +2657,8 @@ protected:
 
         this->calcDrawEtc(root);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(occludingLayerAbove, occlusion);
         EXPECT_INT_RECT_EQ(IntRect(100 / 2, 100 / 2, 50 / 2, 50 / 2), occlusion.occlusionInScreenSpace().bounds());
@@ -2773,8 +2721,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // These layers occlude pixels directly beside the filteredSurface. Because filtered surface blends pixels in a radius, it will
         // need to see some of the pixels (up to radius far) underneath the occludingLayers.
@@ -2892,8 +2840,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // The surface has a background blur, so it blurs non-opaque pixels below it.
         this->visitLayer(filteredSurface, occlusion);
@@ -2941,8 +2889,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(aboveReplicaLayer, occlusion);
         this->visitLayer(aboveSurfaceLayer, occlusion);
@@ -2995,8 +2943,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(besideReplicaLayer, occlusion);
         this->visitLayer(besideSurfaceLayer, occlusion);
@@ -3050,8 +2998,8 @@ protected:
         typename Types::LayerType* small = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 0), belowTrackingSize, true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
         occlusion.setMinimumTrackingSize(trackingSize);
 
         // The small layer is not tracked because it is too small.
diff --git a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
index 9eff157bc..8279a3a6b 100644
--- a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
@@ -27,6 +27,7 @@
 #include "cc/CCQuadCuller.h"
 
 #include "cc/CCLayerTilingData.h"
+#include "cc/CCMathUtil.h"
 #include "cc/CCOcclusionTracker.h"
 #include "cc/CCOverdrawMetrics.h"
 #include "cc/CCSingleThreadProxy.h"
@@ -80,6 +81,7 @@ static PassOwnPtr<CCTiledLayerImpl> makeLayer(CCTiledLayerImpl* parent, const We
             layer->pushTileProperties(i, j, resourceId++, tileOpaqueRect);
         }
 
+    IntRect rectInTarget = CCMathUtil::mapClippedRect(layer->drawTransform(), layer->visibleContentRect());
     if (!parent) {
         layer->createRenderSurface();
         surfaceLayerList.append(layer.get());
@@ -87,7 +89,9 @@ static PassOwnPtr<CCTiledLayerImpl> makeLayer(CCTiledLayerImpl* parent, const We
     } else {
         layer->setRenderTarget(parent->renderTarget());
         parent->renderSurface()->layerList().append(layer.get());
+        rectInTarget.unite(CCMathUtil::mapClippedRect(parent->drawTransform(), parent->visibleContentRect()));
     }
+    layer->setDrawableContentRect(rectInTarget);
 
     return layer.release();
 }
diff --git a/Source/WebKit/chromium/tests/CCRenderSurfaceFiltersTest.cpp b/Source/WebKit/chromium/tests/CCRenderSurfaceFiltersTest.cpp
new file mode 100644
index 000000000..b56a7fb42
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCRenderSurfaceFiltersTest.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCRenderSurfaceFilters.h"
+
+#include "CompositorFakeWebGraphicsContext3D.h"
+#include <gtest/gtest.h>
+#include <public/WebFilterOperation.h>
+#include <public/WebFilterOperations.h>
+#include <wtf/RefPtr.h>
+
+using namespace WebCore;
+using namespace WebKit;
+
+namespace {
+
+// Checks whether op can be combined with a following color matrix.
+bool isCombined(const WebFilterOperation& op)
+{
+    WebFilterOperations filters;
+    filters.append(op);
+    filters.append(WebFilterOperation::createBrightnessFilter(0)); // brightness(0) is identity.
+    WebFilterOperations optimized = CCRenderSurfaceFilters::optimize(filters);
+    return optimized.size() == 1;
+}
+
+TEST(CCRenderSurfaceFiltersTest, testColorMatrixFiltersCombined)
+{
+    // Several filters should always combine for any amount between 0 and 1:
+    // grayscale, saturate, invert, contrast, opacity.
+    EXPECT_TRUE(isCombined(WebFilterOperation::createGrayscaleFilter(0)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createGrayscaleFilter(0.3)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createGrayscaleFilter(0.5)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createGrayscaleFilter(1)));
+
+    EXPECT_TRUE(isCombined(WebFilterOperation::createSaturateFilter(0)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createSaturateFilter(0.3)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createSaturateFilter(0.5)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createSaturateFilter(1)));
+
+    EXPECT_TRUE(isCombined(WebFilterOperation::createInvertFilter(0)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createInvertFilter(0.3)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createInvertFilter(0.5)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createInvertFilter(1)));
+
+    EXPECT_TRUE(isCombined(WebFilterOperation::createContrastFilter(0)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createContrastFilter(0.3)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createContrastFilter(0.5)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createContrastFilter(1)));
+
+    EXPECT_TRUE(isCombined(WebFilterOperation::createOpacityFilter(0)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createOpacityFilter(0.3)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createOpacityFilter(0.5)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createOpacityFilter(1)));
+
+    // Several filters should never combine: brightness(amount > 0), blur, drop-shadow.
+    EXPECT_FALSE(isCombined(WebFilterOperation::createBrightnessFilter(0.5)));
+    EXPECT_FALSE(isCombined(WebFilterOperation::createBrightnessFilter(1)));
+    EXPECT_FALSE(isCombined(WebFilterOperation::createBlurFilter(3)));
+    EXPECT_FALSE(isCombined(WebFilterOperation::createDropShadowFilter(WebPoint(2, 2), 3, 0xffffffff)));
+
+    // sepia and hue may or may not combine depending on the value.
+    EXPECT_TRUE(isCombined(WebFilterOperation::createSepiaFilter(0)));
+    EXPECT_FALSE(isCombined(WebFilterOperation::createSepiaFilter(1)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createHueRotateFilter(0)));
+    EXPECT_FALSE(isCombined(WebFilterOperation::createHueRotateFilter(180)));
+
+    float matrix1[20] = {
+        1, 0, 0, 0, 0,
+        0, 1, 0, 0, 0,
+        0, 0, 1, 0, 0,
+        0, 0, 0, 1, 0,
+    };
+    EXPECT_TRUE(isCombined(WebFilterOperation::createColorMatrixFilter(matrix1)));
+
+    float matrix2[20] = {
+        1, 1, 0, 0, 0,
+        0, 1, 0, 0, 0,
+        0, 0, 1, 0, 0,
+        0, 0, 0, 1, 0,
+    };
+    EXPECT_FALSE(isCombined(WebFilterOperation::createColorMatrixFilter(matrix2)));
+
+    float matrix3[20] = {
+        0.25, 0, 0, 0, 255*0.75,
+        0, 1, 0, 0, 0,
+        0, 0, 1, 0, 0,
+        0, 0, 0, 1, 0,
+    };
+    EXPECT_TRUE(isCombined(WebFilterOperation::createColorMatrixFilter(matrix3)));
+
+    float matrix4[20] = {
+        -0.25, 0.75, 0, 0, 255*0.25,
+        0, 1, 0, 0, 0,
+        0, 0, 1, 0, 0,
+        0, 0, 0, 1, 0,
+    };
+    EXPECT_TRUE(isCombined(WebFilterOperation::createColorMatrixFilter(matrix4)));
+}
+
+TEST(CCRenderSurfaceFiltersTest, testOptimize)
+{
+    WebFilterOperation combines(WebFilterOperation::createBrightnessFilter(0));
+    WebFilterOperation doesntCombine(WebFilterOperation::createBrightnessFilter(1));
+
+    WebFilterOperations filters;
+    WebFilterOperations optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(0u, optimized.size());
+
+    filters.append(combines);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(1u, optimized.size());
+
+    filters.append(combines);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(1u, optimized.size());
+
+    filters.append(doesntCombine);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(1u, optimized.size());
+
+    filters.append(combines);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(2u, optimized.size());
+
+    filters.append(doesntCombine);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(2u, optimized.size());
+
+    filters.append(doesntCombine);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(3u, optimized.size());
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp b/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
index c95d71e84..ad8df2595 100644
--- a/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
+++ b/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
@@ -94,11 +94,16 @@ TEST(CCRenderSurfaceTest, sanityCheckSurfaceCreatesCorrectSharedQuadState)
     // This will fake that we are on the correct thread for testing purposes.
     DebugScopedSetImplThread setImplThread;
 
-    OwnPtr<CCLayerImpl> owningLayer = CCLayerImpl::create(1);
+    OwnPtr<CCLayerImpl> rootLayer = CCLayerImpl::create(1);
+
+    OwnPtr<CCLayerImpl> owningLayer = CCLayerImpl::create(2);
     owningLayer->createRenderSurface();
     ASSERT_TRUE(owningLayer->renderSurface());
+    owningLayer->setRenderTarget(owningLayer.get());
     CCRenderSurface* renderSurface = owningLayer->renderSurface();
 
+    rootLayer->addChild(owningLayer.release());
+
     IntRect contentRect = IntRect(IntPoint::zero(), IntSize(50, 50));
     IntRect clipRect = IntRect(IntPoint(5, 5), IntSize(40, 40));
     WebTransformationMatrix origin;
@@ -108,7 +113,6 @@ TEST(CCRenderSurfaceTest, sanityCheckSurfaceCreatesCorrectSharedQuadState)
     renderSurface->setDrawTransform(origin);
     renderSurface->setContentRect(contentRect);
     renderSurface->setClipRect(clipRect);
-    renderSurface->setScissorRect(clipRect);
     renderSurface->setDrawOpacity(1);
 
     OwnPtr<CCSharedQuadState> sharedQuadState = renderSurface->createSharedQuadState(0);
@@ -116,7 +120,6 @@ TEST(CCRenderSurfaceTest, sanityCheckSurfaceCreatesCorrectSharedQuadState)
     EXPECT_EQ(30, sharedQuadState->quadTransform.m41());
     EXPECT_EQ(40, sharedQuadState->quadTransform.m42());
     EXPECT_EQ(contentRect, IntRect(sharedQuadState->visibleContentRect));
-    EXPECT_EQ(clipRect, IntRect(sharedQuadState->scissorRect));
     EXPECT_EQ(1, sharedQuadState->opacity);
     EXPECT_FALSE(sharedQuadState->opaque);
 }
diff --git a/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp b/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
index b2c41e525..42277459a 100644
--- a/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
+++ b/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
@@ -28,6 +28,7 @@
 
 #include "CompositorFakeWebGraphicsContext3D.h"
 #include "Extensions3DChromium.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCSingleThreadProxy.h" // For DebugScopedSetImplThread
 #include <gtest/gtest.h>
@@ -188,7 +189,7 @@ private:
 class CCResourceProviderTest : public testing::Test {
 public:
     CCResourceProviderTest()
-        : m_context(CCGraphicsContext::create3D(ResourceProviderContext::create()))
+        : m_context(FakeWebCompositorOutputSurface::create(ResourceProviderContext::create()))
         , m_resourceProvider(CCResourceProvider::create(m_context.get()))
     {
     }
diff --git a/Source/WebKit/chromium/tests/CCSchedulerTestCommon.h b/Source/WebKit/chromium/tests/CCSchedulerTestCommon.h
index 6257ec888..beb16554d 100644
--- a/Source/WebKit/chromium/tests/CCSchedulerTestCommon.h
+++ b/Source/WebKit/chromium/tests/CCSchedulerTestCommon.h
@@ -52,6 +52,12 @@ public:
     {
         m_pendingTaskDelay = 0;
         m_pendingTask.clear();
+        m_runPendingTaskOnOverwrite = false;
+    }
+
+    void runPendingTaskOnOverwrite(bool enable)
+    {
+        m_runPendingTaskOnOverwrite = enable;
     }
 
     bool hasPendingTask() const { return m_pendingTask; }
@@ -71,6 +77,9 @@ public:
     virtual void postTask(PassOwnPtr<Task>) { ASSERT_NOT_REACHED(); }
     virtual void postDelayedTask(PassOwnPtr<Task> task, long long delay)
     {
+        if (m_runPendingTaskOnOverwrite && hasPendingTask())
+            runPendingTask();
+
         EXPECT_TRUE(!hasPendingTask());
         m_pendingTask = task;
         m_pendingTaskDelay = delay;
@@ -80,6 +89,7 @@ public:
 protected:
     OwnPtr<Task> m_pendingTask;
     long long m_pendingTaskDelay;
+    bool m_runPendingTaskOnOverwrite;
 };
 
 class FakeCCTimeSource : public WebCore::CCTimeSource {
@@ -93,6 +103,9 @@ public:
     virtual void setClient(WebCore::CCTimeSourceClient* client) OVERRIDE { m_client = client; }
     virtual void setActive(bool b) OVERRIDE { m_active = b; }
     virtual bool active() const OVERRIDE { return m_active; }
+    virtual void setTimebaseAndInterval(double timebase, double interval) OVERRIDE { }
+    virtual double lastTickTime() OVERRIDE { return 0; }
+    virtual double nextTickTime() OVERRIDE { return 0; }
 
     void tick()
     {
diff --git a/Source/WebKit/chromium/tests/CCScrollbarAnimationControllerLinearFadeTest.cpp b/Source/WebKit/chromium/tests/CCScrollbarAnimationControllerLinearFadeTest.cpp
new file mode 100644
index 000000000..e6cdc24c1
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCScrollbarAnimationControllerLinearFadeTest.cpp
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCScrollbarAnimationControllerLinearFade.h"
+
+#include "cc/CCScrollbarLayerImpl.h"
+#include "cc/CCSingleThreadProxy.h"
+#include <gtest/gtest.h>
+#include <wtf/OwnPtr.h>
+
+using namespace WebCore;
+
+namespace {
+
+class CCScrollbarAnimationControllerLinearFadeTest : public testing::Test {
+protected:
+    virtual void SetUp()
+    {
+        m_scrollLayer = CCLayerImpl::create(1);
+        m_scrollLayer->addChild(CCLayerImpl::create(2));
+        m_contentLayer = m_scrollLayer->children()[0].get();
+        m_scrollbarLayer = CCScrollbarLayerImpl::create(3);
+
+        m_scrollLayer->setMaxScrollPosition(IntSize(50, 50));
+        m_contentLayer->setBounds(IntSize(50, 50));
+
+        m_scrollbarController = CCScrollbarAnimationControllerLinearFade::create(m_scrollLayer.get(), 2, 3);
+        m_scrollbarController->setHorizontalScrollbarLayer(m_scrollbarLayer.get());
+    }
+
+    DebugScopedSetImplThread implThread;
+
+    OwnPtr<CCScrollbarAnimationControllerLinearFade> m_scrollbarController;
+    OwnPtr<CCLayerImpl> m_scrollLayer;
+    CCLayerImpl* m_contentLayer;
+    OwnPtr<CCScrollbarLayerImpl> m_scrollbarLayer;
+
+};
+
+TEST_F(CCScrollbarAnimationControllerLinearFadeTest, verifyHiddenInBegin)
+{
+    m_scrollbarController->animate(0);
+    EXPECT_FLOAT_EQ(0, m_scrollbarLayer->opacity());
+    m_scrollbarController->updateScrollOffsetAtTime(m_scrollLayer.get(), 0);
+    m_scrollbarController->animate(0);
+    EXPECT_FLOAT_EQ(0, m_scrollbarLayer->opacity());
+}
+
+TEST_F(CCScrollbarAnimationControllerLinearFadeTest, verifyAwakenByScroll)
+{
+    m_scrollLayer->setScrollDelta(IntSize(1, 1));
+    m_scrollbarController->updateScrollOffsetAtTime(m_scrollLayer.get(), 0);
+    m_scrollbarController->animate(0);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(1);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollLayer->setScrollDelta(IntSize(2, 2));
+    m_scrollbarController->updateScrollOffsetAtTime(m_scrollLayer.get(), 1);
+    m_scrollbarController->animate(2);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(3);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(4);
+    EXPECT_FLOAT_EQ(2 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(5);
+    EXPECT_FLOAT_EQ(1 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollLayer->setScrollDelta(IntSize(3, 3));
+    m_scrollbarController->updateScrollOffsetAtTime(m_scrollLayer.get(), 5);
+    m_scrollbarController->animate(6);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(7);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(8);
+    EXPECT_FLOAT_EQ(2 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(9);
+    EXPECT_FLOAT_EQ(1 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(10);
+    EXPECT_FLOAT_EQ(0, m_scrollbarLayer->opacity());
+}
+
+TEST_F(CCScrollbarAnimationControllerLinearFadeTest, verifyForceAwakenByPinch)
+{
+    m_scrollbarController->didPinchGestureBeginAtTime(0);
+    m_scrollbarController->didPinchGestureUpdateAtTime(0);
+    m_scrollbarController->animate(0);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(1);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollLayer->setScrollDelta(IntSize(1, 1));
+    m_scrollbarController->updateScrollOffsetAtTime(m_scrollLayer.get(), 1);
+    m_scrollbarController->animate(2);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(3);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(4);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(5);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(6);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->didPinchGestureEndAtTime(6);
+    m_scrollbarController->animate(7);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(8);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(9);
+    EXPECT_FLOAT_EQ(2 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(10);
+    EXPECT_FLOAT_EQ(1 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(11);
+    EXPECT_FLOAT_EQ(0, m_scrollbarLayer->opacity());
+
+}
+
+}
diff --git a/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
index 1754a5b12..141a96328 100644
--- a/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
@@ -51,6 +51,8 @@ TEST(CCSolidColorLayerImplTest, verifyTilingCompleteAndNoOverlap)
     layer->setVisibleContentRect(visibleContentRect);
     layer->setBounds(layerSize);
     layer->setContentBounds(layerSize);
+    layer->createRenderSurface();
+    layer->setRenderTarget(layer.get());
 
     OwnPtr<CCSharedQuadState> sharedQuadState = layer->createSharedQuadState(0);
     bool hadMissingTiles = false;
@@ -74,6 +76,8 @@ TEST(CCSolidColorLayerImplTest, verifyCorrectBackgroundColorInQuad)
     layer->setBounds(layerSize);
     layer->setContentBounds(layerSize);
     layer->setBackgroundColor(testColor);
+    layer->createRenderSurface();
+    layer->setRenderTarget(layer.get());
 
     OwnPtr<CCSharedQuadState> sharedQuadState = layer->createSharedQuadState(0);
     bool hadMissingTiles = false;
@@ -98,6 +102,8 @@ TEST(CCSolidColorLayerImplTest, verifyCorrectOpacityInQuad)
     layer->setBounds(layerSize);
     layer->setContentBounds(layerSize);
     layer->setDrawOpacity(opacity);
+    layer->createRenderSurface();
+    layer->setRenderTarget(layer.get());
 
     OwnPtr<CCSharedQuadState> sharedQuadState = layer->createSharedQuadState(0);
     bool hadMissingTiles = false;
diff --git a/Source/WebKit/chromium/tests/CCTextureUpdaterTest.cpp b/Source/WebKit/chromium/tests/CCTextureUpdateControllerTest.cpp
index bfb35c048..a0dc2ec1f 100644
--- a/Source/WebKit/chromium/tests/CCTextureUpdaterTest.cpp
+++ b/Source/WebKit/chromium/tests/CCTextureUpdateControllerTest.cpp
@@ -24,14 +24,15 @@
 
 #include "config.h"
 
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateController.h"
 
+#include "CCSchedulerTestCommon.h"
 #include "CCTiledLayerTestCommon.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "FakeWebGraphicsContext3D.h"
-#include "GraphicsContext3DPrivate.h"
-#include "WebCompositor.h"
 #include "cc/CCSingleThreadProxy.h" // For DebugScopedSetImplThread
-#include "platform/WebThread.h"
+#include <public/WebCompositor.h>
+#include <public/WebThread.h>
 
 #include <gtest/gtest.h>
 #include <wtf/RefPtr.h>
@@ -47,11 +48,11 @@ namespace {
 const int kFlushPeriodFull = 4;
 const int kFlushPeriodPartial = kFlushPeriodFull;
 
-class CCTextureUpdaterTest;
+class CCTextureUpdateControllerTest;
 
 class WebGraphicsContext3DForUploadTest : public FakeWebGraphicsContext3D {
 public:
-    WebGraphicsContext3DForUploadTest(CCTextureUpdaterTest *test)
+    WebGraphicsContext3DForUploadTest(CCTextureUpdateControllerTest *test)
         : m_test(test)
         , m_supportShallowFlush(true)
     { }
@@ -68,27 +69,23 @@ public:
     }
 
 private:
-    CCTextureUpdaterTest* m_test;
+    CCTextureUpdateControllerTest* m_test;
     bool m_supportShallowFlush;
 };
 
 
 class TextureUploaderForUploadTest : public FakeTextureUploader {
 public:
-    TextureUploaderForUploadTest(CCTextureUpdaterTest *test) : m_test(test) { }
+    TextureUploaderForUploadTest(CCTextureUpdateControllerTest *test) : m_test(test) { }
 
     virtual void beginUploads() OVERRIDE;
     virtual void endUploads() OVERRIDE;
-    virtual void uploadTexture(WebCore::LayerTextureUpdater::Texture*,
-                               WebCore::CCResourceProvider*,
-                               const WebCore::IntRect sourceRect,
-                               const WebCore::IntRect destRect) OVERRIDE;
+    virtual void uploadTexture(WebCore::CCResourceProvider*, Parameters) OVERRIDE;
 
 private:
-    CCTextureUpdaterTest* m_test;
+    CCTextureUpdateControllerTest* m_test;
 };
 
-
 class TextureForUploadTest : public LayerTextureUpdater::Texture {
 public:
     TextureForUploadTest() : LayerTextureUpdater::Texture(adoptPtr<CCPrioritizedTexture>(0)) { }
@@ -96,10 +93,11 @@ public:
 };
 
 
-class CCTextureUpdaterTest : public Test {
+class CCTextureUpdateControllerTest : public Test {
 public:
-    CCTextureUpdaterTest()
-    : m_uploader(this)
+    CCTextureUpdateControllerTest()
+    : m_queue(adoptPtr(new CCTextureUpdateQueue))
+    , m_uploader(this)
     , m_fullUploadCountExpected(0)
     , m_partialCountExpected(0)
     , m_totalUploadCountExpected(0)
@@ -176,8 +174,7 @@ protected:
         OwnPtr<WebThread> thread;
         WebCompositor::initialize(thread.get());
 
-        m_context = CCGraphicsContext::create3D(
-                    adoptPtr(new WebGraphicsContext3DForUploadTest(this)));
+        m_context = FakeWebCompositorOutputSurface::create(adoptPtr(new WebGraphicsContext3DForUploadTest(this)));
         DebugScopedSetImplThread implThread;
         m_resourceProvider = CCResourceProvider::create(m_context.get());
     }
@@ -187,24 +184,26 @@ protected:
         WebCompositor::shutdown();
     }
 
-    void appendFullUploadsToUpdater(int count)
+    void appendFullUploadsToUpdateQueue(int count)
     {
         m_fullUploadCountExpected += count;
         m_totalUploadCountExpected += count;
 
         const IntRect rect(0, 0, 300, 150);
+        const TextureUploader::Parameters upload = { &m_texture, rect, rect };
         for (int i = 0; i < count; i++)
-            m_updater.appendFullUpdate(&m_texture, rect, rect);
+            m_queue->appendFullUpload(upload);
     }
 
-    void appendPartialUploadsToUpdater(int count)
+    void appendPartialUploadsToUpdateQueue(int count)
     {
         m_partialCountExpected += count;
         m_totalUploadCountExpected += count;
 
         const IntRect rect(0, 0, 100, 100);
+        const TextureUploader::Parameters upload = { &m_texture, rect, rect };
         for (int i = 0; i < count; i++)
-            m_updater.appendPartialUpdate(&m_texture, rect, rect);
+            m_queue->appendPartialUpload(upload);
     }
 
     void setMaxUploadCountPerUpdate(int count)
@@ -213,10 +212,10 @@ protected:
     }
 
 protected:
-    // Classes required to interact and test the CCTextureUpdater
+    // Classes required to interact and test the CCTextureUpdateController
     OwnPtr<CCGraphicsContext> m_context;
     OwnPtr<CCResourceProvider> m_resourceProvider;
-    CCTextureUpdater m_updater;
+    OwnPtr<CCTextureUpdateQueue> m_queue;
     TextureForUploadTest m_texture;
     FakeTextureCopier m_copier;
     TextureUploaderForUploadTest m_uploader;
@@ -238,7 +237,6 @@ protected:
     int m_numPreviousFlushes;
 };
 
-
 void WebGraphicsContext3DForUploadTest::flush(void)
 {
     m_test->onFlush();
@@ -259,21 +257,18 @@ void TextureUploaderForUploadTest::endUploads()
     m_test->onEndUploads();
 }
 
-void TextureUploaderForUploadTest::uploadTexture(WebCore::LayerTextureUpdater::Texture* texture,
-                                                 WebCore::CCResourceProvider*,
-                                                 const WebCore::IntRect sourceRect,
-                                                 const WebCore::IntRect destRect)
+void TextureUploaderForUploadTest::uploadTexture(WebCore::CCResourceProvider*, Parameters)
 {
     m_test->onUpload();
 }
 
 
 // ZERO UPLOADS TESTS
-TEST_F(CCTextureUpdaterTest, ZeroUploads)
+TEST_F(CCTextureUpdateControllerTest, ZeroUploads)
 {
-    appendFullUploadsToUpdater(0);
-    appendPartialUploadsToUpdater(0);
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    appendFullUploadsToUpdateQueue(0);
+    appendPartialUploadsToUpdateQueue(0);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(0, m_numBeginUploads);
     EXPECT_EQ(0, m_numEndUploads);
@@ -283,12 +278,12 @@ TEST_F(CCTextureUpdaterTest, ZeroUploads)
 
 
 // ONE UPLOAD TESTS
-TEST_F(CCTextureUpdaterTest, OneFullUpload)
+TEST_F(CCTextureUpdateControllerTest, OneFullUpload)
 {
-    appendFullUploadsToUpdater(1);
-    appendPartialUploadsToUpdater(0);
+    appendFullUploadsToUpdateQueue(1);
+    appendPartialUploadsToUpdateQueue(0);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -296,12 +291,12 @@ TEST_F(CCTextureUpdaterTest, OneFullUpload)
     EXPECT_EQ(1, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, OnePartialUpload)
+TEST_F(CCTextureUpdateControllerTest, OnePartialUpload)
 {
-    appendFullUploadsToUpdater(0);
-    appendPartialUploadsToUpdater(1);
+    appendFullUploadsToUpdateQueue(0);
+    appendPartialUploadsToUpdateQueue(1);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -309,12 +304,12 @@ TEST_F(CCTextureUpdaterTest, OnePartialUpload)
     EXPECT_EQ(1, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, OneFullOnePartialUpload)
+TEST_F(CCTextureUpdateControllerTest, OneFullOnePartialUpload)
 {
-    appendFullUploadsToUpdater(1);
-    appendPartialUploadsToUpdater(1);
+    appendFullUploadsToUpdateQueue(1);
+    appendPartialUploadsToUpdateQueue(1);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     // We expect the full uploads to be followed by a flush
     // before the partial uploads begin.
@@ -333,12 +328,12 @@ const int fullNoRemainderCount = fullUploadFlushMultipler * kFlushPeriodFull;
 const int partialUploadFlushMultipler = 11;
 const int partialNoRemainderCount = partialUploadFlushMultipler * kFlushPeriodPartial;
 
-TEST_F(CCTextureUpdaterTest, ManyFullUploadsNoRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullUploadsNoRemainder)
 {
-    appendFullUploadsToUpdater(fullNoRemainderCount);
-    appendPartialUploadsToUpdater(0);
+    appendFullUploadsToUpdateQueue(fullNoRemainderCount);
+    appendPartialUploadsToUpdateQueue(0);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -346,12 +341,12 @@ TEST_F(CCTextureUpdaterTest, ManyFullUploadsNoRemainder)
     EXPECT_EQ(fullNoRemainderCount, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, ManyPartialUploadsNoRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyPartialUploadsNoRemainder)
 {
-    appendFullUploadsToUpdater(0);
-    appendPartialUploadsToUpdater(partialNoRemainderCount);
+    appendFullUploadsToUpdateQueue(0);
+    appendPartialUploadsToUpdateQueue(partialNoRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -359,12 +354,12 @@ TEST_F(CCTextureUpdaterTest, ManyPartialUploadsNoRemainder)
     EXPECT_EQ(partialNoRemainderCount, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, ManyFullManyPartialUploadsNoRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullManyPartialUploadsNoRemainder)
 {
-    appendFullUploadsToUpdater(fullNoRemainderCount);
-    appendPartialUploadsToUpdater(partialNoRemainderCount);
+    appendFullUploadsToUpdateQueue(fullNoRemainderCount);
+    appendPartialUploadsToUpdateQueue(partialNoRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -382,12 +377,12 @@ const int fullMaxRemainderCount = fullNoRemainderCount - 1;
 const int partialMinRemainderCount = partialNoRemainderCount + 1;
 const int partialMaxRemainderCount = partialNoRemainderCount - 1;
 
-TEST_F(CCTextureUpdaterTest, ManyFullAndPartialMinRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullAndPartialMinRemainder)
 {
-    appendFullUploadsToUpdater(fullMinRemainderCount);
-    appendPartialUploadsToUpdater(partialMinRemainderCount);
+    appendFullUploadsToUpdateQueue(fullMinRemainderCount);
+    appendPartialUploadsToUpdateQueue(partialMinRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -395,12 +390,12 @@ TEST_F(CCTextureUpdaterTest, ManyFullAndPartialMinRemainder)
     EXPECT_EQ(fullMinRemainderCount + partialMinRemainderCount, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, ManyFullAndPartialUploadsMaxRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullAndPartialUploadsMaxRemainder)
 {
-    appendFullUploadsToUpdater(fullMaxRemainderCount);
-    appendPartialUploadsToUpdater(partialMaxRemainderCount);
+    appendFullUploadsToUpdateQueue(fullMaxRemainderCount);
+    appendPartialUploadsToUpdateQueue(partialMaxRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -408,12 +403,12 @@ TEST_F(CCTextureUpdaterTest, ManyFullAndPartialUploadsMaxRemainder)
     EXPECT_EQ(fullMaxRemainderCount + partialMaxRemainderCount, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, ManyFullMinRemainderManyPartialMaxRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullMinRemainderManyPartialMaxRemainder)
 {
-    appendFullUploadsToUpdater(fullMinRemainderCount);
-    appendPartialUploadsToUpdater(partialMaxRemainderCount);
+    appendFullUploadsToUpdateQueue(fullMinRemainderCount);
+    appendPartialUploadsToUpdateQueue(partialMaxRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -421,12 +416,12 @@ TEST_F(CCTextureUpdaterTest, ManyFullMinRemainderManyPartialMaxRemainder)
     EXPECT_EQ(fullMinRemainderCount + partialMaxRemainderCount, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, ManyFullMaxRemainderManyPartialMinRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullMaxRemainderManyPartialMinRemainder)
 {
-    appendFullUploadsToUpdater(fullMaxRemainderCount);
-    appendPartialUploadsToUpdater(partialMinRemainderCount);
+    appendFullUploadsToUpdateQueue(fullMaxRemainderCount);
+    appendPartialUploadsToUpdateQueue(partialMinRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -444,7 +439,7 @@ int expectedFlushes(int uploads, int flushPeriod)
     return (uploads + flushPeriod - 1) / flushPeriod;
 }
 
-TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateFullAndPartial)
+TEST_F(CCTextureUpdateControllerTest, TripleUpdateFinalUpdateFullAndPartial)
 {
     const int kMaxUploadsPerUpdate = 40;
     const int kFullUploads = 100;
@@ -454,12 +449,12 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateFullAndPartial)
     int expectedPreviousUploads = 0;
 
     setMaxUploadCountPerUpdate(kMaxUploadsPerUpdate);
-    appendFullUploadsToUpdater(kFullUploads);
-    appendPartialUploadsToUpdater(kPartialUploads);
+    appendFullUploadsToUpdateQueue(kFullUploads);
+    appendPartialUploadsToUpdateQueue(kPartialUploads);
 
     // First update (40 full)
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -471,7 +466,7 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateFullAndPartial)
     EXPECT_EQ(expectedPreviousUploads, m_numPreviousUploads);
 
     // Second update (40 full)
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(2, m_numBeginUploads);
     EXPECT_EQ(2, m_numEndUploads);
@@ -483,7 +478,7 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateFullAndPartial)
     EXPECT_EQ(expectedPreviousUploads, m_numPreviousUploads);
 
     // Third update (20 full, 20 partial)
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(3, m_numBeginUploads);
     EXPECT_EQ(3, m_numEndUploads);
@@ -499,7 +494,7 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateFullAndPartial)
     EXPECT_EQ(kFullUploads + kPartialUploads, m_numTotalUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateAllPartial)
+TEST_F(CCTextureUpdateControllerTest, TripleUpdateFinalUpdateAllPartial)
 {
     const int kMaxUploadsPerUpdate = 40;
     const int kFullUploads = 70;
@@ -509,12 +504,12 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateAllPartial)
     int expectedPreviousUploads = 0;
 
     setMaxUploadCountPerUpdate(kMaxUploadsPerUpdate);
-    appendFullUploadsToUpdater(kFullUploads);
-    appendPartialUploadsToUpdater(kPartialUploads);
+    appendFullUploadsToUpdateQueue(kFullUploads);
+    appendPartialUploadsToUpdateQueue(kPartialUploads);
 
     // First update (40 full)
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -526,7 +521,7 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateAllPartial)
     EXPECT_EQ(expectedPreviousUploads, m_numPreviousUploads);
 
     // Second update (30 full, optionally 10 partial)
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(2, m_numBeginUploads);
     EXPECT_EQ(2, m_numEndUploads);
@@ -536,7 +531,7 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateAllPartial)
     // onFlush(), onUpload(), and onEndUpload() will do basic flush checks for us anyway.
 
     // Third update (30 partial OR 20 partial if 10 partial uploaded in second update)
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(3, m_numBeginUploads);
     EXPECT_EQ(3, m_numEndUploads);
@@ -547,5 +542,4 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateAllPartial)
     EXPECT_EQ(kFullUploads + kPartialUploads, m_numTotalUploads);
 }
 
-
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCThreadedTest.cpp b/Source/WebKit/chromium/tests/CCThreadedTest.cpp
index 2e2c1a06f..89ff9cba3 100644
--- a/Source/WebKit/chromium/tests/CCThreadedTest.cpp
+++ b/Source/WebKit/chromium/tests/CCThreadedTest.cpp
@@ -26,31 +26,28 @@
 
 #include "CCThreadedTest.h"
 
-#include "AnimationIdVendor.h"
 #include "CCAnimationTestCommon.h"
 #include "CCOcclusionTrackerTestCommon.h"
 #include "CCTiledLayerTestCommon.h"
 #include "ContentLayerChromium.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "FakeWebGraphicsContext3D.h"
-#include "GraphicsContext3DPrivate.h"
 #include "LayerChromium.h"
-#include "WebCompositor.h"
-#include "WebKit.h"
 #include "cc/CCActiveAnimation.h"
 #include "cc/CCLayerAnimationController.h"
-#include "cc/CCLayerAnimationDelegate.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCScopedThreadProxy.h"
 #include "cc/CCSingleThreadProxy.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateQueue.h"
 #include "cc/CCThreadTask.h"
 #include "cc/CCTimingFunction.h"
-#include "platform/WebThread.h"
 #include <gmock/gmock.h>
 #include <public/Platform.h>
+#include <public/WebCompositor.h>
 #include <public/WebFilterOperation.h>
 #include <public/WebFilterOperations.h>
+#include <public/WebThread.h>
 #include <wtf/Locker.h>
 #include <wtf/MainThread.h>
 #include <wtf/PassRefPtr.h>
@@ -102,9 +99,9 @@ CompositorFakeWebGraphicsContext3DWithTextureTracking::CompositorFakeWebGraphics
 {
 }
 
-PassOwnPtr<WebGraphicsContext3D> TestHooks::createContext()
+PassOwnPtr<WebCompositorOutputSurface> TestHooks::createOutputSurface()
 {
-    return CompositorFakeWebGraphicsContext3DWithTextureTracking::create(WebGraphicsContext3D::Attributes());
+    return FakeWebCompositorOutputSurface::create(CompositorFakeWebGraphicsContext3DWithTextureTracking::create(WebGraphicsContext3D::Attributes()));
 }
 
 PassOwnPtr<MockLayerTreeHostImpl> MockLayerTreeHostImpl::create(TestHooks* testHooks, const CCLayerTreeSettings& settings, CCLayerTreeHostImplClient* client)
@@ -167,7 +164,7 @@ public:
         layerTreeHost->setRootLayer(rootLayer);
 
         // LayerTreeHostImpl won't draw if it has 1x1 viewport.
-        layerTreeHost->setViewportSize(IntSize(1, 1));
+        layerTreeHost->setViewportSize(IntSize(1, 1), IntSize(1, 1));
 
         layerTreeHost->rootLayer()->setLayerAnimationDelegate(testHooks);
 
@@ -226,9 +223,9 @@ public:
         m_testHooks->applyScrollAndScale(scrollDelta, scale);
     }
 
-    virtual PassOwnPtr<WebGraphicsContext3D> createContext3D() OVERRIDE
+    virtual PassOwnPtr<WebCompositorOutputSurface> createOutputSurface() OVERRIDE
     {
-        return m_testHooks->createContext();
+        return m_testHooks->createOutputSurface();
     }
 
     virtual void willCommit() OVERRIDE
@@ -249,9 +246,9 @@ public:
     {
     }
 
-    virtual void didRecreateContext(bool succeeded) OVERRIDE
+    virtual void didRecreateOutputSurface(bool succeeded) OVERRIDE
     {
-        m_testHooks->didRecreateContext(succeeded);
+        m_testHooks->didRecreateOutputSurface(succeeded);
     }
 
     virtual void scheduleComposite() OVERRIDE
diff --git a/Source/WebKit/chromium/tests/CCThreadedTest.h b/Source/WebKit/chromium/tests/CCThreadedTest.h
index 75886effe..946b65fd1 100644
--- a/Source/WebKit/chromium/tests/CCThreadedTest.h
+++ b/Source/WebKit/chromium/tests/CCThreadedTest.h
@@ -26,11 +26,11 @@
 #define CCThreadedTest_h
 
 #include "CompositorFakeWebGraphicsContext3D.h"
-#include "cc/CCLayerAnimationDelegate.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCScopedThreadProxy.h"
 #include <gtest/gtest.h>
+#include <public/WebAnimationDelegate.h>
 
 namespace WebCore {
 class CCLayerImpl;
@@ -47,7 +47,7 @@ class WebThread;
 namespace WebKitTests {
 
 // Used by test stubs to notify the test when something interesting happens.
-class TestHooks : public WebCore::CCLayerAnimationDelegate {
+class TestHooks : public WebKit::WebAnimationDelegate {
 public:
     virtual void beginCommitOnCCThread(WebCore::CCLayerTreeHostImpl*) { }
     virtual void commitCompleteOnCCThread(WebCore::CCLayerTreeHostImpl*) { }
@@ -58,17 +58,17 @@ public:
     virtual void applyScrollAndScale(const WebCore::IntSize&, float) { }
     virtual void updateAnimations(double monotonicTime) { }
     virtual void layout() { }
-    virtual void didRecreateContext(bool succeeded) { }
+    virtual void didRecreateOutputSurface(bool succeeded) { }
     virtual void didAddAnimation() { }
     virtual void didCommit() { }
     virtual void didCommitAndDrawFrame() { }
     virtual void scheduleComposite() { }
 
-    // Implementation of CCLayerAnimationDelegate
-    virtual void notifyAnimationStarted(double time) { }
-    virtual void notifyAnimationFinished(double time) { }
+    // Implementation of WebAnimationDelegate
+    virtual void notifyAnimationStarted(double time) OVERRIDE { }
+    virtual void notifyAnimationFinished(double time) OVERRIDE { }
 
-    virtual PassOwnPtr<WebKit::WebGraphicsContext3D> createContext();
+    virtual PassOwnPtr<WebKit::WebCompositorOutputSurface> createOutputSurface();
 };
 
 class TimeoutTask;
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
index a0850b251..8d3ca4219 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
@@ -52,6 +52,8 @@ static PassOwnPtr<CCTiledLayerImpl> createLayer(const IntSize& tileSize, const I
     layer->setDrawOpacity(1);
     layer->setBounds(layerSize);
     layer->setContentBounds(layerSize);
+    layer->createRenderSurface();
+    layer->setRenderTarget(layer.get());
 
     CCResourceProvider::ResourceId resourceId = 1;
     for (int i = 0; i < tiler->numTilesX(); ++i)
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
index ec2105327..54f29bbef 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
+++ b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
@@ -115,9 +115,9 @@ void FakeTiledLayerChromium::setNeedsDisplayRect(const FloatRect& rect)
     TiledLayerChromium::setNeedsDisplayRect(rect);
 }
 
-void FakeTiledLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
+void FakeTiledLayerChromium::update(CCTextureUpdateQueue& queue, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
 {
-    updateContentRect(updater, visibleContentRect(), occlusion, stats);
+    updateContentRect(queue, visibleContentRect(), occlusion, stats);
 }
 
 void FakeTiledLayerChromium::setTexturePriorities(const CCPriorityCalculator& calculator)
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
index de1eb66c6..c75932acf 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
+++ b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
@@ -35,7 +35,7 @@
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCPrioritizedTexture.h"
 #include "cc/CCResourceProvider.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateQueue.h"
 #include "cc/CCTiledLayerImpl.h"
 
 namespace WebKitTests {
@@ -122,7 +122,7 @@ public:
     const WebCore::FloatRect& lastNeedsDisplayRect() const { return m_lastNeedsDisplayRect; }
 
     // Updates the visibleContentRect().
-    virtual void update(WebCore::CCTextureUpdater&, const WebCore::CCOcclusionTracker*, WebCore::CCRenderingStats&) OVERRIDE;
+    virtual void update(WebCore::CCTextureUpdateQueue&, const WebCore::CCOcclusionTracker*, WebCore::CCRenderingStats&) OVERRIDE;
 
     virtual void setTexturePriorities(const WebCore::CCPriorityCalculator&) OVERRIDE;
 
@@ -153,7 +153,7 @@ protected:
 
 class FakeTextureCopier : public WebCore::TextureCopier {
 public:
-    virtual void copyTexture(unsigned, unsigned, const WebCore::IntSize&) { }
+    virtual void copyTexture(Parameters) { }
     virtual void flush() { }
 };
 
@@ -162,7 +162,7 @@ public:
     virtual bool isBusy() { return false; }
     virtual void beginUploads() { }
     virtual void endUploads() { }
-    virtual void uploadTexture(WebCore::LayerTextureUpdater::Texture* texture, WebCore::CCResourceProvider* resourceProvider, const WebCore::IntRect sourceRect, const WebCore::IntRect destRect) { texture->updateRect(resourceProvider, sourceRect, destRect); }
+    virtual void uploadTexture(WebCore::CCResourceProvider* resourceProvider, Parameters upload) { upload.texture->updateRect(resourceProvider, upload.sourceRect, upload.destRect); }
 };
 
 }
diff --git a/Source/WebKit/chromium/tests/Canvas2DLayerBridgeTest.cpp b/Source/WebKit/chromium/tests/Canvas2DLayerBridgeTest.cpp
index ace7410c3..fd72e96ed 100644
--- a/Source/WebKit/chromium/tests/Canvas2DLayerBridgeTest.cpp
+++ b/Source/WebKit/chromium/tests/Canvas2DLayerBridgeTest.cpp
@@ -26,17 +26,17 @@
 
 #include "Canvas2DLayerBridge.h"
 
+#include "FakeWebCompositorOutputSurface.h"
 #include "FakeWebGraphicsContext3D.h"
 #include "GraphicsContext3DPrivate.h"
 #include "ImageBuffer.h"
 #include "LayerChromium.h"
-#include "WebCompositor.h"
-#include "WebKit.h"
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCRenderingStats.h"
-#include "cc/CCTextureUpdater.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebThread.h"
+#include "cc/CCTextureUpdateQueue.h"
+#include <public/Platform.h>
+#include <public/WebCompositor.h>
+#include <public/WebThread.h>
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
@@ -75,7 +75,7 @@ protected:
     void fullLifecycleTest(ThreadMode threadMode, DeferralMode deferralMode)
     {
         RefPtr<GraphicsContext3D> mainContext = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new MockCanvasContext));
-        OwnPtr<CCGraphicsContext> ccImplContext = CCGraphicsContext::create3D(adoptPtr(new MockCanvasContext));
+        OwnPtr<CCGraphicsContext> ccImplContext = FakeWebCompositorOutputSurface::create(adoptPtr(new MockCanvasContext));
 
         MockCanvasContext& mainMock = *static_cast<MockCanvasContext*>(GraphicsContext3DPrivate::extractWebGraphicsContext3D(mainContext.get()));
         MockCanvasContext& implMock = *static_cast<MockCanvasContext*>(ccImplContext->context3D());
@@ -143,17 +143,4 @@ TEST_F(Canvas2DLayerBridgeTest, testFullLifecycleThreadedDeferred)
     fullLifecycleTest(Threaded, Deferred);
 }
 
-TEST(Canvas2DLayerBridgeTest2, testClearClient)
-{
-    GraphicsContext3D::Attributes attrs;
-
-    RefPtr<GraphicsContext3D> mainContext = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new MockCanvasContext));
-    OwnPtr<Canvas2DLayerBridge> bridge = Canvas2DLayerBridge::create(mainContext.get(), IntSize(100, 100), Deferred, 1);
-    RefPtr<LayerChromium> layer = bridge->layer();
-    bridge.clear();
-    CCTextureUpdater updater;
-    CCRenderingStats stats;
-    layer->update(updater, 0, stats);
-}
-
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CompositorFakeWebGraphicsContext3D.h b/Source/WebKit/chromium/tests/CompositorFakeWebGraphicsContext3D.h
index 0790639d5..469e25c31 100644
--- a/Source/WebKit/chromium/tests/CompositorFakeWebGraphicsContext3D.h
+++ b/Source/WebKit/chromium/tests/CompositorFakeWebGraphicsContext3D.h
@@ -26,6 +26,7 @@
 #define CompositorFakeWebGraphicsContext3D_h
 
 #include "FakeWebGraphicsContext3D.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebKit {
 
diff --git a/Source/WebKit/chromium/tests/FakeCCGraphicsContext.h b/Source/WebKit/chromium/tests/FakeCCGraphicsContext.h
index beb4ef366..33c4b3046 100644
--- a/Source/WebKit/chromium/tests/FakeCCGraphicsContext.h
+++ b/Source/WebKit/chromium/tests/FakeCCGraphicsContext.h
@@ -27,13 +27,15 @@
 #define FakeCCGraphicsContext_h
 
 #include "CompositorFakeWebGraphicsContext3D.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "cc/CCGraphicsContext.h"
+#include <public/WebCompositorOutputSurface.h>
 
 namespace WebKit {
 
 static inline PassOwnPtr<WebCore::CCGraphicsContext> createFakeCCGraphicsContext()
 {
-    return WebCore::CCGraphicsContext::create3D(CompositorFakeWebGraphicsContext3D::create(WebGraphicsContext3D::Attributes()));
+    return FakeWebCompositorOutputSurface::create(CompositorFakeWebGraphicsContext3D::create(WebGraphicsContext3D::Attributes()));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h b/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h
index 0b3c3fe9e..84804da96 100755
--- a/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h
+++ b/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h
@@ -28,6 +28,8 @@
 #include "config.h"
 
 #include "CompositorFakeWebGraphicsContext3D.h"
+#include "FakeWebCompositorOutputSurface.h"
+
 #include "cc/CCLayerTreeHost.h"
 
 namespace WebCore {
@@ -39,12 +41,13 @@ public:
     virtual void updateAnimations(double monotonicFrameBeginTime) OVERRIDE { }
     virtual void layout() OVERRIDE { }
     virtual void applyScrollAndScale(const IntSize& scrollDelta, float pageScale) OVERRIDE { }
-    virtual PassOwnPtr<WebKit::WebGraphicsContext3D> createContext3D() OVERRIDE
+
+    virtual PassOwnPtr<WebKit::WebCompositorOutputSurface> createOutputSurface() OVERRIDE
     {
         WebKit::WebGraphicsContext3D::Attributes attrs;
-        return WebKit::CompositorFakeWebGraphicsContext3D::create(WebKit::WebGraphicsContext3D::Attributes());
+        return WebKit::FakeWebCompositorOutputSurface::create(WebKit::CompositorFakeWebGraphicsContext3D::create(attrs));
     }
-    virtual void didRecreateContext(bool success) OVERRIDE { }
+    virtual void didRecreateOutputSurface(bool success) OVERRIDE { }
     virtual void willCommit() OVERRIDE { }
     virtual void didCommit() OVERRIDE { }
     virtual void didCommitAndDrawFrame() OVERRIDE { }
diff --git a/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp b/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp
index 720630e17..afffc1623 100644
--- a/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp
+++ b/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp
@@ -26,9 +26,10 @@
 #include "config.h"
 
 #include "FakeWebGraphicsContext3D.h"
-
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 using namespace WebCore;
 using namespace WebKit;
diff --git a/Source/Platform/chromium/public/WebCompositorTextureQuad.h b/Source/WebKit/chromium/tests/FakeWebCompositorOutputSurface.h
index 6b8869565..c20c9f991 100644
--- a/Source/Platform/chromium/public/WebCompositorTextureQuad.h
+++ b/Source/WebKit/chromium/tests/FakeWebCompositorOutputSurface.h
@@ -23,50 +23,56 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCompositorTextureQuad_h
-#define WebCompositorTextureQuad_h
+#ifndef FakeWebCompositorOutputSurface_h
+#define FakeWebCompositorOutputSurface_h
 
-#if WEBKIT_IMPLEMENTATION
-#include "FloatRect.h"
-#endif
-#include "WebCommon.h"
-#include "WebCompositorQuad.h"
-#include "WebFloatRect.h"
-#if WEBKIT_IMPLEMENTATION
-#include <wtf/PassOwnPtr.h>
-#endif
+#include <public/WebCompositorOutputSurface.h>
+#include <public/WebGraphicsContext3D.h>
 
 namespace WebKit {
 
-#pragma pack(push, 4)
-
-class WebCompositorTextureQuad : public WebCompositorQuad {
+class FakeWebCompositorOutputSurface : public WebCompositorOutputSurface {
 public:
-#if WEBKIT_IMPLEMENTATION
-    static PassOwnPtr<WebCompositorTextureQuad> create(const WebCompositorSharedQuadState*, const WebCore::IntRect&, unsigned resourceId, bool premultipliedAlpha, const WebCore::FloatRect& uvRect, bool flipped);
-    WebCore::FloatRect uvRect() const { return m_uvRect; }
-#endif
+    static inline PassOwnPtr<FakeWebCompositorOutputSurface> create(PassOwnPtr<WebGraphicsContext3D> context3D)
+    {
+        return adoptPtr(new FakeWebCompositorOutputSurface(context3D));
+    }
+
+
+    virtual bool bindToClient(WebCompositorOutputSurfaceClient* client) OVERRIDE
+    {
+        ASSERT(client);
+        if (!m_context3D->makeContextCurrent())
+            return false;
+        m_client = client;
+        return true;
+    }
 
-    unsigned resourceId() const { return m_resourceId; }
-    bool premultipliedAlpha() const { return  m_premultipliedAlpha; }
-    bool flipped() const { return m_flipped; }
+    virtual const Capabilities& capabilities() const OVERRIDE
+    {
+        return m_capabilities;
+    }
 
-    void setNeedsBlending();
+    virtual WebGraphicsContext3D* context3D() const OVERRIDE
+    {
+        return m_context3D.get();
+    }
+
+    virtual void sendFrameToParentCompositor(const WebCompositorFrame&) OVERRIDE
+    {
+    }
 
-    static const WebCompositorTextureQuad* materialCast(const WebCompositorQuad*);
 private:
-#if WEBKIT_IMPLEMENTATION
-    WebCompositorTextureQuad(const WebKit::WebCompositorSharedQuadState*, const WebCore::IntRect&, unsigned resourceId, bool premultipliedAlpha, const WebCore::FloatRect& uvRect, bool flipped);
-#endif
+    explicit FakeWebCompositorOutputSurface(PassOwnPtr<WebGraphicsContext3D> context3D)
+    {
+        m_context3D = context3D;
+    }
 
-    unsigned m_resourceId;
-    bool m_premultipliedAlpha;
-    WebFloatRect m_uvRect;
-    bool m_flipped;
+    OwnPtr<WebGraphicsContext3D> m_context3D;
+    Capabilities m_capabilities;
+    WebCompositorOutputSurfaceClient* m_client;
 };
 
-#pragma pack(pop)
-
-}
+} // namespace WebKit
 
-#endif
+#endif // FakeWebCompositorOutputSurface_h
diff --git a/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h b/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
index b864c35fd..bd3545f45 100644
--- a/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
+++ b/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
@@ -27,7 +27,7 @@
 #define FakeWebGraphicsContext3D_h
 
 #include "GraphicsContext3D.h"
-#include "platform/WebGraphicsContext3D.h"
+#include <public/WebGraphicsContext3D.h>
 
 namespace WebKit {
 
diff --git a/Source/WebKit/chromium/tests/FakeWebScrollbarThemeGeometry.h b/Source/WebKit/chromium/tests/FakeWebScrollbarThemeGeometry.h
new file mode 100644
index 000000000..0ca5436f2
--- /dev/null
+++ b/Source/WebKit/chromium/tests/FakeWebScrollbarThemeGeometry.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FakeWebScrollbarThemeGeometry_h
+#define FakeWebScrollbarThemeGeometry_h
+
+#include <public/WebScrollbarThemeGeometry.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+class FakeWebScrollbarThemeGeometry : public WebKit::WebScrollbarThemeGeometry {
+public:
+    static PassOwnPtr<WebKit::WebScrollbarThemeGeometry> create() { return adoptPtr(new WebKit::FakeWebScrollbarThemeGeometry()); }
+
+    virtual WebKit::WebScrollbarThemeGeometry* clone() const OVERRIDE
+    {
+        return new FakeWebScrollbarThemeGeometry();
+    }
+
+    virtual int thumbPosition(WebScrollbar*) OVERRIDE { return 0; }
+    virtual int thumbLength(WebScrollbar*) OVERRIDE { return 0; }
+    virtual int trackPosition(WebScrollbar*) OVERRIDE { return 0; }
+    virtual int trackLength(WebScrollbar*) OVERRIDE { return 0; }
+    virtual bool hasButtons(WebScrollbar*) OVERRIDE { return false; }
+    virtual bool hasThumb(WebScrollbar*) OVERRIDE { return false; }
+    virtual WebRect trackRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual WebRect thumbRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual int minimumThumbLength(WebScrollbar*) OVERRIDE { return 0; }
+    virtual int scrollbarThickness(WebScrollbar*) OVERRIDE { return 0; }
+    virtual WebRect backButtonStartRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual WebRect backButtonEndRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual WebRect forwardButtonStartRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual WebRect forwardButtonEndRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual WebRect constrainTrackRectToTrackPieces(WebScrollbar*, const WebRect&) OVERRIDE { return WebRect(); }
+
+    virtual void splitTrack(WebScrollbar*, const WebRect& track, WebRect& startTrack, WebRect& thumb, WebRect& endTrack) OVERRIDE
+    {
+        startTrack = WebRect();
+        thumb = WebRect();
+        endTrack = WebRect();
+    }
+};
+
+} // namespace WebKit
+
+#endif // FakeWebScrollbarThemeGeometry_h
diff --git a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
index 91aeb7ca5..21d0705b8 100644
--- a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
@@ -36,11 +36,10 @@
 #include "Matrix3DTransformOperation.h"
 #include "RotateTransformOperation.h"
 #include "TranslateTransformOperation.h"
-#include "WebCompositor.h"
-
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCSingleThreadProxy.h"
+#include <public/WebCompositor.h>
 
 #include <gtest/gtest.h>
 #include <public/WebGraphicsContext3D.h>
@@ -71,7 +70,7 @@ public:
         bool success = layerTreeHost->initialize();
         EXPECT_TRUE(success);
         layerTreeHost->setRootLayer(LayerChromium::create());
-        layerTreeHost->setViewportSize(IntSize(1, 1));
+        layerTreeHost->setViewportSize(IntSize(1, 1), IntSize(1, 1));
         return layerTreeHost.release();
     }
 
@@ -95,7 +94,7 @@ public:
         WebCompositor::setAcceleratedAnimationEnabled(true);
         WebCompositor::initialize(0);
         m_graphicsLayer = static_pointer_cast<GraphicsLayerChromium>(GraphicsLayer::create(&m_client));
-        m_platformLayer = static_cast<LayerChromium*>(m_graphicsLayer->platformLayer());
+        m_platformLayer = m_graphicsLayer->platformLayer()->unwrap<LayerChromium>();
         m_layerTreeHost = MockLayerTreeHost::create();
         m_platformLayer->setLayerTreeHost(m_layerTreeHost.get());
     }
@@ -133,7 +132,7 @@ TEST_F(GraphicsLayerChromiumTest, updateLayerPreserves3DWithAnimations)
 
     m_graphicsLayer->setPreserves3D(true);
 
-    m_platformLayer = static_cast<LayerChromium*>(m_graphicsLayer->platformLayer());
+    m_platformLayer = m_graphicsLayer->platformLayer()->unwrap<LayerChromium>();
     ASSERT_TRUE(m_platformLayer);
 
     ASSERT_TRUE(m_platformLayer->hasActiveAnimation());
@@ -142,7 +141,7 @@ TEST_F(GraphicsLayerChromiumTest, updateLayerPreserves3DWithAnimations)
 
     m_graphicsLayer->setPreserves3D(false);
 
-    m_platformLayer = static_cast<LayerChromium*>(m_graphicsLayer->platformLayer());
+    m_platformLayer = m_graphicsLayer->platformLayer()->unwrap<LayerChromium>();
     ASSERT_TRUE(m_platformLayer);
 
     ASSERT_FALSE(m_platformLayer->hasActiveAnimation());
diff --git a/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp b/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
index d9e3d697b..91df126a5 100644
--- a/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
@@ -74,7 +74,7 @@ public:
     {
         return adoptRef(new FailingBackingStore);
     }
-    virtual bool createIDBDatabaseMetaData(const String&, const String&, int64_t&)
+    virtual bool createIDBDatabaseMetaData(const String&, const String&, int64_t, int64_t&)
     {
         return false;
     }
diff --git a/Source/WebKit/chromium/tests/IDBFakeBackingStore.h b/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
index 536d785b9..8862b58d4 100644
--- a/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
+++ b/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
@@ -33,9 +33,10 @@ namespace WebCore {
 class IDBFakeBackingStore : public IDBBackingStore {
 public:
     virtual void getDatabaseNames(Vector<String>& foundNames) OVERRIDE { }
-    virtual bool getIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId) OVERRIDE { return false; }
-    virtual bool createIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId) OVERRIDE { return true; }
+    virtual bool getIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundIntVersion, int64_t& foundId) OVERRIDE { return false; }
+    virtual bool createIDBDatabaseMetaData(const String& name, const String& version, int64_t intVersion, int64_t& rowId) OVERRIDE { return true; }
     virtual bool updateIDBDatabaseMetaData(int64_t rowId, const String& version) OVERRIDE { return false; }
+    virtual bool updateIDBDatabaseIntVersion(int64_t rowId, int64_t version) OVERRIDE { return false; }
     virtual bool deleteDatabase(const String& name) OVERRIDE { return false; }
 
     virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<IDBKeyPath>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags) OVERRIDE { }
diff --git a/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp b/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
index 137699c30..1b2ff6fe1 100644
--- a/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
@@ -84,6 +84,24 @@ TEST(IDBLevelDBCodingTest, EncodeByte)
     EXPECT_EQ(expected, encodeByte(c));
 }
 
+TEST(IDBLevelDBCodingTest, DecodeByte)
+{
+    Vector<unsigned char> testCases;
+    testCases.append(0);
+    testCases.append(1);
+    testCases.append(255);
+
+    for (size_t i = 0; i < testCases.size(); ++i) {
+        unsigned char n = testCases[i];
+        Vector<char> v = encodeByte(n);
+
+        unsigned char res;
+        const char* p = decodeByte(v.data(), v.data() + v.size(), res);
+        EXPECT_EQ(n, res);
+        EXPECT_EQ(v.data() + v.size(), p);
+    }
+}
+   
 TEST(IDBLevelDBCodingTest, EncodeBool)
 {
     {
@@ -187,8 +205,10 @@ TEST(IDBLevelDBCodingTest, EncodeVarInt)
     EXPECT_EQ(static_cast<size_t>(2), encodeVarInt(255).size());
     EXPECT_EQ(static_cast<size_t>(2), encodeVarInt(256).size());
     EXPECT_EQ(static_cast<size_t>(5), encodeVarInt(0xffffffff).size());
+    EXPECT_EQ(static_cast<size_t>(8), encodeVarInt(0xfffffffffffffLL).size());
+    EXPECT_EQ(static_cast<size_t>(9), encodeVarInt(0x7fffffffffffffffLL).size());
 #ifdef NDEBUG
-    EXPECT_EQ(static_cast<size_t>(8), encodeInt(-100).size());
+    EXPECT_EQ(static_cast<size_t>(10), encodeVarInt(-100).size());
 #endif
 }
 
@@ -682,6 +702,24 @@ TEST(IDBLevelDBCodingTest, ComparisonTest)
     }
 }
 
+TEST(IDBLevelDBCodingTest, EncodeVarIntVSEncodeByteTest)
+{
+    Vector<unsigned char> testCases;
+    testCases.append(0);
+    testCases.append(1);
+    testCases.append(127);
+
+    for (size_t i = 0; i < testCases.size(); ++i) {
+        unsigned char n = testCases[i];
+
+        Vector<char> vA = encodeByte(n);
+        Vector<char> vB = encodeVarInt(static_cast<int64_t>(n));
+
+        EXPECT_EQ(vA.size(), vB.size());
+        EXPECT_EQ(*(vA.data()), *(vB.data()));
+    }
+}
+
 } // namespace
 
 #endif // USE(LEVELDB)
diff --git a/Source/WebKit/chromium/tests/IDBRequestTest.cpp b/Source/WebKit/chromium/tests/IDBRequestTest.cpp
new file mode 100644
index 000000000..0f3b77527
--- /dev/null
+++ b/Source/WebKit/chromium/tests/IDBRequestTest.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "IDBRequest.h"
+
+#include "IDBCursorBackendInterface.h"
+#include "IDBDatabaseBackendImpl.h"
+#include "IDBTransactionCoordinator.h"
+
+#include <gtest/gtest.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+using namespace WebCore;
+
+namespace {
+
+TEST(IDBRequestTest, EventsAfterStopping)
+{
+    ScriptExecutionContext* context = 0;
+    IDBTransaction* transaction = 0;
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::createInvalid(), transaction);
+    EXPECT_EQ(request->readyState(), "pending");
+    request->stop();
+
+    // Ensure none of the following raise assertions in stopped state:
+    request->onError(IDBDatabaseError::create(IDBDatabaseException::IDB_ABORT_ERR, "Description goes here."));
+    request->onSuccess(DOMStringList::create());
+    request->onSuccess(PassRefPtr<IDBDatabaseBackendInterface>());
+    request->onSuccess(PassRefPtr<IDBCursorBackendInterface>());
+    request->onSuccess(IDBKey::createInvalid());
+    request->onSuccess(PassRefPtr<IDBTransactionBackendInterface>());
+    request->onSuccess(SerializedScriptValue::nullValue());
+    request->onSuccess(SerializedScriptValue::nullValue(), IDBKey::createInvalid(), IDBKeyPath());
+    request->onSuccessWithContinuation();
+}
+
+} // namespace
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
index a932ab61c..1a14d75bc 100644
--- a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
@@ -29,13 +29,12 @@
 #include "CCLayerTreeTestCommon.h"
 #include "FakeCCLayerTreeHostClient.h"
 #include "LayerPainterChromium.h"
-#include "NonCompositedContentHost.h"
-#include "WebCompositor.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCSingleThreadProxy.h"
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
+#include <public/WebCompositor.h>
 #include <public/WebTransformationMatrix.h>
 
 using namespace WebCore;
@@ -495,7 +494,7 @@ TEST_F(LayerChromiumTest, checkPropertyChangeCausesCorrectBehavior)
 
     // Test properties that should not call needsDisplay and needsCommit when changed.
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setVisibleContentRect(IntRect(0, 0, 40, 50)));
-    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setIsNonCompositedContent(true));
+    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setUseLCDText(true));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setDrawOpacity(0.5));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setRenderTarget(0));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setDrawTransform(WebTransformationMatrix()));
diff --git a/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp b/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
index d861164f6..c4bddc5fb 100644
--- a/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
@@ -26,13 +26,14 @@
 #include "LayerRendererChromium.h"
 
 #include "CCTestCommon.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "FakeWebGraphicsContext3D.h"
 #include "GraphicsContext3D.h"
-#include "WebCompositor.h"
 #include "cc/CCDrawQuad.h"
 #include "cc/CCPrioritizedTextureManager.h"
 #include "cc/CCSettings.h"
 #include "cc/CCSingleThreadProxy.h"
+#include <public/WebCompositor.h>
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
@@ -128,7 +129,7 @@ protected:
     LayerRendererChromiumTest()
         : m_suggestHaveBackbufferYes(1, true)
         , m_suggestHaveBackbufferNo(1, false)
-        , m_context(CCGraphicsContext::create3D(adoptPtr(new FrameCountingMemoryAllocationSettingContext())))
+        , m_context(FakeWebCompositorOutputSurface::create(adoptPtr(new FrameCountingMemoryAllocationSettingContext())))
         , m_resourceProvider(CCResourceProvider::create(m_context.get()))
         , m_layerRendererChromium(&m_mockClient, m_resourceProvider.get())
     {
@@ -147,7 +148,7 @@ protected:
 
     void swapBuffers()
     {
-        m_layerRendererChromium.swapBuffers(IntRect());
+        m_layerRendererChromium.swapBuffers();
     }
 
     FrameCountingMemoryAllocationSettingContext* context() { return static_cast<FrameCountingMemoryAllocationSettingContext*>(m_context->context3D()); }
@@ -224,7 +225,7 @@ TEST_F(LayerRendererChromiumTest, DiscardedBackbufferIsRecreatedForScopeDuration
     EXPECT_EQ(1, m_mockClient.setFullRootLayerDamageCount());
 
     m_layerRendererChromium.setVisible(true);
-    m_layerRendererChromium.drawFrame(m_mockClient.renderPassesInDrawOrder(), m_mockClient.renderPasses(), FloatRect());
+    m_layerRendererChromium.drawFrame(m_mockClient.renderPassesInDrawOrder(), m_mockClient.renderPasses());
     EXPECT_FALSE(m_layerRendererChromium.isFramebufferDiscarded());
 
     swapBuffers();
@@ -239,7 +240,7 @@ TEST_F(LayerRendererChromiumTest, FramebufferDiscardedAfterReadbackWhenNotVisibl
     EXPECT_EQ(1, m_mockClient.setFullRootLayerDamageCount());
 
     char pixels[4];
-    m_layerRendererChromium.drawFrame(m_mockClient.renderPassesInDrawOrder(), m_mockClient.renderPasses(), FloatRect());
+    m_layerRendererChromium.drawFrame(m_mockClient.renderPassesInDrawOrder(), m_mockClient.renderPasses());
     EXPECT_FALSE(m_layerRendererChromium.isFramebufferDiscarded());
 
     m_layerRendererChromium.getFramebufferPixels(pixels, IntRect(0, 0, 1, 1));
@@ -318,7 +319,7 @@ TEST(LayerRendererChromiumTest2, initializationDoesNotMakeSynchronousCalls)
 {
     CCScopedSettings scopedSettings;
     FakeCCRendererClient mockClient;
-    OwnPtr<CCGraphicsContext> context(CCGraphicsContext::create3D(adoptPtr(new ForbidSynchronousCallContext)));
+    OwnPtr<CCGraphicsContext> context(FakeWebCompositorOutputSurface::create(adoptPtr(new ForbidSynchronousCallContext)));
     OwnPtr<CCResourceProvider> resourceProvider(CCResourceProvider::create(context.get()));
     FakeLayerRendererChromium layerRendererChromium(&mockClient, resourceProvider.get());
 
@@ -362,7 +363,7 @@ TEST(LayerRendererChromiumTest2, initializationWithQuicklyLostContextDoesNotAsse
 {
     CCScopedSettings scopedSettings;
     FakeCCRendererClient mockClient;
-    OwnPtr<CCGraphicsContext> context(CCGraphicsContext::create3D(adoptPtr(new LoseContextOnFirstGetContext)));
+    OwnPtr<CCGraphicsContext> context(FakeWebCompositorOutputSurface::create(adoptPtr(new LoseContextOnFirstGetContext)));
     OwnPtr<CCResourceProvider> resourceProvider(CCResourceProvider::create(context.get()));
     FakeLayerRendererChromium layerRendererChromium(&mockClient, resourceProvider.get());
 
@@ -384,7 +385,7 @@ public:
 TEST(LayerRendererChromiumTest2, initializationWithoutGpuMemoryManagerExtensionSupportShouldDefaultToNonZeroAllocation)
 {
     FakeCCRendererClient mockClient;
-    OwnPtr<CCGraphicsContext> context(CCGraphicsContext::create3D(adoptPtr(new ContextThatDoesNotSupportMemoryManagmentExtensions)));
+    OwnPtr<CCGraphicsContext> context(FakeWebCompositorOutputSurface::create(adoptPtr(new ContextThatDoesNotSupportMemoryManagmentExtensions)));
     OwnPtr<CCResourceProvider> resourceProvider(CCResourceProvider::create(context.get()));
     FakeLayerRendererChromium layerRendererChromium(&mockClient, resourceProvider.get());
 
@@ -411,7 +412,7 @@ private:
 TEST(LayerRendererChromiumTest2, opaqueBackground)
 {
     FakeCCRendererClient mockClient;
-    OwnPtr<CCGraphicsContext> ccContext(CCGraphicsContext::create3D(adoptPtr(new ClearCountingContext)));
+    OwnPtr<CCGraphicsContext> ccContext(FakeWebCompositorOutputSurface::create(adoptPtr(new ClearCountingContext)));
     ClearCountingContext* context = static_cast<ClearCountingContext*>(ccContext->context3D());
     OwnPtr<CCResourceProvider> resourceProvider(CCResourceProvider::create(ccContext.get()));
     FakeLayerRendererChromium layerRendererChromium(&mockClient, resourceProvider.get());
@@ -420,7 +421,7 @@ TEST(LayerRendererChromiumTest2, opaqueBackground)
 
     EXPECT_TRUE(layerRendererChromium.initialize());
 
-    layerRendererChromium.drawFrame(mockClient.renderPassesInDrawOrder(), mockClient.renderPasses(), FloatRect());
+    layerRendererChromium.drawFrame(mockClient.renderPassesInDrawOrder(), mockClient.renderPasses());
 
     // On DEBUG builds, render passes with opaque background clear to blue to
     // easily see regions that were not drawn on the screen.
@@ -434,7 +435,7 @@ TEST(LayerRendererChromiumTest2, opaqueBackground)
 TEST(LayerRendererChromiumTest2, transparentBackground)
 {
     FakeCCRendererClient mockClient;
-    OwnPtr<CCGraphicsContext> ccContext(CCGraphicsContext::create3D(adoptPtr(new ClearCountingContext)));
+    OwnPtr<CCGraphicsContext> ccContext(FakeWebCompositorOutputSurface::create(adoptPtr(new ClearCountingContext)));
     ClearCountingContext* context = static_cast<ClearCountingContext*>(ccContext->context3D());
     OwnPtr<CCResourceProvider> resourceProvider(CCResourceProvider::create(ccContext.get()));
     FakeLayerRendererChromium layerRendererChromium(&mockClient, resourceProvider.get());
@@ -443,7 +444,7 @@ TEST(LayerRendererChromiumTest2, transparentBackground)
 
     EXPECT_TRUE(layerRendererChromium.initialize());
 
-    layerRendererChromium.drawFrame(mockClient.renderPassesInDrawOrder(), mockClient.renderPasses(), FloatRect());
+    layerRendererChromium.drawFrame(mockClient.renderPassesInDrawOrder(), mockClient.renderPasses());
 
     EXPECT_EQ(1, context->clearCount());
 }
diff --git a/Source/WebKit/chromium/tests/LocaleMacTest.cpp b/Source/WebKit/chromium/tests/LocaleMacTest.cpp
index 1150a301a..f6b0f6292 100644
--- a/Source/WebKit/chromium/tests/LocaleMacTest.cpp
+++ b/Source/WebKit/chromium/tests/LocaleMacTest.cpp
@@ -118,6 +118,12 @@ protected:
         OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
         return locale->timeAMPMLabels()[index];
     }
+
+    String decimalSeparator(const String& localeString)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        return locale->localizedDecimalSeparator();
+    }
 #endif
 };
 
@@ -207,4 +213,44 @@ TEST_F(LocaleMacTest, timeAMPMLabels)
     EXPECT_STREQ("\xE5\x8D\x88\xE5\x89\x8D", timeAMPMLabel("ja_JP", 0).utf8().data());
     EXPECT_STREQ("\xE5\x8D\x88\xE5\xBE\x8C", timeAMPMLabel("ja_JP", 1).utf8().data());
 }
+
+TEST_F(LocaleMacTest, decimalSeparator)
+{
+    EXPECT_STREQ(".", decimalSeparator("en_US").utf8().data());
+    EXPECT_STREQ(",", decimalSeparator("fr_FR").utf8().data());
+}
 #endif
+
+static void testNumberIsReversible(const String& localeString, const char* original, const char* shouldHave = 0)
+{
+    OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+    String localized = locale->convertToLocalizedNumber(original);
+    if (shouldHave)
+        EXPECT_TRUE(localized.contains(shouldHave));
+    String converted = locale->convertFromLocalizedNumber(localized);
+    EXPECT_STREQ(original, converted.utf8().data());
+}
+
+void testNumbers(const String& localeString, const char* decimalSeparatorShouldBe = 0)
+{
+    testNumberIsReversible(localeString, "123456789012345678901234567890");
+    testNumberIsReversible(localeString, "-123.456", decimalSeparatorShouldBe);
+    testNumberIsReversible(localeString, ".456", decimalSeparatorShouldBe);
+    testNumberIsReversible(localeString, "-0.456", decimalSeparatorShouldBe);
+}
+
+TEST_F(LocaleMacTest, localizedNumberRoundTrip)
+{
+    // Test some of major locales.
+    testNumbers("en_US", ".");
+    testNumbers("fr_FR", ",");
+    testNumbers("ar");
+    testNumbers("de_DE");
+    testNumbers("es_ES");
+    testNumbers("fa");
+    testNumbers("ja_JP");
+    testNumbers("ko_KR");
+    testNumbers("zh_CN");
+    testNumbers("zh_HK");
+    testNumbers("zh_TW");
+}
diff --git a/Source/WebKit/chromium/tests/LocaleWinTest.cpp b/Source/WebKit/chromium/tests/LocaleWinTest.cpp
index 8da2f4461..5f5642e91 100644
--- a/Source/WebKit/chromium/tests/LocaleWinTest.cpp
+++ b/Source/WebKit/chromium/tests/LocaleWinTest.cpp
@@ -57,10 +57,19 @@ protected:
     };
 
     // See http://msdn.microsoft.com/en-us/goglobal/bb964664.aspx
+    // Note that some locales are country-neutral.
     enum {
-        EnglishUS = 0x409,
-        FrenchFR = 0x40C,
-        JapaneseJP = 0x411,
+        ArabicEG = 0x0C01, // ar-eg
+        ChineseCN = 0x0804, // zh-cn
+        ChineseHK = 0x0C04, // zh-hk
+        ChineseTW = 0x0404, // zh-tw
+        German = 0x0407, // de
+        EnglishUS = 0x409, // en-us
+        FrenchFR = 0x40C, // fr
+        JapaneseJP = 0x411, // ja
+        KoreanKR = 0x0412, // ko
+        Persian = 0x0429, // fa
+        Spanish = 0x040A, // es
     };
 
     DateComponents dateComponents(int year, int month, int day)
@@ -131,6 +140,12 @@ protected:
         OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
         return locale->timeAMPMLabels()[index];
     }
+
+    String decimalSeparator(LCID lcid)
+    {
+        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+        return locale->localizedDecimalSeparator();
+    }
 #endif
 };
 
@@ -328,4 +343,52 @@ TEST_F(LocaleWinTest, timeAMPMLabels)
     EXPECT_STREQ("\xE5\x8D\x88\xE5\x89\x8D", timeAMPMLabel(JapaneseJP, 0).utf8().data());
     EXPECT_STREQ("\xE5\x8D\x88\xE5\xBE\x8C", timeAMPMLabel(JapaneseJP, 1).utf8().data());
 }
+
+TEST_F(LocaleWinTest, decimalSeparator)
+{
+    EXPECT_STREQ(".", decimalSeparator(EnglishUS).utf8().data());
+    EXPECT_STREQ(",", decimalSeparator(FrenchFR).utf8().data());
+}
 #endif
+
+static void testNumberIsReversible(LCID lcid, const char* original, const char* shouldHave = 0)
+{
+    OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+    String localized = locale->convertToLocalizedNumber(original);
+    if (shouldHave)
+        EXPECT_TRUE(localized.contains(shouldHave));
+    String converted = locale->convertFromLocalizedNumber(localized);
+    EXPECT_STREQ(original, converted.utf8().data());
+}
+
+void testNumbers(LCID lcid)
+{
+    testNumberIsReversible(lcid, "123456789012345678901234567890");
+    testNumberIsReversible(lcid, "-123.456");
+    testNumberIsReversible(lcid, ".456");
+    testNumberIsReversible(lcid, "-0.456");
+}
+
+TEST_F(LocaleWinTest, localizedNumberRoundTrip)
+{
+    testNumberIsReversible(EnglishUS, "123456789012345678901234567890");
+    testNumberIsReversible(EnglishUS, "-123.456", ".");
+    testNumberIsReversible(EnglishUS, ".456", ".");
+    testNumberIsReversible(EnglishUS, "-0.456", ".");
+
+    testNumberIsReversible(FrenchFR, "123456789012345678901234567890");
+    testNumberIsReversible(FrenchFR, "-123.456", ",");
+    testNumberIsReversible(FrenchFR, ".456", ",");
+    testNumberIsReversible(FrenchFR, "-0.456", ",");
+
+    // Test some of major locales.
+    testNumbers(ArabicEG);
+    testNumbers(German);
+    testNumbers(Spanish);
+    testNumbers(Persian);
+    testNumbers(JapaneseJP);
+    testNumbers(KoreanKR);
+    testNumbers(ChineseCN);
+    testNumbers(ChineseHK);
+    testNumbers(ChineseTW);
+}
diff --git a/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp b/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp
new file mode 100644
index 000000000..052936dab
--- /dev/null
+++ b/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp
@@ -0,0 +1,228 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "DataRef.h"
+#include "MemoryInstrumentationImpl.h"
+
+#include <gtest/gtest.h>
+
+#include <wtf/HashSet.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+using namespace WebCore;
+
+namespace {
+
+class NotInstrumented {
+public:
+    char m_data[42];
+};
+
+class Instrumented {
+public:
+    Instrumented() : m_notInstrumented(new NotInstrumented) { }
+    virtual ~Instrumented() { delete m_notInstrumented; }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        info.addMember(m_notInstrumented);
+    }
+    NotInstrumented* m_notInstrumented;
+};
+
+TEST(MemoryInstrumentationTest, sizeOf)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    Instrumented instrumented;
+    impl.addRootObject(instrumented);
+    EXPECT_EQ(sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(1, visitedObjects.size());
+}
+
+TEST(MemoryInstrumentationTest, nullCheck)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    Instrumented* instrumented = 0;
+    impl.addRootObject(instrumented);
+    EXPECT_EQ(0u, impl.reportedSizeForAllTypes());
+    EXPECT_EQ(0, visitedObjects.size());
+}
+
+TEST(MemoryInstrumentationTest, ptrVsRef)
+{
+    {
+        VisitedObjects visitedObjects;
+        MemoryInstrumentationImpl impl(visitedObjects);
+        Instrumented instrumented;
+        impl.addRootObject(&instrumented);
+        EXPECT_EQ(sizeof(Instrumented) + sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+        EXPECT_EQ(2, visitedObjects.size());
+    }
+    {
+        VisitedObjects visitedObjects;
+        MemoryInstrumentationImpl impl(visitedObjects);
+        Instrumented instrumented;
+        impl.addRootObject(instrumented);
+        EXPECT_EQ(sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+        EXPECT_EQ(1, visitedObjects.size());
+    }
+}
+
+TEST(MemoryInstrumentationTest, ownPtr)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    OwnPtr<Instrumented> instrumented(adoptPtr(new Instrumented));
+    impl.addRootObject(instrumented);
+    EXPECT_EQ(sizeof(Instrumented) + sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+class InstrumentedRefPtr : public RefCounted<InstrumentedRefPtr> {
+public:
+    InstrumentedRefPtr() : m_notInstrumented(new NotInstrumented) { }
+    virtual ~InstrumentedRefPtr() { delete m_notInstrumented; }
+    static PassRefPtr<InstrumentedRefPtr> create() { return adoptRef(new InstrumentedRefPtr()); }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        info.addMember(m_notInstrumented);
+    }
+    NotInstrumented* m_notInstrumented;
+};
+
+TEST(MemoryInstrumentationTest, dataRef)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    DataRef<InstrumentedRefPtr> instrumentedRefPtr;
+    instrumentedRefPtr.init();
+    impl.addRootObject(instrumentedRefPtr);
+    EXPECT_EQ(sizeof(InstrumentedRefPtr) + sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+TEST(MemoryInstrumentationTest, refPtr)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    RefPtr<InstrumentedRefPtr> instrumentedRefPtr(adoptRef(new InstrumentedRefPtr));
+    impl.addRootObject(instrumentedRefPtr);
+    EXPECT_EQ(sizeof(InstrumentedRefPtr) + sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+class InstrumentedWithOwnPtr : public Instrumented {
+public:
+    InstrumentedWithOwnPtr() : m_notInstrumentedOwnPtr(adoptPtr(new NotInstrumented)) { }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+        Instrumented::reportMemoryUsage(memoryObjectInfo);
+        info.addMember(m_notInstrumentedOwnPtr);
+    }
+    OwnPtr<NotInstrumented> m_notInstrumentedOwnPtr;
+};
+
+TEST(MemoryInstrumentationTest, ownPtrNotInstrumented)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    InstrumentedWithOwnPtr instrumentedWithOwnPtr;
+    impl.addRootObject(instrumentedWithOwnPtr);
+    EXPECT_EQ(2 * sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+class InstrumentedOther {
+public:
+    InstrumentedOther() : m_data(0) { }
+
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Other);
+    }
+    int m_data;
+};
+
+class InstrumentedDOM {
+public:
+    InstrumentedDOM() : m_instrumentedOther(adoptPtr(new InstrumentedOther)) { }
+
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        info.addInstrumentedMember(m_instrumentedOther);
+    }
+    OwnPtr<InstrumentedOther> m_instrumentedOther;
+};
+
+TEST(MemoryInstrumentationTest, ownerTypePropagation)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    OwnPtr<InstrumentedDOM> instrumentedDOM(adoptPtr(new InstrumentedDOM));
+    impl.addRootObject(instrumentedDOM);
+    EXPECT_EQ(sizeof(InstrumentedDOM) + sizeof(InstrumentedOther), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(sizeof(InstrumentedDOM) + sizeof(InstrumentedOther), impl.totalSize(MemoryInstrumentation::DOM));
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+class NonVirtualInstrumented {
+public:
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        info.addInstrumentedMember(m_instrumented);
+    }
+
+    Instrumented m_instrumented;
+};
+
+TEST(MemoryInstrumentationTest, visitFirstMemberInNonVirtualClass)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    NonVirtualInstrumented nonVirtualInstrumented;
+    impl.addRootObject(&nonVirtualInstrumented);
+    EXPECT_EQ(sizeof(NonVirtualInstrumented) + sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+} // namespace
+
diff --git a/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp b/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp
index 6c6c359a9..927d4a9c3 100644
--- a/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp
+++ b/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp
@@ -64,6 +64,7 @@ public:
     MOCK_METHOD1(setScrollOffsetFromAnimation, void(const IntPoint&));
     MOCK_CONST_METHOD0(enclosingScrollableArea, ScrollableArea*());
 
+    virtual IntPoint scrollPosition() const { return IntPoint(); }
     virtual int visibleHeight() const { return 768; }
     virtual int visibleWidth() const { return 1024; }
 
diff --git a/Source/WebKit/chromium/tests/ScrollbarLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/ScrollbarLayerChromiumTest.cpp
index d2cd9befc..0e3b1fbdb 100644
--- a/Source/WebKit/chromium/tests/ScrollbarLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/ScrollbarLayerChromiumTest.cpp
@@ -26,12 +26,17 @@
 
 #include "ScrollbarLayerChromium.h"
 
+#include "FakeWebScrollbarThemeGeometry.h"
 #include "Scrollbar.h"
 #include "Settings.h"
 #include "TreeSynchronizer.h"
+#include "cc/CCScrollbarAnimationController.h"
 #include "cc/CCScrollbarLayerImpl.h"
 #include "cc/CCSingleThreadProxy.h"
 #include <gtest/gtest.h>
+#include <public/WebScrollbar.h>
+#include <public/WebScrollbarThemeGeometry.h>
+#include <public/WebScrollbarThemePainter.h>
 
 using namespace WebCore;
 
@@ -60,7 +65,7 @@ public:
     virtual bool isScrollableAreaActive() const { return false; }
     virtual bool isScrollViewScrollbar() const { return false; }
 
-    virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint) { return IntPoint(); }
+    virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint) { return windowPoint; }
 
     virtual bool isCustomScrollbar() const { return false; }
     virtual ScrollbarOrientation orientation() const { return HorizontalScrollbar; }
@@ -83,6 +88,8 @@ public:
     virtual bool enabled() const { return false; }
     virtual void setEnabled(bool) { }
 
+    virtual bool isOverlayScrollbar() const { return false; }
+
     MockScrollbar() : Scrollbar(0, HorizontalScrollbar, RegularScrollbar) { }
     virtual ~MockScrollbar() { }
 };
@@ -91,12 +98,15 @@ TEST(ScrollbarLayerChromiumTest, resolveScrollLayerPointer)
 {
     DebugScopedSetImplThread impl;
 
+    RefPtr<MockScrollbar> mockScrollbar = adoptRef(new MockScrollbar);
+    WebKit::WebScrollbarThemePainter painter(0, mockScrollbar.get());
+
     Settings::setMockScrollbarsEnabled(true);
     {
-        RefPtr<MockScrollbar> scrollbar = adoptRef(new MockScrollbar);
+        OwnPtr<WebKit::WebScrollbar> scrollbar = WebKit::WebScrollbar::create(mockScrollbar.get());
         RefPtr<LayerChromium> layerTreeRoot = LayerChromium::create();
         RefPtr<LayerChromium> child1 = LayerChromium::create();
-        RefPtr<LayerChromium> child2 = ScrollbarLayerChromium::create(scrollbar.get(), child1->id());
+        RefPtr<LayerChromium> child2 = ScrollbarLayerChromium::create(scrollbar.release(), painter, WebKit::FakeWebScrollbarThemeGeometry::create(), child1->id());
         layerTreeRoot->addChild(child1);
         layerTreeRoot->addChild(child2);
 
@@ -105,14 +115,15 @@ TEST(ScrollbarLayerChromiumTest, resolveScrollLayerPointer)
         CCLayerImpl* ccChild1 = ccLayerTreeRoot->children()[0].get();
         CCScrollbarLayerImpl* ccChild2 = static_cast<CCScrollbarLayerImpl*>(ccLayerTreeRoot->children()[1].get());
 
-        EXPECT_EQ(ccChild1, ccChild2->scrollLayer());
+        EXPECT_TRUE(ccChild1->scrollbarAnimationController());
+        EXPECT_EQ(ccChild1->horizontalScrollbarLayer(), ccChild2);
     }
 
     { // another traverse order
-        RefPtr<MockScrollbar> scrollbar = adoptRef(new MockScrollbar);
+        OwnPtr<WebKit::WebScrollbar> scrollbar = WebKit::WebScrollbar::create(mockScrollbar.get());
         RefPtr<LayerChromium> layerTreeRoot = LayerChromium::create();
         RefPtr<LayerChromium> child2 = LayerChromium::create();
-        RefPtr<LayerChromium> child1 = ScrollbarLayerChromium::create(scrollbar.get(), child2->id());
+        RefPtr<LayerChromium> child1 = ScrollbarLayerChromium::create(scrollbar.release(), painter, WebKit::FakeWebScrollbarThemeGeometry::create(), child2->id());
         layerTreeRoot->addChild(child1);
         layerTreeRoot->addChild(child2);
 
@@ -121,8 +132,56 @@ TEST(ScrollbarLayerChromiumTest, resolveScrollLayerPointer)
         CCScrollbarLayerImpl* ccChild1 = static_cast<CCScrollbarLayerImpl*>(ccLayerTreeRoot->children()[0].get());
         CCLayerImpl* ccChild2 = ccLayerTreeRoot->children()[1].get();
 
-        EXPECT_EQ(ccChild1->scrollLayer(), ccChild2);
+        EXPECT_TRUE(ccChild2->scrollbarAnimationController());
+        EXPECT_EQ(ccChild2->horizontalScrollbarLayer(), ccChild1);
     }
 }
 
+TEST(ScrollbarLayerChromiumTest, scrollOffsetSynchronization)
+{
+    DebugScopedSetImplThread impl;
+
+    RefPtr<MockScrollbar> mockScrollbar = adoptRef(new MockScrollbar);
+    WebKit::WebScrollbarThemePainter painter(0, mockScrollbar.get());
+
+    Settings::setMockScrollbarsEnabled(true);
+
+    OwnPtr<WebKit::WebScrollbar> scrollbar = WebKit::WebScrollbar::create(mockScrollbar.get());
+    RefPtr<LayerChromium> layerTreeRoot = LayerChromium::create();
+    RefPtr<LayerChromium> contentLayer = LayerChromium::create();
+    RefPtr<LayerChromium> scrollbarLayer = ScrollbarLayerChromium::create(scrollbar.release(), painter, WebKit::FakeWebScrollbarThemeGeometry::create(), layerTreeRoot->id());
+    layerTreeRoot->addChild(contentLayer);
+    layerTreeRoot->addChild(scrollbarLayer);
+
+    layerTreeRoot->setScrollPosition(IntPoint(10, 20));
+    layerTreeRoot->setMaxScrollPosition(IntSize(30, 50));
+    contentLayer->setBounds(IntSize(100, 200));
+
+    OwnPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), nullptr, 0);
+
+    CCScrollbarLayerImpl* ccScrollbarLayer = static_cast<CCScrollbarLayerImpl*>(ccLayerTreeRoot->children()[1].get());
+
+    EXPECT_EQ(10, ccScrollbarLayer->currentPos());
+    EXPECT_EQ(100, ccScrollbarLayer->totalSize());
+    EXPECT_EQ(30, ccScrollbarLayer->maximum());
+
+    layerTreeRoot->setScrollPosition(IntPoint(100, 200));
+    layerTreeRoot->setMaxScrollPosition(IntSize(300, 500));
+    contentLayer->setBounds(IntSize(1000, 2000));
+
+    CCScrollbarAnimationController* scrollbarController = ccLayerTreeRoot->scrollbarAnimationController();
+    ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), ccLayerTreeRoot.release(), 0);
+    EXPECT_EQ(scrollbarController, ccLayerTreeRoot->scrollbarAnimationController());
+
+    EXPECT_EQ(100, ccScrollbarLayer->currentPos());
+    EXPECT_EQ(1000, ccScrollbarLayer->totalSize());
+    EXPECT_EQ(300, ccScrollbarLayer->maximum());
+
+    ccLayerTreeRoot->scrollBy(FloatSize(12, 34));
+
+    EXPECT_EQ(112, ccScrollbarLayer->currentPos());
+    EXPECT_EQ(1000, ccScrollbarLayer->totalSize());
+    EXPECT_EQ(300, ccScrollbarLayer->maximum());
+}
+
 }
diff --git a/Source/WebKit/chromium/tests/TextureCopierTest.cpp b/Source/WebKit/chromium/tests/TextureCopierTest.cpp
index 776e23bfd..432dd7c4a 100644
--- a/Source/WebKit/chromium/tests/TextureCopierTest.cpp
+++ b/Source/WebKit/chromium/tests/TextureCopierTest.cpp
@@ -27,7 +27,6 @@
 #include "TextureCopier.h"
 
 #include "FakeWebGraphicsContext3D.h"
-#include "GraphicsContext3DPrivate.h"
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
@@ -76,5 +75,6 @@ TEST(TextureCopierTest, testDrawArraysCopy)
     int destTextureId = 2;
     IntSize size(256, 128);
     OwnPtr<AcceleratedTextureCopier> copier(AcceleratedTextureCopier::create(mockContext.get(), false));
-    copier->copyTexture(sourceTextureId, destTextureId, size);
+    TextureCopier::Parameters copy = { sourceTextureId, destTextureId, size };
+    copier->copyTexture(copy);
 }
diff --git a/Source/WebKit/chromium/tests/TextureLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/TextureLayerChromiumTest.cpp
index d0cc3d96f..54e253995 100644
--- a/Source/WebKit/chromium/tests/TextureLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/TextureLayerChromiumTest.cpp
@@ -27,10 +27,10 @@
 #include "TextureLayerChromium.h"
 
 #include "FakeCCLayerTreeHostClient.h"
-#include "WebCompositor.h"
 #include "cc/CCLayerTreeHost.h"
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
+#include <public/WebCompositor.h>
 
 using namespace WebCore;
 using ::testing::Mock;
diff --git a/Source/WebKit/chromium/tests/ThrottledTextureUploaderTest.cpp b/Source/WebKit/chromium/tests/ThrottledTextureUploaderTest.cpp
index 39a57d131..3660c9412 100644
--- a/Source/WebKit/chromium/tests/ThrottledTextureUploaderTest.cpp
+++ b/Source/WebKit/chromium/tests/ThrottledTextureUploaderTest.cpp
@@ -26,8 +26,8 @@
 
 #include "ThrottledTextureUploader.h"
 
+#include "Extensions3DChromium.h"
 #include "FakeWebGraphicsContext3D.h"
-#include "GraphicsContext3DPrivate.h"
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
diff --git a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
index e39fe7e56..bab7168c4 100644
--- a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
@@ -33,11 +33,12 @@
 #include "FakeCCGraphicsContext.h"
 #include "FakeCCLayerTreeHostClient.h"
 #include "LayerPainterChromium.h"
-#include "WebCompositor.h"
 #include "cc/CCOverdrawMetrics.h"
 #include "cc/CCRenderingStats.h"
 #include "cc/CCSingleThreadProxy.h" // For DebugScopedSetImplThread
+#include "cc/CCTextureUpdateController.h"
 #include <gtest/gtest.h>
+#include <public/WebCompositor.h>
 #include <public/WebTransformationMatrix.h>
 
 using namespace WebCore;
@@ -57,7 +58,7 @@ class TestCCOcclusionTracker : public CCOcclusionTracker {
 public:
     TestCCOcclusionTracker()
         : CCOcclusionTracker(IntRect(0, 0, 1000, 1000), true)
-        , m_scissorRectInScreen(IntRect(0, 0, 1000, 1000))
+        , m_layerClipRectInTarget(IntRect(0, 0, 1000, 1000))
     {
         // Pretend we have visited a render surface.
         m_stack.append(StackObject());
@@ -66,10 +67,10 @@ public:
     void setOcclusion(const Region& occlusion) { m_stack.last().occlusionInScreen = occlusion; }
 
 protected:
-    virtual IntRect layerScissorRectInTargetSurface(const LayerChromium* layer) const { return m_scissorRectInScreen; }
+    virtual IntRect layerClipRectInTarget(const LayerChromium* layer) const OVERRIDE { return m_layerClipRectInTarget; }
 
 private:
-    IntRect m_scissorRectInScreen;
+    IntRect m_layerClipRectInTarget;
 };
 
 class TiledLayerChromiumTest : public testing::Test {
@@ -89,12 +90,12 @@ public:
 
     void updateTextures(int count = 500)
     {
-        m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, count);
+        CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, &m_queue, count);
     }
 public:
     OwnPtr<CCGraphicsContext> m_context;
     OwnPtr<CCResourceProvider> m_resourceProvider;
-    CCTextureUpdater m_updater;
+    CCTextureUpdateQueue m_queue;
     CCRenderingStats m_stats;
     FakeTextureCopier m_copier;
     FakeTextureUploader m_uploader;
@@ -118,7 +119,7 @@ TEST_F(TiledLayerChromiumTest, pushDirtyTiles)
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -131,7 +132,7 @@ TEST_F(TiledLayerChromiumTest, pushDirtyTiles)
     // ....but then only update one of them.
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 100), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
     layer->pushPropertiesTo(layerImpl.get());
 
     // We should only have the first tile since the other tile was invalidated but not painted.
@@ -149,13 +150,14 @@ TEST_F(TiledLayerChromiumTest, pushOccludedDirtyTiles)
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
+    layer->setDrawableContentRect(IntRect(0, 0, 100, 200));
     layer->setVisibleContentRect(IntRect(0, 0, 100, 200));
     layer->invalidateContentRect(IntRect(0, 0, 100, 200));
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), &occluded, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -171,7 +173,7 @@ TEST_F(TiledLayerChromiumTest, pushOccludedDirtyTiles)
     layer->invalidateContentRect(IntRect(0, 0, 50, 50));
     // ....but the area is occluded.
     occluded.setOcclusion(IntRect(0, 0, 50, 50));
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 100), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), &occluded, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -199,7 +201,7 @@ TEST_F(TiledLayerChromiumTest, pushDeletedTiles)
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -221,7 +223,7 @@ TEST_F(TiledLayerChromiumTest, pushDeletedTiles)
     // This should recreate and update the deleted textures.
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 100), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -250,7 +252,7 @@ TEST_F(TiledLayerChromiumTest, pushIdlePaintTiles)
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
-    layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+    layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
     updateTextures();
 
     // We should need idle-painting for 3x3 tiles in the center.
@@ -266,7 +268,7 @@ TEST_F(TiledLayerChromiumTest, pushIdlePaintTiles)
         layer->setTexturePriorities(m_priorityCalculator);
         textureManager->prioritizeTextures();
 
-        layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+        layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
         EXPECT_TRUE(layer->needsIdlePaint(visibleRect));
         updateTextures();
         layer->pushPropertiesTo(layerImpl.get());
@@ -317,8 +319,8 @@ TEST_F(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
     layer2->setTexturePriorities(m_priorityCalculator);
     layer1->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer1->updateContentRect(m_updater, layerRect, 0, m_stats);
-    layer2->updateContentRect(m_updater, IntRect(0, 0, 100, 100), 0, m_stats);
+    layer1->updateContentRect(m_queue, layerRect, 0, m_stats);
+    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
 
     // We should need idle-painting for both remaining tiles in layer2.
     EXPECT_TRUE(layer2->needsIdlePaint(layer2Rect));
@@ -335,7 +337,7 @@ TEST_F(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
     layer2->setTexturePriorities(m_priorityCalculator);
     layer1->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer2->updateContentRect(m_updater, IntRect(0, 0, 100, 100), 0, m_stats);
+    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
 
     // Oh well, commit the frame and push.
     updateTextures();
@@ -355,8 +357,8 @@ TEST_F(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
     layer2->setTexturePriorities(m_priorityCalculator);
     layer1->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer2->updateContentRect(m_updater, layer2Rect, 0, m_stats);
-    layer1->updateContentRect(m_updater, layerRect, 0, m_stats);
+    layer2->updateContentRect(m_queue, layer2Rect, 0, m_stats);
+    layer1->updateContentRect(m_queue, layerRect, 0, m_stats);
 
     updateTextures();
     layer1->pushPropertiesTo(layerImpl1.get());
@@ -387,7 +389,7 @@ TEST_F(TiledLayerChromiumTest, pushIdlePaintedOccludedTiles)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 100), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), &occluded, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -412,7 +414,7 @@ TEST_F(TiledLayerChromiumTest, pushTilesMarkedDirtyDuringPaint)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -442,11 +444,11 @@ TEST_F(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnNextLayer)
     layer2->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
-    layer1->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer1->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
 
     // Invalidate a tile on layer1
     layer2->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer1.get());
-    layer2->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
 
     updateTextures();
     layer1->pushPropertiesTo(layer1Impl.get());
@@ -482,8 +484,8 @@ TEST_F(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnPreviousLay
 
     // Invalidate a tile on layer2
     layer1->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer2.get());
-    layer1->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
-    layer2->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer1->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures();
     layer1->pushPropertiesTo(layer1Impl.get());
     layer2->pushPropertiesTo(layer2Impl.get());
@@ -517,7 +519,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintOutOfMemory)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+    layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
 
     // Idle-painting should see no more priority tiles for painting.
     EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
@@ -530,7 +532,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintOutOfMemory)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+    layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
 
     // We shouldn't signal we need another idle paint.
     EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
@@ -559,7 +561,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintZeroSizedLayer)
         textureManager->prioritizeTextures();
 
         // Empty layers don't paint or idle-paint.
-        layer->updateContentRect(m_updater, contentRect, 0, m_stats);
+        layer->updateContentRect(m_queue, contentRect, 0, m_stats);
 
         // Empty layers don't have tiles.
         EXPECT_EQ(0u, layer->numPaintedTiles());
@@ -595,7 +597,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintNonVisibleLayers)
         // Paint / idle-paint.
         layer->setTexturePriorities(m_priorityCalculator);
         textureManager->prioritizeTextures();
-        layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+        layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
 
         // Non-visible layers don't need idle paint.
         EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
@@ -658,7 +660,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintNonVisibleAnimatingLayers)
                 layer->setTexturePriorities(m_priorityCalculator);
                 textureManager->prioritizeTextures();
 
-                layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+                layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
                 updateTextures();
                 layer->pushPropertiesTo(layerImpl.get());
             }
@@ -671,7 +673,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintNonVisibleAnimatingLayers)
                 layer->setTexturePriorities(m_priorityCalculator);
                 textureManager->prioritizeTextures();
 
-                layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+                layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
                 updateTextures();
                 layer->pushPropertiesTo(layerImpl.get());
             }
@@ -694,7 +696,7 @@ TEST_F(TiledLayerChromiumTest, invalidateFromPrepare)
     layer->invalidateContentRect(IntRect(0, 0, 100, 200));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures(1000);
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -705,7 +707,7 @@ TEST_F(TiledLayerChromiumTest, invalidateFromPrepare)
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
     // Invoke updateContentRect again. As the layer is valid updateContentRect shouldn't be invoked on
     // the LayerTextureUpdater.
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures(1000);
     EXPECT_EQ(0, layer->fakeLayerTextureUpdater()->prepareCount());
 
@@ -713,12 +715,12 @@ TEST_F(TiledLayerChromiumTest, invalidateFromPrepare)
     // setRectToInvalidate triggers invalidateContentRect() being invoked from updateContentRect.
     layer->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(25, 25, 50, 50), layer.get());
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures(1000);
     EXPECT_EQ(1, layer->fakeLayerTextureUpdater()->prepareCount());
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
     // The layer should still be invalid as updateContentRect invoked invalidate.
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures(1000);
     EXPECT_EQ(1, layer->fakeLayerTextureUpdater()->prepareCount());
 }
@@ -745,7 +747,7 @@ TEST_F(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, contentBounds, 0, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, 0, m_stats);
     EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 300, 300 * 0.8), layer->updateRect());
     updateTextures();
 
@@ -753,7 +755,7 @@ TEST_F(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_updater, contentBounds, 0, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, 0, m_stats);
     EXPECT_FLOAT_RECT_EQ(FloatRect(layerBounds), layer->updateRect());
     updateTextures();
 
@@ -762,7 +764,7 @@ TEST_F(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
     layer->invalidateContentRect(partialDamage);
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, contentBounds, 0, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, 0, m_stats);
     EXPECT_FLOAT_RECT_EQ(FloatRect(45, 80, 15, 8), layer->updateRect());
 }
 
@@ -784,7 +786,7 @@ TEST_F(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     // Push the tiles to the impl side and check that there is exactly one.
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 100), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
@@ -801,7 +803,7 @@ TEST_F(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     // The impl side should get 2x2 tiles now.
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 200, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 200, 200), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
@@ -813,7 +815,7 @@ TEST_F(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     // impl side.
     layer->setNeedsDisplay();
     layer->setTexturePriorities(m_priorityCalculator);
-    layer->updateContentRect(m_updater, IntRect(1, 0, 0, 1), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(1, 0, 0, 1), 0, m_stats);
     textureManager->prioritizeTextures();
 
     layer->pushPropertiesTo(layerImpl.get());
@@ -852,9 +854,9 @@ TEST_F(TiledLayerChromiumTest, skipsDrawGetsReset)
     childLayer->invalidateContentRect(contentRect);
 
     ccLayerTreeHost->setRootLayer(rootLayer);
-    ccLayerTreeHost->setViewportSize(IntSize(300, 300));
+    ccLayerTreeHost->setViewportSize(IntSize(300, 300), IntSize(300, 300));
 
-    ccLayerTreeHost->updateLayers(m_updater, memoryLimit);
+    ccLayerTreeHost->updateLayers(m_queue, memoryLimit);
 
     // We'll skip the root layer.
     EXPECT_TRUE(rootLayer->skipsDraw());
@@ -865,7 +867,7 @@ TEST_F(TiledLayerChromiumTest, skipsDrawGetsReset)
     // Remove the child layer.
     rootLayer->removeAllChildren();
 
-    ccLayerTreeHost->updateLayers(m_updater, memoryLimit);
+    ccLayerTreeHost->updateLayers(m_queue, memoryLimit);
     EXPECT_FALSE(rootLayer->skipsDraw());
 
     ccLayerTreeHost->contentsTextureManager()->clearAllMemory(m_resourceProvider.get());
@@ -885,7 +887,7 @@ TEST_F(TiledLayerChromiumTest, resizeToSmaller)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 700, 700), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 700, 700), 0, m_stats);
 
     layer->setBounds(IntSize(200, 200));
     layer->invalidateContentRect(IntRect(0, 0, 200, 200));
@@ -904,7 +906,7 @@ TEST_F(TiledLayerChromiumTest, hugeLayerUpdateCrash)
     // Ensure no crash for bounds where size * size would overflow an int.
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 700, 700), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 700, 700), 0, m_stats);
 }
 
 TEST_F(TiledLayerChromiumTest, partialUpdates)
@@ -930,20 +932,20 @@ TEST_F(TiledLayerChromiumTest, partialUpdates)
     layer->invalidateContentRect(contentRect);
 
     ccLayerTreeHost->setRootLayer(layer);
-    ccLayerTreeHost->setViewportSize(IntSize(300, 200));
+    ccLayerTreeHost->setViewportSize(IntSize(300, 200), IntSize(300, 200));
 
     // Full update of all 6 tiles.
-    ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+    ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
         updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_TRUE(m_updater.hasMoreUpdates());
+        EXPECT_TRUE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         updateTextures(4);
         EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         layer->pushPropertiesTo(layerImpl.get());
     }
@@ -951,17 +953,17 @@ TEST_F(TiledLayerChromiumTest, partialUpdates)
 
     // Full update of 3 tiles and partial update of 3 tiles.
     layer->invalidateContentRect(IntRect(0, 0, 300, 150));
-    ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+    ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
         updateTextures(4);
         EXPECT_EQ(3, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_TRUE(m_updater.hasMoreUpdates());
+        EXPECT_TRUE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         updateTextures(4);
         EXPECT_EQ(3, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         layer->pushPropertiesTo(layerImpl.get());
     }
@@ -972,14 +974,14 @@ TEST_F(TiledLayerChromiumTest, partialUpdates)
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
-        ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+        ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
         updateTextures(4);
         EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_TRUE(m_updater.hasMoreUpdates());
+        EXPECT_TRUE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         layer->pushPropertiesTo(layerImpl.get());
     }
@@ -999,14 +1001,14 @@ TEST_F(TiledLayerChromiumTest, partialUpdates)
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
-        ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+        ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
         updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_TRUE(m_updater.hasMoreUpdates());
+        EXPECT_TRUE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         updateTextures(4);
         EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         layer->pushPropertiesTo(layerImpl.get());
     }
@@ -1017,10 +1019,10 @@ TEST_F(TiledLayerChromiumTest, partialUpdates)
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
-        ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+        ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
         updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         layer->pushPropertiesTo(layerImpl.get());
     }
@@ -1042,12 +1044,13 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithoutOcclusion)
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
+    layer->setDrawableContentRect(IntRect(0, 0, 100, 200));
     layer->setVisibleContentRect(IntRect(0, 0, 100, 200));
     layer->invalidateContentRect(IntRect(0, 0, 100, 200));
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->prepareRectCount());
 }
 
@@ -1062,12 +1065,13 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
     layer->setBounds(IntSize(600, 600));
 
     occluded.setOcclusion(IntRect(200, 200, 300, 100));
+    layer->setDrawableContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1075,10 +1079,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
     EXPECT_EQ(3, occluded.overdrawMetrics().tilesCulledForUpload());
 
     layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+    layer->setTexturePriorities(m_priorityCalculator);
+    textureManager->prioritizeTextures();
 
     occluded.setOcclusion(IntRect(250, 200, 300, 100));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(36-2, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1086,10 +1092,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
     EXPECT_EQ(3 + 2, occluded.overdrawMetrics().tilesCulledForUpload());
 
     layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+    layer->setTexturePriorities(m_priorityCalculator);
+    textureManager->prioritizeTextures();
 
     occluded.setOcclusion(IntRect(250, 250, 300, 100));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(36, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1109,12 +1117,13 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
 
     // The partially occluded tiles (by the 150 occlusion height) are visible beyond the occlusion, so not culled.
     occluded.setOcclusion(IntRect(200, 200, 300, 150));
+    layer->setDrawableContentRect(IntRect(0, 0, 600, 360));
     layer->setVisibleContentRect(IntRect(0, 0, 600, 360));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 360), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 360), &occluded, m_stats);
     EXPECT_EQ(24-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1125,11 +1134,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
 
     // Now the visible region stops at the edge of the occlusion so the partly visible tiles become fully occluded.
     occluded.setOcclusion(IntRect(200, 200, 300, 150));
+    layer->setDrawableContentRect(IntRect(0, 0, 600, 350));
     layer->setVisibleContentRect(IntRect(0, 0, 600, 350));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 350), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 350), &occluded, m_stats);
     EXPECT_EQ(24-6, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1140,11 +1150,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
 
     // Now the visible region is even smaller than the occlusion, it should have the same result.
     occluded.setOcclusion(IntRect(200, 200, 300, 150));
+    layer->setDrawableContentRect(IntRect(0, 0, 600, 340));
     layer->setVisibleContentRect(IntRect(0, 0, 600, 340));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 340), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 340), &occluded, m_stats);
     EXPECT_EQ(24-6, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1164,11 +1175,12 @@ TEST_F(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
     layer->setBounds(IntSize(600, 600));
 
     occluded.setOcclusion(IntRect(200, 200, 300, 100));
+    layer->setDrawableContentRect(IntRect(0, 0, 600, 600));
     layer->setVisibleContentRect(IntRect(0, 0, 600, 600));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
     {
         DebugScopedSetImplThread implThread;
@@ -1180,9 +1192,11 @@ TEST_F(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
     EXPECT_EQ(3, occluded.overdrawMetrics().tilesCulledForUpload());
 
     layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+    layer->setTexturePriorities(m_priorityCalculator);
+    textureManager->prioritizeTextures();
 
     // Repaint without marking it dirty. The 3 culled tiles will be pre-painted now.
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1207,11 +1221,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndTransforms)
     layer->setDrawTransform(screenTransform);
 
     occluded.setOcclusion(IntRect(100, 100, 150, 50));
+    layer->setDrawableContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1238,11 +1253,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     layer->setScreenSpaceTransform(drawTransform);
 
     occluded.setOcclusion(IntRect(200, 200, 300, 100));
+    layer->setDrawableContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     // The content is half the size of the layer (so the number of tiles is fewer).
     // In this case, the content is 300x300, and since the tile size is 100, the
     // number of tiles 3x3.
@@ -1258,11 +1274,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     // a different layer space. In this case the occluded region catches the
     // blown up tiles.
     occluded.setOcclusion(IntRect(200, 200, 300, 200));
+    layer->setDrawableContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(9-1, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1278,11 +1295,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     layer->setDrawTransform(screenTransform);
 
     occluded.setOcclusion(IntRect(100, 100, 150, 100));
+    layer->setDrawableContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(9-1, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1306,6 +1324,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     IntRect visibleBounds = IntRect(0, 0, 100, 150);
 
     layer->setBounds(contentBounds.size());
+    layer->setDrawableContentRect(visibleBounds);
     layer->setVisibleContentRect(visibleBounds);
     layer->setDrawOpacity(1);
 
@@ -1315,7 +1334,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     // If the layer doesn't paint opaque content, then the visibleContentOpaqueRegion should be empty.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_TRUE(opaqueContents.isEmpty());
 
@@ -1328,7 +1347,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     opaquePaintRect = IntRect(10, 10, 90, 190);
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(opaquePaintRect);
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
@@ -1341,7 +1360,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
 
     // If we paint again without invalidating, the same stuff should be opaque.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
@@ -1356,7 +1375,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     // not be affected.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(IntRect(0, 0, 1, 1));
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
@@ -1371,7 +1390,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     // not be affected.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(IntRect(10, 10, 1, 1));
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(IntRect(10, 100, 90, 100), visibleBounds), opaqueContents.bounds());
@@ -1399,6 +1418,7 @@ TEST_F(TiledLayerChromiumTest, pixelsPaintedMetrics)
     IntRect visibleBounds = IntRect(0, 0, 100, 300);
 
     layer->setBounds(contentBounds.size());
+    layer->setDrawableContentRect(visibleBounds);
     layer->setVisibleContentRect(visibleBounds);
     layer->setDrawOpacity(1);
 
@@ -1408,7 +1428,7 @@ TEST_F(TiledLayerChromiumTest, pixelsPaintedMetrics)
     // Invalidates and paints the whole layer.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_TRUE(opaqueContents.isEmpty());
@@ -1423,7 +1443,7 @@ TEST_F(TiledLayerChromiumTest, pixelsPaintedMetrics)
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(IntRect(0, 0, 1, 1));
     layer->invalidateContentRect(IntRect(50, 200, 10, 10));
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_TRUE(opaqueContents.isEmpty());
@@ -1458,6 +1478,7 @@ TEST_F(TiledLayerChromiumTest, dontAllocateContentsWhenTargetSurfaceCantBeAlloca
 
     root->setBounds(rootRect.size());
     root->setAnchorPoint(FloatPoint());
+    root->setDrawableContentRect(rootRect);
     root->setVisibleContentRect(rootRect);
     root->addChild(surface);
 
@@ -1471,27 +1492,29 @@ TEST_F(TiledLayerChromiumTest, dontAllocateContentsWhenTargetSurfaceCantBeAlloca
     child->setAnchorPoint(FloatPoint());
     child->setPosition(childRect.location());
     child->setVisibleContentRect(childRect);
+    child->setDrawableContentRect(rootRect);
 
     child2->setBounds(child2Rect.size());
     child2->setAnchorPoint(FloatPoint());
     child2->setPosition(child2Rect.location());
     child2->setVisibleContentRect(child2Rect);
+    child2->setDrawableContentRect(rootRect);
 
     ccLayerTreeHost->setRootLayer(root);
-    ccLayerTreeHost->setViewportSize(rootRect.size());
+    ccLayerTreeHost->setViewportSize(rootRect.size(), rootRect.size());
 
     // With a huge memory limit, all layers should update and push their textures.
     root->invalidateContentRect(rootRect);
     child->invalidateContentRect(childRect);
     child2->invalidateContentRect(child2Rect);
-    ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+    ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
     {
         DebugScopedSetImplThread implThread;
         updateTextures(1000);
         EXPECT_EQ(6, root->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(3, child->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(3, child2->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
 
         root->fakeLayerTextureUpdater()->clearUpdateCount();
         child->fakeLayerTextureUpdater()->clearUpdateCount();
@@ -1519,14 +1542,14 @@ TEST_F(TiledLayerChromiumTest, dontAllocateContentsWhenTargetSurfaceCantBeAlloca
     root->invalidateContentRect(rootRect);
     child->invalidateContentRect(childRect);
     child2->invalidateContentRect(child2Rect);
-    ccLayerTreeHost->updateLayers(m_updater, (3 * 2 + 3 * 1) * (100 * 100) * 4);
+    ccLayerTreeHost->updateLayers(m_queue, (3 * 2 + 3 * 1) * (100 * 100) * 4);
     {
         DebugScopedSetImplThread implThread;
         updateTextures(1000);
         EXPECT_EQ(6, root->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(0, child->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(0, child2->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
 
         root->fakeLayerTextureUpdater()->clearUpdateCount();
         child->fakeLayerTextureUpdater()->clearUpdateCount();
@@ -1555,14 +1578,14 @@ TEST_F(TiledLayerChromiumTest, dontAllocateContentsWhenTargetSurfaceCantBeAlloca
     root->invalidateContentRect(rootRect);
     child->invalidateContentRect(childRect);
     child2->invalidateContentRect(child2Rect);
-    ccLayerTreeHost->updateLayers(m_updater, (3 * 1) * (100 * 100) * 4);
+    ccLayerTreeHost->updateLayers(m_queue, (3 * 1) * (100 * 100) * 4);
     {
         DebugScopedSetImplThread implThread;
         updateTextures(1000);
         EXPECT_EQ(0, root->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(0, child->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(0, child2->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
 
         root->fakeLayerTextureUpdater()->clearUpdateCount();
         child->fakeLayerTextureUpdater()->clearUpdateCount();
@@ -1646,12 +1669,13 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringPaint)
     IntRect contentRect(0, 0, 45, 47);
     EXPECT_EQ(contentRect.size(), layer->contentBounds());
     layer->setVisibleContentRect(contentRect);
+    layer->setDrawableContentRect(contentRect);
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
     // Update the whole tile.
-    layer->updateContentRect(m_updater, contentRect, 0, m_stats);
+    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
     layer->trackingLayerPainter()->resetPaintedRect();
 
     EXPECT_INT_RECT_EQ(IntRect(), layer->trackingLayerPainter()->paintedRect());
@@ -1663,7 +1687,7 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringPaint)
 
     // Invalidate the entire layer in content space. When painting, the rect given to webkit should match the layer's bounds.
     layer->invalidateContentRect(contentRect);
-    layer->updateContentRect(m_updater, contentRect, 0, m_stats);
+    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
 
     EXPECT_INT_RECT_EQ(layerRect, layer->trackingLayerPainter()->paintedRect());
 }
@@ -1681,12 +1705,13 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringInvali
 
     IntRect contentRect(IntPoint(), layer->contentBounds());
     layer->setVisibleContentRect(contentRect);
+    layer->setDrawableContentRect(contentRect);
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
     // Update the whole tile.
-    layer->updateContentRect(m_updater, contentRect, 0, m_stats);
+    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
     layer->trackingLayerPainter()->resetPaintedRect();
 
     EXPECT_INT_RECT_EQ(IntRect(), layer->trackingLayerPainter()->paintedRect());
@@ -1698,7 +1723,7 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringInvali
 
     // Invalidate the entire layer in layer space. When painting, the rect given to webkit should match the layer's bounds.
     layer->setNeedsDisplayRect(layerRect);
-    layer->updateContentRect(m_updater, contentRect, 0, m_stats);
+    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
 
     EXPECT_INT_RECT_EQ(layerRect, layer->trackingLayerPainter()->paintedRect());
 }
diff --git a/Source/WebKit/chromium/tests/WebAnimationTest.cpp b/Source/WebKit/chromium/tests/WebAnimationTest.cpp
index df830cae6..c2ccc4503 100644
--- a/Source/WebKit/chromium/tests/WebAnimationTest.cpp
+++ b/Source/WebKit/chromium/tests/WebAnimationTest.cpp
@@ -47,7 +47,7 @@ namespace {
 TEST(WebAnimationTest, MAYBE_DefaultSettings)
 {
     WebFloatAnimationCurve curve;
-    WebAnimation animation(curve, WebAnimation::WebAnimationOpacity);
+    WebAnimation animation(curve, WebAnimation::TargetPropertyOpacity);
 
     // Ensure that the defaults are correct.
     EXPECT_EQ(1, animation.iterations());
@@ -68,7 +68,7 @@ TEST(WebAnimationTest, MAYBE_DefaultSettings)
 TEST(WebAnimationTest, MAYBE_ModifiedSettings)
 {
     WebFloatAnimationCurve curve;
-    WebAnimation animation(curve, WebAnimation::WebAnimationOpacity);
+    WebAnimation animation(curve, WebAnimation::TargetPropertyOpacity);
     animation.setIterations(2);
     animation.setStartTime(2);
     animation.setTimeOffset(2);
diff --git a/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp b/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
index d5b68a867..902fac981 100644
--- a/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
@@ -27,14 +27,14 @@
 
 #include "WebCompositorInputHandlerImpl.h"
 
-#include "WebCompositor.h"
 #include "WebCompositorInputHandlerClient.h"
 #include "WebInputEvent.h"
 #include "cc/CCActiveGestureAnimation.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCSingleThreadProxy.h"
-#include "platform/WebFloatPoint.h"
-#include "platform/WebPoint.h"
+#include <public/WebCompositor.h>
+#include <public/WebFloatPoint.h>
+#include <public/WebPoint.h>
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
diff --git a/Source/WebKit/chromium/tests/WebFrameTest.cpp b/Source/WebKit/chromium/tests/WebFrameTest.cpp
index 9b745e029..cd23d6268 100644
--- a/Source/WebKit/chromium/tests/WebFrameTest.cpp
+++ b/Source/WebKit/chromium/tests/WebFrameTest.cpp
@@ -804,4 +804,54 @@ TEST_F(WebFrameTest, GetFullHtmlOfPage)
     EXPECT_TRUE(selectionHtml.isEmpty());
 }
 
+class TestExecuteScriptDuringDidCreateScriptContext : public WebFrameClient {
+public:
+    virtual void didCreateScriptContext(WebFrame* frame, v8::Handle<v8::Context> context, int extensionGroup, int worldId) OVERRIDE
+    {
+        frame->executeScript(WebScriptSource("window.history = 'replaced';"));
+    }
+};
+
+TEST_F(WebFrameTest, ExecuteScriptDuringDidCreateScriptContext)
+{
+    registerMockedHttpURLLoad("hello_world.html");
+
+    TestExecuteScriptDuringDidCreateScriptContext webFrameClient;
+    WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "hello_world.html", true, &webFrameClient);
+
+    webView->mainFrame()->reload();
+    webkit_support::ServeAsynchronousMockedRequests();
+}
+
+class TestDidCreateFrameWebFrameClient : public WebFrameClient {
+public:
+    TestDidCreateFrameWebFrameClient() : m_frameCount(0), m_parent(0)
+    {
+    }
+
+    virtual void didCreateFrame(WebFrame* parent, WebFrame* child) 
+    {
+        m_frameCount++;
+        if (!m_parent)
+            m_parent = parent;
+    }
+    
+    int m_frameCount;
+    WebFrame* m_parent;
+};
+
+TEST_F(WebFrameTest, DidCreateFrame)
+{
+    registerMockedHttpURLLoad("iframes_test.html");
+    registerMockedHttpURLLoad("visible_iframe.html");
+    registerMockedHttpURLLoad("invisible_iframe.html");
+    registerMockedHttpURLLoad("zero_sized_iframe.html");
+
+    TestDidCreateFrameWebFrameClient webFrameClient;
+    WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "iframes_test.html", false, &webFrameClient);
+
+    EXPECT_EQ(webFrameClient.m_frameCount, 3); 
+    EXPECT_EQ(webFrameClient.m_parent, webView->mainFrame());
+}
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/WebLayerTest.cpp b/Source/WebKit/chromium/tests/WebLayerTest.cpp
index 12deb5991..5381173ef 100644
--- a/Source/WebKit/chromium/tests/WebLayerTest.cpp
+++ b/Source/WebKit/chromium/tests/WebLayerTest.cpp
@@ -23,19 +23,19 @@
  */
 
 #include "config.h"
-#include "platform/WebLayer.h"
+#include <public/WebLayer.h>
 
 #include "CompositorFakeWebGraphicsContext3D.h"
-#include "WebCompositor.h"
-#include "platform/WebContentLayer.h"
-#include "platform/WebContentLayerClient.h"
-#include "platform/WebExternalTextureLayer.h"
-#include "platform/WebFloatPoint.h"
-#include "platform/WebFloatRect.h"
-#include "platform/WebLayerTreeView.h"
-#include "platform/WebLayerTreeViewClient.h"
-#include "platform/WebRect.h"
-#include "platform/WebSize.h"
+#include <public/WebCompositor.h>
+#include <public/WebContentLayer.h>
+#include <public/WebContentLayerClient.h>
+#include <public/WebExternalTextureLayer.h>
+#include <public/WebFloatPoint.h>
+#include <public/WebFloatRect.h>
+#include <public/WebLayerTreeView.h>
+#include <public/WebLayerTreeViewClient.h>
+#include <public/WebRect.h>
+#include <public/WebSize.h>
 
 #include <gmock/gmock.h>
 
@@ -58,6 +58,8 @@ public:
     virtual void applyScrollAndScale(const WebSize& scrollDelta, float scaleFactor) { }
     virtual WebGraphicsContext3D* createContext3D() { return CompositorFakeWebGraphicsContext3D::create(WebGraphicsContext3D::Attributes()).leakPtr(); }
     virtual void didRebindGraphicsContext(bool success) { }
+    virtual WebCompositorOutputSurface* createOutputSurface() { return 0; }
+    virtual void didRecreateOutputSurface(bool success) { }
     virtual void willCommit() { }
     virtual void didCommitAndDrawFrame() { }
     virtual void didCompleteSwapBuffers() { }
diff --git a/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp b/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp
index 2df259f76..4f0330035 100644
--- a/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp
+++ b/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp
@@ -24,15 +24,16 @@
 
 #include "config.h"
 
-#include "platform/WebLayerTreeView.h"
+#include <public/WebLayerTreeView.h>
 
 #include "CompositorFakeWebGraphicsContext3D.h"
-#include "WebCompositor.h"
-#include "public/WebLayer.h"
-#include "public/WebLayerTreeViewClient.h"
-#include "public/WebThread.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include <gmock/gmock.h>
 #include <public/Platform.h>
+#include <public/WebCompositor.h>
+#include <public/WebLayer.h>
+#include <public/WebLayerTreeViewClient.h>
+#include <public/WebThread.h>
 
 using namespace WebKit;
 using testing::Mock;
@@ -48,8 +49,13 @@ public:
     MOCK_METHOD0(didBeginFrame, void());
     virtual void layout() OVERRIDE { }
     virtual void applyScrollAndScale(const WebSize& scrollDelta, float scaleFactor) OVERRIDE { }
-    virtual WebGraphicsContext3D* createContext3D() OVERRIDE { return CompositorFakeWebGraphicsContext3D::create(WebGraphicsContext3D::Attributes()).leakPtr(); }
-    virtual void didRebindGraphicsContext(bool success) OVERRIDE { }
+
+    virtual WebCompositorOutputSurface* createOutputSurface() OVERRIDE
+    {
+        return FakeWebCompositorOutputSurface::create(CompositorFakeWebGraphicsContext3D::create(WebGraphicsContext3D::Attributes())).leakPtr();
+    }
+    virtual void didRecreateOutputSurface(bool) OVERRIDE { }
+
     MOCK_METHOD0(willCommit, void());
     MOCK_METHOD0(didCommit, void());
     virtual void didCommitAndDrawFrame() OVERRIDE { }
diff --git a/Source/WebKit/chromium/tests/data/hello_world.html b/Source/WebKit/chromium/tests/data/hello_world.html
new file mode 100644
index 000000000..75ab18b58
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/hello_world.html
@@ -0,0 +1,3 @@
+<script>
+document.write("Hello, world.");
+</script>
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index 8e7f0e2e2..3bc2ceab5 100644
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,92 @@
+2012-08-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Handle SSL errors for SOUP
+        https://bugs.webkit.org/show_bug.cgi?id=90267
+
+        Reviewed by Martin Robinson.
+
+        Ignore SSL errors by default for compatibility.
+
+        * ewk/ewk_main.cpp:
+        (_ewk_init_body):
+
+2012-08-07  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Remove PlatformTouchEventEfl and PlatformTouchPointEfl
+        https://bugs.webkit.org/show_bug.cgi?id=93270
+
+        Reviewed by Eric Seidel.
+
+        * ewk/ewk_frame.cpp:
+        (ewk_frame_feed_touch_event):
+        * ewk/ewk_touch_event.cpp: Added.
+        (WebKitPlatformTouchPoint):
+        (WebKitPlatformTouchPoint::WebKitPlatformTouchPoint):
+        Added to initialize members of PlatformTouchPoint.
+        (WebKitPlatformTouchEvent):
+        (WebKitPlatformTouchEvent::WebKitPlatformTouchEvent):
+        Added to initialize members of PlatformTouchEvent.
+        (EWKPrivate):
+        (EWKPrivate::platformTouchEvent):
+        Converted Ewk_Touch_Event to PlatformTouchEvent.
+        * ewk/ewk_touch_event_private.h: 
+        (EWKPrivate):
+
+2012-08-07  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        CUSTOM_SCHEME_HANDLER flag should depend on REGISTER_PROTOCOL_HANDLER
+        https://bugs.webkit.org/show_bug.cgi?id=93081
+
+        Reviewed by Adam Barth.
+
+        CUSTOM_SCHEME_HANDLER #if guards are enclosed in the REGISTER_PROTOCOL_HANDLER guards.
+
+        * WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp:
+        (WebCore::RegisterProtocolHandlerClientEfl::registerProtocolHandler):
+        * WebCoreSupport/RegisterProtocolHandlerClientEfl.h:
+        * ewk/ewk_custom_handler.cpp:
+        (ewk_custom_handler_register_protocol_handler):
+        * ewk/ewk_custom_handler_private.h:
+        * ewk/ewk_view.cpp:
+        (_ewk_view_priv_new):
+
+2012-08-06  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL] [GTK] Register Protocol Handler Client is never deleted
+        https://bugs.webkit.org/show_bug.cgi?id=92745
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Added usage of OwnPtr to manage register protocol handler client pointer.
+
+        * WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp:
+        (WebCore::RegisterProtocolHandlerClientEfl::create): Factory function returning smart pointer.
+        (WebCore):
+        * WebCoreSupport/RegisterProtocolHandlerClientEfl.h:
+        (RegisterProtocolHandlerClientEfl):
+        * ewk/ewk_view.cpp:
+        (_Ewk_View_Private_Data):
+        (_ewk_view_priv_new):
+
+2012-08-01  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL][Regression] Build break with NETSCAPE_PLUGIN_API after r123604
+        https://bugs.webkit.org/show_bug.cgi?id=92937
+
+        Unreviewed build fix.
+
+        r123604 replaced strdup to eina_stringshare, but related codes are not
+        changed properly.
+        This patch changes remained code to use eina_stringshare.
+
+        * ewk/ewk_js.cpp:
+        (ewk_js_variant_to_npvariant):
+        (ewk_js_property_free):
+        (ewk_js_npvariant_to_variant):
+        (ewk_js_variant_free):
+        (ewk_js_variant_array_free):
+        * ewk/ewk_js.h:
+
 2012-07-29  YoungTaeck Song  <youngtaeck.song@samsung.com>
 
         [WK2][EFL] TILED_BACKING_STORE support on Efl WebKit2
diff --git a/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp
index 8f30850f6..5601241a5 100644
--- a/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp
@@ -28,7 +28,7 @@
 #include "config.h"
 #include "RegisterProtocolHandlerClientEfl.h"
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 
 #include "ewk_custom_handler_private.h"
 #include <wtf/text/CString.h>
@@ -53,12 +53,16 @@ static void customHandlerDataDelete(Ewk_Custom_Handler_Data* data)
     delete data;
 }
 
+PassOwnPtr<RegisterProtocolHandlerClientEfl> RegisterProtocolHandlerClientEfl::create(Evas_Object* view)
+{
+    return adoptPtr(new RegisterProtocolHandlerClientEfl(view));
+}
+
 RegisterProtocolHandlerClientEfl::RegisterProtocolHandlerClientEfl(Evas_Object* view)
     : m_view(view)
 {
 }
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 void RegisterProtocolHandlerClientEfl::registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title)
 {
     Ewk_Custom_Handler_Data* data = customHandlerDataCreate(m_view, scheme.utf8().data(), baseURL.utf8().data(), url.utf8().data());
@@ -67,7 +71,6 @@ void RegisterProtocolHandlerClientEfl::registerProtocolHandler(const String& sch
     eina_stringshare_del(data->title);
     customHandlerDataDelete(data);
 }
-#endif
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
 RegisterProtocolHandlerClient::CustomHandlersState RegisterProtocolHandlerClientEfl::isProtocolHandlerRegistered(const String& scheme, const String& baseURL, const String& url)
@@ -89,4 +92,4 @@ void RegisterProtocolHandlerClientEfl::unregisterProtocolHandler(const String& s
 
 }
 
-#endif // ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
diff --git a/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.h b/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.h
index f83723f4d..dca3c6cfa 100644
--- a/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.h
@@ -28,18 +28,18 @@
 #ifndef RegisterProtocolHandlerClientEfl_h
 #define RegisterProtocolHandlerClientEfl_h
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 #include "RegisterProtocolHandlerClient.h"
 
+#include <wtf/PassOwnPtr.h>
+
 namespace WebCore {
 class RegisterProtocolHandlerClientEfl : public WebCore::RegisterProtocolHandlerClient {
 public:
-    explicit RegisterProtocolHandlerClientEfl(Evas_Object* view);
-    ~RegisterProtocolHandlerClientEfl() { }
+    static PassOwnPtr<RegisterProtocolHandlerClientEfl> create(Evas_Object* view);
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+    ~RegisterProtocolHandlerClientEfl() { }
     virtual void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title);
-#endif
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
     virtual CustomHandlersState isProtocolHandlerRegistered(const String& scheme, const String& baseURL, const String& url);
@@ -48,6 +48,8 @@ public:
 
 private:
     Evas_Object* m_view;
+
+    RegisterProtocolHandlerClientEfl(Evas_Object* view);
 };
 }
 
diff --git a/Source/WebKit/efl/ewk/ewk_custom_handler.cpp b/Source/WebKit/efl/ewk/ewk_custom_handler.cpp
index c76b8dec7..3574a1d8a 100644
--- a/Source/WebKit/efl/ewk/ewk_custom_handler.cpp
+++ b/Source/WebKit/efl/ewk/ewk_custom_handler.cpp
@@ -35,7 +35,6 @@ bool ewk_custom_handler_register_protocol_handler(Ewk_Custom_Handler_Data* data)
     evas_object_smart_callback_call(data->ewkView, "protocolhandler,registration,requested", data);
     return true;
 }
-#endif
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
 /**
@@ -68,4 +67,6 @@ bool ewk_custom_handler_unregister_protocol_handler(Ewk_Custom_Handler_Data* dat
     evas_object_smart_callback_call(data->ewkView, "protocolhandler,unregistration,requested", data);
     return true;
 }
-#endif
+
+#endif // ENABLE(CUSTOM_SCHEME_HANDLER)
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
diff --git a/Source/WebKit/efl/ewk/ewk_custom_handler_private.h b/Source/WebKit/efl/ewk/ewk_custom_handler_private.h
index 907ca6bb1..bc0e21d54 100644
--- a/Source/WebKit/efl/ewk/ewk_custom_handler_private.h
+++ b/Source/WebKit/efl/ewk/ewk_custom_handler_private.h
@@ -24,11 +24,11 @@
 
 #if ENABLE(REGISTER_PROTOCOL_HANDLER)
 bool ewk_custom_handler_register_protocol_handler(Ewk_Custom_Handler_Data* data);
-#endif
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
 Ewk_Custom_Handlers_State ewk_custom_handler_is_protocol_handler_registered(Ewk_Custom_Handler_Data* data);
 bool ewk_custom_handler_unregister_protocol_handler(Ewk_Custom_Handler_Data* data);
-#endif
 
+#endif // ENABLE(CUSTOM_SCHEME_HANDLER)
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
 #endif // ewk_custom_handler_private_h
diff --git a/Source/WebKit/efl/ewk/ewk_frame.cpp b/Source/WebKit/efl/ewk/ewk_frame.cpp
index fba460ec0..e8fec6d63 100644
--- a/Source/WebKit/efl/ewk/ewk_frame.cpp
+++ b/Source/WebKit/efl/ewk/ewk_frame.cpp
@@ -57,6 +57,7 @@
 #include "ewk_intent_private.h"
 #include "ewk_private.h"
 #include "ewk_security_origin_private.h"
+#include "ewk_touch_event_private.h"
 #include "ewk_view_private.h"
 #include <Ecore_Input.h>
 #include <Eina.h>
@@ -990,37 +991,7 @@ Eina_Bool ewk_frame_feed_touch_event(Evas_Object* ewkFrame, Ewk_Touch_Event_Type
     Evas_Coord x, y;
     evas_object_geometry_get(smartData->view, &x, &y, 0, 0);
 
-    WebCore::PlatformEvent::Type type;
-    switch (action) {
-    case EWK_TOUCH_START:
-        type = WebCore::PlatformEvent::TouchStart;
-        break;
-    case EWK_TOUCH_MOVE:
-        type = WebCore::PlatformEvent::TouchMove;
-        break;
-    case EWK_TOUCH_END:
-        type = WebCore::PlatformEvent::TouchEnd;
-        break;
-    case EWK_TOUCH_CANCEL:
-        type = WebCore::PlatformEvent::TouchCancel;
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-        return false;
-    }
-
-    unsigned touchModifiers = 0;
-    if (modifiers & ECORE_EVENT_MODIFIER_ALT)
-        touchModifiers |= WebCore::PlatformEvent::AltKey;
-    if (modifiers & ECORE_EVENT_MODIFIER_CTRL)
-        touchModifiers |= WebCore::PlatformEvent::CtrlKey;
-    if (modifiers & ECORE_EVENT_MODIFIER_SHIFT)
-        touchModifiers |= WebCore::PlatformEvent::ShiftKey;
-    if (modifiers & ECORE_EVENT_MODIFIER_WIN)
-        touchModifiers |= WebCore::PlatformEvent::MetaKey;
-
-    WebCore::PlatformTouchEvent touchEvent(points, WebCore::IntPoint(x, y), type, static_cast<WebCore::PlatformEvent::Modifiers>(touchModifiers));
-    return smartData->frame->eventHandler()->handleTouchEvent(touchEvent);
+    return smartData->frame->eventHandler()->handleTouchEvent(EWKPrivate::platformTouchEvent(x, y, points, action, modifiers));
 #else
     return false;
 #endif
diff --git a/Source/WebKit/efl/ewk/ewk_js.cpp b/Source/WebKit/efl/ewk/ewk_js.cpp
index 0cbb18952..bf4e4d787 100644
--- a/Source/WebKit/efl/ewk/ewk_js.cpp
+++ b/Source/WebKit/efl/ewk/ewk_js.cpp
@@ -48,7 +48,7 @@ static Eina_Bool ewk_js_variant_to_npvariant(const Ewk_JS_Variant* data, NPVaria
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(data, false);
     EINA_SAFETY_ON_NULL_RETURN_VAL(result, false);
-    char* string_value;
+    const char* string_value;
 
     switch (data->type) {
     case EWK_JS_VARIANT_VOID:
@@ -315,7 +315,7 @@ static void ewk_js_property_free(Ewk_JS_Property* prop)
 {
     free(const_cast<char*>(prop->name));
     if (prop->value.type == EWK_JS_VARIANT_STRING)
-        free(prop->value.value.s);
+        eina_stringshare_del(prop->value.value.s);
     else if (prop->value.type == EWK_JS_VARIANT_OBJECT)
         ewk_js_object_free(prop->value.value.o);
     free(prop);
@@ -482,7 +482,6 @@ error:
 
 static Eina_Bool ewk_js_npvariant_to_variant(Ewk_JS_Variant* data, const NPVariant* result)
 {
-    int sz;
     EINA_SAFETY_ON_NULL_RETURN_VAL(data, false);
     EINA_SAFETY_ON_NULL_RETURN_VAL(result, false);
     switch (result->type) {
@@ -503,12 +502,7 @@ static Eina_Bool ewk_js_npvariant_to_variant(Ewk_JS_Variant* data, const NPVaria
         data->value.d = NPVARIANT_TO_DOUBLE(*result);
         break;
     case NPVariantType_String:
-        sz = NPVARIANT_TO_STRING(*result).UTF8Length;
-        data->value.s = static_cast<char*>(malloc(sizeof(char) * (sz + 1)));
-        if (!data->value.s)
-            return false;
-        memcpy(data->value.s, NPVARIANT_TO_STRING(*result).UTF8Characters, sz);
-        data->value.s[sz] = '\0';
+        data->value.s = eina_stringshare_add_length(NPVARIANT_TO_STRING(*result).UTF8Characters, NPVARIANT_TO_STRING(*result).UTF8Length);
         data->type = EWK_JS_VARIANT_STRING;
         break;
     case NPVariantType_Bool:
@@ -715,7 +709,7 @@ void ewk_js_variant_free(Ewk_JS_Variant* jsVariant)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     EINA_SAFETY_ON_NULL_RETURN(jsVariant);
     if (jsVariant->type == EWK_JS_VARIANT_STRING)
-        free(jsVariant->value.s);
+        eina_stringshare_del(jsVariant->value.s);
     else if (jsVariant->type == EWK_JS_VARIANT_OBJECT)
         ewk_js_object_free(jsVariant->value.o);
     free(jsVariant);
@@ -728,7 +722,7 @@ void ewk_js_variant_array_free(Ewk_JS_Variant* jsVariant, int count)
     EINA_SAFETY_ON_NULL_RETURN(jsVariant);
     for (int i = 0; i < count; i++) {
         if (jsVariant[i].type == EWK_JS_VARIANT_STRING)
-            free(jsVariant[i].value.s);
+            eina_stringshare_del(jsVariant[i].value.s);
         else if (jsVariant[i].type == EWK_JS_VARIANT_OBJECT)
             ewk_js_object_free(jsVariant[i].value.o);
     }
diff --git a/Source/WebKit/efl/ewk/ewk_js.h b/Source/WebKit/efl/ewk/ewk_js.h
index 6279357ec..283e6f774 100644
--- a/Source/WebKit/efl/ewk/ewk_js.h
+++ b/Source/WebKit/efl/ewk/ewk_js.h
@@ -68,7 +68,7 @@ struct _Ewk_JS_Variant {
         Eina_Bool b;
         int i;
         double d;
-        char *s;
+        const char *s;
         Ewk_JS_Object *o;
     } value;
 };
diff --git a/Source/WebKit/efl/ewk/ewk_main.cpp b/Source/WebKit/efl/ewk/ewk_main.cpp
index c2ccc6a6d..5850ee8de 100644
--- a/Source/WebKit/efl/ewk/ewk_main.cpp
+++ b/Source/WebKit/efl/ewk/ewk_main.cpp
@@ -176,5 +176,7 @@ Eina_Bool _ewk_init_body(void)
     SoupSessionFeature* auth_dialog = static_cast<SoupSessionFeature*>(g_object_new(EWK_TYPE_SOUP_AUTH_DIALOG, 0));
     soup_session_add_feature(session, auth_dialog);
 
+    WebCore::ResourceHandle::setIgnoreSSLErrors(true);
+
     return true;
 }
diff --git a/Source/WebKit/efl/ewk/ewk_touch_event.cpp b/Source/WebKit/efl/ewk/ewk_touch_event.cpp
new file mode 100644
index 000000000..0695d41ad
--- /dev/null
+++ b/Source/WebKit/efl/ewk/ewk_touch_event.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "PlatformTouchPoint.h"
+#include "ewk_touch_event_private.h"
+#include <Ecore_Input.h>
+#include <wtf/CurrentTime.h>
+
+class WebKitPlatformTouchPoint : public WebCore::PlatformTouchPoint {
+public:
+    WebKitPlatformTouchPoint(unsigned id, const WebCore::IntPoint& windowPos, WebCore::PlatformTouchPoint::State state)
+    {
+        m_id = id;
+        m_state = state;
+        m_screenPos = windowPos;
+        m_pos = windowPos;
+    }
+};
+
+class WebKitPlatformTouchEvent : public WebCore::PlatformTouchEvent {
+public:
+    WebKitPlatformTouchEvent(const Eina_List* points, const WebCore::IntPoint& pos, Ewk_Touch_Event_Type action, unsigned modifiers)
+    {
+        switch (action) {
+        case EWK_TOUCH_START:
+            m_type = WebCore::PlatformEvent::TouchStart;
+            break;
+        case EWK_TOUCH_MOVE:
+            m_type = WebCore::PlatformEvent::TouchMove;
+            break;
+        case EWK_TOUCH_END:
+            m_type = WebCore::PlatformEvent::TouchEnd;
+            break;
+        case EWK_TOUCH_CANCEL:
+            m_type = WebCore::PlatformEvent::TouchCancel;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+
+        if (modifiers & ECORE_EVENT_MODIFIER_ALT)
+            m_modifiers |= WebCore::PlatformEvent::AltKey;
+        if (modifiers & ECORE_EVENT_MODIFIER_CTRL)
+            m_modifiers |= WebCore::PlatformEvent::CtrlKey;
+        if (modifiers & ECORE_EVENT_MODIFIER_SHIFT)
+            m_modifiers |= WebCore::PlatformEvent::ShiftKey;
+        if (modifiers & ECORE_EVENT_MODIFIER_WIN)
+            m_modifiers |= WebCore::PlatformEvent::MetaKey;
+
+        m_timestamp = currentTime();
+
+        const Eina_List* list;
+        void* item;
+        EINA_LIST_FOREACH(points, list, item) {
+            Ewk_Touch_Point* point = static_cast<Ewk_Touch_Point*>(item);
+            WebCore::IntPoint pnt = WebCore::IntPoint(point->x - pos.x(), point->y - pos.y());
+            m_touchPoints.append(WebKitPlatformTouchPoint(point->id, pnt, static_cast<WebCore::PlatformTouchPoint::State>(point->state)));
+        }
+    }
+};
+
+namespace EWKPrivate {
+
+WebCore::PlatformTouchEvent platformTouchEvent(Evas_Coord x, Evas_Coord y, Eina_List* points, Ewk_Touch_Event_Type action, unsigned modifiers)
+{
+    return WebKitPlatformTouchEvent(points, WebCore::IntPoint(x, y), action, modifiers);
+}
+
+}
diff --git a/Source/WebCore/platform/efl/PlatformTouchPointEfl.cpp b/Source/WebKit/efl/ewk/ewk_touch_event_private.h
index b181f6872..0f7737a88 100644
--- a/Source/WebCore/platform/efl/PlatformTouchPointEfl.cpp
+++ b/Source/WebKit/efl/ewk/ewk_touch_event_private.h
@@ -1,21 +1,19 @@
 /*
- * Copyright (C) 2009-2010 Samsung Electronics
- *
- * All rights reserved.
+ * Copyright (C) 2012 Samsung Electronics
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 1. Redistributions of source code must retain the above copyright
+ *  * Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
+ *  * Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -25,19 +23,14 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "PlatformTouchPoint.h"
-
-#if ENABLE(TOUCH_EVENTS)
-
-namespace WebCore {
+#ifndef ewk_touch_event_private_h
+#define ewk_touch_event_private_h
 
-PlatformTouchPoint::PlatformTouchPoint(unsigned id, const IntPoint& windowPos, State state)
-    : m_id(id)
-    , m_state(state)
-    , m_screenPos(windowPos)
-    , m_pos(windowPos) { }
+#include "PlatformTouchEvent.h"
+#include "ewk_frame.h"
 
-}
+namespace EWKPrivate {
+WebCore::PlatformTouchEvent platformTouchEvent(Evas_Coord x, Evas_Coord y, Eina_List* points, Ewk_Touch_Event_Type action, unsigned modifiers);
+} // namespace EWKPrivate
 
-#endif
+#endif // ewk_touch_event_private_h
diff --git a/Source/WebKit/efl/ewk/ewk_view.cpp b/Source/WebKit/efl/ewk/ewk_view.cpp
index 5309181b3..081e6ba49 100644
--- a/Source/WebKit/efl/ewk/ewk_view.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view.cpp
@@ -103,7 +103,7 @@
 #include "ColorChooserClient.h"
 #endif
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 #include "RegisterProtocolHandlerClientEfl.h"
 #endif
 
@@ -254,6 +254,9 @@ struct _Ewk_View_Private_Data {
 #if ENABLE(INPUT_TYPE_COLOR)
     WebCore::ColorChooserClient* colorChooserClient;
 #endif
+#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+    OwnPtr<WebCore::RegisterProtocolHandlerClientEfl> registerProtocolHandlerClient;
+#endif
     struct {
         Ewk_Menu menu;
         WebCore::PopupMenuClient* menuClient;
@@ -761,8 +764,9 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
     WebCore::provideBatteryTo(priv->page.get(), new BatteryClientEfl(smartData->self));
 #endif
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
-    WebCore::provideRegisterProtocolHandlerTo(priv->page.get(), new WebCore::RegisterProtocolHandlerClientEfl(smartData->self));
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+    priv->registerProtocolHandlerClient = WebCore::RegisterProtocolHandlerClientEfl::create(smartData->self);
+    WebCore::provideRegisterProtocolHandlerTo(priv->page.get(), priv->registerProtocolHandlerClient.get());
 #endif
 
     priv->pageSettings = priv->page->settings();
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index 27d0d5774..268a9df9d 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,215 @@
+2012-08-10  Alice Cheng  <alice_cheng@apple.com>
+
+        Part 1 of: Extend -webkit-user-select with a new value "all"
+        <rdar://problem/10161404>
+        https://bugs.webkit.org/show_bug.cgi?id=93562
+
+        Reviewed by Dan Bernstein.
+
+        Modify the enum to resolve ambiguous reference
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_class_init): Modify the ambiguous enum
+        (webkit_web_view_select_all): Modify the ambiguous enum
+
+2012-08-10  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Broken implementation of AtkText and AtkEditableText for password fields
+        https://bugs.webkit.org/show_bug.cgi?id=93621
+
+        Reviewed by Chris Fleizach.
+
+        Update unit test to ensure that password input fields behave
+        as expected when inserting and removing characters in them.
+
+        * tests/testatk.c:
+        (testWebkitAtkTextChangedNotifications): Updated unit test to
+        cover the special case of password input fields.
+
+2012-08-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Handle SSL errors for SOUP
+        https://bugs.webkit.org/show_bug.cgi?id=90267
+
+        Reviewed by Martin Robinson.
+
+        Ignore SSL errors by default for compatibility.
+
+        * webkit/webkitglobals.cpp:
+        (webkitInit):
+
+2012-08-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix GTK+ build with GTK2 after r120918.
+
+        * tests/testwebview.c:
+
+2012-08-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Update NEWS and configure.ac for 1.9.6 release
+
+        * NEWS: Added release notes for 1.9.6.
+
+2012-08-06  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL] [GTK] Register Protocol Handler Client is never deleted
+        https://bugs.webkit.org/show_bug.cgi?id=92745
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Added usage of OwnPtr to manage register protocol handler client pointer.
+
+        * WebCoreSupport/RegisterProtocolHandlerClientGtk.cpp:
+        (WebKit::RegisterProtocolHandlerClient::create): Factory function returning smart pointer.
+        (WebKit):
+        * WebCoreSupport/RegisterProtocolHandlerClientGtk.h:
+        (RegisterProtocolHandlerClient):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_init):
+        * webkit/webkitwebviewprivate.h:
+
+2012-08-03  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add a new and reusable enchant-based spellchecker in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=90269
+
+        Reviewed by Martin Robinson.
+
+        Remove enchant specific code from WebKitSpellCheckerEnchant and
+        implement it relying in the new TextCheckerEnchant class in WebCore.
+
+        * webkit/webkitspellcheckerenchant.cpp:
+        (_WebKitSpellCheckerEnchantPrivate):
+        (webkit_spell_checker_enchant_finalize):
+        (webkit_spell_checker_enchant_class_init):
+        (webkit_spell_checker_enchant_init):
+        (checkSpellingOfString):
+        (getGuessesForWord):
+        (updateSpellCheckingLanguages):
+        (learnWord):
+        (ignoreWord):
+
+2012-08-02  Claudio Saavedra  <csaavedra@igalia.com>
+
+        [GTK] Add WebKitNetworkResponse::suggested-filename property
+        https://bugs.webkit.org/show_bug.cgi?id=92878
+
+        Reviewed by Carlos Garcia Campos.
+
+        Webcore has API the suggested filename for a response, add
+        a property and getter for it in WebKitNetworkResponse.
+
+        * docs/webkitgtk-sections.txt: Add the symbols
+        * webkit/webkitnetworkresponse.cpp:
+        (_WebKitNetworkResponsePrivate): Add suggested_filename.
+        (webkit_network_response_finalize): Free it on finalize
+        (webkit_network_response_get_property): Add the getter call.
+        (webkit_network_response_class_init): Install the property.
+        (webkit_network_response_get_suggested_filename): New getter.
+        * webkit/webkitnetworkresponse.h: Add the declaration to header
+        file.
+
+2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124207.
+        http://trac.webkit.org/changeset/124207
+        https://bugs.webkit.org/show_bug.cgi?id=92773
+
+        Patch causes crashes on the 64-bit debug builder (and other
+        builders likely) (Requested by zdobersek on #webkit).
+
+        * webkit/webkitspellcheckerenchant.cpp:
+        (_WebKitSpellCheckerEnchantPrivate):
+        (createEnchantBrokerIfNeeded):
+        (freeSpellCheckingLanguage):
+        (webkit_spell_checker_enchant_finalize):
+        (webkit_spell_checker_enchant_class_init):
+        (webkit_spell_checker_enchant_init):
+        (wordEndIsAContractionApostrophe):
+        (checkSpellingOfString):
+        (getGuessesForWord):
+        (getAvailableDictionariesCallback):
+        (updateSpellCheckingLanguages):
+        (learnWord):
+        (ignoreWord):
+
+2012-07-31  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add a new and reusable enchant-based spellchecker in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=90269
+
+        Reviewed by Martin Robinson.
+
+        Remove enchant specific code from WebKitSpellCheckerEnchant and
+        implement it relying in the new TextCheckerEnchant class in WebCore.
+
+        * webkit/webkitspellcheckerenchant.cpp:
+        (_WebKitSpellCheckerEnchantPrivate):
+        (webkit_spell_checker_enchant_finalize):
+        (webkit_spell_checker_enchant_class_init):
+        (webkit_spell_checker_enchant_init):
+        (checkSpellingOfString):
+        (getGuessesForWord):
+        (updateSpellCheckingLanguages):
+        (learnWord):
+        (ignoreWord):
+
+2012-07-30  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] New lines automatically and repeatedly added to list items in Etherpad
+        https://bugs.webkit.org/show_bug.cgi?id=89971
+
+        Reviewed by Ryosuke Niwa.
+
+        Disable the deletion UI by default. This UI, which was enabled as a side-effect
+        of the addition of the private editing API, seems to expose a bug in Etherpad
+        which causes the continuous insertion of bullet points.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::EditorClient::shouldShowDeleteInterface): Disable the deletion UI by default.
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123966 and r123967.
+        http://trac.webkit.org/changeset/123966
+        http://trac.webkit.org/changeset/123967
+        https://bugs.webkit.org/show_bug.cgi?id=92656
+
+        This patch is causing assertion failures on the debug bot
+        (also rolling out a dependent patch) (Requested by mrobinson
+        on #webkit).
+
+        * webkit/webkitspellcheckerenchant.cpp:
+        (_WebKitSpellCheckerEnchantPrivate):
+        (createEnchantBrokerIfNeeded):
+        (freeSpellCheckingLanguage):
+        (webkit_spell_checker_enchant_finalize):
+        (webkit_spell_checker_enchant_class_init):
+        (webkit_spell_checker_enchant_init):
+        (wordEndIsAContractionApostrophe):
+        (checkSpellingOfString):
+        (getGuessesForWord):
+        (getAvailableDictionariesCallback):
+        (updateSpellCheckingLanguages):
+        (learnWord):
+        (ignoreWord):
+
+2012-07-30  Claudio Saavedra  <csaavedra@igalia.com>
+
+        [Gtk] Add WK1 API for snapshot retrieval
+        https://bugs.webkit.org/show_bug.cgi?id=92261
+
+        Reviewed by Martin Robinson.
+
+        Add API to WebKitWebView to retrieve a snapshot of its
+        visible contents as a cairo_surface_t.
+
+        * docs/webkitgtk-sections.txt: Add new symbols.
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_get_snapshot): New
+        method to paint a webview snapshot.
+        * webkit/webkitwebview.h: Ditto.
+
 2012-07-28  Mario Sanchez Prada  <msanchez@igalia.com>
 
         [GTK] Add a new and reusable enchant-based spellchecker in WebCore
diff --git a/Source/WebKit/gtk/NEWS b/Source/WebKit/gtk/NEWS
index 5e7449c64..9f86b12ad 100644
--- a/Source/WebKit/gtk/NEWS
+++ b/Source/WebKit/gtk/NEWS
@@ -1,4 +1,24 @@
 =================
+WebKitGTK+ 1.9.6
+=================
+
+What's new in WebKitGTK+ 1.9.6?
+
+  - Add spell checker API to WebKit2 GTK+ API.
+  - Add WebKitWebView::submit-form signal to WebKit2 GTK+ API.
+  - Add API to get the suggested filename from a
+    WebKitNetworkResponse.
+  - Add webkit_web_view_get_snapshot() to WebKit1 API.
+  - Paste primary selection when middle clicking in X11 WebKit2.
+  - Make sure WebKitWebView always has a main resource and it has
+    already been set when the load has been committed, even for pages
+    loaded from the history cache in WebKit2.
+  - Fix a run time critical warning when gdk_window_get_cursor() is
+    called before WebKitWebView has been realized in WebKit2.
+  - Fix continuous insertion of newlines in Etherpad.
+  - Fix several memory leaks.
+
+=================
 WebKitGTK+ 1.9.5
 =================
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
index ed980d206..5e4b57848 100644
--- a/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
@@ -96,7 +96,7 @@ bool EditorClient::shouldDeleteRange(Range* range)
 
 bool EditorClient::shouldShowDeleteInterface(HTMLElement* element)
 {
-    gboolean accept = TRUE;
+    gboolean accept = FALSE;
     GRefPtr<WebKitDOMHTMLElement> kitElement(adoptGRef(kit(element)));
     g_signal_emit_by_name(m_webView, "should-show-delete-interface-for-element", kitElement.get(), &accept);
     return accept;
diff --git a/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.cpp
index 56d1b773e..9e38851e5 100644
--- a/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.cpp
@@ -26,6 +26,11 @@
 
 namespace WebKit {
 
+PassOwnPtr<RegisterProtocolHandlerClient> RegisterProtocolHandlerClient::create()
+{
+    return adoptPtr(new RegisterProtocolHandlerClient);
+}
+
 RegisterProtocolHandlerClient::RegisterProtocolHandlerClient()
 {
 }
diff --git a/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.h b/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.h
index 938fbc671..f4889f38f 100644
--- a/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.h
@@ -22,14 +22,20 @@
 #if ENABLE(REGISTER_PROTOCOL_HANDLER)
 #include "RegisterProtocolHandlerClient.h"
 
+#include <wtf/PassOwnPtr.h>
+
 namespace WebKit {
 
 class RegisterProtocolHandlerClient : public WebCore::RegisterProtocolHandlerClient {
 public:
-    RegisterProtocolHandlerClient();
+    static PassOwnPtr<RegisterProtocolHandlerClient> create();
+
     ~RegisterProtocolHandlerClient() { }
 
     virtual void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title);
+
+private:
+    RegisterProtocolHandlerClient();
 };
 
 }
diff --git a/Source/WebKit/gtk/docs/webkitgtk-sections.txt b/Source/WebKit/gtk/docs/webkitgtk-sections.txt
index 97fbc0507..59970b59c 100644
--- a/Source/WebKit/gtk/docs/webkitgtk-sections.txt
+++ b/Source/WebKit/gtk/docs/webkitgtk-sections.txt
@@ -380,6 +380,7 @@ webkit_network_request_get_type
 WebKitNetworkResponse
 webkit_network_response_get_uri
 webkit_network_response_get_message
+webkit_network_response_get_suggested_filename
 webkit_network_response_set_uri
 <SUBSECTION Standard>
 WEBKIT_NETWORK_RESPONSE
@@ -475,6 +476,7 @@ webkit_web_view_unmark_text_matches
 webkit_web_view_zoom_in
 webkit_web_view_zoom_out
 webkit_web_view_get_window_features
+webkit_web_view_get_snapshot
 <SUBSECTION Standard>
 WEBKIT_WEB_VIEW
 WEBKIT_IS_WEB_VIEW
diff --git a/Source/WebKit/gtk/tests/testatk.c b/Source/WebKit/gtk/tests/testatk.c
index 60c27942b..cc51be804 100644
--- a/Source/WebKit/gtk/tests/testatk.c
+++ b/Source/WebKit/gtk/tests/testatk.c
@@ -55,7 +55,7 @@ static const char* comboBoxSelector = "<html><body><select><option selected valu
 
 static const char* embeddedObjects = "<html><body><p>Choose: <input value='foo' type='checkbox'/>foo <input value='bar' type='checkbox'/>bar (pick one)</p><p>Choose: <select name='foo'><option>bar</option><option>baz</option></select> (pick one)</p><p><input name='foobarbutton' value='foobar' type='button'/></p></body></html>";
 
-static const char* formWithTextInputs = "<html><body><form><input type='text' name='entry' /></form></body></html>";
+static const char* formWithTextInputs = "<html><body><form><input type='text' name='entry' /><input type='password' name='passwordEntry' /></form></body></html>";
 
 static const char* hypertextAndHyperlinks = "<html><body><p>A paragraph with no links at all</p><p><a href='http://foo.bar.baz/'>A line</a> with <a href='http://bar.baz.foo/'>a link in the middle</a> as well as at the beginning and <a href='http://baz.foo.bar/'>at the end</a></p><ol><li>List item with a <span><a href='http://foo.bar.baz/'>link inside a span node</a></span></li></ol></body></html>";
 
@@ -1735,6 +1735,7 @@ static void testWebkitAtkTextChangedNotifications()
     AtkObject* form = atk_object_ref_accessible_child(object, 0);
     g_assert(ATK_IS_OBJECT(form));
 
+    /* First check normal text entries. */
     AtkObject* textEntry = atk_object_ref_accessible_child(form, 0);
     g_assert(ATK_IS_EDITABLE_TEXT(textEntry));
     g_assert(atk_object_get_role(ATK_OBJECT(textEntry)) == ATK_ROLE_ENTRY);
@@ -1766,10 +1767,45 @@ static void testWebkitAtkTextChangedNotifications()
     g_assert_cmpstr(textChangedResult, ==, "|1|4|8|'qux quux'|");
     g_free(text);
 
+    /* Now check for password entries. */
+    AtkObject* passwordEntry = atk_object_ref_accessible_child(form, 1);
+    g_assert(ATK_IS_EDITABLE_TEXT(passwordEntry));
+    g_assert(atk_object_get_role(ATK_OBJECT(passwordEntry)) == ATK_ROLE_PASSWORD_TEXT);
+
+    g_signal_connect(passwordEntry, "text-insert",
+                     G_CALLBACK(textChangedCb),
+                     GINT_TO_POINTER(TEXT_CHANGE_INSERT));
+    g_signal_connect(passwordEntry, "text-remove",
+                     G_CALLBACK(textChangedCb),
+                     GINT_TO_POINTER(TEXT_CHANGE_REMOVE));
+
+    pos = 0;
+    atk_editable_text_insert_text(ATK_EDITABLE_TEXT(passwordEntry), "foobar", 6, &pos);
+    g_assert_cmpstr(textChangedResult, ==, "|1|0|6|'\342\200\242\342\200\242\342\200\242\342\200\242\342\200\242\342\200\242'|");
+    text = atk_text_get_text(ATK_TEXT(passwordEntry), 0, -1);
+    g_assert_cmpstr(text, ==, "\303\242\302\200\302\242\303\242\302\200\302\242");
+    g_free(text);
+
+    atk_editable_text_delete_text(ATK_EDITABLE_TEXT(passwordEntry), 2, 4);
+    g_assert_cmpstr(textChangedResult, ==, "|2|2|2|'\342\200\242\342\200\242'|");
+
+    text = atk_text_get_text(ATK_TEXT(passwordEntry), 0, -1);
+    g_assert_cmpstr(text, ==, "\303\242\302\200\302\242\303\242");
+    g_free(text);
+
+    pos = 3;
+    atk_editable_text_insert_text(ATK_EDITABLE_TEXT(passwordEntry), "qux", 3, &pos);
+    g_assert_cmpstr(textChangedResult, ==, "|1|3|3|'\342\200\242\342\200\242\342\200\242'|");
+
+    text = atk_text_get_text(ATK_TEXT(passwordEntry), 0, -1);
+    g_assert_cmpstr(text, ==, "\303\242\302\200\302\242\303\242\302\200\302\242\303\242");
+    g_free(text);
+
     g_free(textChangedResult);
 
     g_object_unref(form);
     g_object_unref(textEntry);
+    g_object_unref(passwordEntry);
     g_object_unref(webView);
 }
 
diff --git a/Source/WebKit/gtk/tests/testwebview.c b/Source/WebKit/gtk/tests/testwebview.c
index f71aa42b4..80d7eeadc 100644
--- a/Source/WebKit/gtk/tests/testwebview.c
+++ b/Source/WebKit/gtk/tests/testwebview.c
@@ -609,7 +609,9 @@ void doMouseButtonEvent(GtkWidget* widget, GdkEventType eventType, int x, int y,
     event->button.state = modifiers;
     event->button.button = button;
 
+#ifndef GTK_API_VERSION_2
     event->button.device = gdk_device_manager_get_client_pointer(gdk_display_get_device_manager(gtk_widget_get_display(widget)));
+#endif
 
     int xRoot, yRoot;
     gdk_window_get_root_coords(gtk_widget_get_window(widget), x, y, &xRoot, &yRoot);
diff --git a/Source/WebKit/gtk/webkit/webkitglobals.cpp b/Source/WebKit/gtk/webkit/webkitglobals.cpp
index 42f7a1d93..40356b86b 100644
--- a/Source/WebKit/gtk/webkit/webkitglobals.cpp
+++ b/Source/WebKit/gtk/webkit/webkitglobals.cpp
@@ -531,6 +531,8 @@ void webkitInit()
     soup_session_add_feature(session, authDialog);
     g_object_unref(authDialog);
 
+    WebCore::ResourceHandle::setIgnoreSSLErrors(true);
+
 #if USE(CLUTTER)
     gtk_clutter_init(0, 0);
 #endif
diff --git a/Source/WebKit/gtk/webkit/webkitnetworkresponse.cpp b/Source/WebKit/gtk/webkit/webkitnetworkresponse.cpp
index d106d1e53..5eb855673 100644
--- a/Source/WebKit/gtk/webkit/webkitnetworkresponse.cpp
+++ b/Source/WebKit/gtk/webkit/webkitnetworkresponse.cpp
@@ -24,10 +24,13 @@
 
 #include "ResourceResponse.h"
 #include "webkitglobalsprivate.h"
+#include "webkitnetworkresponseprivate.h"
 #include <glib/gi18n-lib.h>
 #include <wtf/gobject/GRefPtr.h>
 #include <wtf/text/CString.h>
 
+using namespace WebKit;
+
 /**
  * SECTION:webkitnetworkresponse
  * @short_description: the response given to a network request
@@ -43,6 +46,7 @@ G_DEFINE_TYPE(WebKitNetworkResponse, webkit_network_response, G_TYPE_OBJECT);
 
 struct _WebKitNetworkResponsePrivate {
     gchar* uri;
+    gchar* suggestedFilename;
     SoupMessage* message;
 };
 
@@ -53,6 +57,7 @@ enum {
 
     PROP_URI,
     PROP_MESSAGE,
+    PROP_SUGGESTED_FILENAME,
 };
 
 static void webkit_network_response_dispose(GObject* object)
@@ -74,6 +79,7 @@ static void webkit_network_response_finalize(GObject* object)
     WebKitNetworkResponsePrivate* priv = response->priv;
 
     g_free(priv->uri);
+    g_free(priv->suggestedFilename);
 
     G_OBJECT_CLASS(webkit_network_response_parent_class)->finalize(object);
 }
@@ -89,6 +95,9 @@ static void webkit_network_response_get_property(GObject* object, guint property
     case PROP_MESSAGE:
         g_value_set_object(value, webkit_network_response_get_message(response));
         break;
+    case PROP_SUGGESTED_FILENAME:
+        g_value_set_string(value, webkit_network_response_get_suggested_filename(response));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propertyID, pspec);
     }
@@ -150,6 +159,20 @@ static void webkit_network_response_class_init(WebKitNetworkResponseClass* respo
                                                         SOUP_TYPE_MESSAGE,
                                                         (GParamFlags)(WEBKIT_PARAM_READWRITE|G_PARAM_CONSTRUCT_ONLY)));
 
+    /**
+     * WebKitNetworkResponse:suggested-filename:
+     *
+     * The suggested filename for the response.
+     *
+     * Since: 1.10
+     */
+    g_object_class_install_property(objectClass, PROP_SUGGESTED_FILENAME,
+                                    g_param_spec_string("suggested-filename",
+                                                        _("Suggested filename"),
+                                                        _("The suggested filename for the response."),
+                                                        0,
+                                                        WEBKIT_PARAM_READABLE));
+
     g_type_class_add_private(responseClass, sizeof(WebKitNetworkResponsePrivate));
 }
 
@@ -250,6 +273,32 @@ SoupMessage* webkit_network_response_get_message(WebKitNetworkResponse* response
     return priv->message;
 }
 
+/**
+ * webkit_network_response_get_suggested_filename:
+ * @response: a #WebKitNetworkResponse
+ *
+ * Obtains the suggested filename for the given network response. The
+ * suggested filename is taken from the 'Content-Disposition' HTTP
+ * header, but this is not always present, and this method will return
+ * %NULL in such case.
+ *
+ * Returns: (transfer none): the suggested filename or %NULL if not present
+ * Since: 1.10
+ **/
+const gchar* webkit_network_response_get_suggested_filename(WebKitNetworkResponse* response)
+{
+    g_return_val_if_fail(WEBKIT_IS_NETWORK_RESPONSE(response), 0);
+
+    WebKitNetworkResponsePrivate* priv = response->priv;
+
+    if (priv->suggestedFilename)
+        return priv->suggestedFilename;
+
+    WebCore::ResourceResponse coreResponse = core(response);
+    priv->suggestedFilename = g_strdup(coreResponse.suggestedFilename().utf8().data());
+    return priv->suggestedFilename;
+}
+
 namespace WebKit {
 
 WebCore::ResourceResponse core(WebKitNetworkResponse* response)
diff --git a/Source/WebKit/gtk/webkit/webkitnetworkresponse.h b/Source/WebKit/gtk/webkit/webkitnetworkresponse.h
index 8009aef0a..359b3322a 100644
--- a/Source/WebKit/gtk/webkit/webkitnetworkresponse.h
+++ b/Source/WebKit/gtk/webkit/webkitnetworkresponse.h
@@ -69,6 +69,9 @@ webkit_network_response_get_uri  (WebKitNetworkResponse *response);
 WEBKIT_API SoupMessage *
 webkit_network_response_get_message(WebKitNetworkResponse* response);
 
+WEBKIT_API const char *
+webkit_network_response_get_suggested_filename(WebKitNetworkResponse *response);
+
 G_END_DECLS
 
 #endif
diff --git a/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp b/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
index 0a226928b..07d34d156 100644
--- a/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
+++ b/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
@@ -74,14 +74,14 @@ static void webkit_spell_checker_enchant_init(WebKitSpellCheckerEnchant* checker
 static void checkSpellingOfString(WebKitSpellChecker* checker, const char* string, int* misspellingLocation, int* misspellingLength)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
-    priv->textCheckerEnchant->checkSpellingOfString(String(string), *misspellingLocation, *misspellingLength);
+    priv->textCheckerEnchant->checkSpellingOfString(String::fromUTF8(string), *misspellingLocation, *misspellingLength);
 }
 
 static char** getGuessesForWord(WebKitSpellChecker* checker, const char* word, const char* context)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
 
-    Vector<String> guesses = priv->textCheckerEnchant->getGuessesForWord(String(word));
+    Vector<String> guesses = priv->textCheckerEnchant->getGuessesForWord(String::fromUTF8(word));
 
     if (guesses.isEmpty())
         return 0;
@@ -99,7 +99,7 @@ static char** getGuessesForWord(WebKitSpellChecker* checker, const char* word, c
 static void updateSpellCheckingLanguages(WebKitSpellChecker* checker, const char* languages)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
-    priv->textCheckerEnchant->updateSpellCheckingLanguages(String(languages));
+    priv->textCheckerEnchant->updateSpellCheckingLanguages(String::fromUTF8(languages));
 }
 
 static char* getAutocorrectSuggestionsForMisspelledWord(WebKitSpellChecker* checker, const char* word)
@@ -110,13 +110,13 @@ static char* getAutocorrectSuggestionsForMisspelledWord(WebKitSpellChecker* chec
 static void learnWord(WebKitSpellChecker* checker, const char* word)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
-    priv->textCheckerEnchant->learnWord(String(word));
+    priv->textCheckerEnchant->learnWord(String::fromUTF8(word));
 }
 
 static void ignoreWord(WebKitSpellChecker* checker, const char* word)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
-    priv->textCheckerEnchant->ignoreWord(String(word));
+    priv->textCheckerEnchant->ignoreWord(String::fromUTF8(word));
 }
 
 static void webkit_spell_checker_enchant_spell_checker_interface_init(WebKitSpellCheckerInterface* interface)
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.cpp b/Source/WebKit/gtk/webkit/webkitwebview.cpp
index 810eec9c6..0b8d6a8f0 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebview.cpp
@@ -118,10 +118,6 @@
 #include "DeviceOrientationClientGtk.h"
 #endif
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
-#include "RegisterProtocolHandlerClientGtk.h"
-#endif
-
 /**
  * SECTION:webkitwebview
  * @short_description: The central class of the WebKitGTK+ API
@@ -2294,7 +2290,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
      *
      * The default bindings for this signal is Ctrl-a.
      */
-    webkit_web_view_signals[SELECT_ALL] = g_signal_new("select-all",
+    webkit_web_view_signals[::SELECT_ALL] = g_signal_new("select-all",
             G_TYPE_FROM_CLASS(webViewClass),
             (GSignalFlags)(G_SIGNAL_RUN_LAST | G_SIGNAL_ACTION),
             G_STRUCT_OFFSET(WebKitWebViewClass, select_all),
@@ -3635,7 +3631,8 @@ static void webkit_web_view_init(WebKitWebView* webView)
 #endif
 
 #if ENABLE(REGISTER_PROTOCOL_HANDLER)
-    WebCore::provideRegisterProtocolHandlerTo(priv->corePage, new WebKit::RegisterProtocolHandlerClient);
+    priv->registerProtocolHandlerClient = WebKit::RegisterProtocolHandlerClient::create();
+    WebCore::provideRegisterProtocolHandlerTo(priv->corePage, priv->registerProtocolHandlerClient.get());
 #endif
 
     if (DumpRenderTreeSupportGtk::dumpRenderTreeModeEnabled()) {
@@ -4422,7 +4419,7 @@ void webkit_web_view_select_all(WebKitWebView* webView)
 {
     g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
 
-    g_signal_emit(webView, webkit_web_view_signals[SELECT_ALL], 0);
+    g_signal_emit(webView, webkit_web_view_signals[::SELECT_ALL], 0);
 }
 
 /**
@@ -5259,6 +5256,44 @@ GtkMenu* webkit_web_view_get_context_menu(WebKitWebView* webView)
 #endif
 }
 
+/**
+ * webkit_web_view_get_snapshot:
+ * @web_view: a #WebKitWebView
+ *
+ * Retrieves a snapshot with the visible contents of @webview.
+ *
+ * Returns: (transfer full): a @cairo_surface_t
+ *
+ * Since: 1.10
+ **/
+cairo_surface_t*
+webkit_web_view_get_snapshot(WebKitWebView* webView)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), 0);
+
+    Frame* frame = core(webView)->mainFrame();
+    if (!frame || !frame->contentRenderer() || !frame->view())
+        return 0;
+
+    frame->view()->updateLayoutAndStyleIfNeededRecursive();
+    GtkAllocation allocation;
+    gtk_widget_get_allocation(GTK_WIDGET(webView), &allocation);
+    cairo_surface_t* surface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, allocation.width, allocation.height);
+    RefPtr<cairo_t> cr = adoptRef(cairo_create(surface));
+    GraphicsContext gc(cr.get());
+
+    IntRect rect = allocation;
+    gc.applyDeviceScaleFactor(frame->page()->deviceScaleFactor());
+    gc.save();
+    gc.clip(rect);
+    if (webView->priv->transparent)
+        gc.clearRect(rect);
+    frame->view()->paint(&gc, rect);
+    gc.restore();
+
+    return surface;
+}
+
 void webViewEnterFullscreen(WebKitWebView* webView, Node* node)
 {
     if (!node->hasTagName(HTMLNames::videoTag))
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.h b/Source/WebKit/gtk/webkit/webkitwebview.h
index 87c197acf..9c84263b4 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.h
+++ b/Source/WebKit/gtk/webkit/webkitwebview.h
@@ -446,6 +446,9 @@ webkit_web_view_get_dom_document                (WebKitWebView        *web_view)
 WEBKIT_API WebKitViewportAttributes*
 webkit_web_view_get_viewport_attributes         (WebKitWebView        *web_view);
 
+WEBKIT_API cairo_surface_t*
+webkit_web_view_get_snapshot                    (WebKitWebView        *web_view);
+
 G_END_DECLS
 
 #endif
diff --git a/Source/WebKit/gtk/webkit/webkitwebviewprivate.h b/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
index 72a8dbc05..c302696d2 100644
--- a/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
+++ b/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
@@ -39,6 +39,10 @@
 #include "UserMediaClientGtk.h"
 #endif
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+#include "RegisterProtocolHandlerClientGtk.h"
+#endif
+
 namespace WebKit {
 WebCore::Page* core(WebKitWebView*);
 WebKitWebView* kit(WebCore::Page*);
@@ -117,6 +121,10 @@ struct _WebKitWebViewPrivate {
 #if ENABLE(GEOLOCATION)
     OwnPtr<WebCore::GeolocationClientMock> geolocationClientMock;
 #endif
+
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+    OwnPtr<WebKit::RegisterProtocolHandlerClient> registerProtocolHandlerClient;
+#endif
 };
 
 void webkit_web_view_notify_ready(WebKitWebView*);
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index 05df0aed5..9317bd2f7 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,67 @@
+2012-08-09  Kinuko Yasuda  <kinuko@chromium.org>
+
+        http/tests/security/mixedContent/blob-url-in-iframe.html fails on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=88736
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebView::_canHandleRequest should return true for "blob:" URL so that it can be shown in iframe.
+
+        * WebView/WebView.mm:
+        (+[WebView _canHandleRequest:forMainFrame:]):
+
+2012-08-08  Shane Stephens  <shanestephens@google.com>
+
+        Compile flag for CSS Hierarchies
+        https://bugs.webkit.org/show_bug.cgi?id=92433
+
+        Reviewed by Tony Chang.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-08-05  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: [JSC] implement setting breakpoints by line:column
+        https://bugs.webkit.org/show_bug.cgi?id=53003
+
+        Unreviewed, just changed the interface according the changes of base class JSC::Debugger.
+
+        No JSC can provide the column info of current JS statement, mac porting can use it to support
+        "Pretty Print" debug mode.
+
+        * WebView/WebScriptDebugger.h:
+        (WebScriptDebugger):
+        * WebView/WebScriptDebugger.mm:
+        (WebScriptDebugger::callEvent):
+        (WebScriptDebugger::atStatement):
+        (WebScriptDebugger::returnEvent):
+        (WebScriptDebugger::exception):
+        (WebScriptDebugger::willExecuteProgram):
+        (WebScriptDebugger::didExecuteProgram):
+        (WebScriptDebugger::didReachBreakpoint):
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port
+        https://bugs.webkit.org/show_bug.cgi?id=90298
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig: Add ENABLE_WIDGET_REGION define.
+
+2012-08-01  Antti Koivisto  <antti@apple.com>
+
+        Assertion failure in inspector/profiler/heap-snapshot-containment-show-all.html on Lion bot
+        https://bugs.webkit.org/show_bug.cgi?id=92888
+
+        Reviewed by Andreas Kling.
+
+        Protect the WebInspectorWindowController so it doesn't get destroyed during [WebView close] and cause
+        unsafe [WebView dealloc].
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindowController destroyInspectorView:]):
+
 2012-07-29  Rik Cabanier  <cabanier@adobe.com>
 
         Add ENABLE_CSS_COMPOSITING flag
diff --git a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
index 70cf60c23..10257077c 100644
--- a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -40,6 +40,7 @@ ENABLE_CSP_NEXT = ;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
+ENABLE_CSS_HIERARCHIES = ;
 ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
@@ -134,7 +135,9 @@ ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
 ENABLE_WEB_TIMING = ;
+ENABLE_WIDGET_REGION = $(ENABLE_WIDGET_REGION_$(REAL_PLATFORM_NAME));
+ENABLE_WIDGET_REGION_macosx = ENABLE_WIDGET_REGION;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WIDGET_REGION) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebKit/mac/Configurations/Version.xcconfig b/Source/WebKit/mac/Configurations/Version.xcconfig
index b827ad3ef..c88c7e97b 100644
--- a/Source/WebKit/mac/Configurations/Version.xcconfig
+++ b/Source/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 3;
+MINOR_VERSION = 6;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
index fda659256..97d331c34 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
@@ -511,6 +511,7 @@ void WebInspectorFrontendClient::updateWindowTitle() const
             inspectedPage->inspectorController()->disconnectFrontend();
     }
 
+    RetainPtr<WebInspectorWindowController> protect(self);
     [_webView close];
 }
 
diff --git a/Source/WebKit/mac/WebView/WebScriptDebugger.h b/Source/WebKit/mac/WebView/WebScriptDebugger.h
index 784a80294..b551f7dc8 100644
--- a/Source/WebKit/mac/WebView/WebScriptDebugger.h
+++ b/Source/WebKit/mac/WebView/WebScriptDebugger.h
@@ -54,13 +54,13 @@ public:
     void initGlobalCallFrame(const JSC::DebuggerCallFrame&);
 
     virtual void sourceParsed(JSC::ExecState*, JSC::SourceProvider*, int errorLine, const JSC::UString& errorMsg);
-    virtual void callEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-    virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-    virtual void returnEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-    virtual void exception(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, bool hasHandler);
-    virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-    virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-    virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+    virtual void callEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber);
+    virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber);
+    virtual void returnEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber);
+    virtual void exception(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber, bool hasHandler);
+    virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno, int columnno);
+    virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno, int columnno);
+    virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno, int columnno);
 
     JSC::JSGlobalObject* globalObject() const { return m_globalObject.get(); }
     WebScriptCallFrame *globalCallFrame() const { return m_globalCallFrame.get(); }
diff --git a/Source/WebKit/mac/WebView/WebScriptDebugger.mm b/Source/WebKit/mac/WebView/WebScriptDebugger.mm
index 65f41c89a..4ffe725b8 100644
--- a/Source/WebKit/mac/WebView/WebScriptDebugger.mm
+++ b/Source/WebKit/mac/WebView/WebScriptDebugger.mm
@@ -142,7 +142,7 @@ void WebScriptDebugger::sourceParsed(ExecState* exec, SourceProvider* sourceProv
     m_callingDelegate = false;
 }
 
-void WebScriptDebugger::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void WebScriptDebugger::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (m_callingDelegate)
         return;
@@ -161,7 +161,7 @@ void WebScriptDebugger::callEvent(const DebuggerCallFrame& debuggerCallFrame, in
     m_callingDelegate = false;
 }
 
-void WebScriptDebugger::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void WebScriptDebugger::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (m_callingDelegate)
         return;
@@ -180,7 +180,7 @@ void WebScriptDebugger::atStatement(const DebuggerCallFrame& debuggerCallFrame,
     m_callingDelegate = false;
 }
 
-void WebScriptDebugger::returnEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void WebScriptDebugger::returnEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (m_callingDelegate)
         return;
@@ -202,7 +202,7 @@ void WebScriptDebugger::returnEvent(const DebuggerCallFrame& debuggerCallFrame,
     m_callingDelegate = false;
 }
 
-void WebScriptDebugger::exception(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, bool hasHandler)
+void WebScriptDebugger::exception(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber, bool hasHandler)
 {
     if (m_callingDelegate)
         return;
@@ -224,17 +224,17 @@ void WebScriptDebugger::exception(const DebuggerCallFrame& debuggerCallFrame, in
     m_callingDelegate = false;
 }
 
-void WebScriptDebugger::willExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineno)
+void WebScriptDebugger::willExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineno, int columnno)
 {
-    callEvent(debuggerCallFrame, sourceID, lineno);
+    callEvent(debuggerCallFrame, sourceID, lineno, columnno);
 }
 
-void WebScriptDebugger::didExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineno)
+void WebScriptDebugger::didExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineno, int columnno)
 {
-    returnEvent(debuggerCallFrame, sourceID, lineno);
+    returnEvent(debuggerCallFrame, sourceID, lineno, columnno);
 }
 
-void WebScriptDebugger::didReachBreakpoint(const DebuggerCallFrame&, intptr_t, int)
+void WebScriptDebugger::didReachBreakpoint(const DebuggerCallFrame&, intptr_t, int, int)
 {
     return;
 }
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index a62f27ecb..3391ab967 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -1760,8 +1760,16 @@ static inline IMP getMethod(id o, SEL s)
     // Representations for URL schemes work at the top level.
     if (forMainFrame && [self _representationExistsForURLScheme:scheme])
         return YES;
-        
-    return [scheme _webkit_isCaseInsensitiveEqualToString:@"applewebdata"];
+
+    if ([scheme _webkit_isCaseInsensitiveEqualToString:@"applewebdata"])
+        return YES;
+
+#if ENABLE(BLOB)
+    if ([scheme _webkit_isCaseInsensitiveEqualToString:@"blob"])
+        return YES;
+#endif
+
+    return NO;
 }
 
 + (BOOL)_canHandleRequest:(NSURLRequest *)request
diff --git a/Source/WebKit/qt/Api/qgraphicswebview.cpp b/Source/WebKit/qt/Api/qgraphicswebview.cpp
index 343c2a166..3e8abbad9 100644
--- a/Source/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/Source/WebKit/qt/Api/qgraphicswebview.cpp
@@ -309,9 +309,7 @@ bool QGraphicsWebView::sceneEvent(QEvent* event)
     if (d->page && (event->type() == QEvent::TouchBegin
                 || event->type() == QEvent::TouchEnd
                 || event->type() == QEvent::TouchUpdate
-#if HAVE(QT5)
                 || event->type() == QEvent::TouchCancel
-#endif
        )) {
         d->page->event(event);
 
diff --git a/Source/WebKit/qt/Api/qgraphicswebview.h b/Source/WebKit/qt/Api/qgraphicswebview.h
index 15fe087d6..0f9f17b48 100644
--- a/Source/WebKit/qt/Api/qgraphicswebview.h
+++ b/Source/WebKit/qt/Api/qgraphicswebview.h
@@ -23,11 +23,7 @@
 #include "qwebkitglobal.h"
 #include "qwebpage.h"
 #include <QtCore/qurl.h>
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 #include <QtWidgets/qgraphicswidget.h>
-#else
-#include <QtGui/qgraphicswidget.h>
-#endif
 #include <QtGui/qevent.h>
 #include <QtGui/qicon.h>
 #include <QtGui/qpainter.h>
diff --git a/Source/WebKit/qt/Api/qwebframe.cpp b/Source/WebKit/qt/Api/qwebframe.cpp
index dac4165e9..52b97382d 100644
--- a/Source/WebKit/qt/Api/qwebframe.cpp
+++ b/Source/WebKit/qt/Api/qwebframe.cpp
@@ -97,10 +97,6 @@
 #include <qregion.h>
 #include <qnetworkrequest.h>
 
-#if ENABLE(ORIENTATION_EVENTS) && !HAVE(QT5)
-QTM_USE_NAMESPACE
-#endif
-
 using namespace WebCore;
 
 // from text/qfont.cpp
@@ -492,45 +488,9 @@ void QWebFramePrivate::_q_orientationChanged()
 
 void QWebFramePrivate::didClearWindowObject()
 {
-    if (page->settings()->testAttribute(QWebSettings::JavascriptEnabled))
-        addQtSenderToGlobalObject();
     emit q->javaScriptWindowObjectCleared();
 }
 
-static JSValueRef qtSenderCallback(JSContextRef context, JSObjectRef, JSObjectRef, size_t, const JSValueRef[], JSValueRef*)
-{
-    QObject* sender = JSC::Bindings::QtInstance::qtSenderStack()->top();
-    if (!sender)
-        return JSValueMakeUndefined(context);
-
-    JSC::ExecState* exec = ::toJS(context);
-    RefPtr<JSC::Bindings::RootObject> rootObject = JSC::Bindings::findRootObject(exec->dynamicGlobalObject());
-    JSC::JSObject* jsSender = JSC::Bindings::QtInstance::getQtInstance(sender, rootObject, JSC::Bindings::QtInstance::QtOwnership)->createRuntimeObject(exec);
-    return ::toRef(jsSender);
-}
-
-void QWebFramePrivate::addQtSenderToGlobalObject()
-{
-    JSDOMWindow* window = toJSDOMWindow(frame, mainThreadNormalWorld());
-    Q_ASSERT(window);
-
-    JSC::ExecState* exec = window->globalExec();
-    Q_ASSERT(exec);
-    JSC::JSLockHolder lock(exec);
-
-    JSContextRef context = ::toRef(exec);
-    JSRetainPtr<JSStringRef> propertyName(Adopt, JSStringCreateWithUTF8CString("__qt_sender__"));
-    JSObjectRef function = JSObjectMakeFunctionWithCallback(context, propertyName.get(), qtSenderCallback);
-
-    // JSC public API doesn't support setting a Getter for a property of a given object, https://bugs.webkit.org/show_bug.cgi?id=61374.
-    JSC::PropertyDescriptor descriptor;
-    descriptor.setGetter(::toJS(function));
-    descriptor.setSetter(JSC::jsUndefined());
-    descriptor.setEnumerable(false);
-    descriptor.setConfigurable(false);
-    window->methodTable()->defineOwnProperty(window, exec, propertyName.get()->identifier(&exec->globalData()), descriptor, false);
-}
-
 /*!
     \class QWebFrame
     \since 4.4
@@ -650,11 +610,7 @@ QWebFrame::~QWebFrame()
 
     The ownership of \a object is specified using \a own.
 */
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 void QWebFrame::addToJavaScriptWindowObject(const QString &name, QObject *object, ValueOwnership ownership)
-#else
-void QWebFrame::addToJavaScriptWindowObject(const QString &name, QObject *object, QScriptEngine::ValueOwnership ownership)
-#endif
 {
     if (!page()->settings()->testAttribute(QWebSettings::JavascriptEnabled))
         return;
diff --git a/Source/WebKit/qt/Api/qwebframe.h b/Source/WebKit/qt/Api/qwebframe.h
index 6d486d50e..ca96661e3 100644
--- a/Source/WebKit/qt/Api/qwebframe.h
+++ b/Source/WebKit/qt/Api/qwebframe.h
@@ -28,10 +28,6 @@
 #include <QtNetwork/qnetworkaccessmanager.h>
 #include "qwebkitglobal.h"
 
-#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
-#include <QtScript/qscriptengine.h>
-#endif
-
 QT_BEGIN_NAMESPACE
 class QRect;
 class QPoint;
@@ -124,13 +120,11 @@ private:
     ~QWebFrame();
 
 public:
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
     enum ValueOwnership {
         QtOwnership,
         ScriptOwnership,
         AutoOwnership
     };
-#endif
 
     QWebPage *page() const;
 
@@ -139,11 +133,7 @@ public:
     void setHtml(const QString &html, const QUrl &baseUrl = QUrl());
     void setContent(const QByteArray &data, const QString &mimeType = QString(), const QUrl &baseUrl = QUrl());
 
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
     void addToJavaScriptWindowObject(const QString &name, QObject *object, ValueOwnership ownership = QtOwnership);
-#else
-    void addToJavaScriptWindowObject(const QString &name, QObject *object, QScriptEngine::ValueOwnership ownership = QScriptEngine::QtOwnership);
-#endif
     QString toHtml() const;
     QString toPlainText() const;
     QString renderTreeDump() const;
diff --git a/Source/WebKit/qt/Api/qwebframe_p.h b/Source/WebKit/qt/Api/qwebframe_p.h
index 2762c2be7..3201aaa57 100644
--- a/Source/WebKit/qt/Api/qwebframe_p.h
+++ b/Source/WebKit/qt/Api/qwebframe_p.h
@@ -30,9 +30,6 @@
 #include "PlatformString.h"
 #if ENABLE(ORIENTATION_EVENTS)
 #include "qorientationsensor.h"
-#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
-using QTM_NAMESPACE::QOrientationSensor;
-#endif
 #endif // ENABLE(ORIENTATION_EVENTS).
 #include "qwebelement.h"
 #include "wtf/RefPtr.h"
@@ -132,11 +129,6 @@ public:
 #if ENABLE(ORIENTATION_EVENTS)
     QOrientationSensor m_orientation;
 #endif // ENABLE(ORIENTATION_EVENTS).
-
-private:
-#if USE(JSC)
-    void addQtSenderToGlobalObject();
-#endif
 };
 
 class QWebHitTestResultPrivate {
diff --git a/Source/WebKit/qt/Api/qwebpage.cpp b/Source/WebKit/qt/Api/qwebpage.cpp
index 8e9633d18..08e86183a 100644
--- a/Source/WebKit/qt/Api/qwebpage.cpp
+++ b/Source/WebKit/qt/Api/qwebpage.cpp
@@ -113,7 +113,6 @@
 #include "SystemInfo.h"
 #endif // Q_OS_WIN32
 #include "TextIterator.h"
-#include "UtilsQt.h"
 #include "WebEventConversion.h"
 #include "WindowFeatures.h"
 #include "WorkerThread.h"
@@ -3162,9 +3161,7 @@ bool QWebPage::event(QEvent *ev)
     case QEvent::TouchBegin:
     case QEvent::TouchUpdate:
     case QEvent::TouchEnd:
-#if HAVE(QT5)
     case QEvent::TouchCancel:
-#endif
         // Return whether the default action was cancelled in the JS event handler
         return d->touchEvent(static_cast<QTouchEvent*>(ev));
 #ifndef QT_NO_PROPERTIES
diff --git a/Source/WebKit/qt/Api/qwebpage.h b/Source/WebKit/qt/Api/qwebpage.h
index 0bf35e247..66f89609b 100644
--- a/Source/WebKit/qt/Api/qwebpage.h
+++ b/Source/WebKit/qt/Api/qwebpage.h
@@ -26,11 +26,7 @@
 
 #include <QtCore/qobject.h>
 #include <QtCore/qurl.h>
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 #include <QtWidgets/qwidget.h>
-#else
-#include <QtGui/qwidget.h>
-#endif
 
 QT_BEGIN_NAMESPACE
 class QNetworkProxy;
diff --git a/Source/WebKit/qt/Api/qwebsettings.cpp b/Source/WebKit/qt/Api/qwebsettings.cpp
index 588dcf7aa..774da5d31 100644
--- a/Source/WebKit/qt/Api/qwebsettings.cpp
+++ b/Source/WebKit/qt/Api/qwebsettings.cpp
@@ -46,11 +46,7 @@
 #include "FileSystem.h"
 
 #include <QApplication>
-#if HAVE(QT5)
 #include <QStandardPaths>
-#else
-#include <QDesktopServices>
-#endif
 #include <QDir>
 #include <QHash>
 #include <QSharedData>
@@ -1145,11 +1141,7 @@ void QWebSettings::enablePersistentStorage(const QString& path)
 
     if (path.isEmpty()) {
 
-#if HAVE(QT5)
         storagePath = QStandardPaths::writableLocation(QStandardPaths::DataLocation);
-#else
-        storagePath = QDesktopServices::storageLocation(QDesktopServices::DataLocation);
-#endif
         if (storagePath.isEmpty())
             storagePath = WebCore::pathByAppendingComponent(QDir::homePath(), QCoreApplication::applicationName());
     } else
@@ -1168,11 +1160,7 @@ void QWebSettings::enablePersistentStorage(const QString& path)
 #if ENABLE(NETSCAPE_PLUGIN_METADATA_CACHE)
     // All applications can share the common QtWebkit cache file(s).
     // Path is not configurable and uses QDesktopServices::CacheLocation by default.
-#if HAVE(QT5)
     QString cachePath = QStandardPaths::writableLocation(QStandardPaths::CacheLocation);
-#else
-    QString cachePath = QDesktopServices::storageLocation(QDesktopServices::CacheLocation);
-#endif
     WebCore::makeAllDirectories(cachePath);
 
     QFileInfo info(cachePath);
diff --git a/Source/WebKit/qt/Api/qwebview.cpp b/Source/WebKit/qt/Api/qwebview.cpp
index a6082cf63..f90790f0c 100644
--- a/Source/WebKit/qt/Api/qwebview.cpp
+++ b/Source/WebKit/qt/Api/qwebview.cpp
@@ -34,10 +34,8 @@
 #include "qdir.h"
 #include "qfile.h"
 #ifndef QT_NO_ACCESSIBILITY
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 #include "qwebviewaccessible_p.h"
 #endif
-#endif
 
 class QWebViewPrivate {
 public:
@@ -154,7 +152,6 @@ void QWebViewPrivate::_q_pageDestroyed()
 */
 
 #ifndef QT_NO_ACCESSIBILITY
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 static QAccessibleInterface* accessibleInterfaceFactory(const QString& key, QObject* object)
 {
     Q_UNUSED(key)
@@ -168,7 +165,6 @@ static QAccessibleInterface* accessibleInterfaceFactory(const QString& key, QObj
     return 0;
 }
 #endif
-#endif
 
 /*!
     Constructs an empty QWebView with parent \a parent.
@@ -191,10 +187,8 @@ QWebView::QWebView(QWidget *parent)
     setFocusPolicy(Qt::WheelFocus);
 
 #ifndef QT_NO_ACCESSIBILITY
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
     QAccessible::installFactory(accessibleInterfaceFactory);
 #endif
-#endif
 }
 
 /*!
@@ -732,9 +726,7 @@ bool QWebView::event(QEvent *e)
         } else if (e->type() == QEvent::TouchBegin 
                    || e->type() == QEvent::TouchEnd 
                    || e->type() == QEvent::TouchUpdate
-#if HAVE(QT5)
                    || e->type() == QEvent::TouchCancel
-#endif
                   ) {
             d->page->event(e);
 
diff --git a/Source/WebKit/qt/Api/qwebview.h b/Source/WebKit/qt/Api/qwebview.h
index 90d0a8e3b..d4b4dd917 100644
--- a/Source/WebKit/qt/Api/qwebview.h
+++ b/Source/WebKit/qt/Api/qwebview.h
@@ -23,11 +23,7 @@
 
 #include "qwebkitglobal.h"
 #include "qwebpage.h"
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 #include <QtWidgets/qwidget.h>
-#else
-#include <QtGui/qwidget.h>
-#endif
 #include <QtGui/qicon.h>
 #include <QtGui/qpainter.h>
 #include <QtCore/qurl.h>
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index 3262f75a1..b008c205d 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,162 @@
+2012-08-11  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] Add support for HTML5 state object history API in FrameLoaderClientQt
+        https://bugs.webkit.org/show_bug.cgi?id=93648
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add support for push/replace/pop by implementing dispatchDidNavigateWithinPage.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidNavigateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidPushStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidReplaceStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidPopStateWithinPage):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+        (FrameLoaderClientQt):
+        * tests/qwebframe/tst_qwebframe.cpp:
+        (tst_QWebFrame):
+        (tst_QWebFrame::setUrlUsingStateObject): Added. Tests that the urlChanged signal is fired.
+
+2012-08-10  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove QRegExp <> JS RegExp conversion
+        https://bugs.webkit.org/show_bug.cgi?id=93716
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Removed tests that cover the automatic QRegExp <> JS RegExp conversion. See WebCore
+        ChangeLog for details.
+
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (MyQObject::emitMySignalWithDateTimeArg):
+        (MyQObject):
+        (tst_QObjectBridge::overloadedSlots):
+        (tst_QObjectBridge::typeConversion):
+
+2012-08-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove support for __qt_sender__ in QObject bridge
+        https://bugs.webkit.org/show_bug.cgi?id=93649
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Support for __qt_sender__ has also been removed from QtScript/QJSEngine. The right
+        JavaScript solution to the problem is Function.prototype.bind.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::didClearWindowObject):
+        * Api/qwebframe_p.h:
+        (QWebFramePrivate):
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge::connectAndDisconnect):
+
+2012-08-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Port internal findMethodIndex method matcher to use JSC C API
+        https://bugs.webkit.org/show_bug.cgi?id=93463
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Adjust the expectations of the unit test for some of the exceptions the
+        method throws when signals/slots cannot be found/matched. The C API doesn't allow
+        us to create syntax (type) errors, only generic error exceptions.
+
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge::callQtInvokable):
+
+2012-08-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Add unit test for QObject bindings for scriptable plugins
+        https://bugs.webkit.org/show_bug.cgi?id=93462
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The bindings code is subject to refactoring in the future, so added a unit test to verify that
+        accessing an embedded QWidget from JavaScript goes through the QObject bindings.
+
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge):
+        (TestPluginWidget):
+        (TestPluginWidget::TestPluginWidget):
+        (TestPluginWidget::slotWithReturnValue):
+        (TestWebPage):
+        (TestWebPage::TestWebPage):
+        (TestWebPage::createPlugin):
+        (tst_QObjectBridge::scriptablePlugin):
+
+2012-08-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed trivial fix: Missed HAVE_QT5 removal as part of r124879
+
+        Fixes failing auto-test.
+
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge::enumerate_data):
+
+2012-08-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove Qt 4 specific code paths
+        https://bugs.webkit.org/show_bug.cgi?id=88161
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::sceneEvent):
+        * Api/qgraphicswebview.h:
+        * Api/qwebframe.cpp:
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        * Api/qwebpage.cpp:
+        (QWebPage::event):
+        * Api/qwebpage.h:
+        * Api/qwebsettings.cpp:
+        (QWebSettings::enablePersistentStorage):
+        * Api/qwebview.cpp:
+        (QWebView::QWebView):
+        (QWebView::event):
+        * Api/qwebview.h:
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::setToolTip):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin):
+        * WebCoreSupport/GeolocationClientQt.cpp:
+        * WebCoreSupport/GeolocationClientQt.h:
+        * WebCoreSupport/PageClientQt.cpp:
+        (createPlatformGraphicsContext3DFromWidget):
+        (QWebPageClient::ownerWindow):
+        * WebCoreSupport/WebEventConversion.cpp:
+        (WebCore::WebKitPlatformTouchEvent::WebKitPlatformTouchEvent):
+        * declarative/declarative.pro:
+        * declarative/plugin.cpp:
+        * declarative/public.pri:
+        * examples/platformplugin/WebPlugin.cpp:
+        (WebPlugin::createExtension):
+        * examples/platformplugin/WebPlugin.h:
+        (WebPlugin):
+        * examples/platformplugin/platformplugin.pro:
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge::arrayObjectEnumerable):
+        (tst_QObjectBridge::ownership):
+        (tst_QObjectBridge::qObjectWrapperWithSameIdentity):
+        * tests/tests.pri:
+        * tests/util.h:
+
+2012-08-01  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt]REGRESSION(r123786): It made 3 fast/animation tests fail.
+        https://bugs.webkit.org/show_bug.cgi?id=92490
+
+        QAbstractAnimation:start() is implicitly calling updateTime
+        without going through the event loop. This resulted in executing
+        scripted animation callbacks right when registering a first callback.
+
+        Reviewed by Noam Rosenthal.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::RefreshAnimation::scheduleAnimation):
+            Invoke QAbstractAnimation::start() method through the event loop.
+
 2012-07-27  Csaba Osztrogonác  <ossy@webkit.org>
 
         [Qt][WK2] REGRESSION(r119127): resetting window.internals settings between tests doesn't work properly
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index 92814429b..912320ccd 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -75,7 +75,6 @@
 #include <qeventloop.h>
 #include <qtooltip.h>
 #include <wtf/OwnPtr.h>
-#include <wtf/qt/UtilsQt.h>
 
 #if ENABLE(VIDEO) && ((USE(GSTREAMER) && !defined(GST_API_VERSION_1)) || USE(QT_MULTIMEDIA) || USE(QTKIT))
 #include "FullScreenVideoQt.h"
@@ -104,7 +103,7 @@ public:
     {
         m_animationScheduled = true;
         if (state() != QAbstractAnimation::Running)
-            start();
+            QMetaObject::invokeMethod(this, "start", Qt::QueuedConnection);
     }
 
 protected:
@@ -549,7 +548,7 @@ void ChromeClientQt::setToolTip(const String &tip, TextDirection)
         view->setToolTip(QString());
         QToolTip::hideText();
     } else {
-        QString dtip = QLatin1String("<p>") + escapeHtml(tip) + QLatin1String("</p>");
+        QString dtip = QLatin1String("<p>") + QString(tip).toHtmlEscaped() + QLatin1String("</p>");
         view->setToolTip(dtip);
     }
 #else
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index a2c3cb210..bcd1a18ec 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -372,6 +372,20 @@ void FrameLoaderClientQt::dispatchWillPerformClientRedirect(const KURL& url, dou
     notImplemented();
 }
 
+void FrameLoaderClientQt::dispatchDidNavigateWithinPage()
+{
+    if (!m_webFrame)
+        return;
+
+    FrameLoader* loader = m_frame->loader();
+    bool loaderCompleted = !(loader->activeDocumentLoader() && loader->activeDocumentLoader()->isLoadingInAPISense());
+
+    if (!loaderCompleted)
+        return;
+
+    dispatchDidCommitLoad();
+    dispatchDidFinishLoad();
+}
 
 void FrameLoaderClientQt::dispatchDidChangeLocationWithinPage()
 {
@@ -391,7 +405,7 @@ void FrameLoaderClientQt::dispatchDidPushStateWithinPage()
     if (dumpFrameLoaderCallbacks)
         printf("%s - dispatchDidPushStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    notImplemented();
+    dispatchDidNavigateWithinPage();
 }
 
 void FrameLoaderClientQt::dispatchDidReplaceStateWithinPage()
@@ -399,7 +413,7 @@ void FrameLoaderClientQt::dispatchDidReplaceStateWithinPage()
     if (dumpFrameLoaderCallbacks)
         printf("%s - dispatchDidReplaceStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    notImplemented();
+    dispatchDidNavigateWithinPage();
 }
 
 void FrameLoaderClientQt::dispatchDidPopStateWithinPage()
@@ -407,7 +421,7 @@ void FrameLoaderClientQt::dispatchDidPopStateWithinPage()
     if (dumpFrameLoaderCallbacks)
         printf("%s - dispatchDidPopStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    notImplemented();
+    // No need to call dispatchDidNavigateWithinPage here, it's already been done in loadInSameDocument().
 }
 
 void FrameLoaderClientQt::dispatchWillClose()
@@ -1604,22 +1618,13 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
         Vector<String> params = paramNames;
         Vector<String> values = paramValues;
         if (mimeType == "application/x-shockwave-flash") {
-#if HAVE(QT5)
-            const bool shouldInjectWmode = true;
-#else
             // Inject wmode=opaque when there is no client or the client is not a QWebView.
-            QWebPageClient* client = m_webFrame->page()->d->client.get();
-            const bool shouldInjectWmode = !(client && qobject_cast<QWidget*>(client->pluginParent()));
-#endif
-            if (shouldInjectWmode) {
-                // Inject wmode=opaque when there is no client or the client is not a QWebView.
-                size_t wmodeIndex = params.find("wmode");
-                if (wmodeIndex == WTF::notFound) {
-                    params.append("wmode");
-                    values.append("opaque");
-                } else if (equalIgnoringCase(values[wmodeIndex], "window"))
-                    values[wmodeIndex] = "opaque";
-            }
+            size_t wmodeIndex = params.find("wmode");
+            if (wmodeIndex == WTF::notFound) {
+                params.append("wmode");
+                values.append("opaque");
+            } else if (equalIgnoringCase(values[wmodeIndex], "window"))
+                values[wmodeIndex] = "opaque";
         }
 
         RefPtr<PluginView> pluginView = PluginView::create(m_frame, pluginSize, element, url,
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index 781971d15..8d1c770c8 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -108,6 +108,7 @@ public:
     virtual void dispatchDidReceiveServerRedirectForProvisionalLoad();
     virtual void dispatchDidCancelClientRedirect();
     virtual void dispatchWillPerformClientRedirect(const KURL&, double interval, double fireDate);
+    virtual void dispatchDidNavigateWithinPage() OVERRIDE;
     virtual void dispatchDidChangeLocationWithinPage();
     virtual void dispatchDidPushStateWithinPage();
     virtual void dispatchDidReplaceStateWithinPage();
diff --git a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp
index 20ba353bd..b6b4d70bd 100644
--- a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp
@@ -38,11 +38,7 @@
 #include "qwebpage.h"
 #include "qwebpage_p.h"
 
-#if !HAVE(QT5)
-#include <QGeoPositionInfoSource>
-#elif HAVE(QT5)
 #include <QtLocation/QGeoPositionInfoSource>
-#endif
 
 namespace WebCore {
 
diff --git a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h
index 726be157a..2e94bdebc 100644
--- a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h
@@ -31,18 +31,10 @@
 #include <QObject>
 #include <wtf/RefPtr.h>
 
-#if !HAVE(QT5)
-#include <QGeoPositionInfo>
-namespace QtMobility {
-class QGeoPositionInfoSource;
-};
-using namespace QtMobility;
-#elif HAVE(QT5)
 #include <QtLocation/QGeoPositionInfo>
 QT_BEGIN_NAMESPACE
 class QGeoPositionInfoSource;
 QT_END_NAMESPACE
-#endif
 
 
 class QWebPage;
diff --git a/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
index 990179906..0093187af 100644
--- a/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
@@ -33,9 +33,7 @@
 #endif
 
 #if USE(3D_GRAPHICS)
-#if HAVE(QT5)
 #include <QWindow>
-#endif
 
 static void createPlatformGraphicsContext3DFromWidget(QWidget* widget, PlatformGraphicsContext3D* context,
                                                       PlatformGraphicsSurface3D* surface)
@@ -54,13 +52,8 @@ static void createPlatformGraphicsContext3DFromWidget(QWidget* widget, PlatformG
     if (glWidget->isValid()) {
         // Geometry can be set to zero because m_glWidget is used only for its QGLContext.
         glWidget->setGeometry(0, 0, 0, 0);
-#if HAVE(QT5)
         *surface = glWidget->windowHandle();
         *context = glWidget->context()->contextHandle();
-#else
-        *surface = glWidget;
-        *context = const_cast<QGLContext*>(glWidget->context());
-#endif
     } else {
         delete glWidget;
         glWidget = 0;
@@ -74,7 +67,6 @@ static void createPlatformGraphicsContext3DFromWidget(QWidget* widget, PlatformG
 #include "texmap/TextureMapperLayer.h"
 #endif
 
-#if HAVE(QT5)
 QWindow* QWebPageClient::ownerWindow() const
 {
     QWidget* widget = ownerWidget();
@@ -86,7 +78,6 @@ QWindow* QWebPageClient::ownerWindow() const
         return nativeParent->windowHandle();
     return 0;
 }
-#endif
 
 namespace WebCore {
 
diff --git a/Source/WebKit/qt/WebCoreSupport/WebEventConversion.cpp b/Source/WebKit/qt/WebCoreSupport/WebEventConversion.cpp
index 0b732a4ce..222676620 100644
--- a/Source/WebKit/qt/WebCoreSupport/WebEventConversion.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/WebEventConversion.cpp
@@ -243,11 +243,9 @@ WebKitPlatformTouchEvent::WebKitPlatformTouchEvent(QTouchEvent* event)
     case QEvent::TouchEnd:
         m_type = PlatformEvent::TouchEnd;
         break;
-#if HAVE(QT5)
     case QEvent::TouchCancel:
         m_type = PlatformEvent::TouchCancel;
         break;
-#endif
     }
 
     const QList<QTouchEvent::TouchPoint>& points = event->touchPoints();
diff --git a/Source/WebKit/qt/declarative/declarative.pro b/Source/WebKit/qt/declarative/declarative.pro
index 737928338..04f2298d0 100644
--- a/Source/WebKit/qt/declarative/declarative.pro
+++ b/Source/WebKit/qt/declarative/declarative.pro
@@ -11,7 +11,7 @@ public_api.file = public.pri
 public_api.makefile = Makefile.declarative.public
 SUBDIRS += public_api
 
-haveQt(5):!no_webkit2 {
+!no_webkit2 {
     experimental_api.file = experimental/experimental.pri
     experimental_api.makefile = Makefile.declarative.experimental
     SUBDIRS += experimental_api
diff --git a/Source/WebKit/qt/declarative/plugin.cpp b/Source/WebKit/qt/declarative/plugin.cpp
index 1d44be23f..db748952a 100644
--- a/Source/WebKit/qt/declarative/plugin.cpp
+++ b/Source/WebKit/qt/declarative/plugin.cpp
@@ -25,13 +25,8 @@
 #include "qdeclarativewebview_p.h"
 #endif
 
-#if (HAVE(QT5))
 #include <QtQml/qqml.h>
 #include <QtQml/qqmlextensionplugin.h>
-#else
-#include <QtDeclarative/qdeclarative.h>
-#include <QtDeclarative/qdeclarativeextensionplugin.h>
-#endif
 
 #if defined(HAVE_WEBKIT2)
 #include "private/qquickwebpage_p.h"
@@ -46,12 +41,8 @@
 
 QT_BEGIN_NAMESPACE
 
-#if QT_VERSION >= 0x050000
 class WebKitQmlPlugin : public QQmlExtensionPlugin {
     Q_PLUGIN_METADATA(IID "org.qt-project.Qt.QQmlExtensionInterface" FILE "plugin.json")
-#else
-class WebKitQmlPlugin : public QDeclarativeExtensionPlugin {
-#endif
     Q_OBJECT
 public:
 #if defined(HAVE_WEBKIT2)
@@ -88,7 +79,3 @@ public:
 QT_END_NAMESPACE
 
 #include "plugin.moc"
-
-#if QT_VERSION < 0x050000
-Q_EXPORT_PLUGIN2(qmlwebkitplugin, QT_PREPEND_NAMESPACE(WebKitQmlPlugin));
-#endif
diff --git a/Source/WebKit/qt/declarative/public.pri b/Source/WebKit/qt/declarative/public.pri
index 34c66399f..e5c43db06 100644
--- a/Source/WebKit/qt/declarative/public.pri
+++ b/Source/WebKit/qt/declarative/public.pri
@@ -24,9 +24,7 @@ contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
 
 wince*:LIBS += $$QMAKE_LIBS_GUI
 
-QT += webkit webkit-private
-haveQt(4): QT += declarative
-haveQt(5): QT += widgets quick quick-private
+QT += webkit webkit-private widgets quick quick-private
 
 contains(DEFINES, HAVE_QQUICK1=1) {
     SOURCES += qdeclarativewebview.cpp
diff --git a/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp b/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp
index fdd990f57..c71751177 100644
--- a/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp
+++ b/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp
@@ -314,7 +314,3 @@ QObject* WebPlugin::createExtension(Extension extension) const
         return 0;
     }
 }
-
-#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
-Q_EXPORT_PLUGIN2(platformplugin, WebPlugin)
-#endif
diff --git a/Source/WebKit/qt/examples/platformplugin/WebPlugin.h b/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
index de06f4a84..446d0f754 100644
--- a/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
+++ b/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
@@ -139,9 +139,7 @@ class WebPlugin : public QObject, public QWebKitPlatformPlugin
 {
     Q_OBJECT
     Q_INTERFACES(QWebKitPlatformPlugin)
-#if QT_VERSION >= 0x050000
     Q_PLUGIN_METADATA(IID "org.qt-project.QtWebKit.PlatformPluginInterface")
-#endif
 public:
     virtual bool supportsExtension(Extension extension) const;
     virtual QObject* createExtension(Extension extension) const;
diff --git a/Source/WebKit/qt/examples/platformplugin/platformplugin.pro b/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
index b5da71ca0..fc533d3bb 100644
--- a/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
+++ b/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
@@ -1,8 +1,7 @@
 TEMPLATE = lib
 TARGET = platformplugin
 
-QT += core gui
-haveQt(5): QT += widgets
+QT += core gui widgets
 CONFIG += plugin
 
 ## load mobilityconfig if mobility is available
diff --git a/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp b/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
index 291f9b294..45626d9ef 100644
--- a/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
+++ b/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
@@ -37,12 +37,6 @@ Q_DECLARE_METATYPE(Qt::BrushStyle)
 Q_DECLARE_METATYPE(QVariantList)
 Q_DECLARE_METATYPE(QVariantMap)
 
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
-#define OwnershipClass QWebFrame
-#else
-#define OwnershipClass QScriptEngine
-#endif
-
 class MyQObject : public QObject {
     Q_OBJECT
 
@@ -448,10 +442,6 @@ public:
     {
         emit mySignalWithDateTimeArg(dt);
     }
-    void emitMySignalWithRegexArg(QRegExp r)
-    {
-        emit mySignalWithRegexArg(r);
-    }
 
 public Q_SLOTS:
     void mySlot()
@@ -548,12 +538,6 @@ public Q_SLOTS:
         m_actuals << arg;
     }
 
-    void myOverloadedSlot(const QRegExp &arg)
-    {
-        m_qtFunctionInvoked = 34;
-        m_actuals << arg;
-    }
-
     void myOverloadedSlot(const QVariant &arg)
     {
         m_qtFunctionInvoked = 35;
@@ -581,7 +565,6 @@ Q_SIGNALS:
     void mySignalWithDoubleArg(double);
     void mySignal2(bool arg = false);
     void mySignalWithDateTimeArg(QDateTime);
-    void mySignalWithRegexArg(QRegExp);
 
 private:
     int m_intValue;
@@ -658,6 +641,7 @@ private slots:
     void qObjectWrapperWithSameIdentity();
     void introspectQtMethods_data();
     void introspectQtMethods();
+    void scriptablePlugin();
 
 private:
     QString evalJS(const QString& s)
@@ -1147,7 +1131,7 @@ void tst_QObjectBridge::callQtInvokable()
         QString type;
         QString ret = evalJS("myObject.myInvokableWithVoidStarArg(123)", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: incompatible type of argument(s) in call to myInvokableWithVoidStarArg(); candidates were\n    myInvokableWithVoidStarArg(void*)"));
+        QCOMPARE(ret, QLatin1String("Error: incompatible type of argument(s) in call to myInvokableWithVoidStarArg(); candidates were\n    myInvokableWithVoidStarArg(void*)"));
         QCOMPARE(m_myObject->qtFunctionInvoked(), -1);
     }
 
@@ -1156,7 +1140,7 @@ void tst_QObjectBridge::callQtInvokable()
         QString type;
         QString ret = evalJS("myObject.myInvokableWithAmbiguousArg(123)", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: ambiguous call of overloaded function myInvokableWithAmbiguousArg(); candidates were\n    myInvokableWithAmbiguousArg(int)\n    myInvokableWithAmbiguousArg(uint)"));
+        QCOMPARE(ret, QLatin1String("Error: ambiguous call of overloaded function myInvokableWithAmbiguousArg(); candidates were\n    myInvokableWithAmbiguousArg(int)\n    myInvokableWithAmbiguousArg(uint)"));
     }
 
     m_myObject->resetQtFunctionInvoked();
@@ -1385,7 +1369,7 @@ void tst_QObjectBridge::callQtInvokable()
         QString type;
         QString ret = evalJS("myObject.myInvokableWithIntArg()", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("SyntaxError: too few arguments in call to myInvokableWithIntArg(); candidates are\n    myInvokableWithIntArg(int,int)\n    myInvokableWithIntArg(int)"));
+        QCOMPARE(ret, QLatin1String("Error: too few arguments in call to myInvokableWithIntArg(); candidates are\n    myInvokableWithIntArg(int,int)\n    myInvokableWithIntArg(int)"));
     }
 
     // call function where not all types have been registered
@@ -1394,7 +1378,7 @@ void tst_QObjectBridge::callQtInvokable()
         QString type;
         QString ret = evalJS("myObject.myInvokableWithBrushStyleArg(0)", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: cannot call myInvokableWithBrushStyleArg(): unknown type `Qt::BrushStyle'"));
+        QCOMPARE(ret, QLatin1String("Error: cannot call myInvokableWithBrushStyleArg(): unknown type `Qt::BrushStyle'"));
         QCOMPARE(m_myObject->qtFunctionInvoked(), -1);
     }
 
@@ -1404,7 +1388,7 @@ void tst_QObjectBridge::callQtInvokable()
         QString type;
         QString ret = evalJS("myObject.myInvokableWithQBrushArg(null)", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: incompatible type of argument(s) in call to myInvokableWithQBrushArg(); candidates were\n    myInvokableWithQBrushArg(QBrush)"));
+        QCOMPARE(ret, QLatin1String("Error: incompatible type of argument(s) in call to myInvokableWithQBrushArg(); candidates were\n    myInvokableWithQBrushArg(QBrush)"));
         QCOMPARE(m_myObject->qtFunctionInvoked(), -1);
     }
 }
@@ -1422,7 +1406,7 @@ void tst_QObjectBridge::connectAndDisconnect()
         QCOMPARE(type, sError);
     }
 
-    evalJS("myHandler = function() { window.gotSignal = true; window.signalArgs = arguments; window.slotThisObject = this; window.signalSender = __qt_sender__; }");
+    evalJS("myHandler = function() { window.gotSignal = true; window.signalArgs = arguments; window.slotThisObject = this; }");
 
     QCOMPARE(evalJS("myObject.mySignal.connect(myHandler)"), sUndefined);
 
@@ -1430,7 +1414,6 @@ void tst_QObjectBridge::connectAndDisconnect()
     evalJS("myObject.mySignal()");
     QCOMPARE(evalJS("gotSignal"), sTrue);
     QCOMPARE(evalJS("signalArgs.length == 0"), sTrue);
-    QCOMPARE(evalJS("signalSender"), evalJS("myObject"));
     QCOMPARE(evalJS("slotThisObject == window"), sTrue);
 
     evalJS("gotSignal = false");
@@ -1494,7 +1477,6 @@ void tst_QObjectBridge::connectAndDisconnect()
     QCOMPARE(evalJS("gotSignal"), sTrue);
     QCOMPARE(evalJS("signalArgs.length == 0"), sTrue);
     QCOMPARE(evalJS("slotThisObject"), evalJS("otherObject"));
-    QCOMPARE(evalJS("signalSender"), evalJS("myObject"));
     QCOMPARE(evalJS("slotThisObject.name"), QLatin1String("foo"));
     QCOMPARE(evalJS("myObject.mySignal.disconnect(otherObject, myHandler)"), sUndefined);
 
@@ -1505,7 +1487,6 @@ void tst_QObjectBridge::connectAndDisconnect()
     QCOMPARE(evalJS("gotSignal"), sTrue);
     QCOMPARE(evalJS("signalArgs.length == 1"), sTrue);
     QCOMPARE(evalJS("slotThisObject == yetAnotherObject"), sTrue);
-    QCOMPARE(evalJS("signalSender == myObject"), sTrue);
     QCOMPARE(evalJS("slotThisObject.name"), QLatin1String("bar"));
     QCOMPARE(evalJS("myObject.mySignal2.disconnect(yetAnotherObject, myHandler)"), sUndefined);
 
@@ -1515,7 +1496,6 @@ void tst_QObjectBridge::connectAndDisconnect()
     QCOMPARE(evalJS("gotSignal"), sTrue);
     QCOMPARE(evalJS("signalArgs.length == 1"), sTrue);
     QCOMPARE(evalJS("slotThisObject == myObject"), sTrue);
-    QCOMPARE(evalJS("signalSender == myObject"), sTrue);
     QCOMPARE(evalJS("myObject.mySignal2.disconnect(myObject, myHandler)"), sUndefined);
 
     // connect(obj, string)
@@ -1756,11 +1736,6 @@ void tst_QObjectBridge::overloadedSlots()
     evalJS("myObject.myOverloadedSlot(new Date())");
     QCOMPARE(m_myObject->qtFunctionInvoked(), 32);
 
-    // should pick myOverloadedSlot(QRegExp)
-    m_myObject->resetQtFunctionInvoked();
-    evalJS("myObject.myOverloadedSlot(new RegExp())");
-    QCOMPARE(m_myObject->qtFunctionInvoked(), 34);
-
     // should pick myOverloadedSlot(QVariant)
     /* XFAIL
     m_myObject->resetQtFunctionInvoked();
@@ -1831,9 +1806,7 @@ void tst_QObjectBridge::enumerate_data()
         << "dp1" << "dp2" << "dp3"
         // inherited signals and slots
         << "destroyed(QObject*)" << "destroyed()"
-#if defined(HAVE_QT5) && HAVE_QT5
         << "objectNameChanged(QString)"
-#endif
         << "deleteLater()"
         // not included because it's private:
         // << "_q_reregisterTimers(void*)"
@@ -1982,8 +1955,6 @@ void tst_QObjectBridge::typeConversion()
     QCOMPARE(evalJS("window.__date_equals"), sTrue);
     evalJS("delete window.__date_equals");
     evalJS("myObject.mySignalWithDateTimeArg.disconnect(checkDate); delete checkDate;");
-
-    // ### RegExps
 }
 
 class StringListTestObject : public QObject {
@@ -2000,7 +1971,7 @@ void tst_QObjectBridge::arrayObjectEnumerable()
     QWebPage page;
     QWebFrame* frame = page.mainFrame();
     QObject* qobject = new StringListTestObject();
-    frame->addToJavaScriptWindowObject("test", qobject, OwnershipClass::ScriptOwnership);
+    frame->addToJavaScriptWindowObject("test", qobject, QWebFrame::ScriptOwnership);
 
     const QString script("var stringArray = test.stringList();"
                          "var result = '';"
@@ -2041,7 +2012,7 @@ void tst_QObjectBridge::ownership()
         {
             QWebPage page;
             QWebFrame* frame = page.mainFrame();
-            frame->addToJavaScriptWindowObject("test", ptr.data(), OwnershipClass::ScriptOwnership);
+            frame->addToJavaScriptWindowObject("test", ptr.data(), QWebFrame::ScriptOwnership);
         }
         QVERIFY(!ptr);
     }
@@ -2052,7 +2023,7 @@ void tst_QObjectBridge::ownership()
         {
             QWebPage page;
             QWebFrame* frame = page.mainFrame();
-            frame->addToJavaScriptWindowObject("test", ptr.data(), OwnershipClass::QtOwnership);
+            frame->addToJavaScriptWindowObject("test", ptr.data(), QWebFrame::QtOwnership);
         }
         QVERIFY(ptr.data() == before);
         delete ptr.data();
@@ -2062,7 +2033,7 @@ void tst_QObjectBridge::ownership()
         QObject* child = new QObject(parent);
         QWebPage page;
         QWebFrame* frame = page.mainFrame();
-        frame->addToJavaScriptWindowObject("test", child, OwnershipClass::QtOwnership);
+        frame->addToJavaScriptWindowObject("test", child, QWebFrame::QtOwnership);
         QVariant v = frame->evaluateJavaScript("test");
         QCOMPARE(qvariant_cast<QObject*>(v), child);
         delete parent;
@@ -2075,7 +2046,7 @@ void tst_QObjectBridge::ownership()
         {
             QWebPage page;
             QWebFrame* frame = page.mainFrame();
-            frame->addToJavaScriptWindowObject("test", ptr.data(), OwnershipClass::AutoOwnership);
+            frame->addToJavaScriptWindowObject("test", ptr.data(), QWebFrame::AutoOwnership);
         }
         // no parent, so it should be like ScriptOwnership
         QVERIFY(!ptr);
@@ -2087,7 +2058,7 @@ void tst_QObjectBridge::ownership()
         {
             QWebPage page;
             QWebFrame* frame = page.mainFrame();
-            frame->addToJavaScriptWindowObject("test", child.data(), OwnershipClass::AutoOwnership);
+            frame->addToJavaScriptWindowObject("test", child.data(), QWebFrame::AutoOwnership);
         }
         // has parent, so it should be like QtOwnership
         QVERIFY(child);
@@ -2129,7 +2100,7 @@ void tst_QObjectBridge::qObjectWrapperWithSameIdentity()
     QWebFrame* mainFrame = m_view->page()->mainFrame();
     QCOMPARE(mainFrame->toPlainText(), QString("test"));
 
-    mainFrame->addToJavaScriptWindowObject("test", new TestFactory, OwnershipClass::ScriptOwnership);
+    mainFrame->addToJavaScriptWindowObject("test", new TestFactory, QWebFrame::ScriptOwnership);
 
     mainFrame->evaluateJavaScript("triggerBug();");
     QCOMPARE(mainFrame->toPlainText(), QString("test1"));
@@ -2189,5 +2160,47 @@ void tst_QObjectBridge::webElementSlotOnly()
     QCOMPARE(evalJS("myWebElementSlotObject.tagName"), QString("BODY"));
 }
 
+class TestPluginWidget : public QWidget {
+    Q_OBJECT
+public:
+    TestPluginWidget() { }
+
+public slots:
+    int slotWithReturnValue() { return 42; }
+};
+
+class TestWebPage : public QWebPage {
+    Q_OBJECT
+public:
+    TestWebPage(QObject* parent = 0)
+        : QWebPage(parent)
+        , creationCount(0)
+    { }
+
+    int creationCount;
+
+protected:
+    virtual QObject* createPlugin(const QString&, const QUrl&, const QStringList&, const QStringList&)
+    {
+        creationCount++;
+        return new TestPluginWidget;
+    }
+};
+
+void tst_QObjectBridge::scriptablePlugin()
+{
+    QWebView view;
+    TestWebPage* page = new TestWebPage;
+    view.setPage(page);
+    page->setParent(&view);
+    view.settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+
+    page->mainFrame()->setHtml("<object width=100 height=100 type=\"application/x-qt-plugin\"></object>");
+    QCOMPARE(page->creationCount, 1);
+
+    QVariant result = page->mainFrame()->evaluateJavaScript("document.querySelector(\"object\").slotWithReturnValue()");
+    QCOMPARE(result.toString(), QLatin1String("42"));
+}
+
 QTEST_MAIN(tst_QObjectBridge)
 #include "tst_qobjectbridge.moc"
diff --git a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 31d87b75a..d7db84726 100644
--- a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -90,6 +90,7 @@ private slots:
     void setUrlToEmpty();
     void setUrlToInvalid();
     void setUrlHistory();
+    void setUrlUsingStateObject();
     void setUrlSameUrl();
     void setUrlThenLoads_data();
     void setUrlThenLoads();
@@ -1309,6 +1310,48 @@ void tst_QWebFrame::setUrlHistory()
     QCOMPARE(m_page->history()->count(), 2);
 }
 
+void tst_QWebFrame::setUrlUsingStateObject()
+{
+    const QUrl aboutBlank("about:blank");
+    QUrl url;
+    QWebFrame* frame = m_page->mainFrame();
+    QSignalSpy urlChangedSpy(frame, SIGNAL(urlChanged(QUrl)));
+    int expectedUrlChangeCount = 0;
+
+    QCOMPARE(m_page->history()->count(), 0);
+
+    url = QUrl("qrc:/test1.html");
+    frame->setUrl(url);
+    waitForSignal(m_page, SIGNAL(loadFinished(bool)));
+    expectedUrlChangeCount++;
+    QCOMPARE(urlChangedSpy.count(), expectedUrlChangeCount);
+    QCOMPARE(frame->url(), url);
+    QCOMPARE(m_page->history()->count(), 1);
+
+    frame->evaluateJavaScript("window.history.pushState(null,'push', 'navigate/to/here')");
+    expectedUrlChangeCount++;
+    QCOMPARE(urlChangedSpy.count(), expectedUrlChangeCount);
+    QCOMPARE(frame->url(), QUrl("qrc:/navigate/to/here"));
+    QCOMPARE(m_page->history()->count(), 2);
+    QVERIFY(m_page->history()->canGoBack());
+
+    frame->evaluateJavaScript("window.history.replaceState(null,'replace', 'another/location')");
+    expectedUrlChangeCount++;
+    QCOMPARE(urlChangedSpy.count(), expectedUrlChangeCount);
+    QCOMPARE(frame->url(), QUrl("qrc:/navigate/to/another/location"));
+    QCOMPARE(m_page->history()->count(), 2);
+    QVERIFY(!m_page->history()->canGoForward());
+    QVERIFY(m_page->history()->canGoBack());
+
+    frame->evaluateJavaScript("window.history.back()");
+    QTest::qWait(100);
+    expectedUrlChangeCount++;
+    QCOMPARE(urlChangedSpy.count(), expectedUrlChangeCount);
+    QCOMPARE(frame->url(), QUrl("qrc:/test1.html"));
+    QVERIFY(m_page->history()->canGoForward());
+    QVERIFY(!m_page->history()->canGoBack());
+}
+
 void tst_QWebFrame::setUrlSameUrl()
 {
     const QUrl url1("qrc:/test1.html");
diff --git a/Source/WebKit/qt/tests/tests.pri b/Source/WebKit/qt/tests/tests.pri
index 90c61f093..5437baacc 100644
--- a/Source/WebKit/qt/tests/tests.pri
+++ b/Source/WebKit/qt/tests/tests.pri
@@ -16,10 +16,7 @@ INCLUDEPATH += \
     $$PWD \
     $$PWD/../Api
 
-QT += testlib network webkit
-haveQt(5): QT += widgets
-
-haveQt(4): haveQtModule(declarative): QT += declarative
+QT += testlib network webkit widgets
 
 # This define is used by some tests to look up resources in the source tree
 DEFINES += TESTS_SOURCE_DIR=\\\"$$PWD/\\\"
diff --git a/Source/WebKit/qt/tests/util.h b/Source/WebKit/qt/tests/util.h
index cfa22eb08..2869440cb 100644
--- a/Source/WebKit/qt/tests/util.h
+++ b/Source/WebKit/qt/tests/util.h
@@ -53,37 +53,4 @@ static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
     return timeoutSpy.isEmpty();
 }
 
-#if !(defined(HAVE_QT5) && HAVE_QT5)
-// Will try to wait for the condition while allowing event processing
-#define QTRY_VERIFY(__expr) \
-    do { \
-        const int __step = 50; \
-        const int __timeout = 5000; \
-        if (!(__expr)) { \
-            QTest::qWait(0); \
-        } \
-        for (int __i = 0; __i < __timeout && !(__expr); __i+=__step) { \
-            QTest::qWait(__step); \
-        } \
-        QVERIFY(__expr); \
-    } while(0)
-
-// Will try to wait for the condition while allowing event processing
-#define QTRY_COMPARE(__expr, __expected) \
-    do { \
-        const int __step = 50; \
-        const int __timeout = 5000; \
-        if ((__expr) != (__expected)) { \
-            QTest::qWait(0); \
-        } \
-        for (int __i = 0; __i < __timeout && ((__expr) != (__expected)); __i+=__step) { \
-            QTest::qWait(__step); \
-        } \
-        QCOMPARE(__expr, __expected); \
-    } while(0)
-
-// Compatibility for Qt5
-#define W_QSKIP(a, b) QSKIP(a, b)
-#else
 #define W_QSKIP(a, b) QSKIP(a)
-#endif
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index 86942ca6a..d13a3fc1c 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,18 @@
+2012-08-05  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Use sizeof() for cbWndExtra values
+        https://bugs.webkit.org/show_bug.cgi?id=93179
+
+        Reviewed by Eric Carlson.
+
+        Using sizof() instead of hardcoding the pointer size of
+        the 32bit platform allows us to use the code on 64bit too.
+
+        * FullscreenVideoController.cpp:
+        (FullscreenVideoController::registerHUDWindowClass):
+        * WebView.cpp:
+        (WebView::registerWebViewWindowClass):
+
 2012-07-26  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
 
         [Mac] Fix build break on Apple win bot after r123711
diff --git a/Source/WebKit/win/FullscreenVideoController.cpp b/Source/WebKit/win/FullscreenVideoController.cpp
index 203e229e3..f9dd6fcd3 100644
--- a/Source/WebKit/win/FullscreenVideoController.cpp
+++ b/Source/WebKit/win/FullscreenVideoController.cpp
@@ -422,7 +422,7 @@ void FullscreenVideoController::registerHUDWindowClass()
     wcex.style = CS_HREDRAW | CS_VREDRAW;
     wcex.lpfnWndProc = hudWndProc;
     wcex.cbClsExtra = 0;
-    wcex.cbWndExtra = 4;
+    wcex.cbWndExtra = sizeof(FullscreenVideoController*);
     wcex.hInstance = gInstance;
     wcex.hIcon = 0;
     wcex.hCursor = LoadCursor(0, IDC_ARROW);
diff --git a/Source/WebKit/win/WebView.cpp b/Source/WebKit/win/WebView.cpp
index ececdff22..70d491edb 100644
--- a/Source/WebKit/win/WebView.cpp
+++ b/Source/WebKit/win/WebView.cpp
@@ -2105,7 +2105,7 @@ bool WebView::registerWebViewWindowClass()
     wcex.style          = CS_DBLCLKS;
     wcex.lpfnWndProc    = WebViewWndProc;
     wcex.cbClsExtra     = 0;
-    wcex.cbWndExtra     = 4; // 4 bytes for the IWebView pointer
+    wcex.cbWndExtra     = sizeof(WebView*);
     wcex.hInstance      = gInstance;
     wcex.hIcon          = 0;
     wcex.hCursor        = ::LoadCursor(0, IDC_ARROW);
diff --git a/Source/WebKit2/CMakeLists.txt b/Source/WebKit2/CMakeLists.txt
index 104956641..06440b234 100644
--- a/Source/WebKit2/CMakeLists.txt
+++ b/Source/WebKit2/CMakeLists.txt
@@ -15,6 +15,7 @@ SET(WebKit2_INCLUDE_DIRECTORIES
     "${WEBKIT2_DIR}/UIProcess/API/C"
     "${WEBKIT2_DIR}/UIProcess/API/cpp"
     "${WEBKIT2_DIR}/UIProcess/Authentication"
+    "${WEBKIT2_DIR}/UIProcess/CoordinatedGraphics"
     "${WEBKIT2_DIR}/UIProcess/Downloads"
     "${WEBKIT2_DIR}/UIProcess/Launcher"
     "${WEBKIT2_DIR}/UIProcess/Notifications"
@@ -42,6 +43,7 @@ SET(WebKit2_INCLUDE_DIRECTORIES
     "${WEBKIT2_DIR}/WebProcess/Plugins/Netscape"
     "${WEBKIT2_DIR}/WebProcess/WebCoreSupport"
     "${WEBKIT2_DIR}/WebProcess/WebPage"
+    "${WEBKIT2_DIR}/WebProcess/WebPage/CoordinatedGraphics"
     "${WEBCORE_DIR}"
     "${WEBCORE_DIR}/Modules/battery"
     "${WEBCORE_DIR}/Modules/intents"
@@ -71,6 +73,8 @@ SET(WebKit2_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/graphics/filters"
     "${WEBCORE_DIR}/platform/graphics/harfbuzz"
     "${WEBCORE_DIR}/platform/graphics/harfbuzz/ng"
+    "${WEBCORE_DIR}/platform/graphics/surfaces"
+    "${WEBCORE_DIR}/platform/graphics/texmap"
     "${WEBCORE_DIR}/platform/graphics/transforms"
     "${WEBCORE_DIR}/platform/network"
     "${WEBCORE_DIR}/platform/sql"
@@ -98,7 +102,6 @@ SET(WebKit2_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/runtime"
     "${WTF_DIR}"
     "${DERIVED_SOURCES_DIR}"
-    "${DERIVED_SOURCES_DIR}/ForwardingHeaders"
     "${DERIVED_SOURCES_WEBCORE_DIR}"
     "${DERIVED_SOURCES_WEBKIT2_DIR}"
     "${DERIVED_SOURCES_WEBKIT2_DIR}/include"
@@ -142,7 +145,9 @@ SET(WebKit2_SOURCES
     Shared/SecurityOriginData.cpp
     Shared/SessionState.cpp
     Shared/ShareableBitmap.cpp
+    Shared/ShareableSurface.cpp
     Shared/StatisticsData.cpp
+    Shared/SurfaceUpdateInfo.cpp
     Shared/UpdateInfo.cpp
     Shared/VisitedLinkTable.cpp
     Shared/WebBackForwardListItem.cpp
@@ -160,7 +165,6 @@ SET(WebKit2_SOURCES
     Shared/WebGraphicsContext.cpp
     Shared/WebHitTestResult.cpp
     Shared/WebImage.cpp
-    Shared/WebIntentData.cpp
     Shared/WebIntentServiceInfo.cpp
     Shared/WebKeyboardEvent.cpp
     Shared/WebLayerTreeInfo.cpp
@@ -222,7 +226,7 @@ SET(WebKit2_SOURCES
     UIProcess/FindIndicator.cpp
     UIProcess/GeolocationPermissionRequestManagerProxy.cpp
     UIProcess/GeolocationPermissionRequestProxy.cpp
-    UIProcess/LayerTreeCoordinatorProxy.cpp
+
     UIProcess/ResponsivenessTimer.cpp
     UIProcess/VisitedLinkProvider.cpp
     UIProcess/WebApplicationCacheManagerProxy.cpp
@@ -254,8 +258,9 @@ SET(WebKit2_SOURCES
     UIProcess/WebIconDatabase.cpp
     UIProcess/WebIconDatabaseClient.cpp
     UIProcess/WebInspectorProxy.cpp
+    UIProcess/WebIntentData.cpp
     UIProcess/WebKeyValueStorageManagerProxy.cpp
-    UIProcess/WebLayerTreeRenderer.cpp
+
     UIProcess/WebLoaderClient.cpp
     UIProcess/WebMediaCacheManagerProxy.cpp
     UIProcess/WebNavigationData.cpp
@@ -324,6 +329,10 @@ SET(WebKit2_SOURCES
     UIProcess/Authentication/WebCredential.cpp
     UIProcess/Authentication/WebProtectionSpace.cpp
 
+    UIProcess/CoordinatedGraphics/CoordinatedBackingStore.cpp
+    UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp
+    UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp
+    
     UIProcess/Downloads/DownloadProxy.cpp
 
     UIProcess/InspectorServer/WebInspectorServer.cpp
@@ -331,7 +340,6 @@ SET(WebKit2_SOURCES
     UIProcess/InspectorServer/WebSocketServerConnection.cpp
 
     UIProcess/Launcher/ProcessLauncher.cpp
-    UIProcess/Launcher/ThreadLauncher.cpp
 
     UIProcess/Notifications/NotificationPermissionRequest.cpp
     UIProcess/Notifications/NotificationPermissionRequestManagerProxy.cpp
@@ -455,11 +463,11 @@ SET(WebKit2_SOURCES
     WebProcess/WebPage/EncoderAdapter.cpp
     WebProcess/WebPage/EventDispatcher.cpp
     WebProcess/WebPage/FindController.cpp
-    WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.cpp
+
     WebProcess/WebPage/LayerTreeHost.cpp
     WebProcess/WebPage/PageOverlay.cpp
     WebProcess/WebPage/TapHighlightController.cpp
-    WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp
+    WebProcess/WebPage/UpdateAtlas.cpp
     WebProcess/WebPage/WebBackForwardListProxy.cpp
     WebProcess/WebPage/WebContextMenu.cpp
     WebProcess/WebPage/WebFrame.cpp
@@ -468,6 +476,10 @@ SET(WebKit2_SOURCES
     WebProcess/WebPage/WebPage.cpp
     WebProcess/WebPage/WebPageGroupProxy.cpp
     WebProcess/WebPage/WebUndoStep.cpp
+
+    WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp
+    WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp
+    WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp
 )
 
 SET(WebKit2_MESSAGES_IN_FILES
@@ -478,7 +490,6 @@ SET(WebKit2_MESSAGES_IN_FILES
     Shared/Plugins/NPObjectMessageReceiver.messages.in
 
     UIProcess/DrawingAreaProxy.messages.in
-    UIProcess/LayerTreeCoordinatorProxy.messages.in
     UIProcess/WebApplicationCacheManagerProxy.messages.in
     UIProcess/WebBatteryManagerProxy.messages.in
     UIProcess/WebContext.messages.in
@@ -496,6 +507,9 @@ SET(WebKit2_MESSAGES_IN_FILES
     UIProcess/WebResourceCacheManagerProxy.messages.in
     UIProcess/WebVibrationProxy.messages.in
 
+
+    UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in
+    
     UIProcess/Downloads/DownloadProxy.messages.in
 
     UIProcess/Notifications/WebNotificationManagerProxy.messages.in
@@ -535,9 +549,10 @@ SET(WebKit2_MESSAGES_IN_FILES
 
     WebProcess/WebPage/DrawingArea.messages.in
     WebProcess/WebPage/EventDispatcher.messages.in
-    WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.messages.in
     WebProcess/WebPage/WebInspector.messages.in
     WebProcess/WebPage/WebPage.messages.in
+
+    WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in
 )
 
 SET(WebProcess_EXECUTABLE_NAME WebProcess)
@@ -552,17 +567,8 @@ SET(WebKit2_LIBRARIES
     ${WebCore_LIBRARY_NAME}
 )
 
-SET(WebKit2_FORWARDING_HEADERS_DIRECTORIES
-    Shared/API/c
-    UIProcess/API/C
-    UIProcess/API/cpp
-    WebProcess/InjectedBundle/API/c
-)
-
 WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
-WEBKIT_CREATE_FORWARDING_HEADERS(WebKit2 DIRECTORIES ${WebKit2_FORWARDING_HEADERS_DIRECTORIES})
-
 # Create JavaScript C++ code given an IDL input
 FOREACH (_file ${WebKit2_MESSAGES_IN_FILES})
     GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
@@ -582,6 +588,8 @@ INCLUDE_DIRECTORIES(${WebKit2_INCLUDE_DIRECTORIES})
 ADD_LIBRARY(${WebKit2_LIBRARY_NAME} ${WebKit2_LIBRARY_TYPE} ${WebKit2_SOURCES})
 
 ADD_DEPENDENCIES(${WebKit2_LIBRARY_NAME} ${WebCore_LIBRARY_NAME})
+ADD_DEPENDENCIES(${WebKit2_LIBRARY_NAME} ${ForwardingHeaders_NAME})
+ADD_DEPENDENCIES(${WebKit2_LIBRARY_NAME} ${ForwardingNetworkHeaders_NAME})
 TARGET_LINK_LIBRARIES(${WebKit2_LIBRARY_NAME} ${WebKit2_LIBRARIES})
 SET_TARGET_PROPERTIES(${WebKit2_LIBRARY_NAME} PROPERTIES FOLDER "WebKit")
 SET_TARGET_PROPERTIES(${WebKit2_LIBRARY_NAME} PROPERTIES LINK_INTERFACE_LIBRARIES "")
diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index b8fec0cf1..3994b5c36 100644
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,2102 @@
+2012-08-11  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * Platform/CoreIPC/Connection.h:
+        Add missing include.
+
+2012-08-11  Sam Weinig  <sam@webkit.org>
+
+        [WK2] Get rid of ProcessModelSharedSecondaryThread
+        https://bugs.webkit.org/show_bug.cgi?id=93652
+
+        Reviewed by Dan Bernstein.
+
+        The threaded model for WebKit2 has been broken a long time and its continued existence in
+        the code only serves to confuse. It's time to say good bye to it.
+
+        * UIProcess/API/C/WKContext.cpp:
+        * UIProcess/API/C/WKContextPrivate.h:
+        Remove WKContextGetSharedThreadContext().
+
+        * UIProcess/ProcessModel.h:
+        Remove ProcessModelSharedSecondaryThread from the ProcessModel enum.
+
+        * UIProcess/WebContext.cpp:
+        * UIProcess/WebContext.h:
+        Remove WebContext::sharedThreadContext().
+
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::~WebProcessProxy):
+        (WebKit::WebProcessProxy::connect):
+        (WebKit::WebProcessProxy::isLaunching):
+        * UIProcess/WebProcessProxy.h:
+        Remove the ThreadLauncher member and stop deriving from ThreadLauncher::Client.
+
+        * UIProcess/Launcher/ThreadLauncher.cpp: Removed.
+        * UIProcess/Launcher/ThreadLauncher.h: Removed.
+        * UIProcess/Launcher/efl/ThreadLauncherEfl.cpp: Removed.
+        * UIProcess/Launcher/gtk/ThreadLauncherGtk.cpp: Removed.
+        * UIProcess/Launcher/mac/ThreadLauncherMac.mm: Removed.
+        * UIProcess/Launcher/qt/ThreadLauncherQt.cpp: Removed.
+        * UIProcess/Launcher/win/ThreadLauncherWin.cpp: Removed.
+        * WebKit2.xcodeproj/project.pbxproj:
+        * win/WebKit2.vcproj:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * PlatformEfl.cmake:
+        * Target.pri:
+        Remove ThreadLauncher files.
+
+2012-08-11  Sam Weinig  <sam@webkit.org>
+
+        Enable XPC Service based WebProcess with runtime flag
+        https://bugs.webkit.org/show_bug.cgi?id=93773
+
+        Reviewed by Dan Bernstein.
+
+        Use the XPC Service for WebProcess code path if WEBKIT_USE_XPC_SERVICE_FOR_WEB_PROCESS
+        is set in the environment.
+
+        * UIProcess/Launcher/mac/ProcessLauncherMac.mm:
+        (WebKit::launchXPCService):
+        Fix issue that was causing this code not to compile. This was not caught before since
+        the code was not being built.
+        
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::connect):
+        Switch from hard coding always using the XPC Service code path if
+        HAVE(XPC) was true, to doing it conditionally on an environment variable.
+
+2012-08-11  Sam Weinig  <sam@webkit.org>
+
+        Make it possible to run the WebProcess as an XPC service
+        https://bugs.webkit.org/show_bug.cgi?id=92814
+
+        Reviewed by Anders Carlsson.
+
+        In this initial implementation, we are only using the XPC service
+        to launch the WebProcess, and then using the xpc_connection to send
+        over a mach_port to the WebProcess which is then used for creating
+        the CoreIPC connection.  In the future, we will switch to using the
+        xpc_connection for all messaging.
+
+        When the XPC service is enabled (it is compiled out by default for now), both
+        the XPC service and the old spawned process are runtime choosable.  This allows
+        the connect to pre-existing process workflow to continue to work.
+
+        There are a few additional caveats of this initial implementation:
+            - It is only set up for the WebProcess (not for the PluginProcess)
+            - The WebProcess shim does not work.
+            - It requires a new environment variable to be set when launching
+              to find the right service to launch (__XPC_DYLD_FRAMEWORK_PATH).
+
+        * Configurations/WebKit2Service.xcconfig: Added.
+        Add new configuration file for the service.
+
+        * Platform/CoreIPC/Connection.h:
+        (CoreIPC::Connection::Identifier::Identifier):
+        (CoreIPC::Connection::identifierIsNull):
+        Added to encapsulate the concept of a null identifier, now that it
+        is not possible to just compare to null.
+
+        * Platform/CoreIPC/mac/ConnectionMac.cpp:
+        (CoreIPC::Connection::platformInvalidate):
+        (CoreIPC::Connection::platformInitialize):
+        Change Connection::Identifier on the Mac to be a struct instead of
+        a typedef to a mach_port. This allows for the Connection to get both
+        the listening port and a reference to the xpc_connection (if it
+        compiled in). For now, all we do is retain the xpc_connection when it
+        is given to us, and release on Connection invalidation.
+
+        * PluginProcess/PluginProcess.cpp:
+        (WebKit::PluginProcess::createWebProcessConnection):
+        * PluginProcess/mac/PluginProcessMainMac.mm:
+        (WebKit::PluginProcessMain):
+        * WebProcess/Plugins/PluginProcessConnectionManager.cpp:
+        (WebKit::PluginProcessConnectionManager::getPluginProcessConnection):
+        Use the Connection::Identifier constructor.
+
+        * UIProcess/Launcher/ProcessLauncher.h:
+        (LaunchOptions):
+        Add a UseXPC option to the LaunchOptions so we can dynamically choose whether to use it.
+
+        (ProcessLauncher):
+        Make processTypeAsString public to allow better factoring in the implementation file
+        using static functions.
+
+        * UIProcess/Launcher/mac/ProcessLauncherMac.mm:
+        Factor out the different launching options into helper functions. Always start by
+        trying to connect to a pre-existing process.
+
+        (WebKit::launchXPCService):
+        Create a new xpc_connection to our service, and give it a unique instance UUID.
+        Then, send a bootstrap message with a mach_port and wait for a reply to complete
+        the launch procedure.
+ 
+        (WebKit::tryPreexistingProcess):
+        Move the code to connect to a preexisting process to its own helper function.
+
+        (WebKit::ProcessLauncher::launchProcess):
+        Clean up a bit, calling the helper functions and adding call to launch the XPC service
+        if it is enabled.
+
+        * UIProcess/Launcher/mac/ThreadLauncherMac.mm:
+        (WebKit::webThreadBody):
+        (WebKit::ThreadLauncher::createWebThread):
+        Switch to using the constructor version of Identifier.
+
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::PluginProcessProxy):
+        Don't try to use the XPC service for plugins yet.
+ 
+        (WebKit::PluginProcessProxy::didFinishLaunching):
+        Use Connection::identifierIsNull instead of explicit null check.
+
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::connect):
+        If XPC is compiled in (it currently is not) enable it by default.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+        Add the new files and targets.
+
+        * WebKit2Service: Added.
+        * WebKit2Service/Info.plist: Added.
+        Add the paper work needed for an XPC service. Importantly, set up the XPC
+        service to be an Application service type, use NSApplicationMain as its run
+        loop, and allow for multiple instantiations. Also make sure the service acts
+        like the WebProcess binary by making it a LSUIElement, enabling LSFileQuarantine,
+        and setting the principle class to NSApplication.
+
+        * WebKit2Service/MainMacService.mm: Added.
+        (WebKit2ServiceEventHandler):
+        (main):
+        The initialization of the XPC service is quite a bit different than the
+        WebProcess version, since we don't get passed parameters in argv. Instead,
+        we initiate the XPC service via xpc_main, and wait for the bootstrap message
+        we sent in ProcessLauncherMac.mm. When we receive that message we can load 
+        WebKit2 framework and initialize the WebProcess normally (we also get the mach_port
+        for the CoreIPC connection in that bootstrap message).
+
+        * WebProcess/mac/WebProcessMainMac.mm:
+        (WebKit::WebProcessMainXPC):
+        Add a variant of WebProcessMain that is used for the XPC service case, where we don't
+        have command line arguments and don't need to talk to the mach bootstrap server.
+
+        (WebKit::WebProcessMain):
+        * mac/MainMac.cpp: Removed.
+        * mac/MainMacProcess.cpp: Copied from Source/WebKit2/mac/MainMac.cpp.
+        Rename MainMac to MainMacProcess to signify that it is different from the XPC
+        service main.
+
+2012-08-09  Jer Noble  <jer.noble@apple.com>
+
+        Crash exiting from HTML5 FS mode to normal mode via ESC key
+        https://bugs.webkit.org/show_bug.cgi?id=93663
+
+        Reviewed by Eric Carlson.
+
+        Crash is due to a refcount underrun with _watchdogTimer due to adopting an autoreleased NSTimer.
+        Use the non-autoreleased NSTimer creation method and manually add to the main NSRunLoop.
+
+        * UIProcess/mac/WKFullScreenWindowController.mm:
+        (-[WKFullScreenWindowController cancelOperation:]):
+
+2012-08-10  Rafael Brandao  <rafael.lobo@openbossa.org>
+
+        [Qt] WebViewLoadFavIcon::test_favIconLoad() fails
+        https://bugs.webkit.org/show_bug.cgi?id=91888
+
+        Reviewed by Simon Hausmann.
+
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_favIconLoad.qml:
+        We should wait for iconChanged signal instead of loadFinished,
+        there was no guarantee that at that point we would get it already.
+
+2012-08-10  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt] Uninitialized flags in CoordinatedGraphicsLayer
+        https://bugs.webkit.org/show_bug.cgi?id=93719
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer::CoordinatedGraphicsLayer):
+
+2012-08-10  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [WK2][GTK] Implement new API to save a web page using MHTML
+        https://bugs.webkit.org/show_bug.cgi?id=89873
+
+        Reviewed by Carlos Garcia Campos.
+
+        Implemented new asynchronous API in WebKitWebView for saving a web
+        page to a GInputStream or to a file, using MHTML as the only
+        supported method at the moment.
+
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (ViewSaveAsyncData):
+        (webViewFileSavedCallback):
+        (webViewMHTMLDataGotCallback):
+        (webkit_web_view_save):
+        (webkit_web_view_save_finish):
+        (webkit_web_view_save_to_file):
+        (webkit_web_view_save_to_file_finish):
+        * UIProcess/API/gtk/WebKitWebView.h:
+
+        Added new unit test.
+
+        * UIProcess/API/gtk/tests/TestWebKitWebView.cpp:
+        (testWebViewSave):
+        (beforeAll):
+        (afterAll):
+
+        Updated documentation files with new symbols.
+
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt:
+
+2012-08-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Handle SSL errors for SOUP
+        https://bugs.webkit.org/show_bug.cgi?id=90267
+
+        Reviewed by Martin Robinson.
+
+        Ignore SSL errors by default for compatibility.
+
+        * WebProcess/efl/WebProcessMainEfl.cpp:
+        (WebKit::WebProcessMainEfl):
+        * WebProcess/gtk/WebProcessMainGtk.cpp:
+        (WebKit::WebProcessMainGtk):
+
+2012-08-09  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] Add a process model constant for multiple processes
+        https://bugs.webkit.org/show_bug.cgi?id=93642
+
+        Reviewed by Anders Carlsson.
+
+        * UIProcess/ProcessModel.h: Added ProcessModelMultipleSecondaryProcesses.
+        Deleted ProcessModelSecondaryProcess in favor of more descriptive ProcessModelSharedSecondaryProcess - 
+        these used to behave the same.
+
+        * UIProcess/WebContext.cpp: (WebKit::WebContext::create): Changed to use ProcessModelSharedSecondaryProcess.
+
+        * UIProcess/WebProcessProxy.h: Removed an unncessary include of ProcessModel.h.
+
+2012-08-09  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/12035637> 32-bit PluginProcess launches without appropriate DYLD environment variables if UI process is 64-bit only
+        https://bugs.webkit.org/show_bug.cgi?id=93596
+
+        Reviewed by Mark Rowe.
+
+        * UIProcess/Launcher/mac/ProcessLauncherMac.mm:
+        (WebKit::ProcessLauncher::launchProcess): Changed to pass the current architecture, rather than
+        the intended child process architecture, to the DynamicLinkerEnvironmentExtractor constructor.
+
+2012-08-09  Tim Horton  <timothy_horton@apple.com>
+
+        Add optional debug logging for tiled scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=93305
+
+        Reviewed by Simon Fraser.
+
+        Add a new boolean preference, ScrollingPerformanceLoggingEnabled, which will be used to toggle
+        the WebCore parts of this change.
+
+        * Shared/WebPreferencesStore.h: Add ScrollingPerformanceLoggingEnabled.
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetScrollingPerformanceLoggingEnabled): Added.
+        (WKPreferencesGetScrollingPerformanceLoggingEnabled): Added.
+        * UIProcess/API/C/WKPreferencesPrivate.h: Add getters and setters for ScrollingPerformanceLoggingEnabled.
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage): Add ScrollingPerformanceLoggingEnabled.
+        (WebKit::WebPage::updatePreferences): Add ScrollingPerformanceLoggingEnabled.
+        (WebKit::WebPage::setScrollingPerformanceLoggingEnabled): Propagate settings changes through to FrameView.
+        * WebProcess/WebPage/WebPage.h:
+        (WebKit::WebPage::scrollingPerformanceLoggingEnabled): Add a getter for the setting so that TiledCoreAnimationDrawingArea can access it.
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+        (WebKit::TiledCoreAnimationDrawingArea::updatePreferences): Pass ScrollingPerformanceLoggingEnabled down into the scrolling thread.
+
+2012-08-08  Shane Stephens  <shanestephens@google.com>
+
+        Compile flag for CSS Hierarchies
+        https://bugs.webkit.org/show_bug.cgi?id=92433
+
+        Reviewed by Tony Chang.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-08-08  Anders Carlsson  <andersca@apple.com>
+
+        REGRESSION: Crash when plug-in initialization fails
+        https://bugs.webkit.org/show_bug.cgi?id=93534
+        <rdar://problem/12059786>
+
+        Reviewed by Simon Fraser.
+
+        Protect the PluginProxy while calling out to functions that could cause it to be destroyed.
+
+        * WebProcess/Plugins/PluginProxy.cpp:
+        (WebKit::PluginProxy::didFailToCreatePluginInternal):
+
+2012-08-08  Anders Carlsson  <andersca@apple.com>
+
+        Make isTransparentSilverlightBackgroundValue handle all the possible transparent colors
+        https://bugs.webkit.org/show_bug.cgi?id=93532
+
+        Reviewed by Simon Fraser.
+
+        * WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
+        (WebKit::isTransparentSilverlightBackgroundValue):
+        Check for all the possible transparent colors and assume that the color is opaque otherwise.
+
+        (WebKit::NetscapePlugin::initialize):
+        Pass the lowercase string to isTransparentSilverlightBackgroundValue.
+
+2012-08-08  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=92275
+        Need a way to get a snapshot image that does not show the selection
+        -and corresponding-
+        <rdar://problem/11956802>
+
+        Reviewed by Anders Carlsson.
+
+        Added new API WKBundlePageCreateSnapshotWithOptions()
+
+        New enum SnapshotOptions tracks whether snapshots should exclude 
+        selection highlighting in addition to tracking whether the image is 
+        sharable like the original ImageOptions.
+        * Shared/API/c/WKImage.h:
+        * Shared/API/c/WKSharedAPICast.h:
+        (WebKit::snapshotOptionsFromImageOptions):
+        (WebKit):
+        (WebKit::toSnapshotOptions):
+        * Shared/ImageOptions.h:
+
+        New API.
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.h:
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.cpp:
+        (WKBundlePageCreateSnapshotWithOptions):
+
+        These existing APIs all now call 
+        WebPage::scaledSnapshotWithOptions().
+        (WKBundlePageCreateSnapshotInViewCoordinates):
+        (WKBundlePageCreateSnapshotInDocumentCoordinates):
+        (WKBundlePageCreateScaledSnapshotInDocumentCoordinates):
+
+        This patch removes WebPage::snapshotInViewCoordinates(), 
+        WebPage::snapshotInDocumentCoordinates(), and 
+        WebPage::scaledSnapshotInDocumentCoordinates(). All of the logic is 
+        now consolidated into WebPage::scaledSnapshotWithOptions(). It turns 
+        out that we never did anything different for document coordinates 
+        versus view coordinates, so that complexity could just be eliminated 
+        outright.
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::snapshotOptionsToImageOptions):
+        (WebKit::WebPage::scaledSnapshotWithOptions):
+        (WebKit):
+        * WebProcess/WebPage/WebPage.h:
+        (WebPage):
+
+2012-08-08  Anders Carlsson  <andersca@apple.com>
+
+        Make the Silverlight CAOpenGLLayer opaque if we know the plug-in contents is opaque to reduce blending
+        https://bugs.webkit.org/show_bug.cgi?id=93508
+        <rdar://problem/12056765>
+
+        Reviewed by Simon Fraser.
+
+        * Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:
+        (WebKit::NetscapePluginModule::determineQuirks):
+        * Shared/Plugins/PluginQuirks.h:
+        Rename the MakeTransparentIfBackgroundAttributeExists quirk to MakeOpaqueUnlessTransparentSilverlightBackgroundAttributeExists
+        since we'll explicitly check for opaque background colors (at least one opaque background color for now), instead of just making the
+        plug-in transparent whenever there's a background specified.
+
+        * WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
+        (WebKit::isTransparentSilverlightBackgroundValue):
+        Helper function for determining if a background value is transparent. Just check for opaque black now and treat everything else as transparent.
+
+        (WebKit::NetscapePlugin::initialize):
+        Call isTransparentSilverlightBackgroundValue.
+
+        * WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:
+        (WebKit::makeCGLPresentLayerOpaque):
+        Helper function for grabbing the CGLPresentLayer from the layer hierarchy and setting it to be opaque.
+
+        (WebKit::NetscapePlugin::updatePluginLayer):
+        Call makeCGLPresentLayerOpaque if the plug-in has the MakeOpaqueUnlessTransparentSilverlightBackgroundAttributeExists quirk and
+        the plug-in is not transparent.
+
+2012-08-08  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [WK2] Coding style violation was brought with r125031
+        https://bugs.webkit.org/show_bug.cgi?id=93503
+
+        Reviewed by Alexey Proskuryakov.
+
+        WKURLResponseCopyMimeType is corrected to WKURLResponseCopyMIMEType.
+
+        * Shared/API/c/WKURLResponse.cpp:
+        (WKURLResponseCopyMIMEType):
+        * Shared/API/c/WKURLResponse.h:
+
+2012-08-08  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL] EFL Webkit needs a class wrapping eina stringshare
+        https://bugs.webkit.org/show_bug.cgi?id=93229
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added a new auxiliary class wrapping Eina Stringshare and providing
+        more convenient C++ interface for using it. 
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/cpp/efl/WKEinaSharedString.cpp: Added.
+        (:m_string):
+        (WKEinaSharedString::~WKEinaSharedString):
+        (WKEinaSharedString::operator=):
+        * UIProcess/API/cpp/efl/WKEinaSharedString.h: Added.
+        (WebKit):
+
+2012-08-08  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt] Snowshoe desktop crashes when opening a new tab
+        https://bugs.webkit.org/show_bug.cgi?id=92753
+
+        Reviewed by Jocelyn Turcotte.
+
+        Change back forceRepaint to consider the UI process state.
+        It has been tweaked to satisfy the needs of WKPageForceRepaint but
+        it has other callers so this new behavior was not safe. This patch
+        implements WebPage::forceRepaintAsync for testing purposes. It is
+        done by LayerTreeCoordinator that holds the callback and sends the
+        reply message in the next flushPendingLayerChanges. In theory it
+        could be implemented for the non conposited path in DrawingAreaImpl
+        as well but neither it is needed nor can I test it.
+
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::LayerTreeCoordinator):
+        (WebKit::LayerTreeCoordinator::forceRepaintAsync):
+        (WebKit):
+        (WebKit::LayerTreeCoordinator::flushPendingLayerChanges):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::DrawingAreaImpl::forceRepaintAsync):
+        (WebKit):
+        * WebProcess/WebPage/DrawingAreaImpl.h:
+        (DrawingAreaImpl):
+        * WebProcess/WebPage/LayerTreeHost.h:
+        (WebKit::LayerTreeHost::forceRepaintAsync):
+
+2012-08-08  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [WK2] [WTR] Provide Resource Response dumping.
+        https://bugs.webkit.org/show_bug.cgi?id=93454
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Several new getter functions were added to WKURLResponse and WKURL, so that WTR has
+        necessary data for dumping.
+
+        * Shared/API/c/WKURL.cpp:
+        (WKURLCopyLastPathComponent):
+        * Shared/API/c/WKURL.h:
+        * Shared/API/c/WKURLResponse.cpp:
+        (WKURLResponseCopyURL): Returns URL of the response.
+        (WKURLResponseCopyMimeType): Returns MIME type of the response. 
+        * Shared/API/c/WKURLResponse.h:
+        * Shared/WebURL.h:
+        (WebKit::WebURL::lastPathComponent): Returns last path component of the URL.
+        (WebURL):
+
+2012-08-08  Eunmi Lee  <eunmi15.lee@samsung.com>
+
+        [EFL][WK2] Make ewk_view inheritable in the WebKit2.
+        https://bugs.webkit.org/show_bug.cgi?id=90054
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Make the ewk_view inheritable by exposing ewk_view_smart_class_set()
+        API. Additionally, the ewk_view_smart_add() API is added to create
+        Evas_Object for WebKit2 EFL. The default initialization is done in the
+        ewk_view_smart_add(), so the object which inherits the ewk_view should
+        use ewk_view_smart_add() instead of evas_object_smart_add() to create
+        Evas_Object.
+
+        * UIProcess/API/efl/ewk_context.cpp:
+        (ewk_context_new_from_WKContext):
+        * UIProcess/API/efl/ewk_context_private.h:
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_smart_class_set):
+        (_ewk_view_smart_class_new):
+        (_ewk_view_initialize):
+        (_ewk_view_add_with_smart):
+        (ewk_view_base_add):
+        (ewk_view_smart_add):
+        (ewk_view_add_with_context):
+        * UIProcess/API/efl/ewk_view.h:
+
+2012-08-08  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt] WebProcess hangs on plugin initialization.
+        https://bugs.webkit.org/show_bug.cgi?id=93272
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::didFinishLaunching): Ensure PluginProcessConnectionManager is informed of plugin crashes.
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage): Let setIsInWindow set canStartMedia asynchronously.
+
+2012-08-08  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Set the fixed layout setting before creating the page
+        https://bugs.webkit.org/show_bug.cgi?id=93374
+
+        Reviewed by Noam Rosenthal.
+
+        Any page setting should preferrable be set before creating the page
+        but fixed layout was set after the initialization of the web page.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::initialize):
+        (QQuickWebViewFlickablePrivate::initialize):
+
+2012-08-08  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [WK2] Add new C API to generate MHTML data from the UI process
+        https://bugs.webkit.org/show_bug.cgi?id=89872
+
+        Reviewed by Anders Carlsson.
+
+        Add new C API in the UI Process, using ENABLE(MHTML) guards as needed.
+
+        * UIProcess/API/C/WKPage.cpp:
+        (WKPageGetContentsAsMHTMLData):
+        * UIProcess/API/C/WKPage.h:
+
+        Implementation in the UI Process's WebPage proxy object.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit):
+        (WebKit::WebPageProxy::getContentsAsMHTMLData):
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+
+        Implementation in the WebProcess, relying in WebCore::MHTMLArchive.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit):
+        (WebKit::WebPage::getContentsAsMHTMLData):
+        * WebProcess/WebPage/WebPage.h:
+        (WebPage):
+        * WebProcess/WebPage/WebPage.messages.in:
+
+2012-08-07  YoungTaeck Song  <youngtaeck.song@samsung.com>
+
+        [WK2][EFL] Implement accelerated compositing on WK2 Efl port
+        https://bugs.webkit.org/show_bug.cgi?id=89840
+
+        Reviewed by Noam Rosenthal.
+
+        Implement accelerated composition with TiledBackingStore on WK2 Efl port.
+        This implementation is based on COORDINATED_GRAPHICS.
+
+        * CMakeLists.txt:
+        * PlatformEfl.cmake:
+        * Shared/ShareableSurface.cpp:
+        * Shared/WebCoreArgumentCoders.cpp:
+        * Shared/WebCoreArgumentCoders.h:
+        * UIProcess/API/efl/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::PageClientImpl):
+        (WebKit::PageClientImpl::didChangeContentsSize):
+        (WebKit):
+        * UIProcess/API/efl/PageClientImpl.h:
+        (PageClientImpl):
+        * UIProcess/API/efl/ViewportProcessor.cpp: Added.
+        (WebKit):
+        (WebKit::ViewportProcessor::ViewportProcessor):
+        (WebKit::ViewportProcessor::~ViewportProcessor):
+        (WebKit::ViewportProcessor::display):
+        (WebKit::ViewportProcessor::updateViewportSize):
+        (WebKit::ViewportProcessor::setVisibleContentsRect):
+        (WebKit::ViewportProcessor::didChangeContentsSize):
+        * UIProcess/API/efl/ViewportProcessor.h: Added.
+        (WebKit):
+        (ViewportProcessor):
+        (WebKit::ViewportProcessor::create):
+        (WebKit::ViewportProcessor::drawingArea):
+        (WebKit::ViewportProcessor::viewSize):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_Ewk_View_Private_Data):
+        (_ewk_view_smart_calculate):
+        (ewk_view_base_add):
+        (ewk_view_display):
+        (ewk_view_contents_size_changed):
+        * UIProcess/API/efl/ewk_view_private.h:
+        * UIProcess/PageClient.h:
+        (PageClient):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit):
+        (WebKit::WebPageProxy::didChangeContentsSize):
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+        * UIProcess/WebPageProxy.messages.in:
+        * WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.cpp:
+        * WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.h:
+        * WebProcess/WebPage/LayerTreeHost.cpp:
+        (WebKit::LayerTreeHost::create):
+        * WebProcess/WebPage/LayerTreeHost.h:
+        (WebKit):
+        * WebProcess/efl/WebProcessMainEfl.cpp:
+        (WebKit::WebProcessMainEfl):
+
+2012-08-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+       [Qt] New API tests introuduced in r119723 marked as fail, but pass
+       https://bugs.webkit.org/show_bug.cgi?id=88870
+
+        Reviewed by Alexis Menard.
+
+        Revert r119723, because there are 2 failing tests, and the author and
+        the reviewer of the original patch ignore the bug report long time ago.
+
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_devicePixelRatio.qml: Removed.
+
+2012-08-07  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        GraphicsLayerAnimation shouldn't use HashMap<String>
+        https://bugs.webkit.org/show_bug.cgi?id=93284
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Apply the changes to GraphicsLayerAnimation API.
+
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer::addAnimation):
+
+2012-08-07  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Make it possible to build without QtQuick
+
+        Reviewed by Simon Hausmann.
+
+        * Target.pri:
+        * UIProcess/API/qt/tests/tests.pri:
+        * UIProcess/API/qt/tests/util.cpp:
+        * UIProcess/API/qt/tests/util.h:
+        * UIProcess/qt/WebFullScreenManagerProxyQt.cpp:
+        (WebKit::WebFullScreenManagerProxy::invalidate):
+        (WebKit::WebFullScreenManagerProxy::enterFullScreen):
+        (WebKit::WebFullScreenManagerProxy::exitFullScreen):
+        * UIProcess/qt/WebPageProxyQt.cpp:
+        (WebKit::WebPageProxy::resolveApplicationSchemeRequest):
+        (WebKit::WebPageProxy::sendApplicationSchemeReply):
+        * WebKit2.pri:
+
+2012-07-19  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove Qt 4 specific code paths
+        https://bugs.webkit.org/show_bug.cgi?id=88161
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        * UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp:
+        (gatherAPI):
+        * WebKit2.pri:
+
+2012-08-07  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Add back forward list API
+        https://bugs.webkit.org/show_bug.cgi?id=92345
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added new Back Forward list API to EFL WK2. Ewk_Back_Forward_List and
+        Ewk_Back_Forward_List_Item structures were added. The new API is
+        mostly the same as one from UIProcess/API/C/{ WKBackForwardList.h, WKBackForwardListItem.h }.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/ewk_back_forward_list.cpp: Added.
+        (_Ewk_Back_Forward_List):
+        (_Ewk_Back_Forward_List::_Ewk_Back_Forward_List):
+        (getOrCreateItem):
+        (webkit_back_forward_list_current_item_get):
+        (webkit_back_forward_list_back_item_get):
+        (webkit_back_forward_list_forward_item_get):
+        (webkit_back_forward_list_item_at_index_get):
+        (webkit_back_forward_list_length_get):
+        (ewk_back_forward_list_changed):
+        (ewk_back_forward_list_new):
+        (ewk_back_forward_list_free):
+        * UIProcess/API/efl/ewk_back_forward_list.h: Added.
+        * UIProcess/API/efl/ewk_back_forward_list_item.cpp: Added.
+        (getItemProperty):
+        (_Ewk_Back_Forward_List_Item):
+        (_Ewk_Back_Forward_List_Item::_Ewk_Back_Forward_List_Item):
+        (_Ewk_Back_Forward_List_Item::~_Ewk_Back_Forward_List_Item):
+        (ewk_back_forward_list_item_ref):
+        (ewk_back_forward_list_item_unref):
+        (ewk_back_forward_list_item_uri_get):
+        (ewk_back_forward_list_item_title_get):
+        (ewk_back_forward_list_item_original_uri_get):
+        (ewk_back_forward_list_item_new):
+        * UIProcess/API/efl/ewk_back_forward_list_item.h: Added.
+        * UIProcess/API/efl/ewk_back_forward_list_item_private.h: Added.
+        * UIProcess/API/efl/ewk_back_forward_list_private.h: Added.
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_Ewk_View_Private_Data):
+        (_Ewk_View_Private_Data::_Ewk_View_Private_Data):
+        (_Ewk_View_Private_Data::~_Ewk_View_Private_Data):
+        (ewk_view_back_forward_list_get): New function to get back-forward list.
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/ewk_view_loader_client.cpp:
+        (didChangeBackForwardList): The callback added to update back-forward list items cache.
+        (ewk_view_loader_client_attach):
+
+2012-08-07  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        CUSTOM_SCHEME_HANDLER flag should depend on REGISTER_PROTOCOL_HANDLER
+        https://bugs.webkit.org/show_bug.cgi?id=93081
+
+        Reviewed by Adam Barth.
+
+        CUSTOM_SCHEME_HANDLER #if guards are enclosed in the REGISTER_PROTOCOL_HANDLER guards.
+
+        * WebProcess/WebCoreSupport/WebRegisterProtocolHandlerClient.h:
+        (WebRegisterProtocolHandlerClient):
+
+2012-08-07  Hyerim Bae  <hyerim.bae@samsung.com>
+
+        [EFL][WK2] Add ewk_view_find_client.h / cpp for wrapping WKPageSetPageFindClient.
+        https://bugs.webkit.org/show_bug.cgi?id=90927
+
+        Reviewed by Kentaro Hara.
+
+        Add ewk_view_find_client.h / files for wrapping WKPageSetPageFindClient,
+        add didFindString callback member of WKPageSetPageFindClient.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_base_add):
+        (ewk_view_text_found):
+        (ewk_view_text_find):
+        (ewk_view_text_find_highlight_clear):
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/ewk_view_find_client.cpp: Added.
+        (toEwkView):
+        (didFindString):
+        (ewk_view_find_client_attach):
+        * UIProcess/API/efl/ewk_view_find_client_private.h: Added.
+        * UIProcess/API/efl/ewk_view_private.h:
+
+2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124816.
+        http://trac.webkit.org/changeset/124816
+        https://bugs.webkit.org/show_bug.cgi?id=93311
+
+        made some tests crash (Requested by noamr on #webkit).
+
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer::addAnimation):
+
+2012-08-06  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        GraphicsLayerAnimation shouldn't use HashMap<String>
+        https://bugs.webkit.org/show_bug.cgi?id=93284
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Apply the changes to GraphicsLayerAnimation API.
+
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer::addAnimation):
+
+2012-08-03  Brady Eidson  <beidson@apple.com>
+
+        Out-of-process plug-ins should support asynchronous initialization
+        <rdar://problem/10598594> and https://bugs.webkit.org/show_bug.cgi?id=92919
+
+        Reviewed by Anders Carlsson.
+
+        If a plug-in has been deemed capable of asynchronous initialization when run out of process...
+        ...then do that!
+
+        Add flags to communicate that this plugin create is meant to create a plug-in already requested asynchronously and
+        to include whether or not the initialize call should include an artificial delay (for testing):
+        * PluginProcess/PluginCreationParameters.cpp:
+        (WebKit::PluginCreationParameters::PluginCreationParameters):
+        (WebKit::PluginCreationParameters::encode):
+        (WebKit::PluginCreationParameters::decode):
+        * PluginProcess/PluginCreationParameters.h:
+        (PluginCreationParameters):
+
+        Add a flag for the UI Process to tell the PluginProcess that it supports asynchronous initialization:
+        * Shared/Plugins/PluginProcessCreationParameters.cpp:
+        (WebKit::PluginProcessCreationParameters::PluginProcessCreationParameters):
+        (WebKit::PluginProcessCreationParameters::encode):
+        (WebKit::PluginProcessCreationParameters::decode):
+        * Shared/Plugins/PluginProcessCreationParameters.h:
+        (PluginProcessCreationParameters):
+
+        Allow the UI Process to pass along whether the plug-on supports asynchronous initialization:
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::pluginProcessCrashedOrFailedToLaunch):
+        (WebKit::PluginProcessProxy::didCreateWebProcessConnection):
+        * UIProcess/Plugins/PluginProcessProxy.h:
+        (PluginProcessProxy):
+        * UIProcess/Plugins/mac/PluginProcessProxyMac.mm:
+        (WebKit::PluginProcessProxy::platformInitializePluginProcess):
+        * UIProcess/WebProcessProxy.messages.in:
+
+        Allow the Plugin Process to pass whether or not it supports asynchronous initialization, originally determined
+        in the UI Process, along to the WebProcess:
+        * PluginProcess/PluginProcess.cpp:
+        (WebKit::PluginProcess::PluginProcess):
+        (WebKit::PluginProcess::initializePluginProcess):
+        (WebKit::PluginProcess::createWebProcessConnection):
+        * PluginProcess/PluginProcess.h:
+        (PluginProcess):
+        * UIProcess/Plugins/PluginProcessProxy.messages.in:
+
+        Add a flag so PluginProcessConnections remember whether or not they support asynchronous initialization:
+        * WebProcess/Plugins/PluginProcessConnection.cpp:
+        (WebKit::PluginProcessConnection::PluginProcessConnection):
+        (WebKit::PluginProcessConnection::setSupportsAsynchronousPluginInitialization):
+        (WebKit):
+        * WebProcess/Plugins/PluginProcessConnection.h:
+        (WebKit::PluginProcessConnection::create):
+        (WebKit::PluginProcessConnection::supportsAsynchronousPluginInitialization):
+        (PluginProcessConnection):
+
+        Create PluginProcessConnections with the flag passed down from the PluginProcess about whether or not they
+        support asynchronous initialization:
+        * WebProcess/Plugins/PluginProcessConnectionManager.cpp:
+        (WebKit::PluginProcessConnectionManager::getPluginProcessConnection):
+
+        Responding to messages from the WebProcess, most of the heavy decision making in asynchronous initialization is here:
+        * PluginProcess/WebProcessConnection.cpp:
+        (WebKit::asynchronousInstanceIDsToIgnore): A set of instance IDs to *not* create asynchronously later because we know
+          we no longer need to.
+        (WebKit):
+        (WebKit::WebProcessConnection::didReceiveMessage):
+        (WebKit::WebProcessConnection::destroyPlugin): If the plug-in doesn't exist but is awaiting asynchronous creation, flag 
+          this instance ID in the "asynchronous ignore set".
+        (WebKit::WebProcessConnection::createPluginInternal): Renamed from createPlugin, actually does the plug-in creation.
+        (WebKit::WebProcessConnection::createPlugin): Adds the instance ID to the "asynchronous ignore set" then calls createPluginInternal.
+        (WebKit::WebProcessConnection::createPluginAsynchronously): If the instance ID is in the "asynchronous ignore set", remove it from the
+          set and do nothing else. Otherwise, perform the initialization and then send the asynchronous result back to the WebProcess.
+        * PluginProcess/WebProcessConnection.h:
+        (WebProcessConnection):
+        * PluginProcess/WebProcessConnection.messages.in:
+
+        Add helpers for asynchronous initialization that all plug-in types must implement:
+        * WebProcess/Plugins/Plugin.h:
+        (Plugin):
+
+        Add helpers for asynchronous initialization that plug-in controllers can override:
+        * WebProcess/Plugins/PluginController.h:
+        (PluginController):
+        (WebKit::PluginController::asynchronousPluginInitializationEnabled):
+        (WebKit::PluginController::asynchronousPluginInitializationEnabledForAllPlugins):
+        (WebKit::PluginController::artificialPluginInitializationDelayEnabled):
+
+        Give PluginProxys the ability to initialize either asynchronously or synchronously, and also the ability to synchronously
+        wait for previously asynchronous initialization (in case their PluginScriptObject is required):
+        * WebProcess/Plugins/PluginProxy.cpp:
+        (WebKit::PluginProxy::PluginProxy):
+        (WebKit::PluginProxy::initialize): Store the plugin creation parameters as a member, and decide whether to try synchronous
+          or asynchronous initialization.
+        (WebKit):
+        (WebKit::PluginProxy::canInitializeAsynchronously): Answer based on preferences and what the PluginProcessConnection says
+          that it supports.
+        (WebKit::PluginProxy::waitForAsynchronousInitialization): Synchronously wait on initialization when asynchronous initialization
+          was previously requested.
+        (WebKit::PluginProxy::initializeSynchronously):
+        (WebKit::PluginProxy::didCreatePlugin): Double-check that we're still expecting asynchronous initialization, then call
+          through to didCreatePluginInternal.
+        (WebKit::PluginProxy::didCreatePluginInternal): Handle completion of initialization (both synchronously and asynchronously)
+        (WebKit::PluginProxy::didFailToCreatePlugin): Double-check that we're still expecting asynchronous initialization, then call
+          through to didFailToCreatePluginInternal.
+        (WebKit::PluginProxy::didFailToCreatePluginInternal): Handle failure to initialize (both synchronously and asynchronously)
+        (WebKit::PluginProxy::destroy):
+        * WebProcess/Plugins/PluginProxy.h:
+        (WebKit):
+        (WebKit::PluginProxy::isInitializingAsynchronously):
+        (PluginProxy):
+        * WebProcess/Plugins/PluginProxy.messages.in:
+
+        * WebProcess/Plugins/PluginView.cpp:
+        (WebKit::PluginView::PluginView):
+        (WebKit::PluginView::~PluginView): Always destroy the plug-in even if it hasn't been initialized yet, as it might be initializing
+          right now.
+        (WebKit::PluginView::initializePlugin): Don't handle the result of initialization immediately. Break that out in to two
+          methods that will be called later.
+        (WebKit):
+        (WebKit::PluginView::didFailToInitializePlugin):
+        (WebKit::PluginView::didInitializePlugin):
+        (WebKit::PluginView::scriptObject): If we truly need the script object, then wait for a synchronous initialization of the plug-in.
+        (WebKit::PluginView::asynchronousPluginInitializationEnabled):
+        (WebKit::PluginView::asynchronousPluginInitializationEnabledForAllPlugins):
+        (WebKit::PluginView::artificialPluginInitializationDelayEnabled):
+        * WebProcess/Plugins/PluginView.h:
+        (PluginView):
+
+        These methods shouldn't be called in the PluginProcess, only in the WebProcess:
+        * PluginProcess/PluginControllerProxy.cpp:
+        (WebKit::PluginControllerProxy::didInitializePlugin):
+        (WebKit):
+        (WebKit::PluginControllerProxy::didFailToInitializePlugin):
+        * PluginProcess/PluginControllerProxy.h:
+        (PluginControllerProxy):
+
+        NetscapePlugin is for in-process plug-ins:
+        * WebProcess/Plugins/Netscape/NetscapePlugin.h:
+        (NetscapePlugin):
+        (WebKit::NetscapePlugin::waitForAsynchronousInitialization):
+        (WebKit::NetscapePlugin::isInitializingAsynchronously):
+
+        Built-in PDFView is currently only in-process:
+        * WebProcess/Plugins/PDF/BuiltInPDFView.h:
+        (BuiltInPDFView):
+        (WebKit::BuiltInPDFView::waitForAsynchronousInitialization):
+        (WebKit::BuiltInPDFView::isInitializingAsynchronously):
+
+2012-08-06  Luciano Wolf  <luciano.wolf@openbossa.org>
+
+        [Qt] Default sizes for input-text and text-area are different when running DRT/WTR
+        https://bugs.webkit.org/show_bug.cgi?id=91990
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        WTR wasn't using the proper font types provided by testfonts directory.
+        The same approach as DRT was applied and now it takes info from QFont to
+        update the store variable.
+
+        * UIProcess/qt/WebPreferencesQt.cpp:
+        (WebKit::setStringValueIfInUserDefaults):
+        (WebKit):
+        (WebKit::WebPreferences::platformInitializeStore):
+
+2012-08-06  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Use GraphicsLayerAnimation in LayerTreeCoordinator
+        https://bugs.webkit.org/show_bug.cgi?id=93147
+
+        Reviewed by Kenneth Rohde Christiansen
+
+        Allow controlling animations outside of WebCore. This is an intermediate step before moving
+        to threaded animations.
+
+        CoordinatedGraphicsLayer maintains the GraphicsLayerAnimation structures, and applies the
+        animation interpolation at the right time, before syncing the rest of the layer info and
+        the visible contents rect.
+
+        This also allows sending shorter IPC messages for animated opacity/transform changes,
+        without the rest of the layer info.
+
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp:
+        (WebKit::LayerTreeCoordinatorProxy::setLayerAnimatedOpacity):
+        (WebKit):
+        (WebKit::LayerTreeCoordinatorProxy::setLayerAnimatedTransform):
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h:
+        (LayerTreeCoordinatorProxy):
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in:
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp:
+        (WebKit::LayerTreeRenderer::setAnimatedOpacity):
+        (WebKit):
+        (WebKit::LayerTreeRenderer::setAnimatedTransform):
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.h:
+        (LayerTreeRenderer):
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer::didChangeAnimatedProperties):
+        (WebCore):
+        (WebCore::CoordinatedGraphicsLayer::CoordinatedGraphicsLayer):
+        (WebCore::CoordinatedGraphicsLayer::syncLayerState):
+        (WebCore::CoordinatedGraphicsLayer::syncAnimatedProperties):
+        (WebCore::CoordinatedGraphicsLayer::syncCompositingStateForThisLayerOnly):
+        (WebCore::CoordinatedGraphicsLayer::computeTransformedVisibleRect):
+            account for the animated transform in the visible rect.
+
+        (WebCore::CoordinatedGraphicsLayer::addAnimation):
+        (WebCore::CoordinatedGraphicsLayer::pauseAnimation):
+        (WebCore::CoordinatedGraphicsLayer::removeAnimation):
+        (WebCore::CoordinatedGraphicsLayer::animationStartedTimerFired):
+        (WebCore::CoordinatedGraphicsLayer::setAnimatedTransform):
+        (WebCore::CoordinatedGraphicsLayer::setAnimatedOpacity):
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h:
+        (CoordinatedGraphicsLayerClient):
+        (CoordinatedGraphicsLayer):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        (WebKit):
+        (WebKit::LayerTreeCoordinator::setLayerAnimatedOpacity):
+        (WebKit::LayerTreeCoordinator::setLayerAnimatedTransform):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+
+2012-08-06  Anders Carlsson  <andersca@apple.com>
+
+        If the Apple Java plug-in is blocked and no runtime is installed, don't load it
+        https://bugs.webkit.org/show_bug.cgi?id=93289
+        <rdar://problem/11730092>
+
+        Reviewed by Dan Bernstein.
+
+        If the Apple Java plug-in is blocked, but there's no Java runtime installed (or the Java plug-in is disabled),
+        don't even include it in the plug-in info store.
+
+        * UIProcess/Plugins/PluginInfoStore.cpp:
+        (WebKit::PluginInfoStore::shouldBlockPlugin):
+        Since this is static now, it shouldn't be const.
+
+        * UIProcess/Plugins/PluginInfoStore.h:
+        (PluginInfoStore):
+        shouldBlockPlugin can be static.
+
+        * UIProcess/Plugins/mac/PluginInfoStoreMac.mm:
+        (WebKit::PluginInfoStore::shouldUsePlugin):
+        Return false if the Apple Java plug-in is blocked but Java isn't installed or enabled.
+
+        (WebKit::PluginInfoStore::shouldBlockPlugin):
+        Since this is static now, it shouldn't be const.
+
+2012-08-06  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [WK2][GTK] Improvements for the new spell-checking API
+        https://bugs.webkit.org/show_bug.cgi?id=93262
+
+        Reviewed by Carlos Garcia Campos.
+
+        Improve the way the new spell-checking API is implemented, by
+        using better internal representations for data, documenting better
+        the new functions and using better unit tests.
+
+        * UIProcess/API/gtk/WebKitTextChecker.cpp:
+        (WebKitTextChecker::getSpellCheckingLanguages): Just return the
+        value previously cached when calling to the setter function.
+        (WebKitTextChecker::setSpellCheckingLanguages): Update the text
+        checker in WebCore and cache the value returned from it.
+        * UIProcess/API/gtk/WebKitTextChecker.h:
+        (WebKitTextChecker): Use a CString instead of an String to cache
+        the list of spell checking languages. Update getter and setter.
+        * UIProcess/API/gtk/WebKitWebContext.cpp:
+        (_WebKitWebContextPrivate): No need to cache the spell checking
+        languages here anymore.
+        (webkit_web_context_get_spell_checking_languages): Improve
+        both implementation and documentation to be more consistent.
+        (webkit_web_context_set_spell_checking_languages): Make
+        'languages' a mandatory (non-NULL) parameter. Update documentation.
+        * UIProcess/API/gtk/tests/TestWebKitWebContext.cpp:
+        (testWebContextSpellChecker): Test even more situations.
+
+2012-08-06  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Remove workarounds from input event handling
+        https://bugs.webkit.org/show_bug.cgi?id=93125
+
+        Reviewed by Jocelyn Turcotte.
+
+        Since input event propagation in Qt5 has been fixed we can remove
+        the workarounds introduced to prevent the QML WebView from receiving
+        input events targeting a child dialog.
+        To do this the childMouseEventFilter function has to be changed to
+        force touch and mouse events through the default propagation path.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::QQuickWebViewPrivate):
+        (QQuickWebViewLegacyPrivate::initialize):
+        (QQuickWebView::childMouseEventFilter):
+        (QQuickWebView::touchEvent):
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        (QQuickWebViewLegacyPrivate):
+        * UIProcess/qt/QtDialogRunner.cpp:
+        (WebKit::QtDialogRunner::run):
+        * UIProcess/qt/WebColorChooserProxyQt.cpp:
+        (WebKit::WebColorChooserProxyQt::createItem):
+        (WebKit::WebColorChooserProxyQt::endChooser):
+        * UIProcess/qt/WebPopupMenuProxyQt.cpp:
+        (WebKit::WebPopupMenuProxyQt::showPopupMenu):
+        (WebKit::WebPopupMenuProxyQt::hidePopupMenu):
+
+2012-08-06  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [WK2][GTK] Implement a new spell checker API for WebKit2GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=90268
+
+        Reviewed by Martin Robinson.
+
+        Add a simple spell checking API to WK2, allowing to enable/disable
+        this feature and to define a list of languages associated to it.
+
+        * GNUmakefile.am: Add flags to handle the SPELLCHECK feature.
+        * GNUmakefile.list.am: Added new files
+
+        Added new internal class that will act both as the implementation
+        of TextCheckerClient and as the object WebKitWebContext will
+        depend on to implement the newly added API.
+
+        * UIProcess/API/gtk/WebKitTextChecker.cpp: Added.
+        (toTextChecker):
+        (continuousSpellCheckingEnabledCallback):
+        (setContinuousSpellCheckingEnabledCallback):
+        (checkSpellingOfStringCallback):
+        (guessesForWordCallback):
+        (learnWordCallback):
+        (ignoreWordCallback):
+        (WebKitTextChecker::~WebKitTextChecker):
+        (WebKitTextChecker::create):
+        (WebKitTextChecker::WebKitTextChecker):
+        (WebKitTextChecker::checkSpellingOfString):
+        (WebKitTextChecker::getGuessesForWord):
+        (WebKitTextChecker::learnWord):
+        (WebKitTextChecker::ignoreWord):
+        (WebKitTextChecker::setSpellCheckingEnabled):
+        (WebKitTextChecker::setSpellCheckingLanguages):
+        * UIProcess/API/gtk/WebKitTextChecker.h: Added.
+        (WebKitTextChecker):
+        (WebKitTextChecker::isSpellCheckingEnabled):
+        (WebKitTextChecker::getSpellCheckingLanguages):
+
+        Added WKTextChecker to WebKitPrivate.h, needed in WebKitTextChecker.
+
+        * UIProcess/API/gtk/WebKitPrivate.h:
+
+        Add new API to WebKitWebContext to allow enabling/disabling this
+        spell checking feature, and to set/get the list of languages used
+        to decide which dictionaries will be consulted.
+
+        * UIProcess/API/gtk/WebKitWebContext.cpp:
+        (_WebKitWebContextPrivate):
+        (createDefaultWebContext):
+        (webkit_web_context_get_spell_checking_enabled): New API.
+        (webkit_web_context_set_spell_checking_enabled): Ditto.
+        (webkit_web_context_get_spell_checking_languages): Ditto.
+        (webkit_web_context_set_spell_checking_languages): Ditto.
+        * UIProcess/API/gtk/WebKitWebContext.h:
+
+        New tests for checking the new API added to WebKitWebContext.
+
+        * UIProcess/API/gtk/tests/TestWebKitWebContext.cpp:
+        (testWebContextSpellChecker):
+        (beforeAll):
+
+        Update documentation with new sections and symbols.
+
+        * UIProcess/API/gtk/docs/webkit2gtk-docs.sgml:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt:
+
+2012-08-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        Assert in checkValidity() in hashtable.h from WebGeolocationManager::didFailToDeterminePosition() when fetching http://html5demos.com/geo
+        https://bugs.webkit.org/show_bug.cgi?id=80386
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebKit2's WebGeolocationManager was delivering events without accounting that each event
+        can modify the list of page that need delivery.
+        Any page can remove itself by invoking clearWatch() from the callback function. A page can also cause another
+        page to be removed.
+
+        This patch solves the issue by taking a copy of the list of page before delivery. Each page is
+        referenced as it can be deleted during the delivery.
+
+        Unfortunately, this cannot be tested due to missing features of WebKitTestRunner.
+
+        * WebProcess/Geolocation/WebGeolocationManager.cpp:
+        (WebKit::WebGeolocationManager::didChangePosition):
+        (WebKit::WebGeolocationManager::didFailToDeterminePosition):
+
+2012-08-04  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] UI_SIDE_COMPOSITING code has confusing names
+        https://bugs.webkit.org/show_bug.cgi?id=93164
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Renamed and consolidated code guarded under UI_SIDE_COMPOSITING, now under
+        USE(COORDINATED_GRAPHICS) guard and CoordinatedGraphics folders.
+
+        * CMakeLists.txt:
+        * DerivedSources.pri:
+        * Shared/WebCoreArgumentCoders.cpp:
+        (CoreIPC):
+        * Shared/WebCoreArgumentCoders.h:
+        * Shared/WebLayerTreeInfo.cpp:
+        * Shared/WebLayerTreeInfo.h:
+        * Target.pri:
+        * UIProcess/API/qt/qquickwebpage.cpp:
+        (QQuickWebPage::updatePaintNode):
+        * UIProcess/API/qt/raw/qrawwebview.cpp:
+        (QRawWebView::paint):
+        * UIProcess/CoordinatedGraphics/CoordinatedBackingStore.cpp: Renamed from Source/WebKit2/UIProcess/texmap/LayerBackingStore.cpp.
+        * UIProcess/CoordinatedGraphics/CoordinatedBackingStore.h: Renamed from Source/WebKit2/UIProcess/texmap/LayerBackingStore.h.
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp: Renamed from Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.cpp.
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h: Renamed from Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.h.
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in: Renamed from Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.messages.in.
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp: Renamed from Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp.
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.h: Renamed from Source/WebKit2/UIProcess/WebLayerTreeRenderer.h.
+        * UIProcess/DrawingAreaProxy.cpp:
+        (WebKit):
+        * UIProcess/DrawingAreaProxy.h:
+        (DrawingAreaProxy):
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::DrawingAreaProxyImpl):
+        (WebKit::DrawingAreaProxyImpl::enterAcceleratedCompositingMode):
+        (WebKit):
+        * UIProcess/DrawingAreaProxyImpl.h:
+        (DrawingAreaProxyImpl):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didReceiveMessage):
+        * UIProcess/qt/QtWebPageSGNode.cpp:
+        (WebKit::ContentsSGNode::ContentsSGNode):
+        (WebKit::ContentsSGNode::layerTreeRenderer):
+        (ContentsSGNode):
+        (WebKit::QtWebPageSGNode::setRenderer):
+        * UIProcess/qt/QtWebPageSGNode.h:
+        (WebKit):
+        (QtWebPageSGNode):
+        * WebKit2.pri:
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::scheduleAnimation):
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp: Renamed from Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.cpp.
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h: Renamed from Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.h.
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp: Renamed from Source/WebKit2/WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp.
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h: Renamed from Source/WebKit2/WebProcess/WebPage/TiledBackingStoreRemoteTile.h.
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp: Renamed from Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.cpp.
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h: Renamed from Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.h.
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in: Renamed from Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.messages.in.
+        * WebProcess/WebPage/DrawingArea.h:
+        (DrawingArea):
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit):
+        * WebProcess/WebPage/DrawingAreaImpl.h:
+        (DrawingAreaImpl):
+        * WebProcess/WebPage/LayerTreeHost.h:
+        (LayerTreeHost):
+        * WebProcess/WebPage/UpdateAtlas.cpp:
+        * WebProcess/WebPage/UpdateAtlas.h:
+        * WebProcess/qt/WebProcessMainQt.cpp:
+        (WebKit::WebProcessMainQt):
+
+2012-08-04  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2] Move WebIntentData from Shared to UIProcess
+        https://bugs.webkit.org/show_bug.cgi?id=93175
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move WebIntentData from Shared to UIProcess to
+        prepare for MessagePorts support in WK2.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UIProcess/WebIntentData.cpp: Renamed from Source/WebKit2/Shared/WebIntentData.cpp.
+        (WebKit):
+        (WebKit::WebIntentData::WebIntentData):
+        (WebKit::WebIntentData::data):
+        (WebKit::WebIntentData::suggestions):
+        (WebKit::WebIntentData::extra):
+        (WebKit::WebIntentData::extras):
+        * UIProcess/WebIntentData.h: Renamed from Source/WebKit2/Shared/WebIntentData.h.
+        (WebKit):
+        (WebIntentData):
+        (WebKit::WebIntentData::create):
+        (WebKit::WebIntentData::~WebIntentData):
+        (WebKit::WebIntentData::action):
+        (WebKit::WebIntentData::payloadType):
+        (WebKit::WebIntentData::service):
+        (WebKit::WebIntentData::store):
+        (WebKit::WebIntentData::type):
+
+2012-08-03  Anders Carlsson  <andersca@apple.com>
+
+        Nothing happens when clicking on the unavailable plug-in button for a blocked plug-in
+        https://bugs.webkit.org/show_bug.cgi?id=93161
+
+        Reviewed by John Sullivan.
+
+        Be more robust against values being added to the RenderEmbeddedObject::PluginUnavailabilityReason
+        enumeration, and use a switch statement instead of blindly casting the type value to a WKPluginUnavailabilityReason.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::unavailablePluginButtonClicked):
+
+2012-08-03  Brady Eidson  <beidson@apple.com>
+
+        Small part of "Out-of-process plug-ins should support asynchronous initialization."
+        <rdar://problem/10598594> and https://bugs.webkit.org/show_bug.cgi?id=92919
+
+        Unreviewed (build fix).
+
+        * Shared/WebPreferencesStore.h:
+        (WebKit): Include this file which has the declaration of the new pref.
+
+2012-08-03  Brady Eidson  <beidson@apple.com>
+
+        Small part of "Out-of-process plug-ins should support asynchronous initialization."
+        <rdar://problem/10598594> and https://bugs.webkit.org/show_bug.cgi?id=92919
+
+        Reviewed by Anders Carlsson.
+
+        -Add API-level preferences for forcing asynchronous initialization of all plug-ins (for testing).
+        -Make sure "overridePreference" is hooked up properly for all needed preferences.
+
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetAsynchronousPluginInitializationEnabledForAllPlugins):
+        (WKPreferencesGetAsynchronousPluginInitializationEnabledForAllPlugins):
+        * UIProcess/API/C/WKPreferencesPrivate.h:
+
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner):
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+        (WebKit::WebPage::updatePreferences):
+        * WebProcess/WebPage/WebPage.h:
+        (WebKit::WebPage::setAsynchronousPluginInitializationEnabled):
+        (WebKit::WebPage::asynchronousPluginInitializationEnabledForAllPlugins):
+        (WebKit::WebPage::setAsynchronousPluginInitializationEnabledForAllPlugins):
+        (WebKit::WebPage::setArtificialPluginInitializationDelayEnabled):
+        (WebPage):
+
+2012-08-02  Jeffrey Pfau  <jpfau@apple.com>
+
+        Add API for enabling blanket third-party data blocking
+        https://bugs.webkit.org/show_bug.cgi?id=93022
+
+        Reviewed by Anders Carlsson.
+
+        Added API for enabling third-party storage blocking.
+
+        * Shared/WebPreferencesStore.h:
+        (WebKit):
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetThirdPartyStorageBlockingEnabled):
+        (WKPreferencesGetThirdPartyStorageBlockingEnabled):
+        * UIProcess/API/C/WKPreferences.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences):
+
+2012-08-03  Hugo Parente Lima  <hugo.lima@openbossa.org>
+
+        [Qt][WK2] There's no way to test the gesture tap on WTR
+        https://bugs.webkit.org/show_bug.cgi?id=92895
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add an instance of QtViewportHandler to QQuickWebViewPrivate, so it's
+        now available on mobile and desktop modes, as a side effect gesture tap
+        events can now be created and sent to WebCore.
+
+        This is needed to test tap gestures and to get tap gestures working
+        when you have a WebView (in desktop mode) on notebooks equipped with
+        touch screens.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::onComponentComplete):
+        (QQuickWebViewFlickablePrivate::onComponentComplete): Implementation
+        moved to QQuickWebViewPrivate::onComponentComplete.
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        (QQuickWebViewFlickablePrivate):
+
+2012-08-02  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] Move some WebContext messages to WebProcessProxy
+        https://bugs.webkit.org/show_bug.cgi?id=93046
+
+        Reviewed by Anders Carlsson.
+
+        * UIProcess/WebContext.cpp: (WebKit::WebContext::didReceiveSyncMessage): Unrelated
+        fix - use actual process argument instead of second-guessing where the message came
+        from.
+
+        * UIProcess/WebContext.h: (WebKit::WebContext::historyClient): Expose history client,
+        since WebProcessProxy now needs it.
+
+        * UIProcess/WebContext.messages.in:
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::didNavigateWithNavigationData):
+        (WebKit::WebProcessProxy::didPerformClientRedirect):
+        (WebKit::WebProcessProxy::didPerformServerRedirect):
+        (WebKit::WebProcessProxy::didUpdateHistoryTitle):
+        * UIProcess/WebProcessProxy.h:
+        * UIProcess/WebProcessProxy.messages.in:
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::updateGlobalHistory):
+        (WebKit::WebFrameLoaderClient::updateGlobalHistoryRedirectLinks):
+        (WebKit::WebFrameLoaderClient::setTitle):
+        Move the messages.
+
+2012-08-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Unreviewed, rolling out r124603.
+        http://trac.webkit.org/changeset/124603
+        https://bugs.webkit.org/show_bug.cgi?id=93077
+
+        Made a few tests crash under
+        LayerTreeCoordinator::flushPendingLayerChanges
+
+        * WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::LayerTreeCoordinator):
+        (WebKit::LayerTreeCoordinator::forceRepaint):
+        (WebKit::LayerTreeCoordinator::layerTreeTileUpdatesAllowed):
+        * WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+
+2012-08-03  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Unreviewed build fix for GTK after r124479.
+
+        * UIProcess/WebInspectorProxy.cpp:
+        (WebKit): Moved static const definitions from header file.
+        * UIProcess/WebInspectorProxy.h:
+        (WebInspectorProxy): Don't give values to static const members
+        here.
+
+2012-08-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [WK2] LayerTreeCoordinator can disallow tile updates in forceRepaint
+        https://bugs.webkit.org/show_bug.cgi?id=93077
+
+        Reviewed by Jocelyn Turcotte.
+
+        Force tile updates when doing a forced repaint.
+
+        * WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::LayerTreeCoordinator):
+        (WebKit::LayerTreeCoordinator::forceRepaint):
+        (WebKit::LayerTreeCoordinator::layerTreeTileUpdatesAllowed):
+        * WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+
+2012-08-02  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Inspector should set a default attached height before being attached
+        https://bugs.webkit.org/show_bug.cgi?id=90767
+
+        Reviewed by Xan Lopez.
+
+        We are currently using the minimum attached height in
+        WebKitWebViewBase as the default height for the inspector when
+        attached. It would be easier for WebKitWebViewBase and embedders
+        implementing attach() if the inspector already had an attached
+        height set when it's being attached.
+
+        * UIProcess/API/gtk/WebKitWebViewBase.cpp:
+        (webkitWebViewBaseContainerAdd): Don't initialize
+        inspectorViewHeight.
+        (webkitWebViewBaseSetInspectorViewHeight): Allow to set the
+        inspector view height before having an inpector view, but only
+        queue a resize when the view already has an inspector view.
+        * UIProcess/API/gtk/tests/TestInspector.cpp:
+        (testInspectorDefault):
+        (testInspectorManualAttachDetach):
+        * UIProcess/gtk/WebInspectorProxyGtk.cpp:
+        (WebKit::WebInspectorProxy::platformAttach): Set the default
+        attached height before attach the inspector view.
+
+2012-08-02  Dinu Jacob  <dinu.jacob@nokia.com>
+
+        WebKitTestRunner needs layoutTestController.setUserStyleSheetEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=42679
+
+        Reviewed by Eric Seidel.
+
+        Added WKBundleSetUserStyleSheetLocation API.
+
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundleSetUserStyleSheetLocation): Added.
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h: Added WKBundleSetUserStyleSheetLocation.
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::setUserStyleSheetLocation): Added. Sets the user style sheet location
+        for all pages in the page group.
+        (WebKit):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+        (InjectedBundle):
+
+2012-08-02  Lauro Neto  <lauro.neto@openbossa.org>
+
+        [Qt] Fix axis locking when panning on N9
+        https://bugs.webkit.org/show_bug.cgi?id=92394
+
+        Reviewed by Simon Hausmann.
+
+        Make the QQuickWebView axis locker calculate the
+        time between events using QInputEvent.timestamp, which
+        is set from the native event when available.
+
+        Also use touchPoint.pos() instead of screenPos() to
+        correct the axis detection when running on N9, which
+        has a native landscape display and the applications usually
+        run in portrait mode.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::FlickableAxisLocker::FlickableAxisLocker):
+        (QQuickWebViewPrivate::FlickableAxisLocker::touchVelocity):
+        (QQuickWebViewPrivate::FlickableAxisLocker::update):
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (FlickableAxisLocker):
+
+2012-08-02  Hyerim Bae  <hyerim.bae@samsung.com>
+
+        [EFL][WK2]Add ewk_view_ui_client.
+        https://bugs.webkit.org/show_bug.cgi?id=89864
+
+        Reviewed by Kentaro Hara.
+
+        Add ewk_view_ui_client.h / cpp files for wrapping WKPageSetPageUIClient,
+        add close, createNewPage callback member to WKPageSetPageUIClient.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_base_add):
+        (ewk_view_page_close):
+        (ewk_view_page_create):
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/ewk_view_private.h:
+        * UIProcess/API/efl/ewk_view_ui_client.cpp: Added.
+        (toEwkView):
+        (closePage):
+        (createNewPage):
+        (ewk_view_ui_client_attach):
+        * UIProcess/API/efl/ewk_view_ui_client_private.h: Added.
+
+2012-08-02  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] No main resource in WebView on load committed when page has been loaded from history cache
+        https://bugs.webkit.org/show_bug.cgi?id=91482
+
+        Reviewed by Martin Robinson.
+
+        We assume that on load committed, we already have a main resource
+        in the web view, and it has already received a response. This is
+        not true for pages loaded from the history cache, so when going
+        back/forward, we don't have a main resource when the
+        load-committed signal is emitted. We must ensure that the loading
+        process documented in the API is the same for pages loaded from
+        the history cache too.
+
+        * UIProcess/API/gtk/WebKitLoaderClient.cpp:
+        (didCommitLoadForFrame): Call webkitWebViewLoadChanged() and let
+        the web view handle the certificate.
+        * UIProcess/API/gtk/WebKitWebResource.cpp:
+        (webkitWebResourceGetFrame): Helper private function to easily get
+        the WKFrame associated with a WebResource.
+        * UIProcess/API/gtk/WebKitWebResourcePrivate.h:
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkitWebViewDisconnectMainResourceResponseChangedSignalHandler):
+        Disconnect the notify::response signal of the main resource.
+        (webkitWebViewFinalize): Call
+        webkitWebViewDisconnectMainResourceResponseChangedSignalHandler().
+        (setCertificateToMainResource): Set the TLS certificate on the
+        response of the main resource.
+        (webkitWebViewEmitLoadChanged): Helper function to emit
+        load-chancged signal.
+        (webkitWebViewEmitDelayedLoadEvents): If we were waiting for the
+        main resource, emit the signals that were delayed.
+        (webkitWebViewLoadChanged): Do not emit committed or finished if
+        we are still waiting for the main resource. Set the TLS
+        certificate if we already have a main resource or wait until we
+        have the main resource with a response.
+        (mainResourceResponseChangedCallback): Emitted when the main
+        resource received the response. Set the certificate on the
+        response and emit load signals delayed.
+        (waitForMainResourceResponseIfWaitingForResource): If we are
+        waiting for the main resource, connect to the notify::response
+        signal of the WebResource to make sure it has a response already
+        when load signal delayed are emitted.
+        (webkitWebViewResourceLoadStarted): Call
+        waitForMainResourceResponseIfWaitingForResource().
+        * UIProcess/API/gtk/tests/LoadTrackingTest.cpp:
+        (loadChangedCallback):
+        (LoadTrackingTest::goBack):
+        (LoadTrackingTest::goForward):
+        * UIProcess/API/gtk/tests/LoadTrackingTest.h:
+        (LoadTrackingTest):
+        * UIProcess/API/gtk/tests/TestLoaderClient.cpp:
+        (testWebViewHistoryLoad):
+        (serverCallback):
+        (beforeAll):
+
+2012-08-02  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Click, mouse and links rely on touch mocking.
+        https://bugs.webkit.org/show_bug.cgi?id=83091
+
+        Reviewed by Simon Hausmann.
+
+        Send the incoming mouse events directly to the gesture recognizers to make
+        the WebView behave consistent with other Flickables.
+        This patch unifies the code paths for input events and makes it possible
+        to enable mouse events on the flickable web view again, thus makes the
+        mobile-version of QQuickWebView usable on desktop.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::handleMouseEvent):
+        (QQuickWebViewFlickablePrivate::QQuickWebViewFlickablePrivate):
+        (QQuickWebViewFlickablePrivate::handleMouseEvent):
+        (QQuickWebView::mousePressEvent):
+        (QQuickWebView::mouseMoveEvent):
+        (QQuickWebView::mouseReleaseEvent):
+        (QQuickWebView::mouseDoubleClickEvent):
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        (QQuickWebViewFlickablePrivate):
+        * UIProcess/qt/QtPanGestureRecognizer.cpp:
+        (WebKit::QtPanGestureRecognizer::update):
+        * UIProcess/qt/QtWebPageEventHandler.cpp:
+        (WebKit::QtWebPageEventHandler::QtWebPageEventHandler):
+        (WebKit::QtWebPageEventHandler::handleInputEvent):
+        (WebKit):
+        (WebKit::QtWebPageEventHandler::doneWithTouchEvent):
+        * UIProcess/qt/QtWebPageEventHandler.h:
+        (QtWebPageEventHandler):
+
+2012-08-01  Brady Eidson  <beidson@apple.com>
+
+        Small part of "Out-of-process plug-ins should support asynchronous initialization."
+        <rdar://problem/10598594> and https://bugs.webkit.org/show_bug.cgi?id=92919
+
+        Reviewed by Anders Carlsson.
+
+        Add API-level preferences for:
+        - Is asynchronous plug-in initialization enabled.
+        - Is an artificial initialization delay (for testing purposes) enabled.
+
+        * Shared/WebPreferencesStore.h:
+        (WebKit):
+
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetAsynchronousPluginInitializationEnabled):
+        (WKPreferencesGetAsynchronousPluginInitializationEnabled):
+        (WKPreferencesSetArtificialPluginInitializationDelayEnabled):
+        (WKPreferencesGetArtificialPluginInitializationDelayEnabled):
+        * UIProcess/API/C/WKPreferencesPrivate.h:
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+        (WebKit::WebPage::updatePreferences):
+        * WebProcess/WebPage/WebPage.h:
+        (WebKit::WebPage::asynchronousPluginInitializationEnabled):
+        (WebKit::WebPage::artificialPluginInitializationDelayEnabled):
+        (WebPage):
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port
+        https://bugs.webkit.org/show_bug.cgi?id=90298
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig: Add ENABLE_WIDGET_REGION define.
+
+2012-08-01  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        [Qt][WK2] Race condition between first layout and viewport attributes initialization
+        https://bugs.webkit.org/show_bug.cgi?id=92902
+
+        Reviewed by Noam Rosenthal.
+
+        Initializing m_rawAttributes from QtViewportHandler to avoid calculation of random
+        scale factors on the first layout is triggered.
+
+        * UIProcess/qt/QtViewportHandler.cpp:
+        (WebKit::QtViewportHandler::QtViewportHandler):
+
+2012-08-01  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt]REGRESSION(r123786): It made 3 fast/animation tests fail.
+        https://bugs.webkit.org/show_bug.cgi?id=92490
+
+        Make sure that scripted animations are also serviced when
+        forceRepaint is being executed. As this is what is being used for
+        running layout tests.
+        Move servicing of scripted animations and layoutIfNeeded call
+        into a separate function syncDisplayState.
+        This function can then be called from forceRepaint as well as from
+        performScheduledLayerFlush.
+
+        Reviewed by Noam Rosenthal.
+
+        * WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::forceRepaint):
+        (WebKit::LayerTreeCoordinator::performScheduledLayerFlush):
+        (WebKit):
+        (WebKit::LayerTreeCoordinator::syncDisplayState):
+        * WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+
+2012-08-01  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix GTK+ build with recent version of GTK+.
+
+        Use g_threads_enter/leave instead of the wrapper macros. This
+        gives a compile warning because they are now deprecated but at
+        least it builds.
+
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkitWebViewRunAsModal): Fix enter/leave order.
+        * UIProcess/gtk/WebPopupMenuProxyGtk.cpp:
+        (WebKit::WebPopupMenuProxyGtk::showPopupMenu):
+
+2012-07-31  Anders Carlsson  <andersca@apple.com>
+
+        Prefer the Oracle Java plug-in over the Apple Java plug-in
+        https://bugs.webkit.org/show_bug.cgi?id=92780
+
+        Reviewed by Oliver Hunt.
+
+        * UIProcess/Plugins/mac/PluginInfoStoreMac.mm:
+        (WebKit::findPluginWithBundleIdentifier):
+        Add a new helper for finding a plug-in with the given bundle identifier.
+
+        (WebKit::checkForPreferredPlugin):
+        Helper function for making sure that an old plug-in is never loaded if a new plug-in is found, and that the old plug-in
+        is removed from the list of loaded plug-ins if the new plug-in is found.
+
+        (WebKit::PluginInfoStore::shouldUsePlugin):
+        Prefer the Oracle Java plug-in over the Apple Java plug-in.
+
+2012-07-31  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] Use an actual WebProcessProxy when decoding messages
+        https://bugs.webkit.org/show_bug.cgi?id=92788
+
+        Reviewed by Anders Carlsson.
+
+        WebContextUserMessageDecoder gets process proxy from a WebContext object, but we
+        know which process a message came from, and can just use that.
+
+        * UIProcess/WebContextUserMessageCoders.h:
+        (WebKit::WebContextUserMessageDecoder::WebContextUserMessageDecoder):
+        (WebKit::WebContextUserMessageDecoder::decode):
+        This is the focal point of this patch - decoder no longer needs to call m_context->process().
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::didReceiveMessage):
+        (WebKit::WebContext::didReceiveSyncMessage):
+        * UIProcess/WebContext.h:
+        These methods now take a WebProcessProxy pointer instead of IPC::Connection,
+        so that they can call the updated coder.
+        A number of other didReceiveMessage can be modified to take WebProcessProxy later
+        if needed (it's a richer interface than IPC::Connection), although not all messages
+        come from WebProcesses.
+
+        * UIProcess/WebConnectionToWebProcess.cpp:
+        (WebKit::WebConnectionToWebProcess::didReceiveMessage):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::willGoToBackForwardListItem):
+        (WebKit::WebPageProxy::registerIntentServiceForFrame):
+        (WebKit::WebPageProxy::didStartProvisionalLoadForFrame):
+        (WebKit::WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame):
+        (WebKit::WebPageProxy::didFailProvisionalLoadForFrame):
+        (WebKit::WebPageProxy::didCommitLoadForFrame):
+        (WebKit::WebPageProxy::didFinishDocumentLoadForFrame):
+        (WebKit::WebPageProxy::didFinishLoadForFrame):
+        (WebKit::WebPageProxy::didFailLoadForFrame):
+        (WebKit::WebPageProxy::didSameDocumentNavigationForFrame):
+        (WebKit::WebPageProxy::didReceiveTitleForFrame):
+        (WebKit::WebPageProxy::didFirstLayoutForFrame):
+        (WebKit::WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame):
+        (WebKit::WebPageProxy::didNewFirstVisuallyNonEmptyLayout):
+        (WebKit::WebPageProxy::didRemoveFrameFromHierarchy):
+        (WebKit::WebPageProxy::didDisplayInsecureContentForFrame):
+        (WebKit::WebPageProxy::didRunInsecureContentForFrame):
+        (WebKit::WebPageProxy::didDetectXSSForFrame):
+        (WebKit::WebPageProxy::didReceiveIntentForFrame):
+        (WebKit::WebPageProxy::decidePolicyForNavigationAction):
+        (WebKit::WebPageProxy::decidePolicyForNewWindowAction):
+        (WebKit::WebPageProxy::decidePolicyForResponse):
+        (WebKit::WebPageProxy::unableToImplementPolicy):
+        (WebKit::WebPageProxy::willSubmitForm):
+        (WebKit::WebPageProxy::mouseDidMoveOverElement):
+        (WebKit::WebPageProxy::internalShowContextMenu):
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::didReceiveMessage):
+        (WebKit::WebProcessProxy::didReceiveSyncMessage):
+        Updated arguments accordingly.
+
+2012-07-31  Andras Becsi  <andras.becsi@nokia.com>
+
+        [WK2] Visible content rect update with null trajectory vector does not reach the backing store
+        https://bugs.webkit.org/show_bug.cgi?id=92750
+
+        Reviewed by Jocelyn Turcotte.
+
+        Make sure that notifications with a null trajectory vector reach the backing store
+        since a null vector means that all tiles around the viewport were requested.
+
+        * WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::setVisibleContentsRect):
+
+2012-07-31  Marcelo Lira  <marcelo.lira@openbossa.org>
+
+        [Qt] Input method update should also include hints
+        https://bugs.webkit.org/show_bug.cgi?id=92744
+
+        Reviewed by Simon Hausmann.
+
+        The QInputMethod is told to query for input method hints when updated.
+
+        * UIProcess/qt/QtWebPageEventHandler.cpp:
+        (WebKit::QtWebPageEventHandler::updateTextInputState):
+
+2012-07-31  Danilo Cesar Lemes de Paula  <danilo.cesar@collabora.co.uk>
+
+        add Farstream flags/deps to WebKit, for WebRTC
+        https://bugs.webkit.org/show_bug.cgi?id=87524
+
+        Reviewed by Philippe Normand.
+
+        Since Farstream will be used as the backend for GTK's WebRTC, this
+        patch adds it as a dependency to the build system.
+
+        * GNUmakefile.am:
+
+2012-07-30  Huang Dongsung  <luxtella@company100.net>
+
+        [Texmap] Remove the backing store after 'style.visibility' for an element sets 'hidden'.
+        https://bugs.webkit.org/show_bug.cgi?id=92492
+
+        Reviewed by Noam Rosenthal.
+
+        Texmap handles visibility:hidden in this patch, so WebGraphicsLayer
+        sends the LayerTreeCoordinatorProxyMessages with additional infomation
+        to UIProcess.
+
+        * Shared/WebLayerTreeInfo.h:
+        * UIProcess/WebLayerTreeRenderer.cpp:
+        (WebKit::WebLayerTreeRenderer::setLayerState):
+        * WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.cpp:
+        (WebCore::WebGraphicsLayer::setContentsVisible):
+        (WebCore):
+        (WebCore::WebGraphicsLayer::syncLayerState):
+        * WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.h:
+        (WebGraphicsLayer):
+
+2012-07-30  Sam Weinig  <sam@webkit.org>
+
+        Add a proper umbrella header for the public WebKit2 API headers
+        https://bugs.webkit.org/show_bug.cgi?id=92708
+        <rdar://problem/11970825>
+
+        Reviewed by Dan Bernstein.
+
+        Create a new umbrella WebKit2.h and add the currently public (as decided by their 
+        status in Xcode) Objective-C headers.
+
+        * UIProcess/API/mac/WebKit2.h: Added.
+        * WebKit2.xcodeproj/project.pbxproj:
+        While we are here, make WebKit2_C.h a private header.
+
+2012-07-30  Sam Weinig  <sam@webkit.org>
+
+        Rename WebKit2.h to WebKit2_C.h
+        https://bugs.webkit.org/show_bug.cgi?id=92704
+
+        Reviewed by Dan Bernstein.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UIProcess/API/C/WebKit2_C.h: Renamed from Source/WebKit2/UIProcess/API/C/WebKit2.h.
+        * UIProcess/API/gtk/WebKitBackForwardListPrivate.h:
+        * UIProcess/API/gtk/WebKitPolicyDecisionPrivate.h:
+        * UIProcess/API/gtk/WebKitPrivate.h:
+        * UIProcess/API/gtk/WebKitSettingsPrivate.h:
+        * UIProcess/API/gtk/WebKitWebViewPrivate.h:
+        * WebKit2.xcodeproj/project.pbxproj:
+        * win/WebKit2.vcproj:
+        * win/WebKit2Generated.make:
+        Update for changed header file name.
+
+2012-07-28  Sam Weinig  <sam@webkit.org>
+
+        Add ability to load from a string to the ObjC WK API
+        https://bugs.webkit.org/show_bug.cgi?id=92590
+
+        Reviewed by Dan Bernstein.
+
+        This adds an often used method to the new Objective-C API and will
+        be helpful for writing API tests.
+
+        * UIProcess/API/mac/WKBrowsingContextController.h:
+        * UIProcess/API/mac/WKBrowsingContextController.mm:
+        (-[WKBrowsingContextController loadHTMLString:baseURL:]):
+        Implement via calling down to WKPageLoadHTMLString.
+
+2012-07-30  Rafael Brandao  <rafael.lobo@openbossa.org>
+
+        [WK2] Kill the concept of secondary shared process
+        https://bugs.webkit.org/show_bug.cgi?id=92676
+
+        Reviewed by Alexey Proskuryakov.
+
+        Build fix after r124092.
+
+        * UIProcess/qt/QtWebContext.cpp: Build fix for Qt. In exchange of the
+        method removed, I've used WebContext::create(String()).
+
+2012-07-30  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] Kill the concept of secondary shared process
+        https://bugs.webkit.org/show_bug.cgi?id=92676
+
+        Reviewed by Sam Weinig.
+
+        * UIProcess/API/C/WKContext.cpp:
+        * UIProcess/API/C/WKContext.h:
+        * UIProcess/WebContext.cpp:
+        * UIProcess/WebContext.h:
+        Deleted shared process related code. We don't need to build the singleton into
+        the cross-platform C API, platform-specific API wrappers are perfectly capable
+        of doing that.
+
+        * UIProcess/API/efl/ewk_context.cpp: (createDefaultEwkContext):
+        * UIProcess/API/gtk/WebKitWebContext.cpp: (createDefaultWebContext):
+        Use WKContextCreate() when creating default context.
+
+2012-07-30  Claudio Saavedra  <csaavedra@igalia.com>
+
+        [GTK] critical warning: gdk_window_get_cursor() called on a NULL window
+        https://bugs.webkit.org/show_bug.cgi?id=92651
+
+        Reviewed by Martin Robinson.
+
+        PageClientImpl::setCursor() might get called before the
+        window is realized, so safeguard against it.
+
+        * UIProcess/API/gtk/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::setCursor): early return if the window is
+        not realized.
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123983.
+        http://trac.webkit.org/changeset/123983
+        https://bugs.webkit.org/show_bug.cgi?id=92663
+
+        EFL build is broken when unit tests are enabled (Requested by
+        paroga on #webkit).
+
+        * CMakeLists.txt:
+        * PlatformEfl.cmake:
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123966 and r123967.
+        http://trac.webkit.org/changeset/123966
+        http://trac.webkit.org/changeset/123967
+        https://bugs.webkit.org/show_bug.cgi?id=92656
+
+        This patch is causing assertion failures on the debug bot
+        (also rolling out a dependent patch) (Requested by mrobinson
+        on #webkit).
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * UIProcess/API/gtk/WebKitPrivate.h:
+        * UIProcess/API/gtk/WebKitTextChecker.cpp: Removed.
+        * UIProcess/API/gtk/WebKitTextChecker.h: Removed.
+        * UIProcess/API/gtk/WebKitWebContext.cpp:
+        (_WebKitWebContextPrivate):
+        (createDefaultWebContext):
+        * UIProcess/API/gtk/WebKitWebContext.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt:
+        * UIProcess/API/gtk/tests/TestWebKitWebContext.cpp:
+        (beforeAll):
+
+2012-07-29  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Resource agent's reference to cached resources should be weak.
+        https://bugs.webkit.org/show_bug.cgi?id=92108
+
+        Reviewed by Pavel Feldman.
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124000.
+        http://trac.webkit.org/changeset/124000
+        https://bugs.webkit.org/show_bug.cgi?id=92632
+
+        seems to have broken chromium Range_InstanceSizeUnknown unit
+        test across many platforms (Requested by tomhudson on
+        #webkit).
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-07-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Remove accurateVisibleContentsPosition and use a FloatRect for visibleContentsRect instead
+        https://bugs.webkit.org/show_bug.cgi?id=92536
+
+        Reviewed by Noam Rosenthal.
+
+        AccurateVisibleContentsPosition carries the same information as visibleContentsRect.location() and
+        is needed for fixed layer position updates.
+        This patch instead uses a FloatRect for the visible contents rect from the web view down to the
+        LayerCoordinatorProxy, and converts it to an IntRect at this moment, before sending it to the
+        web process.
+        This also moves the check to prevent sending the same rect to the moment of the conversion
+        in LayerTreeCoordinatorProxy to fix a bug where the fixed layer deltas wouldn't be updated
+        unless the integer part of position components changed.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewLegacyPrivate::updateViewportSize):
+        * UIProcess/DrawingAreaProxy.h:
+        (WebKit::DrawingAreaProxy::setVisibleContentsRect):
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::setVisibleContentsRect):
+        * UIProcess/DrawingAreaProxyImpl.h:
+        (DrawingAreaProxyImpl):
+        * UIProcess/LayerTreeCoordinatorProxy.cpp:
+        (WebKit::LayerTreeCoordinatorProxy::LayerTreeCoordinatorProxy):
+        (WebKit::LayerTreeCoordinatorProxy::setVisibleContentsRect):
+        * UIProcess/LayerTreeCoordinatorProxy.h:
+        (LayerTreeCoordinatorProxy):
+        * UIProcess/WebLayerTreeRenderer.cpp:
+        (WebKit::WebLayerTreeRenderer::WebLayerTreeRenderer):
+        (WebKit::WebLayerTreeRenderer::setVisibleContentsRect):
+        (WebKit::WebLayerTreeRenderer::adjustPositionForFixedLayers):
+        * UIProcess/WebLayerTreeRenderer.h:
+        (WebLayerTreeRenderer):
+        * UIProcess/qt/QtViewportHandler.cpp:
+        (WebKit::QtViewportHandler::visibleContentsRect):
+        (WebKit::QtViewportHandler::informVisibleContentChange):
+        * UIProcess/qt/QtViewportHandler.h:
+        (QtViewportHandler):
+
+2012-07-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Fix issues remaining with fixed positioned layers
+        https://bugs.webkit.org/show_bug.cgi?id=92528
+
+        Reviewed by Noam Rosenthal.
+
+        This partially fixes jittering of fixed layers when zoomed in and the
+        blurriness of rendered tiles of the non-composited contents layer.
+
+        * UIProcess/WebLayerTreeRenderer.cpp:
+        (WebKit::boundedScrollPosition):
+        (WebKit::WebLayerTreeRenderer::paintToCurrentGLContext):
+        Remove the adjustment on the root layer. This cancels setPixelAligned and causes the blurriness.
+        (WebKit::WebLayerTreeRenderer::adjustPositionForFixedLayers):
+        Use m_accurateVisibleContentsPosition to calculate the delta.
+        (WebKit::WebLayerTreeRenderer::didChangeScrollPosition):
+
 2012-07-29  Vsevolod Vlasov  <vsevik@chromium.org>
 
         Web Inspector: Resource agent's reference to cached resources should be weak.
diff --git a/Source/WebKit2/Configurations/FeatureDefines.xcconfig b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
index 49182f3a0..1da0cc82f 100644
--- a/Source/WebKit2/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
@@ -40,6 +40,7 @@ ENABLE_CSP_NEXT = ;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
+ENABLE_CSS_HIERARCHIES = ;
 ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
@@ -133,7 +134,9 @@ ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
 ENABLE_WEB_TIMING = ;
+ENABLE_WIDGET_REGION = $(ENABLE_WIDGET_REGION_$(REAL_PLATFORM_NAME));
+ENABLE_WIDGET_REGION_macosx = ENABLE_WIDGET_REGION;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WIDGET_REGION) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebKit2/Configurations/Version.xcconfig b/Source/WebKit2/Configurations/Version.xcconfig
index a80c98ad7..fef7ac72e 100644
--- a/Source/WebKit2/Configurations/Version.xcconfig
+++ b/Source/WebKit2/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 3;
+MINOR_VERSION = 6;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit2/Configurations/WebKit2Service.xcconfig b/Source/WebKit2/Configurations/WebKit2Service.xcconfig
new file mode 100644
index 000000000..f78892996
--- /dev/null
+++ b/Source/WebKit2/Configurations/WebKit2Service.xcconfig
@@ -0,0 +1,40 @@
+// Copyright (C) 2012 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+#include "BaseTarget.xcconfig"
+
+GCC_ENABLE_OBJC_GC = NO;
+PRODUCT_NAME = com.apple.WebKit2.$(TARGET_NAME:rfc1034identifier);
+INFOPLIST_FILE = WebKit2Service/Info.plist;
+INSTALL_PATH = $(WEBKIT2_FRAMEWORKS_DIR)/WebKit2.framework;
+
+APP_ICON = $(APP_ICON_$(CONFIGURATION));
+APP_ICON_Debug = WebKit.icns;
+APP_ICON_Release = WebKit.icns;
+APP_ICON_Production = ;
+
+EXCLUDED_SOURCE_FILE_NAMES = $(EXCLUDED_SOURCE_FILE_NAMES_$(CONFIGURATION));
+EXCLUDED_SOURCE_FILE_NAMES_Production = WebKit.icns;
+
+WRAPPER_EXTENSION = xpc;
+MACH_O_TYPE = mh_execute;
diff --git a/Source/WebKit2/DerivedSources.pri b/Source/WebKit2/DerivedSources.pri
index 42fa6657a..26cbb2b85 100644
--- a/Source/WebKit2/DerivedSources.pri
+++ b/Source/WebKit2/DerivedSources.pri
@@ -51,8 +51,10 @@ VPATH = \
     WebProcess/ResourceCache \
     WebProcess/WebCoreSupport \
     WebProcess/WebPage \
+    WebProcess/WebPage/CoordinatedGraphics \
     WebProcess \
     UIProcess \
+    UIProcess/CoordinatedGraphics \
     UIProcess/Downloads \
     UIProcess/Notifications \
     UIProcess/Plugins \
@@ -93,10 +95,10 @@ MESSAGE_RECEIVERS = \
     WebNotificationManager.messages.in \
     WebFullScreenManager.messages.in \
     WebFullScreenManagerProxy.messages.in \
-    WebPage/DrawingArea.messages.in \
-    WebPage/LayerTreeCoordinator/LayerTreeCoordinator.messages.in \
-    WebPage/WebInspector.messages.in \
-    WebPage/WebPage.messages.in \
+    DrawingArea.messages.in \
+    LayerTreeCoordinator.messages.in \
+    WebInspector.messages.in \
+    WebPage.messages.in \
     WebPageProxy.messages.in \
     WebProcess.messages.in \
     WebProcessConnection.messages.in \
diff --git a/Source/WebKit2/GNUmakefile.am b/Source/WebKit2/GNUmakefile.am
index eed029672..3edce0aa2 100644
--- a/Source/WebKit2/GNUmakefile.am
+++ b/Source/WebKit2/GNUmakefile.am
@@ -162,6 +162,7 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LIB
 	libWebCoreGtk.la \
 	$(CAIRO_LIBS) \
 	$(COVERAGE_LDFLAGS) \
+	$(FARSTREAM_LIBS) \
 	$(GAIL_LIBS) \
 	$(GAMEPAD_LIBS) \
 	$(GEOCLUE_LIBS) \
@@ -397,6 +398,7 @@ libWebCoreGtk2_la_CPPFLAGS = \
 	$(COVERAGE_CFLAGS) \
 	$(ENCHANT_CFLAGS) \
 	$(GEOCLUE_CFLAGS) \
+	$(FARSTREAM_CFLAGS) \
 	$(GLIB_CFLAGS) \
 	$(GSTREAMER_CFLAGS) \
 	$(GTK2_CFLAGS) \
diff --git a/Source/WebKit2/GNUmakefile.list.am b/Source/WebKit2/GNUmakefile.list.am
index eb6927046..d737bc774 100644
--- a/Source/WebKit2/GNUmakefile.list.am
+++ b/Source/WebKit2/GNUmakefile.list.am
@@ -40,7 +40,7 @@ webkit2_h_api += \
 	$(WebKit2)/UIProcess/API/C/soup/WKAPICastSoup.h \
 	$(WebKit2)/UIProcess/API/C/soup/WKContextSoup.h \
 	$(WebKit2)/UIProcess/API/C/soup/WKSoupRequestManager.h \
-	$(WebKit2)/UIProcess/API/C/WebKit2.h \
+	$(WebKit2)/UIProcess/API/C/WebKit2_C.h \
 	$(WebKit2)/UIProcess/API/C/WKAPICast.h \
 	$(WebKit2)/UIProcess/API/C/WKApplicationCacheManager.h \
 	$(WebKit2)/UIProcess/API/C/WKAuthenticationChallenge.h \
@@ -140,8 +140,6 @@ webkit2_built_sources += \
 	DerivedSources/WebKit2/DrawingAreaProxyMessages.h \
 	DerivedSources/WebKit2/EventDispatcherMessageReceiver.cpp \
 	DerivedSources/WebKit2/EventDispatcherMessages.h \
-	DerivedSources/WebKit2/LayerTreeCoordinatorProxyMessageReceiver.cpp \
-	DerivedSources/WebKit2/LayerTreeCoordinatorProxyMessages.h \
 	DerivedSources/WebKit2/NPObjectMessageReceiverMessageReceiver.cpp \
 	DerivedSources/WebKit2/NPObjectMessageReceiverMessages.h \
 	DerivedSources/WebKit2/PluginControllerProxyMessageReceiver.cpp \
@@ -469,8 +467,6 @@ webkit2_sources += \
 	Source/WebKit2/Shared/WebHitTestResult.h \
 	Source/WebKit2/Shared/WebImage.cpp \
 	Source/WebKit2/Shared/WebImage.h \
-	Source/WebKit2/Shared/WebIntentData.cpp \
-	Source/WebKit2/Shared/WebIntentData.h \
 	Source/WebKit2/Shared/WebIntentServiceInfo.cpp \
 	Source/WebKit2/Shared/WebIntentServiceInfo.h \
 	Source/WebKit2/Shared/WebKeyboardEvent.cpp \
@@ -518,7 +514,7 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/API/C/soup/WKContextSoup.h \
 	Source/WebKit2/UIProcess/API/C/soup/WKSoupRequestManager.cpp \
 	Source/WebKit2/UIProcess/API/C/soup/WKSoupRequestManager.h \
-	Source/WebKit2/UIProcess/API/C/WebKit2.h \
+	Source/WebKit2/UIProcess/API/C/WebKit2_C.h \
 	Source/WebKit2/UIProcess/API/C/WKAPICast.h \
 	Source/WebKit2/UIProcess/API/C/WKApplicationCacheManager.h \
 	Source/WebKit2/UIProcess/API/C/WKApplicationCacheManager.cpp \
@@ -776,11 +772,8 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.h \
 	Source/WebKit2/UIProcess/gtk/WebPreferencesGtk.cpp \
 	Source/WebKit2/UIProcess/Launcher/gtk/ProcessLauncherGtk.cpp \
-	Source/WebKit2/UIProcess/Launcher/gtk/ThreadLauncherGtk.cpp \
 	Source/WebKit2/UIProcess/Launcher/ProcessLauncher.cpp \
 	Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h \
-	Source/WebKit2/UIProcess/Launcher/ThreadLauncher.cpp \
-	Source/WebKit2/UIProcess/Launcher/ThreadLauncher.h \
 	Source/WebKit2/UIProcess/Notifications/NotificationPermissionRequest.cpp \
 	Source/WebKit2/UIProcess/Notifications/NotificationPermissionRequest.h \
 	Source/WebKit2/UIProcess/Notifications/NotificationPermissionRequestManagerProxy.cpp \
@@ -873,6 +866,8 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/WebIconDatabaseClient.h \
 	Source/WebKit2/UIProcess/WebInspectorProxy.cpp \
 	Source/WebKit2/UIProcess/WebInspectorProxy.h \
+	Source/WebKit2/UIProcess/WebIntentData.cpp \
+	Source/WebKit2/UIProcess/WebIntentData.h \
 	Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp \
 	Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.h \
 	Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.cpp \
diff --git a/Source/WebKit2/Platform/CoreIPC/Connection.h b/Source/WebKit2/Platform/CoreIPC/Connection.h
index da9a08a3c..ddf591f32 100644
--- a/Source/WebKit2/Platform/CoreIPC/Connection.h
+++ b/Source/WebKit2/Platform/CoreIPC/Connection.h
@@ -40,6 +40,9 @@
 
 #if OS(DARWIN)
 #include <mach/mach_port.h>
+#if HAVE(XPC)
+#include <xpc/xpc.h>
+#endif
 #elif PLATFORM(WIN)
 #include <string>
 #elif PLATFORM(QT)
@@ -114,12 +117,44 @@ public:
     };
 
 #if OS(DARWIN)
-    typedef mach_port_t Identifier;
+    struct Identifier {
+        Identifier()
+            : port(MACH_PORT_NULL)
+#if HAVE(XPC)
+            , xpcConnection(0)
+#endif
+        {
+        }
+
+        Identifier(mach_port_t port)
+            : port(port)
+#if HAVE(XPC)
+            , xpcConnection(0)
+#endif
+        {
+        }
+
+#if HAVE(XPC)
+        Identifier(mach_port_t port, xpc_connection_t xpcConnection)
+            : port(port)
+            , xpcConnection(xpcConnection)
+        {
+        }
+#endif
+
+        mach_port_t port;
+#if HAVE(XPC)
+        xpc_connection_t xpcConnection;
+#endif
+    };
+    static bool identifierIsNull(Identifier identifier) { return identifier.port == MACH_PORT_NULL; }
 #elif PLATFORM(WIN)
     typedef HANDLE Identifier;
     static bool createServerAndClientIdentifiers(Identifier& serverIdentifier, Identifier& clientIdentifier);
+    static bool identifierIsNull(Identifier identifier) { return !identifier; }
 #elif USE(UNIX_DOMAIN_SOCKETS)
     typedef int Identifier;
+    static bool identifierIsNull(Identifier identifier) { return !identifier; }
 #endif
 
     static PassRefPtr<Connection> createServerConnection(Identifier, Client*, WebCore::RunLoop* clientRunLoop);
@@ -337,6 +372,10 @@ private:
     // the exception port that exceptions from the other end will be sent on.
     mach_port_t m_exceptionPort;
 
+#if HAVE(XPC)
+    xpc_connection_t m_xpcConnection;
+#endif
+
 #elif PLATFORM(WIN)
     // Called on the connection queue.
     void readEventHandler();
diff --git a/Source/WebKit2/Platform/CoreIPC/mac/ConnectionMac.cpp b/Source/WebKit2/Platform/CoreIPC/mac/ConnectionMac.cpp
index 1119a2847..3db1b83d7 100644
--- a/Source/WebKit2/Platform/CoreIPC/mac/ConnectionMac.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/mac/ConnectionMac.cpp
@@ -33,6 +33,10 @@
 #include <mach/mach_error.h>
 #include <mach/vm_map.h>
 
+#if HAVE(XPC)
+#include <xpc/xpc.h>
+#endif
+
 using namespace std;
 using namespace WebCore;
 
@@ -65,6 +69,13 @@ void Connection::platformInvalidate()
         m_connectionQueue.unregisterMachPortEventHandler(m_exceptionPort);
         m_exceptionPort = MACH_PORT_NULL;
     }
+
+#if HAVE(XPC)
+    if (m_xpcConnection) {
+        xpc_release(m_xpcConnection);
+        m_xpcConnection = 0;
+    }
+#endif
 }
 
 void Connection::platformInitialize(Identifier identifier)
@@ -72,12 +83,16 @@ void Connection::platformInitialize(Identifier identifier)
     m_exceptionPort = MACH_PORT_NULL;
 
     if (m_isServer) {
-        m_receivePort = identifier;
+        m_receivePort = identifier.port;
         m_sendPort = MACH_PORT_NULL;
     } else {
         m_receivePort = MACH_PORT_NULL;
-        m_sendPort = identifier;
+        m_sendPort = identifier.port;
     }
+
+#if HAVE(XPC)
+    m_xpcConnection = identifier.xpcConnection;
+#endif
 }
 
 bool Connection::open()
diff --git a/Source/WebKit2/PlatformEfl.cmake b/Source/WebKit2/PlatformEfl.cmake
index 0a02c2bf6..d5ed5420f 100644
--- a/Source/WebKit2/PlatformEfl.cmake
+++ b/Source/WebKit2/PlatformEfl.cmake
@@ -33,14 +33,19 @@ LIST(APPEND WebKit2_SOURCES
     Shared/soup/WebCoreArgumentCodersSoup.cpp
 
     UIProcess/API/C/efl/WKView.cpp
+    
+    UIProcess/API/cpp/efl/WKEinaSharedString.cpp
 
     UIProcess/API/C/soup/WKContextSoup.cpp
     UIProcess/API/C/soup/WKSoupRequestManager.cpp
 
     UIProcess/API/efl/BatteryProvider.cpp
+    UIProcess/API/efl/EflViewportHandler.cpp
     UIProcess/API/efl/NetworkInfoProvider.cpp
     UIProcess/API/efl/PageClientImpl.cpp
     UIProcess/API/efl/VibrationProvider.cpp
+    UIProcess/API/efl/ewk_back_forward_list.cpp
+    UIProcess/API/efl/ewk_back_forward_list_item.cpp
     UIProcess/API/efl/ewk_context.cpp
     UIProcess/API/efl/ewk_context_download_client.cpp
     UIProcess/API/efl/ewk_context_request_manager_client.cpp
@@ -55,10 +60,12 @@ LIST(APPEND WebKit2_SOURCES
     UIProcess/API/efl/ewk_url_response.cpp
     UIProcess/API/efl/ewk_url_scheme_request.cpp
     UIProcess/API/efl/ewk_view.cpp
+    UIProcess/API/efl/ewk_view_find_client.cpp
     UIProcess/API/efl/ewk_view_form_client.cpp
     UIProcess/API/efl/ewk_view_loader_client.cpp
     UIProcess/API/efl/ewk_view_policy_client.cpp
     UIProcess/API/efl/ewk_view_resource_load_client.cpp
+    UIProcess/API/efl/ewk_view_ui_client.cpp
     UIProcess/API/efl/ewk_web_error.cpp
     UIProcess/API/efl/ewk_web_resource.cpp
 
@@ -76,7 +83,6 @@ LIST(APPEND WebKit2_SOURCES
     UIProcess/soup/WebSoupRequestManagerProxy.cpp
 
     UIProcess/Launcher/efl/ProcessLauncherEfl.cpp
-    UIProcess/Launcher/efl/ThreadLauncherEfl.cpp
 
     UIProcess/Plugins/unix/PluginInfoStoreUnix.cpp
 
@@ -119,6 +125,7 @@ LIST(APPEND WebKit2_INCLUDE_DIRECTORIES
     "${WEBKIT2_DIR}/Shared/soup"
     "${WEBKIT2_DIR}/UIProcess/API/C/efl"
     "${WEBKIT2_DIR}/UIProcess/API/C/soup"
+    "${WEBKIT2_DIR}/UIProcess/API/cpp/efl"
     "${WEBKIT2_DIR}/UIProcess/API/efl"
     "${WEBKIT2_DIR}/UIProcess/soup"
     "${WEBKIT2_DIR}/WebProcess/Downloads/soup"
@@ -147,6 +154,7 @@ LIST(APPEND WebKit2_LIBRARIES
     ${EFREET_LIBRARIES}
     ${Freetype_LIBRARIES}
     ${LIBXML2_LIBRARIES}
+    ${OPENGL_LIBRARIES}
     ${SQLITE_LIBRARIES}
     ${FONTCONFIG_LIBRARIES}
     ${PNG_LIBRARY}
@@ -156,13 +164,6 @@ LIST(APPEND WebKit2_LIBRARIES
     ${LIBSOUP24_LIBRARIES}
 )
 
-LIST (APPEND WebKit2_FORWARDING_HEADERS_DIRECTORIES
-    Shared/API/c/efl
-    Shared/API/c/soup
-    UIProcess/API/C/efl
-    UIProcess/API/C/soup
-)
-
 LIST (APPEND WebProcess_SOURCES
     efl/MainEfl.cpp
 )
@@ -175,14 +176,27 @@ LIST (APPEND WebProcess_LIBRARIES
     ${EVAS_LIBRARIES}
     ${LIBXML2_LIBRARIES}
     ${LIBXSLT_LIBRARIES}
+    ${OPENGL_LIBRARIES}
     ${SQLITE_LIBRARIES}
 )
 
 ADD_DEFINITIONS(-DDEFAULT_THEME_PATH=\"${CMAKE_INSTALL_PREFIX}/${DATA_INSTALL_DIR}/themes\")
 
+ADD_CUSTOM_TARGET(forwarding-headerEfl
+    COMMAND ${PERL_EXECUTABLE} ${WEBKIT2_DIR}/Scripts/generate-forwarding-headers.pl ${WEBKIT2_DIR} ${DERIVED_SOURCES_WEBKIT2_DIR}/include efl
+)
+SET(ForwardingHeaders_NAME forwarding-headerEfl)
+
+ADD_CUSTOM_TARGET(forwarding-headerSoup
+    COMMAND ${PERL_EXECUTABLE} ${WEBKIT2_DIR}/Scripts/generate-forwarding-headers.pl ${WEBKIT2_DIR} ${DERIVED_SOURCES_WEBKIT2_DIR}/include soup
+)
+SET(ForwardingNetworkHeaders_NAME forwarding-headerSoup)
+
 CONFIGURE_FILE(efl/ewebkit2.pc.in ${CMAKE_BINARY_DIR}/WebKit2/efl/ewebkit2.pc @ONLY)
 SET (EWebKit2_HEADERS
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/EWebKit2.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_back_forward_list.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_back_forward_list_item.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_context.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_cookie_manager.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_download_job.h"
diff --git a/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp b/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
index 24a8cee99..ab60f941c 100644
--- a/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
+++ b/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
@@ -317,6 +317,18 @@ void PluginControllerProxy::willSendEventToPlugin()
     ASSERT_NOT_REACHED();
 }
 
+void PluginControllerProxy::didInitializePlugin()
+{
+    // This should only be called on the plugin in the web process.
+    ASSERT_NOT_REACHED();
+}
+
+void PluginControllerProxy::didFailToInitializePlugin()
+{
+    // This should only be called on the plugin in the web process.
+    ASSERT_NOT_REACHED();
+}
+
 float PluginControllerProxy::contentsScaleFactor()
 {
     return m_contentsScaleFactor;
diff --git a/Source/WebKit2/PluginProcess/PluginControllerProxy.h b/Source/WebKit2/PluginProcess/PluginControllerProxy.h
index a4af54356..46da1a4bf 100644
--- a/Source/WebKit2/PluginProcess/PluginControllerProxy.h
+++ b/Source/WebKit2/PluginProcess/PluginControllerProxy.h
@@ -90,6 +90,8 @@ private:
     virtual bool isAcceleratedCompositingEnabled();
     virtual void pluginProcessCrashed();
     virtual void willSendEventToPlugin();
+    virtual void didInitializePlugin() OVERRIDE;
+    virtual void didFailToInitializePlugin() OVERRIDE;
 
 #if PLATFORM(MAC)
     virtual void pluginFocusOrWindowFocusChanged(bool);
diff --git a/Source/WebKit2/PluginProcess/PluginCreationParameters.cpp b/Source/WebKit2/PluginProcess/PluginCreationParameters.cpp
index e29e9744c..bc2e9929c 100644
--- a/Source/WebKit2/PluginProcess/PluginCreationParameters.cpp
+++ b/Source/WebKit2/PluginProcess/PluginCreationParameters.cpp
@@ -37,6 +37,8 @@ PluginCreationParameters::PluginCreationParameters()
     , windowNPObjectID(0)
     , contentsScaleFactor(1)
     , isPrivateBrowsingEnabled(false)
+    , asynchronousCreationIncomplete(false)
+    , artificialPluginInitializationDelayEnabled(false)
 #if USE(ACCELERATED_COMPOSITING)
     , isAcceleratedCompositingEnabled(false)
 #endif
@@ -51,6 +53,8 @@ void PluginCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) const
     encoder->encode(userAgent);
     encoder->encode(contentsScaleFactor);
     encoder->encode(isPrivateBrowsingEnabled);
+    encoder->encode(asynchronousCreationIncomplete);
+    encoder->encode(artificialPluginInitializationDelayEnabled);
 
 #if USE(ACCELERATED_COMPOSITING)
     encoder->encode(isAcceleratedCompositingEnabled);
@@ -77,6 +81,12 @@ bool PluginCreationParameters::decode(CoreIPC::ArgumentDecoder* decoder, PluginC
     if (!decoder->decode(result.isPrivateBrowsingEnabled))
         return false;
 
+    if (!decoder->decode(result.asynchronousCreationIncomplete))
+        return false;
+
+    if (!decoder->decode(result.artificialPluginInitializationDelayEnabled))
+        return false;
+
 #if USE(ACCELERATED_COMPOSITING)
     if (!decoder->decode(result.isAcceleratedCompositingEnabled))
         return false;
diff --git a/Source/WebKit2/PluginProcess/PluginCreationParameters.h b/Source/WebKit2/PluginProcess/PluginCreationParameters.h
index fcd534963..6f05bdaab 100644
--- a/Source/WebKit2/PluginProcess/PluginCreationParameters.h
+++ b/Source/WebKit2/PluginProcess/PluginCreationParameters.h
@@ -60,6 +60,12 @@ struct PluginCreationParameters {
 
     // Whether private browsing is enabled at the time of instantiation.
     bool isPrivateBrowsingEnabled;
+    
+    // If requesting synchronous initialization, whether this plugin had previously been requested asynchronously
+    bool asynchronousCreationIncomplete;
+
+    // Simulated initialization delay test asynchronous plugin initialization
+    bool artificialPluginInitializationDelayEnabled;
 
 #if USE(ACCELERATED_COMPOSITING)
     // Whether accelerated compositing is enabled.
diff --git a/Source/WebKit2/PluginProcess/PluginProcess.cpp b/Source/WebKit2/PluginProcess/PluginProcess.cpp
index bb1b3b839..759628504 100644
--- a/Source/WebKit2/PluginProcess/PluginProcess.cpp
+++ b/Source/WebKit2/PluginProcess/PluginProcess.cpp
@@ -32,8 +32,9 @@
 #include "Attachment.h"
 #include "NetscapePlugin.h"
 #include "NetscapePluginModule.h"
-#include "PluginProcessProxyMessages.h"
+#include "PluginProcessConnectionMessages.h"
 #include "PluginProcessCreationParameters.h"
+#include "PluginProcessProxyMessages.h"
 #include "WebProcessConnection.h"
 #include <WebCore/NotImplemented.h>
 #include <WebCore/RunLoop.h>
@@ -74,6 +75,7 @@ PluginProcess& PluginProcess::shared()
 
 PluginProcess::PluginProcess()
     : ChildProcess(shutdownTimeout)
+    , m_supportsAsynchronousPluginInitialization(false)
 #if PLATFORM(MAC)
     , m_compositingRenderServerPort(MACH_PORT_NULL)
 #endif
@@ -159,6 +161,7 @@ void PluginProcess::initializePluginProcess(const PluginProcessCreationParameter
     ASSERT(!m_pluginModule);
 
     m_pluginPath = parameters.pluginPath;
+    m_supportsAsynchronousPluginInitialization = parameters.supportsAsynchronousPluginInitialization;
 
     platformInitialize(parameters);
 }
@@ -173,11 +176,11 @@ void PluginProcess::createWebProcessConnection()
     mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &listeningPort);
 
     // Create a listening connection.
-    RefPtr<WebProcessConnection> connection = WebProcessConnection::create(listeningPort);
+    RefPtr<WebProcessConnection> connection = WebProcessConnection::create(CoreIPC::Connection::Identifier(listeningPort));
     m_webProcessConnections.append(connection.release());
 
     CoreIPC::Attachment clientPort(listeningPort, MACH_MSG_TYPE_MAKE_SEND);
-    m_connection->send(Messages::PluginProcessProxy::DidCreateWebProcessConnection(clientPort), 0);
+    m_connection->send(Messages::PluginProcessProxy::DidCreateWebProcessConnection(clientPort, m_supportsAsynchronousPluginInitialization), 0);
 #elif USE(UNIX_DOMAIN_SOCKETS)
     int sockets[2];
     if (socketpair(AF_UNIX, SOCKET_TYPE, 0, sockets) == -1) {
@@ -209,7 +212,7 @@ void PluginProcess::createWebProcessConnection()
     m_webProcessConnections.append(connection.release());
 
     CoreIPC::Attachment clientSocket(sockets[0]);
-    m_connection->send(Messages::PluginProcessProxy::DidCreateWebProcessConnection(clientSocket), 0);
+    m_connection->send(Messages::PluginProcessProxy::DidCreateWebProcessConnection(clientSocket, m_supportsAsynchronousPluginInitialization), 0);
 #else
     notImplemented();
 #endif
diff --git a/Source/WebKit2/PluginProcess/PluginProcess.h b/Source/WebKit2/PluginProcess/PluginProcess.h
index 633bb4103..bcbd2003e 100644
--- a/Source/WebKit2/PluginProcess/PluginProcess.h
+++ b/Source/WebKit2/PluginProcess/PluginProcess.h
@@ -99,6 +99,8 @@ private:
     // The plug-in module.
     RefPtr<NetscapePluginModule> m_pluginModule;
     
+    bool m_supportsAsynchronousPluginInitialization;
+    
 #if USE(ACCELERATED_COMPOSITING) && PLATFORM(MAC)
     // The Mach port used for accelerated compositing.
     mach_port_t m_compositingRenderServerPort;
diff --git a/Source/WebKit2/PluginProcess/WebProcessConnection.cpp b/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
index 5ae80b9dc..1621ca0c8 100644
--- a/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
+++ b/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
@@ -34,7 +34,9 @@
 #include "PluginCreationParameters.h"
 #include "PluginProcess.h"
 #include "PluginProcessConnectionMessages.h"
+#include "PluginProxyMessages.h"
 #include <WebCore/RunLoop.h>
+#include <unistd.h>
 
 using namespace WebCore;
 
@@ -160,6 +162,11 @@ void WebProcessConnection::didReceiveMessage(CoreIPC::Connection* connection, Co
 {
     ConnectionStack::CurrentConnectionPusher currentConnection(connectionStack(), connection);
 
+    if (messageID.is<CoreIPC::MessageClassWebProcessConnection>()) {
+        didReceiveWebProcessConnectionMessage(connection, messageID, arguments);
+        return;
+    }
+
     if (!arguments->destinationID()) {
         ASSERT_NOT_REACHED();
         return;
@@ -208,11 +215,20 @@ void WebProcessConnection::didClose(CoreIPC::Connection*)
         destroyPluginControllerProxy(pluginControllers[i]);
 }
 
-void WebProcessConnection::destroyPlugin(uint64_t pluginInstanceID)
+void WebProcessConnection::destroyPlugin(uint64_t pluginInstanceID, bool asynchronousCreationIncomplete)
 {
     PluginControllerProxy* pluginControllerProxy = m_pluginControllers.get(pluginInstanceID);
-    ASSERT(pluginControllerProxy);
-
+    
+    // If there is no PluginControllerProxy then this plug-in doesn't exist yet and we probably have nothing to do.
+    if (!pluginControllerProxy) {
+        // If the plugin we're supposed to destroy was requested asynchronously and doesn't exist yet,
+        // we need to flag the instance ID so it is not created later.
+        if (asynchronousCreationIncomplete)
+            m_asynchronousInstanceIDsToIgnore.add(pluginInstanceID);
+        
+        return;
+    }
+    
     destroyPluginControllerProxy(pluginControllerProxy);
 }
 
@@ -225,7 +241,7 @@ void WebProcessConnection::syncMessageSendTimedOut(CoreIPC::Connection*)
 {
 }
 
-void WebProcessConnection::createPlugin(const PluginCreationParameters& creationParameters, bool& result, bool& wantsWheelEvents, uint32_t& remoteLayerClientID)
+void WebProcessConnection::createPluginInternal(const PluginCreationParameters& creationParameters, bool& result, bool& wantsWheelEvents, uint32_t& remoteLayerClientID)
 {
     OwnPtr<PluginControllerProxy> pluginControllerProxy = PluginControllerProxy::create(this, creationParameters);
 
@@ -247,6 +263,58 @@ void WebProcessConnection::createPlugin(const PluginCreationParameters& creation
 #endif
 }
 
+void WebProcessConnection::createPlugin(const PluginCreationParameters& creationParameters, bool& result, bool& wantsWheelEvents, uint32_t& remoteLayerClientID)
+{
+    PluginControllerProxy* pluginControllerProxy = m_pluginControllers.get(creationParameters.pluginInstanceID);
+
+    // The plug-in we're being asked to create synchronously might already exist if we just finished creating it asynchronously.
+    // In that case we need to not create it again (but also need to return the correct information about its creation).
+    if (pluginControllerProxy) {
+        result = true;
+        wantsWheelEvents = pluginControllerProxy->wantsWheelEvents();
+#if PLATFORM(MAC)
+        remoteLayerClientID = pluginControllerProxy->remoteLayerClientID();
+#endif
+        return;
+    }
+    
+    // The plugin we're supposed to create might have been requested asynchronously before.
+    // In that case we need to create it synchronously now but flag the instance ID so we don't recreate it asynchronously later.
+    if (creationParameters.asynchronousCreationIncomplete)
+        m_asynchronousInstanceIDsToIgnore.add(creationParameters.pluginInstanceID);
+    
+    createPluginInternal(creationParameters, result, wantsWheelEvents, remoteLayerClientID);
+}
+
+void WebProcessConnection::createPluginAsynchronously(const PluginCreationParameters& creationParameters)
+{
+    // In the time since this plugin was requested asynchronously we might have created it synchronously or destroyed it.
+    // In either of those cases we need to ignore this creation request.
+    if (m_asynchronousInstanceIDsToIgnore.contains(creationParameters.pluginInstanceID)) {
+        m_asynchronousInstanceIDsToIgnore.remove(creationParameters.pluginInstanceID);
+        return;
+    }
+    
+    // This version of CreatePlugin is only used by plug-ins that are known to behave when started asynchronously.
+    bool result = false;
+    uint32_t remoteLayerClientID = 0;
+    bool wantsWheelEvents = false;
+    
+    if (creationParameters.artificialPluginInitializationDelayEnabled) {
+        unsigned artificialPluginInitializationDelay = 5;
+        sleep(artificialPluginInitializationDelay);
+    }
+
+    createPluginInternal(creationParameters, result, wantsWheelEvents, remoteLayerClientID);
+
+    if (!result) {
+        m_connection->sendSync(Messages::PluginProxy::DidFailToCreatePlugin(), Messages::PluginProxy::DidFailToCreatePlugin::Reply(), creationParameters.pluginInstanceID);
+        return;
+    }
+
+    m_connection->sendSync(Messages::PluginProxy::DidCreatePlugin(wantsWheelEvents, remoteLayerClientID), Messages::PluginProxy::DidCreatePlugin::Reply(), creationParameters.pluginInstanceID);
+}
+
 } // namespace WebKit
 
 #endif // ENABLE(PLUGIN_PROCESS)
diff --git a/Source/WebKit2/PluginProcess/WebProcessConnection.h b/Source/WebKit2/PluginProcess/WebProcessConnection.h
index f384671d3..53ca1e40e 100644
--- a/Source/WebKit2/PluginProcess/WebProcessConnection.h
+++ b/Source/WebKit2/PluginProcess/WebProcessConnection.h
@@ -30,6 +30,7 @@
 
 #include "Connection.h"
 #include "Plugin.h"
+#include <wtf/HashSet.h>
 #include <wtf/RefCounted.h>
 
 namespace WebKit {
@@ -67,14 +68,19 @@ private:
     virtual void syncMessageSendTimedOut(CoreIPC::Connection*);
 
     // Message handlers.
+    void didReceiveWebProcessConnectionMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
     void didReceiveSyncWebProcessConnectionMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, OwnPtr<CoreIPC::ArgumentEncoder>&);
     void createPlugin(const PluginCreationParameters&, bool& result, bool& wantsWheelEvents, uint32_t& remoteLayerClientID);
-    void destroyPlugin(uint64_t pluginInstanceID);
+    void createPluginAsynchronously(const PluginCreationParameters&);
+    void destroyPlugin(uint64_t pluginInstanceID, bool asynchronousCreationIncomplete);
+    
+    void createPluginInternal(const PluginCreationParameters&, bool& result, bool& wantsWheelEvents, uint32_t& remoteLayerClientID);
 
     RefPtr<CoreIPC::Connection> m_connection;
 
     HashMap<uint64_t, PluginControllerProxy*> m_pluginControllers;
     RefPtr<NPRemoteObjectMap> m_npRemoteObjectMap;
+    HashSet<uint64_t> m_asynchronousInstanceIDsToIgnore;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/PluginProcess/WebProcessConnection.messages.in b/Source/WebKit2/PluginProcess/WebProcessConnection.messages.in
index 07c3c27fa..f1a83594f 100644
--- a/Source/WebKit2/PluginProcess/WebProcessConnection.messages.in
+++ b/Source/WebKit2/PluginProcess/WebProcessConnection.messages.in
@@ -26,8 +26,11 @@ messages -> WebProcessConnection {
     # Creates a plug-in instance using the given creation parameters.
     CreatePlugin(WebKit::PluginCreationParameters pluginCreationParameters) -> (bool result, bool wantsWheelEvents, uint32_t remoteLayerClientID)
 
+    # Creates a plug-in instance asynchronously using the given creation parameters.
+    CreatePluginAsynchronously(WebKit::PluginCreationParameters pluginCreationParameters)
+
     # Destroys the plug-in instance with the given instance ID.
-    DestroyPlugin(uint64_t pluginInstanceID) -> ()
+    DestroyPlugin(uint64_t pluginInstanceID, bool asynchronousCreationIncomplete) -> ()
 }
 
 #endif
diff --git a/Source/WebKit2/PluginProcess/mac/PluginProcessMainMac.mm b/Source/WebKit2/PluginProcess/mac/PluginProcessMainMac.mm
index 0ee4cb642..732cff83a 100644
--- a/Source/WebKit2/PluginProcess/mac/PluginProcessMainMac.mm
+++ b/Source/WebKit2/PluginProcess/mac/PluginProcessMainMac.mm
@@ -118,9 +118,9 @@ int PluginProcessMain(const CommandLine& commandLine)
 
     // Initialize the shim.
     PluginProcess::shared().initializeShim();
-    
+
     // Initialize the plug-in process connection.
-    PluginProcess::shared().initialize(serverPort, RunLoop::main());
+    PluginProcess::shared().initialize(CoreIPC::Connection::Identifier(serverPort), RunLoop::main());
 
     [NSApplication sharedApplication];
 
diff --git a/Source/WebKit2/Shared/API/c/WKImage.h b/Source/WebKit2/Shared/API/c/WKImage.h
index e3a2f9e4b..8dec00a9d 100644
--- a/Source/WebKit2/Shared/API/c/WKImage.h
+++ b/Source/WebKit2/Shared/API/c/WKImage.h
@@ -38,6 +38,12 @@ enum {
 };
 typedef uint32_t WKImageOptions;
 
+enum {
+    kWKSnapshotOptionsShareable = 1 << 0,
+    kWKSnapshotOptionsExcludeSelectionHighlighting = 1 << 1
+};
+typedef uint32_t WKSnapshotOptions;
+
 WK_EXPORT WKTypeID WKImageGetTypeID();
 
 WK_EXPORT WKImageRef WKImageCreate(WKSize size, WKImageOptions options);
diff --git a/Source/WebKit2/Shared/API/c/WKSharedAPICast.h b/Source/WebKit2/Shared/API/c/WKSharedAPICast.h
index fd1a89675..cc605d1f8 100644
--- a/Source/WebKit2/Shared/API/c/WKSharedAPICast.h
+++ b/Source/WebKit2/Shared/API/c/WKSharedAPICast.h
@@ -758,6 +758,28 @@ inline ImageOptions toImageOptions(WKImageOptions wkImageOptions)
     return static_cast<ImageOptions>(imageOptions);
 }
 
+inline SnapshotOptions snapshotOptionsFromImageOptions(WKImageOptions wkImageOptions)
+{
+    unsigned snapshotOptions = 0;
+
+    if (wkImageOptions & kWKImageOptionsShareable)
+        snapshotOptions |= SnapshotOptionsShareable;
+
+    return snapshotOptions;
+}
+
+inline SnapshotOptions toSnapshotOptions(WKSnapshotOptions wkSnapshotOptions)
+{
+    unsigned snapshotOptions = 0;
+
+    if (wkSnapshotOptions & kWKSnapshotOptionsShareable)
+        snapshotOptions |= SnapshotOptionsShareable;
+    if (wkSnapshotOptions & kWKSnapshotOptionsExcludeSelectionHighlighting)
+        snapshotOptions |= SnapshotOptionsExcludeSelectionHighlighting;
+
+    return snapshotOptions;
+}
+
 } // namespace WebKit
 
 #endif // WKSharedAPICast_h
diff --git a/Source/WebKit2/Shared/API/c/WKURL.cpp b/Source/WebKit2/Shared/API/c/WKURL.cpp
index dacd589d3..99cde89ef 100644
--- a/Source/WebKit2/Shared/API/c/WKURL.cpp
+++ b/Source/WebKit2/Shared/API/c/WKURL.cpp
@@ -59,3 +59,8 @@ WKStringRef WKURLCopyScheme(WKURLRef url)
 {
     return toCopiedAPI(toImpl(url)->protocol());
 }
+
+WKStringRef WKURLCopyLastPathComponent(WKURLRef url)
+{
+    return toCopiedAPI(toImpl(url)->lastPathComponent());
+}
diff --git a/Source/WebKit2/Shared/API/c/WKURL.h b/Source/WebKit2/Shared/API/c/WKURL.h
index f599f16d8..2cda6c192 100644
--- a/Source/WebKit2/Shared/API/c/WKURL.h
+++ b/Source/WebKit2/Shared/API/c/WKURL.h
@@ -39,6 +39,7 @@ WK_EXPORT WKURLRef WKURLCreateWithUTF8CString(const char* string);
 WK_EXPORT WKStringRef WKURLCopyString(WKURLRef url);
 WK_EXPORT WKStringRef WKURLCopyHostName(WKURLRef url);
 WK_EXPORT WKStringRef WKURLCopyScheme(WKURLRef url);
+WK_EXPORT WKStringRef WKURLCopyLastPathComponent(WKURLRef url);
 
 WK_EXPORT bool WKURLIsEqual(WKURLRef a, WKURLRef b);
 
diff --git a/Source/WebKit2/Shared/API/c/WKURLResponse.cpp b/Source/WebKit2/Shared/API/c/WKURLResponse.cpp
index 7d8d68b4c..cefd07d31 100644
--- a/Source/WebKit2/Shared/API/c/WKURLResponse.cpp
+++ b/Source/WebKit2/Shared/API/c/WKURLResponse.cpp
@@ -28,6 +28,7 @@
 
 #include "WKAPICast.h"
 #include "WebURLResponse.h"
+#include <WebCore/KURL.h>
 
 using namespace WebKit;
 
@@ -36,3 +37,12 @@ WKTypeID WKURLResponseGetTypeID()
     return toAPI(WebURLResponse::APIType);
 }
 
+WKURLRef WKURLResponseCopyURL(WKURLResponseRef responseRef)
+{
+    return toCopiedURLAPI(toImpl(responseRef)->resourceResponse().url());
+}
+
+WKStringRef WKURLResponseCopyMIMEType(WKURLResponseRef responseRef)
+{
+    return toCopiedAPI(toImpl(responseRef)->resourceResponse().mimeType());
+}
diff --git a/Source/WebKit2/Shared/API/c/WKURLResponse.h b/Source/WebKit2/Shared/API/c/WKURLResponse.h
index 62e51f411..8988dff08 100644
--- a/Source/WebKit2/Shared/API/c/WKURLResponse.h
+++ b/Source/WebKit2/Shared/API/c/WKURLResponse.h
@@ -34,6 +34,10 @@ extern "C" {
 
 WK_EXPORT WKTypeID WKURLResponseGetTypeID();
 
+WK_EXPORT WKURLRef WKURLResponseCopyURL(WKURLResponseRef);
+
+WK_EXPORT WKStringRef WKURLResponseCopyMIMEType(WKURLResponseRef);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/Shared/ImageOptions.h b/Source/WebKit2/Shared/ImageOptions.h
index caf79bfa6..534cd2332 100644
--- a/Source/WebKit2/Shared/ImageOptions.h
+++ b/Source/WebKit2/Shared/ImageOptions.h
@@ -32,6 +32,12 @@ enum ImageOptions {
     ImageOptionsShareable = 1 << 0,
 };
 
+enum {
+    SnapshotOptionsShareable = 1 << 0,
+    SnapshotOptionsExcludeSelectionHighlighting = 1 << 1
+};
+typedef uint32_t SnapshotOptions;
+
 } // namespace WebKit
 
 #endif // ImageOptions_h
diff --git a/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm b/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
index 439de7956..a4635e035 100644
--- a/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
+++ b/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
@@ -477,8 +477,8 @@ void NetscapePluginModule::determineQuirks()
 
     if (plugin.bundleIdentifier == "com.microsoft.SilverlightPlugin") {
         // Silverlight doesn't explicitly opt into transparency, so we'll do it whenever
-        // there's a 'background' attribute.
-        m_pluginQuirks.add(PluginQuirks::MakeTransparentIfBackgroundAttributeExists);
+        // there's a 'background' attribute that's set to a transparent color.
+        m_pluginQuirks.add(PluginQuirks::MakeOpaqueUnlessTransparentSilverlightBackgroundAttributeExists);
 
         // Silverlight has a workaround for a leak in Safari 2. This workaround is
         // applied when the user agent does not contain "Version/3" so we append it
diff --git a/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp b/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp
index c6c87a608..0f036bb46 100644
--- a/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp
+++ b/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp
@@ -33,12 +33,14 @@
 namespace WebKit {
 
 PluginProcessCreationParameters::PluginProcessCreationParameters()
+    : supportsAsynchronousPluginInitialization(false)
 {
 }
 
 void PluginProcessCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) const
 {
     encoder->encode(pluginPath);
+    encoder->encode(supportsAsynchronousPluginInitialization);
 
 #if PLATFORM(MAC)
     encoder->encode(parentProcessName);
@@ -50,6 +52,8 @@ bool PluginProcessCreationParameters::decode(CoreIPC::ArgumentDecoder* decoder,
 {
     if (!decoder->decode(result.pluginPath))
         return false;
+    if (!decoder->decode(result.supportsAsynchronousPluginInitialization))
+        return false;
 
 #if PLATFORM(MAC)
     if (!decoder->decode(result.parentProcessName))
diff --git a/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.h b/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.h
index 62cf4bb92..cfaedcd32 100644
--- a/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.h
+++ b/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.h
@@ -48,6 +48,7 @@ struct PluginProcessCreationParameters {
     static bool decode(CoreIPC::ArgumentDecoder*, PluginProcessCreationParameters&);
 
     String pluginPath;
+    bool supportsAsynchronousPluginInitialization;
 
 #if PLATFORM(MAC)
     String parentProcessName;
diff --git a/Source/WebKit2/Shared/Plugins/PluginQuirks.h b/Source/WebKit2/Shared/Plugins/PluginQuirks.h
index c0a67d354..e99f71aa9 100644
--- a/Source/WebKit2/Shared/Plugins/PluginQuirks.h
+++ b/Source/WebKit2/Shared/Plugins/PluginQuirks.h
@@ -40,13 +40,13 @@ public:
         // Supports receiving a paint event, even when using CoreAnimation rendering.
         SupportsSnapshotting,
 
-        // Make the plug-in transparent if it has a "background" attribute set.
+        // Make the plug-in opaque unless it has a "background" attribute set to a transparent color
+        // according to http://msdn.microsoft.com/en-us/library/cc838148(VS.95).aspx
+        // A non-existent "background" attribute is interpreted as the named color White which is opaque.
         // Microsoft Silverlight doesn't opt into transparency using NPN_SetValue and
-        // NPPVpluginTransparentBool, so we'll always force if the plug-in has a "background"
-        // attribute specified, regardless of it's value.
-        // FIXME: We could get more fancy here and check for specific values that we know are
-        // transparent.
-        MakeTransparentIfBackgroundAttributeExists,
+        // NPPVpluginTransparentBool, so we'll always force it unless the plug-in has a "background"
+        // attribute that specifies a opaque color.
+        MakeOpaqueUnlessTransparentSilverlightBackgroundAttributeExists,
 
         // Whether calling NPP_GetValue with NPPVpluginCoreAnimationLayer returns a retained Core Animation
         // layer or not. According to the NPAPI specifications, plug-in shouldn't return a retained layer but
diff --git a/Source/WebKit2/Shared/ShareableSurface.cpp b/Source/WebKit2/Shared/ShareableSurface.cpp
index 2ef5a4bb9..228c0e5dc 100644
--- a/Source/WebKit2/Shared/ShareableSurface.cpp
+++ b/Source/WebKit2/Shared/ShareableSurface.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "ShareableSurface.h"
 
+#include "GraphicsContext.h"
 #include "WebCoreArgumentCoders.h"
 
 #if USE(TEXTURE_MAPPER)
diff --git a/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp b/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
index 9b0448ae8..7d40bc866 100644
--- a/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
+++ b/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
@@ -46,9 +46,10 @@
 #include <WebCore/WindowFeatures.h>
 #include <wtf/text/StringHash.h>
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 #include <WebCore/Animation.h>
 #include <WebCore/FloatPoint3D.h>
+#include <WebCore/Length.h>
 #include <WebCore/TransformationMatrix.h>
 
 #if ENABLE(CSS_FILTERS)
@@ -652,7 +653,7 @@ bool ArgumentCoder<KURL>::decode(ArgumentDecoder* decoder, KURL& result)
     return true;
 }
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 void ArgumentCoder<FloatPoint3D>::encode(ArgumentEncoder* encoder, const FloatPoint3D& floatPoint3D)
 {
     SimpleArgumentCoder<FloatPoint3D>::encode(encoder, floatPoint3D);
diff --git a/Source/WebKit2/Shared/WebCoreArgumentCoders.h b/Source/WebKit2/Shared/WebCoreArgumentCoders.h
index db2b8f741..b08f118f9 100644
--- a/Source/WebKit2/Shared/WebCoreArgumentCoders.h
+++ b/Source/WebKit2/Shared/WebCoreArgumentCoders.h
@@ -67,30 +67,19 @@ namespace WebCore {
 }
 #endif
 
-#if PLATFORM(QT)
+#if USE(COORDINATED_GRAPHICS)
 namespace WebCore {
-    class Animation;
     class FloatPoint3D;
-    class Matrix3DTransformOperation;
-    class MatrixTransformOperation;
-    class PerspectiveTransformOperation;
-    class RotateTransformOperation;
-    class ScaleTransformOperation;
-    class SkewTransformOperation;
-    class TimingFunction;
-    class TransformOperation;
-    class TransformOperations;
     class TransformationMatrix;
-    class TranslateTransformOperation;
     struct Length;
 }
-#endif
 
-#if USE(UI_SIDE_COMPOSITING) && ENABLE(CSS_FILTERS)
+#if ENABLE(CSS_FILTERS)
 namespace WebCore {
     class FilterOperations;
 }
 #endif
+#endif
 
 namespace CoreIPC {
 
@@ -240,7 +229,7 @@ template<> struct ArgumentCoder<WebCore::KURL> {
     static bool decode(ArgumentDecoder*, WebCore::KURL&);
 };
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 template<> struct ArgumentCoder<WebCore::FloatPoint3D> {
     static void encode(ArgumentEncoder*, const WebCore::FloatPoint3D&);
     static bool decode(ArgumentDecoder*, WebCore::FloatPoint3D&);
diff --git a/Source/WebKit2/Shared/WebLayerTreeInfo.cpp b/Source/WebKit2/Shared/WebLayerTreeInfo.cpp
index ffdea522b..e08364006 100644
--- a/Source/WebKit2/Shared/WebLayerTreeInfo.cpp
+++ b/Source/WebKit2/Shared/WebLayerTreeInfo.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 #include "WebLayerTreeInfo.h"
 
 #include "ArgumentCoders.h"
diff --git a/Source/WebKit2/Shared/WebLayerTreeInfo.h b/Source/WebKit2/Shared/WebLayerTreeInfo.h
index 7600633c8..df44778a8 100644
--- a/Source/WebKit2/Shared/WebLayerTreeInfo.h
+++ b/Source/WebKit2/Shared/WebLayerTreeInfo.h
@@ -20,7 +20,7 @@
 #ifndef WebLayerTreeInfo_h
 #define WebLayerTreeInfo_h
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 
 #include "ArgumentDecoder.h"
 #include "ArgumentEncoder.h"
@@ -61,6 +61,7 @@ struct WebLayerInfo {
         struct {
             bool contentsOpaque : 1;
             bool drawsContent : 1;
+            bool contentsVisible : 1;
             bool backfaceVisible : 1;
             bool masksToBounds : 1;
             bool preserves3D : 1;
diff --git a/Source/WebKit2/Shared/WebPreferencesStore.h b/Source/WebKit2/Shared/WebPreferencesStore.h
index 83e0596f2..af0812d40 100644
--- a/Source/WebKit2/Shared/WebPreferencesStore.h
+++ b/Source/WebKit2/Shared/WebPreferencesStore.h
@@ -114,6 +114,11 @@ namespace WebKit {
     macro(WantsBalancedSetDefersLoadingBehavior, wantsBalancedSetDefersLoadingBehavior, Bool, bool, false) \
     macro(RequestAnimationFrameEnabled, requestAnimationFrameEnabled, Bool, bool, true) \
     macro(DiagnosticLoggingEnabled, diagnosticLoggingEnabled, Bool, bool, false) \
+    macro(AsynchronousPluginInitializationEnabled, asynchronousPluginInitializationEnabled, Bool, bool, false) \
+    macro(AsynchronousPluginInitializationEnabledForAllPlugins, asynchronousPluginInitializationEnabledForAllPlugins, Bool, bool, false) \
+    macro(ArtificialPluginInitializationDelayEnabled, artificialPluginInitializationDelayEnabled, Bool, bool, false) \
+    macro(ScrollingPerformanceLoggingEnabled, scrollingPerformanceLoggingEnabled, Bool, bool, false) \
+    macro(ThirdPartyStorageBlockingEnabled, thirdPartyStorageBlockingEnabled, Bool, bool, false) \
     \
 
 #define FOR_EACH_WEBKIT_DOUBLE_PREFERENCE(macro) \
diff --git a/Source/WebKit2/Shared/WebURL.h b/Source/WebKit2/Shared/WebURL.h
index 14bd99f48..f0cce8d02 100644
--- a/Source/WebKit2/Shared/WebURL.h
+++ b/Source/WebKit2/Shared/WebURL.h
@@ -63,6 +63,12 @@ public:
         return m_parsedURL->isValid() ? m_parsedURL->protocol() : String();
     }
 
+    String lastPathComponent() const
+    {
+        parseURLIfNecessary();
+        return m_parsedURL->isValid() ? m_parsedURL->lastPathComponent() : String();
+    }
+
 private:
     WebURL(const String& string)
         : m_string(string)
diff --git a/Source/WebKit2/Target.pri b/Source/WebKit2/Target.pri
index f9fc48791..5ffc8ccb3 100644
--- a/Source/WebKit2/Target.pri
+++ b/Source/WebKit2/Target.pri
@@ -10,7 +10,6 @@ TARGET = WebKit2
 include(WebKit2.pri)
 
 WEBKIT += wtf javascriptcore webcore
-QT += qml quick quick-private
 
 CONFIG += staticlib
 
@@ -112,7 +111,6 @@ HEADERS += \
     Shared/WebGraphicsContext.h \
     Shared/WebHitTestResult.h \
     Shared/WebImage.h \
-    Shared/WebIntentData.h \
     Shared/WebIntentServiceInfo.h \
     Shared/WebLayerTreeInfo.h \
     Shared/WebNavigationDataStore.h \
@@ -184,29 +182,11 @@ HEADERS += \
     UIProcess/API/C/WKProtectionSpace.h \
     UIProcess/API/C/WKProtectionSpaceTypes.h \
     UIProcess/API/C/WKVibration.h \
-    UIProcess/API/C/WebKit2.h \
+    UIProcess/API/C/WebKit2_C.h \
     UIProcess/API/C/qt/WKNativeEvent.h \
     UIProcess/API/cpp/WKRetainPtr.h \
     UIProcess/API/cpp/qt/WKStringQt.h \
     UIProcess/API/cpp/qt/WKURLQt.h \
-    UIProcess/API/qt/qwebpreferences_p.h \
-    UIProcess/API/qt/qwebpreferences_p_p.h \
-    UIProcess/API/qt/qwebdownloaditem_p.h \
-    UIProcess/API/qt/qwebdownloaditem_p_p.h \
-    UIProcess/API/qt/qwebpermissionrequest_p.h \
-    UIProcess/API/qt/qtwebsecurityorigin_p.h \
-    UIProcess/API/qt/qwebloadrequest_p.h \
-    UIProcess/API/qt/qwebnavigationrequest_p.h \
-    UIProcess/API/qt/qquickwebpage_p.h \
-    UIProcess/API/qt/qquickwebpage_p_p.h \
-    UIProcess/API/qt/qwebnavigationhistory_p.h \
-    UIProcess/API/qt/qwebnavigationhistory_p_p.h \
-    UIProcess/API/qt/qquickwebview_p.h \
-    UIProcess/API/qt/qquickwebview_p_p.h \
-    UIProcess/API/qt/qquicknetworkreply_p.h \
-    UIProcess/API/qt/qquicknetworkrequest_p.h \
-    UIProcess/API/qt/qquickurlschemedelegate_p.h \
-    UIProcess/API/qt/qwebkittest_p.h \
     UIProcess/API/qt/raw/qrawwebview_p.h \
     UIProcess/API/qt/raw/qrawwebview_p_p.h \
     UIProcess/Authentication/AuthenticationChallengeProxy.h \
@@ -215,6 +195,9 @@ HEADERS += \
     UIProcess/Authentication/WebProtectionSpace.h \
     UIProcess/BackingStore.h \
     UIProcess/Downloads/DownloadProxy.h \
+    UIProcess/CoordinatedGraphics/CoordinatedBackingStore.h \
+    UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h \
+    UIProcess/CoordinatedGraphics/LayerTreeRenderer.h \
     UIProcess/DrawingAreaProxy.h \
     UIProcess/DrawingAreaProxyImpl.h \
     UIProcess/FindIndicator.h \
@@ -222,8 +205,6 @@ HEADERS += \
     UIProcess/GeolocationPermissionRequestManagerProxy.h \
     UIProcess/GeolocationPermissionRequestProxy.h \
     UIProcess/Launcher/ProcessLauncher.h \
-    UIProcess/Launcher/ThreadLauncher.h \
-    UIProcess/LayerTreeCoordinatorProxy.h \
     UIProcess/Notifications/NotificationPermissionRequest.h \
     UIProcess/Notifications/NotificationPermissionRequestManagerProxy.h \
     UIProcess/Notifications/WebNotification.h \
@@ -267,8 +248,8 @@ HEADERS += \
     UIProcess/WebIconDatabase.h \
     UIProcess/WebIconDatabaseClient.h \
     UIProcess/WebInspectorProxy.h \
+    UIProcess/WebIntentData.h \
     UIProcess/WebKeyValueStorageManagerProxy.h \
-    UIProcess/WebLayerTreeRenderer.h \
     UIProcess/WebLoaderClient.h \
     UIProcess/WebMediaCacheManagerProxy.h \
     UIProcess/WebNavigationData.h \
@@ -284,27 +265,6 @@ HEADERS += \
     UIProcess/WebUIClient.h \
     UIProcess/WebVibrationProvider.h \
     UIProcess/WebVibrationProxy.h \
-    UIProcess/qt/QtWebContext.h \
-    UIProcess/qt/QtWebPageEventHandler.h \
-    UIProcess/qt/QtGestureRecognizer.h \
-    UIProcess/qt/QtPanGestureRecognizer.h \
-    UIProcess/qt/QtPinchGestureRecognizer.h \
-    UIProcess/qt/QtTapGestureRecognizer.h \
-    UIProcess/qt/QtWebError.h \
-    UIProcess/qt/QtDialogRunner.h \
-    UIProcess/qt/QtDownloadManager.h \
-    UIProcess/qt/QtPageClient.h \
-    UIProcess/qt/QtWebPageLoadClient.h \
-    UIProcess/qt/QtWebPagePolicyClient.h \
-    UIProcess/qt/QtWebPageSGNode.h \
-    UIProcess/qt/QtWebPageUIClient.h \
-    UIProcess/qt/QtViewportHandler.h \
-    UIProcess/qt/QtWebUndoController.h \
-    UIProcess/qt/QtWebIconDatabaseClient.h \
-    UIProcess/qt/WebContextMenuProxyQt.h \
-    UIProcess/qt/WebGeolocationProviderQt.h \
-    UIProcess/qt/WebPopupMenuProxyQt.h \
-    UIProcess/texmap/LayerBackingStore.h \
     WebProcess/ApplicationCache/WebApplicationCacheManager.h \
     WebProcess/Authentication/AuthenticationManager.h \
     WebProcess/Battery/WebBatteryManager.h \
@@ -385,8 +345,9 @@ HEADERS += \
     WebProcess/WebPage/DrawingAreaImpl.h \
     WebProcess/WebPage/EventDispatcher.h \
     WebProcess/WebPage/FindController.h \
-    WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.h \
-    WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.h \
+    WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h \
+    WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h \
+    WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h \
     WebProcess/WebPage/TapHighlightController.h \
     WebProcess/WebPage/PageOverlay.h \
     WebProcess/WebPage/UpdateAtlas.h \
@@ -495,7 +456,6 @@ SOURCES += \
     Shared/WebHitTestResult.cpp \
     Shared/WebKeyboardEvent.cpp \
     Shared/WebImage.cpp \
-    Shared/WebIntentData.cpp \
     Shared/WebIntentServiceInfo.cpp \
     Shared/WebLayerTreeInfo.cpp \
     Shared/WebMouseEvent.cpp \
@@ -564,20 +524,6 @@ SOURCES += \
     UIProcess/API/C/WKVibration.cpp \
     UIProcess/API/cpp/qt/WKStringQt.cpp \
     UIProcess/API/cpp/qt/WKURLQt.cpp \
-    UIProcess/API/qt/qwebdownloaditem.cpp \
-    UIProcess/API/qt/qwebpermissionrequest.cpp \
-    UIProcess/API/qt/qtwebsecurityorigin.cpp \
-    UIProcess/API/qt/qwebloadrequest.cpp \
-    UIProcess/API/qt/qwebnavigationrequest.cpp \
-    UIProcess/API/qt/qquickwebpage.cpp \
-    UIProcess/API/qt/qwebnavigationhistory.cpp \
-    UIProcess/API/qt/qquickwebview.cpp \
-    UIProcess/API/qt/qwebiconimageprovider.cpp \
-    UIProcess/API/qt/qquicknetworkreply.cpp \
-    UIProcess/API/qt/qquicknetworkrequest.cpp \
-    UIProcess/API/qt/qquickurlschemedelegate.cpp \
-    UIProcess/API/qt/qwebpreferences.cpp \
-    UIProcess/API/qt/qwebkittest.cpp \
     UIProcess/API/qt/raw/qrawwebview.cpp \
     UIProcess/Authentication/AuthenticationChallengeProxy.cpp \
     UIProcess/Authentication/AuthenticationDecisionListener.cpp \
@@ -585,18 +531,17 @@ SOURCES += \
     UIProcess/Authentication/WebProtectionSpace.cpp \
     UIProcess/BackingStore.cpp \
     UIProcess/qt/BackingStoreQt.cpp \
+    UIProcess/CoordinatedGraphics/CoordinatedBackingStore.cpp \
+    UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp \
+    UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp \
     UIProcess/Downloads/DownloadProxy.cpp \
     UIProcess/DrawingAreaProxy.cpp \
     UIProcess/DrawingAreaProxyImpl.cpp \
-    UIProcess/qt/QtWebUndoController.cpp \
     UIProcess/FindIndicator.cpp \
     UIProcess/GeolocationPermissionRequestManagerProxy.cpp \
     UIProcess/GeolocationPermissionRequestProxy.cpp \
     UIProcess/Launcher/ProcessLauncher.cpp \
-    UIProcess/Launcher/ThreadLauncher.cpp \
     UIProcess/Launcher/qt/ProcessLauncherQt.cpp \
-    UIProcess/Launcher/qt/ThreadLauncherQt.cpp \
-    UIProcess/LayerTreeCoordinatorProxy.cpp \
     UIProcess/Notifications/NotificationPermissionRequest.cpp \
     UIProcess/Notifications/NotificationPermissionRequestManagerProxy.cpp \
     UIProcess/Notifications/WebNotification.cpp \
@@ -638,8 +583,8 @@ SOURCES += \
     UIProcess/WebIconDatabase.cpp \
     UIProcess/WebIconDatabaseClient.cpp \
     UIProcess/WebInspectorProxy.cpp \
+    UIProcess/WebIntentData.cpp \
     UIProcess/WebKeyValueStorageManagerProxy.cpp \
-    UIProcess/WebLayerTreeRenderer.cpp \
     UIProcess/WebLoaderClient.cpp \
     UIProcess/WebMediaCacheManagerProxy.cpp \
     UIProcess/WebNavigationData.cpp \
@@ -658,31 +603,13 @@ SOURCES += \
     UIProcess/WebVibrationProvider.cpp \
     UIProcess/WebVibrationProxy.cpp \
     UIProcess/qt/QtWebContext.cpp \
-    UIProcess/qt/QtWebPageEventHandler.cpp \
-    UIProcess/qt/QtGestureRecognizer.cpp \
-    UIProcess/qt/QtPanGestureRecognizer.cpp \
-    UIProcess/qt/QtPinchGestureRecognizer.cpp \
-    UIProcess/qt/QtTapGestureRecognizer.cpp \
-    UIProcess/qt/QtWebError.cpp \
-    UIProcess/qt/QtDialogRunner.cpp \
-    UIProcess/qt/QtDownloadManager.cpp \
-    UIProcess/qt/QtPageClient.cpp \
-    UIProcess/qt/QtWebPageLoadClient.cpp \
-    UIProcess/qt/QtWebPagePolicyClient.cpp \
-    UIProcess/qt/QtWebPageSGNode.cpp \
-    UIProcess/qt/QtWebPageUIClient.cpp \
+    UIProcess/qt/QtWebUndoController.cpp \
     UIProcess/qt/TextCheckerQt.cpp \
-    UIProcess/qt/QtViewportHandler.cpp \
-    UIProcess/qt/WebContextMenuProxyQt.cpp \
     UIProcess/qt/WebContextQt.cpp \
-    UIProcess/qt/WebGeolocationProviderQt.cpp \
     UIProcess/qt/WebFullScreenManagerProxyQt.cpp \
     UIProcess/qt/WebInspectorProxyQt.cpp \
     UIProcess/qt/WebPageProxyQt.cpp \
-    UIProcess/qt/WebPopupMenuProxyQt.cpp \
     UIProcess/qt/WebPreferencesQt.cpp \
-    UIProcess/qt/QtWebIconDatabaseClient.cpp \
-    UIProcess/texmap/LayerBackingStore.cpp \
     WebProcess/ApplicationCache/WebApplicationCacheManager.cpp \
     WebProcess/Authentication/AuthenticationManager.cpp \
     WebProcess/Battery/WebBatteryManager.cpp \
@@ -781,12 +708,12 @@ SOURCES += \
     WebProcess/WebPage/EncoderAdapter.cpp \
     WebProcess/WebPage/EventDispatcher.cpp \
     WebProcess/WebPage/FindController.cpp \
-    WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.cpp \
-    WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.cpp \
+    WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp \
+    WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp \
+    WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp \
     WebProcess/WebPage/TapHighlightController.cpp \
     WebProcess/WebPage/LayerTreeHost.cpp \
     WebProcess/WebPage/PageOverlay.cpp \
-    WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp \
     WebProcess/WebPage/UpdateAtlas.cpp \
     WebProcess/WebPage/WebBackForwardListProxy.cpp \
     WebProcess/WebPage/WebContextMenu.cpp \
@@ -807,8 +734,92 @@ SOURCES += \
     WebProcess/qt/WebProcessMainQt.cpp \
     WebProcess/qt/WebProcessQt.cpp
 
-mac: {
+contains(DEFINES, HAVE_QTQUICK=1) {
+    QT += qml quick quick-private
+
+    HEADERS += \
+        UIProcess/API/qt/qwebpreferences_p.h \
+        UIProcess/API/qt/qwebpreferences_p_p.h \
+        UIProcess/API/qt/qwebdownloaditem_p.h \
+        UIProcess/API/qt/qwebdownloaditem_p_p.h \
+        UIProcess/API/qt/qwebpermissionrequest_p.h \
+        UIProcess/API/qt/qtwebsecurityorigin_p.h \
+        UIProcess/API/qt/qwebloadrequest_p.h \
+        UIProcess/API/qt/qwebnavigationrequest_p.h \
+        UIProcess/API/qt/qquickwebpage_p.h \
+        UIProcess/API/qt/qquickwebpage_p_p.h \
+        UIProcess/API/qt/qwebnavigationhistory_p.h \
+        UIProcess/API/qt/qwebnavigationhistory_p_p.h \
+        UIProcess/API/qt/qquickwebview_p.h \
+        UIProcess/API/qt/qquickwebview_p_p.h \
+        UIProcess/API/qt/qquicknetworkreply_p.h \
+        UIProcess/API/qt/qquicknetworkrequest_p.h \
+        UIProcess/API/qt/qquickurlschemedelegate_p.h \
+        UIProcess/API/qt/qwebkittest_p.h \
+        UIProcess/qt/QtWebContext.h \
+        UIProcess/qt/QtWebPageEventHandler.h \
+        UIProcess/qt/QtGestureRecognizer.h \
+        UIProcess/qt/QtPanGestureRecognizer.h \
+        UIProcess/qt/QtPinchGestureRecognizer.h \
+        UIProcess/qt/QtTapGestureRecognizer.h \
+        UIProcess/qt/QtWebError.h \
+        UIProcess/qt/QtDialogRunner.h \
+        UIProcess/qt/QtDownloadManager.h \
+        UIProcess/qt/QtPageClient.h \
+        UIProcess/qt/QtWebPageLoadClient.h \
+        UIProcess/qt/QtWebPagePolicyClient.h \
+        UIProcess/qt/QtWebPageSGNode.h \
+        UIProcess/qt/QtWebPageUIClient.h \
+        UIProcess/qt/QtViewportHandler.h \
+        UIProcess/qt/QtWebUndoController.h \
+        UIProcess/qt/QtWebIconDatabaseClient.h \
+        UIProcess/qt/WebContextMenuProxyQt.h \
+        UIProcess/qt/WebGeolocationProviderQt.h \
+        UIProcess/qt/WebPopupMenuProxyQt.h
+
+    SOURCES += \
+        UIProcess/API/qt/qwebdownloaditem.cpp \
+        UIProcess/API/qt/qwebpermissionrequest.cpp \
+        UIProcess/API/qt/qtwebsecurityorigin.cpp \
+        UIProcess/API/qt/qwebloadrequest.cpp \
+        UIProcess/API/qt/qwebnavigationrequest.cpp \
+        UIProcess/API/qt/qquickwebpage.cpp \
+        UIProcess/API/qt/qwebnavigationhistory.cpp \
+        UIProcess/API/qt/qquickwebview.cpp \
+        UIProcess/API/qt/qwebiconimageprovider.cpp \
+        UIProcess/API/qt/qquicknetworkreply.cpp \
+        UIProcess/API/qt/qquicknetworkrequest.cpp \
+        UIProcess/API/qt/qquickurlschemedelegate.cpp \
+        UIProcess/API/qt/qwebpreferences.cpp \
+        UIProcess/API/qt/qwebkittest.cpp \
+        UIProcess/qt/QtWebError.cpp \
+        UIProcess/qt/QtDialogRunner.cpp \
+        UIProcess/qt/QtDownloadManager.cpp \
+        UIProcess/qt/QtPageClient.cpp \
+        UIProcess/qt/QtWebPageLoadClient.cpp \
+        UIProcess/qt/QtWebPagePolicyClient.cpp \
+        UIProcess/qt/QtWebPageSGNode.cpp \
+        UIProcess/qt/QtWebPageEventHandler.cpp \
+        UIProcess/qt/QtGestureRecognizer.cpp \
+        UIProcess/qt/QtPanGestureRecognizer.cpp \
+        UIProcess/qt/QtPinchGestureRecognizer.cpp \
+        UIProcess/qt/QtTapGestureRecognizer.cpp \
+        UIProcess/qt/QtViewportHandler.cpp \
+        UIProcess/qt/WebContextMenuProxyQt.cpp \
+        UIProcess/qt/WebGeolocationProviderQt.cpp \
+        UIProcess/qt/WebPopupMenuProxyQt.cpp \
+        UIProcess/qt/QtWebIconDatabaseClient.cpp \
+        UIProcess/qt/QtWebPageUIClient.cpp
+
+    contains(DEFINES, ENABLE_INPUT_TYPE_COLOR=1) {
+        HEADERS += \
+            UIProcess/qt/WebColorChooserProxyQt.h
+        SOURCES += \
+            UIProcess/qt/WebColorChooserProxyQt.cpp
+    }
+}
 
+mac: {
     contains(DEFINES, WTF_USE_QTKIT=1) {
         DEFINES += NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
         INCLUDEPATH += \
@@ -863,12 +874,6 @@ contains(DEFINES, ENABLE_TOUCH_EVENTS=1) {
         Shared/qt/NativeWebTouchEventQt.cpp
 }
 
-contains(DEFINES, ENABLE_INPUT_TYPE_COLOR=1) {
-    HEADERS += \
-        UIProcess/qt/WebColorChooserProxyQt.h
-    SOURCES += \
-        UIProcess/qt/WebColorChooserProxyQt.cpp
-}
 
 contains(DEFINES, ENABLE_GEOLOCATION=1): QT += location
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKContext.cpp b/Source/WebKit2/UIProcess/API/C/WKContext.cpp
index e90d1129a..f802e9374 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContext.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKContext.cpp
@@ -61,16 +61,6 @@ WKContextRef WKContextCreateWithInjectedBundlePath(WKStringRef pathRef)
     return toAPI(context.release().leakRef());
 }
 
-WKContextRef WKContextGetSharedProcessContext()
-{
-    return toAPI(WebContext::sharedProcessContext());
-}
-
-WKContextRef WKContextGetSharedThreadContext()
-{
-    return toAPI(WebContext::sharedThreadContext());
-}
-
 void WKContextSetInjectedBundleClient(WKContextRef contextRef, const WKContextInjectedBundleClient* wkClient)
 {
     toImpl(contextRef)->initializeInjectedBundleClient(wkClient);
diff --git a/Source/WebKit2/UIProcess/API/C/WKContext.h b/Source/WebKit2/UIProcess/API/C/WKContext.h
index 412227de7..967daea79 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContext.h
+++ b/Source/WebKit2/UIProcess/API/C/WKContext.h
@@ -127,7 +127,6 @@ WK_EXPORT WKTypeID WKContextGetTypeID();
 
 WK_EXPORT WKContextRef WKContextCreate();
 WK_EXPORT WKContextRef WKContextCreateWithInjectedBundlePath(WKStringRef path);
-WK_EXPORT WKContextRef WKContextGetSharedProcessContext();
 
 WK_EXPORT void WKContextSetInjectedBundleClient(WKContextRef context, const WKContextInjectedBundleClient* client);
 WK_EXPORT void WKContextSetHistoryClient(WKContextRef context, const WKContextHistoryClient* client);
diff --git a/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h b/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h
index 01dac4b01..49aec7f53 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h
+++ b/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h
@@ -42,8 +42,6 @@ typedef struct WKContextStatistics WKContextStatistics;
 
 WK_EXPORT void WKContextGetGlobalStatistics(WKContextStatistics* statistics);
 
-WK_EXPORT WKContextRef WKContextGetSharedThreadContext();
-
 WK_EXPORT void WKContextSetAdditionalPluginsDirectory(WKContextRef context, WKStringRef pluginsDirectory);
 
 WK_EXPORT void WKContextRegisterURLSchemeAsEmptyDocument(WKContextRef context, WKStringRef urlScheme);
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.cpp b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
index 5c600350a..a53a83161 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
@@ -582,6 +582,13 @@ void WKPageGetContentsAsString_b(WKPageRef pageRef, WKPageGetSourceForFrameBlock
 }
 #endif
 
+void WKPageGetContentsAsMHTMLData(WKPageRef pageRef, bool useBinaryEncoding, void* context, WKPageGetContentsAsMHTMLDataFunction callback)
+{
+#if ENABLE(MHTML)
+    toImpl(pageRef)->getContentsAsMHTMLData(DataCallback::create(context, callback), useBinaryEncoding);
+#endif
+}
+
 void WKPageForceRepaint(WKPageRef pageRef, void* context, WKPageForceRepaintFunction callback)
 {
     toImpl(pageRef)->forceRepaint(VoidCallback::create(context, callback));
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.h b/Source/WebKit2/UIProcess/API/C/WKPage.h
index fdacf8b4d..ab3b8eede 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.h
@@ -465,6 +465,9 @@ typedef void (^WKPageGetContentsAsStringBlock)(WKStringRef, WKErrorRef);
 WK_EXPORT void WKPageGetContentsAsString_b(WKPageRef page, WKPageGetContentsAsStringBlock block);
 #endif
 
+typedef void (*WKPageGetContentsAsMHTMLDataFunction)(WKDataRef, WKErrorRef, void*);
+WK_EXPORT void WKPageGetContentsAsMHTMLData(WKPageRef page, bool useBinaryEncoding, void* context, WKPageGetContentsAsMHTMLDataFunction function);
+
 typedef void (*WKPageForceRepaintFunction)(WKErrorRef, void*);
 WK_EXPORT void WKPageForceRepaint(WKPageRef page, void* context, WKPageForceRepaintFunction function);
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
index 243a17369..66d4dcd98 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
@@ -817,6 +817,16 @@ bool WKPreferencesGetRequestAnimationFrameEnabled(WKPreferencesRef preferencesRe
     return toImpl(preferencesRef)->requestAnimationFrameEnabled();
 }
 
+void WKPreferencesSetThirdPartyStorageBlockingEnabled(WKPreferencesRef preferencesRef, bool flag)
+{
+    toImpl(preferencesRef)->setThirdPartyStorageBlockingEnabled(flag);
+}
+
+bool WKPreferencesGetThirdPartyStorageBlockingEnabled(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->thirdPartyStorageBlockingEnabled();
+}
+
 void WKPreferencesResetTestRunnerOverrides(WKPreferencesRef preferencesRef)
 {
     // Currently we reset the overrides on the web process when preferencesDidChange() is called. Since WTR preferences
@@ -833,3 +843,43 @@ bool WKPreferencesGetDiagnosticLoggingEnabled(WKPreferencesRef preferencesRef)
 {
     return toImpl(preferencesRef)->diagnosticLoggingEnabled();
 }
+
+void WKPreferencesSetAsynchronousPluginInitializationEnabled(WKPreferencesRef preferencesRef, bool enabled)
+{
+    toImpl(preferencesRef)->setAsynchronousPluginInitializationEnabled(enabled);
+}
+
+bool WKPreferencesGetAsynchronousPluginInitializationEnabled(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->asynchronousPluginInitializationEnabled();
+}
+
+void WKPreferencesSetAsynchronousPluginInitializationEnabledForAllPlugins(WKPreferencesRef preferencesRef, bool enabled)
+{
+    toImpl(preferencesRef)->setAsynchronousPluginInitializationEnabledForAllPlugins(enabled);
+}
+
+bool WKPreferencesGetAsynchronousPluginInitializationEnabledForAllPlugins(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->asynchronousPluginInitializationEnabledForAllPlugins();
+}
+
+void WKPreferencesSetArtificialPluginInitializationDelayEnabled(WKPreferencesRef preferencesRef, bool enabled)
+{
+    toImpl(preferencesRef)->setArtificialPluginInitializationDelayEnabled(enabled);
+}
+
+bool WKPreferencesGetArtificialPluginInitializationDelayEnabled(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->artificialPluginInitializationDelayEnabled();
+}
+
+void WKPreferencesSetScrollingPerformanceLoggingEnabled(WKPreferencesRef preferencesRef, bool enabled)
+{
+    toImpl(preferencesRef)->setScrollingPerformanceLoggingEnabled(enabled);
+}
+
+bool WKPreferencesGetScrollingPerformanceLoggingEnabled(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->scrollingPerformanceLoggingEnabled();
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.h b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
index 42f94957e..883fbff61 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
@@ -205,6 +205,10 @@ WK_EXPORT bool WKPreferencesGetNotificationsEnabled(WKPreferencesRef preferences
 WK_EXPORT void WKPreferencesSetShouldRespectImageOrientation(WKPreferencesRef preferencesRef, bool enabled);
 WK_EXPORT bool WKPreferencesGetShouldRespectImageOrientation(WKPreferencesRef preferencesRef);
 
+// Defaults to false
+WK_EXPORT void WKPreferencesSetThirdPartyStorageBlockingEnabled(WKPreferencesRef preferencesRef, bool enabled);
+WK_EXPORT bool WKPreferencesGetThirdPartyStorageBlockingEnabled(WKPreferencesRef preferencesRef);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h b/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
index 371c539a1..b469d7aca 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
@@ -191,6 +191,22 @@ WK_EXPORT bool WKPreferencesGetRequestAnimationFrameEnabled(WKPreferencesRef);
 WK_EXPORT void WKPreferencesSetDiagnosticLoggingEnabled(WKPreferencesRef preferencesRef, bool enabled);
 WK_EXPORT bool WKPreferencesGetDiagnosticLoggingEnabled(WKPreferencesRef preferencesRef);
 
+// Defaults to false
+WK_EXPORT void WKPreferencesSetAsynchronousPluginInitializationEnabled(WKPreferencesRef preferencesRef, bool enabled);
+WK_EXPORT bool WKPreferencesGetAsynchronousPluginInitializationEnabled(WKPreferencesRef preferencesRef);
+
+// Defaults to false
+WK_EXPORT void WKPreferencesSetAsynchronousPluginInitializationEnabledForAllPlugins(WKPreferencesRef preferencesRef, bool enabled);
+WK_EXPORT bool WKPreferencesGetAsynchronousPluginInitializationEnabledForAllPlugins(WKPreferencesRef preferencesRef);
+
+// Defaults to false
+WK_EXPORT void WKPreferencesSetArtificialPluginInitializationDelayEnabled(WKPreferencesRef preferencesRef, bool enabled);
+WK_EXPORT bool WKPreferencesGetArtificialPluginInitializationDelayEnabled(WKPreferencesRef preferencesRef);
+
+// Defaults to false
+WK_EXPORT void WKPreferencesSetScrollingPerformanceLoggingEnabled(WKPreferencesRef preferencesRef, bool enabled);
+WK_EXPORT bool WKPreferencesGetScrollingPerformanceLoggingEnabled(WKPreferencesRef preferencesRef);
+
 WK_EXPORT void WKPreferencesResetTestRunnerOverrides(WKPreferencesRef preferencesRef);
 
 #ifdef __cplusplus
diff --git a/Source/WebKit2/UIProcess/API/C/WebKit2.h b/Source/WebKit2/UIProcess/API/C/WebKit2_C.h
index 5209e794f..981d52027 100644
--- a/Source/WebKit2/UIProcess/API/C/WebKit2.h
+++ b/Source/WebKit2/UIProcess/API/C/WebKit2_C.h
@@ -23,8 +23,8 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebKit2_h
-#define WebKit2_h
+#ifndef WebKit2_C_h
+#define WebKit2_C_h
 
 #include <WebKit2/WKBase.h>
 #include <WebKit2/WKType.h>
@@ -65,4 +65,4 @@
 #include <WebKit2/WKView.h>
 #endif
 
-#endif /* WebKit2_h */
+#endif /* WebKit2_C_h */
diff --git a/Source/WebKit2/UIProcess/API/cpp/efl/WKEinaSharedString.cpp b/Source/WebKit2/UIProcess/API/cpp/efl/WKEinaSharedString.cpp
new file mode 100644
index 000000000..d2681203c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/cpp/efl/WKEinaSharedString.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKEinaSharedString.h"
+
+#include <WebKit2/WKAPICast.h>
+#include <WebKit2/WKString.h>
+#include <WebKit2/WKURL.h>
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+template <typename WKRefType>
+ALWAYS_INLINE const char* fromRefType(WKRefType strRef, bool adopt = false)
+{
+    const char* res = 0;
+    if (strRef) {
+        res = eina_stringshare_add(toImpl(strRef)->string().utf8().data());
+        ASSERT(res);
+        if (adopt)
+            WKRelease(strRef);
+    }
+
+    return res;
+}
+
+WKEinaSharedString::WKEinaSharedString(const WKEinaSharedString& other)
+    : m_string(eina_stringshare_ref(other.m_string))
+{
+}
+
+WKEinaSharedString::WKEinaSharedString(const char* str)
+    : m_string(eina_stringshare_add(str))
+{
+}
+
+WKEinaSharedString::WKEinaSharedString(WKAdoptTag adoptTag, WKStringRef stringRef)
+    : m_string(fromRefType(stringRef, /*adopt*/ true))
+{
+    ASSERT(adoptTag == AdoptWK); // Guard for future enum changes.
+}
+
+WKEinaSharedString::WKEinaSharedString(WKStringRef stringRef)
+    : m_string(fromRefType(stringRef))
+{
+}
+
+WKEinaSharedString::WKEinaSharedString(WKAdoptTag adoptTag, WKURLRef urlRef)
+    : m_string(fromRefType(urlRef, /*adopt*/ true))
+{
+    ASSERT(adoptTag == AdoptWK); // Guard for future enum changes.
+}
+
+WKEinaSharedString::WKEinaSharedString(WKURLRef urlRef)
+    : m_string(fromRefType(urlRef))
+{
+}
+
+WKEinaSharedString::~WKEinaSharedString()
+{
+    if (m_string)
+        eina_stringshare_del(m_string);
+}
+
+WKEinaSharedString& WKEinaSharedString::operator=(const WKEinaSharedString& other)
+{
+    if (this != &other) {
+        if (m_string)
+            eina_stringshare_del(m_string);
+        m_string = eina_stringshare_ref(other.m_string);
+    }
+    return *this;
+}
+
+WKEinaSharedString& WKEinaSharedString::operator=(const char* str)
+{
+    eina_stringshare_replace(&m_string, str);
+    return *this;
+}
diff --git a/Source/WebKit2/UIProcess/API/cpp/efl/WKEinaSharedString.h b/Source/WebKit2/UIProcess/API/cpp/efl/WKEinaSharedString.h
new file mode 100644
index 000000000..83f661418
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/cpp/efl/WKEinaSharedString.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKEinaSharedString_h
+#define WKEinaSharedString_h
+
+#include <Eina.h>
+#include <WebKit2/WKBase.h>
+#include <WebKit2/WKRetainPtr.h>
+
+namespace WebKit {
+
+class WK_EXPORT WKEinaSharedString {
+public:
+    ALWAYS_INLINE WKEinaSharedString() : m_string(0) { }
+    WKEinaSharedString(const WKEinaSharedString& other);
+    WKEinaSharedString(const char* str);
+
+    WKEinaSharedString(WKAdoptTag, WKStringRef);
+    WKEinaSharedString(WKStringRef);
+
+    WKEinaSharedString(WKAdoptTag, WKURLRef);
+    WKEinaSharedString(WKURLRef);
+
+    ~WKEinaSharedString();
+
+    WKEinaSharedString& operator=(const WKEinaSharedString& other);
+    WKEinaSharedString& operator=(const char* str);
+
+    ALWAYS_INLINE bool operator==(const WKEinaSharedString& other) const { return this->m_string == other.m_string; }
+    ALWAYS_INLINE bool operator!=(const WKEinaSharedString& other) const { return !(*this == other); }
+
+    ALWAYS_INLINE operator const char* () const { return m_string; }
+
+    ALWAYS_INLINE bool isNull() const { return !m_string; }
+
+    ALWAYS_INLINE size_t length() const { return m_string ? static_cast<size_t>(eina_stringshare_strlen(m_string)) : 0; }
+
+private:
+    const char* m_string;
+};
+
+} // namespace WebKit
+
+using WebKit::WKEinaSharedString;
+
+#endif // WKEinaSharedString_h
diff --git a/Source/WebKit2/UIProcess/API/efl/EWebKit2.h b/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
index 9a052da4b..d98023de6 100644
--- a/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
+++ b/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
@@ -28,6 +28,8 @@
 #ifndef EWebKit2_h
 #define EWebKit2_h
 
+#include "ewk_back_forward_list.h"
+#include "ewk_back_forward_list_item.h"
 #include "ewk_context.h"
 #include "ewk_cookie_manager.h"
 #include "ewk_download_job.h"
diff --git a/Source/WebKit2/UIProcess/API/efl/EflViewportHandler.cpp b/Source/WebKit2/UIProcess/API/efl/EflViewportHandler.cpp
new file mode 100644
index 000000000..f5740822e
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/EflViewportHandler.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "EflViewportHandler.h"
+
+#if USE(COORDINATED_GRAPHICS)
+
+#include "LayerTreeCoordinatorProxy.h"
+#include "LayerTreeRenderer.h"
+#include "TransformationMatrix.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+EflViewportHandler::EflViewportHandler(PageClientImpl* pageClientImpl)
+    : m_pageClientImpl(pageClientImpl)
+    , m_scaleFactor(1)
+{
+    ASSERT(m_pageClientImpl);
+}
+
+EflViewportHandler::~EflViewportHandler()
+{
+}
+
+void EflViewportHandler::display(const IntRect& rect)
+{
+    WebCore::TransformationMatrix matrix;
+    matrix.setMatrix(m_scaleFactor, 0, 0, m_scaleFactor, -m_visibleContentRect.x(), -m_visibleContentRect.y());
+
+    LayerTreeRenderer* renderer = drawingArea()->layerTreeCoordinatorProxy()->layerTreeRenderer();
+    renderer->setActive(true);
+    renderer->syncRemoteContent();
+    renderer->paintToCurrentGLContext(matrix, 1, rect);
+}
+
+void EflViewportHandler::updateViewportSize(const IntSize& viewportSize)
+{
+    m_viewportSize = viewportSize;
+    m_pageClientImpl->page()->setViewportSize(viewportSize);
+    setVisibleContentsRect(m_visibleContentRect.location(), m_scaleFactor, FloatPoint());
+}
+
+void EflViewportHandler::setVisibleContentsRect(const IntPoint& newScrollPosition, float newScale, const FloatPoint& trajectory)
+{
+    m_scaleFactor = newScale;
+    m_visibleContentRect = IntRect(newScrollPosition, m_viewportSize);
+
+    // Move visibleContentRect inside contentsRect when visibleContentRect goes outside contentsRect. 
+    IntSize contentsSize = m_contentsSize;
+    contentsSize.scale(m_scaleFactor);
+    if (m_visibleContentRect.x() > contentsSize.width() - m_visibleContentRect.width())
+        m_visibleContentRect.setX(contentsSize.width() - m_visibleContentRect.width());
+    if (m_visibleContentRect.x() < 0)
+        m_visibleContentRect.setX(0);
+    if (m_visibleContentRect.y() > contentsSize.height() - m_visibleContentRect.height())
+        m_visibleContentRect.setY(contentsSize.height() - m_visibleContentRect.height());
+    if (m_visibleContentRect.y() < 0)
+        m_visibleContentRect.setY(0);
+
+    FloatRect mapRectToWebContent = m_visibleContentRect;
+    mapRectToWebContent.scale(1 / m_scaleFactor);
+    drawingArea()->setVisibleContentsRect(enclosingIntRect(mapRectToWebContent), m_scaleFactor, trajectory);
+}
+
+void EflViewportHandler::didChangeContentsSize(const WebCore::IntSize& size)
+{
+    m_contentsSize = size;
+    setVisibleContentsRect(m_visibleContentRect.location(), m_scaleFactor, FloatPoint());
+    drawingArea()->layerTreeCoordinatorProxy()->setContentsSize(WebCore::FloatSize(size.width(), size.height()));
+}
+
+} // namespace WebKit
+#endif // USE(COORDINATED_GRAPHICS)
+
diff --git a/Source/WebKit2/UIProcess/Launcher/qt/ThreadLauncherQt.cpp b/Source/WebKit2/UIProcess/API/efl/EflViewportHandler.h
index 37d045f93..cc6b3d957 100644
--- a/Source/WebKit2/UIProcess/Launcher/qt/ThreadLauncherQt.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/EflViewportHandler.h
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,52 +23,44 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "ThreadLauncher.h"
+#ifndef EflViewportHandler_h
+#define EflViewportHandler_h
 
-#include "WebProcess.h"
-#include <WebCore/RunLoop.h>
-#include <runtime/InitializeThreading.h>
-#include <wtf/MainThread.h>
-#include <wtf/Threading.h>
+#if USE(COORDINATED_GRAPHICS)
 
-#include <QDebug>
-#include <QFile>
-#include <QLocalServer>
-#include <QProcess>
-
-#include <QtCore/qglobal.h>
-
-#include <sys/resource.h>
-#include <unistd.h>
-
-using namespace WebCore;
+#include "PageClientImpl.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebKit {
 
-static void webThreadBody(void* /* context */)
-{
-    // Initialization
-    JSC::initializeThreading();
-    WTF::initializeMainThread();
-
-    // FIXME: We do not support threaded mode for now.
+class EflViewportHandler {
+public:
+    static PassOwnPtr<EflViewportHandler> create(PageClientImpl* pageClientImpl)
+    {
+        return adoptPtr(new EflViewportHandler(pageClientImpl));
+    }
+    ~EflViewportHandler();
 
-    WebProcess::shared().initialize(-1, RunLoop::current());
-    RunLoop::run();
-}
+    DrawingAreaProxy* drawingArea() const { return m_pageClientImpl->page()->drawingArea(); }
+    WebCore::IntSize viewSize() { return m_viewportSize; }
 
-CoreIPC::Connection::Identifier ThreadLauncher::createWebThread()
-{
-    srandom(time(0));
-    int connectionIdentifier = random();
+    void display(const WebCore::IntRect& rect);
+    void updateViewportSize(const WebCore::IntSize& viewportSize);
+    void setVisibleContentsRect(const WebCore::IntPoint&, float, const WebCore::FloatPoint&);
+    void didChangeContentsSize(const WebCore::IntSize& size);
 
-    if (!createThread(webThreadBody, reinterpret_cast<void*>(connectionIdentifier), "WebKit2: WebThread")) {
-        qWarning() << "failed starting thread";
-        return 0;
-    }
+private:
+    explicit EflViewportHandler(PageClientImpl*);
 
-    return connectionIdentifier;
-}
+    PageClientImpl* m_pageClientImpl;
+    WebCore::IntRect m_visibleContentRect;
+    WebCore::IntSize m_contentsSize;
+    WebCore::IntSize m_viewportSize;
+    float m_scaleFactor;
+};
 
 } // namespace WebKit
+
+#endif
+
+#endif // EflViewportHandler_h
diff --git a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp
index 79d20a17d..726caaae1 100644
--- a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp
@@ -31,7 +31,9 @@
 #include "NotImplemented.h"
 #include "WebContext.h"
 #include "WebContextMenuProxy.h"
+#include "WebPageGroup.h"
 #include "WebPageProxy.h"
+#include "WebPreferences.h"
 #include "ewk_context.h"
 #include "ewk_context_private.h"
 #include "ewk_download_job.h"
@@ -46,6 +48,13 @@ PageClientImpl::PageClientImpl(WebContext* context, WebPageGroup* pageGroup, Eva
     : m_viewWidget(viewWidget)
 {
     m_page = context->createWebPage(this, pageGroup);
+
+#if USE(COORDINATED_GRAPHICS)
+    m_page->pageGroup()->preferences()->setAcceleratedCompositingEnabled(true);
+    m_page->pageGroup()->preferences()->setForceCompositingMode(true);
+    m_page->setUseFixedLayout(true);
+#endif
+
     m_page->initializeWebPage();
 }
 
@@ -295,4 +304,9 @@ void PageClientImpl::pageDidRequestScroll(const IntPoint&)
 }
 #endif
 
+void PageClientImpl::didChangeContentsSize(const WebCore::IntSize& size)
+{
+    ewk_view_contents_size_changed(m_viewWidget, size);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h
index 1bd22934a..861850263 100644
--- a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h
@@ -112,6 +112,8 @@ private:
     virtual void pageDidRequestScroll(const WebCore::IntPoint&);
 #endif
 
+    virtual void didChangeContentsSize(const WebCore::IntSize&);
+
 private:
     RefPtr<WebPageProxy> m_page;
     Evas_Object* m_viewWidget;
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.cpp
new file mode 100644
index 000000000..5b8e2d7ea
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.cpp
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_back_forward_list.h"
+
+#include "WKAPICast.h"
+#include "WKArray.h"
+#include "WKBackForwardList.h"
+#include "WKRetainPtr.h"
+#include "ewk_back_forward_list_item_private.h"
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+typedef HashMap<WKBackForwardListItemRef, Ewk_Back_Forward_List_Item*> ItemsMap;
+
+/**
+ * \struct  _Ewk_Back_Forward_List
+ * @brief   Contains the Back Forward List data.
+ */
+struct _Ewk_Back_Forward_List {
+    WKRetainPtr<WKBackForwardListRef> wkList;
+    mutable ItemsMap wrapperCache;
+
+    _Ewk_Back_Forward_List(WKBackForwardListRef listRef)
+        : wkList(listRef)
+    { }
+
+    ~_Ewk_Back_Forward_List()
+    {
+        ItemsMap::iterator it = wrapperCache.begin();
+        ItemsMap::iterator end = wrapperCache.end();
+        for (; it != end; ++it)
+            ewk_back_forward_list_item_unref(it->second);
+    }
+};
+
+#define EWK_BACK_FORWARD_LIST_WK_GET_OR_RETURN(list, wkList_, ...)  \
+    if (!(list)) {                                             \
+        EINA_LOG_CRIT("list is NULL.");                        \
+        return __VA_ARGS__;                                    \
+    }                                                          \
+    if (!(list)->wkList) {                                     \
+        EINA_LOG_CRIT("list->wkList is NULL.");                \
+        return __VA_ARGS__;                                    \
+    }                                                          \
+    WKBackForwardListRef wkList_ = (list)->wkList.get()
+
+
+static inline Ewk_Back_Forward_List_Item* addItemToWrapperCache(const Ewk_Back_Forward_List* list, WKBackForwardListItemRef wkItem)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(list, 0);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(wkItem, 0);
+
+    Ewk_Back_Forward_List_Item* item = list->wrapperCache.get(wkItem);
+    if (!item) {
+        item = ewk_back_forward_list_item_new(wkItem);
+        list->wrapperCache.set(wkItem, item);
+    }
+
+    return item;
+}
+
+Ewk_Back_Forward_List_Item* ewk_back_forward_list_current_item_get(const Ewk_Back_Forward_List* list)
+{
+    EWK_BACK_FORWARD_LIST_WK_GET_OR_RETURN(list, wkList, 0);
+
+    return addItemToWrapperCache(list, WKBackForwardListGetCurrentItem(wkList));
+}
+
+Ewk_Back_Forward_List_Item* ewk_back_forward_list_previous_item_get(const Ewk_Back_Forward_List* list)
+{
+    EWK_BACK_FORWARD_LIST_WK_GET_OR_RETURN(list, wkList, 0);
+
+    return addItemToWrapperCache(list, WKBackForwardListGetBackItem(wkList));
+}
+
+Ewk_Back_Forward_List_Item* ewk_back_forward_list_next_item_get(const Ewk_Back_Forward_List* list)
+{
+    EWK_BACK_FORWARD_LIST_WK_GET_OR_RETURN(list, wkList, 0);
+
+    return addItemToWrapperCache(list, WKBackForwardListGetForwardItem(wkList));
+}
+
+Ewk_Back_Forward_List_Item* ewk_back_forward_list_item_at_index_get(const Ewk_Back_Forward_List* list, int index)
+{
+    EWK_BACK_FORWARD_LIST_WK_GET_OR_RETURN(list, wkList, 0);
+
+    return addItemToWrapperCache(list, WKBackForwardListGetItemAtIndex(wkList, index));
+}
+
+unsigned ewk_back_forward_list_count(Ewk_Back_Forward_List* list)
+{
+    EWK_BACK_FORWARD_LIST_WK_GET_OR_RETURN(list, wkList, 0);
+
+    const unsigned currentItem = ewk_back_forward_list_current_item_get(list) ? 1 : 0;
+
+    return WKBackForwardListGetBackListCount(wkList) + WKBackForwardListGetForwardListCount(wkList) + currentItem;
+}
+
+
+/**
+ * @internal
+ * Updates items cache.
+ */
+void ewk_back_forward_list_changed(Ewk_Back_Forward_List* list, WKBackForwardListItemRef wkAddedItem, WKArrayRef wkRemovedItems)
+{
+    addItemToWrapperCache(list, wkAddedItem); // Puts new item to the cache.
+
+    const size_t removedItemsSize = wkRemovedItems ? WKArrayGetSize(wkRemovedItems) : 0;
+    for (size_t i = 0; i < removedItemsSize; ++i) {
+        WKBackForwardListItemRef wkItem = static_cast<WKBackForwardListItemRef>(WKArrayGetItemAtIndex(wkRemovedItems, i));
+        if (Ewk_Back_Forward_List_Item* item = list->wrapperCache.take(wkItem))
+            ewk_back_forward_list_item_unref(item);
+    }
+}
+
+/**
+ * @internal
+ * Constructs a Ewk_Back_Forward_List from a WKBackForwardListRef.
+ */
+Ewk_Back_Forward_List* ewk_back_forward_list_new(WKBackForwardListRef wkBackForwardListRef)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(wkBackForwardListRef, 0);
+
+    return new Ewk_Back_Forward_List(wkBackForwardListRef);
+}
+
+/**
+ * @internal
+ * Frees a Ewk_Back_Forward_List object.
+ */
+void ewk_back_forward_list_free(Ewk_Back_Forward_List* list)
+{
+    EINA_SAFETY_ON_NULL_RETURN(list);
+
+    delete list;
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.h b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.h
new file mode 100644
index 000000000..5b9cca726
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_back_forward_list.h
+ * @brief   Describes the Ewk Back Forward List API.
+ */
+
+#ifndef ewk_back_forward_list_h
+#define ewk_back_forward_list_h
+
+#include "ewk_back_forward_list_item.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for _Ewk_Back_Forward_List */
+typedef struct _Ewk_Back_Forward_List Ewk_Back_Forward_List;
+
+/**
+ * Returns the current item in the @a list.
+ *
+ * @param list the back-forward list instance
+ *
+ * @return the current item in the @a list or @c NULL in case of error
+ */
+EAPI Ewk_Back_Forward_List_Item *ewk_back_forward_list_current_item_get(const Ewk_Back_Forward_List *list);
+
+/**
+ * Returns the item that precedes the current item in the @a list.
+ *
+ * @param list the back-forward list instance
+ *
+ * @return the item that precedes the current item the @a list or @c NULL in case of error
+ */
+EAPI Ewk_Back_Forward_List_Item *ewk_back_forward_list_previous_item_get(const Ewk_Back_Forward_List *list);
+
+/**
+ * Returns the item that follows the current item in the @a list.
+ *
+ * @param list the back-forward list instance
+ *
+ * @return the item that follows the current item in the @a list or @c NULL in case of error
+ */
+EAPI Ewk_Back_Forward_List_Item *ewk_back_forward_list_next_item_get(const Ewk_Back_Forward_List *list);
+
+/**
+ * Returns the item at a given @a index relative to the current item.
+ *
+ * @param list the back-forward list instance
+ * @param index the index of the item
+ *
+ * @return the item at a given @a index relative to the current item or @c NULL in case of error
+ */
+EAPI Ewk_Back_Forward_List_Item *ewk_back_forward_list_item_at_index_get(const Ewk_Back_Forward_List *list, int index);
+
+/**
+ * Returns the length of the back-forward list including current item.
+ *
+ * @param list the back-forward list instance
+ *
+ * @return the length of the back-forward list including current item or @c 0 in case of error
+ */
+EAPI unsigned ewk_back_forward_list_count(Ewk_Back_Forward_List *list);
+
+#ifdef __cplusplus
+}
+#endif
+#endif // ewk_back_forward_list_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.cpp
new file mode 100644
index 000000000..a8586b23d
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this item of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this item of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_back_forward_list_item.h"
+
+#include "WKAPICast.h"
+#include "WKBackForwardListItem.h"
+#include "WKEinaSharedString.h"
+
+using namespace WebKit;
+
+/**
+ * \struct  _Ewk_Back_Forward_List
+ * @brief   Contains the Back Forward List data.
+ */
+struct _Ewk_Back_Forward_List_Item {
+    unsigned int __ref; /**< the reference count of the object */
+    WKRetainPtr<WKBackForwardListItemRef> wkItem;
+    WKEinaSharedString uri;
+    WKEinaSharedString title;
+    WKEinaSharedString originalUri;
+
+    _Ewk_Back_Forward_List_Item(WKBackForwardListItemRef itemRef)
+        : __ref(1)
+        , wkItem(itemRef)
+        , uri(AdoptWK, WKBackForwardListItemCopyURL(itemRef))
+        , title(AdoptWK, WKBackForwardListItemCopyTitle(itemRef))
+        , originalUri(AdoptWK, WKBackForwardListItemCopyOriginalURL(itemRef))
+    { }
+
+    ~_Ewk_Back_Forward_List_Item()
+    {
+        ASSERT(!__ref);
+    }
+};
+
+void ewk_back_forward_list_item_ref(Ewk_Back_Forward_List_Item* item)
+{
+    EINA_SAFETY_ON_NULL_RETURN(item);
+    ++item->__ref;
+}
+
+void ewk_back_forward_list_item_unref(Ewk_Back_Forward_List_Item* item)
+{
+    EINA_SAFETY_ON_NULL_RETURN(item);
+
+    if (--item->__ref)
+        return;
+
+    delete item;
+}
+
+const char* ewk_back_forward_list_item_uri_get(const Ewk_Back_Forward_List_Item* item)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(item, 0);
+
+    return item->uri;
+}
+
+const char* ewk_back_forward_list_item_title_get(const Ewk_Back_Forward_List_Item* item)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(item, 0);
+
+    return item->title;
+}
+
+const char* ewk_back_forward_list_item_original_uri_get(const Ewk_Back_Forward_List_Item* item)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(item, 0);
+
+    return item->originalUri;
+}
+
+Ewk_Back_Forward_List_Item* ewk_back_forward_list_item_new(WKBackForwardListItemRef backForwardListItemData)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(backForwardListItemData, 0);
+
+    return new Ewk_Back_Forward_List_Item(backForwardListItemData);
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.h b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.h
new file mode 100644
index 000000000..811f0e104
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_back_forward_list_item.h
+ * @brief   Describes the Ewk Back Forward List Item API.
+ */
+
+#ifndef ewk_back_forward_list_item_h
+#define ewk_back_forward_list_item_h
+
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for _Ewk_Back_Forward_List_Item */
+typedef struct _Ewk_Back_Forward_List_Item Ewk_Back_Forward_List_Item;
+
+/**
+ * Increases the reference count of the given object.
+ *
+ * @param item the back-forward list item instance to increase the reference count
+ */
+EAPI void ewk_back_forward_list_item_ref(Ewk_Back_Forward_List_Item *item);
+
+/**
+ * Decreases the reference count of the given object, possibly freeing it.
+ *
+ * When the reference count reaches 0, the item is freed.
+ *
+ * @param item the back-forward list item instance to decrease the reference count
+ */
+EAPI void ewk_back_forward_list_item_unref(Ewk_Back_Forward_List_Item *item);
+
+/**
+ * Returns URI of the item.
+ *
+ * The returned URI may differ from the original URI (For example if the page was redirected).
+ *
+ * @see ewk_back_forward_list_item_original_uri_get()
+ *
+ * @param item the back-forward list item instance
+ *
+ * @return the URI of the @a item or @c NULL in case of error. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup()
+ */
+EAPI const char *ewk_back_forward_list_item_uri_get(const Ewk_Back_Forward_List_Item *item);
+
+/**
+ * Returns title of the item.
+ *
+ * @param item the back-forward list item instance
+ *
+ * @return the title of the @a item or @c NULL in case of error. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup()
+ */
+EAPI const char *ewk_back_forward_list_item_title_get(const Ewk_Back_Forward_List_Item *item);
+
+/**
+ * Returns original URI of the item.
+ *
+ * @see ewk_back_forward_list_item_uri_get()
+ *
+ * @param item the back-forward list item instance
+ *
+ * @return the original URI of the @a item or @c NULL in case of error. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup()
+ */
+EAPI const char *ewk_back_forward_list_item_original_uri_get(const Ewk_Back_Forward_List_Item *item);
+
+#ifdef __cplusplus
+}
+#endif
+#endif // ewk_back_forward_list_item_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item_private.h
new file mode 100644
index 000000000..8c2c684d4
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item_private.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this item of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this item of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_back_forward_list_item_private_h
+#define ewk_back_forward_list_item_private_h
+
+#include <WebKit2/WKBase.h>
+
+typedef struct _Ewk_Back_Forward_List_Item Ewk_Back_Forward_List_Item;
+
+Ewk_Back_Forward_List_Item* ewk_back_forward_list_item_new(WKBackForwardListItemRef wkBackForwardListItemRef);
+
+#endif // ewk_back_forward_list_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_private.h
new file mode 100644
index 000000000..592a4f48d
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_private.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_back_forward_list_private_h
+#define ewk_back_forward_list_private_h
+
+#include <WebKit2/WKBase.h>
+
+typedef struct _Ewk_Back_Forward_List Ewk_Back_Forward_List;
+
+void ewk_back_forward_list_changed(Ewk_Back_Forward_List*, WKBackForwardListItemRef wkAddedItem, WKArrayRef wkRemovedItems);
+Ewk_Back_Forward_List* ewk_back_forward_list_new(WKBackForwardListRef wkBackForwardListRef);
+void ewk_back_forward_list_free(Ewk_Back_Forward_List* list);
+
+#endif // ewk_back_forward_list_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
index f2ed417fc..d6453757e 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
@@ -118,6 +118,17 @@ WKContextRef ewk_context_WKContext_get(const Ewk_Context* ewkContext)
 
 /**
  * @internal
+ * Create Ewk_Context from WKContext.
+ */
+Ewk_Context* ewk_context_new_from_WKContext(WKContextRef contextRef)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(contextRef, 0);
+
+    return new Ewk_Context(contextRef);
+}
+
+/**
+ * @internal
  * Registers that a new download has been requested.
  */
 void ewk_context_download_job_add(Ewk_Context* ewkContext, Ewk_Download_Job* ewkDownload)
@@ -189,7 +200,7 @@ void ewk_context_url_scheme_request_received(Ewk_Context* ewkContext, Ewk_Url_Sc
 
 static inline Ewk_Context* createDefaultEwkContext()
 {
-    return new Ewk_Context(WKContextGetSharedProcessContext());
+    return new Ewk_Context(WKContextCreate());
 }
 
 Ewk_Context* ewk_context_default_get()
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h
index db9e911d2..d1b695e0c 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h
@@ -27,6 +27,7 @@ typedef struct _Ewk_Download_Job Ewk_Download_Job;
 typedef struct _Ewk_Url_Scheme_Request Ewk_Url_Scheme_Request;
 
 WKContextRef ewk_context_WKContext_get(const Ewk_Context*);
+Ewk_Context* ewk_context_new_from_WKContext(WKContextRef);
 WKSoupRequestManagerRef ewk_context_request_manager_get(const Ewk_Context*);
 void ewk_context_url_scheme_request_received(Ewk_Context*, Ewk_Url_Scheme_Request*);
 
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
index b1b1bcc08..7d8b1ce05 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
@@ -26,17 +26,22 @@
 #include "NativeWebWheelEvent.h"
 #include "PageClientImpl.h"
 #include "WKAPICast.h"
+#include "WKFindOptions.h"
 #include "WKRetainPtr.h"
 #include "WKString.h"
 #include "WKURL.h"
+#include "ewk_back_forward_list_private.h"
 #include "ewk_context.h"
 #include "ewk_context_private.h"
 #include "ewk_intent_private.h"
+#include "ewk_private.h"
+#include "ewk_view_find_client_private.h"
 #include "ewk_view_form_client_private.h"
 #include "ewk_view_loader_client_private.h"
 #include "ewk_view_policy_client_private.h"
 #include "ewk_view_private.h"
 #include "ewk_view_resource_load_client_private.h"
+#include "ewk_view_ui_client_private.h"
 #include "ewk_web_resource.h"
 #include <Ecore_Evas.h>
 #include <Edje.h>
@@ -48,6 +53,10 @@
 #include <Evas_GL.h>
 #endif
 
+#if USE(COORDINATED_GRAPHICS)
+#include "EflViewportHandler.h"
+#endif
+
 using namespace WebKit;
 using namespace WebCore;
 
@@ -60,6 +69,10 @@ static void _ewk_view_priv_loading_resources_clear(LoadingResourcesMap& loadingR
 
 struct _Ewk_View_Private_Data {
     OwnPtr<PageClientImpl> pageClient;
+#if USE(COORDINATED_GRAPHICS)
+    OwnPtr<EflViewportHandler> viewportHandler;
+#endif
+
     const char* uri;
     const char* title;
     const char* theme;
@@ -67,6 +80,7 @@ struct _Ewk_View_Private_Data {
     const char* cursorGroup;
     Evas_Object* cursorObject;
     LoadingResourcesMap loadingResourcesMap;
+    Ewk_Back_Forward_List* backForwardList;
 
 #ifdef HAVE_ECORE_X
     bool isUsingEcoreX;
@@ -85,6 +99,7 @@ struct _Ewk_View_Private_Data {
         , customEncoding(0)
         , cursorGroup(0)
         , cursorObject(0)
+        , backForwardList(0)
 #ifdef HAVE_ECORE_X
         , isUsingEcoreX(false)
 #endif
@@ -105,6 +120,8 @@ struct _Ewk_View_Private_Data {
 
         if (cursorObject)
             evas_object_del(cursorObject);
+
+        ewk_back_forward_list_free(backForwardList);
     }
 };
 
@@ -521,6 +538,10 @@ static void _ewk_view_smart_calculate(Evas_Object* ewkView)
     evas_object_geometry_get(ewkView, &x, &y, &width, &height);
 
     if (smartData->changed.size) {
+#if USE(COORDINATED_GRAPHICS)
+        priv->viewportHandler->updateViewportSize(IntSize(width, height));
+#endif
+
         if (priv->pageClient->page()->drawingArea())
             priv->pageClient->page()->drawingArea()->setSize(IntSize(width, height), IntSize());
 
@@ -590,7 +611,7 @@ static void _ewk_view_smart_color_set(Evas_Object* ewkView, int red, int green,
     g_parentSmartClass.color_set(ewkView, red, green, blue, alpha);
 }
 
-Eina_Bool ewk_view_smart_class_init(Ewk_View_Smart_Class* api)
+Eina_Bool ewk_view_smart_class_set(Ewk_View_Smart_Class* api)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(api, false);
 
@@ -635,16 +656,46 @@ static inline Evas_Smart* _ewk_view_smart_class_new(void)
     static Evas_Smart* smart = 0;
 
     if (EINA_UNLIKELY(!smart)) {
-        ewk_view_smart_class_init(&api);
+        ewk_view_smart_class_set(&api);
         smart = evas_smart_class_new(&api.sc);
     }
 
     return smart;
 }
 
-Evas_Object* ewk_view_base_add(Evas* canvas, WKContextRef contextRef, WKPageGroupRef pageGroupRef)
+static void _ewk_view_initialize(Evas_Object* ewkView, Ewk_Context* context, WKPageGroupRef pageGroupRef)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv)
+    EINA_SAFETY_ON_NULL_RETURN(context);
+
+    if (priv->pageClient)
+        return;
+
+    priv->pageClient = PageClientImpl::create(toImpl(ewk_context_WKContext_get(context)), toImpl(pageGroupRef), ewkView);
+    priv->backForwardList = ewk_back_forward_list_new(toAPI(priv->pageClient->page()->backForwardList()));
+
+#if USE(COORDINATED_GRAPHICS)
+    priv->viewportHandler = EflViewportHandler::create(priv->pageClient.get());
+#endif
+
+    WKPageRef wkPage = toAPI(priv->pageClient->page());
+    ewk_view_find_client_attach(wkPage, ewkView);
+    ewk_view_form_client_attach(wkPage, ewkView);
+    ewk_view_loader_client_attach(wkPage, ewkView);
+    ewk_view_policy_client_attach(wkPage, ewkView);
+    ewk_view_resource_load_client_attach(wkPage, ewkView);
+    ewk_view_ui_client_attach(wkPage, ewkView);
+
+    ewk_view_theme_set(ewkView, DEFAULT_THEME_PATH"/default.edj");
+}
+
+static Evas_Object* _ewk_view_add_with_smart(Evas* canvas, Evas_Smart* smart)
 {
-    Evas_Object* ewkView = evas_object_smart_add(canvas, _ewk_view_smart_class_new());
+    EINA_SAFETY_ON_NULL_RETURN_VAL(canvas, 0);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(smart, 0);
+
+    Evas_Object* ewkView = evas_object_smart_add(canvas, smart);
     if (!ewkView)
         return 0;
 
@@ -660,22 +711,44 @@ Evas_Object* ewk_view_base_add(Evas* canvas, WKContextRef contextRef, WKPageGrou
         return 0;
     }
 
-    priv->pageClient = PageClientImpl::create(toImpl(contextRef), toImpl(pageGroupRef), ewkView);
+    return ewkView;
+}
 
-    WKPageRef wkPage = toAPI(priv->pageClient->page());
-    ewk_view_form_client_attach(wkPage, ewkView);
-    ewk_view_loader_client_attach(wkPage, ewkView);
-    ewk_view_policy_client_attach(wkPage, ewkView);
-    ewk_view_resource_load_client_attach(wkPage, ewkView);
+/**
+ * @internal
+ * Constructs a ewk_view Evas_Object with WKType parameters.
+ */
+Evas_Object* ewk_view_base_add(Evas* canvas, WKContextRef contextRef, WKPageGroupRef pageGroupRef)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(canvas, 0);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(contextRef, 0);
+    Evas_Object* ewkView = _ewk_view_add_with_smart(canvas, _ewk_view_smart_class_new());
+    if (!ewkView)
+        return 0;
 
-    ewk_view_theme_set(ewkView, DEFAULT_THEME_PATH"/default.edj");
+    _ewk_view_initialize(ewkView, ewk_context_new_from_WKContext(contextRef), pageGroupRef);
+
+    return ewkView;
+}
+
+Evas_Object* ewk_view_smart_add(Evas* canvas, Evas_Smart* smart, Ewk_Context* context)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(canvas, 0);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(smart, 0);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(context, 0);
+
+    Evas_Object* ewkView = _ewk_view_add_with_smart(canvas, smart);
+    if (!ewkView)
+        return 0;
+
+    _ewk_view_initialize(ewkView, context, 0);
 
     return ewkView;
 }
 
 Evas_Object* ewk_view_add_with_context(Evas* canvas, Ewk_Context* context)
 {
-    return ewk_view_base_add(canvas, ewk_context_WKContext_get(context), 0);
+    return ewk_view_smart_add(canvas, _ewk_view_smart_class_new(), context);
 }
 
 Evas_Object* ewk_view_add(Evas* canvas)
@@ -867,6 +940,17 @@ const char* ewk_view_title_get(const Evas_Object* ewkView)
 
 /**
  * @internal
+ * Reports that the requested text was found.
+ *
+ * Emits signal: "text,found" with the number of matches.
+ */
+void ewk_view_text_found(Evas_Object* ewkView, unsigned int matchCount)
+{
+    evas_object_smart_callback_call(ewkView, "text,found", &matchCount);
+}
+
+/**
+ * @internal
  * The view title was changed by the frame loader.
  *
  * Emits signal: "title,changed" with pointer to new title string.
@@ -1020,6 +1104,13 @@ void ewk_view_display(Evas_Object* ewkView, const IntRect& rect)
     if (!smartData->image)
         return;
 
+#if USE(COORDINATED_GRAPHICS)
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+
+    evas_gl_make_current(priv->evasGl, priv->evasGlSurface, priv->evasGlContext);
+    priv->viewportHandler->display(rect);
+#endif
+
     evas_object_image_data_update_add(smartData->image, rect.x(), rect.y(), rect.width(), rect.height());
 }
 
@@ -1128,6 +1219,14 @@ Eina_Bool ewk_view_forward_possible(Evas_Object* ewkView)
     return priv->pageClient->page()->canGoForward();
 }
 
+Ewk_Back_Forward_List* ewk_view_back_forward_list_get(const Evas_Object* ewkView)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+
+    return priv->backForwardList;
+}
+
 void ewk_view_image_data_set(Evas_Object* ewkView, void* imageData, const IntSize& size)
 {
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
@@ -1297,3 +1396,61 @@ Eina_Bool ewk_view_setting_encoding_custom_set(Evas_Object* ewkView, const char*
 
     return true;
 }
+
+void ewk_view_page_close(Evas_Object* ewkView)
+{
+    evas_object_smart_callback_call(ewkView, "close,window", 0);
+}
+
+WKPageRef ewk_view_page_create(Evas_Object* ewkView)
+{
+    Evas_Object* newEwkView = 0;
+    evas_object_smart_callback_call(ewkView, "create,window", &newEwkView);
+
+    if (!newEwkView)
+        return 0;
+
+    return static_cast<WKPageRef>(WKRetain(ewk_view_page_get(newEwkView)));
+}
+
+// EwkFindOptions should be matched up orders with WkFindOptions.
+COMPILE_ASSERT_MATCHING_ENUM(EWK_FIND_OPTIONS_CASE_INSENSITIVE, kWKFindOptionsCaseInsensitive);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_FIND_OPTIONS_AT_WORD_STARTS, kWKFindOptionsAtWordStarts);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_FIND_OPTIONS_TREAT_MEDIAL_CAPITAL_AS_WORD_START, kWKFindOptionsTreatMedialCapitalAsWordStart);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_FIND_OPTIONS_BACKWARDS, kWKFindOptionsBackwards);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_FIND_OPTIONS_WRAP_AROUND, kWKFindOptionsWrapAround);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_FIND_OPTIONS_SHOW_OVERLAY, kWKFindOptionsShowOverlay);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_FIND_OPTIONS_SHOW_FIND_INDICATOR, kWKFindOptionsShowFindIndicator);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_FIND_OPTIONS_SHOW_HIGHLIGHT, kWKFindOptionsShowHighlight);
+
+Eina_Bool ewk_view_text_find(Evas_Object* ewkView, const char* text, Ewk_Find_Options options, unsigned int maxMatchCount)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(text, false);
+
+    WKRetainPtr<WKStringRef> findText(AdoptWK, WKStringCreateWithUTF8CString(text));
+    WKPageFindString(toAPI(priv->pageClient->page()), findText.get(), static_cast<WKFindOptions>(options), maxMatchCount);
+
+    return true;
+}
+
+Eina_Bool ewk_view_text_find_highlight_clear(Evas_Object* ewkView)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+
+    WKPageHideFindUI(toAPI(priv->pageClient->page()));
+
+    return true;
+}
+
+void ewk_view_contents_size_changed(const Evas_Object* ewkView, const IntSize& size)
+{
+#if USE(COORDINATED_GRAPHICS)
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+
+    priv->viewportHandler->didChangeContentsSize(size);
+#endif
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view.h b/Source/WebKit2/UIProcess/API/efl/ewk_view.h
index 057f725bd..423f9e143 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view.h
@@ -26,6 +26,8 @@
  *
  * The following signals (see evas_object_smart_callback_add()) are emitted:
  *
+ * - "close,window", void: window is closed.
+ * - "create,window", Evas_Object**: a new window is created.
  * - "download,cancelled", Ewk_Download_Job*: reports that a download was effectively cancelled.
  * - "download,failed", Ewk_Download_Job_Error*: reports that a download failed with the given error.
  * - "download,finished", Ewk_Download_Job*: reports that a download completed successfully.
@@ -59,6 +61,7 @@
  * - "resource,request,new", const Ewk_Web_Resource_Request*: a resource request was initiated.
  * - "resource,request,response", Ewk_Web_Resource_Load_Response*: a response to a resource request was received.
  * - "resource,request,sent", const Ewk_Web_Resource_Request*: a resource request was sent.
+ * - "text,found", unsigned int*: the requested text was found and it gives the number of matches.
  * - "title,changed", const char*: title of the main frame was changed.
  * - "uri,changed", const char*: uri of the main frame was changed.
  */
@@ -66,6 +69,7 @@
 #ifndef ewk_view_h
 #define ewk_view_h
 
+#include "ewk_back_forward_list.h"
 #include "ewk_context.h"
 #include "ewk_download_job.h"
 #include "ewk_intent.h"
@@ -216,6 +220,62 @@ struct _Ewk_Download_Job_Error {
 };
 
 /**
+ * Enum values used to specify search options.
+ * @brief   Provides option to find text
+ * @info    Keep this in sync with WKFindOptions.h
+ */
+enum _Ewk_Find_Options {
+    EWK_FIND_OPTIONS_NONE, /**< no search flags, this means a case sensitive, no wrap, forward only search. */
+    EWK_FIND_OPTIONS_CASE_INSENSITIVE = 1 << 0, /**< case insensitive search. */
+    EWK_FIND_OPTIONS_AT_WORD_STARTS = 1 << 1, /**< search text only at the beginning of the words. */
+    EWK_FIND_OPTIONS_TREAT_MEDIAL_CAPITAL_AS_WORD_START = 1 << 2, /**< treat capital letters in the middle of words as word start. */
+    EWK_FIND_OPTIONS_BACKWARDS = 1 << 3, /**< search backwards. */
+    EWK_FIND_OPTIONS_WRAP_AROUND = 1 << 4, /**< if not present search will stop at the end of the document. */
+    EWK_FIND_OPTIONS_SHOW_OVERLAY = 1 << 5, /**< show overlay */
+    EWK_FIND_OPTIONS_SHOW_FIND_INDICATOR = 1 << 6, /**< show indicator */
+    EWK_FIND_OPTIONS_SHOW_HIGHLIGHT = 1 << 7 /**< show highlight */
+};
+typedef enum _Ewk_Find_Options Ewk_Find_Options;
+
+/**
+ * Sets the smart class APIs, enabling view to be inherited.
+ *
+ * @param api class definition to set, all members with the
+ *        exception of @a Evas_Smart_Class->data may be overridden, must
+ *        @b not be @c NULL
+ *
+ * @note @a Evas_Smart_Class->data is used to implement type checking and
+ *       is not supposed to be changed/overridden. If you need extra
+ *       data for your smart class to work, just extend
+ *       Ewk_View_Smart_Class instead.
+ *       The Evas_Object which inherits the ewk_view should use
+ *       ewk_view_smart_add() to create Evas_Object instead of
+ *       evas_object_smart_add() because it performs additional initialization
+ *       for the ewk_view.
+ *
+ * @return @c EINA_TRUE on success or @c EINA_FALSE on failure (probably
+ *         version mismatch)
+ *
+ * @see ewk_view_smart_add()
+ */
+EAPI Eina_Bool ewk_view_smart_class_set(Ewk_View_Smart_Class *api);
+
+/**
+ * Creates a new EFL WebKit view object with Evas_Smart and Ewk_Context.
+ *
+ * @note The Evas_Object which inherits the ewk_view should create its
+ *       Evas_Object using this API instead of evas_object_smart_add()
+ *       because the default initialization for ewk_view is done in this API.
+ *
+ * @param e canvas object where to create the view object
+ * @param smart Evas_Smart object. Its type should be EWK_VIEW_TYPE_STR
+ * @param context Ewk_Context object which is used for initializing
+ *
+ * @return view object on success or @c NULL on failure
+ */
+Evas_Object *ewk_view_smart_add(Evas *e, Evas_Smart *smart, Ewk_Context *context);
+
+/**
  * Creates a new EFL WebKit view object.
  *
  * @param e canvas object where to create the view object
@@ -336,6 +396,21 @@ EAPI Eina_Bool    ewk_view_back_possible(Evas_Object *o);
 EAPI Eina_Bool    ewk_view_forward_possible(Evas_Object *o);
 
 /**
+ * Gets the back-forward list associated with this view.
+ *
+ * The returned instance is unique for this view and thus multiple calls
+ * to this function with the same view as parameter returns the same
+ * handle. This handle is alive while view is alive, thus one
+ * might want to listen for EVAS_CALLBACK_DEL on given view
+ * (@a o) to know when to stop using returned handle.
+ *
+ * @param o view object to get navigation back-forward list
+ *
+ * @return the back-forward list instance handle associated with this view
+ */
+EAPI Ewk_Back_Forward_List *ewk_view_back_forward_list_get(const Evas_Object *o);
+
+/**
  * Gets the current title of the main frame.
  *
  * It returns an internal string and should not
@@ -494,6 +569,27 @@ EAPI const char  *ewk_view_setting_encoding_custom_get(const Evas_Object *o);
  */
 EAPI Eina_Bool    ewk_view_setting_encoding_custom_set(Evas_Object *o, const char *encoding);
 
+/**
+* Searches the given string in the document.
+*
+* @param o view object to find text
+* @param text text to find
+* @param options options to find
+* @param max count to find, unlimited if 0
+*
+* @return @c EINA_TRUE on success, @c EINA_FALSE on errors
+*/
+EAPI Eina_Bool ewk_view_text_find(Evas_Object *o, const char *text, Ewk_Find_Options options, unsigned int max_match_count);
+
+/**
+* Clears the highlight of searched text.
+*
+* @param o view object to find text
+*
+* @return @c EINA_TRUE on success, @c EINA_FALSE on errors
+*/
+EAPI Eina_Bool ewk_view_text_find_highlight_clear(Evas_Object *o);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_find_client.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view_find_client.cpp
new file mode 100644
index 000000000..2a0dacaa3
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_find_client.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WKPage.h"
+#include "ewk_view_find_client_private.h"
+#include "ewk_view_private.h"
+
+static inline Evas_Object* toEwkView(const void* clientInfo)
+{
+    return static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+}
+
+static void didFindString(WKPageRef page, WKStringRef string, unsigned matchCount, const void* clientInfo)
+{
+    ewk_view_text_found(toEwkView(clientInfo), static_cast<unsigned int>(matchCount));
+}
+
+void ewk_view_find_client_attach(WKPageRef pageRef, Evas_Object* ewkView)
+{
+    WKPageFindClient findClient;
+    memset(&findClient, 0, sizeof(WKPageFindClient));
+    findClient.version = kWKPageFindClientCurrentVersion;
+    findClient.clientInfo = ewkView;
+    findClient.didFindString = didFindString;
+    WKPageSetPageFindClient(pageRef, &findClient);
+}
diff --git a/Source/WebKit2/UIProcess/Launcher/gtk/ThreadLauncherGtk.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view_find_client_private.h
index 84f72b54d..c17143360 100644
--- a/Source/WebKit2/UIProcess/Launcher/gtk/ThreadLauncherGtk.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_find_client_private.h
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Portions Copyright (c) 2010 Motorola Mobility, Inc.  All rights reserved.
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,17 +23,12 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "ThreadLauncher.h"
+#ifndef ewk_view_find_client_private_h
+#define ewk_view_find_client_private_h
 
-#include <WebCore/NotImplemented.h>
+#include <Evas.h>
+#include <WebKit2/WKBase.h>
 
-namespace WebKit {
+void ewk_view_find_client_attach(WKPageRef pageRef, Evas_Object* ewkView);
 
-CoreIPC::Connection::Identifier ThreadLauncher::createWebThread()
-{
-    notImplemented();
-    return -1;
-}
-
-} // namespace WebKit
+#endif // ewk_view_find_client_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp
index cc8b120cd..2deb38e19 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp
@@ -24,8 +24,10 @@
  */
 
 #include "config.h"
+#include "ewk_view.h"
 
 #include "WKFrame.h"
+#include "ewk_back_forward_list_private.h"
 #include "ewk_intent.h"
 #include "ewk_intent_private.h"
 #include "ewk_intent_service.h"
@@ -123,6 +125,14 @@ static void didFailProvisionalLoadWithErrorForFrame(WKPageRef page, WKFrameRef f
     ewk_web_error_free(ewkError);
 }
 
+static void didChangeBackForwardList(WKPageRef page, WKBackForwardListItemRef addedItem, WKArrayRef removedItems, const void* clientInfo)
+{
+    Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    ASSERT(ewkView);
+
+    ewk_back_forward_list_changed(ewk_view_back_forward_list_get(ewkView), addedItem, removedItems);
+}
+
 void ewk_view_loader_client_attach(WKPageRef pageRef, Evas_Object* ewkView)
 {
     WKPageLoaderClient loadClient;
@@ -144,5 +154,6 @@ void ewk_view_loader_client_attach(WKPageRef pageRef, Evas_Object* ewkView)
     loadClient.didStartProvisionalLoadForFrame = didStartProvisionalLoadForFrame;
     loadClient.didReceiveServerRedirectForProvisionalLoadForFrame = didReceiveServerRedirectForProvisionalLoadForFrame;
     loadClient.didFailProvisionalLoadWithErrorForFrame = didFailProvisionalLoadWithErrorForFrame;
+    loadClient.didChangeBackForwardList = didChangeBackForwardList;
     WKPageSetPageLoaderClient(pageRef, &loadClient);
 }
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
index 3b57a7618..f40298587 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
@@ -61,12 +61,16 @@ void ewk_view_load_provisional_redirect(Evas_Object* ewkView);
 void ewk_view_load_provisional_started(Evas_Object* ewkView);
 void ewk_view_navigation_policy_decision(Evas_Object* ewkView, Ewk_Navigation_Policy_Decision* decision);
 void ewk_view_new_window_policy_decision(Evas_Object* ewkView, Ewk_Navigation_Policy_Decision* decision);
+void ewk_view_page_close(Evas_Object* ewkView);
+WKPageRef ewk_view_page_create(Evas_Object* ewkView);
 void ewk_view_title_changed(Evas_Object* ewkView, const char* title);
 void ewk_view_resource_load_failed(Evas_Object* ewkView, uint64_t resourceIdentifier, Ewk_Web_Error* error);
 void ewk_view_resource_load_finished(Evas_Object* ewkView, uint64_t resourceIdentifier);
 void ewk_view_resource_load_initiated(Evas_Object* ewkView, uint64_t resourceIdentifier, Ewk_Web_Resource* resource, Ewk_Url_Request* request);
 void ewk_view_resource_load_response(Evas_Object* ewkView, uint64_t resourceIdentifier, Ewk_Url_Response* response);
 void ewk_view_resource_request_sent(Evas_Object* ewkView, uint64_t resourceIdentifier, Ewk_Url_Request* request, Ewk_Url_Response* redirectResponse);
+void ewk_view_text_found(Evas_Object* ewkView, unsigned int matchCount);
+void ewk_view_contents_size_changed(const Evas_Object* ewkView, const WebCore::IntSize&);
 
 Evas_Object* ewk_view_base_add(Evas* canvas, WKContextRef, WKPageGroupRef);
 
diff --git a/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view_ui_client.cpp
index f37a5d3a2..18ede08a1 100644
--- a/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_ui_client.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,45 +24,32 @@
  */
 
 #include "config.h"
-#include "ThreadLauncher.h"
 
-#include <WebCore/RunLoop.h>
+#include "ewk_view_private.h"
+#include "ewk_view_ui_client_private.h"
 
-using namespace WebCore;
-
-namespace WebKit {
-
-ThreadLauncher::ThreadLauncher(Client* client)
-    : m_client(client)
+static inline Evas_Object* toEwkView(const void* clientInfo)
 {
-    launchThread();
+    return static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
 }
 
-void ThreadLauncher::launchThread()
+static void closePage(WKPageRef, const void* clientInfo)
 {
-    m_isLaunching = true;
-
-    CoreIPC::Connection::Identifier connectionIdentifier = createWebThread();
-
-    // We've finished launching the thread, message back to the main run loop.
-    RunLoop::main()->dispatch(bind(&ThreadLauncher::didFinishLaunchingThread, this, connectionIdentifier));
+    ewk_view_page_close(toEwkView(clientInfo));
 }
 
-void ThreadLauncher::didFinishLaunchingThread(CoreIPC::Connection::Identifier identifier)
+static WKPageRef createNewPage(WKPageRef, WKURLRequestRef, WKDictionaryRef, WKEventModifiers, WKEventMouseButton, const void* clientInfo)
 {
-    m_isLaunching = false;
-    
-    if (!m_client) {
-        // FIXME: Dispose of the connection identifier.
-        return;
-    }
-
-    m_client->didFinishLaunching(this, identifier);
+     return ewk_view_page_create(toEwkView(clientInfo));
 }
 
-void ThreadLauncher::invalidate()
+void ewk_view_ui_client_attach(WKPageRef pageRef, Evas_Object* ewkView)
 {
-    m_client = 0;
+    WKPageUIClient uiClient;
+    memset(&uiClient, 0, sizeof(WKPageUIClient));
+    uiClient.version = kWKPageUIClientCurrentVersion;
+    uiClient.clientInfo = ewkView;
+    uiClient.close = closePage;
+    uiClient.createNewPage = createNewPage;
+    WKPageSetPageUIClient(pageRef, &uiClient);
 }
-
-} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_ui_client_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_view_ui_client_private.h
new file mode 100644
index 000000000..4c9c492a5
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_ui_client_private.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_view_ui_client_private_h
+#define ewk_view_ui_client_private_h
+
+#include <Evas.h>
+#include <WebKit2/WKBase.h>
+
+void ewk_view_ui_client_attach(WKPageRef pageRef, Evas_Object* ewkView);
+
+#endif // ewk_view_ui_client_private_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
index 8ecd480e5..5a6adae0a 100644
--- a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
@@ -142,6 +142,9 @@ void PageClientImpl::toolTipChanged(const String&, const String& newToolTip)
 
 void PageClientImpl::setCursor(const Cursor& cursor)
 {
+    if (!gtk_widget_get_realized(m_viewWidget))
+        return;
+
     // [GTK] Widget::setCursor() gets called frequently
     // http://bugs.webkit.org/show_bug.cgi?id=16388
     // Setting the cursor may be an expensive operation in some backends,
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitBackForwardListPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitBackForwardListPrivate.h
index e01909201..333e68d18 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitBackForwardListPrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitBackForwardListPrivate.h
@@ -28,7 +28,7 @@
 
 #include "WebBackForwardList.h"
 #include "WebKitBackForwardList.h"
-#include <WebKit2/WebKit2.h>
+#include <WebKit2/WebKit2_C.h>
 
 WebKitBackForwardList* webkitBackForwardListCreate(WKBackForwardListRef);
 WebKitBackForwardListItem* webkitBackForwardListItemGetOrCreate(WKBackForwardListItemRef);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp
index 8cd149c5b..6c3bf920a 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp
@@ -65,16 +65,7 @@ static void didCommitLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef us
     if (!WKFrameIsMainFrame(frame))
         return;
 
-    WebKitWebView* webView = WEBKIT_WEB_VIEW(clientInfo);
-    WebKitWebResource* resource = webkit_web_view_get_main_resource(webView);
-    if (resource) {
-        // We might not have a resource if this load is a content replacement.
-        // FIXME: For some reason, when going back/forward this callback is emitted even before
-        // didInitiateLoadForResource(), so we don't have a main resource at this point either.
-        webkitURIResponseSetCertificateInfo(webkit_web_resource_get_response(resource), WKFrameGetCertificateInfo(frame));
-    }
-
-    webkitWebViewLoadChanged(webView, WEBKIT_LOAD_COMMITTED);
+    webkitWebViewLoadChanged(WEBKIT_WEB_VIEW(clientInfo), WEBKIT_LOAD_COMMITTED);
 }
 
 static void didFinishLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitPolicyDecisionPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitPolicyDecisionPrivate.h
index 62580c83e..e02caab64 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitPolicyDecisionPrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitPolicyDecisionPrivate.h
@@ -21,7 +21,7 @@
 #define WebKitPolicyDecisionPrivate_h
 
 #include "WebKitPolicyDecision.h"
-#include <WebKit2/WebKit2.h>
+#include <WebKit2/WebKit2_C.h>
 
 void webkitPolicyDecisionSetListener(WebKitPolicyDecision*, WKFramePolicyListenerRef);
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h
index aa8a71bf9..8fede827f 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h
@@ -41,7 +41,7 @@
 #include <WebKit2/WKSoupRequestManager.h>
 #include <WebKit2/WKString.h>
 #include <WebKit2/WKTextChecker.h>
-#include <WebKit2/WebKit2.h>
+#include <WebKit2/WebKit2_C.h>
 #include <glib.h>
 #include <wtf/Assertions.h>
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitSettingsPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitSettingsPrivate.h
index a47ac7f74..4e5d23217 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitSettingsPrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitSettingsPrivate.h
@@ -27,7 +27,7 @@
 #define WebKitSettingsPrivate_h
 
 #include "WebKitSettings.h"
-#include <WebKit2/WebKit2.h>
+#include <WebKit2/WebKit2_C.h>
 
 void webkitSettingsAttachSettingsToPage(WebKitSettings*, WKPageRef);
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.cpp
index 5676bb6d7..5ae62c6fd 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.cpp
@@ -140,13 +140,15 @@ void WebKitTextChecker::setSpellCheckingEnabled(bool enabled)
     WKTextCheckerContinuousSpellCheckingEnabledStateChanged(enabled);
 }
 
-void WebKitTextChecker::setSpellCheckingLanguages(const String& languages)
+const CString& WebKitTextChecker::getSpellCheckingLanguages()
 {
-    if (m_spellCheckingLanguages == languages)
-        return;
-    m_spellCheckingLanguages = languages;
+    String spellCheckingLanguages = m_textChecker->getSpellCheckingLanguages();
+    m_spellCheckingLanguages = spellCheckingLanguages.isEmpty() ? CString() : spellCheckingLanguages.utf8();
+    return m_spellCheckingLanguages;
+}
 
-    // We need to update the languages in the enchant-based checker too.
-    m_textChecker->updateSpellCheckingLanguages(languages);
+void WebKitTextChecker::setSpellCheckingLanguages(const CString& languages)
+{
+    m_textChecker->updateSpellCheckingLanguages(String::fromUTF8(languages.data()));
 }
 #endif // ENABLE(SPELLCHECK)
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.h b/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.h
index dd7583a3a..3cca5622a 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.h
@@ -26,6 +26,7 @@
 #include <wtf/FastAllocBase.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
+#include <wtf/text/CString.h>
 
 class WebKitTextChecker {
     WTF_MAKE_FAST_ALLOCATED;
@@ -43,14 +44,14 @@ public:
     void ignoreWord(const String& word);
 
     // To be called from WebKitWebContext only.
-    const String getSpellCheckingLanguages() { return m_spellCheckingLanguages; }
-    void setSpellCheckingLanguages(const String& spellCheckingLanguages);
+    const CString& getSpellCheckingLanguages();
+    void setSpellCheckingLanguages(const CString& spellCheckingLanguages);
 
 private:
     WebKitTextChecker();
 
     OwnPtr<WebCore::TextCheckerEnchant> m_textChecker;
-    String m_spellCheckingLanguages;
+    CString m_spellCheckingLanguages;
     bool m_spellCheckingEnabled;
 };
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
index 4008e865f..fe9df9f75 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
@@ -77,7 +77,6 @@ struct _WebKitWebContextPrivate {
 #endif
 #if ENABLE(SPELLCHECK)
     OwnPtr<WebKitTextChecker> textChecker;
-    GOwnPtr<gchar> spellCheckingLanguages;
 #endif
 };
 
@@ -125,7 +124,7 @@ static void webkit_web_context_class_init(WebKitWebContextClass* webContextClass
 static gpointer createDefaultWebContext(gpointer)
 {
     static GRefPtr<WebKitWebContext> webContext = adoptGRef(WEBKIT_WEB_CONTEXT(g_object_new(WEBKIT_TYPE_WEB_CONTEXT, NULL)));
-    webContext->priv->context = WKContextGetSharedProcessContext();
+    webContext->priv->context = WKContextCreate();
     webContext->priv->requestManager = WKContextGetSoupRequestManager(webContext->priv->context.get());
     WKContextSetCacheModel(webContext->priv->context.get(), kWKCacheModelPrimaryWebBrowser);
     attachDownloadClientToContext(webContext.get());
@@ -432,7 +431,7 @@ void webkit_web_context_register_uri_scheme(WebKitWebContext* context, const cha
  * webkit_web_context_get_spell_checking_enabled:
  * @context: a #WebKitWebContext
  *
- * Get the current status of the spell checking feature.
+ * Get whether spell checking feature is currently enabled.
  *
  * Returns: %TRUE If spell checking is enabled, or %FALSE otherwise.
  */
@@ -468,18 +467,24 @@ void webkit_web_context_set_spell_checking_enabled(WebKitWebContext* context, gb
  * @context: a #WebKitWebContext
  *
  * Get the the list of spell checking languages associated with
- * @context, separated by commas. See
- * webkit_web_context_set_spell_checking_languages() for more details
- * on the format of the languages in the list.
+ * @context separated by commas, or %NULL if no languages have been
+ * previously set.
+
+ * See webkit_web_context_set_spell_checking_languages() for more
+ * details on the format of the languages in the list.
  *
- * Returns: (transfer none): A comma separated list of languages.
+ * Returns: (transfer none): A comma separated list of languages if
+ * available, or %NULL otherwise.
  */
 const gchar* webkit_web_context_get_spell_checking_languages(WebKitWebContext* context)
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_CONTEXT(context), 0);
 
 #if ENABLE(SPELLCHECK)
-    return context->priv->spellCheckingLanguages.get();
+    CString spellCheckingLanguages = context->priv->textChecker->getSpellCheckingLanguages();
+    if (spellCheckingLanguages.isNull())
+        return 0;
+    return spellCheckingLanguages.data();
 #else
     return 0;
 #endif
@@ -488,25 +493,28 @@ const gchar* webkit_web_context_get_spell_checking_languages(WebKitWebContext* c
 /**
  * webkit_web_context_set_spell_checking_languages:
  * @context: a #WebKitWebContext
- * @languages: (allow-none): new list of spell checking
- * languages separated by commas, or %NULL
+ * @languages: new list of spell checking languages separated by
+ * commas
  *
  * Set the list of spell checking languages to be used for spell
- * checking, separated by commas. In case %NULL is passed, the default
- * value as returned by gtk_get_default_language() will be used.
+ * checking, separated by commas.
  *
  * The locale string typically is in the form lang_COUNTRY, where lang
  * is an ISO-639 language code, and COUNTRY is an ISO-3166 country code.
  * For instance, sv_FI for Swedish as written in Finland or pt_BR
  * for Portuguese as written in Brazil.
+ *
+ * You need to call this function with a valid list of languages at
+ * least once in order to properly enable the spell checking feature
+ * in WebKit.
  */
 void webkit_web_context_set_spell_checking_languages(WebKitWebContext* context, const gchar* languages)
 {
     g_return_if_fail(WEBKIT_IS_WEB_CONTEXT(context));
+    g_return_if_fail(languages);
 
 #if ENABLE(SPELLCHECK)
-    context->priv->textChecker->setSpellCheckingLanguages(String(languages));
-    context->priv->spellCheckingLanguages.set(g_strdup(languages));
+    context->priv->textChecker->setSpellCheckingLanguages(languages);
 #endif
 }
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebResource.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebResource.cpp
index 7fbe28a0a..5ca5e989d 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebResource.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebResource.cpp
@@ -243,6 +243,11 @@ void webkitWebResourceFailed(WebKitWebResource* resource, GError* error)
     g_signal_emit(resource, signals[FINISHED], 0, NULL);
 }
 
+WKFrameRef webkitWebResourceGetFrame(WebKitWebResource* resource)
+{
+    return resource->priv->wkFrame.get();
+}
+
 /**
  * webkit_web_resource_get_uri:
  * @resource: a #WebKitWebResource
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebResourcePrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebResourcePrivate.h
index 5011ae4dd..ed1fe02f1 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebResourcePrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebResourcePrivate.h
@@ -29,6 +29,7 @@ void webkitWebResourceSetResponse(WebKitWebResource*, WebKitURIResponse*);
 void webkitWebResourceNotifyProgress(WebKitWebResource*, guint64 bytesReceived);
 void webkitWebResourceFinished(WebKitWebResource*);
 void webkitWebResourceFailed(WebKitWebResource*, GError*);
+WKFrameRef webkitWebResourceGetFrame(WebKitWebResource*);
 
 
 #endif // WebKitWebResourcePrivate_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
index 8bf4d8fe0..80e5fff23 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
@@ -124,6 +124,10 @@ struct _WebKitWebViewPrivate {
     CString activeURI;
     ReplaceContentStatus replaceContentStatus;
 
+    bool waitingForMainResource;
+    gulong mainResourceResponseHandlerID;
+    WebKitLoadEvent lastDelayedEvent;
+
     GRefPtr<WebKitBackForwardList> backForwardList;
     GRefPtr<WebKitSettings> settings;
     GRefPtr<WebKitWindowProperties> windowProperties;
@@ -268,6 +272,14 @@ static void webkitWebViewDisconnectSettingsSignalHandlers(WebKitWebView* webView
 
 }
 
+static void webkitWebViewDisconnectMainResourceResponseChangedSignalHandler(WebKitWebView* webView)
+{
+    WebKitWebViewPrivate* priv = webView->priv;
+    if (priv->mainResourceResponseHandlerID)
+        g_signal_handler_disconnect(priv->mainResource.get(), priv->mainResourceResponseHandlerID);
+    priv->mainResourceResponseHandlerID = 0;
+}
+
 static void fileChooserDialogResponseCallback(GtkDialog* dialog, gint responseID, WebKitFileChooserRequest* request)
 {
     GRefPtr<WebKitFileChooserRequest> adoptedRequest = adoptGRef(request);
@@ -382,7 +394,8 @@ static void webkitWebViewGetProperty(GObject* object, guint propId, GValue* valu
 
 static void webkitWebViewFinalize(GObject* object)
 {
-    WebKitWebViewPrivate* priv = WEBKIT_WEB_VIEW(object)->priv;
+    WebKitWebView* webView = WEBKIT_WEB_VIEW(object);
+    WebKitWebViewPrivate* priv = webView->priv;
 
     if (priv->javascriptGlobalContext)
         JSGlobalContextRelease(priv->javascriptGlobalContext);
@@ -391,7 +404,8 @@ static void webkitWebViewFinalize(GObject* object)
     if (priv->modalLoop && g_main_loop_is_running(priv->modalLoop.get()))
         g_main_loop_quit(priv->modalLoop.get());
 
-    webkitWebViewDisconnectSettingsSignalHandlers(WEBKIT_WEB_VIEW(object));
+    webkitWebViewDisconnectMainResourceResponseChangedSignalHandler(webView);
+    webkitWebViewDisconnectSettingsSignalHandlers(webView);
 
     priv->~WebKitWebViewPrivate();
     G_OBJECT_CLASS(webkit_web_view_parent_class)->finalize(object);
@@ -1112,20 +1126,68 @@ static bool updateReplaceContentStatus(WebKitWebView* webView, WebKitLoadEvent l
     return false;
 }
 
+static void setCertificateToMainResource(WebKitWebView* webView)
+{
+    WebKitWebViewPrivate* priv = webView->priv;
+    ASSERT(priv->mainResource.get());
+
+    webkitURIResponseSetCertificateInfo(webkit_web_resource_get_response(priv->mainResource.get()),
+                                        WKFrameGetCertificateInfo(webkitWebResourceGetFrame(priv->mainResource.get())));
+}
+
+static void webkitWebViewEmitLoadChanged(WebKitWebView* webView, WebKitLoadEvent loadEvent)
+{
+    if (loadEvent == WEBKIT_LOAD_FINISHED) {
+        webView->priv->waitingForMainResource = false;
+        webkitWebViewDisconnectMainResourceResponseChangedSignalHandler(webView);
+    } else
+        webkitWebViewUpdateURI(webView);
+    g_signal_emit(webView, signals[LOAD_CHANGED], 0, loadEvent);
+}
+
+static void webkitWebViewEmitDelayedLoadEvents(WebKitWebView* webView)
+{
+    WebKitWebViewPrivate* priv = webView->priv;
+    if (!priv->waitingForMainResource)
+        return;
+    ASSERT(priv->lastDelayedEvent == WEBKIT_LOAD_COMMITTED || priv->lastDelayedEvent == WEBKIT_LOAD_FINISHED);
+
+    if (priv->lastDelayedEvent == WEBKIT_LOAD_FINISHED)
+        webkitWebViewEmitLoadChanged(webView, WEBKIT_LOAD_COMMITTED);
+    webkitWebViewEmitLoadChanged(webView, priv->lastDelayedEvent);
+    priv->waitingForMainResource = false;
+}
+
 void webkitWebViewLoadChanged(WebKitWebView* webView, WebKitLoadEvent loadEvent)
 {
     if (loadEvent == WEBKIT_LOAD_STARTED) {
+        // Finish a possible previous load waiting for main resource.
+        webkitWebViewEmitDelayedLoadEvents(webView);
+
         webView->priv->loadingResourcesMap.clear();
         webView->priv->mainResource = 0;
-    } else if (loadEvent == WEBKIT_LOAD_COMMITTED)
+        webView->priv->waitingForMainResource = false;
+    } else if (loadEvent == WEBKIT_LOAD_COMMITTED) {
         webView->priv->subresourcesMap.clear();
+        if (webView->priv->replaceContentStatus != ReplacingContent) {
+            if (!webView->priv->mainResource) {
+                // When a page is loaded from the history cache, the main resource load callbacks
+                // are called when the main frame load is finished. We want to make sure there's a
+                // main resource available when load has been committed, so we delay the emission of
+                // load-changed signal until main resource object has been created.
+                webView->priv->waitingForMainResource = true;
+            } else
+                setCertificateToMainResource(webView);
+        }
+    }
 
     if (updateReplaceContentStatus(webView, loadEvent))
         return;
 
-    if (loadEvent != WEBKIT_LOAD_FINISHED)
-        webkitWebViewUpdateURI(webView);
-    g_signal_emit(webView, signals[LOAD_CHANGED], 0, loadEvent);
+    if (webView->priv->waitingForMainResource)
+        webView->priv->lastDelayedEvent = loadEvent;
+    else
+        webkitWebViewEmitLoadChanged(webView, loadEvent);
 }
 
 void webkitWebViewLoadFailed(WebKitWebView* webView, WebKitLoadEvent loadEvent, const char* failingURI, GError *error)
@@ -1197,9 +1259,9 @@ void webkitWebViewRunAsModal(WebKitWebView* webView)
     g_signal_emit(webView, signals[RUN_AS_MODAL], 0, NULL);
 
     webView->priv->modalLoop = adoptGRef(g_main_loop_new(0, FALSE));
-    GDK_THREADS_ENTER();
+    gdk_threads_leave();
     g_main_loop_run(webView->priv->modalLoop.get());
-    GDK_THREADS_LEAVE();
+    gdk_threads_enter();
 }
 
 void webkitWebViewClosePage(WebKitWebView* webView)
@@ -1269,6 +1331,24 @@ void webkitWebViewPrintFrame(WebKitWebView* webView, WKFrameRef wkFrame)
     g_signal_connect(printOperation.leakRef(), "finished", G_CALLBACK(g_object_unref), 0);
 }
 
+static void mainResourceResponseChangedCallback(WebKitWebResource*, GParamSpec*, WebKitWebView* webView)
+{
+    webkitWebViewDisconnectMainResourceResponseChangedSignalHandler(webView);
+    setCertificateToMainResource(webView);
+    webkitWebViewEmitDelayedLoadEvents(webView);
+}
+
+static void waitForMainResourceResponseIfWaitingForResource(WebKitWebView* webView)
+{
+    WebKitWebViewPrivate* priv = webView->priv;
+    if (!priv->waitingForMainResource)
+        return;
+
+    webkitWebViewDisconnectMainResourceResponseChangedSignalHandler(webView);
+    priv->mainResourceResponseHandlerID =
+        g_signal_connect(priv->mainResource.get(), "notify::response", G_CALLBACK(mainResourceResponseChangedCallback), webView);
+}
+
 static inline bool webkitWebViewIsReplacingContentOrDidReplaceContent(WebKitWebView* webView)
 {
     return (webView->priv->replaceContentStatus == ReplacingContent || webView->priv->replaceContentStatus == DidReplaceContent);
@@ -1281,8 +1361,10 @@ void webkitWebViewResourceLoadStarted(WebKitWebView* webView, WKFrameRef wkFrame
 
     WebKitWebViewPrivate* priv = webView->priv;
     WebKitWebResource* resource = webkitWebResourceCreate(wkFrame, request, isMainResource);
-    if (WKFrameIsMainFrame(wkFrame) && (isMainResource || !priv->mainResource))
+    if (WKFrameIsMainFrame(wkFrame) && (isMainResource || !priv->mainResource)) {
         priv->mainResource = resource;
+        waitForMainResourceResponseIfWaitingForResource(webView);
+    }
     priv->loadingResourcesMap.set(resourceIdentifier, adoptGRef(resource));
     g_signal_emit(webView, signals[RESOURCE_LOAD_STARTED], 0, resource, request);
 }
@@ -2318,3 +2400,171 @@ gboolean webkit_web_view_can_show_mime_type(WebKitWebView* webView, const char*
     WebPageProxy* page = webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView));
     return page->canShowMIMEType(String::fromUTF8(mimeType));
 }
+
+struct ViewSaveAsyncData {
+    WKRetainPtr<WKDataRef> wkData;
+    GRefPtr<GFile> file;
+    GRefPtr<GCancellable> cancellable;
+};
+WEBKIT_DEFINE_ASYNC_DATA_STRUCT(ViewSaveAsyncData)
+
+static void fileReplaceContentsCallback(GObject* object, GAsyncResult* result, gpointer data)
+{
+    GFile* file = G_FILE(object);
+    GRefPtr<GSimpleAsyncResult> savedToFileResult = adoptGRef(G_SIMPLE_ASYNC_RESULT(data));
+
+    GError* error = 0;
+    if (!g_file_replace_contents_finish(file, result, 0, &error))
+        g_simple_async_result_take_error(savedToFileResult.get(), error);
+
+    g_simple_async_result_complete(savedToFileResult.get());
+}
+
+static void getContentsAsMHTMLDataCallback(WKDataRef wkData, WKErrorRef, void* context)
+{
+    GRefPtr<GSimpleAsyncResult> result = adoptGRef(G_SIMPLE_ASYNC_RESULT(context));
+    ViewSaveAsyncData* data = static_cast<ViewSaveAsyncData*>(g_simple_async_result_get_op_res_gpointer(result.get()));
+    GError* error = 0;
+
+    if (g_cancellable_set_error_if_cancelled(data->cancellable.get(), &error))
+        g_simple_async_result_take_error(result.get(), error);
+    else {
+        // We need to retain the data until the asyncronous process
+        // initiated by the user has finished completely.
+        data->wkData = wkData;
+
+        // If we are saving to a file we need to write the data on disk before finishing.
+        if (g_simple_async_result_get_source_tag(result.get()) == webkit_web_view_save_to_file) {
+            ASSERT(G_IS_FILE(data->file.get()));
+            g_file_replace_contents_async(data->file.get(), reinterpret_cast<const gchar*>(WKDataGetBytes(data->wkData.get())), WKDataGetSize(data->wkData.get()), 0, FALSE, G_FILE_CREATE_REPLACE_DESTINATION,
+                                          data->cancellable.get(), fileReplaceContentsCallback, g_object_ref(result.get()));
+            return;
+        }
+    }
+
+    g_simple_async_result_complete(result.get());
+}
+
+/**
+ * webkit_web_view_save:
+ * @web_view: a #WebKitWebView
+ * @save_mode: the #WebKitSaveMode specifying how the web page should be saved.
+ * @cancellable: (allow-none): a #GCancellable or %NULL to ignore
+ * @callback: (scope async): a #GAsyncReadyCallback to call when the request is satisfied
+ * @user_data: (closure): the data to pass to callback function
+ *
+ * Asynchronously save the current web page associated to the
+ * #WebKitWebView into a self-contained format using the mode
+ * specified in @save_mode.
+ *
+ * When the operation is finished, @callback will be called. You can
+ * then call webkit_web_view_save_finish() to get the result of the
+ * operation.
+ */
+void webkit_web_view_save(WebKitWebView* webView, WebKitSaveMode saveMode, GCancellable* cancellable, GAsyncReadyCallback callback, gpointer userData)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
+
+    // We only support MHTML at the moment.
+    g_return_if_fail(saveMode == WEBKIT_SAVE_MODE_MHTML);
+
+    GSimpleAsyncResult* result = g_simple_async_result_new(G_OBJECT(webView), callback, userData,
+                                                           reinterpret_cast<gpointer>(webkit_web_view_save));
+    ViewSaveAsyncData* data = createViewSaveAsyncData();
+    data->cancellable = cancellable;
+    g_simple_async_result_set_op_res_gpointer(result, data, reinterpret_cast<GDestroyNotify>(destroyViewSaveAsyncData));
+
+    WKPageRef wkPage = toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView)));
+    WKPageGetContentsAsMHTMLData(wkPage, false, result, getContentsAsMHTMLDataCallback);
+}
+
+/**
+ * webkit_web_view_save_finish:
+ * @web_view: a #WebKitWebView
+ * @result: a #GAsyncResult
+ * @error: return location for error or %NULL to ignore
+ *
+ * Finish an asynchronous operation started with webkit_web_view_save().
+ *
+ * Returns: (transfer full): a #GInputStream with the result of saving
+ *    the current web page or %NULL in case of error.
+ */
+GInputStream* webkit_web_view_save_finish(WebKitWebView* webView, GAsyncResult* result, GError** error)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), 0);
+    g_return_val_if_fail(G_IS_ASYNC_RESULT(result), 0);
+
+    GSimpleAsyncResult* simple = G_SIMPLE_ASYNC_RESULT(result);
+    g_warn_if_fail(g_simple_async_result_get_source_tag(simple) == webkit_web_view_save);
+
+    if (g_simple_async_result_propagate_error(simple, error))
+        return 0;
+
+    GInputStream* dataStream = g_memory_input_stream_new();
+    ViewSaveAsyncData* data = static_cast<ViewSaveAsyncData*>(g_simple_async_result_get_op_res_gpointer(simple));
+    gsize length = WKDataGetSize(data->wkData.get());
+    if (length)
+        g_memory_input_stream_add_data(G_MEMORY_INPUT_STREAM(dataStream), g_memdup(WKDataGetBytes(data->wkData.get()), length), length, g_free);
+
+    return dataStream;
+}
+
+/**
+ * webkit_web_view_save_to_file:
+ * @web_view: a #WebKitWebView
+ * @file: the #GFile where the current web page should be saved to.
+ * @save_mode: the #WebKitSaveMode specifying how the web page should be saved.
+ * @cancellable: (allow-none): a #GCancellable or %NULL to ignore
+ * @callback: (scope async): a #GAsyncReadyCallback to call when the request is satisfied
+ * @user_data: (closure): the data to pass to callback function
+ *
+ * Asynchronously save the current web page associated to the
+ * #WebKitWebView into a self-contained format using the mode
+ * specified in @save_mode and writing it to @file.
+ *
+ * When the operation is finished, @callback will be called. You can
+ * then call webkit_web_view_save_to_file_finish() to get the result of the
+ * operation.
+ */
+void webkit_web_view_save_to_file(WebKitWebView* webView, GFile* file, WebKitSaveMode saveMode, GCancellable* cancellable, GAsyncReadyCallback callback, gpointer userData)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
+    g_return_if_fail(G_IS_FILE(file));
+
+    // We only support MHTML at the moment.
+    g_return_if_fail(saveMode == WEBKIT_SAVE_MODE_MHTML);
+
+    GSimpleAsyncResult* result = g_simple_async_result_new(G_OBJECT(webView), callback, userData,
+                                                           reinterpret_cast<gpointer>(webkit_web_view_save_to_file));
+    ViewSaveAsyncData* data = createViewSaveAsyncData();
+    data->file = file;
+    data->cancellable = cancellable;
+    g_simple_async_result_set_op_res_gpointer(result, data, reinterpret_cast<GDestroyNotify>(destroyViewSaveAsyncData));
+
+    WKPageRef wkPage = toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView)));
+    WKPageGetContentsAsMHTMLData(wkPage, false, result, getContentsAsMHTMLDataCallback);
+}
+
+/**
+ * webkit_web_view_save_to_file_finish:
+ * @web_view: a #WebKitWebView
+ * @result: a #GAsyncResult
+ * @error: return location for error or %NULL to ignore
+ *
+ * Finish an asynchronous operation started with webkit_web_view_save_to_file().
+ *
+ * Returns: %TRUE if the web page was successfully saved to a file or %FALSE otherwise.
+ */
+gboolean webkit_web_view_save_to_file_finish(WebKitWebView* webView, GAsyncResult* result, GError** error)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), FALSE);
+    g_return_val_if_fail(G_IS_ASYNC_RESULT(result), FALSE);
+
+    GSimpleAsyncResult* simple = G_SIMPLE_ASYNC_RESULT(result);
+    g_warn_if_fail(g_simple_async_result_get_source_tag(simple) == webkit_web_view_save_to_file);
+
+    if (g_simple_async_result_propagate_error(simple, error))
+        return FALSE;
+
+    return TRUE;
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
index 2553b1840..6ebd17f04 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
@@ -118,6 +118,17 @@ typedef enum {
     WEBKIT_LOAD_FINISHED
 } WebKitLoadEvent;
 
+/**
+ * WebKitSaveMode:
+ * @WEBKIT_SAVE_MODE_MHTML: Save the current page using the MHTML format.
+ *
+ * Enum values to specify the different ways in which a #WebKitWebView
+ * can save its current web page into a self-contained file.
+ */
+typedef enum {
+    WEBKIT_SAVE_MODE_MHTML
+} WebKitSaveMode;
+
 struct _WebKitWebView {
     WebKitWebViewBase parent;
 
@@ -319,6 +330,31 @@ WEBKIT_API gboolean
 webkit_web_view_can_show_mime_type                 (WebKitWebView             *web_view,
                                                     const gchar               *mime_type);
 
+WEBKIT_API void
+webkit_web_view_save                               (WebKitWebView             *web_view,
+                                                    WebKitSaveMode             save_mode,
+                                                    GCancellable              *cancellable,
+                                                    GAsyncReadyCallback        callback,
+                                                    gpointer                   user_data);
+
+WEBKIT_API GInputStream *
+webkit_web_view_save_finish                        (WebKitWebView             *web_view,
+                                                    GAsyncResult              *result,
+                                                    GError                   **error);
+
+WEBKIT_API void
+webkit_web_view_save_to_file                       (WebKitWebView             *web_view,
+                                                    GFile                     *file,
+                                                    WebKitSaveMode             save_mode,
+                                                    GCancellable              *cancellable,
+                                                    GAsyncReadyCallback        callback,
+                                                    gpointer                   user_data);
+
+WEBKIT_API gboolean
+webkit_web_view_save_to_file_finish                (WebKitWebView             *web_view,
+                                                    GAsyncResult              *result,
+                                                    GError                   **error);
+
 G_END_DECLS
 
 #endif
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
index f65fa97ed..4925b5a7c 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
@@ -101,9 +101,6 @@ struct _WebKitWebViewBasePrivate {
 
 G_DEFINE_TYPE(WebKitWebViewBase, webkit_web_view_base, GTK_TYPE_CONTAINER)
 
-// Keep this in sync with the value minimumAttachedHeight in WebInspectorProxy.
-static const unsigned gMinimumAttachedInspectorHeight = 250;
-
 static void webkitWebViewBaseNotifyResizerSizeForWindow(WebKitWebViewBase* webViewBase, GtkWindow* window)
 {
     gboolean resizerVisible;
@@ -190,7 +187,6 @@ static void webkitWebViewBaseContainerAdd(GtkContainer* container, GtkWidget* wi
         && WebInspectorProxy::isInspectorPage(WEBKIT_WEB_VIEW_BASE(widget)->priv->pageProxy.get())) {
         ASSERT(!priv->inspectorView);
         priv->inspectorView = widget;
-        priv->inspectorViewHeight = gMinimumAttachedInspectorHeight;
     } else {
         GtkAllocation childAllocation;
         gtk_widget_get_allocation(widget, &childAllocation);
@@ -773,12 +769,11 @@ void webkitWebViewBaseInitializeFullScreenClient(WebKitWebViewBase* webkitWebVie
 
 void webkitWebViewBaseSetInspectorViewHeight(WebKitWebViewBase* webkitWebViewBase, unsigned height)
 {
-    if (!webkitWebViewBase->priv->inspectorView)
-        return;
     if (webkitWebViewBase->priv->inspectorViewHeight == height)
         return;
     webkitWebViewBase->priv->inspectorViewHeight = height;
-    gtk_widget_queue_resize_no_redraw(GTK_WIDGET(webkitWebViewBase));
+    if (webkitWebViewBase->priv->inspectorView)
+        gtk_widget_queue_resize_no_redraw(GTK_WIDGET(webkitWebViewBase));
 }
 
 void webkitWebViewBaseSetActiveContextMenuProxy(WebKitWebViewBase* webkitWebViewBase, WebContextMenuProxyGtk* contextMenuProxy)
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h
index 1833fb111..f2986d1f9 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h
@@ -28,7 +28,7 @@
 #define WebKitWebViewPrivate_h
 
 #include "WebKitWebView.h"
-#include <WebKit2/WebKit2.h>
+#include <WebKit2/WebKit2_C.h>
 #include <wtf/text/CString.h>
 
 void webkitWebViewLoadChanged(WebKitWebView*, WebKitLoadEvent);
diff --git a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
index 73f09d5d3..92da1ebe5 100644
--- a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
+++ b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
@@ -62,6 +62,7 @@ webkit_web_context_get_type
 WebKitWebView
 WebKitLoadEvent
 WebKitPolicyDecisionType
+WebKitSaveMode
 
 <SUBSECTION Editing Commands>
 WEBKIT_EDITING_COMMAND_CUT
@@ -105,6 +106,10 @@ webkit_web_view_get_javascript_global_context
 webkit_web_view_run_javascript
 webkit_web_view_run_javascript_finish
 webkit_web_view_can_show_mime_type
+webkit_web_view_save
+webkit_web_view_save_finish
+webkit_web_view_save_to_file
+webkit_web_view_save_to_file_finish
 
 <SUBSECTION WebKitJavascriptResult>
 WebKitJavascriptResult
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/LoadTrackingTest.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/LoadTrackingTest.cpp
index a35c8745b..d370de938 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/LoadTrackingTest.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/LoadTrackingTest.cpp
@@ -35,10 +35,17 @@ static void loadChangedCallback(WebKitWebView* webView, WebKitLoadEvent loadEven
             g_assert_cmpstr(test->m_redirectURI.data(), ==, test->m_activeURI.data());
         test->provisionalLoadReceivedServerRedirect();
         break;
-    case WEBKIT_LOAD_COMMITTED:
+    case WEBKIT_LOAD_COMMITTED: {
         g_assert_cmpstr(test->m_activeURI.data(), ==, webkit_web_view_get_uri(webView));
+
+        // Check that on committed we always have a main resource with a response.
+        WebKitWebResource* resource = webkit_web_view_get_main_resource(webView);
+        g_assert(resource);
+        g_assert(webkit_web_resource_get_response(resource));
+
         test->loadCommitted();
         break;
+    }
     case WEBKIT_LOAD_FINISHED:
         if (!test->m_loadFailed)
             g_assert_cmpstr(test->m_activeURI.data(), ==, webkit_web_view_get_uri(webView));
@@ -170,3 +177,17 @@ void LoadTrackingTest::reload()
     m_estimatedProgress = 0;
     webkit_web_view_reload(m_webView);
 }
+
+void LoadTrackingTest::goBack()
+{
+    m_loadEvents.clear();
+    m_estimatedProgress = 0;
+    WebViewTest::goBack();
+}
+
+void LoadTrackingTest::goForward()
+{
+    m_loadEvents.clear();
+    m_estimatedProgress = 0;
+    WebViewTest::goForward();
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/LoadTrackingTest.h b/Source/WebKit2/UIProcess/API/gtk/tests/LoadTrackingTest.h
index 2d95c48f4..562f7f038 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/LoadTrackingTest.h
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/LoadTrackingTest.h
@@ -44,6 +44,8 @@ public:
     void loadPlainText(const char* plainText);
     void loadRequest(WebKitURIRequest*);
     void reload();
+    void goBack();
+    void goForward();
 
     void setRedirectURI(const char* uri) { m_redirectURI = uri; }
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestInspector.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestInspector.cpp
index 9b023f3ed..673749411 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestInspector.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestInspector.cpp
@@ -22,8 +22,6 @@
 #include "WebViewTest.h"
 #include <wtf/gobject/GRefPtr.h>
 
-static const unsigned gMinimumAttachedInspectorHeight = 250;
-
 class InspectorTest: public WebViewTest {
 public:
     MAKE_GLIB_TEST_FIXTURE(InspectorTest);
@@ -181,6 +179,7 @@ static void testInspectorDefault(InspectorTest* test, gconstpointer)
 
     test->resizeViewAndAttach();
     g_assert(webkit_web_inspector_is_attached(test->m_inspector));
+    g_assert_cmpuint(webkit_web_inspector_get_attached_height(test->m_inspector), >=, InspectorTest::gMinimumAttachedInspectorHeight);
     events = test->m_events;
     g_assert_cmpint(events.size(), ==, 1);
     g_assert_cmpint(events[0], ==, InspectorTest::Attach);
@@ -258,6 +257,7 @@ public:
             gtk_widget_show_all(pane);
         } else
             pane = gtk_bin_get_child(GTK_BIN(m_parentWindow));
+        gtk_paned_set_position(GTK_PANED(pane), webkit_web_inspector_get_attached_height(m_inspector));
         gtk_paned_add2(GTK_PANED(pane), GTK_WIDGET(inspectorView.get()));
 
         return InspectorTest::attach();
@@ -301,6 +301,7 @@ static void testInspectorManualAttachDetach(CustomInspectorTest* test, gconstpoi
 
     test->resizeViewAndAttach();
     g_assert(webkit_web_inspector_is_attached(test->m_inspector));
+    g_assert_cmpuint(webkit_web_inspector_get_attached_height(test->m_inspector), >=, InspectorTest::gMinimumAttachedInspectorHeight);
     events = test->m_events;
     g_assert_cmpint(events.size(), ==, 1);
     g_assert_cmpint(events[0], ==, InspectorTest::Attach);
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestLoaderClient.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestLoaderClient.cpp
index 3afa2b96f..59eed7658 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestLoaderClient.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestLoaderClient.cpp
@@ -144,6 +144,26 @@ static void testLoadProgress(LoadTrackingTest* test, gconstpointer)
     g_assert_cmpfloat(test->m_estimatedProgress, ==, 1);
 }
 
+static void testWebViewHistoryLoad(LoadTrackingTest* test, gconstpointer)
+{
+    test->loadURI(kServer->getURIForPath("/normal").data());
+    test->waitUntilLoadFinished();
+    assertNormalLoadHappened(test->m_loadEvents);
+
+    test->loadURI(kServer->getURIForPath("/normal2").data());
+    test->waitUntilLoadFinished();
+    assertNormalLoadHappened(test->m_loadEvents);
+
+    // Check that load process is the same for pages loaded from history cache.
+    test->goBack();
+    test->waitUntilLoadFinished();
+    assertNormalLoadHappened(test->m_loadEvents);
+
+    test->goForward();
+    test->waitUntilLoadFinished();
+    assertNormalLoadHappened(test->m_loadEvents);
+}
+
 class ViewURITrackingTest: public LoadTrackingTest {
 public:
     MAKE_GLIB_TEST_FIXTURE(ViewURITrackingTest);
@@ -217,7 +237,7 @@ static void serverCallback(SoupServer* server, SoupMessage* message, const char*
 
     soup_message_set_status(message, SOUP_STATUS_OK);
 
-    if (g_str_equal(path, "/normal"))
+    if (g_str_has_prefix(path, "/normal"))
         soup_message_body_append(message->response_body, SOUP_MEMORY_STATIC, responseString, strlen(responseString));
     else if (g_str_equal(path, "/error"))
         soup_message_set_status(message, SOUP_STATUS_CANT_CONNECT);
@@ -248,6 +268,7 @@ void beforeAll()
     LoadTrackingTest::add("WebKitWebView", "title", testWebViewTitle);
     LoadTrackingTest::add("WebKitWebView", "progress", testLoadProgress);
     LoadTrackingTest::add("WebKitWebView", "reload", testWebViewReload);
+    LoadTrackingTest::add("WebKitWebView", "history-load", testWebViewHistoryLoad);
 
     // This test checks that web view notify::uri signal is correctly emitted
     // and the uri is already updated when loader client signals are emitted.
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebContext.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebContext.cpp
index f42feafb7..1b172dfee 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebContext.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebContext.cpp
@@ -233,28 +233,37 @@ static void testWebContextURIScheme(URISchemeTest* test, gconstpointer)
 
 static void testWebContextSpellChecker(Test* test, gconstpointer)
 {
-    GRefPtr<WebKitWebContext> webContext(webkit_web_context_get_default());
+    WebKitWebContext* webContext = webkit_web_context_get_default();
 
-    // Set the language to a specific one, an empty one and a list of them.
-    webkit_web_context_set_spell_checking_languages(webContext.get(), "en_US");
-    const gchar* currentLanguage(webkit_web_context_get_spell_checking_languages(webContext.get()));
+    // Check what happens if no spell checking language has been set.
+    const gchar* currentLanguage = webkit_web_context_get_spell_checking_languages(webContext);
+    g_assert(!currentLanguage);
+
+    // Set the language to a specific one.
+    webkit_web_context_set_spell_checking_languages(webContext, "en_US");
+    currentLanguage = webkit_web_context_get_spell_checking_languages(webContext);
     g_assert_cmpstr(currentLanguage, ==, "en_US");
 
-    webkit_web_context_set_spell_checking_languages(webContext.get(), 0);
-    currentLanguage = webkit_web_context_get_spell_checking_languages(webContext.get());
-    g_assert_cmpstr(currentLanguage, ==, 0);
+    // Set the language string to list of valid languages.
+    webkit_web_context_set_spell_checking_languages(webContext, "en_GB,en_US");
+    currentLanguage = webkit_web_context_get_spell_checking_languages(webContext);
+    g_assert_cmpstr(currentLanguage, ==, "en_GB,en_US");
+
+    // Try passing a wrong language along with good ones.
+    webkit_web_context_set_spell_checking_languages(webContext, "bd_WR,en_US,en_GB");
+    currentLanguage = webkit_web_context_get_spell_checking_languages(webContext);
+    g_assert_cmpstr(currentLanguage, ==, "en_US,en_GB");
 
-    webkit_web_context_set_spell_checking_languages(webContext.get(), "es_ES,en_US");
-    currentLanguage = webkit_web_context_get_spell_checking_languages(webContext.get());
-    g_assert_cmpstr(currentLanguage, ==, "es_ES,en_US");
+    // Try passing a list with only wrong languages.
+    webkit_web_context_set_spell_checking_languages(webContext, "bd_WR,wr_BD");
+    currentLanguage = webkit_web_context_get_spell_checking_languages(webContext);
+    g_assert(!currentLanguage);
 
     // Check disabling and re-enabling spell checking.
-    webkit_web_context_set_spell_checking_enabled(webContext.get(), FALSE);
-    gboolean isSpellCheckingEnabled = webkit_web_context_get_spell_checking_enabled(webContext.get());
-    g_assert(!isSpellCheckingEnabled);
-    webkit_web_context_set_spell_checking_enabled(webContext.get(), TRUE);
-    isSpellCheckingEnabled = webkit_web_context_get_spell_checking_enabled(webContext.get());
-    g_assert(isSpellCheckingEnabled);
+    webkit_web_context_set_spell_checking_enabled(webContext, FALSE);
+    g_assert(!webkit_web_context_get_spell_checking_enabled(webContext));
+    webkit_web_context_set_spell_checking_enabled(webContext, TRUE);
+    g_assert(webkit_web_context_get_spell_checking_enabled(webContext));
 }
 
 void beforeAll()
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
index eec6fc786..22796bf73 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
@@ -21,6 +21,7 @@
 #include "WebViewTest.h"
 #include <JavaScriptCore/JSStringRef.h>
 #include <JavaScriptCore/JSValueRef.h>
+#include <glib/gstdio.h>
 #include <wtf/HashSet.h>
 #include <wtf/gobject/GRefPtr.h>
 #include <wtf/text/StringHash.h>
@@ -946,6 +947,102 @@ static void testWebViewSubmitForm(FormClientTest* test, gconstpointer)
     g_assert_cmpstr(static_cast<char*>(g_hash_table_lookup(values, "password")), ==, "secret");
 }
 
+class SaveWebViewTest: public WebViewTest {
+public:
+    MAKE_GLIB_TEST_FIXTURE(SaveWebViewTest);
+
+    SaveWebViewTest()
+        : m_tempDirectory(g_dir_make_tmp("WebKit2SaveViewTest-XXXXXX", 0))
+    {
+    }
+
+    ~SaveWebViewTest()
+    {
+        if (G_IS_FILE(m_file.get()))
+            g_file_delete(m_file.get(), 0, 0);
+
+        if (G_IS_INPUT_STREAM(m_inputStream.get()))
+            g_input_stream_close(m_inputStream.get(), 0, 0);
+
+        if (m_tempDirectory)
+            g_rmdir(m_tempDirectory.get());
+    }
+
+    static void webViewSavedToStreamCallback(GObject* object, GAsyncResult* result, SaveWebViewTest* test)
+    {
+        GOwnPtr<GError> error;
+        test->m_inputStream = adoptGRef(webkit_web_view_save_finish(test->m_webView, result, &error.outPtr()));
+        g_assert(G_IS_INPUT_STREAM(test->m_inputStream.get()));
+        g_assert(!error);
+
+        test->quitMainLoop();
+    }
+
+    static void webViewSavedToFileCallback(GObject* object, GAsyncResult* result, SaveWebViewTest* test)
+    {
+        GOwnPtr<GError> error;
+        g_assert(webkit_web_view_save_to_file_finish(test->m_webView, result, &error.outPtr()));
+        g_assert(!error);
+
+        test->quitMainLoop();
+    }
+
+    void saveAndWaitForStream()
+    {
+        webkit_web_view_save(m_webView, WEBKIT_SAVE_MODE_MHTML, 0, reinterpret_cast<GAsyncReadyCallback>(webViewSavedToStreamCallback), this);
+        g_main_loop_run(m_mainLoop);
+    }
+
+    void saveAndWaitForFile()
+    {
+        m_saveDestinationFilePath.set(g_build_filename(m_tempDirectory.get(), "testWebViewSaveResult.mht", NULL));
+        m_file = adoptGRef(g_file_new_for_path(m_saveDestinationFilePath.get()));
+        webkit_web_view_save_to_file(m_webView, m_file.get(), WEBKIT_SAVE_MODE_MHTML, 0, reinterpret_cast<GAsyncReadyCallback>(webViewSavedToFileCallback), this);
+        g_main_loop_run(m_mainLoop);
+    }
+
+    GOwnPtr<char> m_tempDirectory;
+    GOwnPtr<char> m_saveDestinationFilePath;
+    GRefPtr<GInputStream> m_inputStream;
+    GRefPtr<GFile> m_file;
+};
+
+static void testWebViewSave(SaveWebViewTest* test, gconstpointer)
+{
+    test->loadHtml("<html>"
+                   "<body>"
+                   "  <p>A paragraph with plain text</p>"
+                   "  <p>"
+                   "    A red box: <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAIAAAD91JpzAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAB3RJTUUH3AYWDTMVwnSZnwAAAB1pVFh0Q29tbWVudAAAAAAAQ3JlYXRlZCB3aXRoIEdJTVBkLmUHAAAAFklEQVQI12P8z8DAwMDAxMDAwMDAAAANHQEDK+mmyAAAAABJRU5ErkJggg=='></br>"
+                   "    A blue box: <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAIAAAD91JpzAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAB3RJTUUH3AYWDTMvBHhALQAAAB1pVFh0Q29tbWVudAAAAAAAQ3JlYXRlZCB3aXRoIEdJTVBkLmUHAAAAFklEQVQI12Nk4PnPwMDAxMDAwMDAAAALrwEPPIs1pgAAAABJRU5ErkJggg=='>"
+                   "  </p>"
+                   "</body>"
+                   "</html>", 0);
+    test->waitUntilLoadFinished();
+
+    // Write to a file and to an input stream.
+    test->saveAndWaitForFile();
+    test->saveAndWaitForStream();
+
+    // We should have exactly the same amount of bytes in the file
+    // than those coming from the GInputStream. We don't compare the
+    // strings read since the 'Date' field and the boundaries will be
+    // different on each case. MHTML functionality will be tested by
+    // Layout tests, so checking the amount of bytes is enough.
+    GOwnPtr<GError> error;
+    gchar buffer[512] = { 0 };
+    gssize readBytes = 0;
+    gssize totalBytesFromStream = 0;
+    while (readBytes = g_input_stream_read(test->m_inputStream.get(), &buffer, 512, 0, &error.outPtr())) {
+        g_assert(!error);
+        totalBytesFromStream += readBytes;
+    }
+
+    // Check that the file exists and that it contains the same amount of bytes.
+    GRefPtr<GFileInfo> fileInfo = adoptGRef(g_file_query_info(test->m_file.get(), G_FILE_ATTRIBUTE_STANDARD_SIZE, static_cast<GFileQueryInfoFlags>(0), 0, 0));
+    g_assert_cmpint(g_file_info_get_size(fileInfo.get()), ==, totalBytesFromStream);
+}
+
 void beforeAll()
 {
     WebViewTest::add("WebKitWebView", "default-context", testWebViewDefaultContext);
@@ -965,6 +1062,7 @@ void beforeAll()
     FullScreenClientTest::add("WebKitWebView", "fullscreen", testWebViewFullScreen);
     WebViewTest::add("WebKitWebView", "can-show-mime-type", testWebViewCanShowMIMEType);
     FormClientTest::add("WebKitWebView", "submit-form", testWebViewSubmitForm);
+    SaveWebViewTest::add("WebKitWebView", "save", testWebViewSave);
 }
 
 void afterAll()
diff --git a/Source/WebKit2/UIProcess/API/mac/WKBrowsingContextController.h b/Source/WebKit2/UIProcess/API/mac/WKBrowsingContextController.h
index a79fc6afc..c053ae664 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKBrowsingContextController.h
+++ b/Source/WebKit2/UIProcess/API/mac/WKBrowsingContextController.h
@@ -53,6 +53,9 @@ WK_EXPORT
 */
 - (void)loadFileURL:(NSURL *)URL restrictToFilesWithin:(NSURL *)allowedDirectory;
 
+/* Load a page using the passed in string as its contents. */
+- (void)loadHTMLString:(NSString *)HTMLString baseURL:(NSURL *)baseURL;
+
 /* Stops the load associated with the active URL. */
 - (void)stopLoading;
 
diff --git a/Source/WebKit2/UIProcess/API/mac/WKBrowsingContextController.mm b/Source/WebKit2/UIProcess/API/mac/WKBrowsingContextController.mm
index 3daa08c37..2d4a94400 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKBrowsingContextController.mm
+++ b/Source/WebKit2/UIProcess/API/mac/WKBrowsingContextController.mm
@@ -120,6 +120,19 @@ static inline NSURL *autoreleased(WKURLRef url)
     WKPageLoadURL(self._pageRef, wkURL.get());
 }
 
+- (void)loadHTMLString:(NSString *)HTMLString baseURL:(NSURL *)baseURL
+{
+    WKRetainPtr<WKStringRef> wkHTMLString;
+    if (HTMLString)
+        wkHTMLString = adoptWK(WKStringCreateWithCFString((CFStringRef)HTMLString));
+
+    WKRetainPtr<WKURLRef> wkBaseURL;
+    if (baseURL)
+        wkBaseURL = adoptWK(WKURLCreateWithCFURL((CFURLRef)baseURL));
+
+    WKPageLoadHTMLString(self._pageRef, wkHTMLString.get(), wkBaseURL.get());
+}
+
 - (void)stopLoading
 {
     WKPageStopLoading(self._pageRef);
diff --git a/Source/WebKit2/UIProcess/API/mac/WebKit2.h b/Source/WebKit2/UIProcess/API/mac/WebKit2.h
new file mode 100644
index 000000000..7a2bd1a23
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/mac/WebKit2.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import <WebKit2/WKBrowsingContextController.h>
+#import <WebKit2/WKBrowsingContextGroup.h>
+#import <WebKit2/WKBrowsingContextLoadDelegate.h>
+#import <WebKit2/WKConnection.h>
+#import <WebKit2/WKProcessGroup.h>
+#import <WebKit2/WKView.h>
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp b/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
index 99c5ffb40..7911f167c 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
@@ -22,10 +22,10 @@
 #include "qquickwebpage_p.h"
 
 #include "LayerTreeCoordinatorProxy.h"
+#include "LayerTreeRenderer.h"
 #include "QtWebPageEventHandler.h"
 #include "QtWebPageSGNode.h"
 #include "TransformationMatrix.h"
-#include "WebLayerTreeRenderer.h"
 #include "WebPageProxy.h"
 #include "qquickwebpage_p_p.h"
 #include "qquickwebview_p.h"
@@ -82,7 +82,7 @@ QSGNode* QQuickWebPage::updatePaintNode(QSGNode* oldNode, UpdatePaintNodeData*)
         return oldNode;
 
     LayerTreeCoordinatorProxy* layerTreeCoordinatorProxy = d->webPageProxy->drawingArea()->layerTreeCoordinatorProxy();
-    WebLayerTreeRenderer* renderer = layerTreeCoordinatorProxy->layerTreeRenderer();
+    LayerTreeRenderer* renderer = layerTreeCoordinatorProxy->layerTreeRenderer();
 
     QtWebPageSGNode* node = static_cast<QtWebPageSGNode*>(oldNode);
     if (!node)
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
index fa0446fec..6ca413f66 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
@@ -32,7 +32,6 @@
 #include "QtWebPageEventHandler.h"
 #include "QtWebPageLoadClient.h"
 #include "QtWebPagePolicyClient.h"
-#include "UtilsQt.h"
 #include "WebBackForwardList.h"
 #include "WebInspectorProxy.h"
 #include "WebInspectorServer.h"
@@ -185,7 +184,7 @@ static QQuickWebViewPrivate* createPrivateObject(QQuickWebView* publicObject)
 
 QQuickWebViewPrivate::FlickableAxisLocker::FlickableAxisLocker()
     : m_allowedDirection(QQuickFlickable::AutoFlickDirection)
-    , m_sampleCount(0)
+    , m_time(0), m_sampleCount(0)
 {
 }
 
@@ -197,8 +196,8 @@ QVector2D QQuickWebViewPrivate::FlickableAxisLocker::touchVelocity(const QTouchE
     if (touchVelocityAvailable)
         return touchPoint.velocity();
 
-    const QLineF movementLine(touchPoint.screenPos(), m_initialScreenPosition);
-    const qint64 elapsed = m_time.elapsed();
+    const QLineF movementLine(touchPoint.pos(), m_initialPosition);
+    const ulong elapsed = event->timestamp() - m_time;
 
     if (!elapsed)
         return QVector2D(0, 0);
@@ -215,8 +214,8 @@ void QQuickWebViewPrivate::FlickableAxisLocker::update(const QTouchEvent* event)
     ++m_sampleCount;
 
     if (m_sampleCount == 1) {
-        m_initialScreenPosition = touchPoint.screenPos();
-        m_time.restart();
+        m_initialPosition = touchPoint.pos();
+        m_time = event->timestamp();
         return;
     }
 
@@ -270,7 +269,6 @@ QQuickWebViewPrivate::QQuickWebViewPrivate(QQuickWebView* viewport)
     , m_useDefaultContentItemSize(true)
     , m_navigatorQtObjectEnabled(false)
     , m_renderToOffscreenBuffer(false)
-    , m_dialogActive(false)
     , m_allowAnyHTTPSCertificateForLocalHost(false)
     , m_loadProgress(0)
 {
@@ -297,6 +295,7 @@ void QQuickWebViewPrivate::initialize(WKContextRef contextRef, WKPageGroupRef pa
 
     context = contextRef ? QtWebContext::create(toImpl(contextRef)) : QtWebContext::defaultContext();
     webPageProxy = context->createWebPage(&pageClient, pageGroup.get());
+    webPageProxy->setUseFixedLayout(s_flickableViewportEnabled);
 #if ENABLE(FULLSCREEN_API)
     webPageProxy->fullScreenManager()->setWebView(q_ptr);
 #endif
@@ -321,6 +320,13 @@ void QQuickWebViewPrivate::initialize(WKContextRef contextRef, WKPageGroupRef pa
     webPageProxy->initializeWebPage();
 }
 
+void QQuickWebViewPrivate::onComponentComplete()
+{
+    Q_Q(QQuickWebView);
+    m_viewportHandler.reset(new QtViewportHandler(webPageProxy.get(), q, pageView.data()));
+    pageView->eventHandler()->setViewportHandler(m_viewportHandler.data());
+}
+
 void QQuickWebViewPrivate::setTransparentBackground(bool enable)
 {
     webPageProxy->setDrawsTransparentBackground(enable);
@@ -408,6 +414,27 @@ void QQuickWebViewPrivate::loadDidFail(const QtWebError& error)
     emit q->loadingChanged(&loadRequest);
 }
 
+void QQuickWebViewPrivate::handleMouseEvent(QMouseEvent* event)
+{
+    switch (event->type()) {
+    case QEvent::MouseButtonPress:
+    case QEvent::MouseButtonDblClick:
+        // If a MouseButtonDblClick was received then we got a MouseButtonPress before
+        // handleMousePressEvent will take care of double clicks.
+        pageView->eventHandler()->handleMousePressEvent(event);
+        break;
+    case QEvent::MouseMove:
+        pageView->eventHandler()->handleMouseMoveEvent(event);
+        break;
+    case QEvent::MouseButtonRelease:
+        pageView->eventHandler()->handleMouseReleaseEvent(event);
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
 void QQuickWebViewPrivate::setNeedsDisplay()
 {
     Q_Q(QQuickWebView);
@@ -767,8 +794,11 @@ QQuickWebViewLegacyPrivate::QQuickWebViewLegacyPrivate(QQuickWebView* viewport)
 
 void QQuickWebViewLegacyPrivate::initialize(WKContextRef contextRef, WKPageGroupRef pageGroupRef)
 {
+    Q_Q(QQuickWebView);
     QQuickWebViewPrivate::initialize(contextRef, pageGroupRef);
-    enableMouseEvents();
+
+    q->setAcceptedMouseButtons(Qt::MouseButtonMask);
+    q->setAcceptHoverEvents(true);
 
     // Trigger setting of correct visibility flags after everything was allocated and initialized.
     _q_onVisibleChanged();
@@ -777,29 +807,15 @@ void QQuickWebViewLegacyPrivate::initialize(WKContextRef contextRef, WKPageGroup
 void QQuickWebViewLegacyPrivate::updateViewportSize()
 {
     Q_Q(QQuickWebView);
-    QSize viewportSize = q->boundingRect().size().toSize();
+    QSizeF viewportSize = q->boundingRect().size();
     if (viewportSize.isEmpty())
         return;
     pageView->setContentsSize(viewportSize);
     // The fixed layout is handled by the FrameView and the drawing area doesn't behave differently
     // whether its fixed or not. We still need to tell the drawing area which part of it
     // has to be rendered on tiles, and in desktop mode it's all of it.
-    webPageProxy->drawingArea()->setSize(viewportSize, IntSize());
-    webPageProxy->drawingArea()->setVisibleContentsRect(IntRect(IntPoint(), viewportSize), 1, FloatPoint());
-}
-
-void QQuickWebViewLegacyPrivate::enableMouseEvents()
-{
-    Q_Q(QQuickWebView);
-    q->setAcceptedMouseButtons(Qt::MouseButtonMask);
-    q->setAcceptHoverEvents(true);
-}
-
-void QQuickWebViewLegacyPrivate::disableMouseEvents()
-{
-    Q_Q(QQuickWebView);
-    q->setAcceptedMouseButtons(Qt::NoButton);
-    q->setAcceptHoverEvents(false);
+    webPageProxy->drawingArea()->setSize(viewportSize.toSize(), IntSize());
+    webPageProxy->drawingArea()->setVisibleContentsRect(FloatRect(FloatPoint(), viewportSize), 1, FloatPoint());
 }
 
 qreal QQuickWebViewLegacyPrivate::zoomFactor() const
@@ -815,12 +831,6 @@ void QQuickWebViewLegacyPrivate::setZoomFactor(qreal factor)
 QQuickWebViewFlickablePrivate::QQuickWebViewFlickablePrivate(QQuickWebView* viewport)
     : QQuickWebViewPrivate(viewport)
 {
-    // Disable mouse events on the flickable web view so we do not
-    // select text during pan gestures on platforms which send both
-    // touch and mouse events simultaneously.
-    // FIXME: Temporary workaround code which should be removed when
-    // bug http://codereview.qt-project.org/21896 is fixed.
-    viewport->setAcceptedMouseButtons(Qt::NoButton);
     viewport->setAcceptHoverEvents(false);
 }
 
@@ -832,15 +842,11 @@ QQuickWebViewFlickablePrivate::~QQuickWebViewFlickablePrivate()
 void QQuickWebViewFlickablePrivate::initialize(WKContextRef contextRef, WKPageGroupRef pageGroupRef)
 {
     QQuickWebViewPrivate::initialize(contextRef, pageGroupRef);
-    webPageProxy->setUseFixedLayout(true);
 }
 
 void QQuickWebViewFlickablePrivate::onComponentComplete()
 {
-    Q_Q(QQuickWebView);
-
-    m_viewportHandler.reset(new QtViewportHandler(webPageProxy.get(), q, pageView.data()));
-    pageView->eventHandler()->setViewportHandler(m_viewportHandler.data());
+    QQuickWebViewPrivate::onComponentComplete();
 
     // Trigger setting of correct visibility flags after everything was allocated and initialized.
     _q_onVisibleChanged();
@@ -872,6 +878,15 @@ void QQuickWebViewFlickablePrivate::didChangeContentsSize(const QSize& newSize)
     m_viewportHandler->pageContentsSizeChanged(newSize, q->boundingRect().size().toSize());
 }
 
+void QQuickWebViewFlickablePrivate::handleMouseEvent(QMouseEvent* event)
+{
+    if (!pageView->eventHandler())
+        return;
+
+    // FIXME: Update the axis locker for mouse events as well.
+    pageView->eventHandler()->handleInputEvent(event);
+}
+
 /*!
     \qmlsignal WebView::onNavigationRequested(WebNavigationRequest request)
 
@@ -1657,36 +1672,25 @@ void QQuickWebView::platformInitialize()
 
 bool QQuickWebView::childMouseEventFilter(QQuickItem* item, QEvent* event)
 {
-    if (!isVisible() || !isEnabled() || !s_flickableViewportEnabled)
-        return QQuickFlickable::childMouseEventFilter(item, event);
-
-    Q_D(QQuickWebView);
-    if (d->m_dialogActive) {
-        event->ignore();
+    if (!isVisible() || !isEnabled())
         return false;
-    }
 
     // This function is used by MultiPointTouchArea and PinchArea to filter
     // touch events, thus to hinder the canvas from sending synthesized
     // mouse events to the Flickable implementation we need to reimplement
-    // childMouseEventFilter and filter incoming touch events as well.
+    // childMouseEventFilter to ignore touch and mouse events.
 
     switch (event->type()) {
     case QEvent::MouseButtonPress:
-        mousePressEvent(static_cast<QMouseEvent*>(event));
-        return event->isAccepted();
     case QEvent::MouseMove:
-        mouseMoveEvent(static_cast<QMouseEvent*>(event));
-        return event->isAccepted();
     case QEvent::MouseButtonRelease:
-        mouseReleaseEvent(static_cast<QMouseEvent*>(event));
-        return event->isAccepted();
     case QEvent::TouchBegin:
     case QEvent::TouchUpdate:
     case QEvent::TouchEnd:
-        touchEvent(static_cast<QTouchEvent*>(event));
-        return event->isAccepted();
+        // Force all mouse and touch events through the default propagation path.
+        return false;
     default:
+        ASSERT(event->type() == QEvent::UngrabMouse);
         break;
     }
 
@@ -1743,10 +1747,6 @@ void QQuickWebView::focusOutEvent(QFocusEvent* event)
 void QQuickWebView::touchEvent(QTouchEvent* event)
 {
     Q_D(QQuickWebView);
-    if (d->m_dialogActive) {
-        event->ignore();
-        return;
-    }
 
     bool lockingDisabled = flickableDirection() != AutoFlickDirection
                            || event->touchPoints().size() != 1
@@ -1766,29 +1766,26 @@ void QQuickWebView::mousePressEvent(QMouseEvent* event)
 {
     Q_D(QQuickWebView);
     forceActiveFocus();
-    d->pageView->eventHandler()->handleMousePressEvent(event);
+    d->handleMouseEvent(event);
 }
 
 void QQuickWebView::mouseMoveEvent(QMouseEvent* event)
 {
     Q_D(QQuickWebView);
-    d->pageView->eventHandler()->handleMouseMoveEvent(event);
+    d->handleMouseEvent(event);
 }
 
 void QQuickWebView::mouseReleaseEvent(QMouseEvent* event)
 {
     Q_D(QQuickWebView);
-    d->pageView->eventHandler()->handleMouseReleaseEvent(event);
+    d->handleMouseEvent(event);
 }
 
 void QQuickWebView::mouseDoubleClickEvent(QMouseEvent* event)
 {
     Q_D(QQuickWebView);
-
     forceActiveFocus();
-    // If a MouseButtonDblClick was received then we got a MouseButtonPress before
-    // handleMousePressEvent will take care of double clicks.
-    d->pageView->eventHandler()->handleMousePressEvent(event);
+    d->handleMouseEvent(event);
 }
 
 void QQuickWebView::wheelEvent(QWheelEvent* event)
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
index f102f6030..d8a88f8c9 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
@@ -69,10 +69,7 @@ public:
 
     virtual void initialize(WKContextRef contextRef = 0, WKPageGroupRef pageGroupRef = 0);
 
-    virtual void onComponentComplete() { }
-
-    virtual void enableMouseEvents() { }
-    virtual void disableMouseEvents() { }
+    virtual void onComponentComplete();
 
     virtual void provisionalLoadDidStart(const WTF::String& url);
     virtual void didReceiveServerRedirectForProvisionalLoad(const WTF::String& url);
@@ -83,6 +80,7 @@ public:
     virtual void backForwardListDidChange();
     virtual void loadDidSucceed();
     virtual void loadDidFail(const WebKit::QtWebError& error);
+    virtual void handleMouseEvent(QMouseEvent*);
 
     virtual void didChangeViewportProperties(const WebCore::ViewportAttributes& attr) { }
 
@@ -124,8 +122,6 @@ public:
     QPointF contentPos() const;
     void setContentPos(const QPointF&);
 
-    void setDialogActive(bool active) { m_dialogActive = active; }
-
     void updateIcon();
 
     // PageClient.
@@ -142,8 +138,8 @@ protected:
     class FlickableAxisLocker {
         QQuickFlickable::FlickableDirection m_allowedDirection;
 
-        QElapsedTimer m_time;
-        QPointF m_initialScreenPosition;
+        ulong m_time;
+        QPointF m_initialPosition;
         QPointF m_lockReferencePosition;
         int m_sampleCount;
 
@@ -174,6 +170,7 @@ protected:
     QScopedPointer<QQuickWebPage> pageView;
     QQuickWebView* q_ptr;
 
+    QScopedPointer<WebKit::QtViewportHandler> m_viewportHandler;
     FlickableAxisLocker axisLocker;
 
     QQmlComponent* alertDialog;
@@ -192,7 +189,6 @@ protected:
     bool m_useDefaultContentItemSize;
     bool m_navigatorQtObjectEnabled;
     bool m_renderToOffscreenBuffer;
-    bool m_dialogActive;
     bool m_allowAnyHTTPSCertificateForLocalHost;
     WTF::String m_iconUrl;
     int m_loadProgress;
@@ -206,8 +202,6 @@ public:
     virtual void initialize(WKContextRef contextRef = 0, WKPageGroupRef pageGroupRef = 0);
 
     virtual void updateViewportSize();
-    virtual void enableMouseEvents();
-    virtual void disableMouseEvents();
 
     qreal zoomFactor() const;
     void setZoomFactor(qreal);
@@ -228,9 +222,7 @@ public:
 
     virtual void pageDidRequestScroll(const QPoint& pos);
     virtual void didChangeContentsSize(const QSize& newSize);
-
-private:
-    QScopedPointer<WebKit::QtViewportHandler> m_viewportHandler;
+    virtual void handleMouseEvent(QMouseEvent*);
 };
 
 #endif // qquickwebview_p_p_h
diff --git a/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview.cpp b/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview.cpp
index 121f90d88..0aed5d948 100644
--- a/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview.cpp
@@ -23,6 +23,7 @@
 #include "Cursor.h"
 #include "DrawingAreaProxyImpl.h"
 #include "LayerTreeCoordinatorProxy.h"
+#include "LayerTreeRenderer.h"
 #include "NativeWebKeyboardEvent.h"
 #include "NativeWebMouseEvent.h"
 #if ENABLE(TOUCH_EVENTS)
@@ -31,7 +32,6 @@
 #include "NativeWebWheelEvent.h"
 #include "NotImplemented.h"
 #include "WebContext.h"
-#include "WebLayerTreeRenderer.h"
 #include "WebPageGroup.h"
 #include "WebPreferences.h"
 #include "qrawwebview_p_p.h"
@@ -353,7 +353,7 @@ void QRawWebView::paint(const QMatrix4x4& transform, float opacity, unsigned pai
     if (!coordinatorProxy)
         return;
 
-    WebKit::WebLayerTreeRenderer* renderer = coordinatorProxy->layerTreeRenderer();
+    WebKit::LayerTreeRenderer* renderer = coordinatorProxy->layerTreeRenderer();
     if (!renderer)
         return;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp b/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp
index 0e3b33cf7..12e0ab903 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp
@@ -144,11 +144,7 @@ static void gatherAPI(const QString& prefix, const QMetaMethod& method, QStringL
 {
     if (method.access() != QMetaMethod::Private) {
         const char* methodTypeName = !!strlen(method.typeName()) ? method.typeName() : "void";
-#if HAVE(QT5)
         *output << QString::fromLatin1("%1%2 --> %3").arg(prefix).arg(QString::fromLatin1(method.methodSignature())).arg(QString::fromLatin1(methodTypeName));
-#else
-        *output << QString::fromLatin1("%1%2 --> %3").arg(prefix).arg(method.signature()).arg(methodTypeName);
-#endif
 
         checkKnownType(methodTypeName);
         foreach (QByteArray paramType, method.parameterTypes())
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_devicePixelRatio.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_devicePixelRatio.qml
deleted file mode 100644
index 643c721da..000000000
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_devicePixelRatio.qml
+++ /dev/null
@@ -1,63 +0,0 @@
-import QtQuick 2.0
-import QtTest 1.0
-import QtWebKit 3.0
-import QtWebKit.experimental 1.0
-import "../common"
-
-Item {
-    TestWebView {
-        id: webView
-        property variant lastResult
-    }
-
-    SignalSpy {
-        id: resultSpy
-        target: webView
-        signalName: "lastResultChanged"
-    }
-
-    TestCase {
-        name: "DevicePixelRatio"
-
-        function init() {
-            resultSpy.clear()
-            webView.lastResult = null
-        }
-
-        function test_devicePixelRatio() {
-            expectFail("", "This currently fails since window.devicePixelRatio doesn't return the updated value.")
-
-            resultSpy.clear()
-            webView.url = "about:blank"
-            webView.experimental.devicePixelRatio = 2.0
-            verify(webView.waitForLoadSucceeded())
-
-            webView.experimental.evaluateJavaScript(
-                "(function() { return window.devicePixelRatio })()",
-                function(result) {
-                    webView.lastResult = result
-                })
-
-            resultSpy.wait()
-            compare(webView.lastResult, 2.0)
-            compare(webView.lastResult, webView.experimental.devicePixelRatio)
-        }
-
-        function test_devicePixelRatioMediaQuery() {
-            expectFail("", "This currently fails since the devicePixelRatio from the QML API isn't propagated correctly.")
-            resultSpy.clear()
-            webView.url = "about:blank"
-            webView.experimental.devicePixelRatio = 2.0
-            verify(webView.waitForLoadSucceeded())
-
-            webView.experimental.evaluateJavaScript(
-                "(function() { return window.matchMedia('-webkit-device-pixel-ratio: 2').matches })()",
-                function(result) {
-                    webView.lastResult = result
-                })
-
-            resultSpy.wait()
-            verify(webView.lastResult)
-        }
-    }
-}
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_favIconLoad.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_favIconLoad.qml
index f6ed4b261..6f0858696 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_favIconLoad.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_favIconLoad.qml
@@ -36,7 +36,7 @@ TestWebView {
             compare(spy.count, 0)
             var url = Qt.resolvedUrl("../common/favicon.html")
             webView.url = url
-            verify(webView.waitForLoadSucceeded())
+            spy.wait()
             compare(spy.count, 1)
             compare(favicon.width, 48)
             compare(favicon.height, 48)
@@ -46,7 +46,7 @@ TestWebView {
             compare(spy.count, 0)
             var url = Qt.resolvedUrl("../common/favicon2.html?favicon=load should work with#whitespace!")
             webView.url = url
-            verify(webView.waitForLoadSucceeded())
+            spy.wait()
             compare(spy.count, 1)
             compare(favicon.width, 16)
             compare(favicon.height, 16)
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/tests.pri b/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
index 2704efe4a..b87659bf3 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
+++ b/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
@@ -3,14 +3,17 @@ TEMPLATE = app
 VPATH += $$_PRO_FILE_PWD_
 TARGET = tst_$$TARGET
 
-HEADERS += ../bytearraytestdata.h \
-           ../util.h
-
-SOURCES += ../util.cpp \
-           ../bytearraytestdata.cpp
 INCLUDEPATH += $$PWD
+SOURCES +=  ../util.cpp
+
+QT += testlib webkit
+contains(DEFINES, HAVE_QTQUICK=1) {
+    QT += qml quick quick-private
+    HEADERS += ../bytearraytestdata.h \
+               ../util.h
 
-QT += testlib qml quick quick-private webkit
+    SOURCES += ../bytearraytestdata.cpp
+}
 WEBKIT += wtf # For platform macros
 
 DEFINES += TESTS_SOURCE_DIR=\\\"$$PWD\\\" \
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/util.cpp b/Source/WebKit2/UIProcess/API/qt/tests/util.cpp
index 2582848aa..cdd1f9961 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/util.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/util.cpp
@@ -18,11 +18,15 @@
 */
 
 #include "util.h"
-#include "private/qquickwebview_p.h"
-#include "private/qwebloadrequest_p.h"
+
 #include <QtTest/QtTest>
 #include <stdio.h>
 
+#if defined(HAVE_QTQUICK) && HAVE_QTQUICK
+#include "private/qquickwebview_p.h"
+#include "private/qwebloadrequest_p.h"
+#endif
+
 void addQtWebProcessToPath()
 {
     // Since tests won't find ./QtWebProcess, add it to PATH (at the end to prevent surprises).
@@ -53,6 +57,7 @@ bool waitForSignal(QObject* obj, const char* signal, int timeout)
     return timeoutSpy.isEmpty();
 }
 
+#if defined(HAVE_QTQUICK) && HAVE_QTQUICK
 class LoadSpy : public QEventLoop {
     Q_OBJECT
 public:
@@ -136,5 +141,6 @@ void LoadStartedCatcher::onLoadingChanged(QWebLoadRequest* loadRequest)
         QCOMPARE(m_webView->loading(), true);
     }
 }
+#endif
 
 #include "util.moc"
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/util.h b/Source/WebKit2/UIProcess/API/qt/tests/util.h
index 9d076f1b4..907ddb05f 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/util.h
+++ b/Source/WebKit2/UIProcess/API/qt/tests/util.h
@@ -30,6 +30,7 @@ class QWebLoadRequest;
 #endif
 
 void addQtWebProcessToPath();
+#if defined(HAVE_QTQUICK) && HAVE_QTQUICK
 bool waitForSignal(QObject*, const char* signal, int timeout = 10000);
 bool waitForLoadSucceeded(QQuickWebView* webView, int timeout = 10000);
 bool waitForLoadFailed(QQuickWebView* webView, int timeout = 10000);
@@ -46,3 +47,4 @@ signals:
 private:
     QQuickWebView* m_webView;
 };
+#endif
diff --git a/Source/WebKit2/UIProcess/texmap/LayerBackingStore.cpp b/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.cpp
index 43dbe0cba..84f6ebd2f 100644
--- a/Source/WebKit2/UIProcess/texmap/LayerBackingStore.cpp
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.cpp
@@ -18,9 +18,9 @@
  */
 
 #include "config.h"
-#include "LayerBackingStore.h"
+#include "CoordinatedBackingStore.h"
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 #include "GraphicsLayer.h"
 #include "ShareableSurface.h"
 #include "TextureMapper.h"
@@ -30,7 +30,7 @@ using namespace WebCore;
 
 namespace WebKit {
 
-void LayerBackingStoreTile::swapBuffers(WebCore::TextureMapper* textureMapper)
+void CoordinatedBackingStoreTile::swapBuffers(WebCore::TextureMapper* textureMapper)
 {
     if (!m_surface)
         return;
@@ -56,7 +56,7 @@ void LayerBackingStoreTile::swapBuffers(WebCore::TextureMapper* textureMapper)
     m_surface.clear();
 }
 
-void LayerBackingStoreTile::setBackBuffer(const IntRect& targetRect, const IntRect& sourceRect, PassRefPtr<ShareableSurface> buffer, const IntPoint& offset)
+void CoordinatedBackingStoreTile::setBackBuffer(const IntRect& targetRect, const IntRect& sourceRect, PassRefPtr<ShareableSurface> buffer, const IntPoint& offset)
 {
     m_sourceRect = sourceRect;
     m_targetRect = targetRect;
@@ -64,30 +64,30 @@ void LayerBackingStoreTile::setBackBuffer(const IntRect& targetRect, const IntRe
     m_surface = buffer;
 }
 
-void LayerBackingStore::createTile(int id, float scale)
+void CoordinatedBackingStore::createTile(int id, float scale)
 {
-    m_tiles.add(id, LayerBackingStoreTile(scale));
+    m_tiles.add(id, CoordinatedBackingStoreTile(scale));
     m_scale = scale;
 }
 
-void LayerBackingStore::removeTile(int id)
+void CoordinatedBackingStore::removeTile(int id)
 {
     m_tilesToRemove.append(id);
 }
 
 
-void LayerBackingStore::updateTile(int id, const IntRect& sourceRect, const IntRect& targetRect, PassRefPtr<ShareableSurface> backBuffer, const IntPoint& offset)
+void CoordinatedBackingStore::updateTile(int id, const IntRect& sourceRect, const IntRect& targetRect, PassRefPtr<ShareableSurface> backBuffer, const IntPoint& offset)
 {
-    HashMap<int, LayerBackingStoreTile>::iterator it = m_tiles.find(id);
+    HashMap<int, CoordinatedBackingStoreTile>::iterator it = m_tiles.find(id);
     ASSERT(it != m_tiles.end());
     it->second.incrementRepaintCount();
     it->second.setBackBuffer(targetRect, sourceRect, backBuffer, offset);
 }
 
-PassRefPtr<BitmapTexture> LayerBackingStore::texture() const
+PassRefPtr<BitmapTexture> CoordinatedBackingStore::texture() const
 {
-    HashMap<int, LayerBackingStoreTile>::const_iterator end = m_tiles.end();
-    for (HashMap<int, LayerBackingStoreTile>::const_iterator it = m_tiles.begin(); it != end; ++it) {
+    HashMap<int, CoordinatedBackingStoreTile>::const_iterator end = m_tiles.end();
+    for (HashMap<int, CoordinatedBackingStoreTile>::const_iterator it = m_tiles.begin(); it != end; ++it) {
         RefPtr<BitmapTexture> texture = it->second.texture();
         if (texture)
             return texture;
@@ -104,15 +104,15 @@ static bool shouldShowTileDebugVisuals()
     return false;
 }
 
-void LayerBackingStore::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
+void CoordinatedBackingStore::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
 {
     Vector<TextureMapperTile*> tilesToPaint;
 
     // We have to do this every time we paint, in case the opacity has changed.
-    HashMap<int, LayerBackingStoreTile>::iterator end = m_tiles.end();
+    HashMap<int, CoordinatedBackingStoreTile>::iterator end = m_tiles.end();
     FloatRect coveredRect;
-    for (HashMap<int, LayerBackingStoreTile>::iterator it = m_tiles.begin(); it != end; ++it) {
-        LayerBackingStoreTile& tile = it->second;
+    for (HashMap<int, CoordinatedBackingStoreTile>::iterator it = m_tiles.begin(); it != end; ++it) {
+        CoordinatedBackingStoreTile& tile = it->second;
         if (!tile.texture())
             continue;
 
@@ -132,7 +132,7 @@ void LayerBackingStore::paintToTextureMapper(TextureMapper* textureMapper, const
 
     // TODO: When the TextureMapper makes a distinction between some edges exposed and no edges
     // exposed, the value passed should be an accurate reflection of the tile subset that we are
-    // passing. For now we just "estimate" since LayerBackingStore doesn't keep information about
+    // passing. For now we just "estimate" since CoordinatedBackingStore doesn't keep information about
     // the total tiled surface rect at the moment.
     unsigned edgesExposed = m_tiles.size() > 1 ? TextureMapper::NoEdges : TextureMapper::AllEdges;
     for (size_t i = 0; i < tilesToPaint.size(); ++i) {
@@ -143,19 +143,19 @@ void LayerBackingStore::paintToTextureMapper(TextureMapper* textureMapper, const
             continue;
 
         textureMapper->drawBorder(Color(0xFF, 0, 0), 2, tile->rect(), transform);
-        textureMapper->drawRepaintCounter(static_cast<LayerBackingStoreTile*>(tile)->repaintCount(), 8, tilesToPaint[i]->rect().location(), transform);
+        textureMapper->drawRepaintCounter(static_cast<CoordinatedBackingStoreTile*>(tile)->repaintCount(), 8, tilesToPaint[i]->rect().location(), transform);
     }
 }
 
-void LayerBackingStore::commitTileOperations(TextureMapper* textureMapper)
+void CoordinatedBackingStore::commitTileOperations(TextureMapper* textureMapper)
 {
     Vector<int>::iterator tilesToRemoveEnd = m_tilesToRemove.end();
     for (Vector<int>::iterator it = m_tilesToRemove.begin(); it != tilesToRemoveEnd; ++it)
         m_tiles.remove(*it);
     m_tilesToRemove.clear();
 
-    HashMap<int, LayerBackingStoreTile>::iterator tilesEnd = m_tiles.end();
-    for (HashMap<int, LayerBackingStoreTile>::iterator it = m_tiles.begin(); it != tilesEnd; ++it)
+    HashMap<int, CoordinatedBackingStoreTile>::iterator tilesEnd = m_tiles.end();
+    for (HashMap<int, CoordinatedBackingStoreTile>::iterator it = m_tiles.begin(); it != tilesEnd; ++it)
         it->second.swapBuffers(textureMapper);
 }
 
diff --git a/Source/WebKit2/UIProcess/texmap/LayerBackingStore.h b/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.h
index 6a4f513a0..637feba70 100644
--- a/Source/WebKit2/UIProcess/texmap/LayerBackingStore.h
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/CoordinatedBackingStore.h
@@ -17,10 +17,10 @@
  Boston, MA 02110-1301, USA.
  */
 
-#ifndef LayerBackingStore_h
-#define LayerBackingStore_h
+#ifndef CoordinatedBackingStore_h
+#define CoordinatedBackingStore_h
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 
 #include "TextureMapper.h"
 #include "TextureMapperBackingStore.h"
@@ -30,9 +30,9 @@ namespace WebKit {
 
 class ShareableSurface;
 
-class LayerBackingStoreTile : public WebCore::TextureMapperTile {
+class CoordinatedBackingStoreTile : public WebCore::TextureMapperTile {
 public:
-    LayerBackingStoreTile(float scale = 1)
+    CoordinatedBackingStoreTile(float scale = 1)
         : TextureMapperTile(WebCore::FloatRect())
         , m_scale(scale)
         , m_repaintCount(0)
@@ -54,21 +54,21 @@ private:
     int m_repaintCount;
 };
 
-class LayerBackingStore : public WebCore::TextureMapperBackingStore {
+class CoordinatedBackingStore : public WebCore::TextureMapperBackingStore {
 public:
     void createTile(int, float);
     void removeTile(int);
     void updateTile(int, const WebCore::IntRect&, const WebCore::IntRect&, PassRefPtr<ShareableSurface>, const WebCore::IntPoint&);
-    static PassRefPtr<LayerBackingStore> create() { return adoptRef(new LayerBackingStore); }
+    static PassRefPtr<CoordinatedBackingStore> create() { return adoptRef(new CoordinatedBackingStore); }
     void commitTileOperations(WebCore::TextureMapper*);
     PassRefPtr<WebCore::BitmapTexture> texture() const;
     virtual void paintToTextureMapper(WebCore::TextureMapper*, const WebCore::FloatRect&, const WebCore::TransformationMatrix&, float, WebCore::BitmapTexture*);
 
 private:
-    LayerBackingStore()
+    CoordinatedBackingStore()
         : m_scale(1.)
     { }
-    HashMap<int, LayerBackingStoreTile> m_tiles;
+    HashMap<int, CoordinatedBackingStoreTile> m_tiles;
     Vector<int> m_tilesToRemove;
     float m_scale;
 };
@@ -76,4 +76,4 @@ private:
 } // namespace WebKit
 #endif
 
-#endif // LayerBackingStore_h
+#endif // CoordinatedBackingStore_h
diff --git a/Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.cpp b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp
index 629291a4b..ef972f3e3 100644
--- a/Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.cpp
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp
@@ -19,14 +19,14 @@
 
 #include "config.h"
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 #include "LayerTreeCoordinatorProxy.h"
 
 #include "LayerTreeCoordinatorMessages.h"
+#include "LayerTreeRenderer.h"
 #include "UpdateInfo.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebLayerTreeInfo.h"
-#include "WebLayerTreeRenderer.h"
 #include "WebPageProxy.h"
 #include "WebProcessProxy.h"
 
@@ -36,7 +36,8 @@ using namespace WebCore;
 
 LayerTreeCoordinatorProxy::LayerTreeCoordinatorProxy(DrawingAreaProxy* drawingAreaProxy)
     : m_drawingAreaProxy(drawingAreaProxy)
-    , m_renderer(adoptRef(new WebLayerTreeRenderer(this)))
+    , m_renderer(adoptRef(new LayerTreeRenderer(this)))
+    , m_lastSentScale(0)
 {
 }
 
@@ -57,7 +58,7 @@ void LayerTreeCoordinatorProxy::dispatchUpdate(const Function<void()>& function)
 
 void LayerTreeCoordinatorProxy::createTileForLayer(int layerID, int tileID, const IntRect& targetRect, const WebKit::SurfaceUpdateInfo& updateInfo)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::createTile, m_renderer.get(), layerID, tileID, updateInfo.scaleFactor));
+    dispatchUpdate(bind(&LayerTreeRenderer::createTile, m_renderer.get(), layerID, tileID, updateInfo.scaleFactor));
     updateTileForLayer(layerID, tileID, targetRect, updateInfo);
 }
 
@@ -78,69 +79,89 @@ void LayerTreeCoordinatorProxy::updateTileForLayer(int layerID, int tileID, cons
 #else
     surface = ShareableSurface::create(updateInfo.surfaceHandle);
 #endif
-    dispatchUpdate(bind(&WebLayerTreeRenderer::updateTile, m_renderer.get(), layerID, tileID, WebLayerTreeRenderer::TileUpdate(updateInfo.updateRect, targetRect, surface, updateInfo.surfaceOffset)));
+    dispatchUpdate(bind(&LayerTreeRenderer::updateTile, m_renderer.get(), layerID, tileID, LayerTreeRenderer::TileUpdate(updateInfo.updateRect, targetRect, surface, updateInfo.surfaceOffset)));
 }
 
 void LayerTreeCoordinatorProxy::removeTileForLayer(int layerID, int tileID)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::removeTile, m_renderer.get(), layerID, tileID));
+    dispatchUpdate(bind(&LayerTreeRenderer::removeTile, m_renderer.get(), layerID, tileID));
 }
 
 void LayerTreeCoordinatorProxy::deleteCompositingLayer(WebLayerID id)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::deleteLayer, m_renderer.get(), id));
+    dispatchUpdate(bind(&LayerTreeRenderer::deleteLayer, m_renderer.get(), id));
     updateViewport();
 }
 
 void LayerTreeCoordinatorProxy::setRootCompositingLayer(WebLayerID id)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::setRootLayerID, m_renderer.get(), id));
+    dispatchUpdate(bind(&LayerTreeRenderer::setRootLayerID, m_renderer.get(), id));
     updateViewport();
 }
 
 void LayerTreeCoordinatorProxy::setCompositingLayerState(WebLayerID id, const WebLayerInfo& info)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::setLayerState, m_renderer.get(), id, info));
+    dispatchUpdate(bind(&LayerTreeRenderer::setLayerState, m_renderer.get(), id, info));
 }
 
 void LayerTreeCoordinatorProxy::setCompositingLayerChildren(WebLayerID id, const Vector<WebLayerID>& children)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::setLayerChildren, m_renderer.get(), id, children));
+    dispatchUpdate(bind(&LayerTreeRenderer::setLayerChildren, m_renderer.get(), id, children));
 }
 
 #if ENABLE(CSS_FILTERS)
 void LayerTreeCoordinatorProxy::setCompositingLayerFilters(WebLayerID id, const FilterOperations& filters)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::setLayerFilters, m_renderer.get(), id, filters));
+    dispatchUpdate(bind(&LayerTreeRenderer::setLayerFilters, m_renderer.get(), id, filters));
 }
 #endif
 
 void LayerTreeCoordinatorProxy::didRenderFrame()
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::flushLayerChanges, m_renderer.get()));
+    dispatchUpdate(bind(&LayerTreeRenderer::flushLayerChanges, m_renderer.get()));
     updateViewport();
 }
 
 void LayerTreeCoordinatorProxy::createDirectlyCompositedImage(int64_t key, const WebKit::ShareableBitmap::Handle& handle)
 {
     RefPtr<ShareableBitmap> bitmap = ShareableBitmap::create(handle);
-    dispatchUpdate(bind(&WebLayerTreeRenderer::createImage, m_renderer.get(), key, bitmap));
+    dispatchUpdate(bind(&LayerTreeRenderer::createImage, m_renderer.get(), key, bitmap));
 }
 
 void LayerTreeCoordinatorProxy::destroyDirectlyCompositedImage(int64_t key)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::destroyImage, m_renderer.get(), key));
+    dispatchUpdate(bind(&LayerTreeRenderer::destroyImage, m_renderer.get(), key));
 }
 
 void LayerTreeCoordinatorProxy::setContentsSize(const FloatSize& contentsSize)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::setContentsSize, m_renderer.get(), contentsSize));
+    dispatchUpdate(bind(&LayerTreeRenderer::setContentsSize, m_renderer.get(), contentsSize));
 }
 
-void LayerTreeCoordinatorProxy::setVisibleContentsRect(const IntRect& rect, float scale, const FloatPoint& trajectoryVector, const WebCore::FloatPoint& accurateVisibleContentsPosition)
+void LayerTreeCoordinatorProxy::setLayerAnimatedOpacity(uint32_t id, float opacity)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::setVisibleContentsRect, m_renderer.get(), rect, scale, accurateVisibleContentsPosition));
-    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeCoordinator::SetVisibleContentsRect(rect, scale, trajectoryVector), m_drawingAreaProxy->page()->pageID());
+    dispatchUpdate(bind(&LayerTreeRenderer::setAnimatedOpacity, m_renderer.get(), id, opacity));
+}
+
+void LayerTreeCoordinatorProxy::setLayerAnimatedTransform(uint32_t id, const WebCore::TransformationMatrix& transform)
+{
+    dispatchUpdate(bind(&LayerTreeRenderer::setAnimatedTransform, m_renderer.get(), id, transform));
+}
+
+void LayerTreeCoordinatorProxy::setVisibleContentsRect(const FloatRect& rect, float scale, const FloatPoint& trajectoryVector)
+{
+    // Inform the renderer to adjust viewport-fixed layers.
+    dispatchUpdate(bind(&LayerTreeRenderer::setVisibleContentsRect, m_renderer.get(), rect));
+
+    // Round the rect instead of enclosing it to make sure that its size stays the same while panning. This can have nasty effects on layout.
+    IntRect roundedRect = roundedIntRect(rect);
+    if (roundedRect == m_lastSentVisibleRect && scale == m_lastSentScale && trajectoryVector == m_lastSentTrajectoryVector)
+        return;
+
+    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeCoordinator::SetVisibleContentsRect(roundedRect, scale, trajectoryVector), m_drawingAreaProxy->page()->pageID());
+    m_lastSentVisibleRect = roundedRect;
+    m_lastSentScale = scale;
+    m_lastSentTrajectoryVector = trajectoryVector;
 }
 
 void LayerTreeCoordinatorProxy::renderNextFrame()
@@ -150,12 +171,12 @@ void LayerTreeCoordinatorProxy::renderNextFrame()
 
 void LayerTreeCoordinatorProxy::didChangeScrollPosition(const IntPoint& position)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::didChangeScrollPosition, m_renderer.get(), position));
+    dispatchUpdate(bind(&LayerTreeRenderer::didChangeScrollPosition, m_renderer.get(), position));
 }
 
 void LayerTreeCoordinatorProxy::syncCanvas(uint32_t id, const IntSize& canvasSize, uint32_t graphicsSurfaceToken)
 {
-    dispatchUpdate(bind(&WebLayerTreeRenderer::syncCanvas, m_renderer.get(), id, canvasSize, graphicsSurfaceToken));
+    dispatchUpdate(bind(&LayerTreeRenderer::syncCanvas, m_renderer.get(), id, canvasSize, graphicsSurfaceToken));
 }
 
 void LayerTreeCoordinatorProxy::purgeBackingStores()
@@ -164,4 +185,4 @@ void LayerTreeCoordinatorProxy::purgeBackingStores()
 }
 
 }
-#endif // USE(UI_SIDE_COMPOSITING)
+#endif // USE(COORDINATED_GRAPHICS)
diff --git a/Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.h b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h
index eca6900b6..f603cd0fc 100644
--- a/Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.h
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h
@@ -20,7 +20,7 @@
 #ifndef LayerTreeCoordinatorProxy_h
 #define LayerTreeCoordinatorProxy_h
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 
 #include "BackingStore.h"
 #include "DrawingAreaProxy.h"
@@ -36,14 +36,16 @@
 #include <wtf/Functional.h>
 #include <wtf/HashSet.h>
 
+#if PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QSGNode;
 QT_END_NAMESPACE
+#endif
 
 namespace WebKit {
 
 class WebLayerInfo;
-class WebLayerTreeRenderer;
+class LayerTreeRenderer;
 class WebLayerUpdateInfo;
 
 class LayerTreeCoordinatorProxy {
@@ -60,7 +62,7 @@ public:
     void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
     void purgeGLResources();
     void setContentsSize(const WebCore::FloatSize&);
-    void setVisibleContentsRect(const WebCore::IntRect&, float scale, const WebCore::FloatPoint& trajectory, const WebCore::FloatPoint& accurateVisibleContentsPosition);
+    void setVisibleContentsRect(const WebCore::FloatRect&, float scale, const WebCore::FloatPoint& trajectoryVector);
     void didRenderFrame();
     void createTileForLayer(int layerID, int tileID, const WebCore::IntRect&, const SurfaceUpdateInfo&);
     void updateTileForLayer(int layerID, int tileID, const WebCore::IntRect&, const SurfaceUpdateInfo&);
@@ -73,13 +75,18 @@ public:
     void didChangeScrollPosition(const WebCore::IntPoint& position);
     void syncCanvas(uint32_t id, const WebCore::IntSize& canvasSize, uint32_t graphicsSurfaceToken);
     void purgeBackingStores();
-    WebLayerTreeRenderer* layerTreeRenderer() const { return m_renderer.get(); }
+    LayerTreeRenderer* layerTreeRenderer() const { return m_renderer.get(); }
+    void setLayerAnimatedOpacity(uint32_t, float);
+    void setLayerAnimatedTransform(uint32_t, const WebCore::TransformationMatrix&);
 
 protected:
     void dispatchUpdate(const Function<void()>&);
 
     DrawingAreaProxy* m_drawingAreaProxy;
-    RefPtr<WebLayerTreeRenderer> m_renderer;
+    RefPtr<LayerTreeRenderer> m_renderer;
+    WebCore::IntRect m_lastSentVisibleRect;
+    float m_lastSentScale;
+    WebCore::FloatPoint m_lastSentTrajectoryVector;
 #if USE(GRAPHICS_SURFACE)
     HashMap<uint32_t, RefPtr<ShareableSurface> > m_surfaces;
 #endif
diff --git a/Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.messages.in b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in
index c284b915b..d2438f1f1 100644
--- a/Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.messages.in
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in
@@ -17,7 +17,7 @@
 #   Boston, MA 02110-1301, USA.
 #
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TILED_BACKING_STORE)
+#if USE(COORDINATED_GRAPHICS)
 messages -> LayerTreeCoordinatorProxy {
     SetCompositingLayerState(uint32_t id, WebKit::WebLayerInfo layerInfo)
     SetCompositingLayerChildren(uint32_t id, Vector<uint32_t> children)
@@ -34,5 +34,7 @@ messages -> LayerTreeCoordinatorProxy {
     DidRenderFrame()
     DidChangeScrollPosition(WebCore::IntPoint position)
     SyncCanvas(uint32_t id, WebCore::IntSize canvasSize, uint32_t graphicsSurfaceToken)
+    SetLayerAnimatedOpacity(uint32_t id, float opacity)
+    SetLayerAnimatedTransform(uint32_t id, WebCore::TransformationMatrix transform)
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp
index 95049a32d..ed0be3c29 100644
--- a/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp
@@ -19,12 +19,12 @@
 
 #include "config.h"
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 
-#include "WebLayerTreeRenderer.h"
+#include "LayerTreeRenderer.h"
 
+#include "CoordinatedBackingStore.h"
 #include "GraphicsLayerTextureMapper.h"
-#include "LayerBackingStore.h"
 #include "LayerTreeCoordinatorProxy.h"
 #include "MessageID.h"
 #include "ShareableBitmap.h"
@@ -66,38 +66,36 @@ private:
     }
 };
 
-void WebLayerTreeRenderer::callOnMainTread(const Function<void()>& function)
+void LayerTreeRenderer::callOnMainTread(const Function<void()>& function)
 {
     if (isMainThread())
         function();
     else
-        MainThreadGuardedInvoker<WebLayerTreeRenderer>::call(this, function);
+        MainThreadGuardedInvoker<LayerTreeRenderer>::call(this, function);
 }
 
-static IntPoint boundedScrollPosition(const IntPoint& scrollPosition, const IntRect& visibleContentRect, const FloatSize& contentSize)
+static FloatPoint boundedScrollPosition(const FloatPoint& scrollPosition, const FloatRect& visibleContentRect, const FloatSize& contentSize)
 {
-    IntSize size(contentSize.width(), contentSize.height());
-    int scrollPositionX = std::max(scrollPosition.x(), 0);
-    scrollPositionX = std::min(scrollPositionX, size.width() - visibleContentRect.width());
+    float scrollPositionX = std::max(scrollPosition.x(), 0.0f);
+    scrollPositionX = std::min(scrollPositionX, contentSize.width() - visibleContentRect.width());
 
-    int scrollPositionY = std::max(scrollPosition.y(), 0);
-    scrollPositionY = std::min(scrollPositionY, size.height() - visibleContentRect.height());
-    return IntPoint(scrollPositionX, scrollPositionY);
+    float scrollPositionY = std::max(scrollPosition.y(), 0.0f);
+    scrollPositionY = std::min(scrollPositionY, contentSize.height() - visibleContentRect.height());
+    return FloatPoint(scrollPositionX, scrollPositionY);
 }
 
-WebLayerTreeRenderer::WebLayerTreeRenderer(LayerTreeCoordinatorProxy* layerTreeCoordinatorProxy)
-    : m_contentsScale(1)
-    , m_layerTreeCoordinatorProxy(layerTreeCoordinatorProxy)
+LayerTreeRenderer::LayerTreeRenderer(LayerTreeCoordinatorProxy* layerTreeCoordinatorProxy)
+    : m_layerTreeCoordinatorProxy(layerTreeCoordinatorProxy)
     , m_rootLayerID(InvalidWebLayerID)
     , m_isActive(false)
 {
 }
 
-WebLayerTreeRenderer::~WebLayerTreeRenderer()
+LayerTreeRenderer::~LayerTreeRenderer()
 {
 }
 
-PassOwnPtr<GraphicsLayer> WebLayerTreeRenderer::createLayer(WebLayerID layerID)
+PassOwnPtr<GraphicsLayer> LayerTreeRenderer::createLayer(WebLayerID layerID)
 {
     GraphicsLayer* newLayer = new GraphicsLayerTextureMapper(this);
     TextureMapperLayer* layer = toTextureMapperLayer(newLayer);
@@ -105,18 +103,12 @@ PassOwnPtr<GraphicsLayer> WebLayerTreeRenderer::createLayer(WebLayerID layerID)
     return adoptPtr(newLayer);
 }
 
-void WebLayerTreeRenderer::paintToCurrentGLContext(const TransformationMatrix& matrix, float opacity, const FloatRect& clipRect, TextureMapper::PaintFlags PaintFlags)
+void LayerTreeRenderer::paintToCurrentGLContext(const TransformationMatrix& matrix, float opacity, const FloatRect& clipRect, TextureMapper::PaintFlags PaintFlags)
 {
     if (!m_textureMapper)
         m_textureMapper = TextureMapper::create(TextureMapper::OpenGLMode);
     ASSERT(m_textureMapper->accelerationMode() == TextureMapper::OpenGLMode);
 
-    // We need to compensate for the rounding error that happens due to m_visibleContentsRect being
-    // int and not float. We do that by moving the TransformationMatrix by the delta between the
-    // position of m_visibleContentsRect and the position it would have if it wasn't rounded.
- 
-    TransformationMatrix newMatrix = matrix;
-    newMatrix.translate(m_accurateVisibleContentsPosition.x() / m_contentsScale - m_visibleContentsRect.x(), m_accurateVisibleContentsPosition.y() / m_contentsScale - m_visibleContentsRect.y());
     adjustPositionForFixedLayers();
     GraphicsLayer* currentRootLayer = rootLayer();
     if (!currentRootLayer)
@@ -131,9 +123,9 @@ void WebLayerTreeRenderer::paintToCurrentGLContext(const TransformationMatrix& m
     m_textureMapper->beginPainting(PaintFlags);
     m_textureMapper->beginClip(TransformationMatrix(), clipRect);
 
-    if (currentRootLayer->opacity() != opacity || currentRootLayer->transform() != newMatrix) {
+    if (currentRootLayer->opacity() != opacity || currentRootLayer->transform() != matrix) {
         currentRootLayer->setOpacity(opacity);
-        currentRootLayer->setTransform(newMatrix);
+        currentRootLayer->setTransform(matrix);
         currentRootLayer->syncCompositingStateForThisLayerOnly();
     }
 
@@ -142,7 +134,7 @@ void WebLayerTreeRenderer::paintToCurrentGLContext(const TransformationMatrix& m
     m_textureMapper->endPainting();
 }
 
-void WebLayerTreeRenderer::paintToGraphicsContext(BackingStore::PlatformGraphicsContext painter)
+void LayerTreeRenderer::paintToGraphicsContext(BackingStore::PlatformGraphicsContext painter)
 {
     if (!m_textureMapper)
         m_textureMapper = TextureMapper::create();
@@ -161,42 +153,45 @@ void WebLayerTreeRenderer::paintToGraphicsContext(BackingStore::PlatformGraphics
     m_textureMapper->setGraphicsContext(0);
 }
 
-void WebLayerTreeRenderer::setContentsSize(const WebCore::FloatSize& contentsSize)
+void LayerTreeRenderer::setContentsSize(const WebCore::FloatSize& contentsSize)
 {
     m_contentsSize = contentsSize;
 }
 
-void WebLayerTreeRenderer::setVisibleContentsRect(const IntRect& rect, float scale, const WebCore::FloatPoint& accurateVisibleContentsPosition)
+void LayerTreeRenderer::setVisibleContentsRect(const FloatRect& rect)
 {
     m_visibleContentsRect = rect;
-    m_contentsScale = scale;
-    m_accurateVisibleContentsPosition = accurateVisibleContentsPosition;
 }
 
-void WebLayerTreeRenderer::updateViewport()
+void LayerTreeRenderer::updateViewport()
 {
     if (m_layerTreeCoordinatorProxy)
         m_layerTreeCoordinatorProxy->updateViewport();
 }
 
-void WebLayerTreeRenderer::adjustPositionForFixedLayers()
+void LayerTreeRenderer::adjustPositionForFixedLayers()
 {
     if (m_fixedLayers.isEmpty())
         return;
 
-    IntPoint scrollPosition = boundedScrollPosition(m_visibleContentsRect.location(), m_visibleContentsRect, m_contentsSize);
+    // Fixed layer positions are updated by the web process when we update the visible contents rect / scroll position.
+    // If we want those layers to follow accurately the viewport when we move between the web process updates, we have to offset
+    // them by the delta between the current position and the position of the viewport used for the last layout.
+    FloatPoint scrollPosition = boundedScrollPosition(m_visibleContentsRect.location(), m_visibleContentsRect, m_contentsSize);
+    FloatPoint renderedScrollPosition = boundedScrollPosition(m_renderedContentsScrollPosition, m_visibleContentsRect, m_contentsSize);
+    FloatSize delta = scrollPosition - renderedScrollPosition;
 
     LayerMap::iterator end = m_fixedLayers.end();
     for (LayerMap::iterator it = m_fixedLayers.begin(); it != end; ++it)
-        toTextureMapperLayer(it->second)->setScrollPositionDeltaIfNeeded(IntPoint(scrollPosition.x() - m_renderedContentsScrollPosition.x(), scrollPosition.y() - m_renderedContentsScrollPosition.y()));
+        toTextureMapperLayer(it->second)->setScrollPositionDeltaIfNeeded(delta);
 }
 
-void WebLayerTreeRenderer::didChangeScrollPosition(const IntPoint& position)
+void LayerTreeRenderer::didChangeScrollPosition(const IntPoint& position)
 {
-    m_pendingRenderedContentsScrollPosition = boundedScrollPosition(position, m_visibleContentsRect, m_contentsSize);
+    m_pendingRenderedContentsScrollPosition = position;
 }
 
-void WebLayerTreeRenderer::syncCanvas(WebLayerID id, const WebCore::IntSize& canvasSize, uint32_t graphicsSurfaceToken)
+void LayerTreeRenderer::syncCanvas(WebLayerID id, const WebCore::IntSize& canvasSize, uint32_t graphicsSurfaceToken)
 {
     if (canvasSize.isEmpty() || !m_textureMapper)
         return;
@@ -218,7 +213,7 @@ void WebLayerTreeRenderer::syncCanvas(WebLayerID id, const WebCore::IntSize& can
 #endif
 }
 
-void WebLayerTreeRenderer::setLayerChildren(WebLayerID id, const Vector<WebLayerID>& childIDs)
+void LayerTreeRenderer::setLayerChildren(WebLayerID id, const Vector<WebLayerID>& childIDs)
 {
     ensureLayer(id);
     LayerMap::iterator it = m_layers.find(id);
@@ -238,7 +233,7 @@ void WebLayerTreeRenderer::setLayerChildren(WebLayerID id, const Vector<WebLayer
 }
 
 #if ENABLE(CSS_FILTERS)
-void WebLayerTreeRenderer::setLayerFilters(WebLayerID id, const FilterOperations& filters)
+void LayerTreeRenderer::setLayerFilters(WebLayerID id, const FilterOperations& filters)
 {
     ensureLayer(id);
     LayerMap::iterator it = m_layers.find(id);
@@ -249,7 +244,7 @@ void WebLayerTreeRenderer::setLayerFilters(WebLayerID id, const FilterOperations
 }
 #endif
 
-void WebLayerTreeRenderer::setLayerState(WebLayerID id, const WebLayerInfo& layerInfo)
+void LayerTreeRenderer::setLayerState(WebLayerID id, const WebLayerInfo& layerInfo)
 {
     ensureLayer(id);
     LayerMap::iterator it = m_layers.find(id);
@@ -269,6 +264,7 @@ void WebLayerTreeRenderer::setLayerState(WebLayerID id, const WebLayerInfo& laye
     layer->setContentsOpaque(layerInfo.contentsOpaque);
     layer->setContentsRect(layerInfo.contentsRect);
     layer->setDrawsContent(layerInfo.drawsContent);
+    layer->setContentsVisible(layerInfo.contentsVisible);
     toGraphicsLayerTextureMapper(layer)->setFixedToViewport(layerInfo.fixedToViewport);
 
     if (layerInfo.fixedToViewport)
@@ -286,7 +282,7 @@ void WebLayerTreeRenderer::setLayerState(WebLayerID id, const WebLayerInfo& laye
         setRootLayerID(id);
 }
 
-void WebLayerTreeRenderer::deleteLayer(WebLayerID layerID)
+void LayerTreeRenderer::deleteLayer(WebLayerID layerID)
 {
     GraphicsLayer* layer = layerByID(layerID);
     if (!layer)
@@ -302,7 +298,7 @@ void WebLayerTreeRenderer::deleteLayer(WebLayerID layerID)
 }
 
 
-void WebLayerTreeRenderer::ensureLayer(WebLayerID id)
+void LayerTreeRenderer::ensureLayer(WebLayerID id)
 {
     // We have to leak the new layer's pointer and manage it ourselves,
     // because OwnPtr is not copyable.
@@ -310,7 +306,7 @@ void WebLayerTreeRenderer::ensureLayer(WebLayerID id)
         m_layers.add(id, createLayer(id).leakPtr());
 }
 
-void WebLayerTreeRenderer::setRootLayerID(WebLayerID layerID)
+void LayerTreeRenderer::setRootLayerID(WebLayerID layerID)
 {
     if (layerID == m_rootLayerID)
         return;
@@ -329,37 +325,37 @@ void WebLayerTreeRenderer::setRootLayerID(WebLayerID layerID)
     m_rootLayer->addChild(layer);
 }
 
-PassRefPtr<LayerBackingStore> WebLayerTreeRenderer::getBackingStore(WebLayerID id)
+PassRefPtr<CoordinatedBackingStore> LayerTreeRenderer::getBackingStore(WebLayerID id)
 {
     TextureMapperLayer* layer = toTextureMapperLayer(layerByID(id));
     ASSERT(layer);
-    RefPtr<LayerBackingStore> backingStore = static_cast<LayerBackingStore*>(layer->backingStore().get());
+    RefPtr<CoordinatedBackingStore> backingStore = static_cast<CoordinatedBackingStore*>(layer->backingStore().get());
     if (!backingStore) {
-        backingStore = LayerBackingStore::create();
+        backingStore = CoordinatedBackingStore::create();
         layer->setBackingStore(backingStore.get());
     }
     ASSERT(backingStore);
     return backingStore;
 }
 
-void WebLayerTreeRenderer::createTile(WebLayerID layerID, int tileID, float scale)
+void LayerTreeRenderer::createTile(WebLayerID layerID, int tileID, float scale)
 {
     getBackingStore(layerID)->createTile(tileID, scale);
 }
 
-void WebLayerTreeRenderer::removeTile(WebLayerID layerID, int tileID)
+void LayerTreeRenderer::removeTile(WebLayerID layerID, int tileID)
 {
     getBackingStore(layerID)->removeTile(tileID);
 }
 
-void WebLayerTreeRenderer::updateTile(WebLayerID layerID, int tileID, const TileUpdate& update)
+void LayerTreeRenderer::updateTile(WebLayerID layerID, int tileID, const TileUpdate& update)
 {
-    RefPtr<LayerBackingStore> backingStore = getBackingStore(layerID);
+    RefPtr<CoordinatedBackingStore> backingStore = getBackingStore(layerID);
     backingStore->updateTile(tileID, update.sourceRect, update.targetRect, update.surface, update.offset);
     m_backingStoresWithPendingBuffers.add(backingStore);
 }
 
-void WebLayerTreeRenderer::createImage(int64_t imageID, PassRefPtr<ShareableBitmap> weakBitmap)
+void LayerTreeRenderer::createImage(int64_t imageID, PassRefPtr<ShareableBitmap> weakBitmap)
 {
     RefPtr<ShareableBitmap> bitmap = weakBitmap;
     RefPtr<TextureMapperTiledBackingStore> backingStore = TextureMapperTiledBackingStore::create();
@@ -367,12 +363,12 @@ void WebLayerTreeRenderer::createImage(int64_t imageID, PassRefPtr<ShareableBitm
     backingStore->updateContents(m_textureMapper.get(), bitmap->createImage().get());
 }
 
-void WebLayerTreeRenderer::destroyImage(int64_t imageID)
+void LayerTreeRenderer::destroyImage(int64_t imageID)
 {
     m_directlyCompositedImages.remove(imageID);
 }
 
-void WebLayerTreeRenderer::assignImageToLayer(GraphicsLayer* layer, int64_t imageID)
+void LayerTreeRenderer::assignImageToLayer(GraphicsLayer* layer, int64_t imageID)
 {
     if (!imageID) {
         layer->setContentsToMedia(0);
@@ -384,16 +380,16 @@ void WebLayerTreeRenderer::assignImageToLayer(GraphicsLayer* layer, int64_t imag
     layer->setContentsToMedia(it->second.get());
 }
 
-void WebLayerTreeRenderer::commitTileOperations()
+void LayerTreeRenderer::commitTileOperations()
 {
-    HashSet<RefPtr<LayerBackingStore> >::iterator end = m_backingStoresWithPendingBuffers.end();
-    for (HashSet<RefPtr<LayerBackingStore> >::iterator it = m_backingStoresWithPendingBuffers.begin(); it != end; ++it)
+    HashSet<RefPtr<CoordinatedBackingStore> >::iterator end = m_backingStoresWithPendingBuffers.end();
+    for (HashSet<RefPtr<CoordinatedBackingStore> >::iterator it = m_backingStoresWithPendingBuffers.begin(); it != end; ++it)
         (*it)->commitTileOperations(m_textureMapper.get());
 
     m_backingStoresWithPendingBuffers.clear();
 }
 
-void WebLayerTreeRenderer::flushLayerChanges()
+void LayerTreeRenderer::flushLayerChanges()
 {
     m_renderedContentsScrollPosition = m_pendingRenderedContentsScrollPosition;
 
@@ -401,16 +397,16 @@ void WebLayerTreeRenderer::flushLayerChanges()
     commitTileOperations();
 
     // The pending tiles state is on its way for the screen, tell the web process to render the next one.
-    callOnMainThread(bind(&WebLayerTreeRenderer::renderNextFrame, this));
+    callOnMainThread(bind(&LayerTreeRenderer::renderNextFrame, this));
 }
 
-void WebLayerTreeRenderer::renderNextFrame()
+void LayerTreeRenderer::renderNextFrame()
 {
     if (m_layerTreeCoordinatorProxy)
         m_layerTreeCoordinatorProxy->renderNextFrame();
 }
 
-void WebLayerTreeRenderer::ensureRootLayer()
+void LayerTreeRenderer::ensureRootLayer()
 {
     if (m_rootLayer)
         return;
@@ -429,7 +425,7 @@ void WebLayerTreeRenderer::ensureRootLayer()
     toTextureMapperLayer(m_rootLayer.get())->setTextureMapper(m_textureMapper.get());
 }
 
-void WebLayerTreeRenderer::syncRemoteContent()
+void LayerTreeRenderer::syncRemoteContent()
 {
     // We enqueue messages and execute them during paint, as they require an active GL context.
     ensureRootLayer();
@@ -440,7 +436,7 @@ void WebLayerTreeRenderer::syncRemoteContent()
     m_renderQueue.clear();
 }
 
-void WebLayerTreeRenderer::purgeGLResources()
+void LayerTreeRenderer::purgeGLResources()
 {
     TextureMapperLayer* layer = toTextureMapperLayer(rootLayer());
 
@@ -462,21 +458,37 @@ void WebLayerTreeRenderer::purgeGLResources()
 
     setActive(false);
 
-    callOnMainThread(bind(&WebLayerTreeRenderer::purgeBackingStores, this));
+    callOnMainThread(bind(&LayerTreeRenderer::purgeBackingStores, this));
 }
 
-void WebLayerTreeRenderer::purgeBackingStores()
+void LayerTreeRenderer::setAnimatedOpacity(uint32_t id, float opacity)
+{
+    GraphicsLayer* layer = layerByID(id);
+    ASSERT(layer);
+
+    layer->setOpacity(opacity);
+}
+
+void LayerTreeRenderer::setAnimatedTransform(uint32_t id, const WebCore::TransformationMatrix& transform)
+{
+    GraphicsLayer* layer = layerByID(id);
+    ASSERT(layer);
+
+    layer->setTransform(transform);
+}
+
+void LayerTreeRenderer::purgeBackingStores()
 {
     if (m_layerTreeCoordinatorProxy)
         m_layerTreeCoordinatorProxy->purgeBackingStores();
 }
 
-void WebLayerTreeRenderer::detach()
+void LayerTreeRenderer::detach()
 {
     m_layerTreeCoordinatorProxy = 0;
 }
 
-void WebLayerTreeRenderer::appendUpdate(const Function<void()>& function)
+void LayerTreeRenderer::appendUpdate(const Function<void()>& function)
 {
     if (!m_isActive)
         return;
@@ -484,7 +496,7 @@ void WebLayerTreeRenderer::appendUpdate(const Function<void()>& function)
     m_renderQueue.append(function);
 }
 
-void WebLayerTreeRenderer::setActive(bool active)
+void LayerTreeRenderer::setActive(bool active)
 {
     if (m_isActive == active)
         return;
@@ -500,4 +512,4 @@ void WebLayerTreeRenderer::setActive(bool active)
 
 } // namespace WebKit
 
-#endif // USE(UI_SIDE_COMPOSITING)
+#endif // USE(COORDINATED_GRAPHICS)
diff --git a/Source/WebKit2/UIProcess/WebLayerTreeRenderer.h b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.h
index 2a4bab536..6403b5d2d 100644
--- a/Source/WebKit2/UIProcess/WebLayerTreeRenderer.h
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.h
@@ -17,10 +17,10 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef WebLayerTreeRenderer_h
-#define WebLayerTreeRenderer_h
+#ifndef LayerTreeRenderer_h
+#define LayerTreeRenderer_h
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 #include "BackingStore.h"
 #include "GraphicsSurface.h"
 #include "ShareableSurface.h"
@@ -39,12 +39,12 @@
 
 namespace WebKit {
 
-class LayerBackingStore;
+class CoordinatedBackingStore;
 class LayerTreeCoordinatorProxy;
 class WebLayerInfo;
 class WebLayerUpdateInfo;
 
-class WebLayerTreeRenderer : public ThreadSafeRefCounted<WebLayerTreeRenderer>, public WebCore::GraphicsLayerClient {
+class LayerTreeRenderer : public ThreadSafeRefCounted<LayerTreeRenderer>, public WebCore::GraphicsLayerClient {
 public:
     struct TileUpdate {
         WebCore::IntRect sourceRect;
@@ -59,14 +59,14 @@ public:
         {
         }
     };
-    WebLayerTreeRenderer(LayerTreeCoordinatorProxy*);
-    virtual ~WebLayerTreeRenderer();
+    LayerTreeRenderer(LayerTreeCoordinatorProxy*);
+    virtual ~LayerTreeRenderer();
     void purgeGLResources();
     void paintToCurrentGLContext(const WebCore::TransformationMatrix&, float, const WebCore::FloatRect&, WebCore::TextureMapper::PaintFlags = 0);
     void paintToGraphicsContext(BackingStore::PlatformGraphicsContext);
     void syncRemoteContent();
     void setContentsSize(const WebCore::FloatSize&);
-    void setVisibleContentsRect(const WebCore::IntRect&, float scale, const WebCore::FloatPoint& accurateVisibleContentsPosition);
+    void setVisibleContentsRect(const WebCore::FloatRect&);
     void didChangeScrollPosition(const WebCore::IntPoint& position);
     void syncCanvas(uint32_t id, const WebCore::IntSize& canvasSize, uint32_t graphicsSurfaceToken);
 
@@ -89,6 +89,8 @@ public:
     void flushLayerChanges();
     void createImage(int64_t, PassRefPtr<ShareableBitmap>);
     void destroyImage(int64_t);
+    void setAnimatedOpacity(uint32_t, float);
+    void setAnimatedTransform(uint32_t, const WebCore::TransformationMatrix&);
 
 private:
     PassOwnPtr<WebCore::GraphicsLayer> createLayer(WebLayerID);
@@ -107,18 +109,16 @@ private:
 
     typedef HashMap<WebLayerID, WebCore::GraphicsLayer*> LayerMap;
     WebCore::FloatSize m_contentsSize;
-    WebCore::IntRect m_visibleContentsRect;
-    WebCore::FloatPoint m_accurateVisibleContentsPosition;
-    float m_contentsScale;
+    WebCore::FloatRect m_visibleContentsRect;
 
     // Render queue can be accessed ony from main thread or updatePaintNode call stack!
     Vector<Function<void()> > m_renderQueue;
 
 #if USE(TEXTURE_MAPPER)
     OwnPtr<WebCore::TextureMapper> m_textureMapper;
-    PassRefPtr<LayerBackingStore> getBackingStore(WebLayerID);
+    PassRefPtr<CoordinatedBackingStore> getBackingStore(WebLayerID);
     HashMap<int64_t, RefPtr<WebCore::TextureMapperBackingStore> > m_directlyCompositedImages;
-    HashSet<RefPtr<LayerBackingStore> > m_backingStoresWithPendingBuffers;
+    HashSet<RefPtr<CoordinatedBackingStore> > m_backingStoresWithPendingBuffers;
 #endif
 #if USE(GRAPHICS_SURFACE)
     typedef HashMap<WebLayerID, RefPtr<WebCore::TextureMapperSurfaceBackingStore> > SurfaceBackingStoreMap;
@@ -149,8 +149,8 @@ private:
 
 };
 
-#endif // USE(UI_SIDE_COMPOSITING)
+#endif // USE(COORDINATED_GRAPHICS)
 
-#endif // WebLayerTreeRenderer_h
+#endif // LayerTreeRenderer_h
 
 
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxy.cpp b/Source/WebKit2/UIProcess/DrawingAreaProxy.cpp
index 5f7b10654..79e610e96 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxy.cpp
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxy.cpp
@@ -28,7 +28,7 @@
 
 #include "WebPageProxy.h"
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 #include "LayerTreeCoordinatorProxy.h"
 #include <CoreIPC/MessageID.h>
 #endif
@@ -58,7 +58,7 @@ void DrawingAreaProxy::setSize(const IntSize& size, const IntSize& scrollOffset)
     sizeDidChange();
 }
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 void DrawingAreaProxy::updateViewport()
 {
     m_webPageProxy->setViewNeedsDisplay(viewportVisibleRect());
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxy.h b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
index 805b8ac34..5c2d508c4 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxy.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
@@ -90,13 +90,13 @@ public:
 
     virtual void colorSpaceDidChange() { }
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
     virtual void updateViewport();
     virtual WebCore::IntRect viewportVisibleRect() const { return contentsRect(); }
     virtual WebCore::IntRect contentsRect() const;
     virtual bool isBackingStoreReady() const { return true; }
     LayerTreeCoordinatorProxy* layerTreeCoordinatorProxy() const { return m_layerTreeCoordinatorProxy.get(); }
-    virtual void setVisibleContentsRect(const WebCore::IntRect& visibleContentsRect, float scale, const WebCore::FloatPoint& trajectoryVector, const WebCore::FloatPoint& accurateVisibleContentsPosition = WebCore::FloatPoint()) { }
+    virtual void setVisibleContentsRect(const WebCore::FloatRect& visibleContentsRect, float scale, const WebCore::FloatPoint& trajectoryVector) { }
     virtual void createTileForLayer(int layerID, int tileID, const WebKit::UpdateInfo&) { }
     virtual void updateTileForLayer(int layerID, int tileID, const WebKit::UpdateInfo&) { }
     virtual void removeTileForLayer(int layerID, int tileID) { }
@@ -113,7 +113,7 @@ protected:
     WebCore::IntSize m_size;
     WebCore::IntSize m_scrollOffset;
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
     OwnPtr<LayerTreeCoordinatorProxy> m_layerTreeCoordinatorProxy;
 #endif
 
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
index 0bb74484e..cd9cafc17 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
@@ -36,7 +36,7 @@
 #include "WebProcessProxy.h"
 #include <WebCore/Region.h>
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 #include "LayerTreeCoordinatorProxy.h"
 #endif
 
@@ -58,7 +58,7 @@ DrawingAreaProxyImpl::DrawingAreaProxyImpl(WebPageProxy* webPageProxy)
     , m_isBackingStoreDiscardable(true)
     , m_discardBackingStoreTimer(RunLoop::current(), this, &DrawingAreaProxyImpl::discardBackingStore)
 {
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
     // Construct the proxy early to allow messages to be sent to the web process while AC is entered there.
     if (webPageProxy->pageGroup()->preferences()->forceCompositingMode())
         m_layerTreeCoordinatorProxy = adoptPtr(new LayerTreeCoordinatorProxy(this));
@@ -353,23 +353,23 @@ void DrawingAreaProxyImpl::enterAcceleratedCompositingMode(const LayerTreeContex
     m_backingStore = nullptr;
     m_layerTreeContext = layerTreeContext;
     m_webPageProxy->enterAcceleratedCompositingMode(layerTreeContext);
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
     if (!m_layerTreeCoordinatorProxy)
         m_layerTreeCoordinatorProxy = adoptPtr(new LayerTreeCoordinatorProxy(this));
 #endif
 }
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 void DrawingAreaProxyImpl::didReceiveLayerTreeCoordinatorProxyMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
     if (m_layerTreeCoordinatorProxy)
         m_layerTreeCoordinatorProxy->didReceiveLayerTreeCoordinatorProxyMessage(connection, messageID, arguments);
 }
 
-void DrawingAreaProxyImpl::setVisibleContentsRect(const WebCore::IntRect& visibleContentsRect, float scale, const WebCore::FloatPoint& trajectoryVector, const WebCore::FloatPoint& accurateVisibleContentsPosition)
+void DrawingAreaProxyImpl::setVisibleContentsRect(const WebCore::FloatRect& visibleContentsRect, float scale, const WebCore::FloatPoint& trajectoryVector)
 {
     if (m_layerTreeCoordinatorProxy)
-        m_layerTreeCoordinatorProxy->setVisibleContentsRect(visibleContentsRect, scale, trajectoryVector, accurateVisibleContentsPosition);
+        m_layerTreeCoordinatorProxy->setVisibleContentsRect(visibleContentsRect, scale, trajectoryVector);
 }
 
 #endif
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
index 4c4ac5939..0c9f04f8e 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
@@ -81,8 +81,8 @@ private:
 
     bool isInAcceleratedCompositingMode() const { return !m_layerTreeContext.isEmpty(); }
 
-#if USE(UI_SIDE_COMPOSITING)
-    virtual void setVisibleContentsRect(const WebCore::IntRect& visibleContentsRect, float scale, const WebCore::FloatPoint& trajectory, const WebCore::FloatPoint& accurateVisibleContentsPosition = WebCore::FloatPoint());
+#if USE(COORDINATED_GRAPHICS)
+    virtual void setVisibleContentsRect(const WebCore::FloatRect& visibleContentsRect, float scale, const WebCore::FloatPoint& trajectory);
     void didReceiveLayerTreeCoordinatorProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 #endif
 #else
diff --git a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
index 75b2f27a6..3144a43b6 100644
--- a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
+++ b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
@@ -57,6 +57,9 @@ public:
         static const cpu_type_t MatchCurrentArchitecture = 0;
         cpu_type_t architecture;
         bool executableHeap;
+#if HAVE(XPC)
+        bool useXPC;
+#endif
 #endif
 #ifndef NDEBUG
         String processCmdPrefix;
@@ -75,11 +78,11 @@ public:
     void invalidate();
 
     static bool getProcessTypeFromString(const char*, ProcessType&);
+    static const char* processTypeAsString(ProcessType);
+
 private:
     ProcessLauncher(Client*, const LaunchOptions& launchOptions);
 
-    static const char* processTypeAsString(ProcessType);
-
     void launchProcess();
     void didFinishLaunchingProcess(PlatformProcessIdentifier, CoreIPC::Connection::Identifier);
 
diff --git a/Source/WebKit2/UIProcess/Launcher/efl/ThreadLauncherEfl.cpp b/Source/WebKit2/UIProcess/Launcher/efl/ThreadLauncherEfl.cpp
deleted file mode 100644
index 47e1fd685..000000000
--- a/Source/WebKit2/UIProcess/Launcher/efl/ThreadLauncherEfl.cpp
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
-   Copyright (C) 2012 Samsung Electronics
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include "ThreadLauncher.h"
-
-#include <WebCore/NotImplemented.h>
-
-namespace WebKit {
-
-CoreIPC::Connection::Identifier ThreadLauncher::createWebThread()
-{
-    notImplemented();
-    return -1;
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/Launcher/mac/ProcessLauncherMac.mm b/Source/WebKit2/UIProcess/Launcher/mac/ProcessLauncherMac.mm
index fab9c24f8..fddf8502d 100644
--- a/Source/WebKit2/UIProcess/Launcher/mac/ProcessLauncherMac.mm
+++ b/Source/WebKit2/UIProcess/Launcher/mac/ProcessLauncherMac.mm
@@ -45,11 +45,20 @@
 #import <wtf/text/CString.h>
 #import <wtf/text/WTFString.h>
 
+#if HAVE(XPC)
+#import <xpc/xpc.h>
+#endif
+
 using namespace WebCore;
 
 // FIXME: We should be doing this another way.
 extern "C" kern_return_t bootstrap_register2(mach_port_t, name_t, mach_port_t, uint64_t);
 
+#if HAVE(XPC)
+extern "C" void xpc_connection_set_instance(xpc_connection_t, uuid_t);
+extern "C" void xpc_dictionary_set_mach_send(xpc_object_t, const char*, mach_port_t);
+#endif
+
 namespace WebKit {
 
 static void setUpTerminationNotificationHandler(pid_t pid)
@@ -68,8 +77,27 @@ static void setUpTerminationNotificationHandler(pid_t pid)
 #endif
 }
 
-void ProcessLauncher::launchProcess()
+typedef void (ProcessLauncher::*DidFinishLaunchingProcessFunction)(PlatformProcessIdentifier, CoreIPC::Connection::Identifier);
+
+#if HAVE(XPC)
+static void launchXPCService(const ProcessLauncher::LaunchOptions&, const EnvironmentVariables&, ProcessLauncher* that, DidFinishLaunchingProcessFunction didFinishLaunchingProcessFunction)
 {
+    // Create a connection to the WebKit2 XPC service.
+    xpc_connection_t connection = xpc_connection_create("com.apple.WebKit2Service", 0);
+
+    uuid_t uuid;
+    uuid_generate(uuid);
+    xpc_connection_set_instance(connection, uuid);
+
+    xpc_connection_set_event_handler(connection, ^(xpc_object_t event) {
+        xpc_type_t type = xpc_get_type(event);
+        if (type == XPC_TYPE_ERROR) {
+            if (event == XPC_ERROR_CONNECTION_INVALID || event == XPC_ERROR_CONNECTION_INTERRUPTED)
+                NSLog(@"WebKit2 Web Content service exited.");
+        }
+    });
+    xpc_connection_resume(connection);
+
     // Create the listening port.
     mach_port_t listeningPort;
     mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &listeningPort);
@@ -77,41 +105,109 @@ void ProcessLauncher::launchProcess()
     // Insert a send right so we can send to it.
     mach_port_insert_right(mach_task_self(), listeningPort, listeningPort, MACH_MSG_TYPE_MAKE_SEND);
 
-    pid_t processIdentifier = 0;
+    xpc_object_t bootStrapMessage = xpc_dictionary_create(0, 0, 0);
+    xpc_dictionary_set_string(bootStrapMessage, "message-name", "bootstrap");
+    xpc_dictionary_set_string(bootStrapMessage, "framework-executable-path", [[[NSBundle bundleWithIdentifier:@"com.apple.WebKit2"] executablePath] fileSystemRepresentation]);
+    xpc_dictionary_set_mach_send(bootStrapMessage, "server-port", listeningPort);
+
+    that->ref();
+
+    xpc_connection_send_message_with_reply(connection, bootStrapMessage, dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^(xpc_object_t reply) {
+        xpc_type_t type = xpc_get_type(reply);
+        if (type == XPC_TYPE_ERROR) {
+            // We failed to launch. Release the send right.
+            mach_port_deallocate(mach_task_self(), listeningPort);
+
+            // And the receive right.
+            mach_port_mod_refs(mach_task_self(), listeningPort, MACH_PORT_RIGHT_RECEIVE, -1);
+
+            RunLoop::main()->dispatch(bind(didFinishLaunchingProcessFunction, that, 0, CoreIPC::Connection::Identifier()));
+        } else {
+            ASSERT(type == XPC_TYPE_DICTIONARY);
+            ASSERT(!strcmp(xpc_dictionary_get_string(reply, "message-name"), "process-finished-launching"));
+
+            // The process has finished launching, grab the pid from the connection.
+            pid_t processIdentifier = xpc_connection_get_pid(connection);
+
+            // We've finished launching the process, message back to the main run loop.
+            RunLoop::main()->dispatch(bind(didFinishLaunchingProcessFunction, that, processIdentifier, CoreIPC::Connection::Identifier(listeningPort, connection)));
+        }
+
+        that->deref();
+    });
+    xpc_release(bootStrapMessage);
+}
+#endif
 
-    EnvironmentVariables environmentVariables;
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
+static bool tryPreexistingProcess(const ProcessLauncher::LaunchOptions& launchOptions, const EnvironmentVariables& environmentVariables, ProcessLauncher* that, DidFinishLaunchingProcessFunction didFinishLaunchingProcessFunction)
+{
     static const char* preexistingProcessServiceName = environmentVariables.get(EnvironmentVariables::preexistingProcessServiceNameKey());
-    ProcessType preexistingProcessType;
+
+    ProcessLauncher::ProcessType preexistingProcessType;
     if (preexistingProcessServiceName)
-        getProcessTypeFromString(environmentVariables.get(EnvironmentVariables::preexistingProcessTypeKey()), preexistingProcessType);
+        ProcessLauncher::getProcessTypeFromString(environmentVariables.get(EnvironmentVariables::preexistingProcessTypeKey()), preexistingProcessType);
 
-    bool usePreexistingProcess = preexistingProcessServiceName && preexistingProcessType == m_launchOptions.processType;
+    bool usePreexistingProcess = preexistingProcessServiceName && preexistingProcessType == launchOptions.processType;
+    if (!usePreexistingProcess)
+        return false;
 
-    if (usePreexistingProcess) {
-        mach_port_t lookupPort;
-        bootstrap_look_up(bootstrap_port, preexistingProcessServiceName, &lookupPort);
+    // Create the listening port.
+    mach_port_t listeningPort;
+    mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &listeningPort);
+    
+    // Insert a send right so we can send to it.
+    mach_port_insert_right(mach_task_self(), listeningPort, listeningPort, MACH_MSG_TYPE_MAKE_SEND);
+
+    pid_t processIdentifier = 0;
 
-        mach_msg_header_t header;
-        header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND);
-        header.msgh_id = 0;
-        header.msgh_local_port = listeningPort;
-        header.msgh_remote_port = lookupPort;
-        header.msgh_size = sizeof(header);
-        kern_return_t kr = mach_msg(&header, MACH_SEND_MSG, sizeof(header), 0, MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
+    mach_port_t lookupPort;
+    bootstrap_look_up(bootstrap_port, preexistingProcessServiceName, &lookupPort);
 
-        if (kr) {
-            LOG_ERROR("Failed to pick up preexisting process at %s (%x). Launching a new process of type %s instead.", preexistingProcessServiceName, kr, processTypeAsString(m_launchOptions.processType));
-            usePreexistingProcess = false;
-        }
+    mach_msg_header_t header;
+    header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND);
+    header.msgh_id = 0;
+    header.msgh_local_port = listeningPort;
+    header.msgh_remote_port = lookupPort;
+    header.msgh_size = sizeof(header);
+    kern_return_t kr = mach_msg(&header, MACH_SEND_MSG, sizeof(header), 0, MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
 
-        mach_port_deallocate(mach_task_self(), lookupPort);
+    mach_port_deallocate(mach_task_self(), lookupPort);
+    preexistingProcessServiceName = 0;
 
-        preexistingProcessServiceName = 0;
+    if (kr) {
+        LOG_ERROR("Failed to pick up preexisting process at %s (%x). Launching a new process of type %s instead.", preexistingProcessServiceName, kr, ProcessLauncher::processTypeAsString(launchOptions.processType));
+        return false;
     }
+    
+    // We've finished launching the process, message back to the main run loop.
+    RunLoop::main()->dispatch(bind(didFinishLaunchingProcessFunction, that, processIdentifier, CoreIPC::Connection::Identifier(listeningPort)));
+    return true;
+}
+#endif
 
-    if (!usePreexistingProcess) {
+void ProcessLauncher::launchProcess()
+{
+    EnvironmentVariables environmentVariables;
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
+    if (tryPreexistingProcess(m_launchOptions, environmentVariables, this, &ProcessLauncher::didFinishLaunchingProcess))
+        return;
 #endif
+
+#if HAVE(XPC)
+    if (m_launchOptions.useXPC) {
+        launchXPCService(m_launchOptions, environmentVariables, this, &ProcessLauncher::didFinishLaunchingProcess);
+        return;
+    }
+#endif
+
+        // Create the listening port.
+        mach_port_t listeningPort;
+        mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &listeningPort);
+    
+        // Insert a send right so we can send to it.
+        mach_port_insert_right(mach_task_self(), listeningPort, listeningPort, MACH_MSG_TYPE_MAKE_SEND);
+
         NSBundle *webKit2Bundle = [NSBundle bundleWithIdentifier:@"com.apple.WebKit2"];
         NSString *frameworksPath = [[webKit2Bundle bundlePath] stringByDeletingLastPathComponent];
         const char* frameworkExecutablePath = [[webKit2Bundle executablePath] fileSystemRepresentation];
@@ -169,7 +265,7 @@ void ProcessLauncher::launchProcess()
         posix_spawnattr_setflags(&attr, flags);
 
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
-        DynamicLinkerEnvironmentExtractor environmentExtractor([[NSBundle mainBundle] executablePath], architecture);
+        DynamicLinkerEnvironmentExtractor environmentExtractor([[NSBundle mainBundle] executablePath], _NSGetMachExecuteHeader()->cputype);
         environmentExtractor.getExtractedEnvironmentVariables(environmentVariables);
 #endif
 
@@ -192,7 +288,8 @@ void ProcessLauncher::launchProcess()
             if (stat(processShimPath, &statBuf) == 0 && (statBuf.st_mode & S_IFMT) == S_IFREG)
                 environmentVariables.appendValue("DYLD_INSERT_LIBRARIES", processShimPath, ':');
         }
-        
+
+        pid_t processIdentifier = 0;
         int result = posix_spawn(&processIdentifier, args[0], 0, &attr, const_cast<char**>(args), environmentVariables.environmentPointer());
 
         posix_spawnattr_destroy(&attr);
@@ -211,12 +308,9 @@ void ProcessLauncher::launchProcess()
             listeningPort = MACH_PORT_NULL;
             processIdentifier = 0;
         }
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
-    }
-#endif
 
     // We've finished launching the process, message back to the main run loop.
-    RunLoop::main()->dispatch(bind(&ProcessLauncher::didFinishLaunchingProcess, this, processIdentifier, listeningPort));
+    RunLoop::main()->dispatch(bind(&ProcessLauncher::didFinishLaunchingProcess, this, processIdentifier, CoreIPC::Connection::Identifier(listeningPort)));
 }
 
 void ProcessLauncher::terminateProcess()
diff --git a/Source/WebKit2/UIProcess/Launcher/mac/ThreadLauncherMac.mm b/Source/WebKit2/UIProcess/Launcher/mac/ThreadLauncherMac.mm
deleted file mode 100644
index 7c011531f..000000000
--- a/Source/WebKit2/UIProcess/Launcher/mac/ThreadLauncherMac.mm
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "config.h"
-#import "ThreadLauncher.h"
-
-#import "WebProcess.h"
-#import "WebSystemInterface.h"
-#import <runtime/InitializeThreading.h>
-#import <WebCore/RunLoop.h>
-#import <wtf/MainThread.h>
-#import <wtf/Threading.h>
-
-using namespace WebCore;
-
-namespace WebKit {
-
-static void webThreadBody(void* context)
-{
-    mach_port_t serverPort = static_cast<mach_port_t>(reinterpret_cast<uintptr_t>(context));
-
-    NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
-
-    InitWebCoreSystemInterface();
-    JSC::initializeThreading();
-    WTF::initializeMainThread();
-
-    WebProcess::shared().initialize(serverPort, RunLoop::current());
-
-    [pool drain];
-
-    RunLoop::current()->run();
-}
-
-CoreIPC::Connection::Identifier ThreadLauncher::createWebThread()
-{
-    // Create the service port.
-     mach_port_t listeningPort;
-     mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &listeningPort);
-     
-     // Insert a send right so we can send to it.
-     mach_port_insert_right(mach_task_self(), listeningPort, listeningPort, MACH_MSG_TYPE_MAKE_SEND);
-
-    if (!createThread(webThreadBody, reinterpret_cast<void*>(listeningPort), "WebKit2: WebThread")) {
-        mach_port_destroy(mach_task_self(), listeningPort);
-        return MACH_PORT_NULL;
-    }
-
-    return listeningPort;
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/Launcher/win/ThreadLauncherWin.cpp b/Source/WebKit2/UIProcess/Launcher/win/ThreadLauncherWin.cpp
deleted file mode 100644
index 5abec7aaa..000000000
--- a/Source/WebKit2/UIProcess/Launcher/win/ThreadLauncherWin.cpp
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ThreadLauncher.h"
-
-#include "WebProcess.h"
-#include <WebCore/RunLoop.h>
-#include <runtime/InitializeThreading.h>
-#include <wtf/MainThread.h>
-#include <wtf/Threading.h>
-
-using namespace WebCore;
-
-namespace WebKit {
-
-static void webThreadBody(void* context)
-{
-    HANDLE clientIdentifier = reinterpret_cast<HANDLE>(context);
-
-    // Initialization
-    JSC::initializeThreading();
-    WTF::initializeMainThread();
-
-    WebProcess::shared().initialize(clientIdentifier, RunLoop::current());
-    RunLoop::run();
-}
-
-CoreIPC::Connection::Identifier ThreadLauncher::createWebThread()
-{
-    // First, create the server and client identifiers.
-    HANDLE serverIdentifier, clientIdentifier;
-    if (!CoreIPC::Connection::createServerAndClientIdentifiers(serverIdentifier, clientIdentifier)) {
-        // FIXME: What should we do here?
-        ASSERT_NOT_REACHED();
-    }
-
-    if (!createThread(webThreadBody, reinterpret_cast<void*>(clientIdentifier), "WebKit2: WebThread")) {
-        ::CloseHandle(serverIdentifier);
-        ::CloseHandle(clientIdentifier);
-        return 0;
-    }
-
-    return serverIdentifier;
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/PageClient.h b/Source/WebKit2/UIProcess/PageClient.h
index 518db8e1c..a343ae610 100644
--- a/Source/WebKit2/UIProcess/PageClient.h
+++ b/Source/WebKit2/UIProcess/PageClient.h
@@ -118,7 +118,6 @@ public:
     virtual void pageDidRequestScroll(const WebCore::IntPoint&) = 0;
 #endif
 #if PLATFORM(QT)
-    virtual void didChangeContentsSize(const WebCore::IntSize&) = 0;
     virtual void didFindZoomableArea(const WebCore::IntPoint&, const WebCore::IntRect&) = 0;
     virtual void didReceiveMessageFromNavigatorQtObject(const String&) = 0;
     virtual void updateTextInputState() = 0;
@@ -131,6 +130,10 @@ public:
     virtual void handleDownloadRequest(DownloadProxy*) = 0;
 #endif // PLATFORM(QT) || PLATFORM(EFL)
 
+#if PLATFORM(QT) || PLATFORM(EFL)
+    virtual void didChangeContentsSize(const WebCore::IntSize&) = 0;
+#endif
+
 #if PLATFORM(QT) || PLATFORM(GTK)
     virtual void startDrag(const WebCore::DragData&, PassRefPtr<ShareableBitmap> dragImage) = 0;
 #endif
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.cpp b/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.cpp
index 37ff06030..bff8fa941 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.cpp
@@ -187,7 +187,7 @@ static inline String pathExtension(const KURL& url)
 }
 
 #if !PLATFORM(MAC)
-bool PluginInfoStore::shouldBlockPlugin(const PluginModuleInfo&) const
+bool PluginInfoStore::shouldBlockPlugin(const PluginModuleInfo&)
 {
     return false;
 }
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h b/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h
index 42df69b09..1b2082dbb 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h
+++ b/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h
@@ -56,7 +56,7 @@ public:
 
     // Return whether this plug-in should be blocked from being instantiated.
     // Note that the plug-in will still be seen by e.g. navigator.plugins
-    bool shouldBlockPlugin(const PluginModuleInfo&) const;
+    static bool shouldBlockPlugin(const PluginModuleInfo&);
 
 private:
     PluginModuleInfo findPluginForMIMEType(const String& mimeType) const;
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
index 43fa2f4cb..12abf6dc2 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
@@ -67,6 +67,9 @@ PluginProcessProxy::PluginProcessProxy(PluginProcessManager* PluginProcessManage
 #if PLATFORM(MAC)
     launchOptions.architecture = pluginInfo.pluginArchitecture;
     launchOptions.executableHeap = PluginProcessProxy::pluginNeedsExecutableHeap(pluginInfo);
+#if HAVE(XPC)
+    launchOptions.useXPC = false;
+#endif
 #endif
 
     m_processLauncher = ProcessLauncher::create(this, launchOptions);
@@ -137,9 +140,9 @@ void PluginProcessProxy::pluginProcessCrashedOrFailedToLaunch()
         RefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply> reply = m_pendingConnectionReplies.takeFirst();
 
 #if PLATFORM(MAC)
-        reply->send(CoreIPC::Attachment(0, MACH_MSG_TYPE_MOVE_SEND));
+        reply->send(CoreIPC::Attachment(0, MACH_MSG_TYPE_MOVE_SEND), false);
 #elif USE(UNIX_DOMAIN_SOCKETS)
-        reply->send(CoreIPC::Attachment());
+        reply->send(CoreIPC::Attachment(), false);
 #else
         notImplemented();
 #endif
@@ -190,14 +193,16 @@ void PluginProcessProxy::didFinishLaunching(ProcessLauncher*, CoreIPC::Connectio
 {
     ASSERT(!m_connection);
 
-    if (!connectionIdentifier) {
+    if (CoreIPC::Connection::identifierIsNull(connectionIdentifier)) {
         pluginProcessCrashedOrFailedToLaunch();
         return;
     }
-    
+
     m_connection = CoreIPC::Connection::createServerConnection(connectionIdentifier, this, RunLoop::main());
 #if PLATFORM(MAC)
     m_connection->setShouldCloseConnectionOnMachExceptions();
+#elif PLATFORM(QT)
+    m_connection->setShouldCloseConnectionOnProcessTermination(m_processLauncher->processIdentifier());
 #endif
 
     m_connection->open();
@@ -228,7 +233,7 @@ void PluginProcessProxy::didFinishLaunching(ProcessLauncher*, CoreIPC::Connectio
     m_numPendingConnectionRequests = 0;
 }
 
-void PluginProcessProxy::didCreateWebProcessConnection(const CoreIPC::Attachment& connectionIdentifier)
+void PluginProcessProxy::didCreateWebProcessConnection(const CoreIPC::Attachment& connectionIdentifier, bool supportsAsynchronousPluginInitialization)
 {
     ASSERT(!m_pendingConnectionReplies.isEmpty());
 
@@ -236,9 +241,9 @@ void PluginProcessProxy::didCreateWebProcessConnection(const CoreIPC::Attachment
     RefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply> reply = m_pendingConnectionReplies.takeFirst();
 
 #if PLATFORM(MAC)
-    reply->send(CoreIPC::Attachment(connectionIdentifier.port(), MACH_MSG_TYPE_MOVE_SEND));
+    reply->send(CoreIPC::Attachment(connectionIdentifier.port(), MACH_MSG_TYPE_MOVE_SEND), supportsAsynchronousPluginInitialization);
 #elif USE(UNIX_DOMAIN_SOCKETS)
-    reply->send(connectionIdentifier);
+    reply->send(connectionIdentifier, supportsAsynchronousPluginInitialization);
 #else
     notImplemented();
 #endif
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
index 0a51d9b27..e0fe15ff0 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
@@ -108,7 +108,7 @@ private:
 
     // Message handlers
     void didReceivePluginProcessProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
-    void didCreateWebProcessConnection(const CoreIPC::Attachment&);
+    void didCreateWebProcessConnection(const CoreIPC::Attachment&, bool supportsAsynchronousPluginInitialization);
     void didGetSitesWithData(const Vector<String>& sites, uint64_t callbackID);
     void didClearSiteData(uint64_t callbackID);
 
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in
index 7b59aefec..183cb0c68 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in
@@ -23,7 +23,7 @@
 #if ENABLE(PLUGIN_PROCESS)
 
 messages -> PluginProcessProxy {
-    DidCreateWebProcessConnection(CoreIPC::Attachment connectionIdentifier)
+    DidCreateWebProcessConnection(CoreIPC::Attachment connectionIdentifier, bool supportsAsynchronousPluginInitialization)
 
     DidGetSitesWithData(Vector<WTF::String> sites, uint64_t callbackID)
     DidClearSiteData(uint64_t callbackID)
diff --git a/Source/WebKit2/UIProcess/Plugins/mac/PluginInfoStoreMac.mm b/Source/WebKit2/UIProcess/Plugins/mac/PluginInfoStoreMac.mm
index 8688cfa79..9b86aaed3 100644
--- a/Source/WebKit2/UIProcess/Plugins/mac/PluginInfoStoreMac.mm
+++ b/Source/WebKit2/UIProcess/Plugins/mac/PluginInfoStoreMac.mm
@@ -82,6 +82,33 @@ bool PluginInfoStore::getPluginInfo(const String& pluginPath, PluginModuleInfo&
 #endif
 }
 
+static size_t findPluginWithBundleIdentifier(const Vector<PluginModuleInfo>& plugins, const String& bundleIdentifier)
+{
+    for (size_t i = 0; i < plugins.size(); ++i) {
+        if (plugins[i].bundleIdentifier == bundleIdentifier)
+            return i;
+    }
+
+    return notFound;
+}
+
+// Returns true if the given plug-in should be loaded, false otherwise.
+static bool checkForPreferredPlugin(Vector<PluginModuleInfo>& alreadyLoadedPlugins, const PluginModuleInfo& plugin, const String& oldPluginBundleIdentifier, const String& newPluginBundleIdentifier)
+{
+    if (plugin.bundleIdentifier == oldPluginBundleIdentifier) {
+        // If we've already found the new plug-in, we don't want to load the old plug-in.
+        if (findPluginWithBundleIdentifier(alreadyLoadedPlugins, newPluginBundleIdentifier) != notFound)
+            return false;
+    } else if (plugin.bundleIdentifier == newPluginBundleIdentifier) {
+        // If we've already found the old plug-in, remove it from the list of loaded plug-ins.
+        size_t oldPluginIndex = findPluginWithBundleIdentifier(alreadyLoadedPlugins, oldPluginBundleIdentifier);
+        if (oldPluginIndex != notFound)
+            alreadyLoadedPlugins.remove(oldPluginIndex);
+    }
+
+    return true;
+}
+
 bool PluginInfoStore::shouldUsePlugin(Vector<PluginModuleInfo>& alreadyLoadedPlugins, const PluginModuleInfo& plugin)
 {
     for (size_t i = 0; i < alreadyLoadedPlugins.size(); ++i) {
@@ -92,10 +119,21 @@ bool PluginInfoStore::shouldUsePlugin(Vector<PluginModuleInfo>& alreadyLoadedPlu
             return false;
     }
 
+    // Prefer the Oracle Java plug-in over the Apple java plug-in.
+    if (!checkForPreferredPlugin(alreadyLoadedPlugins, plugin, "com.apple.java.JavaAppletPlugin", "com.oracle.java.JavaAppletPlugin"))
+        return false;
+
+#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
+    if (plugin.bundleIdentifier == "com.apple.java.JavaAppletPlugin" && shouldBlockPlugin(plugin) && !WKJLIsRuntimeAndWebComponentsInstalled()) {
+        // If the Apple Java plug-in is blocked and there's no Java runtime installed, just pretend that the plug-in doesn't exist.
+        return false;
+    }
+#endif
+
     return true;
 }
 
-bool PluginInfoStore::shouldBlockPlugin(const PluginModuleInfo& plugin) const
+bool PluginInfoStore::shouldBlockPlugin(const PluginModuleInfo& plugin)
 {
     return WKShouldBlockPlugin(plugin.bundleIdentifier, plugin.versionString);
 }
diff --git a/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
index 3486de437..d4b4ba3c8 100644
--- a/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
+++ b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
@@ -118,6 +118,9 @@ bool PluginProcessProxy::createPropertyListFile(const PluginModuleInfo& plugin)
 
 void PluginProcessProxy::platformInitializePluginProcess(PluginProcessCreationParameters& parameters)
 {
+    // For know only Flash is known to behave with asynchronous plug-in initialization.
+    parameters.supportsAsynchronousPluginInitialization = m_pluginInfo.bundleIdentifier == "com.macromedia.Flash Player.plugin";
+
 #if USE(ACCELERATED_COMPOSITING) && HAVE(HOSTED_CORE_ANIMATION)
     parameters.parentProcessName = [[NSProcessInfo processInfo] processName];
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
diff --git a/Source/WebKit2/UIProcess/ProcessModel.h b/Source/WebKit2/UIProcess/ProcessModel.h
index 0e89c65c9..6c18da0a2 100644
--- a/Source/WebKit2/UIProcess/ProcessModel.h
+++ b/Source/WebKit2/UIProcess/ProcessModel.h
@@ -30,8 +30,7 @@ namespace WebKit {
 
 enum ProcessModel {
     ProcessModelSharedSecondaryProcess,
-    ProcessModelSharedSecondaryThread,
-    ProcessModelSecondaryProcess
+    ProcessModelMultipleSecondaryProcesses
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebConnectionToWebProcess.cpp b/Source/WebKit2/UIProcess/WebConnectionToWebProcess.cpp
index 84280a73d..e0dbc0644 100644
--- a/Source/WebKit2/UIProcess/WebConnectionToWebProcess.cpp
+++ b/Source/WebKit2/UIProcess/WebConnectionToWebProcess.cpp
@@ -78,7 +78,7 @@ void WebConnectionToWebProcess::didReceiveMessage(CoreIPC::Connection* connectio
             case WebConnectionLegacyMessage::PostMessage: {
                 String messageName;
                 RefPtr<APIObject> messageBody;
-                WebContextUserMessageDecoder messageDecoder(messageBody, m_process->context());
+                WebContextUserMessageDecoder messageDecoder(messageBody, m_process);
                 if (!arguments->decode(CoreIPC::Out(messageName, messageDecoder)))
                     return;
 
diff --git a/Source/WebKit2/UIProcess/WebContext.cpp b/Source/WebKit2/UIProcess/WebContext.cpp
index 22e4e2006..c80aad42b 100644
--- a/Source/WebKit2/UIProcess/WebContext.cpp
+++ b/Source/WebKit2/UIProcess/WebContext.cpp
@@ -86,7 +86,6 @@
 #include <wtf/RefCountedLeakCounter.h>
 #endif
 
-#define MESSAGE_CHECK(assertion) MESSAGE_CHECK_BASE(assertion, m_process->connection())
 #define MESSAGE_CHECK_URL(url) MESSAGE_CHECK_BASE(m_process->checkURLReceivedFromWebProcess(url), m_process->connection())
 
 using namespace WebCore;
@@ -95,28 +94,12 @@ namespace WebKit {
 
 DEFINE_DEBUG_ONLY_GLOBAL(WTF::RefCountedLeakCounter, webContextCounter, ("WebContext"));
 
-WebContext* WebContext::sharedProcessContext()
-{
-    JSC::initializeThreading();
-    WTF::initializeMainThread();
-    RunLoop::initializeMainRunLoop();
-    static WebContext* context = adoptRef(new WebContext(ProcessModelSharedSecondaryProcess, String())).leakRef();
-    return context;
-}
-
-WebContext* WebContext::sharedThreadContext()
-{
-    RunLoop::initializeMainRunLoop();
-    static WebContext* context = adoptRef(new WebContext(ProcessModelSharedSecondaryThread, String())).leakRef();
-    return context;
-}
-
 PassRefPtr<WebContext> WebContext::create(const String& injectedBundlePath)
 {
     JSC::initializeThreading();
     WTF::initializeMainThread();
     RunLoop::initializeMainRunLoop();
-    return adoptRef(new WebContext(ProcessModelSecondaryProcess, injectedBundlePath));
+    return adoptRef(new WebContext(ProcessModelSharedSecondaryProcess, injectedBundlePath));
 }
 
 static Vector<WebContext*>& contexts()
@@ -530,71 +513,6 @@ void WebContext::didReceiveSynchronousMessageFromInjectedBundle(const String& me
     m_injectedBundleClient.didReceiveSynchronousMessageFromInjectedBundle(this, messageName, messageBody, returnData);
 }
 
-// HistoryClient
-
-void WebContext::didNavigateWithNavigationData(uint64_t pageID, const WebNavigationDataStore& store, uint64_t frameID) 
-{
-    WebPageProxy* page = m_process->webPage(pageID);
-    if (!page)
-        return;
-    
-    WebFrameProxy* frame = m_process->webFrame(frameID);
-    MESSAGE_CHECK(frame);
-    MESSAGE_CHECK(frame->page() == page);
-    
-    m_historyClient.didNavigateWithNavigationData(this, page, store, frame);
-}
-
-void WebContext::didPerformClientRedirect(uint64_t pageID, const String& sourceURLString, const String& destinationURLString, uint64_t frameID)
-{
-    WebPageProxy* page = m_process->webPage(pageID);
-    if (!page)
-        return;
-
-    if (sourceURLString.isEmpty() || destinationURLString.isEmpty())
-        return;
-    
-    WebFrameProxy* frame = m_process->webFrame(frameID);
-    MESSAGE_CHECK(frame);
-    MESSAGE_CHECK(frame->page() == page);
-    MESSAGE_CHECK_URL(sourceURLString);
-    MESSAGE_CHECK_URL(destinationURLString);
-
-    m_historyClient.didPerformClientRedirect(this, page, sourceURLString, destinationURLString, frame);
-}
-
-void WebContext::didPerformServerRedirect(uint64_t pageID, const String& sourceURLString, const String& destinationURLString, uint64_t frameID)
-{
-    WebPageProxy* page = m_process->webPage(pageID);
-    if (!page)
-        return;
-    
-    if (sourceURLString.isEmpty() || destinationURLString.isEmpty())
-        return;
-    
-    WebFrameProxy* frame = m_process->webFrame(frameID);
-    MESSAGE_CHECK(frame);
-    MESSAGE_CHECK(frame->page() == page);
-    MESSAGE_CHECK_URL(sourceURLString);
-    MESSAGE_CHECK_URL(destinationURLString);
-
-    m_historyClient.didPerformServerRedirect(this, page, sourceURLString, destinationURLString, frame);
-}
-
-void WebContext::didUpdateHistoryTitle(uint64_t pageID, const String& title, const String& url, uint64_t frameID)
-{
-    WebPageProxy* page = m_process->webPage(pageID);
-    if (!page)
-        return;
-
-    WebFrameProxy* frame = m_process->webFrame(frameID);
-    MESSAGE_CHECK(frame);
-    MESSAGE_CHECK(frame->page() == page);
-    MESSAGE_CHECK_URL(url);
-
-    m_historyClient.didUpdateHistoryTitle(this, page, title, url, frame);
-}
-
 void WebContext::populateVisitedLinks()
 {
     m_historyClient.populateVisitedLinks(this);
@@ -765,91 +683,91 @@ HashSet<String, CaseFoldingHash> WebContext::pdfAndPostScriptMIMETypes()
     return mimeTypes;
 }
 
-void WebContext::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+void WebContext::didReceiveMessage(WebProcessProxy* process, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
     if (messageID.is<CoreIPC::MessageClassWebContext>()) {
-        didReceiveWebContextMessage(connection, messageID, arguments);
+        didReceiveWebContextMessage(process->connection(), messageID, arguments);
         return;
     }
 
     if (messageID.is<CoreIPC::MessageClassDownloadProxy>()) {
         if (DownloadProxy* downloadProxy = m_downloads.get(arguments->destinationID()).get())
-            downloadProxy->didReceiveDownloadProxyMessage(connection, messageID, arguments);
+            downloadProxy->didReceiveDownloadProxyMessage(process->connection(), messageID, arguments);
         
         return;
     }
 
     if (messageID.is<CoreIPC::MessageClassWebApplicationCacheManagerProxy>()) {
-        m_applicationCacheManagerProxy->didReceiveMessage(connection, messageID, arguments);
+        m_applicationCacheManagerProxy->didReceiveMessage(process->connection(), messageID, arguments);
         return;
     }
 
 #if ENABLE(BATTERY_STATUS)
     if (messageID.is<CoreIPC::MessageClassWebBatteryManagerProxy>()) {
-        m_batteryManagerProxy->didReceiveMessage(connection, messageID, arguments);
+        m_batteryManagerProxy->didReceiveMessage(process->connection(), messageID, arguments);
         return;
     }
 #endif
 
     if (messageID.is<CoreIPC::MessageClassWebCookieManagerProxy>()) {
-        m_cookieManagerProxy->didReceiveMessage(connection, messageID, arguments);
+        m_cookieManagerProxy->didReceiveMessage(process->connection(), messageID, arguments);
         return;
     }
 
 #if ENABLE(SQL_DATABASE)
     if (messageID.is<CoreIPC::MessageClassWebDatabaseManagerProxy>()) {
-        m_databaseManagerProxy->didReceiveWebDatabaseManagerProxyMessage(connection, messageID, arguments);
+        m_databaseManagerProxy->didReceiveWebDatabaseManagerProxyMessage(process->connection(), messageID, arguments);
         return;
     }
 #endif
 
     if (messageID.is<CoreIPC::MessageClassWebGeolocationManagerProxy>()) {
-        m_geolocationManagerProxy->didReceiveMessage(connection, messageID, arguments);
+        m_geolocationManagerProxy->didReceiveMessage(process->connection(), messageID, arguments);
         return;
     }
     
     if (messageID.is<CoreIPC::MessageClassWebIconDatabase>()) {
-        m_iconDatabase->didReceiveMessage(connection, messageID, arguments);
+        m_iconDatabase->didReceiveMessage(process->connection(), messageID, arguments);
         return;
     }
 
     if (messageID.is<CoreIPC::MessageClassWebKeyValueStorageManagerProxy>()) {
-        m_keyValueStorageManagerProxy->didReceiveMessage(connection, messageID, arguments);
+        m_keyValueStorageManagerProxy->didReceiveMessage(process->connection(), messageID, arguments);
         return;
     }
 
     if (messageID.is<CoreIPC::MessageClassWebMediaCacheManagerProxy>()) {
-        m_mediaCacheManagerProxy->didReceiveMessage(connection, messageID, arguments);
+        m_mediaCacheManagerProxy->didReceiveMessage(process->connection(), messageID, arguments);
         return;
     }
 
 #if ENABLE(NETWORK_INFO)
     if (messageID.is<CoreIPC::MessageClassWebNetworkInfoManagerProxy>()) {
-        m_networkInfoManagerProxy->didReceiveMessage(connection, messageID, arguments);
+        m_networkInfoManagerProxy->didReceiveMessage(process->connection(), messageID, arguments);
         return;
     }
 #endif
     
     if (messageID.is<CoreIPC::MessageClassWebNotificationManagerProxy>()) {
-        m_notificationManagerProxy->didReceiveMessage(connection, messageID, arguments);
+        m_notificationManagerProxy->didReceiveMessage(process->connection(), messageID, arguments);
         return;
     }
 
     if (messageID.is<CoreIPC::MessageClassWebResourceCacheManagerProxy>()) {
-        m_resourceCacheManagerProxy->didReceiveWebResourceCacheManagerProxyMessage(connection, messageID, arguments);
+        m_resourceCacheManagerProxy->didReceiveWebResourceCacheManagerProxyMessage(process->connection(), messageID, arguments);
         return;
     }
 
 #if USE(SOUP)
     if (messageID.is<CoreIPC::MessageClassWebSoupRequestManagerProxy>()) {
-        m_soupRequestManagerProxy->didReceiveMessage(connection, messageID, arguments);
+        m_soupRequestManagerProxy->didReceiveMessage(process->connection(), messageID, arguments);
         return;
     }
 #endif
 
 #if ENABLE(VIBRATION)
     if (messageID.is<CoreIPC::MessageClassWebVibrationProxy>()) {
-        m_vibrationProxy->didReceiveMessage(connection, messageID, arguments);
+        m_vibrationProxy->didReceiveMessage(process->connection(), messageID, arguments);
         return;
     }
 #endif
@@ -858,7 +776,7 @@ void WebContext::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         case WebContextLegacyMessage::PostMessage: {
             String messageName;
             RefPtr<APIObject> messageBody;
-            WebContextUserMessageDecoder messageDecoder(messageBody, this);
+            WebContextUserMessageDecoder messageDecoder(messageBody, process);
             if (!arguments->decode(CoreIPC::Out(messageName, messageDecoder)))
                 return;
 
@@ -872,27 +790,27 @@ void WebContext::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
     ASSERT_NOT_REACHED();
 }
 
-void WebContext::didReceiveSyncMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments, OwnPtr<CoreIPC::ArgumentEncoder>& reply)
+void WebContext::didReceiveSyncMessage(WebProcessProxy* process, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments, OwnPtr<CoreIPC::ArgumentEncoder>& reply)
 {
     if (messageID.is<CoreIPC::MessageClassWebContext>()) {
-        didReceiveSyncWebContextMessage(connection, messageID, arguments, reply);
+        didReceiveSyncWebContextMessage(process->connection(), messageID, arguments, reply);
         return;
     }
 
     if (messageID.is<CoreIPC::MessageClassDownloadProxy>()) {
         if (DownloadProxy* downloadProxy = m_downloads.get(arguments->destinationID()).get())
-            downloadProxy->didReceiveSyncDownloadProxyMessage(connection, messageID, arguments, reply);
+            downloadProxy->didReceiveSyncDownloadProxyMessage(process->connection(), messageID, arguments, reply);
         return;
     }
     
     if (messageID.is<CoreIPC::MessageClassWebIconDatabase>()) {
-        m_iconDatabase->didReceiveSyncMessage(connection, messageID, arguments, reply);
+        m_iconDatabase->didReceiveSyncMessage(process->connection(), messageID, arguments, reply);
         return;
     }
 
 #if ENABLE(NETWORK_INFO)
     if (messageID.is<CoreIPC::MessageClassWebNetworkInfoManagerProxy>()) {
-        m_networkInfoManagerProxy->didReceiveSyncMessage(connection, messageID, arguments, reply);
+        m_networkInfoManagerProxy->didReceiveSyncMessage(process->connection(), messageID, arguments, reply);
         return;
     }
 #endif
@@ -903,7 +821,7 @@ void WebContext::didReceiveSyncMessage(CoreIPC::Connection* connection, CoreIPC:
 
             String messageName;
             RefPtr<APIObject> messageBody;
-            WebContextUserMessageDecoder messageDecoder(messageBody, this);
+            WebContextUserMessageDecoder messageDecoder(messageBody, process);
             if (!arguments->decode(CoreIPC::Out(messageName, messageDecoder)))
                 return;
 
diff --git a/Source/WebKit2/UIProcess/WebContext.h b/Source/WebKit2/UIProcess/WebContext.h
index 6b6d97e0f..aef8af977 100644
--- a/Source/WebKit2/UIProcess/WebContext.h
+++ b/Source/WebKit2/UIProcess/WebContext.h
@@ -79,9 +79,6 @@ class WebContext : public APIObject, private CoreIPC::Connection::QueueClient {
 public:
     static const Type APIType = TypeContext;
 
-    static WebContext* sharedProcessContext();
-    static WebContext* sharedThreadContext();
-
     static PassRefPtr<WebContext> create(const String& injectedBundlePath);
     virtual ~WebContext();
 
@@ -136,8 +133,8 @@ public:
     void addVisitedLink(const String&);
     void addVisitedLinkHash(WebCore::LinkHash);
 
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
-    void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, OwnPtr<CoreIPC::ArgumentEncoder>&);
+    void didReceiveMessage(WebProcessProxy*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    void didReceiveSyncMessage(WebProcessProxy*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, OwnPtr<CoreIPC::ArgumentEncoder>&);
 
     void setCacheModel(CacheModel);
     CacheModel cacheModel() const { return m_cacheModel; }
@@ -160,6 +157,8 @@ public:
     WebDownloadClient& downloadClient() { return m_downloadClient; }
     void downloadFinished(DownloadProxy*);
 
+    WebHistoryClient& historyClient() { return m_historyClient; }
+
     static HashSet<String, CaseFoldingHash> pdfAndPostScriptMIMETypes();
 
     WebApplicationCacheManagerProxy* applicationCacheManagerProxy() const { return m_applicationCacheManagerProxy.get(); }
@@ -229,12 +228,6 @@ private:
     void platformInitializeWebProcess(WebProcessCreationParameters&);
     void platformInvalidateContext();
     
-    // History client
-    void didNavigateWithNavigationData(uint64_t pageID, const WebNavigationDataStore& store, uint64_t frameID);
-    void didPerformClientRedirect(uint64_t pageID, const String& sourceURLString, const String& destinationURLString, uint64_t frameID);
-    void didPerformServerRedirect(uint64_t pageID, const String& sourceURLString, const String& destinationURLString, uint64_t frameID);
-    void didUpdateHistoryTitle(uint64_t pageID, const String& title, const String& url, uint64_t frameID);
-
     // Plugins
     void getPlugins(CoreIPC::Connection*, uint64_t requestID, bool refresh);
     void getPluginPath(const String& mimeType, const String& urlString, String& pluginPath, bool& blocked);
diff --git a/Source/WebKit2/UIProcess/WebContext.messages.in b/Source/WebKit2/UIProcess/WebContext.messages.in
index 955017293..64f598cef 100644
--- a/Source/WebKit2/UIProcess/WebContext.messages.in
+++ b/Source/WebKit2/UIProcess/WebContext.messages.in
@@ -22,12 +22,6 @@
 
 messages -> WebContext {
 
-    # History client messages.
-    DidNavigateWithNavigationData(uint64_t pageID, WebKit::WebNavigationDataStore store, uint64_t frameID)
-    DidPerformClientRedirect(uint64_t pageID, WTF::String sourceURLString, WTF::String destinationURLString, uint64_t frameID)
-    DidPerformServerRedirect(uint64_t pageID, WTF::String sourceURLString, WTF::String destinationURLString, uint64_t frameID)
-    DidUpdateHistoryTitle(uint64_t pageID, WTF::String title, WTF::String url, uint64_t frameID)
-
     # Visited link provider messages.
     AddVisitedLinkHash(uint64_t linkHash)
     
diff --git a/Source/WebKit2/UIProcess/WebContextUserMessageCoders.h b/Source/WebKit2/UIProcess/WebContextUserMessageCoders.h
index bb2ba39a1..5693751e0 100644
--- a/Source/WebKit2/UIProcess/WebContextUserMessageCoders.h
+++ b/Source/WebKit2/UIProcess/WebContextUserMessageCoders.h
@@ -84,15 +84,15 @@ class WebContextUserMessageDecoder : public UserMessageDecoder<WebContextUserMes
 public:
     typedef UserMessageDecoder<WebContextUserMessageDecoder> Base;
 
-    WebContextUserMessageDecoder(RefPtr<APIObject>& root, WebContext* context)
+    WebContextUserMessageDecoder(RefPtr<APIObject>& root, WebProcessProxy* process)
         : Base(root)
-        , m_context(context)
+        , m_process(process)
     {
     }
 
     WebContextUserMessageDecoder(WebContextUserMessageDecoder& userMessageDecoder, RefPtr<APIObject>& root)
         : Base(root)
-        , m_context(userMessageDecoder.m_context)
+        , m_process(userMessageDecoder.m_process)
     {
     }
 
@@ -110,14 +110,14 @@ public:
             uint64_t pageID;
             if (!decoder->decode(pageID))
                 return false;
-            coder.m_root = coder.m_context->process()->webPage(pageID);
+            coder.m_root = coder.m_process->webPage(pageID);
             break;
         }
         case APIObject::TypeBundleFrame: {
             uint64_t frameID;
             if (!decoder->decode(frameID))
                 return false;
-            coder.m_root = coder.m_context->process()->webFrame(frameID);
+            coder.m_root = coder.m_process->webFrame(frameID);
             break;
         }
         case APIObject::TypeBundlePageGroup: {
@@ -135,7 +135,7 @@ public:
     }
 
 private:
-    WebContext* m_context;
+    WebProcessProxy* m_process;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebInspectorProxy.cpp b/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
index 3c5c38005..52c0b74a6 100644
--- a/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
@@ -50,6 +50,14 @@ using namespace WebCore;
 
 namespace WebKit {
 
+const unsigned WebInspectorProxy::minimumWindowWidth = 500;
+const unsigned WebInspectorProxy::minimumWindowHeight = 400;
+
+const unsigned WebInspectorProxy::initialWindowWidth = 750;
+const unsigned WebInspectorProxy::initialWindowHeight = 650;
+
+const unsigned WebInspectorProxy::minimumAttachedHeight = 250;
+
 static PassRefPtr<WebPageGroup> createInspectorPageGroup()
 {
     RefPtr<WebPageGroup> pageGroup = WebPageGroup::create("__WebInspectorPageGroup__", false, false);
diff --git a/Source/WebKit2/UIProcess/WebInspectorProxy.h b/Source/WebKit2/UIProcess/WebInspectorProxy.h
index 5a73a5e8c..1f53cccf0 100644
--- a/Source/WebKit2/UIProcess/WebInspectorProxy.h
+++ b/Source/WebKit2/UIProcess/WebInspectorProxy.h
@@ -193,14 +193,14 @@ private:
     void createInspectorWindow();
 #endif
 
-    static const unsigned minimumWindowWidth = 500;
-    static const unsigned minimumWindowHeight = 400;
+    static const unsigned minimumWindowWidth;
+    static const unsigned minimumWindowHeight;
 
-    static const unsigned initialWindowWidth = 750;
-    static const unsigned initialWindowHeight = 650;
+    static const unsigned initialWindowWidth;
+    static const unsigned initialWindowHeight;
 
     // Keep this in sync with the value in InspectorFrontendClientLocal.
-    static const unsigned minimumAttachedHeight = 250;
+    static const unsigned minimumAttachedHeight;
 
     WebPageProxy* m_page;
 
diff --git a/Source/WebKit2/Shared/WebIntentData.cpp b/Source/WebKit2/UIProcess/WebIntentData.cpp
index 96128dbe2..96128dbe2 100644
--- a/Source/WebKit2/Shared/WebIntentData.cpp
+++ b/Source/WebKit2/UIProcess/WebIntentData.cpp
diff --git a/Source/WebKit2/Shared/WebIntentData.h b/Source/WebKit2/UIProcess/WebIntentData.h
index decf4ae4f..decf4ae4f 100644
--- a/Source/WebKit2/Shared/WebIntentData.h
+++ b/Source/WebKit2/UIProcess/WebIntentData.h
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.cpp b/Source/WebKit2/UIProcess/WebPageProxy.cpp
index 6cf260a36..9c4df8eea 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebPageProxy.cpp
@@ -82,6 +82,7 @@
 #include <WebCore/FloatRect.h>
 #include <WebCore/FocusDirection.h>
 #include <WebCore/MIMETypeRegistry.h>
+#include <WebCore/RenderEmbeddedObject.h>
 #include <WebCore/TextCheckerClient.h>
 #include <WebCore/WindowFeatures.h>
 #include <stdio.h>
@@ -93,7 +94,7 @@
 #include "WebIntentServiceInfo.h"
 #endif
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 #include "LayerTreeCoordinatorProxyMessages.h"
 #endif
 
@@ -671,7 +672,7 @@ void WebPageProxy::shouldGoToBackForwardListItem(uint64_t itemID, bool& shouldGo
 void WebPageProxy::willGoToBackForwardListItem(uint64_t itemID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1655,6 +1656,21 @@ void WebPageProxy::getContentsAsString(PassRefPtr<StringCallback> prpCallback)
     process()->send(Messages::WebPage::GetContentsAsString(callbackID), m_pageID);
 }
 
+#if ENABLE(MHTML)
+void WebPageProxy::getContentsAsMHTMLData(PassRefPtr<DataCallback> prpCallback, bool useBinaryEncoding)
+{
+    RefPtr<DataCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+
+    uint64_t callbackID = callback->callbackID();
+    m_dataCallbacks.set(callbackID, callback.get());
+    process()->send(Messages::WebPage::GetContentsAsMHTMLData(callbackID, useBinaryEncoding), m_pageID);
+}
+#endif
+
 void WebPageProxy::getSelectionOrContentsAsString(PassRefPtr<StringCallback> prpCallback)
 {
     RefPtr<StringCallback> callback = prpCallback;
@@ -1746,7 +1762,7 @@ void WebPageProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::M
         return;
     }
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
     if (messageID.is<CoreIPC::MessageClassLayerTreeCoordinatorProxy>()) {
         m_drawingArea->didReceiveLayerTreeCoordinatorProxyMessage(connection, messageID, arguments);
         return;
@@ -1897,7 +1913,7 @@ void WebPageProxy::didFinishProgress()
 void WebPageProxy::registerIntentServiceForFrame(uint64_t frameID, const IntentServiceInfo& serviceInfo, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1914,7 +1930,7 @@ void WebPageProxy::didStartProvisionalLoadForFrame(uint64_t frameID, const Strin
     clearPendingAPIRequestURL();
 
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1931,7 +1947,7 @@ void WebPageProxy::didStartProvisionalLoadForFrame(uint64_t frameID, const Strin
 void WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame(uint64_t frameID, const String& url, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1947,7 +1963,7 @@ void WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame(uint64_t f
 void WebPageProxy::didFailProvisionalLoadForFrame(uint64_t frameID, const ResourceError& error, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1975,7 +1991,7 @@ void WebPageProxy::clearLoadDependentCallbacks()
 void WebPageProxy::didCommitLoadForFrame(uint64_t frameID, const String& mimeType, bool frameHasCustomRepresentation, const PlatformCertificateInfo& certificateInfo, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2015,7 +2031,7 @@ void WebPageProxy::didCommitLoadForFrame(uint64_t frameID, const String& mimeTyp
 void WebPageProxy::didFinishDocumentLoadForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2028,7 +2044,7 @@ void WebPageProxy::didFinishDocumentLoadForFrame(uint64_t frameID, CoreIPC::Argu
 void WebPageProxy::didFinishLoadForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2043,7 +2059,7 @@ void WebPageProxy::didFinishLoadForFrame(uint64_t frameID, CoreIPC::ArgumentDeco
 void WebPageProxy::didFailLoadForFrame(uint64_t frameID, const ResourceError& error, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2060,7 +2076,7 @@ void WebPageProxy::didFailLoadForFrame(uint64_t frameID, const ResourceError& er
 void WebPageProxy::didSameDocumentNavigationForFrame(uint64_t frameID, uint32_t opaqueSameDocumentNavigationType, const String& url, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2077,7 +2093,7 @@ void WebPageProxy::didSameDocumentNavigationForFrame(uint64_t frameID, uint32_t
 void WebPageProxy::didReceiveTitleForFrame(uint64_t frameID, const String& title, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2092,7 +2108,7 @@ void WebPageProxy::didReceiveTitleForFrame(uint64_t frameID, const String& title
 void WebPageProxy::didFirstLayoutForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2105,7 +2121,7 @@ void WebPageProxy::didFirstLayoutForFrame(uint64_t frameID, CoreIPC::ArgumentDec
 void WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2118,7 +2134,7 @@ void WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame(uint64_t frameID, Core
 void WebPageProxy::didNewFirstVisuallyNonEmptyLayout(CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2128,7 +2144,7 @@ void WebPageProxy::didNewFirstVisuallyNonEmptyLayout(CoreIPC::ArgumentDecoder* a
 void WebPageProxy::didRemoveFrameFromHierarchy(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2143,7 +2159,7 @@ void WebPageProxy::didRemoveFrameFromHierarchy(uint64_t frameID, CoreIPC::Argume
 void WebPageProxy::didDisplayInsecureContentForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2156,7 +2172,7 @@ void WebPageProxy::didDisplayInsecureContentForFrame(uint64_t frameID, CoreIPC::
 void WebPageProxy::didRunInsecureContentForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2169,7 +2185,7 @@ void WebPageProxy::didRunInsecureContentForFrame(uint64_t frameID, CoreIPC::Argu
 void WebPageProxy::didDetectXSSForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2183,7 +2199,7 @@ void WebPageProxy::didDetectXSSForFrame(uint64_t frameID, CoreIPC::ArgumentDecod
 void WebPageProxy::didReceiveIntentForFrame(uint64_t frameID, const IntentData& intentData, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2209,7 +2225,7 @@ void WebPageProxy::frameDidBecomeFrameSet(uint64_t frameID, bool value)
 void WebPageProxy::decidePolicyForNavigationAction(uint64_t frameID, uint32_t opaqueNavigationType, uint32_t opaqueModifiers, int32_t opaqueMouseButton, const ResourceRequest& request, uint64_t listenerID, CoreIPC::ArgumentDecoder* arguments, bool& receivedPolicyAction, uint64_t& policyAction, uint64_t& downloadID)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2247,7 +2263,7 @@ void WebPageProxy::decidePolicyForNavigationAction(uint64_t frameID, uint32_t op
 void WebPageProxy::decidePolicyForNewWindowAction(uint64_t frameID, uint32_t opaqueNavigationType, uint32_t opaqueModifiers, int32_t opaqueMouseButton, const ResourceRequest& request, const String& frameName, uint64_t listenerID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2267,7 +2283,7 @@ void WebPageProxy::decidePolicyForNewWindowAction(uint64_t frameID, uint32_t opa
 void WebPageProxy::decidePolicyForResponse(uint64_t frameID, const ResourceResponse& response, const ResourceRequest& request, uint64_t listenerID, CoreIPC::ArgumentDecoder* arguments, bool& receivedPolicyAction, uint64_t& policyAction, uint64_t& downloadID)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2299,7 +2315,7 @@ void WebPageProxy::decidePolicyForResponse(uint64_t frameID, const ResourceRespo
 void WebPageProxy::unableToImplementPolicy(uint64_t frameID, const ResourceError& error, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
     
@@ -2314,7 +2330,7 @@ void WebPageProxy::unableToImplementPolicy(uint64_t frameID, const ResourceError
 void WebPageProxy::willSubmitForm(uint64_t frameID, uint64_t sourceFrameID, const StringPairVector& textFieldValues, uint64_t listenerID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2457,7 +2473,7 @@ void WebPageProxy::setStatusText(const String& text)
 void WebPageProxy::mouseDidMoveOverElement(const WebHitTestResult::Data& hitTestResultData, uint32_t opaqueModifiers, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2471,7 +2487,22 @@ void WebPageProxy::unavailablePluginButtonClicked(uint32_t opaquePluginUnavailab
     MESSAGE_CHECK_URL(url);
     MESSAGE_CHECK_URL(pluginsPageURL);
 
-    WKPluginUnavailabilityReason pluginUnavailabilityReason = static_cast<WKPluginUnavailabilityReason>(opaquePluginUnavailabilityReason);
+    WKPluginUnavailabilityReason pluginUnavailabilityReason = kWKPluginUnavailabilityReasonPluginMissing;
+    switch (static_cast<RenderEmbeddedObject::PluginUnavailabilityReason>(opaquePluginUnavailabilityReason)) {
+    case RenderEmbeddedObject::PluginMissing:
+        pluginUnavailabilityReason = kWKPluginUnavailabilityReasonPluginMissing;
+        break;
+    case RenderEmbeddedObject::InsecurePluginVersion:
+        pluginUnavailabilityReason = kWKPluginUnavailabilityReasonInsecurePluginVersion;
+        break;
+    case RenderEmbeddedObject::PluginCrashed:
+        pluginUnavailabilityReason = kWKPluginUnavailabilityReasonPluginCrashed;
+        break;
+
+    case RenderEmbeddedObject::PluginBlockedByContentSecurityPolicy:
+        ASSERT_NOT_REACHED();
+    }
+
     m_uiClient.unavailablePluginButtonClicked(this, pluginUnavailabilityReason, mimeType, url, pluginsPageURL);
 }
 
@@ -2619,11 +2650,6 @@ void WebPageProxy::setMediaVolume(float volume)
 }
 
 #if PLATFORM(QT)
-void WebPageProxy::didChangeContentsSize(const IntSize& size)
-{
-    m_pageClient->didChangeContentsSize(size);
-}
-
 void WebPageProxy::didFindZoomableArea(const IntPoint& target, const IntRect& area)
 {
     m_pageClient->didFindZoomableArea(target, area);
@@ -2665,6 +2691,13 @@ void WebPageProxy::handleDownloadRequest(DownloadProxy* download)
 }
 #endif // PLATFORM(QT) || PLATFORM(EFL)
 
+#if PLATFORM(QT) || PLATFORM(EFL)
+void WebPageProxy::didChangeContentsSize(const IntSize& size)
+{
+    m_pageClient->didChangeContentsSize(size);
+}
+#endif
+
 #if ENABLE(TOUCH_EVENTS)
 void WebPageProxy::needTouchEvents(bool needTouchEvents)
 {
@@ -2907,7 +2940,7 @@ void WebPageProxy::showContextMenu(const IntPoint& menuLocation, const WebHitTes
 void WebPageProxy::internalShowContextMenu(const IntPoint& menuLocation, const WebHitTestResult::Data& hitTestResultData, const Vector<WebContextMenuItemData>& proposedItems, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process.get());
     if (!arguments->decode(messageDecoder))
         return;
 
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.h b/Source/WebKit2/UIProcess/WebPageProxy.h
index 5633ce750..b88a5d498 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.h
+++ b/Source/WebKit2/UIProcess/WebPageProxy.h
@@ -528,6 +528,9 @@ public:
 #endif
 
     void getContentsAsString(PassRefPtr<StringCallback>);
+#if ENABLE(MHTML)
+    void getContentsAsMHTMLData(PassRefPtr<DataCallback>, bool useBinaryEncoding);
+#endif
     void getMainResourceDataOfFrame(WebFrameProxy*, PassRefPtr<DataCallback>);
     void getResourceDataFromFrame(WebFrameProxy*, WebURL*, PassRefPtr<DataCallback>);
     void getRenderTreeExternalRepresentation(PassRefPtr<StringCallback>);
@@ -831,9 +834,13 @@ private:
 #endif
 
 #if PLATFORM(QT)
-    void didChangeContentsSize(const WebCore::IntSize&);
     void didFindZoomableArea(const WebCore::IntPoint&, const WebCore::IntRect&);
 #endif
+
+#if PLATFORM(QT) || PLATFORM(EFL)
+    void didChangeContentsSize(const WebCore::IntSize&);
+#endif
+
 #if ENABLE(TOUCH_EVENTS)
     void needTouchEvents(bool);
 #endif
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.messages.in b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
index 376904701..7fa81be5a 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
@@ -73,12 +73,16 @@ messages -> WebPageProxy {
     PageDidRequestScroll(WebCore::IntPoint point)
 #endif
 #if PLATFORM(QT)
-    DidChangeContentsSize(WebCore::IntSize newSize)
     DidFindZoomableArea(WebCore::IntPoint target, WebCore::IntRect area)
     AuthenticationRequiredRequest(WTF::String hostname, WTF::String realm, WTF::String prefilledUsername) -> (WTF::String username, WTF::String password)
     CertificateVerificationRequest(WTF::String hostname) -> (bool ignoreErrors)
     ProxyAuthenticationRequiredRequest(WTF::String hostname, uint16_t port, WTF::String prefilledUsername) -> (WTF::String username, WTF::String password)
 #endif
+
+#if PLATFORM(QT) || PLATFORM(EFL)
+    DidChangeContentsSize(WebCore::IntSize newSize)
+#endif
+
 #if ENABLE(TOUCH_EVENTS)
     NeedTouchEvents(bool needTouchEvents)
 #endif
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.cpp b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
index e3cdc8809..d90355c4e 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
@@ -46,6 +46,7 @@
 using namespace WebCore;
 using namespace std;
 
+#define MESSAGE_CHECK(assertion) MESSAGE_CHECK_BASE(assertion, connection())
 #define MESSAGE_CHECK_URL(url) MESSAGE_CHECK_BASE(checkURLReceivedFromWebProcess(url), connection())
 
 namespace WebKit {
@@ -87,36 +88,30 @@ WebProcessProxy::~WebProcessProxy()
         m_processLauncher->invalidate();
         m_processLauncher = 0;
     }
-
-    if (m_threadLauncher) {
-        m_threadLauncher->invalidate();
-        m_threadLauncher = 0;
-    }
 }
 
 void WebProcessProxy::connect()
 {
-    if (m_context->processModel() == ProcessModelSharedSecondaryThread) {
-        ASSERT(!m_threadLauncher);
-        m_threadLauncher = ThreadLauncher::create(this);
-    } else {
-        ASSERT(!m_processLauncher);
+    ASSERT(!m_processLauncher);
 
-        ProcessLauncher::LaunchOptions launchOptions;
-        launchOptions.processType = ProcessLauncher::WebProcess;
+    ProcessLauncher::LaunchOptions launchOptions;
+    launchOptions.processType = ProcessLauncher::WebProcess;
 
 #if PLATFORM(MAC)
-        // We want the web process to match the architecture of the UI process.
-        launchOptions.architecture = ProcessLauncher::LaunchOptions::MatchCurrentArchitecture;
-        launchOptions.executableHeap = false;
+    // We want the web process to match the architecture of the UI process.
+    launchOptions.architecture = ProcessLauncher::LaunchOptions::MatchCurrentArchitecture;
+    launchOptions.executableHeap = false;
+#if HAVE(XPC)
+    launchOptions.useXPC = getenv("WEBKIT_USE_XPC_SERVICE_FOR_WEB_PROCESS");
+#endif
 #endif
 #ifndef NDEBUG
-        const char* webProcessCmdPrefix = getenv("WEB_PROCESS_CMD_PREFIX");
-        if (webProcessCmdPrefix && *webProcessCmdPrefix)
-            launchOptions.processCmdPrefix = String::fromUTF8(webProcessCmdPrefix);
+    const char* webProcessCmdPrefix = getenv("WEB_PROCESS_CMD_PREFIX");
+    if (webProcessCmdPrefix && *webProcessCmdPrefix)
+        launchOptions.processCmdPrefix = String::fromUTF8(webProcessCmdPrefix);
 #endif
-        m_processLauncher = ProcessLauncher::create(this, launchOptions);
-    }
+
+    m_processLauncher = ProcessLauncher::create(this, launchOptions);
 }
 
 void WebProcessProxy::disconnect()
@@ -159,8 +154,6 @@ bool WebProcessProxy::isLaunching() const
 {
     if (m_processLauncher)
         return m_processLauncher->isLaunching();
-    if (m_threadLauncher)
-        return m_threadLauncher->isLaunching();
 
     return false;
 }
@@ -332,7 +325,7 @@ void WebProcessProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC
         || messageID.is<CoreIPC::MessageClassWebVibrationProxy>()
 #endif
         || messageID.is<CoreIPC::MessageClassWebResourceCacheManagerProxy>()) {
-        m_context->didReceiveMessage(connection, messageID, arguments);
+        m_context->didReceiveMessage(this, messageID, arguments);
         return;
     }
 
@@ -359,7 +352,7 @@ void WebProcessProxy::didReceiveSyncMessage(CoreIPC::Connection* connection, Cor
         || messageID.is<CoreIPC::MessageClassWebNetworkInfoManagerProxy>()
 #endif
         || messageID.is<CoreIPC::MessageClassDownloadProxy>() || messageID.is<CoreIPC::MessageClassWebIconDatabase>()) {
-        m_context->didReceiveSyncMessage(connection, messageID, arguments, reply);
+        m_context->didReceiveSyncMessage(this, messageID, arguments, reply);
         return;
     }
 
@@ -436,11 +429,6 @@ void WebProcessProxy::didFinishLaunching(ProcessLauncher*, CoreIPC::Connection::
     didFinishLaunching(connectionIdentifier);
 }
 
-void WebProcessProxy::didFinishLaunching(ThreadLauncher*, CoreIPC::Connection::Identifier connectionIdentifier)
-{
-    didFinishLaunching(connectionIdentifier);
-}
-
 void WebProcessProxy::didFinishLaunching(CoreIPC::Connection::Identifier connectionIdentifier)
 {
     ASSERT(!m_connection);
@@ -527,4 +515,67 @@ void WebProcessProxy::updateTextCheckerState()
     send(Messages::WebProcess::SetTextCheckerState(TextChecker::state()), 0);
 }
 
+void WebProcessProxy::didNavigateWithNavigationData(uint64_t pageID, const WebNavigationDataStore& store, uint64_t frameID) 
+{
+    WebPageProxy* page = webPage(pageID);
+    if (!page)
+        return;
+    
+    WebFrameProxy* frame = webFrame(frameID);
+    MESSAGE_CHECK(frame);
+    MESSAGE_CHECK(frame->page() == page);
+    
+    m_context->historyClient().didNavigateWithNavigationData(m_context.get(), page, store, frame);
+}
+
+void WebProcessProxy::didPerformClientRedirect(uint64_t pageID, const String& sourceURLString, const String& destinationURLString, uint64_t frameID)
+{
+    WebPageProxy* page = webPage(pageID);
+    if (!page)
+        return;
+
+    if (sourceURLString.isEmpty() || destinationURLString.isEmpty())
+        return;
+    
+    WebFrameProxy* frame = webFrame(frameID);
+    MESSAGE_CHECK(frame);
+    MESSAGE_CHECK(frame->page() == page);
+    MESSAGE_CHECK_URL(sourceURLString);
+    MESSAGE_CHECK_URL(destinationURLString);
+
+    m_context->historyClient().didPerformClientRedirect(m_context.get(), page, sourceURLString, destinationURLString, frame);
+}
+
+void WebProcessProxy::didPerformServerRedirect(uint64_t pageID, const String& sourceURLString, const String& destinationURLString, uint64_t frameID)
+{
+    WebPageProxy* page = webPage(pageID);
+    if (!page)
+        return;
+    
+    if (sourceURLString.isEmpty() || destinationURLString.isEmpty())
+        return;
+    
+    WebFrameProxy* frame = webFrame(frameID);
+    MESSAGE_CHECK(frame);
+    MESSAGE_CHECK(frame->page() == page);
+    MESSAGE_CHECK_URL(sourceURLString);
+    MESSAGE_CHECK_URL(destinationURLString);
+
+    m_context->historyClient().didPerformServerRedirect(m_context.get(), page, sourceURLString, destinationURLString, frame);
+}
+
+void WebProcessProxy::didUpdateHistoryTitle(uint64_t pageID, const String& title, const String& url, uint64_t frameID)
+{
+    WebPageProxy* page = webPage(pageID);
+    if (!page)
+        return;
+
+    WebFrameProxy* frame = webFrame(frameID);
+    MESSAGE_CHECK(frame);
+    MESSAGE_CHECK(frame->page() == page);
+    MESSAGE_CHECK_URL(url);
+
+    m_context->historyClient().didUpdateHistoryTitle(m_context.get(), page, title, url, frame);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.h b/Source/WebKit2/UIProcess/WebProcessProxy.h
index 8e768bfb6..09d861a0e 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.h
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.h
@@ -29,9 +29,7 @@
 #include "PlatformProcessIdentifier.h"
 #include "PluginInfoStore.h"
 #include "ProcessLauncher.h"
-#include "ProcessModel.h"
 #include "ResponsivenessTimer.h"
-#include "ThreadLauncher.h"
 #include "WebConnectionToWebProcess.h"
 #include "WebPageProxy.h"
 #include "WebProcessProxyMessages.h"
@@ -57,7 +55,7 @@ class WebContext;
 class WebPageGroup;
 struct WebNavigationDataStore;
 
-class WebProcessProxy : public RefCounted<WebProcessProxy>, CoreIPC::Connection::Client, ResponsivenessTimer::Client, ProcessLauncher::Client, ThreadLauncher::Client, CoreIPC::Connection::QueueClient {
+class WebProcessProxy : public RefCounted<WebProcessProxy>, CoreIPC::Connection::Client, ResponsivenessTimer::Client, ProcessLauncher::Client,  CoreIPC::Connection::QueueClient {
 public:
     typedef HashMap<uint64_t, RefPtr<WebFrameProxy> > WebFrameProxyMap;
     typedef HashMap<uint64_t, RefPtr<WebBackForwardListItem> > WebBackForwardListItemMap;
@@ -119,7 +117,7 @@ public:
 private:
     explicit WebProcessProxy(PassRefPtr<WebContext>);
 
-    // Initializes the process or thread launcher which will begin launching the process.
+    // Initializes the process launcher which will begin launching the process.
     void connect();
 
     // Called when the web process has crashed or we know that it will terminate soon.
@@ -165,11 +163,14 @@ private:
     // ProcessLauncher::Client
     virtual void didFinishLaunching(ProcessLauncher*, CoreIPC::Connection::Identifier);
 
-    // ThreadLauncher::Client
-    virtual void didFinishLaunching(ThreadLauncher*, CoreIPC::Connection::Identifier);
-
     void didFinishLaunching(CoreIPC::Connection::Identifier);
 
+    // History client
+    void didNavigateWithNavigationData(uint64_t pageID, const WebNavigationDataStore&, uint64_t frameID);
+    void didPerformClientRedirect(uint64_t pageID, const String& sourceURLString, const String& destinationURLString, uint64_t frameID);
+    void didPerformServerRedirect(uint64_t pageID, const String& sourceURLString, const String& destinationURLString, uint64_t frameID);
+    void didUpdateHistoryTitle(uint64_t pageID, const String& title, const String& url, uint64_t frameID);
+
     // Implemented in generated WebProcessProxyMessageReceiver.cpp
     void didReceiveWebProcessProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
     void didReceiveSyncWebProcessProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder* arguments, OwnPtr<CoreIPC::ArgumentEncoder>& reply);
@@ -183,7 +184,6 @@ private:
 
     Vector<std::pair<CoreIPC::Connection::OutgoingMessage, unsigned> > m_pendingMessages;
     RefPtr<ProcessLauncher> m_processLauncher;
-    RefPtr<ThreadLauncher> m_threadLauncher;
 
     RefPtr<WebContext> m_context;
 
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.messages.in b/Source/WebKit2/UIProcess/WebProcessProxy.messages.in
index cd24c741c..84805df32 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.messages.in
@@ -22,13 +22,19 @@
 
 messages -> WebProcessProxy {
 
+    # History client messages.
+    DidNavigateWithNavigationData(uint64_t pageID, WebKit::WebNavigationDataStore store, uint64_t frameID)
+    DidPerformClientRedirect(uint64_t pageID, WTF::String sourceURLString, WTF::String destinationURLString, uint64_t frameID)
+    DidPerformServerRedirect(uint64_t pageID, WTF::String sourceURLString, WTF::String destinationURLString, uint64_t frameID)
+    DidUpdateHistoryTitle(uint64_t pageID, WTF::String title, WTF::String url, uint64_t frameID)
+
     AddBackForwardItem(uint64_t itemID, WTF::String originalURL, WTF::String url, WTF::String title, CoreIPC::DataReference backForwardData)
     DidDestroyFrame(uint64_t frameID) 
 
     ShouldTerminate() -> (bool shouldTerminate)
 
 #if ENABLE(PLUGIN_PROCESS)
-    GetPluginProcessConnection(WTF::String pluginPath) -> (CoreIPC::Attachment connectionHandle) Delayed
+    GetPluginProcessConnection(WTF::String pluginPath) -> (CoreIPC::Attachment connectionHandle, bool supportsAsynchronousInitialization) Delayed
     PluginSyncMessageSendTimedOut(WTF::String pluginPath)
 #endif
 
diff --git a/Source/WebKit2/UIProcess/gtk/WebInspectorProxyGtk.cpp b/Source/WebKit2/UIProcess/gtk/WebInspectorProxyGtk.cpp
index fac19dc8f..4768ffc56 100644
--- a/Source/WebKit2/UIProcess/gtk/WebInspectorProxyGtk.cpp
+++ b/Source/WebKit2/UIProcess/gtk/WebInspectorProxyGtk.cpp
@@ -182,6 +182,11 @@ void WebInspectorProxy::platformAttach()
         m_inspectorWindow = 0;
     }
 
+    // Set a default attached height based on InspectorFrontendClientLocal.
+    static const unsigned defaultAttachedHeight = 300;
+    unsigned maximumAttachedHeight = platformInspectedWindowHeight() * 3 / 4;
+    platformSetAttachedWindowHeight(std::max(minimumAttachedHeight, std::min(defaultAttachedHeight, maximumAttachedHeight)));
+
     if (m_client.attach(this))
         return;
 
diff --git a/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.cpp b/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.cpp
index db94d6f33..a41839a3e 100644
--- a/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.cpp
+++ b/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.cpp
@@ -97,9 +97,9 @@ void WebPopupMenuProxyGtk::showPopupMenu(const IntRect& rect, TextDirection text
     // menu right after calling WebPopupMenuProxy::showPopupMenu().
     m_runLoop = adoptGRef(g_main_loop_new(0, FALSE));
 
-    GDK_THREADS_LEAVE();
+    gdk_threads_leave();
     g_main_loop_run(m_runLoop.get());
-    GDK_THREADS_ENTER();
+    gdk_threads_enter();
 
     m_runLoop.clear();
 
diff --git a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
index 5293c4889..b5fc012c9 100644
--- a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
+++ b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
@@ -144,8 +144,10 @@ static NSRect convertRectToScreen(NSWindow *window, NSRect rect)
 
     // If the page doesn't respond in DefaultWatchdogTimerInterval seconds, it could be because
     // the WebProcess has hung, so exit anyway.
-    if (!_watchdogTimer)
-        _watchdogTimer = adoptNS([NSTimer scheduledTimerWithTimeInterval:DefaultWatchdogTimerInterval target:self selector:@selector(exitFullScreen) userInfo:nil repeats:NO]);
+    if (!_watchdogTimer) {
+        _watchdogTimer = adoptNS([[NSTimer alloc] initWithFireDate:nil interval:DefaultWatchdogTimerInterval target:self selector:@selector(exitFullScreen) userInfo:nil repeats:NO]);
+        [[NSRunLoop mainRunLoop] addTimer:_watchdogTimer.get() forMode:NSDefaultRunLoopMode];
+    }
 }
 
 #pragma mark -
diff --git a/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp b/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp
index 3d4c4e6d6..638715fb1 100644
--- a/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp
@@ -310,16 +310,7 @@ void QtDialogRunner::run()
         return;
 
     connect(context, SIGNAL(dismissed()), SLOT(quit()));
-
-    QQuickWebViewPrivate* webViewPrivate = QQuickWebViewPrivate::get(m_webView);
-
-    // FIXME: Change the way we disable mouse and touch events to use the
-    // concept of suspending instead (in this case event processing).
-    webViewPrivate->disableMouseEvents();
-    webViewPrivate->m_dialogActive = true;
     exec(); // Spin the event loop
-    webViewPrivate->m_dialogActive = false;
-    webViewPrivate->enableMouseEvents();
 }
 
 bool QtDialogRunner::initForAlert(const QString& message)
diff --git a/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp b/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp
index 4c28b93cf..ba9c90a3f 100644
--- a/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp
@@ -47,13 +47,13 @@ bool QtPanGestureRecognizer::update(const QTouchEvent::TouchPoint& touchPoint, q
     switch (m_state) {
     case NoGesture:
         m_state = GestureRecognitionStarted;
-        m_firstScreenPosition = touchPoint.scenePos();
+        m_firstScreenPosition = touchPoint.screenPos();
         viewportHandler()->cancelScrollAnimation();
         return false;
     case GestureRecognitionStarted: {
         // To start the gesture, the delta from start in screen coordinates
         // must be bigger than the trigger threshold.
-        QPointF totalOffsetFromStart(touchPoint.scenePos() - m_firstScreenPosition);
+        QPointF totalOffsetFromStart(touchPoint.screenPos() - m_firstScreenPosition);
         if (qAbs(totalOffsetFromStart.x()) < panningInitialTriggerDistanceThreshold && qAbs(totalOffsetFromStart.y()) < panningInitialTriggerDistanceThreshold)
             return false;
 
diff --git a/Source/WebKit2/UIProcess/qt/QtViewportHandler.cpp b/Source/WebKit2/UIProcess/qt/QtViewportHandler.cpp
index a1f56d189..faff331be 100644
--- a/Source/WebKit2/UIProcess/qt/QtViewportHandler.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtViewportHandler.cpp
@@ -171,6 +171,14 @@ QtViewportHandler::QtViewportHandler(WebKit::WebPageProxy* proxy, QQuickWebView*
     m_scaleAnimation->setDuration(kScaleAnimationDurationMillis);
     m_scaleAnimation->setEasingCurve(QEasingCurve::OutCubic);
 
+    // Initializing Viewport Raw Attributes to avoid random negative scale factors
+    // if there is a race condition between the first layout and setting the viewport attributes for the first time.
+    m_rawAttributes.devicePixelRatio = m_devicePixelRatio;
+    m_rawAttributes.initialScale = 1;
+    m_rawAttributes.minimumScale = m_minimumScale;
+    m_rawAttributes.maximumScale = m_maximumScale;
+    m_rawAttributes.userScalable = m_allowsUserScaling;
+
     connect(m_viewportItem, SIGNAL(movementStarted()), SLOT(flickMoveStarted()), Qt::DirectConnection);
     connect(m_viewportItem, SIGNAL(movementEnded()), SLOT(flickMoveEnded()), Qt::DirectConnection);
 
@@ -694,13 +702,10 @@ void QtViewportHandler::pinchGestureCancelled()
     m_scaleUpdateDeferrer.clear();
 }
 
-QRect QtViewportHandler::visibleContentsRect() const
+QRectF QtViewportHandler::visibleContentsRect() const
 {
     const QRectF visibleRect(m_viewportItem->boundingRect().intersected(m_pageItem->boundingRect()));
-
-    // We avoid using toAlignedRect() because it produces inconsistent width and height.
-    QRectF mappedRect(m_viewportItem->mapRectToWebContent(visibleRect));
-    return QRect(floor(mappedRect.x()), floor(mappedRect.y()), floor(mappedRect.width()), floor(mappedRect.height()));
+    return m_viewportItem->mapRectToWebContent(visibleRect);
 }
 
 void QtViewportHandler::informVisibleContentChange(const QPointF& trajectoryVector)
@@ -709,17 +714,13 @@ void QtViewportHandler::informVisibleContentChange(const QPointF& trajectoryVect
     if (!drawingArea)
         return;
 
-    if (m_lastVisibleContentsRect == visibleContentsRect())
-        return;
-
     qreal scale = m_pageItem->contentsScale();
 
     if (scale != m_lastCommittedScale)
         emit m_viewportItem->experimental()->test()->contentsScaleCommitted();
     m_lastCommittedScale = scale;
-    m_lastVisibleContentsRect = visibleContentsRect();
 
-    drawingArea->setVisibleContentsRect(visibleContentsRect(), scale, trajectoryVector, m_viewportItem->contentPos());
+    drawingArea->setVisibleContentsRect(visibleContentsRect(), scale, trajectoryVector);
 
     // Ensure that updatePaintNode is always called before painting.
     m_pageItem->update();
diff --git a/Source/WebKit2/UIProcess/qt/QtViewportHandler.h b/Source/WebKit2/UIProcess/qt/QtViewportHandler.h
index c93b0bd32..9237fe9f3 100644
--- a/Source/WebKit2/UIProcess/qt/QtViewportHandler.h
+++ b/Source/WebKit2/UIProcess/qt/QtViewportHandler.h
@@ -116,7 +116,7 @@ private:
     void setPageItemRectVisible(const QRectF&);
     void animatePageItemRectVisible(const QRectF&);
 
-    QRect visibleContentsRect() const;
+    QRectF visibleContentsRect() const;
     QRectF initialRect() const;
     QRectF nearestValidBounds() const;
 
@@ -169,7 +169,6 @@ private:
     QPointF m_lastScrollPosition;
     qreal m_pinchStartScale;
     qreal m_lastCommittedScale;
-    QRectF m_lastVisibleContentsRect;
     qreal m_zoomOutScale;
     QList<ScaleStackItem> m_scaleStack;
 };
diff --git a/Source/WebKit2/UIProcess/qt/QtWebContext.cpp b/Source/WebKit2/UIProcess/qt/QtWebContext.cpp
index 8239c5d21..50fa17f66 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebContext.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebContext.cpp
@@ -115,7 +115,7 @@ PassRefPtr<QtWebContext> QtWebContext::defaultContext()
     if (s_defaultContext)
         return PassRefPtr<QtWebContext>(s_defaultContext);
 
-    RefPtr<WebContext> context = WebContext::sharedProcessContext();
+    RefPtr<WebContext> context = WebContext::create(String());
     RefPtr<QtWebContext> defaultContext = QtWebContext::create(context.get());
     s_defaultContext = defaultContext.get();
     // Make sure that this doesn't get called in WebKitTestRunner (defaultContext isn't used there).
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
index d82eba2f9..a02900fcd 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
@@ -31,8 +31,10 @@
 #include <QCursor>
 #include <QDrag>
 #include <QGuiApplication>
+#include <QInputEvent>
 #include <QInputMethod>
 #include <QMimeData>
+#include <QMouseEvent>
 #include <QQuickWindow>
 #include <QStyleHints>
 #include <QTextFormat>
@@ -99,6 +101,7 @@ QtWebPageEventHandler::QtWebPageEventHandler(WKPageRef pageRef, QQuickWebPage* q
     , m_clickCount(0)
     , m_postponeTextInputStateChanged(false)
     , m_isTapHighlightActive(false)
+    , m_isMouseButtonPressed(false)
 {
     connect(qApp->inputMethod(), SIGNAL(visibleChanged()), this, SLOT(inputPanelVisibleChanged()));
 }
@@ -427,7 +430,7 @@ void QtWebPageEventHandler::updateTextInputState()
     if (!m_webView->hasActiveFocus())
         return;
 
-    qApp->inputMethod()->update(Qt::ImQueryInput | Qt::ImEnabled);
+    qApp->inputMethod()->update(Qt::ImQueryInput | Qt::ImEnabled | Qt::ImHints);
 
     setInputPanelVisible(editor.isContentEditable);
 }
@@ -445,23 +448,17 @@ void QtWebPageEventHandler::doneWithGestureEvent(const WebGestureEvent& event, b
     updateTextInputState();
 }
 
-#if ENABLE(TOUCH_EVENTS)
-void QtWebPageEventHandler::doneWithTouchEvent(const NativeWebTouchEvent& event, bool wasEventHandled)
+void QtWebPageEventHandler::handleInputEvent(const QInputEvent* event)
 {
-    if (!m_viewportHandler)
-        return;
+    ASSERT(m_viewportHandler);
 
-    if (wasEventHandled || event.type() == WebEvent::TouchCancel) {
-        m_panGestureRecognizer.cancel();
-        m_pinchGestureRecognizer.cancel();
-        if (event.type() != WebEvent::TouchMove)
-            m_tapGestureRecognizer.cancel();
-        return;
-    }
-
-    const QTouchEvent* ev = event.nativeEvent();
+    bool isMouseEvent = false;
 
-    switch (ev->type()) {
+    switch (event->type()) {
+    case QEvent::MouseButtonPress:
+        isMouseEvent = true;
+        m_isMouseButtonPressed = true;
+        // Fall through.
     case QEvent::TouchBegin:
         ASSERT(!m_viewportHandler->panGestureActive());
         ASSERT(!m_viewportHandler->pinchGestureActive());
@@ -472,16 +469,27 @@ void QtWebPageEventHandler::doneWithTouchEvent(const NativeWebTouchEvent& event,
         // where as it does not stop the scale animation.
         // The gesture recognizer stops the kinetic scrolling animation if needed.
         break;
+    case QEvent::MouseMove:
+        if (!m_isMouseButtonPressed)
+            return;
+
+        isMouseEvent = true;
+        // Fall through.
     case QEvent::TouchUpdate:
         // The scale animation can only be interrupted by a pinch gesture, which will then take over.
         if (m_viewportHandler->scaleAnimationActive() && m_pinchGestureRecognizer.isRecognized())
             m_viewportHandler->interruptScaleAnimation();
         break;
+    case QEvent::MouseButtonRelease:
+        isMouseEvent = true;
+        m_isMouseButtonPressed = false;
+        // Fall through.
     case QEvent::TouchEnd:
         m_viewportHandler->touchEnd();
         break;
     default:
-        break;
+        ASSERT(event->type() == QEvent::MouseButtonDblClick);
+        return;
     }
 
     // If the scale animation is active we don't pass the event to the recognizers. In the future
@@ -489,15 +497,36 @@ void QtWebPageEventHandler::doneWithTouchEvent(const NativeWebTouchEvent& event,
     if (m_viewportHandler->scaleAnimationActive())
         return;
 
-    const QList<QTouchEvent::TouchPoint>& touchPoints = ev->touchPoints();
-    const int touchPointCount = touchPoints.size();
-    qint64 eventTimestampMillis = ev->timestamp();
     QList<QTouchEvent::TouchPoint> activeTouchPoints;
-    activeTouchPoints.reserve(touchPointCount);
-
-    for (int i = 0; i < touchPointCount; ++i) {
-        if (touchPoints[i].state() != Qt::TouchPointReleased)
-            activeTouchPoints << touchPoints[i];
+    QTouchEvent::TouchPoint currentTouchPoint;
+    qint64 eventTimestampMillis = event->timestamp();
+    int touchPointCount = 0;
+
+    if (!isMouseEvent) {
+        const QTouchEvent* touchEvent = static_cast<const QTouchEvent*>(event);
+        const QList<QTouchEvent::TouchPoint>& touchPoints = touchEvent->touchPoints();
+        currentTouchPoint = touchPoints.first();
+        touchPointCount = touchPoints.size();
+        activeTouchPoints.reserve(touchPointCount);
+
+        for (int i = 0; i < touchPointCount; ++i) {
+            if (touchPoints[i].state() != Qt::TouchPointReleased)
+                activeTouchPoints << touchPoints[i];
+        }
+    } else {
+        const QMouseEvent* mouseEvent = static_cast<const QMouseEvent*>(event);
+        touchPointCount = 1;
+
+        // Make a distinction between mouse events on the basis of pressed buttons.
+        currentTouchPoint.setId(mouseEvent->buttons());
+        currentTouchPoint.setScreenPos(mouseEvent->screenPos());
+        // For tap gesture hit testing the float touch rect is translated to
+        // an int rect representing the radius of the touch point (size/2),
+        // thus the touch rect has to have a size of at least 2.
+        currentTouchPoint.setRect(QRectF(mouseEvent->localPos(), QSizeF(2, 2)));
+
+        if (m_isMouseButtonPressed)
+            activeTouchPoints << currentTouchPoint;
     }
 
     const int activeTouchPointCount = activeTouchPoints.size();
@@ -506,11 +535,11 @@ void QtWebPageEventHandler::doneWithTouchEvent(const NativeWebTouchEvent& event,
         if (touchPointCount == 1) {
             // No active touch points, one finger released.
             if (m_panGestureRecognizer.isRecognized())
-                m_panGestureRecognizer.finish(touchPoints.first(), eventTimestampMillis);
+                m_panGestureRecognizer.finish(currentTouchPoint, eventTimestampMillis);
             else {
                 // The events did not result in a pan gesture.
                 m_panGestureRecognizer.cancel();
-                m_tapGestureRecognizer.finish(touchPoints.first());
+                m_tapGestureRecognizer.finish(currentTouchPoint);
             }
 
         } else
@@ -532,7 +561,27 @@ void QtWebPageEventHandler::doneWithTouchEvent(const NativeWebTouchEvent& event,
     if (m_panGestureRecognizer.isRecognized() || m_pinchGestureRecognizer.isRecognized() || m_webView->isMoving())
         m_tapGestureRecognizer.cancel();
     else if (touchPointCount == 1)
-        m_tapGestureRecognizer.update(touchPoints.first());
+        m_tapGestureRecognizer.update(currentTouchPoint);
+
+}
+
+#if ENABLE(TOUCH_EVENTS)
+void QtWebPageEventHandler::doneWithTouchEvent(const NativeWebTouchEvent& event, bool wasEventHandled)
+{
+    if (!m_viewportHandler)
+        return;
+
+    if (wasEventHandled || event.type() == WebEvent::TouchCancel) {
+        m_panGestureRecognizer.cancel();
+        m_pinchGestureRecognizer.cancel();
+        if (event.type() != WebEvent::TouchMove)
+            m_tapGestureRecognizer.cancel();
+        return;
+    }
+
+    const QTouchEvent* ev = event.nativeEvent();
+
+    handleInputEvent(ev);
 }
 #endif
 
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.h b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.h
index b64f6fee6..4cc9f3372 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.h
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.h
@@ -88,6 +88,7 @@ public:
 #if ENABLE(TOUCH_EVENTS)
     void doneWithTouchEvent(const NativeWebTouchEvent&, bool wasEventHandled);
 #endif
+    void handleInputEvent(const QInputEvent*);
     void resetGestureRecognizers();
 
     QtViewportHandler* viewportHandler() { return m_viewportHandler; }
@@ -115,6 +116,7 @@ private:
     int m_clickCount;
     bool m_postponeTextInputStateChanged;
     bool m_isTapHighlightActive;
+    bool m_isMouseButtonPressed;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.cpp b/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.cpp
index 4de77f70a..eb7023990 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 #include "QtWebPageSGNode.h"
 
-#include "WebLayerTreeRenderer.h"
+#include "LayerTreeRenderer.h"
 #include <QtGui/QPolygonF>
 #include <QtQuick/QSGSimpleRectNode>
 #include <private/qsgrendernode_p.h>
@@ -32,7 +32,7 @@ namespace WebKit {
 
 class ContentsSGNode : public QSGRenderNode {
 public:
-    ContentsSGNode(PassRefPtr<WebLayerTreeRenderer> renderer)
+    ContentsSGNode(PassRefPtr<LayerTreeRenderer> renderer)
         : m_renderer(renderer)
     {
         layerTreeRenderer()->setActive(true);
@@ -61,7 +61,7 @@ public:
         layerTreeRenderer()->purgeGLResources();
     }
 
-    WebLayerTreeRenderer* layerTreeRenderer() const { return m_renderer.get(); }
+    LayerTreeRenderer* layerTreeRenderer() const { return m_renderer.get(); }
 
 private:
     QRectF clipRect() const
@@ -105,7 +105,7 @@ private:
         return resultRect;
     }
 
-    RefPtr<WebLayerTreeRenderer> m_renderer;
+    RefPtr<LayerTreeRenderer> m_renderer;
 };
 
 QtWebPageSGNode::QtWebPageSGNode()
@@ -128,7 +128,7 @@ void QtWebPageSGNode::setScale(float scale)
     setMatrix(matrix);
 }
 
-void QtWebPageSGNode::setRenderer(PassRefPtr<WebLayerTreeRenderer> renderer)
+void QtWebPageSGNode::setRenderer(PassRefPtr<LayerTreeRenderer> renderer)
 {
     if (m_contentsNode && m_contentsNode->layerTreeRenderer() == renderer)
         return;
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.h b/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.h
index 22a5bcfba..11d18984e 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.h
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.h
@@ -31,14 +31,14 @@ QT_END_NAMESPACE
 namespace WebKit {
 
 class ContentsSGNode;
-class WebLayerTreeRenderer;
+class LayerTreeRenderer;
 
 class QtWebPageSGNode : public QSGTransformNode {
     public:
         QtWebPageSGNode();
         void setBackground(const QRectF&, const QColor&);
         void setScale(float);
-        void setRenderer(PassRefPtr<WebLayerTreeRenderer>);
+        void setRenderer(PassRefPtr<LayerTreeRenderer>);
 
     private:
         ContentsSGNode* m_contentsNode;
diff --git a/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.cpp b/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.cpp
index e46da326d..9fd296fd1 100644
--- a/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.cpp
@@ -95,7 +95,6 @@ void WebColorChooserProxyQt::createItem(QObject* contextObject)
     m_colorChooser->setParentItem(m_webView);
 
     component->completeCreate();
-    QQuickWebViewPrivate::get(m_webView)->setDialogActive(true);
 }
 
 void WebColorChooserProxyQt::createContext(QQmlComponent* component, QObject* contextObject)
@@ -133,8 +132,6 @@ void WebColorChooserProxyQt::notifyColorSelected(const QColor& color)
 
 void WebColorChooserProxyQt::endChooser()
 {
-    QQuickWebViewPrivate::get(m_webView)->setDialogActive(false);
-
     m_colorChooser.clear();
     m_context.clear();
 
diff --git a/Source/WebKit2/UIProcess/qt/WebFullScreenManagerProxyQt.cpp b/Source/WebKit2/UIProcess/qt/WebFullScreenManagerProxyQt.cpp
index 91d962e90..7d19da5d2 100644
--- a/Source/WebKit2/UIProcess/qt/WebFullScreenManagerProxyQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebFullScreenManagerProxyQt.cpp
@@ -26,16 +26,21 @@
 #include "WebFullScreenManagerMessages.h"
 #include "WebFullScreenManagerProxyMessages.h"
 #include "WebProcess.h"
-#include "qquickwebview_p.h"
 #include <WebCore/NotImplemented.h>
 
+#if HAVE(QTQUICK)
+#include "qquickwebview_p.h"
+#endif
+
 using namespace WebCore;
 
 namespace WebKit {
 
 void WebFullScreenManagerProxy::invalidate()
 {
+#if HAVE(QTQUICK)
     m_webView = 0;
+#endif
 }
 
 void WebFullScreenManagerProxy::close()
@@ -52,14 +57,18 @@ bool WebFullScreenManagerProxy::isFullScreen()
 void WebFullScreenManagerProxy::enterFullScreen()
 {
     willEnterFullScreen();
+#if HAVE(QTQUICK)
     emit m_webView->experimental()->enterFullScreenRequested();
+#endif
     didEnterFullScreen();
 }
 
 void WebFullScreenManagerProxy::exitFullScreen()
 {
     willExitFullScreen();
+#if HAVE(QTQUICK)
     emit m_webView->experimental()->exitFullScreenRequested();
+#endif
     didExitFullScreen();
 }
 
diff --git a/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp b/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp
index fa2c74f1f..558d47d75 100644
--- a/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp
@@ -27,14 +27,17 @@
 #include "WebPageProxy.h"
 
 #include "PageClient.h"
-#include "QtNetworkReplyData.h"
-#include "QtPageClient.h"
-#include "qquicknetworkreply_p.h"
 #include "WebPageMessages.h"
 #include "WebProcessProxy.h"
 #include <WebCore/Editor.h>
 #include <WebCore/NotImplemented.h>
 
+#if HAVE(QTQUICK)
+#include "QtNetworkReplyData.h"
+#include "QtPageClient.h"
+#include "qquicknetworkreply_p.h"
+#endif
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -87,19 +90,23 @@ void WebPageProxy::registerApplicationScheme(const String& scheme)
 
 void WebPageProxy::resolveApplicationSchemeRequest(QtNetworkRequestData request)
 {
+#if HAVE(QTQUICK)
     RefPtr<QtRefCountedNetworkRequestData> requestData = adoptRef(new QtRefCountedNetworkRequestData(request));
     m_applicationSchemeRequests.add(requestData);
     static_cast<QtPageClient*>(m_pageClient)->handleApplicationSchemeRequest(requestData);
+#endif
 }
 
 void WebPageProxy::sendApplicationSchemeReply(const QQuickNetworkReply* reply)
 {
+#if HAVE(QTQUICK)
     RefPtr<QtRefCountedNetworkRequestData> requestData = reply->networkRequestData();
     if (m_applicationSchemeRequests.contains(requestData)) {
         RefPtr<QtRefCountedNetworkReplyData> replyData = reply->networkReplyData();
         process()->send(Messages::WebPage::ApplicationSchemeReply(replyData->data()), pageID());
         m_applicationSchemeRequests.remove(requestData);
     }
+#endif
 }
 
 void WebPageProxy::setUserScripts(const Vector<String>& scripts)
diff --git a/Source/WebKit2/UIProcess/qt/WebPopupMenuProxyQt.cpp b/Source/WebKit2/UIProcess/qt/WebPopupMenuProxyQt.cpp
index 7512892bb..32ec1857b 100644
--- a/Source/WebKit2/UIProcess/qt/WebPopupMenuProxyQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebPopupMenuProxyQt.cpp
@@ -278,13 +278,11 @@ void WebPopupMenuProxyQt::showPopupMenu(const IntRect& rect, WebCore::TextDirect
         hidePopupMenu();
         return;
     }
-    QQuickWebViewPrivate::get(m_webView)->setDialogActive(true);
 }
 
 void WebPopupMenuProxyQt::hidePopupMenu()
 {
     m_itemSelector.clear();
-    QQuickWebViewPrivate::get(m_webView)->setDialogActive(false);
     m_context.clear();
 
     if (m_client) {
diff --git a/Source/WebKit2/UIProcess/qt/WebPreferencesQt.cpp b/Source/WebKit2/UIProcess/qt/WebPreferencesQt.cpp
index fae4a2d76..d8f1c7801 100644
--- a/Source/WebKit2/UIProcess/qt/WebPreferencesQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebPreferencesQt.cpp
@@ -25,11 +25,39 @@
 
 #include "config.h"
 #include "WebPreferences.h"
+#include <QFont>
 
 namespace WebKit {
 
+static void setStringValueIfInUserDefaults(const String& baseKey, WebPreferencesStore& store, const QHash<String, QFont::StyleHint> qFontHint)
+{
+    // Use same approach as DumpRenderTree does - get font info from QFont.
+    static QFont defaultFont;
+    defaultFont.setStyleHint(qFontHint[baseKey]);
+    store.setStringValueForKey(baseKey, defaultFont.defaultFamily());
+}
+
 void WebPreferences::platformInitializeStore()
 {
+    if (!m_identifier)
+        return;
+
+    QHash <String, QFont::StyleHint> qFontHint;
+
+    qFontHint["StandardFontFamily"] = QFont::Serif;
+    qFontHint["CursiveFontFamily"] = QFont::Cursive;
+    qFontHint["FantasyFontFamily"] = QFont::Fantasy;
+    qFontHint["FixedFontFamily"] = QFont::Monospace;
+    qFontHint["SansSerifFontFamily"] = QFont::SansSerif;
+    qFontHint["SerifFontFamily"] = QFont::Serif;
+    qFontHint["PictographFontFamily"] = QFont::Serif;
+
+#define INITIALIZE_FONT_PREFERENCES(KeyUpper, KeyLower, TypeName, Type, DefaultValue) \
+    set##TypeName##ValueIfInUserDefaults(WebPreferencesKey::KeyLower##Key(), m_store, qFontHint);
+
+    FOR_EACH_WEBKIT_FONT_FAMILY_PREFERENCE(INITIALIZE_FONT_PREFERENCES)
+
+#undef INITIALIZE_FONT_PREFERENCES
 }
 
 void WebPreferences::platformUpdateStringValueForKey(const String&, const String&)
diff --git a/Source/WebKit2/WebKit2.pri b/Source/WebKit2/WebKit2.pri
index 17d5493b0..916687449 100644
--- a/Source/WebKit2/WebKit2.pri
+++ b/Source/WebKit2/WebKit2.pri
@@ -26,6 +26,7 @@ INCLUDEPATH += \
     $$SOURCE_DIR/UIProcess/API/cpp/qt \
     $$SOURCE_DIR/UIProcess/API/qt \
     $$SOURCE_DIR/UIProcess/Authentication \
+    $$SOURCE_DIR/UIProcess/CoordinatedGraphics \
     $$SOURCE_DIR/UIProcess/Downloads \
     $$SOURCE_DIR/UIProcess/InspectorServer \
     $$SOURCE_DIR/UIProcess/InspectorServer/qt \
@@ -58,7 +59,7 @@ INCLUDEPATH += \
     $$SOURCE_DIR/WebProcess/WebCoreSupport \
     $$SOURCE_DIR/WebProcess/WebCoreSupport/qt \
     $$SOURCE_DIR/WebProcess/WebPage \
-    $$SOURCE_DIR/WebProcess/WebPage/LayerTreeCoordinator \
+    $$SOURCE_DIR/WebProcess/WebPage/CoordinatedGraphics \
     $$SOURCE_DIR/WebProcess/qt \
     $$SOURCE_DIR/PluginProcess
 
@@ -74,6 +75,6 @@ linux-*: {
     LIBS += -lrt
 }
 
-QT += qml quick
+contains(DEFINES, HAVE_QTQUICK=1): QT += qml quick
 
-contains(DEFINES, ENABLE_GEOLOCATION=1):haveQt(5): QT += location
+contains(DEFINES, ENABLE_GEOLOCATION=1): QT += location
diff --git a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
index cf12343df..8c80ced45 100644
--- a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
+++ b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
@@ -12,10 +12,12 @@
 			buildConfigurationList = 1A50DB48110A3C27000D3FE5 /* Build configuration list for PBXAggregateTarget "All" */;
 			buildPhases = (
 				1A50DB70110A3D67000D3FE5 /* CopyFiles */,
+				BCA8D46B15BCE33C009DC1F1 /* CopyFiles */,
 			);
 			dependencies = (
 				1A50DB3C110A3C19000D3FE5 /* PBXTargetDependency */,
 				BCDE0AC113272712001259FB /* PBXTargetDependency */,
+				BCA8D46815BCE0D6009DC1F1 /* PBXTargetDependency */,
 			);
 			name = All;
 			productName = WebKit2;
@@ -146,7 +148,7 @@
 		1A6F9FB711E1408500DB1371 /* CommandLineMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6F9FB611E1408500DB1371 /* CommandLineMac.cpp */; };
 		1A6FA01E11E1526300DB1371 /* WebProcessMainMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1A6FA01D11E1526300DB1371 /* WebProcessMainMac.mm */; };
 		1A6FA02011E1528700DB1371 /* WebProcessMain.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A6FA01F11E1528700DB1371 /* WebProcessMain.h */; };
-		1A6FA31111E3921E00DB1371 /* MainMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6FA31011E3921E00DB1371 /* MainMac.cpp */; };
+		1A6FA31111E3921E00DB1371 /* MainMacProcess.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6FA31011E3921E00DB1371 /* MainMacProcess.cpp */; };
 		1A6FA31611E3923600DB1371 /* WebKitMain.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6FA31511E3923600DB1371 /* WebKitMain.cpp */; };
 		1A6FB7AE11E64B6800DB1371 /* PluginView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6FB7AC11E64B6800DB1371 /* PluginView.cpp */; };
 		1A6FB7AF11E64B6800DB1371 /* PluginView.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A6FB7AD11E64B6800DB1371 /* PluginView.h */; };
@@ -578,6 +580,8 @@
 		BC33DD681238464600360F3F /* WebNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = BC33DD671238464600360F3F /* WebNumber.h */; };
 		BC33E0D112408E8600360F3F /* InjectedBundleRangeHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = BC33E0CF12408E8600360F3F /* InjectedBundleRangeHandle.h */; };
 		BC33E0D212408E8600360F3F /* InjectedBundleRangeHandle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC33E0D012408E8600360F3F /* InjectedBundleRangeHandle.cpp */; };
+		BC3DE46915A91763008D26FC /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BC3DE46815A91763008D26FC /* Foundation.framework */; };
+		BC3DE47215A91764008D26FC /* MainMacService.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC3DE47115A91764008D26FC /* MainMacService.mm */; };
 		BC4075F3124FF0270068F20A /* WKArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC4075D7124FF0270068F20A /* WKArray.cpp */; };
 		BC4075F4124FF0270068F20A /* WKArray.h in Headers */ = {isa = PBXBuildFile; fileRef = BC4075D8124FF0270068F20A /* WKArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC4075F5124FF0270068F20A /* WKCertificateInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC4075D9124FF0270068F20A /* WKCertificateInfo.cpp */; };
@@ -645,6 +649,7 @@
 		BC5750981268F3C6006F0F12 /* WebPopupMenuProxyMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC5750961268F3C6006F0F12 /* WebPopupMenuProxyMac.mm */; };
 		BC575613126E0138006F0F12 /* WebError.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC575612126E0138006F0F12 /* WebError.cpp */; };
 		BC59534210FC04520098F82D /* WebLoaderClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BC59534010FC04520098F82D /* WebLoaderClient.h */; };
+		BC59548915C7868500FD1E3E /* WebKit2.h in Headers */ = {isa = PBXBuildFile; fileRef = BC59548815C7868500FD1E3E /* WebKit2.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		BC597075116591D000551FCA /* ProcessModel.h in Headers */ = {isa = PBXBuildFile; fileRef = BC597074116591D000551FCA /* ProcessModel.h */; };
 		BC5C75C814954DA600BC4775 /* WKConnectionInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5C75C614954DA600BC4775 /* WKConnectionInternal.h */; };
 		BC60C5791240A546008C5E29 /* WKBundleRangeHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = BC60C5771240A546008C5E29 /* WKBundleRangeHandle.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -676,6 +681,7 @@
 		BC8147AA12F64CDA007B2C32 /* InjectedBundlePagePolicyClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC8147A812F64CDA007B2C32 /* InjectedBundlePagePolicyClient.cpp */; };
 		BC8147D512F66D31007B2C32 /* InjectedBundleNavigationAction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8147D312F66D31007B2C32 /* InjectedBundleNavigationAction.h */; };
 		BC8147D612F66D31007B2C32 /* InjectedBundleNavigationAction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC8147D412F66D31007B2C32 /* InjectedBundleNavigationAction.cpp */; };
+		BC82DF2215BDF42200FC2841 /* com.apple.WebProcess.sb in Resources */ = {isa = PBXBuildFile; fileRef = E1967E37150AB5E200C73169 /* com.apple.WebProcess.sb */; };
 		BC8452A71162C80900CAB9B5 /* DrawingArea.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC8452A51162C80900CAB9B5 /* DrawingArea.cpp */; };
 		BC8452A81162C80900CAB9B5 /* DrawingArea.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8452A61162C80900CAB9B5 /* DrawingArea.h */; };
 		BC84EB1812A7100C0083F2DA /* WebPreferencesMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC84EB1712A7100C0083F2DA /* WebPreferencesMac.mm */; };
@@ -719,6 +725,7 @@
 		BCA8C6A911E3BA5F00812FB7 /* InjectedBundlePageLoaderClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA8C6A711E3BA5F00812FB7 /* InjectedBundlePageLoaderClient.h */; };
 		BCA8C6AF11E3C08700812FB7 /* InjectedBundlePageUIClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA8C6AD11E3C08700812FB7 /* InjectedBundlePageUIClient.cpp */; };
 		BCA8C6B011E3C08700812FB7 /* InjectedBundlePageUIClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA8C6AE11E3C08700812FB7 /* InjectedBundlePageUIClient.h */; };
+		BCA8D46C15BCE34B009DC1F1 /* com.apple.WebKit2.WebKit2Service.xpc in CopyFiles */ = {isa = PBXBuildFile; fileRef = BC3DE46615A91763008D26FC /* com.apple.WebKit2.WebKit2Service.xpc */; };
 		BCAC111F12C92C1F00B08EEE /* WebDatabaseManagerProxyClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BCAC111D12C92C1F00B08EEE /* WebDatabaseManagerProxyClient.h */; };
 		BCAC112012C92C1F00B08EEE /* WebDatabaseManagerProxyClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCAC111E12C92C1F00B08EEE /* WebDatabaseManagerProxyClient.cpp */; };
 		BCB0AD33122F285800B1341E /* MutableArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC8049D122F0D6B00103529 /* MutableArray.cpp */; };
@@ -729,7 +736,7 @@
 		BCB0B0DE12305A8C00B1341E /* InjectedBundleUserMessageCoders.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB0B0DD12305A8C00B1341E /* InjectedBundleUserMessageCoders.h */; };
 		BCB0B0E012305AB100B1341E /* UserMessageCoders.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB0B0DF12305AB100B1341E /* UserMessageCoders.h */; };
 		BCB28CC0120233D9007D99BC /* InjectedBundleMessageKinds.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB28CBF120233D9007D99BC /* InjectedBundleMessageKinds.h */; };
-		BCB63478116BF10600603215 /* WebKit2.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB63477116BF10600603215 /* WebKit2.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		BCB63478116BF10600603215 /* WebKit2_C.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB63477116BF10600603215 /* WebKit2_C.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCB9E2431120DACA00A137E0 /* WebContext.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB9E2411120DACA00A137E0 /* WebContext.h */; };
 		BCB9E2441120DACA00A137E0 /* WebContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCB9E2421120DACA00A137E0 /* WebContext.cpp */; };
 		BCB9E24B1120E15C00A137E0 /* WKContext.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB9E2491120E15C00A137E0 /* WKContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -793,7 +800,7 @@
 		BCDDB32D124EC2E10048D13C /* WKAPICast.h in Headers */ = {isa = PBXBuildFile; fileRef = BCDDB32C124EC2E10048D13C /* WKAPICast.h */; };
 		BCDE059B11CDA8AE00E41AF1 /* WebContextInjectedBundleClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BCDE059911CDA8AE00E41AF1 /* WebContextInjectedBundleClient.h */; };
 		BCDE059C11CDA8AE00E41AF1 /* WebContextInjectedBundleClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCDE059A11CDA8AE00E41AF1 /* WebContextInjectedBundleClient.cpp */; };
-		BCDE093B13272496001259FB /* MainMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6FA31011E3921E00DB1371 /* MainMac.cpp */; };
+		BCDE093B13272496001259FB /* MainMacProcess.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6FA31011E3921E00DB1371 /* MainMacProcess.cpp */; };
 		BCDE093D13272496001259FB /* PluginProcessShim.dylib in Copy Plug-in Process Shim */ = {isa = PBXBuildFile; fileRef = 1AC25FB012A48EA700BD2671 /* PluginProcessShim.dylib */; };
 		BCDE0ABF13272708001259FB /* PluginProcess.app in CopyFiles */ = {isa = PBXBuildFile; fileRef = BCDE094213272496001259FB /* PluginProcess.app */; };
 		BCE0937714FB128C001138D9 /* LayerHostingContext.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCE0937514FB128B001138D9 /* LayerHostingContext.mm */; };
@@ -827,9 +834,6 @@
 		BCEE966D112FAF57006BCC24 /* Attachment.h in Headers */ = {isa = PBXBuildFile; fileRef = BCEE966B112FAF57006BCC24 /* Attachment.h */; };
 		BCF049E611FE20F600F86A58 /* WKBundleFramePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF049E411FE20F600F86A58 /* WKBundleFramePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCF049E711FE20F600F86A58 /* WKBundlePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF049E511FE20F600F86A58 /* WKBundlePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BCF50121123ED3B3005955AE /* ThreadLauncher.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF5011F123ED3B3005955AE /* ThreadLauncher.h */; };
-		BCF50122123ED3B3005955AE /* ThreadLauncher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCF50120123ED3B3005955AE /* ThreadLauncher.cpp */; };
-		BCF501B4123EF602005955AE /* ThreadLauncherMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCF501B3123EF602005955AE /* ThreadLauncherMac.mm */; };
 		BCF505E71243047B005955AE /* PlatformCertificateInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF505E51243047B005955AE /* PlatformCertificateInfo.h */; };
 		BCF505E81243047B005955AE /* PlatformCertificateInfo.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCF505E61243047B005955AE /* PlatformCertificateInfo.mm */; };
 		BCF50728124329AA005955AE /* WebCertificateInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF50726124329AA005955AE /* WebCertificateInfo.h */; };
@@ -960,6 +964,13 @@
 			remoteGlobalIDString = 510031EA1379CACB00C8DFE4;
 			remoteInfo = WebProcessShim;
 		};
+		BCA8D46715BCE0D6009DC1F1 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = BC3DE46515A91763008D26FC;
+			remoteInfo = WebKit2Service;
+		};
 		BCDE093513272496001259FB /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
@@ -1006,6 +1017,16 @@
 			name = "Copy Web Process Shim";
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		BCA8D46B15BCE33C009DC1F1 /* CopyFiles */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = WebKit2.framework/XPCServices;
+			dstSubfolderSpec = 1;
+			files = (
+				BCA8D46C15BCE34B009DC1F1 /* com.apple.WebKit2.WebKit2Service.xpc in CopyFiles */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		BCDE093C13272496001259FB /* Copy Plug-in Process Shim */ = {
 			isa = PBXCopyFilesBuildPhase;
 			buildActionMask = 2147483647;
@@ -1147,7 +1168,7 @@
 		1A6F9FB611E1408500DB1371 /* CommandLineMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CommandLineMac.cpp; sourceTree = "<group>"; };
 		1A6FA01D11E1526300DB1371 /* WebProcessMainMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebProcessMainMac.mm; sourceTree = "<group>"; };
 		1A6FA01F11E1528700DB1371 /* WebProcessMain.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebProcessMain.h; sourceTree = "<group>"; };
-		1A6FA31011E3921E00DB1371 /* MainMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = MainMac.cpp; path = mac/MainMac.cpp; sourceTree = "<group>"; };
+		1A6FA31011E3921E00DB1371 /* MainMacProcess.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = MainMacProcess.cpp; path = mac/MainMacProcess.cpp; sourceTree = "<group>"; };
 		1A6FA31511E3923600DB1371 /* WebKitMain.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitMain.cpp; sourceTree = "<group>"; };
 		1A6FB7AC11E64B6800DB1371 /* PluginView.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginView.cpp; sourceTree = "<group>"; };
 		1A6FB7AD11E64B6800DB1371 /* PluginView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginView.h; sourceTree = "<group>"; };
@@ -1623,6 +1644,10 @@
 		BC33DD671238464600360F3F /* WebNumber.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebNumber.h; sourceTree = "<group>"; };
 		BC33E0CF12408E8600360F3F /* InjectedBundleRangeHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundleRangeHandle.h; sourceTree = "<group>"; };
 		BC33E0D012408E8600360F3F /* InjectedBundleRangeHandle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundleRangeHandle.cpp; sourceTree = "<group>"; };
+		BC3DE46615A91763008D26FC /* com.apple.WebKit2.WebKit2Service.xpc */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = com.apple.WebKit2.WebKit2Service.xpc; sourceTree = BUILT_PRODUCTS_DIR; };
+		BC3DE46815A91763008D26FC /* Foundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Foundation.framework; path = System/Library/Frameworks/Foundation.framework; sourceTree = SDKROOT; };
+		BC3DE46C15A91763008D26FC /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; name = Info.plist; path = WebKit2Service/Info.plist; sourceTree = "<group>"; };
+		BC3DE47115A91764008D26FC /* MainMacService.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; name = MainMacService.mm; path = WebKit2Service/MainMacService.mm; sourceTree = "<group>"; };
 		BC4075D7124FF0270068F20A /* WKArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKArray.cpp; sourceTree = "<group>"; };
 		BC4075D8124FF0270068F20A /* WKArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKArray.h; sourceTree = "<group>"; };
 		BC4075D9124FF0270068F20A /* WKCertificateInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKCertificateInfo.cpp; sourceTree = "<group>"; };
@@ -1690,6 +1715,7 @@
 		BC5750961268F3C6006F0F12 /* WebPopupMenuProxyMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebPopupMenuProxyMac.mm; sourceTree = "<group>"; };
 		BC575612126E0138006F0F12 /* WebError.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebError.cpp; sourceTree = "<group>"; };
 		BC59534010FC04520098F82D /* WebLoaderClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebLoaderClient.h; sourceTree = "<group>"; };
+		BC59548815C7868500FD1E3E /* WebKit2.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKit2.h; sourceTree = "<group>"; };
 		BC597074116591D000551FCA /* ProcessModel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProcessModel.h; sourceTree = "<group>"; };
 		BC5C75C614954DA600BC4775 /* WKConnectionInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKConnectionInternal.h; sourceTree = "<group>"; };
 		BC60C5771240A546008C5E29 /* WKBundleRangeHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKBundleRangeHandle.h; sourceTree = "<group>"; };
@@ -1764,6 +1790,7 @@
 		BCA8C6A711E3BA5F00812FB7 /* InjectedBundlePageLoaderClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundlePageLoaderClient.h; sourceTree = "<group>"; };
 		BCA8C6AD11E3C08700812FB7 /* InjectedBundlePageUIClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundlePageUIClient.cpp; sourceTree = "<group>"; };
 		BCA8C6AE11E3C08700812FB7 /* InjectedBundlePageUIClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundlePageUIClient.h; sourceTree = "<group>"; };
+		BCA8D46A15BCE160009DC1F1 /* WebKit2Service.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = WebKit2Service.xcconfig; sourceTree = "<group>"; };
 		BCAC111D12C92C1F00B08EEE /* WebDatabaseManagerProxyClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebDatabaseManagerProxyClient.h; sourceTree = "<group>"; };
 		BCAC111E12C92C1F00B08EEE /* WebDatabaseManagerProxyClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebDatabaseManagerProxyClient.cpp; sourceTree = "<group>"; };
 		BCB0AEE7122F53E300B1341E /* MutableDictionary.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MutableDictionary.h; sourceTree = "<group>"; };
@@ -1772,7 +1799,7 @@
 		BCB0B0DD12305A8C00B1341E /* InjectedBundleUserMessageCoders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundleUserMessageCoders.h; sourceTree = "<group>"; };
 		BCB0B0DF12305AB100B1341E /* UserMessageCoders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserMessageCoders.h; sourceTree = "<group>"; };
 		BCB28CBF120233D9007D99BC /* InjectedBundleMessageKinds.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundleMessageKinds.h; sourceTree = "<group>"; };
-		BCB63477116BF10600603215 /* WebKit2.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKit2.h; sourceTree = "<group>"; };
+		BCB63477116BF10600603215 /* WebKit2_C.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKit2_C.h; sourceTree = "<group>"; };
 		BCB86F4B116AAACD00CE20B7 /* WebKit2.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = WebKit2.xcconfig; sourceTree = "<group>"; };
 		BCB9E2411120DACA00A137E0 /* WebContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebContext.h; sourceTree = "<group>"; };
 		BCB9E2421120DACA00A137E0 /* WebContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebContext.cpp; sourceTree = "<group>"; };
@@ -1878,9 +1905,6 @@
 		BCF049E511FE20F600F86A58 /* WKBundlePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKBundlePrivate.h; sourceTree = "<group>"; };
 		BCF04C8C11FF9B7D00F86A58 /* APIObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = APIObject.h; sourceTree = "<group>"; };
 		BCF04C8E11FF9F6E00F86A58 /* WebString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebString.h; sourceTree = "<group>"; };
-		BCF5011F123ED3B3005955AE /* ThreadLauncher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadLauncher.h; sourceTree = "<group>"; };
-		BCF50120123ED3B3005955AE /* ThreadLauncher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ThreadLauncher.cpp; sourceTree = "<group>"; };
-		BCF501B3123EF602005955AE /* ThreadLauncherMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ThreadLauncherMac.mm; sourceTree = "<group>"; };
 		BCF505E51243047B005955AE /* PlatformCertificateInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformCertificateInfo.h; sourceTree = "<group>"; };
 		BCF505E61243047B005955AE /* PlatformCertificateInfo.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformCertificateInfo.mm; sourceTree = "<group>"; };
 		BCF5068412431861005955AE /* Security.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Security.framework; path = /System/Library/Frameworks/Security.framework; sourceTree = "<absolute>"; };
@@ -2033,6 +2057,14 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		BC3DE46315A91763008D26FC /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				BC3DE46915A91763008D26FC /* Foundation.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXFrameworksBuildPhase section */
 
 /* Begin PBXGroup section */
@@ -2044,6 +2076,7 @@
 				8DC2EF5B0486A6940098B216 /* WebKit2.framework */,
 				1A50DB1E110A3BDC000D3FE5 /* WebProcess.app */,
 				510031F61379CACB00C8DFE4 /* WebProcessShim.dylib */,
+				BC3DE46615A91763008D26FC /* com.apple.WebKit2.WebKit2Service.xpc */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -2054,6 +2087,7 @@
 			isa = PBXGroup;
 			children = (
 				B396EA5512E0ED2D00F4FEB7 /* config.h */,
+				32DBCF5E0370ADEE00C91783 /* WebKit2Prefix.h */,
 				C0CE72DB1247E8F700BC0EC4 /* DerivedSources.make */,
 				BC2E6E74114196F000A63B1E /* Platform */,
 				1AADDF4B10D82AF000D3D63D /* Shared */,
@@ -2088,6 +2122,7 @@
 				BC122FA51327085D00F7EAC1 /* PluginProcess */,
 				BC8A500E11765AD400757573 /* WebKit2 */,
 				BC8A500F11765AE300757573 /* WebProcess */,
+				BC3DE47815A917C6008D26FC /* WebKit2Service */,
 				6D8A91A511F0EFD100DD01FE /* com.apple.WebProcess.sb.in */,
 				089C1666FE841158C02AAC07 /* InfoPlist.strings */,
 			);
@@ -2104,6 +2139,7 @@
 				1AA1CD06100FA1BA0078DEBC /* Carbon.framework */,
 				1058C7B1FEA5585E11CA2CBB /* Cocoa.framework */,
 				BCD0042C110C1E27003B8A67 /* CoreServices.framework */,
+				BC3DE46815A91763008D26FC /* Foundation.framework */,
 				CDCA85D4132AC2B300E961DF /* IOKit.framework */,
 				1AA1C7DE100E846E0078DEBC /* JavaScriptCore.framework */,
 				BC87DFA91018101400564216 /* libicucore.dylib */,
@@ -2188,6 +2224,7 @@
 				1A4F976E100E7B6600637A18 /* Version.xcconfig */,
 				BCB86F4B116AAACD00CE20B7 /* WebKit2.xcconfig */,
 				5DAD7294116FF70B00EE5396 /* WebProcess.xcconfig */,
+				BCA8D46A15BCE160009DC1F1 /* WebKit2Service.xcconfig */,
 			);
 			path = Configurations;
 			sourceTree = "<group>";
@@ -2589,8 +2626,8 @@
 		32C88DFF0371C24200C91783 /* Other Sources */ = {
 			isa = PBXGroup;
 			children = (
-				1A6FA31011E3921E00DB1371 /* MainMac.cpp */,
-				32DBCF5E0370ADEE00C91783 /* WebKit2Prefix.h */,
+				1A6FA31011E3921E00DB1371 /* MainMacProcess.cpp */,
+				BC3DE47115A91764008D26FC /* MainMacService.mm */,
 			);
 			name = "Other Sources";
 			sourceTree = "<group>";
@@ -3004,7 +3041,7 @@
 			children = (
 				5123CF18133D25E60056F800 /* cg */,
 				6EE849C41368D9040038D481 /* mac */,
-				BCB63477116BF10600603215 /* WebKit2.h */,
+				BCB63477116BF10600603215 /* WebKit2_C.h */,
 				BCDDB32C124EC2E10048D13C /* WKAPICast.h */,
 				517A33B3130B308C00F80CB5 /* WKApplicationCacheManager.cpp */,
 				517A33B4130B308C00F80CB5 /* WKApplicationCacheManager.h */,
@@ -3118,8 +3155,6 @@
 				BC111B19112F5FC500337BAB /* mac */,
 				1AE117F511DBB30900981615 /* ProcessLauncher.cpp */,
 				BC1A7C571136E19C00FB7167 /* ProcessLauncher.h */,
-				BCF50120123ED3B3005955AE /* ThreadLauncher.cpp */,
-				BCF5011F123ED3B3005955AE /* ThreadLauncher.h */,
 			);
 			path = Launcher;
 			sourceTree = "<group>";
@@ -3132,7 +3167,6 @@
 				1A7C6CD81378950800B9C04D /* EnvironmentVariables.cpp */,
 				1A7C6CD91378950800B9C04D /* EnvironmentVariables.h */,
 				BC111B1B112F5FE600337BAB /* ProcessLauncherMac.mm */,
-				BCF501B3123EF602005955AE /* ThreadLauncherMac.mm */,
 			);
 			path = mac;
 			sourceTree = "<group>";
@@ -3159,6 +3193,7 @@
 				BC8699B3116AADAA002A925B /* WKView.mm */,
 				BC8699B4116AADAA002A925B /* WKViewInternal.h */,
 				BFA6179E12F0B99D0033E0CA /* WKViewPrivate.h */,
+				BC59548815C7868500FD1E3E /* WebKit2.h */,
 			);
 			path = mac;
 			sourceTree = "<group>";
@@ -3346,6 +3381,14 @@
 			tabWidth = 8;
 			usesTabs = 0;
 		};
+		BC3DE47815A917C6008D26FC /* WebKit2Service */ = {
+			isa = PBXGroup;
+			children = (
+				BC3DE46C15A91763008D26FC /* Info.plist */,
+			);
+			name = WebKit2Service;
+			sourceTree = "<group>";
+		};
 		BC4075D5124FEFFA0068F20A /* cf */ = {
 			isa = PBXGroup;
 			children = (
@@ -3920,7 +3963,6 @@
 				BCBD3C3B125BFA7A00D2C29F /* StringPairVector.h in Headers */,
 				1AA417CB12C00CCA002BE67B /* TextChecker.h in Headers */,
 				1A5E4DA412D3BD3D0099A2BB /* TextCheckerState.h in Headers */,
-				BCF50121123ED3B3005955AE /* ThreadLauncher.h in Headers */,
 				1AAF263914687C39004A1E8A /* TiledCoreAnimationDrawingArea.h in Headers */,
 				1AF05D8714688348008B1E81 /* TiledCoreAnimationDrawingAreaProxy.h in Headers */,
 				1A64245E12DE29A100CAAE2C /* UpdateInfo.h in Headers */,
@@ -4011,7 +4053,7 @@
 				51A9E1291315ED35009E7031 /* WebKeyValueStorageManagerMessages.h in Headers */,
 				51A9E1061315CCFC009E7031 /* WebKeyValueStorageManagerProxy.h in Headers */,
 				51A9E12B1315ED35009E7031 /* WebKeyValueStorageManagerProxyMessages.h in Headers */,
-				BCB63478116BF10600603215 /* WebKit2.h in Headers */,
+				BCB63478116BF10600603215 /* WebKit2_C.h in Headers */,
 				BC59534210FC04520098F82D /* WebLoaderClient.h in Headers */,
 				33D3A3C2133960B000709BE4 /* WebMediaCacheManager.h in Headers */,
 				33D3A3C91339617900709BE4 /* WebMediaCacheManagerMessages.h in Headers */,
@@ -4204,6 +4246,7 @@
 				51EFC1CF1524E62500C9A938 /* WKBundleDOMWindowExtension.h in Headers */,
 				3F87B9BE158940190090FF62 /* WebColorChooser.h in Headers */,
 				3F87B9C0158940D80090FF62 /* WebColorChooserProxy.h in Headers */,
+				BC59548915C7868500FD1E3E /* WebKit2.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -4289,6 +4332,23 @@
 			productReference = 8DC2EF5B0486A6940098B216 /* WebKit2.framework */;
 			productType = "com.apple.product-type.framework";
 		};
+		BC3DE46515A91763008D26FC /* WebKit2Service */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = BC3DE47615A91764008D26FC /* Build configuration list for PBXNativeTarget "WebKit2Service" */;
+			buildPhases = (
+				BC3DE46215A91763008D26FC /* Sources */,
+				BC3DE46315A91763008D26FC /* Frameworks */,
+				BC3DE46415A91763008D26FC /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = WebKit2Service;
+			productName = WebKit2Service;
+			productReference = BC3DE46615A91763008D26FC /* com.apple.WebKit2.WebKit2Service.xpc */;
+			productType = "com.apple.product-type.bundle";
+		};
 		BCDE093313272496001259FB /* PluginProcess */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = BCDE093E13272496001259FB /* Build configuration list for PBXNativeTarget "PluginProcess" */;
@@ -4326,6 +4386,7 @@
 				Japanese,
 				French,
 				German,
+				en,
 			);
 			mainGroup = 0867D691FE84028FC02AAC07 /* WebKit2 */;
 			productRefGroup = 034768DFFF38A50411DB9C8B /* Products */;
@@ -4339,6 +4400,7 @@
 				C0CE72851247E66800BC0EC4 /* Derived Sources */,
 				1AC25FAF12A48EA700BD2671 /* PluginProcessShim */,
 				510031EA1379CACB00C8DFE4 /* WebProcessShim */,
+				BC3DE46515A91763008D26FC /* WebKit2Service */,
 			);
 		};
 /* End PBXProject section */
@@ -4361,6 +4423,14 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		BC3DE46415A91763008D26FC /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				BC82DF2215BDF42200FC2841 /* com.apple.WebProcess.sb in Resources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		BCDE093813272496001259FB /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -4496,7 +4566,7 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				1A6FA31111E3921E00DB1371 /* MainMac.cpp in Sources */,
+				1A6FA31111E3921E00DB1371 /* MainMacProcess.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -4677,8 +4747,6 @@
 				1A24BF3A120896A600FBB059 /* SharedMemoryMac.cpp in Sources */,
 				5272B28A1406985D0096A5D0 /* StatisticsData.cpp in Sources */,
 				1AA417EF12C00D87002BE67B /* TextCheckerMac.mm in Sources */,
-				BCF50122123ED3B3005955AE /* ThreadLauncher.cpp in Sources */,
-				BCF501B4123EF602005955AE /* ThreadLauncherMac.mm in Sources */,
 				1AAF263814687C39004A1E8A /* TiledCoreAnimationDrawingArea.mm in Sources */,
 				1AF05D8614688348008B1E81 /* TiledCoreAnimationDrawingAreaProxy.mm in Sources */,
 				1A64245F12DE29A100CAAE2C /* UpdateInfo.cpp in Sources */,
@@ -4956,11 +5024,19 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		BC3DE46215A91763008D26FC /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				BC3DE47215A91764008D26FC /* MainMacService.mm in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		BCDE093A13272496001259FB /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				BCDE093B13272496001259FB /* MainMac.cpp in Sources */,
+				BCDE093B13272496001259FB /* MainMacProcess.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -4987,6 +5063,11 @@
 			target = 510031EA1379CACB00C8DFE4 /* WebProcessShim */;
 			targetProxy = 5183B38D1379F54600E8754E /* PBXContainerItemProxy */;
 		};
+		BCA8D46815BCE0D6009DC1F1 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = BC3DE46515A91763008D26FC /* WebKit2Service */;
+			targetProxy = BCA8D46715BCE0D6009DC1F1 /* PBXContainerItemProxy */;
+		};
 		BCDE093413272496001259FB /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = 1AC25FAF12A48EA700BD2671 /* PluginProcessShim */;
@@ -5176,6 +5257,27 @@
 			};
 			name = Production;
 		};
+		BC3DE47315A91764008D26FC /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BCA8D46A15BCE160009DC1F1 /* WebKit2Service.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		BC3DE47415A91764008D26FC /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BCA8D46A15BCE160009DC1F1 /* WebKit2Service.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		BC3DE47515A91764008D26FC /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BCA8D46A15BCE160009DC1F1 /* WebKit2Service.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
 		BCDE093F13272496001259FB /* Debug */ = {
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = BC122FA3132707F300F7EAC1 /* PluginProcess.xcconfig */;
@@ -5289,6 +5391,16 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Production;
 		};
+		BC3DE47615A91764008D26FC /* Build configuration list for PBXNativeTarget "WebKit2Service" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				BC3DE47315A91764008D26FC /* Debug */,
+				BC3DE47415A91764008D26FC /* Release */,
+				BC3DE47515A91764008D26FC /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
 		BCDE093E13272496001259FB /* Build configuration list for PBXNativeTarget "PluginProcess" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
diff --git a/Source/WebKit2/WebKit2Service/Info.plist b/Source/WebKit2/WebKit2Service/Info.plist
new file mode 100644
index 000000000..8a680577e
--- /dev/null
+++ b/Source/WebKit2/WebKit2Service/Info.plist
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleExecutable</key>
+	<string>${EXECUTABLE_NAME}</string>
+	<key>CFBundleIdentifier</key>
+	<string>com.apple.WebKit2Service</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>${PRODUCT_NAME}</string>
+	<key>CFBundlePackageType</key>
+	<string>XPC!</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleVersion</key>
+	<string>1</string>
+	<key>LSFileQuarantineEnabled</key>
+	<true/>
+	<key>NSPrincipalClass</key>
+	<string>NSApplication</string>
+	<key>LSUIElement</key>
+	<true/>
+	<key>XPCService</key>
+	<dict>
+		<key>ServiceType</key>
+		<string>Application</string>
+		<key>RunLoopType</key>
+		<string>_NSApplicationMain</string>
+		<key>_MultipleInstance</key>
+		<true/>
+	</dict>
+</dict>
+</plist>
diff --git a/Source/WebKit2/WebKit2Service/MainMacService.mm b/Source/WebKit2/WebKit2Service/MainMacService.mm
new file mode 100644
index 000000000..a6faf3c40
--- /dev/null
+++ b/Source/WebKit2/WebKit2Service/MainMacService.mm
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <AvailabilityMacros.h>
+
+#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
+
+#include <dlfcn.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <xpc/xpc.h>
+
+extern "C" mach_port_t xpc_dictionary_copy_mach_send(xpc_object_t, const char*);
+
+static void WebKit2ServiceEventHandler(xpc_connection_t peer)
+{
+    xpc_connection_set_target_queue(peer, dispatch_get_main_queue());
+    xpc_connection_set_event_handler(peer, ^(xpc_object_t event) {
+        xpc_type_t type = xpc_get_type(event);
+        if (type == XPC_TYPE_ERROR) {
+            if (event == XPC_ERROR_CONNECTION_INVALID || event == XPC_ERROR_TERMINATION_IMMINENT) {
+                // FIXME: Handle this case more gracefully.
+                exit(EXIT_FAILURE);
+            }
+        } else {
+            assert(type == XPC_TYPE_DICTIONARY);
+
+            if (!strcmp(xpc_dictionary_get_string(event, "message-name"), "bootstrap")) {
+                static void* frameworkLibrary = dlopen(xpc_dictionary_get_string(event, "framework-executable-path"), RTLD_NOW);
+                if (!frameworkLibrary) {
+                    NSLog(@"Unable to load WebKit2.framework: %s\n", dlerror());
+                    exit(EXIT_FAILURE);
+                }
+
+                typedef int (*WebKitMainFunction)(xpc_connection_t connection, mach_port_t serverPort);
+                WebKitMainFunction webKitMainXPC = reinterpret_cast<WebKitMainFunction>(dlsym(frameworkLibrary, "WebKitMainXPC"));
+                if (!webKitMainXPC) {
+                    NSLog(@"Unable to find entry point in WebKit2.framework: %s\n", dlerror());
+                    exit(EXIT_FAILURE);
+                }
+
+                xpc_object_t reply = xpc_dictionary_create_reply(event);
+                xpc_dictionary_set_string(reply, "message-name", "process-finished-launching");
+                xpc_connection_send_message(xpc_dictionary_get_remote_connection(event), reply);
+                xpc_release(reply);
+
+                webKitMainXPC(peer, xpc_dictionary_copy_mach_send(event, "server-port"));
+            }
+        }
+    });
+
+    xpc_connection_resume(peer);
+}
+
+int main(int argc, char** argv)
+{
+    xpc_main(WebKit2ServiceEventHandler);
+    return 0;
+}
+
+#else
+
+int main(int argc, char** argv)
+{
+    return 0;
+}
+
+#endif
diff --git a/Source/WebKit2/WebProcess/Geolocation/WebGeolocationManager.cpp b/Source/WebKit2/WebProcess/Geolocation/WebGeolocationManager.cpp
index 2b976763f..1bdf11d65 100644
--- a/Source/WebKit2/WebProcess/Geolocation/WebGeolocationManager.cpp
+++ b/Source/WebKit2/WebProcess/Geolocation/WebGeolocationManager.cpp
@@ -76,10 +76,10 @@ void WebGeolocationManager::didChangePosition(const WebGeolocationPosition::Data
 #if ENABLE(GEOLOCATION)
     RefPtr<GeolocationPosition> position = GeolocationPosition::create(data.timestamp, data.latitude, data.longitude, data.accuracy);
 
-    HashSet<WebPage*>::const_iterator it = m_pageSet.begin();
-    HashSet<WebPage*>::const_iterator end = m_pageSet.end();
-    for (; it != end; ++it) {
-        WebPage* page = *it;
+    Vector<RefPtr<WebPage> > webPageCopy;
+    copyToVector(m_pageSet, webPageCopy);
+    for (size_t i = 0; i < webPageCopy.size(); ++i) {
+        WebPage* page = webPageCopy[i].get();
         if (page->corePage())
             GeolocationController::from(page->corePage())->positionChanged(position.get());
     }
@@ -92,10 +92,10 @@ void WebGeolocationManager::didFailToDeterminePosition()
     // FIXME: Add localized error string.
     RefPtr<GeolocationError> error = GeolocationError::create(GeolocationError::PositionUnavailable, /* Localized error string */ String(""));
 
-    HashSet<WebPage*>::const_iterator it = m_pageSet.begin();
-    HashSet<WebPage*>::const_iterator end = m_pageSet.end();
-    for (; it != end; ++it) {
-        WebPage* page = *it;
+    Vector<RefPtr<WebPage> > webPageCopy;
+    copyToVector(m_pageSet, webPageCopy);
+    for (size_t i = 0; i < webPageCopy.size(); ++i) {
+        WebPage* page = webPageCopy[i].get();
         if (page->corePage())
             GeolocationController::from(page->corePage())->errorOccurred(error.get());
     }
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
index 55d083b27..ee10e964f 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
@@ -255,3 +255,8 @@ void WKBundleSetPageVisibilityState(WKBundleRef bundleRef, WKBundlePageRef pageR
 {
     toImpl(bundleRef)->setPageVisibilityState(toImpl(pageRef), state, isInitialState);
 }
+
+void WKBundleSetUserStyleSheetLocation(WKBundleRef bundleRef, WKBundlePageGroupRef pageGroupRef, WKStringRef location)
+{
+    toImpl(bundleRef)->setUserStyleSheetLocation(toImpl(pageGroupRef), toImpl(location)->string());
+}
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
index 2ae22371d..1f43a1220 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
@@ -287,21 +287,27 @@ bool WKBundlePageFindString(WKBundlePageRef pageRef, WKStringRef target, WKFindO
     return toImpl(pageRef)->findStringFromInjectedBundle(toImpl(target)->string(), toFindOptions(findOptions));
 }
 
+WKImageRef WKBundlePageCreateSnapshotWithOptions(WKBundlePageRef pageRef, WKRect rect, WKSnapshotOptions options)
+{
+    RefPtr<WebImage> webImage = toImpl(pageRef)->scaledSnapshotWithOptions(toIntRect(rect), 1, toSnapshotOptions(options));
+    return toAPI(webImage.release().leakRef());
+}
+
 WKImageRef WKBundlePageCreateSnapshotInViewCoordinates(WKBundlePageRef pageRef, WKRect rect, WKImageOptions options)
 {
-    RefPtr<WebImage> webImage = toImpl(pageRef)->snapshotInViewCoordinates(toIntRect(rect), toImageOptions(options));
+    RefPtr<WebImage> webImage = toImpl(pageRef)->scaledSnapshotWithOptions(toIntRect(rect), 1, snapshotOptionsFromImageOptions(options));
     return toAPI(webImage.release().leakRef());
 }
 
 WKImageRef WKBundlePageCreateSnapshotInDocumentCoordinates(WKBundlePageRef pageRef, WKRect rect, WKImageOptions options)
 {
-    RefPtr<WebImage> webImage = toImpl(pageRef)->snapshotInDocumentCoordinates(toIntRect(rect), toImageOptions(options));
+    RefPtr<WebImage> webImage = toImpl(pageRef)->scaledSnapshotWithOptions(toIntRect(rect), 1, snapshotOptionsFromImageOptions(options));
     return toAPI(webImage.release().leakRef());
 }
 
 WKImageRef WKBundlePageCreateScaledSnapshotInDocumentCoordinates(WKBundlePageRef pageRef, WKRect rect, double scaleFactor, WKImageOptions options)
 {
-    RefPtr<WebImage> webImage = toImpl(pageRef)->scaledSnapshotInDocumentCoordinates(toIntRect(rect), scaleFactor, toImageOptions(options));
+    RefPtr<WebImage> webImage = toImpl(pageRef)->scaledSnapshotWithOptions(toIntRect(rect), scaleFactor, snapshotOptionsFromImageOptions(options));
     return toAPI(webImage.release().leakRef());
 }
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
index aa8609244..28eee5c73 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
@@ -398,8 +398,14 @@ WK_EXPORT bool WKBundlePageCanHandleRequest(WKURLRequestRef request);
 
 WK_EXPORT bool WKBundlePageFindString(WKBundlePageRef page, WKStringRef target, WKFindOptions findOptions);
 
+WK_EXPORT WKImageRef WKBundlePageCreateSnapshotWithOptions(WKBundlePageRef page, WKRect rect, WKSnapshotOptions options);
+
+// We should deprecate these functions in favor of just using WKBundlePageCreateSnapshotWithOptions.
 WK_EXPORT WKImageRef WKBundlePageCreateSnapshotInViewCoordinates(WKBundlePageRef page, WKRect rect, WKImageOptions options);
 WK_EXPORT WKImageRef WKBundlePageCreateSnapshotInDocumentCoordinates(WKBundlePageRef page, WKRect rect, WKImageOptions options);
+
+// We should keep this function since it allows passing a scale factor, but we should re-name it to
+// WKBundlePageCreateScaledSnapshotWithOptions.
 WK_EXPORT WKImageRef WKBundlePageCreateScaledSnapshotInDocumentCoordinates(WKBundlePageRef page, WKRect rect, double scaleFactor, WKImageOptions options);
 
 WK_EXPORT double WKBundlePageGetBackingScaleFactor(WKBundlePageRef page);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
index 12e933ea8..b5e10e57f 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
@@ -74,6 +74,7 @@ WK_EXPORT void WKBundleSetGeolocationPermission(WKBundleRef bundle, WKBundlePage
 WK_EXPORT void WKBundleSetJavaScriptCanAccessClipboard(WKBundleRef bundle, WKBundlePageGroupRef pageGroup, bool enabled);
 WK_EXPORT void WKBundleSetPrivateBrowsingEnabled(WKBundleRef bundle, WKBundlePageGroupRef pageGroup, bool enabled);
 WK_EXPORT void WKBundleSetPopupBlockingEnabled(WKBundleRef bundle, WKBundlePageGroupRef pageGroup, bool enabled);
+WK_EXPORT void WKBundleSetUserStyleSheetLocation(WKBundleRef bundle, WKBundlePageGroupRef pageGroup, WKStringRef location);
 WK_EXPORT void WKBundleSetAuthorAndUserStylesEnabled(WKBundleRef bundle, WKBundlePageGroupRef pageGroup, bool enabled);
 WK_EXPORT void WKBundleClearAllDatabases(WKBundleRef bundle);
 WK_EXPORT void WKBundleSetDatabaseQuota(WKBundleRef bundle, uint64_t);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
index d809d611b..127715c7a 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
@@ -131,6 +131,30 @@ void InjectedBundle::overrideBoolPreferenceForTestRunner(WebPageGroupProxy* page
 
     // FIXME: Need an explicit way to set "WebKitTabToLinksPreferenceKey" directly in WebPage.
 
+    if (preference == "WebKit2AsynchronousPluginInitializationEnabled") {
+        WebPreferencesStore::overrideBoolValueForKey(WebPreferencesKey::asynchronousPluginInitializationEnabledKey(), enabled);
+        for (HashSet<Page*>::iterator i = pages.begin(); i != pages.end(); ++i) {
+            WebPage* webPage = static_cast<WebFrameLoaderClient*>((*i)->mainFrame()->loader()->client())->webFrame()->page();
+            webPage->setAsynchronousPluginInitializationEnabled(enabled);
+        }
+    }
+
+    if (preference == "WebKit2AsynchronousPluginInitializationEnabledForAllPlugins") {
+        WebPreferencesStore::overrideBoolValueForKey(WebPreferencesKey::asynchronousPluginInitializationEnabledForAllPluginsKey(), enabled);
+        for (HashSet<Page*>::iterator i = pages.begin(); i != pages.end(); ++i) {
+            WebPage* webPage = static_cast<WebFrameLoaderClient*>((*i)->mainFrame()->loader()->client())->webFrame()->page();
+            webPage->setAsynchronousPluginInitializationEnabledForAllPlugins(enabled);
+        }
+    }
+
+    if (preference == "WebKit2ArtificialPluginInitializationDelayEnabled") {
+        WebPreferencesStore::overrideBoolValueForKey(WebPreferencesKey::artificialPluginInitializationDelayEnabledKey(), enabled);
+        for (HashSet<Page*>::iterator i = pages.begin(); i != pages.end(); ++i) {
+            WebPage* webPage = static_cast<WebFrameLoaderClient*>((*i)->mainFrame()->loader()->client())->webFrame()->page();
+            webPage->setArtificialPluginInitializationDelayEnabled(enabled);
+        }
+    }
+
     // Map the names used in LayoutTests with the names used in WebCore::Settings and WebPreferencesStore.
 #define FOR_EACH_OVERRIDE_BOOL_PREFERENCE(macro) \
     macro(WebKitAcceleratedCompositingEnabled, AcceleratedCompositingEnabled, acceleratedCompositingEnabled) \
@@ -479,4 +503,11 @@ void InjectedBundle::setPageVisibilityState(WebPage* page, int state, bool isIni
 #endif
 }
 
+void InjectedBundle::setUserStyleSheetLocation(WebPageGroupProxy* pageGroup, const String& location)
+{
+    const HashSet<Page*>& pages = PageGroup::pageGroup(pageGroup->identifier())->pages();
+    for (HashSet<Page*>::iterator iter = pages.begin(); iter != pages.end(); ++iter)
+        (*iter)->settings()->setUserStyleSheetLocation(KURL(KURL(), location));
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
index f3e36a85d..1e240503b 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
@@ -123,6 +123,7 @@ public:
     int pageNumberForElementById(WebFrame*, const String&, double, double);
     String pageSizeAndMarginsInPixels(WebFrame*, int, int, int, int, int, int, int);
     bool isPageBoxVisible(WebFrame*, int);
+    void setUserStyleSheetLocation(WebPageGroupProxy*, const String&);
 
     // UserContent API
     void addUserScript(WebPageGroupProxy*, InjectedBundleScriptWorld*, const String& source, const String& url, ImmutableArray* whitelist, ImmutableArray* blacklist, WebCore::UserScriptInjectionTime, WebCore::UserContentInjectedFrames);
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
index 4d82cff01..b20743213 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
@@ -548,6 +548,38 @@ bool NetscapePlugin::allowPopups() const
     return false;
 }
 
+#if PLUGIN_ARCHITECTURE(MAC)
+static bool isTransparentSilverlightBackgroundValue(const String& lowercaseBackgroundValue)
+{
+    // This checks if the background color value is transparent, according to
+    // the forumat documented at http://msdn.microsoft.com/en-us/library/cc838148(VS.95).aspx
+    if (lowercaseBackgroundValue.startsWith('#')) {
+        if (lowercaseBackgroundValue.length() == 5 && lowercaseBackgroundValue[1] != 'f') {
+            // An 8-bit RGB value with alpha transparency, in the form #ARGB.
+            return true;
+        }
+
+        if (lowercaseBackgroundValue.length() == 9 && !(lowercaseBackgroundValue[1] == 'f' && lowercaseBackgroundValue[2] == 'f')) {
+            // A 16-bit RGB value with alpha transparency, in the form #AARRGGBB.
+            return true;
+        }
+    } else if (lowercaseBackgroundValue.startsWith("sc#")) {
+        Vector<String> components;
+        lowercaseBackgroundValue.substring(3).split(",", components);
+
+        // An ScRGB value with alpha transparency, in the form sc#A,R,G,B.
+        if (components.size() == 4) {
+            if (components[0].toDouble() < 1)
+                return true;
+        }
+    } else if (lowercaseBackgroundValue == "transparent")
+        return true;
+
+    // This is an opaque color.
+    return false;
+}
+#endif
+
 bool NetscapePlugin::initialize(const Parameters& parameters)
 {
     uint16_t mode = parameters.isFullFramePlugin ? NP_FULL : NP_EMBED;
@@ -581,10 +613,10 @@ bool NetscapePlugin::initialize(const Parameters& parameters)
     }
 
 #if PLUGIN_ARCHITECTURE(MAC)
-    if (m_pluginModule->pluginQuirks().contains(PluginQuirks::MakeTransparentIfBackgroundAttributeExists)) {
+    if (m_pluginModule->pluginQuirks().contains(PluginQuirks::MakeOpaqueUnlessTransparentSilverlightBackgroundAttributeExists)) {
         for (size_t i = 0; i < parameters.names.size(); ++i) {
             if (equalIgnoringCase(parameters.names[i], "background")) {
-                setIsTransparent(true);
+                setIsTransparent(isTransparentSilverlightBackgroundValue(parameters.values[i].lower()));
                 break;
             }
         }
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
index 1c49c6032..8591892b8 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
@@ -54,6 +54,10 @@ public:
 
     static PassRefPtr<NetscapePlugin> fromNPP(NPP);
 
+    // In-process NetscapePlugins don't support asynchronous initialization.
+    virtual void waitForAsynchronousInitialization() { }
+    virtual bool isBeingAsynchronouslyInitialized() const { return false; }
+
 #if PLATFORM(MAC)
     NPError setDrawingModel(NPDrawingModel);
     NPError setEventModel(NPEventModel);
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
index f1fa2f646..8a447df31 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
@@ -1057,6 +1057,27 @@ PlatformLayer* NetscapePlugin::pluginLayer()
     return static_cast<PlatformLayer*>(m_pluginLayer.get());
 }
 
+static void makeCGLPresentLayerOpaque(CALayer *pluginRootLayer)
+{
+    // We look for a layer that's the only sublayer of the root layer that is an instance
+    // of the CGLPresentLayer class which in turn is a subclass of CAOpenGLLayer and make
+    // it opaque if all these conditions hold.
+
+    NSArray *sublayers = [pluginRootLayer sublayers];
+    if ([sublayers count] != 1)
+        return;
+
+    Class cglPresentLayerClass = NSClassFromString(@"CGLPresentLayer");
+    if (![cglPresentLayerClass isSubclassOfClass:[CAOpenGLLayer class]])
+        return;
+
+    CALayer *layer = [sublayers objectAtIndex:0];
+    if (![layer isKindOfClass:cglPresentLayerClass])
+        return;
+
+    [layer setOpaque:YES];
+}
+
 void NetscapePlugin::updatePluginLayer()
 {
     if (m_drawingModel != NPDrawingModelCoreAnimation)
@@ -1086,6 +1107,10 @@ void NetscapePlugin::updatePluginLayer()
         m_pluginLayer = reinterpret_cast<CALayer *>(value);
     else
         m_pluginLayer.adoptNS(reinterpret_cast<CALayer *>(value));
+
+    if (m_pluginModule->pluginQuirks().contains(PluginQuirks::MakeOpaqueUnlessTransparentSilverlightBackgroundAttributeExists) &&
+        !m_isTransparent)
+        makeCGLPresentLayerOpaque(m_pluginLayer.get());
 }
 
 #ifndef NP_NO_CARBON
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
index 6d11c8552..8a7c28a5b 100644
--- a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
@@ -50,6 +50,10 @@ public:
 
     static WebCore::PluginInfo pluginInfo();
 
+    // In-process PDFViews don't support asynchronous initialization.
+    virtual void waitForAsynchronousInitialization() { }
+    virtual bool isBeingAsynchronouslyInitialized() const { return false; }
+
 private:
     explicit BuiltInPDFView(WebFrame*);
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Plugin.h b/Source/WebKit2/WebProcess/Plugins/Plugin.h
index 5be84f476..b91174f9e 100644
--- a/Source/WebKit2/WebProcess/Plugins/Plugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/Plugin.h
@@ -83,6 +83,10 @@ public:
     // Sets the active plug-in controller and initializes the plug-in.
     bool initialize(PluginController*, const Parameters&);
 
+    // Forces synchronous initialization of a plugin previously initialized asynchronously.
+    virtual void waitForAsynchronousInitialization() = 0;
+    virtual bool isBeingAsynchronouslyInitialized() const = 0;
+
     // Destroys the plug-in.
     void destroyPlugin();
 
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginController.h b/Source/WebKit2/WebProcess/Plugins/PluginController.h
index 42c29595e..6682ba020 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginController.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginController.h
@@ -138,6 +138,15 @@ public:
 
     // Returns whether private browsing is enabled.
     virtual bool isPrivateBrowsingEnabled() = 0;
+    
+    // Returns whether or not asynchronous plugin initialization is enabled.
+    virtual bool asynchronousPluginInitializationEnabled() const { return false; }
+    
+    // Returns whether or not asynchronous plugin initialization should be attempted for all plugins.
+    virtual bool asynchronousPluginInitializationEnabledForAllPlugins() const { return false; }
+    
+    // Returns the articifical plugin delay to use for testing of asynchronous plugin initialization.
+    virtual bool artificialPluginInitializationDelayEnabled() const { return false; }
 
     // Increments a counter that prevents the plug-in from being destroyed.
     virtual void protectPluginFromDestruction() = 0;
@@ -151,6 +160,12 @@ public:
     virtual void windowedPluginGeometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect, uint64_t windowID) = 0;
 #endif
 
+    // Called when the a plug-in instance is successfully initialized, either synchronously or asynchronously.
+    virtual void didInitializePlugin() = 0;
+    
+    // Called when the a plug-in instance fails to initialized, either synchronously or asynchronously.
+    virtual void didFailToInitializePlugin() = 0;
+
     // Helper class for delaying destruction of a plug-in.
     class PluginDestructionProtector {
     public:
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
index 8339ad45c..cc313d2e4 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
@@ -73,9 +73,10 @@ static double defaultSyncMessageTimeout(const String& pluginPath)
     return syncMessageTimeout;
 }
 
-PluginProcessConnection::PluginProcessConnection(PluginProcessConnectionManager* pluginProcessConnectionManager, const String& pluginPath, CoreIPC::Connection::Identifier connectionIdentifier)
+PluginProcessConnection::PluginProcessConnection(PluginProcessConnectionManager* pluginProcessConnectionManager, const String& pluginPath, CoreIPC::Connection::Identifier connectionIdentifier, bool supportsAsynchronousPluginInitialization)
     : m_pluginProcessConnectionManager(pluginProcessConnectionManager)
     , m_pluginPath(pluginPath)
+    , m_supportsAsynchronousPluginInitialization(supportsAsynchronousPluginInitialization)
 {
     m_connection = CoreIPC::Connection::createClientConnection(connectionIdentifier, this, WebProcess::shared().runLoop());
 
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
index 61c4ac2a5..bc866d10c 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
@@ -43,9 +43,9 @@ class PluginProxy;
     
 class PluginProcessConnection : public RefCounted<PluginProcessConnection>, CoreIPC::Connection::Client {
 public:
-    static PassRefPtr<PluginProcessConnection> create(PluginProcessConnectionManager* pluginProcessConnectionManager, const String& pluginPath, CoreIPC::Connection::Identifier connectionIdentifier)
+    static PassRefPtr<PluginProcessConnection> create(PluginProcessConnectionManager* pluginProcessConnectionManager, const String& pluginPath, CoreIPC::Connection::Identifier connectionIdentifier, bool supportsAsynchronousPluginInitialization)
     {
-        return adoptRef(new PluginProcessConnection(pluginProcessConnectionManager, pluginPath, connectionIdentifier));
+        return adoptRef(new PluginProcessConnection(pluginProcessConnectionManager, pluginPath, connectionIdentifier, supportsAsynchronousPluginInitialization));
     }
     ~PluginProcessConnection();
 
@@ -58,8 +58,10 @@ public:
 
     NPRemoteObjectMap* npRemoteObjectMap() const { return m_npRemoteObjectMap.get(); }
 
+    bool supportsAsynchronousPluginInitialization() const { return m_supportsAsynchronousPluginInitialization; }
+
 private:
-    PluginProcessConnection(PluginProcessConnectionManager* pluginProcessConnectionManager, const String& pluginPath, CoreIPC::Connection::Identifier connectionIdentifier);
+    PluginProcessConnection(PluginProcessConnectionManager*, const String& pluginPath, CoreIPC::Connection::Identifier connectionIdentifier, bool supportsAsynchronousInitialization);
 
     // CoreIPC::Connection::Client
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
@@ -82,6 +84,8 @@ private:
     HashMap<uint64_t, PluginProxy*> m_plugins;
 
     RefPtr<NPRemoteObjectMap> m_npRemoteObjectMap;
+    
+    bool m_supportsAsynchronousPluginInitialization;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp
index fd1906d7a..b77050992 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp
@@ -57,13 +57,14 @@ PluginProcessConnection* PluginProcessConnectionManager::getPluginProcessConnect
     }
 
     CoreIPC::Attachment encodedConnectionIdentifier;
+    bool supportsAsynchronousInitialization;
     if (!WebProcess::shared().connection()->sendSync(Messages::WebProcessProxy::GetPluginProcessConnection(pluginPath),
-                                                     Messages::WebProcessProxy::GetPluginProcessConnection::Reply(encodedConnectionIdentifier), 0))
+                                                     Messages::WebProcessProxy::GetPluginProcessConnection::Reply(encodedConnectionIdentifier, supportsAsynchronousInitialization), 0))
         return 0;
 
 #if PLATFORM(MAC)
-    CoreIPC::Connection::Identifier connectionIdentifier = encodedConnectionIdentifier.port();
-    if (!connectionIdentifier)
+    CoreIPC::Connection::Identifier connectionIdentifier(encodedConnectionIdentifier.port());
+    if (CoreIPC::Connection::identifierIsNull(connectionIdentifier))
         return 0;
 #elif USE(UNIX_DOMAIN_SOCKETS)
     CoreIPC::Connection::Identifier connectionIdentifier = encodedConnectionIdentifier.fileDescriptor();
@@ -71,7 +72,7 @@ PluginProcessConnection* PluginProcessConnectionManager::getPluginProcessConnect
         return 0;
 #endif
 
-    RefPtr<PluginProcessConnection> pluginProcessConnection = PluginProcessConnection::create(this, pluginPath, connectionIdentifier);
+    RefPtr<PluginProcessConnection> pluginProcessConnection = PluginProcessConnection::create(this, pluginPath, connectionIdentifier, supportsAsynchronousInitialization);
     m_pluginProcessConnections.append(pluginProcessConnection);
 
     {
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
index d4a3549f4..17db25708 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
@@ -68,6 +68,7 @@ PluginProxy::PluginProxy(const String& pluginPath)
     , m_waitingForPaintInResponseToUpdate(false)
     , m_wantsWheelEvents(false)
     , m_remoteLayerClientID(0)
+    , m_waitingOnAsynchronousInitialization(false)
 {
 }
 
@@ -93,38 +94,112 @@ bool PluginProxy::initialize(const Parameters& parameters)
     m_connection->addPluginProxy(this);
 
     // Ask the plug-in process to create a plug-in.
-    PluginCreationParameters creationParameters;
-    creationParameters.pluginInstanceID = m_pluginInstanceID;
-    creationParameters.windowNPObjectID = windowNPObjectID();
-    creationParameters.parameters = parameters;
-    creationParameters.userAgent = controller()->userAgent();
-    creationParameters.contentsScaleFactor = contentsScaleFactor();
-    creationParameters.isPrivateBrowsingEnabled = controller()->isPrivateBrowsingEnabled();
+    m_pendingPluginCreationParameters = adoptPtr(new PluginCreationParameters);
+
+    m_pendingPluginCreationParameters->pluginInstanceID = m_pluginInstanceID;
+    m_pendingPluginCreationParameters->windowNPObjectID = windowNPObjectID();
+    m_pendingPluginCreationParameters->parameters = parameters;
+    m_pendingPluginCreationParameters->userAgent = controller()->userAgent();
+    m_pendingPluginCreationParameters->contentsScaleFactor = contentsScaleFactor();
+    m_pendingPluginCreationParameters->isPrivateBrowsingEnabled = controller()->isPrivateBrowsingEnabled();
+    m_pendingPluginCreationParameters->artificialPluginInitializationDelayEnabled = controller()->artificialPluginInitializationDelayEnabled();
+
 #if USE(ACCELERATED_COMPOSITING)
-    creationParameters.isAcceleratedCompositingEnabled = controller()->isAcceleratedCompositingEnabled();
+    m_pendingPluginCreationParameters->isAcceleratedCompositingEnabled = controller()->isAcceleratedCompositingEnabled();
 #endif
 
+    if (!canInitializeAsynchronously())
+        return initializeSynchronously();
+
+    // Remember that we tried to create this plug-in asynchronously in case we need to create it synchronously later.
+    m_waitingOnAsynchronousInitialization = true;
+    PluginCreationParameters creationParameters(*m_pendingPluginCreationParameters.get());
+    m_connection->connection()->send(Messages::WebProcessConnection::CreatePluginAsynchronously(creationParameters), m_pluginInstanceID);
+    return true;
+}
+
+bool PluginProxy::canInitializeAsynchronously() const
+{
+    return controller()->asynchronousPluginInitializationEnabled() && (m_connection->supportsAsynchronousPluginInitialization() || controller()->asynchronousPluginInitializationEnabledForAllPlugins());
+}
+
+void PluginProxy::waitForAsynchronousInitialization()
+{
+    ASSERT(!m_isStarted);
+    ASSERT(m_waitingOnAsynchronousInitialization);
+
+    initializeSynchronously();
+}
+
+bool PluginProxy::initializeSynchronously()
+{
+    ASSERT(m_pendingPluginCreationParameters);
+
+    m_pendingPluginCreationParameters->asynchronousCreationIncomplete = m_waitingOnAsynchronousInitialization;
     bool result = false;
     bool wantsWheelEvents = false;
     uint32_t remoteLayerClientID = 0;
+    
+    PluginCreationParameters parameters(*m_pendingPluginCreationParameters.get());
 
-    if (!m_connection->connection()->sendSync(Messages::WebProcessConnection::CreatePlugin(creationParameters), Messages::WebProcessConnection::CreatePlugin::Reply(result, wantsWheelEvents, remoteLayerClientID), 0) || !result) {
-        m_connection->removePluginProxy(this);
-        return false;
-    }
+    if (!m_connection->connection()->sendSync(Messages::WebProcessConnection::CreatePlugin(parameters), Messages::WebProcessConnection::CreatePlugin::Reply(result, wantsWheelEvents, remoteLayerClientID), 0) || !result)
+        didFailToCreatePluginInternal();
+    else
+        didCreatePluginInternal(wantsWheelEvents, remoteLayerClientID);
+    
+    return result;
+}
 
+void PluginProxy::didCreatePlugin(bool wantsWheelEvents, uint32_t remoteLayerClientID)
+{
+    // We might have tried to create the plug-in sychronously while waiting on the asynchronous reply,
+    // in which case we should ignore this message.
+    if (!m_waitingOnAsynchronousInitialization)
+        return;
+
+    didCreatePluginInternal(wantsWheelEvents, remoteLayerClientID);
+}
+
+void PluginProxy::didFailToCreatePlugin()
+{
+    // We might have tried to create the plug-in sychronously while waiting on the asynchronous reply,
+    // in which case we should ignore this message.
+    if (!m_waitingOnAsynchronousInitialization)
+        return;
+
+    didFailToCreatePluginInternal();
+}
+
+void PluginProxy::didCreatePluginInternal(bool wantsWheelEvents, uint32_t remoteLayerClientID)
+{
     m_wantsWheelEvents = wantsWheelEvents;
     m_remoteLayerClientID = remoteLayerClientID;
     m_isStarted = true;
+    controller()->didInitializePlugin();
 
-    return true;
+    // Whether synchronously or asynchronously, this plug-in was created and we shouldn't need to remember
+    // anything about how.
+    m_pendingPluginCreationParameters.clear();
+    m_waitingOnAsynchronousInitialization = false;
 }
 
-void PluginProxy::destroy()
+void PluginProxy::didFailToCreatePluginInternal()
 {
-    ASSERT(m_isStarted);
+    // Calling out to the connection and the controller could potentially cause the plug-in proxy to go away, so protect it here.
+    RefPtr<PluginProxy> protect(this);
+
+    m_connection->removePluginProxy(this);
+    controller()->didFailToInitializePlugin();
+
+    // Whether synchronously or asynchronously, this plug-in failed to create and we shouldn't need to remember
+    // anything about how.
+    m_pendingPluginCreationParameters.clear();
+    m_waitingOnAsynchronousInitialization = false;
+}
 
-    m_connection->connection()->sendSync(Messages::WebProcessConnection::DestroyPlugin(m_pluginInstanceID), Messages::WebProcessConnection::DestroyPlugin::Reply(), 0);
+void PluginProxy::destroy()
+{
+    m_connection->connection()->sendSync(Messages::WebProcessConnection::DestroyPlugin(m_pluginInstanceID, m_waitingOnAsynchronousInitialization), Messages::WebProcessConnection::DestroyPlugin::Reply(), 0);
 
     m_isStarted = false;
 
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProxy.h b/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
index be07caa85..c0ca116b0 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
@@ -49,6 +49,8 @@ class ShareableBitmap;
 class NPVariantData;
 class PluginProcessConnection;
 
+struct PluginCreationParameters;
+
 class PluginProxy : public Plugin {
 public:
     static PassRefPtr<PluginProxy> create(const String& pluginPath);
@@ -60,11 +62,16 @@ public:
     void didReceivePluginProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments);
     void didReceiveSyncPluginProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, OwnPtr<CoreIPC::ArgumentEncoder>&);
 
+    bool isBeingAsynchronouslyInitialized() const { return m_waitingOnAsynchronousInitialization; }
+
 private:
     explicit PluginProxy(const String& pluginPath);
 
     // Plugin
     virtual bool initialize(const Parameters&);
+    bool initializeSynchronously();
+
+    virtual void waitForAsynchronousInitialization();
     virtual void destroy();
     virtual void paint(WebCore::GraphicsContext*, const WebCore::IntRect& dirtyRect);
     virtual PassRefPtr<ShareableBitmap> snapshot();
@@ -141,6 +148,14 @@ private:
     void windowedPluginGeometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect, uint64_t windowID);
 #endif
 
+    bool canInitializeAsynchronously() const;
+
+    void didCreatePlugin(bool wantsWheelEvents, uint32_t remoteLayerClientID);
+    void didFailToCreatePlugin();
+    
+    void didCreatePluginInternal(bool wantsWheelEvents, uint32_t remoteLayerClientID);
+    void didFailToCreatePluginInternal();
+
     String m_pluginPath;
 
     RefPtr<PluginProcessConnection> m_connection;
@@ -174,6 +189,9 @@ private:
 
     // The client ID for the CA layer in the plug-in process. Will be 0 if the plug-in is not a CA plug-in.
     uint32_t m_remoteLayerClientID;
+    
+    OwnPtr<PluginCreationParameters> m_pendingPluginCreationParameters;
+    bool m_waitingOnAsynchronousInitialization;
 
 #if PLATFORM(MAC)
     RetainPtr<CALayer> m_pluginLayer;
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProxy.messages.in b/Source/WebKit2/WebProcess/Plugins/PluginProxy.messages.in
index a2ef31965..453c0f1d2 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProxy.messages.in
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProxy.messages.in
@@ -74,6 +74,12 @@ messages -> PluginProxy {
     # Update geometry of windowed plugin widget
     WindowedPluginGeometryDidChange(WebCore::IntRect frameRect, WebCore::IntRect clipRect, uint64_t windowID)
 #endif
+
+    # Tells the WebProcess that the plug-in was successfully initialized asynchronously
+    DidCreatePlugin(bool wantsWheelEvents, uint32_t remoteLayerClientID) -> ()
+    
+    # Tells the WebProcess that the plug-in failed to initialize.
+    DidFailToCreatePlugin() -> ()
 }
 
 #endif
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
index 072a69c9c..d07f8b79d 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
@@ -260,6 +260,7 @@ PluginView::PluginView(PassRefPtr<HTMLPlugInElement> pluginElement, PassRefPtr<P
     , m_webPage(webPage(m_pluginElement.get()))
     , m_parameters(parameters)
     , m_isInitialized(false)
+    , m_isWaitingForSynchronousInitialization(false)
     , m_isWaitingUntilMediaCanStart(false)
     , m_isBeingDestroyed(false)
     , m_pendingURLRequestsTimer(RunLoop::main(), this, &PluginView::pendingURLRequestsTimerFired)
@@ -285,7 +286,7 @@ PluginView::~PluginView()
     for (FrameLoadMap::iterator it = m_pendingFrameLoads.begin(), end = m_pendingFrameLoads.end(); it != end; ++it)
         it->first->setLoadListener(0);
 
-    if (m_plugin && m_isInitialized) {
+    if (m_plugin) {
         m_isBeingDestroyed = true;
         m_plugin->destroyPlugin();
         m_isBeingDestroyed = false;
@@ -487,15 +488,20 @@ void PluginView::initializePlugin()
             }
         }
     }
-    
-    if (!m_plugin->initialize(this, m_parameters)) {
-        // We failed to initialize the plug-in.
-        m_plugin = 0;
 
-        m_webPage->send(Messages::WebPageProxy::DidFailToInitializePlugin(m_parameters.mimeType));
-        return;
-    }
+    m_plugin->initialize(this, m_parameters);
     
+    // Plug-in initialization continued in didFailToInitializePlugin() or didInitializePlugin().
+}
+
+void PluginView::didFailToInitializePlugin()
+{
+    m_plugin = 0;
+    m_webPage->send(Messages::WebPageProxy::DidFailToInitializePlugin(m_parameters.mimeType));
+}
+
+void PluginView::didInitializePlugin()
+{
     m_isInitialized = true;
 
 #if PLATFORM(MAC)
@@ -539,6 +545,19 @@ PlatformLayer* PluginView::platformLayer() const
 
 JSObject* PluginView::scriptObject(JSGlobalObject* globalObject)
 {
+    // If we're already waiting for synchronous initialization of the plugin,
+    // calls to scriptObject() are from the plug-in itself and need to return 0;
+    if (m_isWaitingForSynchronousInitialization)
+        return 0;
+
+    // If the plug-in exists but is not initialized then we're still initializing asynchronously.
+    // We need to wait here until initialization has either succeeded or failed.
+    if (m_plugin->isBeingAsynchronouslyInitialized()) {
+        m_isWaitingForSynchronousInitialization = true;
+        m_plugin->waitForAsynchronousInitialization();
+        m_isWaitingForSynchronousInitialization = false;
+    }
+
     // The plug-in can be null here if it failed to initialize.
     if (!m_isInitialized || !m_plugin)
         return 0;
@@ -1250,6 +1269,21 @@ bool PluginView::isPrivateBrowsingEnabled()
     return settings->privateBrowsingEnabled();
 }
 
+bool PluginView::asynchronousPluginInitializationEnabled() const
+{
+    return m_webPage->asynchronousPluginInitializationEnabled();
+}
+
+bool PluginView::asynchronousPluginInitializationEnabledForAllPlugins() const
+{
+    return m_webPage->asynchronousPluginInitializationEnabledForAllPlugins();
+}
+
+bool PluginView::artificialPluginInitializationDelayEnabled() const
+{
+    return m_webPage->artificialPluginInitializationDelayEnabled();
+}
+
 void PluginView::protectPluginFromDestruction()
 {
     if (!m_isBeingDestroyed)
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginView.h b/Source/WebKit2/WebProcess/Plugins/PluginView.h
index f101b2f4f..a6a056ccd 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginView.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginView.h
@@ -80,7 +80,6 @@ private:
     virtual ~PluginView();
 
     void initializePlugin();
-    void destroyPlugin();
 
     void viewGeometryDidChange();
     void viewVisibilityDidChange();
@@ -164,6 +163,9 @@ private:
     virtual void setCookiesForURL(const String& urlString, const String& cookieString);
     virtual bool getAuthenticationInfo(const WebCore::ProtectionSpace&, String& username, String& password);
     virtual bool isPrivateBrowsingEnabled();
+    virtual bool asynchronousPluginInitializationEnabled() const;
+    virtual bool asynchronousPluginInitializationEnabledForAllPlugins() const;
+    virtual bool artificialPluginInitializationDelayEnabled() const;
     virtual void protectPluginFromDestruction();
     virtual void unprotectPluginFromDestruction();
 #if PLUGIN_ARCHITECTURE(X11)
@@ -171,6 +173,9 @@ private:
     virtual void windowedPluginGeometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect, uint64_t windowID);
 #endif
 
+    virtual void didInitializePlugin();
+    virtual void didFailToInitializePlugin();
+
     // WebFrame::LoadListener
     virtual void didFinishLoad(WebFrame*);
     virtual void didFailLoad(WebFrame*, bool wasCancelled);
@@ -181,6 +186,7 @@ private:
     Plugin::Parameters m_parameters;
     
     bool m_isInitialized;
+    bool m_isWaitingForSynchronousInitialization;
     bool m_isWaitingUntilMediaCanStart;
     bool m_isBeingDestroyed;
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
index 3af596626..c7fc9a7b7 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
@@ -638,7 +638,7 @@ void WebChromeClient::setCursorHiddenUntilMouseMoves(bool hiddenUntilMouseMoves)
 #if ENABLE(REQUEST_ANIMATION_FRAME) && !USE(REQUEST_ANIMATION_FRAME_TIMER)
 void WebChromeClient::scheduleAnimation()
 {
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
     m_page->drawingArea()->layerTreeHost()->scheduleAnimation();
 #endif
 }
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
index fbb824974..ceccd6af1 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -943,7 +943,7 @@ void WebFrameLoaderClient::updateGlobalHistory()
     data.title = loader->title().string();
     data.originalRequest = loader->originalRequestCopy();
 
-    WebProcess::shared().connection()->send(Messages::WebContext::DidNavigateWithNavigationData(webPage->pageID(), data, m_frame->frameID()), 0);
+    WebProcess::shared().connection()->send(Messages::WebProcessProxy::DidNavigateWithNavigationData(webPage->pageID(), data, m_frame->frameID()), 0);
 }
 
 void WebFrameLoaderClient::updateGlobalHistoryRedirectLinks()
@@ -957,13 +957,13 @@ void WebFrameLoaderClient::updateGlobalHistoryRedirectLinks()
 
     // Client redirect
     if (!loader->clientRedirectSourceForHistory().isNull()) {
-        WebProcess::shared().connection()->send(Messages::WebContext::DidPerformClientRedirect(webPage->pageID(),
+        WebProcess::shared().connection()->send(Messages::WebProcessProxy::DidPerformClientRedirect(webPage->pageID(),
             loader->clientRedirectSourceForHistory(), loader->clientRedirectDestinationForHistory(), m_frame->frameID()), 0);
     }
 
     // Server redirect
     if (!loader->serverRedirectSourceForHistory().isNull()) {
-        WebProcess::shared().connection()->send(Messages::WebContext::DidPerformServerRedirect(webPage->pageID(),
+        WebProcess::shared().connection()->send(Messages::WebProcessProxy::DidPerformServerRedirect(webPage->pageID(),
             loader->serverRedirectSourceForHistory(), loader->serverRedirectDestinationForHistory(), m_frame->frameID()), 0);
     }
 }
@@ -1194,7 +1194,7 @@ void WebFrameLoaderClient::setTitle(const StringWithDirection& title, const KURL
         return;
 
     // FIXME: use direction of title.
-    WebProcess::shared().connection()->send(Messages::WebContext::DidUpdateHistoryTitle(webPage->pageID(),
+    WebProcess::shared().connection()->send(Messages::WebProcessProxy::DidUpdateHistoryTitle(webPage->pageID(),
         title.string(), url.string(), m_frame->frameID()), 0);
 }
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebRegisterProtocolHandlerClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebRegisterProtocolHandlerClient.h
index 7019747b9..63f199098 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebRegisterProtocolHandlerClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebRegisterProtocolHandlerClient.h
@@ -26,6 +26,8 @@
 #ifndef WebRegisterProtocolHandlerClient_h
 #define WebRegisterProtocolHandlerClient_h
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+
 #include <WebCore/RegisterProtocolHandlerClient.h>
 #include <wtf/text/WTFString.h>
 
@@ -36,9 +38,7 @@ public:
     virtual ~WebRegisterProtocolHandlerClient() { }
 
 private:
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
     virtual void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title) OVERRIDE { }
-#endif
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
     virtual CustomHandlersState isProtocolHandlerRegistered(const String&, const String&, const String&) { return CustomHandlersDeclined; }
@@ -48,4 +48,5 @@ private:
 
 }
 
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
 #endif // WebRegisterProtocolHandlerClient_h
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp
new file mode 100644
index 000000000..26a7ddb29
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp
@@ -0,0 +1,834 @@
+/*
+ Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if USE(COORDINATED_GRAPHICS)
+#include "CoordinatedGraphicsLayer.h"
+
+#include "BackingStore.h"
+#include "CoordinatedTile.h"
+#include "FloatQuad.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "GraphicsLayer.h"
+#include "LayerTreeCoordinatorProxyMessages.h"
+#include "Page.h"
+#include "TextureMapperPlatformLayer.h"
+#include "WebPage.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/HashMap.h>
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+namespace WebCore {
+
+static HashMap<WebLayerID, CoordinatedGraphicsLayer*>& layerByIDMap()
+{
+    static HashMap<WebLayerID, CoordinatedGraphicsLayer*> globalMap;
+    return globalMap;
+}
+
+CoordinatedGraphicsLayer* CoordinatedGraphicsLayer::layerByID(WebKit::WebLayerID id)
+{
+    HashMap<WebLayerID, CoordinatedGraphicsLayer*>& table = layerByIDMap();
+    HashMap<WebLayerID, CoordinatedGraphicsLayer*>::iterator it = table.find(id);
+    if (it == table.end())
+        return 0;
+    return it->second;
+}
+
+static WebLayerID toWebLayerID(GraphicsLayer* layer)
+{
+    return layer ? toCoordinatedGraphicsLayer(layer)->id() : 0;
+}
+
+void CoordinatedGraphicsLayer::didChangeLayerState()
+{
+    m_shouldSyncLayerState = true;
+    if (client())
+        client()->notifySyncRequired(this);
+}
+
+void CoordinatedGraphicsLayer::didChangeAnimatedProperties()
+{
+    m_shouldSyncAnimatedProperties = true;
+    if (client())
+        client()->notifySyncRequired(this);
+}
+
+void CoordinatedGraphicsLayer::didChangeChildren()
+{
+    m_shouldSyncChildren = true;
+    if (client())
+        client()->notifySyncRequired(this);
+}
+
+#if ENABLE(CSS_FILTERS)
+void CoordinatedGraphicsLayer::didChangeFilters()
+{
+    m_shouldSyncFilters = true;
+    if (client())
+        client()->notifySyncRequired(this);
+}
+#endif
+
+void CoordinatedGraphicsLayer::setShouldUpdateVisibleRect()
+{
+    if (!transform().isAffine())
+        return;
+
+    m_shouldUpdateVisibleRect = true;
+    for (size_t i = 0; i < children().size(); ++i)
+        toCoordinatedGraphicsLayer(children()[i])->setShouldUpdateVisibleRect();
+    if (replicaLayer())
+        toCoordinatedGraphicsLayer(replicaLayer())->setShouldUpdateVisibleRect();
+}
+
+void CoordinatedGraphicsLayer::didChangeGeometry()
+{
+    didChangeLayerState();
+    setShouldUpdateVisibleRect();
+}
+
+CoordinatedGraphicsLayer::CoordinatedGraphicsLayer(GraphicsLayerClient* client)
+    : GraphicsLayer(client)
+    , m_maskTarget(0)
+    , m_inUpdateMode(false)
+    , m_shouldUpdateVisibleRect(true)
+    , m_shouldSyncLayerState(true)
+    , m_shouldSyncChildren(true)
+    , m_shouldSyncFilters(true)
+    , m_shouldSyncAnimatedProperties(true)
+    , m_fixedToViewport(false)
+    , m_canvasNeedsDisplay(false)
+    , m_CoordinatedGraphicsLayerClient(0)
+    , m_contentsScale(1)
+    , m_canvasPlatformLayer(0)
+    , m_animationStartedTimer(this, &CoordinatedGraphicsLayer::animationStartedTimerFired)
+{
+    static WebLayerID nextLayerID = 1;
+    m_id = nextLayerID++;
+    layerByIDMap().add(id(), this);
+}
+
+CoordinatedGraphicsLayer::~CoordinatedGraphicsLayer()
+{
+    layerByIDMap().remove(id());
+
+    if (m_CoordinatedGraphicsLayerClient) {
+        purgeBackingStores();
+        m_CoordinatedGraphicsLayerClient->detachLayer(this);
+    }
+    willBeDestroyed();
+}
+
+void CoordinatedGraphicsLayer::willBeDestroyed()
+{
+    GraphicsLayer::willBeDestroyed();
+}
+
+bool CoordinatedGraphicsLayer::setChildren(const Vector<GraphicsLayer*>& children)
+{
+    bool ok = GraphicsLayer::setChildren(children);
+    if (!ok)
+        return false;
+    for (int i = 0; i < children.size(); ++i) {
+        CoordinatedGraphicsLayer* child = toCoordinatedGraphicsLayer(children[i]);
+        child->setCoordinatedGraphicsLayerClient(m_CoordinatedGraphicsLayerClient);
+        child->didChangeLayerState();
+    }
+    didChangeChildren();
+    return true;
+}
+
+void CoordinatedGraphicsLayer::addChild(GraphicsLayer* layer)
+{
+    GraphicsLayer::addChild(layer);
+    toCoordinatedGraphicsLayer(layer)->setCoordinatedGraphicsLayerClient(m_CoordinatedGraphicsLayerClient);
+    toCoordinatedGraphicsLayer(layer)->didChangeLayerState();
+    didChangeChildren();
+}
+
+void CoordinatedGraphicsLayer::addChildAtIndex(GraphicsLayer* layer, int index)
+{
+    GraphicsLayer::addChildAtIndex(layer, index);
+    toCoordinatedGraphicsLayer(layer)->setCoordinatedGraphicsLayerClient(m_CoordinatedGraphicsLayerClient);
+    toCoordinatedGraphicsLayer(layer)->didChangeLayerState();
+    didChangeChildren();
+}
+
+void CoordinatedGraphicsLayer::addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling)
+{
+    GraphicsLayer::addChildAbove(layer, sibling);
+    toCoordinatedGraphicsLayer(layer)->setCoordinatedGraphicsLayerClient(m_CoordinatedGraphicsLayerClient);
+    toCoordinatedGraphicsLayer(layer)->didChangeLayerState();
+    didChangeChildren();
+}
+
+void CoordinatedGraphicsLayer::addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling)
+{
+    GraphicsLayer::addChildBelow(layer, sibling);
+    toCoordinatedGraphicsLayer(layer)->setCoordinatedGraphicsLayerClient(m_CoordinatedGraphicsLayerClient);
+    toCoordinatedGraphicsLayer(layer)->didChangeLayerState();
+    didChangeChildren();
+}
+
+bool CoordinatedGraphicsLayer::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
+{
+    bool ok = GraphicsLayer::replaceChild(oldChild, newChild);
+    if (!ok)
+        return false;
+    didChangeChildren();
+    toCoordinatedGraphicsLayer(oldChild)->didChangeLayerState();
+    toCoordinatedGraphicsLayer(newChild)->setCoordinatedGraphicsLayerClient(m_CoordinatedGraphicsLayerClient);
+    toCoordinatedGraphicsLayer(newChild)->didChangeLayerState();
+    return true;
+}
+
+void CoordinatedGraphicsLayer::removeFromParent()
+{
+    if (CoordinatedGraphicsLayer* parentLayer = toCoordinatedGraphicsLayer(parent()))
+        parentLayer->didChangeChildren();
+    GraphicsLayer::removeFromParent();
+
+    didChangeLayerState();
+}
+
+void CoordinatedGraphicsLayer::setPosition(const FloatPoint& p)
+{
+    if (position() == p)
+        return;
+
+    GraphicsLayer::setPosition(p);
+    didChangeGeometry();
+}
+
+void CoordinatedGraphicsLayer::setAnchorPoint(const FloatPoint3D& p)
+{
+    if (anchorPoint() == p)
+        return;
+
+    GraphicsLayer::setAnchorPoint(p);
+    didChangeGeometry();
+}
+
+void CoordinatedGraphicsLayer::setSize(const FloatSize& size)
+{
+    if (this->size() == size)
+        return;
+
+    GraphicsLayer::setSize(size);
+    setNeedsDisplay();
+    if (maskLayer())
+        maskLayer()->setSize(size);
+    didChangeGeometry();
+}
+
+void CoordinatedGraphicsLayer::setTransform(const TransformationMatrix& t)
+{
+    if (transform() == t)
+        return;
+
+    GraphicsLayer::setTransform(t);
+    didChangeGeometry();
+}
+
+void CoordinatedGraphicsLayer::setChildrenTransform(const TransformationMatrix& t)
+{
+    if (childrenTransform() == t)
+        return;
+
+    GraphicsLayer::setChildrenTransform(t);
+    didChangeGeometry();
+}
+
+void CoordinatedGraphicsLayer::setPreserves3D(bool b)
+{
+    if (preserves3D() == b)
+        return;
+
+    GraphicsLayer::setPreserves3D(b);
+    didChangeGeometry();
+}
+
+void CoordinatedGraphicsLayer::setMasksToBounds(bool b)
+{
+    if (masksToBounds() == b)
+        return;
+    GraphicsLayer::setMasksToBounds(b);
+    didChangeGeometry();
+}
+
+void CoordinatedGraphicsLayer::setDrawsContent(bool b)
+{
+    if (drawsContent() == b)
+        return;
+    GraphicsLayer::setDrawsContent(b);
+
+    didChangeLayerState();
+}
+
+void CoordinatedGraphicsLayer::setContentsVisible(bool b)
+{
+    if (contentsAreVisible() == b)
+        return;
+    GraphicsLayer::setContentsVisible(b);
+
+    didChangeLayerState();
+}
+
+void CoordinatedGraphicsLayer::setContentsOpaque(bool b)
+{
+    if (contentsOpaque() == b)
+        return;
+    if (m_mainBackingStore)
+        m_mainBackingStore->setSupportsAlpha(!b);
+    GraphicsLayer::setContentsOpaque(b);
+    didChangeLayerState();
+}
+
+void CoordinatedGraphicsLayer::setBackfaceVisibility(bool b)
+{
+    if (backfaceVisibility() == b)
+        return;
+
+    GraphicsLayer::setBackfaceVisibility(b);
+    didChangeLayerState();
+}
+
+void CoordinatedGraphicsLayer::setOpacity(float opacity)
+{
+    if (this->opacity() == opacity)
+        return;
+
+    GraphicsLayer::setOpacity(opacity);
+    didChangeLayerState();
+}
+
+void CoordinatedGraphicsLayer::setContentsRect(const IntRect& r)
+{
+    if (contentsRect() == r)
+        return;
+
+    GraphicsLayer::setContentsRect(r);
+    didChangeLayerState();
+}
+
+void CoordinatedGraphicsLayer::setContentsNeedsDisplay()
+{
+    RefPtr<Image> image = m_image;
+    setContentsToImage(0);
+    setContentsToImage(image.get());
+    m_canvasNeedsDisplay = true;
+    if (client())
+        client()->notifySyncRequired(this);
+}
+
+void CoordinatedGraphicsLayer::setContentsToCanvas(PlatformLayer* platformLayer)
+{
+    m_canvasPlatformLayer = platformLayer;
+    m_canvasNeedsDisplay = true;
+    if (client())
+        client()->notifySyncRequired(this);
+}
+
+#if ENABLE(CSS_FILTERS)
+bool CoordinatedGraphicsLayer::setFilters(const FilterOperations& newFilters)
+{
+    if (filters() == newFilters)
+        return true;
+    didChangeFilters();
+    return GraphicsLayer::setFilters(newFilters);
+}
+#endif
+
+
+void CoordinatedGraphicsLayer::setContentsToImage(Image* image)
+{
+    if (image == m_image)
+        return;
+    int64_t newID = 0;
+    if (m_CoordinatedGraphicsLayerClient) {
+        // We adopt first, in case this is the same frame - that way we avoid destroying and recreating the image.
+        newID = m_CoordinatedGraphicsLayerClient->adoptImageBackingStore(image);
+        m_CoordinatedGraphicsLayerClient->releaseImageBackingStore(m_layerInfo.imageBackingStoreID);
+        didChangeLayerState();
+        if (m_layerInfo.imageBackingStoreID && newID == m_layerInfo.imageBackingStoreID)
+            return;
+    } else {
+        // If m_CoordinatedGraphicsLayerClient is not set yet there should be no backing store ID.
+        ASSERT(!m_layerInfo.imageBackingStoreID);
+        didChangeLayerState();
+    }
+
+    m_layerInfo.imageBackingStoreID = newID;
+    m_image = image;
+    GraphicsLayer::setContentsToImage(image);
+}
+
+void CoordinatedGraphicsLayer::setMaskLayer(GraphicsLayer* layer)
+{
+    if (layer == maskLayer())
+        return;
+
+    GraphicsLayer::setMaskLayer(layer);
+
+    if (!layer)
+        return;
+
+    layer->setSize(size());
+    CoordinatedGraphicsLayer* CoordinatedGraphicsLayer = toCoordinatedGraphicsLayer(layer);
+    CoordinatedGraphicsLayer->setCoordinatedGraphicsLayerClient(m_CoordinatedGraphicsLayerClient);
+    CoordinatedGraphicsLayer->setMaskTarget(this);
+    CoordinatedGraphicsLayer->didChangeLayerState();
+    didChangeLayerState();
+
+}
+
+void CoordinatedGraphicsLayer::setReplicatedByLayer(GraphicsLayer* layer)
+{
+    if (layer == replicaLayer())
+        return;
+
+    if (layer)
+        toCoordinatedGraphicsLayer(layer)->setCoordinatedGraphicsLayerClient(m_CoordinatedGraphicsLayerClient);
+
+    GraphicsLayer::setReplicatedByLayer(layer);
+    didChangeLayerState();
+}
+
+void CoordinatedGraphicsLayer::setNeedsDisplay()
+{
+    setNeedsDisplayInRect(IntRect(IntPoint::zero(), IntSize(size().width(), size().height())));
+}
+
+void CoordinatedGraphicsLayer::setNeedsDisplayInRect(const FloatRect& rect)
+{
+    if (m_mainBackingStore)
+        m_mainBackingStore->invalidate(IntRect(rect));
+    didChangeLayerState();
+}
+
+WebLayerID CoordinatedGraphicsLayer::id() const
+{
+    return m_id;
+}
+
+void CoordinatedGraphicsLayer::syncCompositingState(const FloatRect& rect)
+{
+    if (CoordinatedGraphicsLayer* mask = toCoordinatedGraphicsLayer(maskLayer()))
+        mask->syncCompositingStateForThisLayerOnly();
+
+    if (CoordinatedGraphicsLayer* replica = toCoordinatedGraphicsLayer(replicaLayer()))
+        replica->syncCompositingStateForThisLayerOnly();
+
+    m_CoordinatedGraphicsLayerClient->syncFixedLayers();
+
+    syncCompositingStateForThisLayerOnly();
+
+    for (size_t i = 0; i < children().size(); ++i)
+        children()[i]->syncCompositingState(rect);
+}
+
+CoordinatedGraphicsLayer* toCoordinatedGraphicsLayer(GraphicsLayer* layer)
+{
+    return static_cast<CoordinatedGraphicsLayer*>(layer);
+}
+
+void CoordinatedGraphicsLayer::syncChildren()
+{
+    if (!m_shouldSyncChildren)
+        return;
+    m_shouldSyncChildren = false;
+    Vector<WebLayerID> childIDs;
+    for (size_t i = 0; i < children().size(); ++i)
+        childIDs.append(toWebLayerID(children()[i]));
+
+    m_CoordinatedGraphicsLayerClient->syncLayerChildren(m_id, childIDs);
+}
+
+#if ENABLE(CSS_FILTERS)
+void CoordinatedGraphicsLayer::syncFilters()
+{
+    if (!m_shouldSyncFilters)
+        return;
+    m_shouldSyncFilters = false;
+    m_CoordinatedGraphicsLayerClient->syncLayerFilters(m_id, filters());
+}
+#endif
+
+void CoordinatedGraphicsLayer::syncLayerState()
+{
+    if (!m_shouldSyncLayerState)
+        return;
+    m_shouldSyncLayerState = false;
+    m_layerInfo.fixedToViewport = fixedToViewport();
+
+    m_layerInfo.anchorPoint = anchorPoint();
+    m_layerInfo.backfaceVisible = backfaceVisibility();
+    m_layerInfo.childrenTransform = childrenTransform();
+    m_layerInfo.contentsOpaque = contentsOpaque();
+    m_layerInfo.contentsRect = contentsRect();
+    m_layerInfo.drawsContent = drawsContent();
+    m_layerInfo.contentsVisible = contentsAreVisible();
+    m_layerInfo.mask = toWebLayerID(maskLayer());
+    m_layerInfo.masksToBounds = masksToBounds();
+    m_layerInfo.opacity = opacity();
+    m_layerInfo.parent = toWebLayerID(parent());
+    m_layerInfo.pos = position();
+    m_layerInfo.preserves3D = preserves3D();
+    m_layerInfo.replica = toWebLayerID(replicaLayer());
+    m_layerInfo.size = size();
+    m_layerInfo.transform = transform();
+    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyWebkitTransform))
+        m_effectiveTransform = transform();
+    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyOpacity))
+        m_effectiveOpacity = opacity();
+    m_CoordinatedGraphicsLayerClient->syncLayerState(m_id, m_layerInfo);
+}
+
+void CoordinatedGraphicsLayer::syncAnimatedProperties()
+{
+    m_animations.apply(this);
+    if (!m_shouldSyncAnimatedProperties)
+        return;
+
+    m_shouldSyncAnimatedProperties = true;
+    if (m_effectiveOpacity != opacity())
+        m_CoordinatedGraphicsLayerClient->setLayerAnimatedOpacity(id(), m_effectiveOpacity);
+    if (m_effectiveTransform != transform())
+        m_CoordinatedGraphicsLayerClient->setLayerAnimatedTransform(id(), m_effectiveTransform);
+}
+
+
+void CoordinatedGraphicsLayer::syncCanvas()
+{
+    if (!m_canvasNeedsDisplay)
+        return;
+
+    if (!m_canvasPlatformLayer)
+        return;
+
+#if USE(GRAPHICS_SURFACE)
+    uint32_t graphicsSurfaceToken = m_canvasPlatformLayer->copyToGraphicsSurface();
+    m_CoordinatedGraphicsLayerClient->syncCanvas(m_id, IntSize(size().width(), size().height()), graphicsSurfaceToken);
+#endif
+    m_canvasNeedsDisplay = false;
+}
+
+void CoordinatedGraphicsLayer::ensureImageBackingStore()
+{
+    if (!m_image)
+        return;
+    if (!m_layerInfo.imageBackingStoreID)
+        m_layerInfo.imageBackingStoreID = m_CoordinatedGraphicsLayerClient->adoptImageBackingStore(m_image.get());
+}
+
+void CoordinatedGraphicsLayer::syncCompositingStateForThisLayerOnly()
+{
+    // The remote image might have been released by purgeBackingStores.
+    ensureImageBackingStore();
+    syncLayerState();
+    syncAnimatedProperties();
+    computeTransformedVisibleRect();
+    syncChildren();
+#if ENABLE(CSS_FILTERS)
+    syncFilters();
+#endif
+    updateContentBuffers();
+    syncCanvas();
+}
+
+void CoordinatedGraphicsLayer::tiledBackingStorePaintBegin()
+{
+}
+
+void CoordinatedGraphicsLayer::setRootLayer(bool isRoot)
+{
+    m_layerInfo.isRootLayer = isRoot;
+    didChangeLayerState();
+}
+
+void CoordinatedGraphicsLayer::setVisibleContentRectTrajectoryVector(const FloatPoint& trajectoryVector)
+{
+    if (m_mainBackingStore)
+        m_mainBackingStore->coverWithTilesIfNeeded(trajectoryVector);
+}
+
+void CoordinatedGraphicsLayer::setContentsScale(float scale)
+{
+    m_contentsScale = scale;
+    adjustContentsScale();
+}
+
+float CoordinatedGraphicsLayer::effectiveContentsScale()
+{
+    return shouldUseTiledBackingStore() ? m_contentsScale : 1;
+}
+
+void CoordinatedGraphicsLayer::adjustContentsScale()
+{
+    if (!drawsContent())
+        return;
+
+    if (!m_mainBackingStore || m_mainBackingStore->contentsScale() == effectiveContentsScale())
+        return;
+
+    // Between creating the new backing store and painting the content,
+    // we do not want to drop the previous one as that might result in
+    // briefly seeing flickering as the old tiles may be dropped before
+    // something replaces them.
+    m_previousBackingStore = m_mainBackingStore.release();
+
+    // No reason to save the previous backing store for non-visible areas.
+    m_previousBackingStore->removeAllNonVisibleTiles();
+
+    createBackingStore();
+}
+
+void CoordinatedGraphicsLayer::createBackingStore()
+{
+    m_mainBackingStore = adoptPtr(new TiledBackingStore(this, CoordinatedTileBackend::create(this)));
+    m_mainBackingStore->setSupportsAlpha(!contentsOpaque());
+    m_mainBackingStore->setContentsScale(effectiveContentsScale());
+}
+
+void CoordinatedGraphicsLayer::tiledBackingStorePaint(GraphicsContext* context, const IntRect& rect)
+{
+    if (rect.isEmpty())
+        return;
+    paintGraphicsLayerContents(*context, rect);
+}
+
+void CoordinatedGraphicsLayer::tiledBackingStorePaintEnd(const Vector<IntRect>& updatedRects)
+{
+}
+
+bool CoordinatedGraphicsLayer::tiledBackingStoreUpdatesAllowed() const
+{
+    if (!m_inUpdateMode)
+        return false;
+    return m_CoordinatedGraphicsLayerClient->layerTreeTileUpdatesAllowed();
+}
+
+IntRect CoordinatedGraphicsLayer::tiledBackingStoreContentsRect()
+{
+    return IntRect(0, 0, size().width(), size().height());
+}
+
+bool CoordinatedGraphicsLayer::shouldUseTiledBackingStore()
+{
+    return !selfOrAncestorHaveNonAffineTransforms();
+}
+
+IntRect CoordinatedGraphicsLayer::tiledBackingStoreVisibleRect()
+{
+    if (!shouldUseTiledBackingStore())
+        return tiledBackingStoreContentsRect();
+
+    // Non-invertible layers are not visible.
+    if (!m_layerTransform.combined().isInvertible())
+        return IntRect();
+
+    // Return a projection of the visible rect (surface coordinates) onto the layer's plane (layer coordinates).
+    // The resulting quad might be squewed and the visible rect is the bounding box of this quad,
+    // so it might spread further than the real visible area (and then even more amplified by the cover rect multiplier).
+    return enclosingIntRect(m_layerTransform.combined().inverse().clampedBoundsOfProjectedQuad(FloatQuad(FloatRect(m_CoordinatedGraphicsLayerClient->visibleContentsRect()))));
+}
+
+Color CoordinatedGraphicsLayer::tiledBackingStoreBackgroundColor() const
+{
+    return contentsOpaque() ? Color::white : Color::transparent;
+}
+
+PassOwnPtr<WebCore::GraphicsContext> CoordinatedGraphicsLayer::beginContentUpdate(const WebCore::IntSize& size, ShareableSurface::Handle& handle, WebCore::IntPoint& offset)
+{
+    return m_CoordinatedGraphicsLayerClient->beginContentUpdate(size, contentsOpaque() ? 0 : ShareableBitmap::SupportsAlpha, handle, offset);
+}
+
+void CoordinatedGraphicsLayer::createTile(int tileID, const SurfaceUpdateInfo& updateInfo, const IntRect& targetRect)
+{
+    m_CoordinatedGraphicsLayerClient->createTile(id(), tileID, updateInfo, targetRect);
+}
+
+void CoordinatedGraphicsLayer::updateTile(int tileID, const SurfaceUpdateInfo& updateInfo, const IntRect& targetRect)
+{
+    m_CoordinatedGraphicsLayerClient->updateTile(id(), tileID, updateInfo, targetRect);
+}
+
+void CoordinatedGraphicsLayer::removeTile(int tileID)
+{
+    m_CoordinatedGraphicsLayerClient->removeTile(id(), tileID);
+}
+
+void CoordinatedGraphicsLayer::updateContentBuffers()
+{
+    if (!drawsContent()) {
+        m_mainBackingStore.clear();
+        m_previousBackingStore.clear();
+        return;
+    }
+
+    m_inUpdateMode = true;
+    // This is the only place we (re)create the main tiled backing store, once we
+    // have a remote client and we are ready to send our data to the UI process.
+    if (!m_mainBackingStore)
+        createBackingStore();
+    m_mainBackingStore->updateTileBuffers();
+    m_inUpdateMode = false;
+
+    // The previous backing store is kept around to avoid flickering between
+    // removing the existing tiles and painting the new ones. The first time
+    // the visibleRect is full painted we remove the previous backing store.
+    if (m_mainBackingStore->visibleAreaIsCovered())
+        m_previousBackingStore.clear();
+}
+
+void CoordinatedGraphicsLayer::purgeBackingStores()
+{
+    m_mainBackingStore.clear();
+    m_previousBackingStore.clear();
+
+    if (m_layerInfo.imageBackingStoreID) {
+        m_CoordinatedGraphicsLayerClient->releaseImageBackingStore(m_layerInfo.imageBackingStoreID);
+        m_layerInfo.imageBackingStoreID = 0;
+    }
+
+    didChangeLayerState();
+    didChangeChildren();
+}
+
+void CoordinatedGraphicsLayer::setCoordinatedGraphicsLayerClient(WebKit::CoordinatedGraphicsLayerClient* client)
+{
+    if (m_CoordinatedGraphicsLayerClient == client)
+        return;
+
+    if (CoordinatedGraphicsLayer* replica = toCoordinatedGraphicsLayer(replicaLayer()))
+        replica->setCoordinatedGraphicsLayerClient(client);
+    if (CoordinatedGraphicsLayer* mask = toCoordinatedGraphicsLayer(maskLayer()))
+        mask->setCoordinatedGraphicsLayerClient(client);
+    for (size_t i = 0; i < children().size(); ++i) {
+        CoordinatedGraphicsLayer* layer = toCoordinatedGraphicsLayer(this->children()[i]);
+        layer->setCoordinatedGraphicsLayerClient(client);
+    }
+
+    // We have to release resources on the UI process here if the remote client has changed or is removed.
+    if (m_CoordinatedGraphicsLayerClient) {
+        purgeBackingStores();
+        m_CoordinatedGraphicsLayerClient->detachLayer(this);
+    }
+    m_CoordinatedGraphicsLayerClient = client;
+    if (client)
+        client->attachLayer(this);
+}
+
+void CoordinatedGraphicsLayer::adjustVisibleRect()
+{
+    if (m_mainBackingStore)
+        m_mainBackingStore->coverWithTilesIfNeeded();
+}
+
+void CoordinatedGraphicsLayer::computeTransformedVisibleRect()
+{
+    if (!m_shouldUpdateVisibleRect)
+        return;
+    m_shouldUpdateVisibleRect = false;
+    m_layerTransform.setLocalTransform(m_effectiveTransform);
+    m_layerTransform.setPosition(position());
+    m_layerTransform.setAnchorPoint(anchorPoint());
+    m_layerTransform.setSize(size());
+    m_layerTransform.setFlattening(!preserves3D());
+    m_layerTransform.setChildrenTransform(childrenTransform());
+    m_layerTransform.combineTransforms(parent() ? toCoordinatedGraphicsLayer(parent())->m_layerTransform.combinedForChildren() : TransformationMatrix());
+
+    // The combined transform will be used in tiledBackingStoreVisibleRect.
+    adjustVisibleRect();
+    adjustContentsScale();
+}
+
+static PassOwnPtr<GraphicsLayer> createCoordinatedGraphicsLayer(GraphicsLayerClient* client)
+{
+    return adoptPtr(new CoordinatedGraphicsLayer(client));
+}
+
+void CoordinatedGraphicsLayer::initFactory()
+{
+    GraphicsLayer::setGraphicsLayerFactory(createCoordinatedGraphicsLayer);
+}
+
+bool CoordinatedGraphicsLayer::selfOrAncestorHaveNonAffineTransforms()
+{
+    if (!m_layerTransform.combined().isAffine())
+        return true;
+
+    return false;
+}
+
+bool CoordinatedGraphicsLayer::addAnimation(const KeyframeValueList& valueList, const IntSize& boxSize, const Animation* anim, const String& keyframesName, double timeOffset)
+{
+    ASSERT(!keyframesName.isEmpty());
+
+    if (!anim || anim->isEmptyOrZeroDuration() || valueList.size() < 2 || (valueList.property() != AnimatedPropertyWebkitTransform && valueList.property() != AnimatedPropertyOpacity))
+        return false;
+
+    bool listsMatch = false;
+    bool ignoredHasBigRotation;
+
+    if (valueList.property() == AnimatedPropertyWebkitTransform)
+        listsMatch = validateTransformOperations(valueList, ignoredHasBigRotation) >= 0;
+
+    m_animations.add(GraphicsLayerAnimation(keyframesName, valueList, boxSize, anim, timeOffset, listsMatch));
+    m_animationStartedTimer.startOneShot(0);
+    didChangeLayerState();
+    return true;
+}
+
+void CoordinatedGraphicsLayer::pauseAnimation(const String& animationName, double timeOffset)
+{
+    m_animations.pause(animationName, timeOffset);
+}
+
+void CoordinatedGraphicsLayer::removeAnimation(const String& animationName)
+{
+    m_animations.remove(animationName);
+}
+
+void CoordinatedGraphicsLayer::animationStartedTimerFired(Timer<CoordinatedGraphicsLayer>*)
+{
+    client()->notifyAnimationStarted(this, /* DOM time */ WTF::currentTime());
+}
+
+void CoordinatedGraphicsLayer::setAnimatedTransform(const TransformationMatrix& transform)
+{
+    m_effectiveTransform = transform;
+    didChangeAnimatedProperties();
+    m_shouldUpdateVisibleRect = true;
+}
+
+void CoordinatedGraphicsLayer::setAnimatedOpacity(float opacity)
+{
+    m_effectiveOpacity = opacity;
+    didChangeAnimatedProperties();
+}
+
+}
+#endif
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.h b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h
index 9ce8ecdad..25ccd9454 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.h
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h
@@ -18,18 +18,19 @@
  */
 
 
-#ifndef WebGraphicsLayer_h
-#define WebGraphicsLayer_h
+#ifndef CoordinatedGraphicsLayer_h
+#define CoordinatedGraphicsLayer_h
 
+#include "CoordinatedTile.h"
 #include "FloatPoint3D.h"
 #include "GraphicsLayer.h"
+#include "GraphicsLayerAnimation.h"
 #include "GraphicsLayerTransform.h"
 #include "Image.h"
 #include "IntSize.h"
 #include "ShareableBitmap.h"
 #include "TiledBackingStore.h"
 #include "TiledBackingStoreClient.h"
-#include "TiledBackingStoreRemoteTile.h"
 #include "TransformationMatrix.h"
 #include "UpdateInfo.h"
 #include "WebLayerTreeInfo.h"
@@ -37,16 +38,16 @@
 #include <WebCore/RunLoop.h>
 #include <wtf/text/StringHash.h>
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 namespace WebCore {
-class WebGraphicsLayer;
+class CoordinatedGraphicsLayer;
 }
 
 namespace WebKit {
 
-class WebGraphicsLayerClient {
+class CoordinatedGraphicsLayerClient {
 public:
-    // TiledBackingStoreRemoteTileClient
+    // CoordinatedTileClient
     virtual void createTile(WebLayerID, int tileID, const SurfaceUpdateInfo&, const WebCore::IntRect&) = 0;
     virtual void updateTile(WebLayerID, int tileID, const SurfaceUpdateInfo&, const WebCore::IntRect&) = 0;
     virtual void removeTile(WebLayerID, int tileID) = 0;
@@ -63,8 +64,12 @@ public:
 #if PLATFORM(QT)
     virtual void syncCanvas(WebLayerID, const WebCore::IntSize& canvasSize, uint32_t graphicsSurfaceToken) = 0;
 #endif
-    virtual void attachLayer(WebCore::WebGraphicsLayer*) = 0;
-    virtual void detachLayer(WebCore::WebGraphicsLayer*) = 0;
+
+    virtual void setLayerAnimatedOpacity(WebLayerID, float) = 0;
+    virtual void setLayerAnimatedTransform(WebLayerID, const WebCore::TransformationMatrix&) = 0;
+
+    virtual void attachLayer(WebCore::CoordinatedGraphicsLayer*) = 0;
+    virtual void detachLayer(WebCore::CoordinatedGraphicsLayer*) = 0;
     virtual void syncFixedLayers() = 0;
     virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableBitmap::Flags, ShareableSurface::Handle&, WebCore::IntPoint&) = 0;
 };
@@ -72,12 +77,13 @@ public:
 
 namespace WebCore {
 
-class WebGraphicsLayer : public WebCore::GraphicsLayer
+class CoordinatedGraphicsLayer : public WebCore::GraphicsLayer
                        , public TiledBackingStoreClient
-                       , public WebKit::TiledBackingStoreRemoteTileClient {
+                       , public WebKit::CoordinatedTileClient
+                       , public GraphicsLayerAnimation::Client {
 public:
-    WebGraphicsLayer(GraphicsLayerClient*);
-    virtual ~WebGraphicsLayer();
+    CoordinatedGraphicsLayer(GraphicsLayerClient*);
+    virtual ~CoordinatedGraphicsLayer();
 
     // Reimplementations from GraphicsLayer.h.
     bool setChildren(const Vector<GraphicsLayer*>&);
@@ -95,6 +101,7 @@ public:
     void setPreserves3D(bool);
     void setMasksToBounds(bool);
     void setDrawsContent(bool);
+    void setContentsVisible(bool);
     void setContentsOpaque(bool);
     void setBackfaceVisibility(bool);
     void setOpacity(float);
@@ -117,7 +124,7 @@ public:
     void setRootLayer(bool);
 
     WebKit::WebLayerID id() const;
-    static WebGraphicsLayer* layerByID(WebKit::WebLayerID);
+    static CoordinatedGraphicsLayer* layerByID(WebKit::WebLayerID);
     void didSynchronize();
     Image* image() { return m_image.get(); }
 
@@ -138,13 +145,13 @@ public:
     virtual IntRect tiledBackingStoreVisibleRect();
     virtual Color tiledBackingStoreBackgroundColor() const;
 
-    // TiledBackingStoreRemoteTileClient
+    // CoordinatedTileClient
     virtual void createTile(int tileID, const WebKit::SurfaceUpdateInfo&, const WebCore::IntRect&);
     virtual void updateTile(int tileID, const WebKit::SurfaceUpdateInfo&, const WebCore::IntRect&);
     virtual void removeTile(int tileID);
     virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, WebKit::ShareableSurface::Handle&, WebCore::IntPoint&);
 
-    void setWebGraphicsLayerClient(WebKit::WebGraphicsLayerClient*);
+    void setCoordinatedGraphicsLayerClient(WebKit::CoordinatedGraphicsLayerClient*);
     void syncChildren();
     void syncLayerState();
 #if ENABLE(CSS_FILTERS)
@@ -158,6 +165,14 @@ public:
     void updateContentBuffers();
     void purgeBackingStores();
 
+    // GraphicsLayerAnimation::Client
+    virtual void setAnimatedTransform(const TransformationMatrix&);
+    virtual void setAnimatedOpacity(float);
+
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize&, const Animation*, const String&, double);
+    virtual void pauseAnimation(const String&, double);
+    virtual void removeAnimation(const String&);
+
 private:
     virtual void willBeDestroyed();
     WebKit::WebLayerID m_id;
@@ -171,10 +186,12 @@ private:
     bool m_shouldSyncLayerState: 1;
     bool m_shouldSyncChildren: 1;
     bool m_shouldSyncFilters: 1;
+    bool m_shouldSyncAnimatedProperties: 1;
     bool m_fixedToViewport : 1;
     bool m_canvasNeedsDisplay : 1;
 
     void notifyChange();
+    void didChangeAnimatedProperties();
     void didChangeGeometry();
     void didChangeLayerState();
     void didChangeChildren();
@@ -182,6 +199,9 @@ private:
     void didChangeFilters();
 #endif
 
+    float m_effectiveOpacity;
+    TransformationMatrix m_effectiveTransform;
+
     void createBackingStore();
 
     bool selfOrAncestorHaveNonAffineTransforms();
@@ -189,19 +209,24 @@ private:
     void adjustContentsScale();
     void computeTransformedVisibleRect();
     void syncLayerParameters();
+    void syncAnimatedProperties();
     void setShouldUpdateVisibleRect();
     float effectiveContentsScale();
 
-    WebKit::WebGraphicsLayerClient* m_webGraphicsLayerClient;
+    void animationStartedTimerFired(WebCore::Timer<CoordinatedGraphicsLayer>*);
+
+    WebKit::CoordinatedGraphicsLayerClient* m_CoordinatedGraphicsLayerClient;
     OwnPtr<WebCore::TiledBackingStore> m_mainBackingStore;
     OwnPtr<WebCore::TiledBackingStore> m_previousBackingStore;
     float m_contentsScale;
     PlatformLayer* m_canvasPlatformLayer;
+    Timer<CoordinatedGraphicsLayer> m_animationStartedTimer;
+    GraphicsLayerAnimations m_animations;
 };
 
-WebGraphicsLayer* toWebGraphicsLayer(GraphicsLayer*);
+CoordinatedGraphicsLayer* toCoordinatedGraphicsLayer(GraphicsLayer*);
 
 }
 #endif
 
-#endif // WebGraphicsLayer_H
+#endif // CoordinatedGraphicsLayer_H
diff --git a/Source/WebKit2/WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp
index 2125600b1..4a6244e2d 100644
--- a/Source/WebKit2/WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp
@@ -24,7 +24,7 @@
  */
 
 #include "config.h"
-#include "TiledBackingStoreRemoteTile.h"
+#include "CoordinatedTile.h"
 
 #if USE(TILED_BACKING_STORE)
 
@@ -37,7 +37,7 @@ using namespace WebCore;
 
 namespace WebKit {
 
-TiledBackingStoreRemoteTile::TiledBackingStoreRemoteTile(TiledBackingStoreRemoteTileClient* client, TiledBackingStore* tiledBackingStore, const Coordinate& tileCoordinate)
+CoordinatedTile::CoordinatedTile(CoordinatedTileClient* client, TiledBackingStore* tiledBackingStore, const Coordinate& tileCoordinate)
     : m_client(client)
     , m_tiledBackingStore(tiledBackingStore)
     , m_coordinate(tileCoordinate)
@@ -47,18 +47,18 @@ TiledBackingStoreRemoteTile::TiledBackingStoreRemoteTile(TiledBackingStoreRemote
 {
 }
 
-TiledBackingStoreRemoteTile::~TiledBackingStoreRemoteTile()
+CoordinatedTile::~CoordinatedTile()
 {
     if (m_ID)
         m_client->removeTile(m_ID);
 }
 
-bool TiledBackingStoreRemoteTile::isDirty() const
+bool CoordinatedTile::isDirty() const
 {
     return !m_dirtyRect.isEmpty();
 }
 
-void TiledBackingStoreRemoteTile::invalidate(const IntRect& dirtyRect)
+void CoordinatedTile::invalidate(const IntRect& dirtyRect)
 {
     IntRect tileDirtyRect = intersection(dirtyRect, m_rect);
     if (tileDirtyRect.isEmpty())
@@ -67,7 +67,7 @@ void TiledBackingStoreRemoteTile::invalidate(const IntRect& dirtyRect)
     m_dirtyRect.unite(tileDirtyRect);
 }
 
-Vector<IntRect> TiledBackingStoreRemoteTile::updateBackBuffer()
+Vector<IntRect> CoordinatedTile::updateBackBuffer()
 {
     if (!isDirty())
         return Vector<IntRect>();
@@ -96,38 +96,38 @@ Vector<IntRect> TiledBackingStoreRemoteTile::updateBackBuffer()
     return Vector<IntRect>();
 }
 
-void TiledBackingStoreRemoteTile::swapBackBufferToFront()
+void CoordinatedTile::swapBackBufferToFront()
 {
     // Handled by tiledBackingStorePaintEnd.
 }
 
-bool TiledBackingStoreRemoteTile::isReadyToPaint() const
+bool CoordinatedTile::isReadyToPaint() const
 {
     return !!m_ID;
 }
 
-void TiledBackingStoreRemoteTile::paint(GraphicsContext* context, const IntRect& rect)
+void CoordinatedTile::paint(GraphicsContext* context, const IntRect& rect)
 {
     ASSERT_NOT_REACHED();
 }
 
-void TiledBackingStoreRemoteTile::resize(const IntSize& newSize)
+void CoordinatedTile::resize(const IntSize& newSize)
 {
     m_rect = IntRect(m_rect.location(), newSize);
     m_dirtyRect = m_rect;
 }
 
-TiledBackingStoreRemoteTileBackend::TiledBackingStoreRemoteTileBackend(TiledBackingStoreRemoteTileClient* client)
+CoordinatedTileBackend::CoordinatedTileBackend(CoordinatedTileClient* client)
     : m_client(client)
 {
 }
 
-PassRefPtr<WebCore::Tile> TiledBackingStoreRemoteTileBackend::createTile(WebCore::TiledBackingStore* tiledBackingStore, const WebCore::Tile::Coordinate& tileCoordinate)
+PassRefPtr<WebCore::Tile> CoordinatedTileBackend::createTile(WebCore::TiledBackingStore* tiledBackingStore, const WebCore::Tile::Coordinate& tileCoordinate)
 {
-    return TiledBackingStoreRemoteTile::create(m_client, tiledBackingStore, tileCoordinate);
+    return CoordinatedTile::create(m_client, tiledBackingStore, tileCoordinate);
 }
 
-void TiledBackingStoreRemoteTileBackend::paintCheckerPattern(WebCore::GraphicsContext*, const WebCore::FloatRect&)
+void CoordinatedTileBackend::paintCheckerPattern(WebCore::GraphicsContext*, const WebCore::FloatRect&)
 {
 }
 
diff --git a/Source/WebKit2/WebProcess/WebPage/TiledBackingStoreRemoteTile.h b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h
index cae11e9bb..84d1134f0 100644
--- a/Source/WebKit2/WebProcess/WebPage/TiledBackingStoreRemoteTile.h
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h
@@ -23,8 +23,8 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef TiledBackingStoreRemoteTile_h
-#define TiledBackingStoreRemoteTile_h
+#ifndef CoordinatedTile_h
+#define CoordinatedTile_h
 
 #if USE(TILED_BACKING_STORE)
 
@@ -40,13 +40,13 @@ class TiledBackingStore;
 
 namespace WebKit {
 
-class TiledBackingStoreRemoteTileClient;
+class CoordinatedTileClient;
 class SurfaceUpdateInfo;
 
-class TiledBackingStoreRemoteTile : public WebCore::Tile {
+class CoordinatedTile : public WebCore::Tile {
 public:
-    static PassRefPtr<Tile> create(TiledBackingStoreRemoteTileClient* client, WebCore::TiledBackingStore* tiledBackingStore, const Coordinate& tileCoordinate) { return adoptRef(new TiledBackingStoreRemoteTile(client, tiledBackingStore, tileCoordinate)); }
-    ~TiledBackingStoreRemoteTile();
+    static PassRefPtr<Tile> create(CoordinatedTileClient* client, WebCore::TiledBackingStore* tiledBackingStore, const Coordinate& tileCoordinate) { return adoptRef(new CoordinatedTile(client, tiledBackingStore, tileCoordinate)); }
+    ~CoordinatedTile();
 
     bool isDirty() const;
     void invalidate(const WebCore::IntRect&);
@@ -60,9 +60,9 @@ public:
     void resize(const WebCore::IntSize&);
 
 private:
-    TiledBackingStoreRemoteTile(TiledBackingStoreRemoteTileClient*, WebCore::TiledBackingStore*, const Coordinate&);
+    CoordinatedTile(CoordinatedTileClient*, WebCore::TiledBackingStore*, const Coordinate&);
 
-    TiledBackingStoreRemoteTileClient* m_client;
+    CoordinatedTileClient* m_client;
     WebCore::TiledBackingStore* m_tiledBackingStore;
     Coordinate m_coordinate;
     WebCore::IntRect m_rect;
@@ -73,24 +73,24 @@ private:
     OwnPtr<WebCore::ImageBuffer> m_localBuffer;
 };
 
-class TiledBackingStoreRemoteTileClient {
+class CoordinatedTileClient {
 public:
-    virtual ~TiledBackingStoreRemoteTileClient() { }
+    virtual ~CoordinatedTileClient() { }
     virtual void createTile(int tileID, const SurfaceUpdateInfo&, const WebCore::IntRect&) = 0;
     virtual void updateTile(int tileID, const SurfaceUpdateInfo&, const WebCore::IntRect&) = 0;
     virtual void removeTile(int tileID) = 0;
     virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableSurface::Handle&, WebCore::IntPoint&) = 0;
 };
 
-class TiledBackingStoreRemoteTileBackend : public WebCore::TiledBackingStoreBackend {
+class CoordinatedTileBackend : public WebCore::TiledBackingStoreBackend {
 public:
-    static PassOwnPtr<WebCore::TiledBackingStoreBackend> create(TiledBackingStoreRemoteTileClient* client) { return adoptPtr(new TiledBackingStoreRemoteTileBackend(client)); }
+    static PassOwnPtr<WebCore::TiledBackingStoreBackend> create(CoordinatedTileClient* client) { return adoptPtr(new CoordinatedTileBackend(client)); }
     PassRefPtr<WebCore::Tile> createTile(WebCore::TiledBackingStore*, const WebCore::Tile::Coordinate&);
     void paintCheckerPattern(WebCore::GraphicsContext*, const WebCore::FloatRect&);
 
 private:
-    TiledBackingStoreRemoteTileBackend(TiledBackingStoreRemoteTileClient*);
-    TiledBackingStoreRemoteTileClient* m_client;
+    CoordinatedTileBackend(CoordinatedTileClient*);
+    CoordinatedTileClient* m_client;
 };
 
 
@@ -98,4 +98,4 @@ private:
 
 #endif // USE(TILED_BACKING_STORE)
 
-#endif // TiledBackingStoreRemoteTile
+#endif // CoordinatedTile
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.cpp b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp
index ae3994422..7095c438b 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp
@@ -1,4 +1,4 @@
-/*
+    /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
  *
@@ -26,16 +26,18 @@
 
 #include "config.h"
 
+#if USE(COORDINATED_GRAPHICS)
 #include "LayerTreeCoordinator.h"
 
+#include "CoordinatedGraphicsLayer.h"
 #include "DrawingAreaImpl.h"
 #include "GraphicsContext.h"
 #include "LayerTreeCoordinatorProxyMessages.h"
 #include "MessageID.h"
 #include "SurfaceUpdateInfo.h"
 #include "WebCoreArgumentCoders.h"
-#include "WebGraphicsLayer.h"
 #include "WebPage.h"
+#include "WebPageProxyMessages.h"
 #include <WebCore/Frame.h>
 #include <WebCore/FrameView.h>
 #include <WebCore/Page.h>
@@ -56,13 +58,13 @@ PassRefPtr<LayerTreeCoordinator> LayerTreeCoordinator::create(WebPage* webPage)
 
 LayerTreeCoordinator::~LayerTreeCoordinator()
 {
-    // Prevent setWebGraphicsLayerClient(0) -> detachLayer() from modifying the set while we iterate it.
-    HashSet<WebCore::WebGraphicsLayer*> registeredLayers;
+    // Prevent setCoordinatedGraphicsLayerClient(0) -> detachLayer() from modifying the set while we iterate it.
+    HashSet<WebCore::CoordinatedGraphicsLayer*> registeredLayers;
     registeredLayers.swap(m_registeredLayers);
 
-    HashSet<WebCore::WebGraphicsLayer*>::iterator end = registeredLayers.end();
-    for (HashSet<WebCore::WebGraphicsLayer*>::iterator it = registeredLayers.begin(); it != end; ++it)
-        (*it)->setWebGraphicsLayerClient(0);
+    HashSet<WebCore::CoordinatedGraphicsLayer*>::iterator end = registeredLayers.end();
+    for (HashSet<WebCore::CoordinatedGraphicsLayer*>::iterator it = registeredLayers.begin(); it != end; ++it)
+        (*it)->setCoordinatedGraphicsLayerClient(0);
 }
 
 LayerTreeCoordinator::LayerTreeCoordinator(WebPage* webPage)
@@ -77,20 +79,21 @@ LayerTreeCoordinator::LayerTreeCoordinator(WebPage* webPage)
     , m_shouldSyncRootLayer(true)
     , m_layerFlushTimer(this, &LayerTreeCoordinator::layerFlushTimerFired)
     , m_layerFlushSchedulingEnabled(true)
+    , m_forceRepaintAsyncCallbackID(0)
 {
     // Create a root layer.
     m_rootLayer = GraphicsLayer::create(this);
-    WebGraphicsLayer* webRootLayer = toWebGraphicsLayer(m_rootLayer.get());
+    CoordinatedGraphicsLayer* webRootLayer = toCoordinatedGraphicsLayer(m_rootLayer.get());
     webRootLayer->setRootLayer(true);
 #ifndef NDEBUG
     m_rootLayer->setName("LayerTreeCoordinator root layer");
 #endif
     m_rootLayer->setDrawsContent(false);
     m_rootLayer->setSize(m_webPage->size());
-    m_layerTreeContext.webLayerID = toWebGraphicsLayer(webRootLayer)->id();
+    m_layerTreeContext.webLayerID = toCoordinatedGraphicsLayer(webRootLayer)->id();
 
     m_nonCompositedContentLayer = GraphicsLayer::create(this);
-    toWebGraphicsLayer(m_rootLayer.get())->setWebGraphicsLayerClient(this);
+    toCoordinatedGraphicsLayer(m_rootLayer.get())->setCoordinatedGraphicsLayerClient(this);
 #ifndef NDEBUG
     m_nonCompositedContentLayer->setName("LayerTreeCoordinator non-composited content");
 #endif
@@ -174,12 +177,25 @@ void LayerTreeCoordinator::scrollNonCompositedContents(const WebCore::IntRect& s
 
 void LayerTreeCoordinator::forceRepaint()
 {
+    // This is necessary for running layout tests. Since in this case we are not waiting for a UIProcess to reply nicely.
+    // Instead we are just triggering forceRepaint. But we still want to have the scripted animation callbacks being executed.
+    syncDisplayState();
+
     // We need to schedule another flush, otherwise the forced paint might cancel a later expected flush.
     // This is aligned with LayerTreeHostCA.
     scheduleLayerFlush();
     flushPendingLayerChanges();
 }
 
+bool LayerTreeCoordinator::forceRepaintAsync(uint64_t callbackID)
+{
+    // We expect the UI process to not require a new repaint until the previous one has finished.
+    ASSERT(!m_forceRepaintAsyncCallbackID);
+    m_forceRepaintAsyncCallbackID = callbackID;
+    scheduleLayerFlush();
+    return true;
+}
+
 void LayerTreeCoordinator::sizeDidChange(const WebCore::IntSize& newSize)
 {
     if (m_rootLayer->size() == newSize)
@@ -234,6 +250,9 @@ void LayerTreeCoordinator::setPageOverlayOpacity(float value)
 
 bool LayerTreeCoordinator::flushPendingLayerChanges()
 {
+    if (m_waitingForUIProcess)
+        return false;
+
     m_shouldSyncFrame = false;
     bool didSync = m_webPage->corePage()->mainFrame()->view()->syncCompositingStateIncludingSubframes();
     m_nonCompositedContentLayer->syncCompositingStateForThisLayerOnly();
@@ -243,18 +262,23 @@ bool LayerTreeCoordinator::flushPendingLayerChanges()
     m_rootLayer->syncCompositingStateForThisLayerOnly();
 
     if (m_shouldSyncRootLayer) {
-        m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetRootCompositingLayer(toWebGraphicsLayer(m_rootLayer.get())->id()));
+        m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetRootCompositingLayer(toCoordinatedGraphicsLayer(m_rootLayer.get())->id()));
         m_shouldSyncRootLayer = false;
     }
 
-    if (!m_shouldSyncFrame)
-        return didSync;
+    if (m_shouldSyncFrame) {
+        didSync = true;
+        m_webPage->send(Messages::LayerTreeCoordinatorProxy::DidRenderFrame());
+        m_waitingForUIProcess = true;
+        m_shouldSyncFrame = false;
+    }
 
-    m_webPage->send(Messages::LayerTreeCoordinatorProxy::DidRenderFrame());
-    m_waitingForUIProcess = true;
-    m_shouldSyncFrame = false;
+    if (m_forceRepaintAsyncCallbackID) {
+        m_webPage->send(Messages::WebPageProxy::VoidCallback(m_forceRepaintAsyncCallbackID));
+        m_forceRepaintAsyncCallbackID = 0;
+    }
 
-    return true;
+    return didSync;
 }
 
 void LayerTreeCoordinator::syncLayerState(WebLayerID id, const WebLayerInfo& info)
@@ -288,7 +312,7 @@ void LayerTreeCoordinator::syncLayerFilters(WebLayerID id, const FilterOperation
 }
 #endif
 
-void LayerTreeCoordinator::attachLayer(WebGraphicsLayer* layer)
+void LayerTreeCoordinator::attachLayer(CoordinatedGraphicsLayer* layer)
 {
     ASSERT(!m_registeredLayers.contains(layer));
     m_registeredLayers.add(layer);
@@ -297,7 +321,7 @@ void LayerTreeCoordinator::attachLayer(WebGraphicsLayer* layer)
     layer->adjustVisibleRect();
 }
 
-void LayerTreeCoordinator::detachLayer(WebGraphicsLayer* layer)
+void LayerTreeCoordinator::detachLayer(CoordinatedGraphicsLayer* layer)
 {
     m_registeredLayers.remove(layer);
     m_shouldSyncFrame = true;
@@ -324,7 +348,7 @@ static void updateOffsetFromViewportForSelf(RenderLayer* renderLayer)
     if (!renderLayer->isStackingContext())
         return;
 
-    WebGraphicsLayer* graphicsLayer = toWebGraphicsLayer(backing->graphicsLayer());
+    CoordinatedGraphicsLayer* graphicsLayer = toCoordinatedGraphicsLayer(backing->graphicsLayer());
     graphicsLayer->setFixedToViewport(true);
 }
 
@@ -356,12 +380,8 @@ void LayerTreeCoordinator::performScheduledLayerFlush()
 {
     if (m_isSuspended || m_waitingForUIProcess)
         return;
-#if ENABLE(REQUEST_ANIMATION_FRAME) && !USE(REQUEST_ANIMATION_FRAME_TIMER) && !USE(REQUEST_ANIMATION_FRAME_DISPLAY_MONITOR)
-    // Make sure that any previously registered animation callbacks are being executed before we flush the layers.
-    m_webPage->corePage()->mainFrame()->view()->serviceScriptedAnimations(convertSecondsToDOMTimeStamp(currentTime()));
-#endif
 
-    m_webPage->layoutIfNeeded();
+    syncDisplayState();
 
     if (!m_isValid)
         return;
@@ -370,6 +390,16 @@ void LayerTreeCoordinator::performScheduledLayerFlush()
         didPerformScheduledLayerFlush();
 }
 
+void LayerTreeCoordinator::syncDisplayState()
+{
+#if ENABLE(REQUEST_ANIMATION_FRAME) && !USE(REQUEST_ANIMATION_FRAME_TIMER) && !USE(REQUEST_ANIMATION_FRAME_DISPLAY_MONITOR)
+    // Make sure that any previously registered animation callbacks are being executed before we flush the layers.
+    m_webPage->corePage()->mainFrame()->view()->serviceScriptedAnimations(convertSecondsToDOMTimeStamp(currentTime()));
+#endif
+
+    m_webPage->layoutIfNeeded();
+}
+
 void LayerTreeCoordinator::didPerformScheduledLayerFlush()
 {
     if (m_notifyAfterScheduledLayerFlush) {
@@ -520,20 +550,33 @@ WebCore::IntRect LayerTreeCoordinator::visibleContentsRect() const
     return m_visibleContentsRect;
 }
 
+
+void LayerTreeCoordinator::setLayerAnimatedOpacity(WebLayerID id, float opacity)
+{
+    m_shouldSyncFrame = true;
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetLayerAnimatedOpacity(id, opacity));
+}
+
+void LayerTreeCoordinator::setLayerAnimatedTransform(WebLayerID id, const TransformationMatrix& transform)
+{
+    m_shouldSyncFrame = true;
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetLayerAnimatedTransform(id, transform));
+}
+
 void LayerTreeCoordinator::setVisibleContentsRect(const IntRect& rect, float scale, const FloatPoint& trajectoryVector)
 {
     bool contentsRectDidChange = rect != m_visibleContentsRect;
     bool contentsScaleDidChange = scale != m_contentsScale;
 
-    if (trajectoryVector != FloatPoint::zero())
-        toWebGraphicsLayer(m_nonCompositedContentLayer.get())->setVisibleContentRectTrajectoryVector(trajectoryVector);
+    // A zero trajectoryVector indicates that tiles all around the viewport are requested.
+    toCoordinatedGraphicsLayer(m_nonCompositedContentLayer.get())->setVisibleContentRectTrajectoryVector(trajectoryVector);
 
     if (contentsRectDidChange || contentsScaleDidChange) {
         m_visibleContentsRect = rect;
         m_contentsScale = scale;
 
-        HashSet<WebCore::WebGraphicsLayer*>::iterator end = m_registeredLayers.end();
-        for (HashSet<WebCore::WebGraphicsLayer*>::iterator it = m_registeredLayers.begin(); it != end; ++it) {
+        HashSet<WebCore::CoordinatedGraphicsLayer*>::iterator end = m_registeredLayers.end();
+        for (HashSet<WebCore::CoordinatedGraphicsLayer*>::iterator it = m_registeredLayers.begin(); it != end; ++it) {
             if (contentsScaleDidChange)
                 (*it)->setContentsScale(scale);
             if (contentsRectDidChange)
@@ -548,12 +591,10 @@ void LayerTreeCoordinator::setVisibleContentsRect(const IntRect& rect, float sca
         m_shouldSendScrollPositionUpdate = true;
 }
 
-#if USE(UI_SIDE_COMPOSITING)
 void LayerTreeCoordinator::scheduleAnimation()
 {
     scheduleLayerFlush();
 }
-#endif
 
 void LayerTreeCoordinator::renderNextFrame()
 {
@@ -570,8 +611,8 @@ bool LayerTreeCoordinator::layerTreeTileUpdatesAllowed() const
 
 void LayerTreeCoordinator::purgeBackingStores()
 {
-    HashSet<WebCore::WebGraphicsLayer*>::iterator end = m_registeredLayers.end();
-    for (HashSet<WebCore::WebGraphicsLayer*>::iterator it = m_registeredLayers.begin(); it != end; ++it)
+    HashSet<WebCore::CoordinatedGraphicsLayer*>::iterator end = m_registeredLayers.end();
+    for (HashSet<WebCore::CoordinatedGraphicsLayer*>::iterator it = m_registeredLayers.begin(); it != end; ++it)
         (*it)->purgeBackingStores();
 
     ASSERT(!m_directlyCompositedImageRefCounts.size());
@@ -597,3 +638,4 @@ PassOwnPtr<WebCore::GraphicsContext> LayerTreeCoordinator::beginContentUpdate(co
 }
 
 } // namespace WebKit
+#endif // USE(COORDINATED_GRAPHICS)
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.h b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h
index 7f6038005..3fd59d218 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.h
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h
@@ -20,11 +20,13 @@
 #ifndef LayerTreeCoordinator_h
 #define LayerTreeCoordinator_h
 
+#if USE(COORDINATED_GRAPHICS)
+
+#include "CoordinatedGraphicsLayer.h"
 #include "LayerTreeContext.h"
 #include "LayerTreeHost.h"
 #include "Timer.h"
 #include "UpdateAtlas.h"
-#include "WebGraphicsLayer.h"
 #include <WebCore/GraphicsLayerClient.h>
 #include <wtf/OwnPtr.h>
 
@@ -34,7 +36,7 @@ class UpdateInfo;
 class WebPage;
 
 class LayerTreeCoordinator : public LayerTreeHost, WebCore::GraphicsLayerClient
-                           , public WebGraphicsLayerClient {
+                           , public CoordinatedGraphicsLayerClient {
 public:
     static PassRefPtr<LayerTreeCoordinator> create(WebPage*);
     virtual ~LayerTreeCoordinator();
@@ -51,6 +53,7 @@ public:
     virtual void setNonCompositedContentsNeedDisplay(const WebCore::IntRect&);
     virtual void scrollNonCompositedContents(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset);
     virtual void forceRepaint();
+    virtual bool forceRepaintAsync(uint64_t callbackID);
     virtual void sizeDidChange(const WebCore::IntSize& newSize);
 
     virtual void didInstallPageOverlay();
@@ -77,18 +80,18 @@ public:
 
     virtual void syncLayerState(WebLayerID, const WebLayerInfo&);
     virtual void syncLayerChildren(WebLayerID, const Vector<WebLayerID>&);
+    virtual void setLayerAnimatedOpacity(WebLayerID, float);
+    virtual void setLayerAnimatedTransform(WebLayerID, const WebCore::TransformationMatrix&);
 #if ENABLE(CSS_FILTERS)
     virtual void syncLayerFilters(WebLayerID, const WebCore::FilterOperations&);
 #endif
     virtual void syncCanvas(WebLayerID, const WebCore::IntSize& canvasSize, uint32_t graphicsSurfaceToken) OVERRIDE;
-    virtual void attachLayer(WebCore::WebGraphicsLayer*);
-    virtual void detachLayer(WebCore::WebGraphicsLayer*);
+    virtual void attachLayer(WebCore::CoordinatedGraphicsLayer*);
+    virtual void detachLayer(WebCore::CoordinatedGraphicsLayer*);
     virtual void syncFixedLayers();
 
     virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableBitmap::Flags, ShareableSurface::Handle&, WebCore::IntPoint&);
-#if USE(UI_SIDE_COMPOSITING)
     virtual void scheduleAnimation() OVERRIDE;
-#endif
 
 protected:
     explicit LayerTreeCoordinator(WebPage*);
@@ -108,6 +111,7 @@ private:
     void cancelPendingLayerFlush();
     void performScheduledLayerFlush();
     void didPerformScheduledLayerFlush();
+    void syncDisplayState();
 
     OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
 
@@ -117,7 +121,7 @@ private:
     // The page overlay layer. Will be null if there's no page overlay.
     OwnPtr<WebCore::GraphicsLayer> m_pageOverlayLayer;
 
-    HashSet<WebCore::WebGraphicsLayer*> m_registeredLayers;
+    HashSet<WebCore::CoordinatedGraphicsLayer*> m_registeredLayers;
     HashMap<int64_t, int> m_directlyCompositedImageRefCounts;
     Vector<UpdateAtlas> m_updateAtlases;
 
@@ -136,8 +140,11 @@ private:
     void layerFlushTimerFired(WebCore::Timer<LayerTreeCoordinator>*);
     WebCore::Timer<LayerTreeCoordinator> m_layerFlushTimer;
     bool m_layerFlushSchedulingEnabled;
+    uint64_t m_forceRepaintAsyncCallbackID;
 };
 
 }
 
+#endif
+
 #endif // LayerTreeCoordinator_h
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.messages.in b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in
index aff6f96ad..7b9c2acdf 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/LayerTreeCoordinator.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in
@@ -18,7 +18,7 @@
 #
 
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 messages -> LayerTreeCoordinator {
     SetVisibleContentsRect(WebCore::IntRect visibleContentsRect, float scale, WebCore::FloatPoint trajectoryVectory)
     RenderNextFrame()
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingArea.h b/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
index 71aa607cb..759e675ad 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
@@ -90,7 +90,7 @@ public:
     virtual void scheduleCompositingLayerSync() = 0;
 #endif
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
     virtual void didReceiveLayerTreeCoordinatorMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) = 0;
 #endif
 
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
index 5e6d5ec0a..eefd1bb88 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
@@ -199,6 +199,11 @@ void DrawingAreaImpl::forceRepaint()
     display();
 }
 
+bool DrawingAreaImpl::forceRepaintAsync(uint64_t callbackID)
+{
+    return m_layerTreeHost && m_layerTreeHost->forceRepaintAsync(callbackID);
+}
+
 void DrawingAreaImpl::didInstallPageOverlay()
 {
     if (m_layerTreeHost)
@@ -688,7 +693,7 @@ void DrawingAreaImpl::display(UpdateInfo& updateInfo)
     m_displayTimer.stop();
 }
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 void DrawingAreaImpl::didReceiveLayerTreeCoordinatorMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
     if (m_layerTreeHost)
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
index 2cebbd5c4..0174a5d6e 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
@@ -57,6 +57,7 @@ private:
     virtual bool layerTreeStateIsFrozen() const { return m_layerTreeStateIsFrozen; }
     virtual LayerTreeHost* layerTreeHost() const { return m_layerTreeHost.get(); }
     virtual void forceRepaint();
+    virtual bool forceRepaintAsync(uint64_t callbackID);
 
     virtual void didInstallPageOverlay();
     virtual void didUninstallPageOverlay();
@@ -77,7 +78,7 @@ private:
     virtual void setLayerHostingMode(uint32_t) OVERRIDE;
 #endif
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
     virtual void didReceiveLayerTreeCoordinatorMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 #endif
 
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.cpp b/Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.cpp
deleted file mode 100644
index 19ce4d031..000000000
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeCoordinator/WebGraphicsLayer.cpp
+++ /dev/null
@@ -1,748 +0,0 @@
-/*
- Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
-
- This library is free software; you can redistribute it and/or
- modify it under the terms of the GNU Library General Public
- License as published by the Free Software Foundation; either
- version 2 of the License, or (at your option) any later version.
-
- This library is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- Library General Public License for more details.
-
- You should have received a copy of the GNU Library General Public License
- along with this library; see the file COPYING.LIB.  If not, write to
- the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if USE(UI_SIDE_COMPOSITING)
-#include "WebGraphicsLayer.h"
-
-#include "BackingStore.h"
-#include "FloatQuad.h"
-#include "Frame.h"
-#include "FrameView.h"
-#include "GraphicsContext.h"
-#include "GraphicsLayer.h"
-#include "LayerTreeCoordinatorProxyMessages.h"
-#include "Page.h"
-#include "TextureMapperPlatformLayer.h"
-#include "TiledBackingStoreRemoteTile.h"
-#include "WebPage.h"
-#include <wtf/CurrentTime.h>
-#include <wtf/HashMap.h>
-#include <wtf/text/CString.h>
-
-using namespace WebKit;
-
-namespace WebCore {
-
-static HashMap<WebLayerID, WebGraphicsLayer*>& layerByIDMap()
-{
-    static HashMap<WebLayerID, WebGraphicsLayer*> globalMap;
-    return globalMap;
-}
-
-WebGraphicsLayer* WebGraphicsLayer::layerByID(WebKit::WebLayerID id)
-{
-    HashMap<WebLayerID, WebGraphicsLayer*>& table = layerByIDMap();
-    HashMap<WebLayerID, WebGraphicsLayer*>::iterator it = table.find(id);
-    if (it == table.end())
-        return 0;
-    return it->second;
-}
-
-static WebLayerID toWebLayerID(GraphicsLayer* layer)
-{
-    return layer ? toWebGraphicsLayer(layer)->id() : 0;
-}
-
-void WebGraphicsLayer::didChangeLayerState()
-{
-    m_shouldSyncLayerState = true;
-    if (client())
-        client()->notifySyncRequired(this);
-}
-
-void WebGraphicsLayer::didChangeChildren()
-{
-    m_shouldSyncChildren = true;
-    if (client())
-        client()->notifySyncRequired(this);
-}
-
-#if ENABLE(CSS_FILTERS)
-void WebGraphicsLayer::didChangeFilters()
-{
-    m_shouldSyncFilters = true;
-    if (client())
-        client()->notifySyncRequired(this);
-}
-#endif
-
-void WebGraphicsLayer::setShouldUpdateVisibleRect()
-{
-    if (!transform().isAffine())
-        return;
-
-    m_shouldUpdateVisibleRect = true;
-    for (size_t i = 0; i < children().size(); ++i)
-        toWebGraphicsLayer(children()[i])->setShouldUpdateVisibleRect();
-    if (replicaLayer())
-        toWebGraphicsLayer(replicaLayer())->setShouldUpdateVisibleRect();
-}
-
-void WebGraphicsLayer::didChangeGeometry()
-{
-    didChangeLayerState();
-    setShouldUpdateVisibleRect();
-}
-
-WebGraphicsLayer::WebGraphicsLayer(GraphicsLayerClient* client)
-    : GraphicsLayer(client)
-    , m_maskTarget(0)
-    , m_inUpdateMode(false)
-    , m_shouldUpdateVisibleRect(true)
-    , m_shouldSyncLayerState(true)
-    , m_shouldSyncChildren(true)
-    , m_fixedToViewport(false)
-    , m_canvasNeedsDisplay(false)
-    , m_webGraphicsLayerClient(0)
-    , m_contentsScale(1)
-    , m_canvasPlatformLayer(0)
-{
-    static WebLayerID nextLayerID = 1;
-    m_id = nextLayerID++;
-    layerByIDMap().add(id(), this);
-}
-
-WebGraphicsLayer::~WebGraphicsLayer()
-{
-    layerByIDMap().remove(id());
-
-    if (m_webGraphicsLayerClient) {
-        purgeBackingStores();
-        m_webGraphicsLayerClient->detachLayer(this);
-    }
-    willBeDestroyed();
-}
-
-void WebGraphicsLayer::willBeDestroyed()
-{
-    GraphicsLayer::willBeDestroyed();
-}
-
-bool WebGraphicsLayer::setChildren(const Vector<GraphicsLayer*>& children)
-{
-    bool ok = GraphicsLayer::setChildren(children);
-    if (!ok)
-        return false;
-    for (int i = 0; i < children.size(); ++i) {
-        WebGraphicsLayer* child = toWebGraphicsLayer(children[i]);
-        child->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
-        child->didChangeLayerState();
-    }
-    didChangeChildren();
-    return true;
-}
-
-void WebGraphicsLayer::addChild(GraphicsLayer* layer)
-{
-    GraphicsLayer::addChild(layer);
-    toWebGraphicsLayer(layer)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
-    toWebGraphicsLayer(layer)->didChangeLayerState();
-    didChangeChildren();
-}
-
-void WebGraphicsLayer::addChildAtIndex(GraphicsLayer* layer, int index)
-{
-    GraphicsLayer::addChildAtIndex(layer, index);
-    toWebGraphicsLayer(layer)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
-    toWebGraphicsLayer(layer)->didChangeLayerState();
-    didChangeChildren();
-}
-
-void WebGraphicsLayer::addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling)
-{
-    GraphicsLayer::addChildAbove(layer, sibling);
-    toWebGraphicsLayer(layer)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
-    toWebGraphicsLayer(layer)->didChangeLayerState();
-    didChangeChildren();
-}
-
-void WebGraphicsLayer::addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling)
-{
-    GraphicsLayer::addChildBelow(layer, sibling);
-    toWebGraphicsLayer(layer)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
-    toWebGraphicsLayer(layer)->didChangeLayerState();
-    didChangeChildren();
-}
-
-bool WebGraphicsLayer::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
-{
-    bool ok = GraphicsLayer::replaceChild(oldChild, newChild);
-    if (!ok)
-        return false;
-    didChangeChildren();
-    toWebGraphicsLayer(oldChild)->didChangeLayerState();
-    toWebGraphicsLayer(newChild)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
-    toWebGraphicsLayer(newChild)->didChangeLayerState();
-    return true;
-}
-
-void WebGraphicsLayer::removeFromParent()
-{
-    if (WebGraphicsLayer* parentLayer = toWebGraphicsLayer(parent()))
-        parentLayer->didChangeChildren();
-    GraphicsLayer::removeFromParent();
-
-    didChangeLayerState();
-}
-
-void WebGraphicsLayer::setPosition(const FloatPoint& p)
-{
-    if (position() == p)
-        return;
-
-    GraphicsLayer::setPosition(p);
-    didChangeGeometry();
-}
-
-void WebGraphicsLayer::setAnchorPoint(const FloatPoint3D& p)
-{
-    if (anchorPoint() == p)
-        return;
-
-    GraphicsLayer::setAnchorPoint(p);
-    didChangeGeometry();
-}
-
-void WebGraphicsLayer::setSize(const FloatSize& size)
-{
-    if (this->size() == size)
-        return;
-
-    GraphicsLayer::setSize(size);
-    setNeedsDisplay();
-    if (maskLayer())
-        maskLayer()->setSize(size);
-    didChangeGeometry();
-}
-
-void WebGraphicsLayer::setTransform(const TransformationMatrix& t)
-{
-    if (transform() == t)
-        return;
-
-    GraphicsLayer::setTransform(t);
-    didChangeGeometry();
-}
-
-void WebGraphicsLayer::setChildrenTransform(const TransformationMatrix& t)
-{
-    if (childrenTransform() == t)
-        return;
-
-    GraphicsLayer::setChildrenTransform(t);
-    didChangeGeometry();
-}
-
-void WebGraphicsLayer::setPreserves3D(bool b)
-{
-    if (preserves3D() == b)
-        return;
-
-    GraphicsLayer::setPreserves3D(b);
-    didChangeGeometry();
-}
-
-void WebGraphicsLayer::setMasksToBounds(bool b)
-{
-    if (masksToBounds() == b)
-        return;
-    GraphicsLayer::setMasksToBounds(b);
-    didChangeGeometry();
-}
-
-void WebGraphicsLayer::setDrawsContent(bool b)
-{
-    if (drawsContent() == b)
-        return;
-    GraphicsLayer::setDrawsContent(b);
-
-    didChangeLayerState();
-}
-
-void WebGraphicsLayer::setContentsOpaque(bool b)
-{
-    if (contentsOpaque() == b)
-        return;
-    if (m_mainBackingStore)
-        m_mainBackingStore->setSupportsAlpha(!b);
-    GraphicsLayer::setContentsOpaque(b);
-    didChangeLayerState();
-}
-
-void WebGraphicsLayer::setBackfaceVisibility(bool b)
-{
-    if (backfaceVisibility() == b)
-        return;
-
-    GraphicsLayer::setBackfaceVisibility(b);
-    didChangeLayerState();
-}
-
-void WebGraphicsLayer::setOpacity(float opacity)
-{
-    if (this->opacity() == opacity)
-        return;
-
-    GraphicsLayer::setOpacity(opacity);
-    didChangeLayerState();
-}
-
-void WebGraphicsLayer::setContentsRect(const IntRect& r)
-{
-    if (contentsRect() == r)
-        return;
-
-    GraphicsLayer::setContentsRect(r);
-    didChangeLayerState();
-}
-
-void WebGraphicsLayer::setContentsNeedsDisplay()
-{
-    RefPtr<Image> image = m_image;
-    setContentsToImage(0);
-    setContentsToImage(image.get());
-    m_canvasNeedsDisplay = true;
-    if (client())
-        client()->notifySyncRequired(this);
-}
-
-void WebGraphicsLayer::setContentsToCanvas(PlatformLayer* platformLayer)
-{
-    m_canvasPlatformLayer = platformLayer;
-    m_canvasNeedsDisplay = true;
-    if (client())
-        client()->notifySyncRequired(this);
-}
-
-#if ENABLE(CSS_FILTERS)
-bool WebGraphicsLayer::setFilters(const FilterOperations& newFilters)
-{
-    if (filters() == newFilters)
-        return true;
-    didChangeFilters();
-    return GraphicsLayer::setFilters(newFilters);
-}
-#endif
-
-
-void WebGraphicsLayer::setContentsToImage(Image* image)
-{
-    if (image == m_image)
-        return;
-    int64_t newID = 0;
-    if (m_webGraphicsLayerClient) {
-        // We adopt first, in case this is the same frame - that way we avoid destroying and recreating the image.
-        newID = m_webGraphicsLayerClient->adoptImageBackingStore(image);
-        m_webGraphicsLayerClient->releaseImageBackingStore(m_layerInfo.imageBackingStoreID);
-        didChangeLayerState();
-        if (m_layerInfo.imageBackingStoreID && newID == m_layerInfo.imageBackingStoreID)
-            return;
-    } else {
-        // If m_webGraphicsLayerClient is not set yet there should be no backing store ID.
-        ASSERT(!m_layerInfo.imageBackingStoreID);
-        didChangeLayerState();
-    }
-
-    m_layerInfo.imageBackingStoreID = newID;
-    m_image = image;
-    GraphicsLayer::setContentsToImage(image);
-}
-
-void WebGraphicsLayer::setMaskLayer(GraphicsLayer* layer)
-{
-    if (layer == maskLayer())
-        return;
-
-    GraphicsLayer::setMaskLayer(layer);
-
-    if (!layer)
-        return;
-
-    layer->setSize(size());
-    WebGraphicsLayer* webGraphicsLayer = toWebGraphicsLayer(layer);
-    webGraphicsLayer->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
-    webGraphicsLayer->setMaskTarget(this);
-    webGraphicsLayer->didChangeLayerState();
-    didChangeLayerState();
-
-}
-
-void WebGraphicsLayer::setReplicatedByLayer(GraphicsLayer* layer)
-{
-    if (layer == replicaLayer())
-        return;
-
-    if (layer)
-        toWebGraphicsLayer(layer)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
-
-    GraphicsLayer::setReplicatedByLayer(layer);
-    didChangeLayerState();
-}
-
-void WebGraphicsLayer::setNeedsDisplay()
-{
-    setNeedsDisplayInRect(IntRect(IntPoint::zero(), IntSize(size().width(), size().height())));
-}
-
-void WebGraphicsLayer::setNeedsDisplayInRect(const FloatRect& rect)
-{
-    if (m_mainBackingStore)
-        m_mainBackingStore->invalidate(IntRect(rect));
-    didChangeLayerState();
-}
-
-WebLayerID WebGraphicsLayer::id() const
-{
-    return m_id;
-}
-
-void WebGraphicsLayer::syncCompositingState(const FloatRect& rect)
-{
-    if (WebGraphicsLayer* mask = toWebGraphicsLayer(maskLayer()))
-        mask->syncCompositingStateForThisLayerOnly();
-
-    if (WebGraphicsLayer* replica = toWebGraphicsLayer(replicaLayer()))
-        replica->syncCompositingStateForThisLayerOnly();
-
-    m_webGraphicsLayerClient->syncFixedLayers();
-
-    syncCompositingStateForThisLayerOnly();
-
-    for (size_t i = 0; i < children().size(); ++i)
-        children()[i]->syncCompositingState(rect);
-}
-
-WebGraphicsLayer* toWebGraphicsLayer(GraphicsLayer* layer)
-{
-    return static_cast<WebGraphicsLayer*>(layer);
-}
-
-void WebGraphicsLayer::syncChildren()
-{
-    if (!m_shouldSyncChildren)
-        return;
-    m_shouldSyncChildren = false;
-    Vector<WebLayerID> childIDs;
-    for (size_t i = 0; i < children().size(); ++i)
-        childIDs.append(toWebLayerID(children()[i]));
-
-    m_webGraphicsLayerClient->syncLayerChildren(m_id, childIDs);
-}
-
-#if ENABLE(CSS_FILTERS)
-void WebGraphicsLayer::syncFilters()
-{
-    if (!m_shouldSyncFilters)
-        return;
-    m_shouldSyncFilters = false;
-    m_webGraphicsLayerClient->syncLayerFilters(m_id, filters());
-}
-#endif
-
-void WebGraphicsLayer::syncLayerState()
-{
-    if (!m_shouldSyncLayerState)
-        return;
-    m_shouldSyncLayerState = false;
-    m_layerInfo.fixedToViewport = fixedToViewport();
-
-    m_layerInfo.anchorPoint = anchorPoint();
-    m_layerInfo.backfaceVisible = backfaceVisibility();
-    m_layerInfo.childrenTransform = childrenTransform();
-    m_layerInfo.contentsOpaque = contentsOpaque();
-    m_layerInfo.contentsRect = contentsRect();
-    m_layerInfo.drawsContent = drawsContent();
-    m_layerInfo.mask = toWebLayerID(maskLayer());
-    m_layerInfo.masksToBounds = masksToBounds();
-    m_layerInfo.opacity = opacity();
-    m_layerInfo.parent = toWebLayerID(parent());
-    m_layerInfo.pos = position();
-    m_layerInfo.preserves3D = preserves3D();
-    m_layerInfo.replica = toWebLayerID(replicaLayer());
-    m_layerInfo.size = size();
-    m_layerInfo.transform = transform();
-    m_webGraphicsLayerClient->syncLayerState(m_id, m_layerInfo);
-}
-
-void WebGraphicsLayer::syncCanvas()
-{
-    if (!m_canvasNeedsDisplay)
-        return;
-
-    if (!m_canvasPlatformLayer)
-        return;
-
-#if USE(GRAPHICS_SURFACE)
-    uint32_t graphicsSurfaceToken = m_canvasPlatformLayer->copyToGraphicsSurface();
-    m_webGraphicsLayerClient->syncCanvas(m_id, IntSize(size().width(), size().height()), graphicsSurfaceToken);
-#endif
-    m_canvasNeedsDisplay = false;
-}
-
-void WebGraphicsLayer::ensureImageBackingStore()
-{
-    if (!m_image)
-        return;
-    if (!m_layerInfo.imageBackingStoreID)
-        m_layerInfo.imageBackingStoreID = m_webGraphicsLayerClient->adoptImageBackingStore(m_image.get());
-}
-
-void WebGraphicsLayer::syncCompositingStateForThisLayerOnly()
-{
-    // The remote image might have been released by purgeBackingStores.
-    ensureImageBackingStore();
-    computeTransformedVisibleRect();
-    syncChildren();
-    syncLayerState();
-#if ENABLE(CSS_FILTERS)
-    syncFilters();
-#endif
-    updateContentBuffers();
-    syncCanvas();
-}
-
-void WebGraphicsLayer::tiledBackingStorePaintBegin()
-{
-}
-
-void WebGraphicsLayer::setRootLayer(bool isRoot)
-{
-    m_layerInfo.isRootLayer = isRoot;
-    didChangeLayerState();
-}
-
-void WebGraphicsLayer::setVisibleContentRectTrajectoryVector(const FloatPoint& trajectoryVector)
-{
-    if (m_mainBackingStore)
-        m_mainBackingStore->coverWithTilesIfNeeded(trajectoryVector);
-}
-
-void WebGraphicsLayer::setContentsScale(float scale)
-{
-    m_contentsScale = scale;
-    adjustContentsScale();
-}
-
-float WebGraphicsLayer::effectiveContentsScale()
-{
-    return shouldUseTiledBackingStore() ? m_contentsScale : 1;
-}
-
-void WebGraphicsLayer::adjustContentsScale()
-{
-    if (!drawsContent())
-        return;
-
-    if (!m_mainBackingStore || m_mainBackingStore->contentsScale() == effectiveContentsScale())
-        return;
-
-    // Between creating the new backing store and painting the content,
-    // we do not want to drop the previous one as that might result in
-    // briefly seeing flickering as the old tiles may be dropped before
-    // something replaces them.
-    m_previousBackingStore = m_mainBackingStore.release();
-
-    // No reason to save the previous backing store for non-visible areas.
-    m_previousBackingStore->removeAllNonVisibleTiles();
-
-    createBackingStore();
-}
-
-void WebGraphicsLayer::createBackingStore()
-{
-    m_mainBackingStore = adoptPtr(new TiledBackingStore(this, TiledBackingStoreRemoteTileBackend::create(this)));
-    m_mainBackingStore->setSupportsAlpha(!contentsOpaque());
-    m_mainBackingStore->setContentsScale(effectiveContentsScale());
-}
-
-void WebGraphicsLayer::tiledBackingStorePaint(GraphicsContext* context, const IntRect& rect)
-{
-    if (rect.isEmpty())
-        return;
-    paintGraphicsLayerContents(*context, rect);
-}
-
-void WebGraphicsLayer::tiledBackingStorePaintEnd(const Vector<IntRect>& updatedRects)
-{
-}
-
-bool WebGraphicsLayer::tiledBackingStoreUpdatesAllowed() const
-{
-    if (!m_inUpdateMode)
-        return false;
-    return m_webGraphicsLayerClient->layerTreeTileUpdatesAllowed();
-}
-
-IntRect WebGraphicsLayer::tiledBackingStoreContentsRect()
-{
-    return IntRect(0, 0, size().width(), size().height());
-}
-
-bool WebGraphicsLayer::shouldUseTiledBackingStore()
-{
-    return !selfOrAncestorHaveNonAffineTransforms();
-}
-
-IntRect WebGraphicsLayer::tiledBackingStoreVisibleRect()
-{
-    if (!shouldUseTiledBackingStore())
-        return tiledBackingStoreContentsRect();
-
-    // Non-invertible layers are not visible.
-    if (!m_layerTransform.combined().isInvertible())
-        return IntRect();
-
-    // Return a projection of the visible rect (surface coordinates) onto the layer's plane (layer coordinates).
-    // The resulting quad might be squewed and the visible rect is the bounding box of this quad,
-    // so it might spread further than the real visible area (and then even more amplified by the cover rect multiplier).
-    return enclosingIntRect(m_layerTransform.combined().inverse().clampedBoundsOfProjectedQuad(FloatQuad(FloatRect(m_webGraphicsLayerClient->visibleContentsRect()))));
-}
-
-Color WebGraphicsLayer::tiledBackingStoreBackgroundColor() const
-{
-    return contentsOpaque() ? Color::white : Color::transparent;
-}
-
-PassOwnPtr<WebCore::GraphicsContext> WebGraphicsLayer::beginContentUpdate(const WebCore::IntSize& size, ShareableSurface::Handle& handle, WebCore::IntPoint& offset)
-{
-    return m_webGraphicsLayerClient->beginContentUpdate(size, contentsOpaque() ? 0 : ShareableBitmap::SupportsAlpha, handle, offset);
-}
-
-void WebGraphicsLayer::createTile(int tileID, const SurfaceUpdateInfo& updateInfo, const IntRect& targetRect)
-{
-    m_webGraphicsLayerClient->createTile(id(), tileID, updateInfo, targetRect);
-}
-
-void WebGraphicsLayer::updateTile(int tileID, const SurfaceUpdateInfo& updateInfo, const IntRect& targetRect)
-{
-    m_webGraphicsLayerClient->updateTile(id(), tileID, updateInfo, targetRect);
-}
-
-void WebGraphicsLayer::removeTile(int tileID)
-{
-    m_webGraphicsLayerClient->removeTile(id(), tileID);
-}
-
-void WebGraphicsLayer::updateContentBuffers()
-{
-    if (!drawsContent()) {
-        m_mainBackingStore.clear();
-        m_previousBackingStore.clear();
-        return;
-    }
-
-    m_inUpdateMode = true;
-    // This is the only place we (re)create the main tiled backing store, once we
-    // have a remote client and we are ready to send our data to the UI process.
-    if (!m_mainBackingStore)
-        createBackingStore();
-    m_mainBackingStore->updateTileBuffers();
-    m_inUpdateMode = false;
-
-    // The previous backing store is kept around to avoid flickering between
-    // removing the existing tiles and painting the new ones. The first time
-    // the visibleRect is full painted we remove the previous backing store.
-    if (m_mainBackingStore->visibleAreaIsCovered())
-        m_previousBackingStore.clear();
-}
-
-void WebGraphicsLayer::purgeBackingStores()
-{
-    m_mainBackingStore.clear();
-    m_previousBackingStore.clear();
-
-    if (m_layerInfo.imageBackingStoreID) {
-        m_webGraphicsLayerClient->releaseImageBackingStore(m_layerInfo.imageBackingStoreID);
-        m_layerInfo.imageBackingStoreID = 0;
-    }
-
-    didChangeLayerState();
-    didChangeChildren();
-}
-
-void WebGraphicsLayer::setWebGraphicsLayerClient(WebKit::WebGraphicsLayerClient* client)
-{
-    if (m_webGraphicsLayerClient == client)
-        return;
-
-    if (WebGraphicsLayer* replica = toWebGraphicsLayer(replicaLayer()))
-        replica->setWebGraphicsLayerClient(client);
-    if (WebGraphicsLayer* mask = toWebGraphicsLayer(maskLayer()))
-        mask->setWebGraphicsLayerClient(client);
-    for (size_t i = 0; i < children().size(); ++i) {
-        WebGraphicsLayer* layer = toWebGraphicsLayer(this->children()[i]);
-        layer->setWebGraphicsLayerClient(client);
-    }
-
-    // We have to release resources on the UI process here if the remote client has changed or is removed.
-    if (m_webGraphicsLayerClient) {
-        purgeBackingStores();
-        m_webGraphicsLayerClient->detachLayer(this);
-    }
-    m_webGraphicsLayerClient = client;
-    if (client)
-        client->attachLayer(this);
-}
-
-void WebGraphicsLayer::adjustVisibleRect()
-{
-    if (m_mainBackingStore)
-        m_mainBackingStore->coverWithTilesIfNeeded();
-}
-
-void WebGraphicsLayer::computeTransformedVisibleRect()
-{
-    if (!m_shouldUpdateVisibleRect)
-        return;
-    m_shouldUpdateVisibleRect = false;
-    m_layerTransform.setLocalTransform(transform());
-    m_layerTransform.setPosition(position());
-    m_layerTransform.setAnchorPoint(anchorPoint());
-    m_layerTransform.setSize(size());
-    m_layerTransform.setFlattening(!preserves3D());
-    m_layerTransform.setChildrenTransform(childrenTransform());
-    m_layerTransform.combineTransforms(parent() ? toWebGraphicsLayer(parent())->m_layerTransform.combinedForChildren() : TransformationMatrix());
-
-    // The combined transform will be used in tiledBackingStoreVisibleRect.
-    adjustVisibleRect();
-    adjustContentsScale();
-}
-
-static PassOwnPtr<GraphicsLayer> createWebGraphicsLayer(GraphicsLayerClient* client)
-{
-    return adoptPtr(new WebGraphicsLayer(client));
-}
-
-void WebGraphicsLayer::initFactory()
-{
-    GraphicsLayer::setGraphicsLayerFactory(createWebGraphicsLayer);
-}
-
-bool WebGraphicsLayer::selfOrAncestorHaveNonAffineTransforms()
-{
-    if (!m_layerTransform.combined().isAffine())
-        return true;
-
-    return false;
-}
-
-}
-#endif
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
index bf011e085..87b46b372 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
@@ -34,7 +34,7 @@
 #endif
 #endif
 
-#if PLATFORM(QT)
+#if USE(COORDINATED_GRAPHICS)
 #include "LayerTreeCoordinator.h"
 #endif
 
@@ -52,7 +52,7 @@ PassRefPtr<LayerTreeHost> LayerTreeHost::create(WebPage* webPage)
     return LayerTreeHostCAMac::create(webPage);
 #elif PLATFORM(WIN) && HAVE(WKQCA)
     return LayerTreeHostCAWin::create(webPage);
-#elif PLATFORM(QT)
+#elif USE(COORDINATED_GRAPHICS)
     return LayerTreeCoordinator::create(webPage);
 #elif PLATFORM(GTK) && USE(TEXTURE_MAPPER_GL)
     return LayerTreeHostGtk::create(webPage);
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
index 1372f2a29..9beeb3d0c 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
+++ b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
@@ -73,6 +73,7 @@ public:
     virtual void setNonCompositedContentsNeedDisplay(const WebCore::IntRect&) = 0;
     virtual void scrollNonCompositedContents(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset) = 0;
     virtual void forceRepaint() = 0;
+    virtual bool forceRepaintAsync(uint64_t callbackID) { return false; }
     virtual void sizeDidChange(const WebCore::IntSize& newSize) = 0;
     virtual void deviceScaleFactorDidChange() = 0;
 
@@ -85,7 +86,7 @@ public:
     virtual void pauseRendering() { }
     virtual void resumeRendering() { }
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
     virtual void setVisibleContentsRect(const WebCore::IntRect&, float scale, const WebCore::FloatPoint&) { }
     virtual void setVisibleContentsRectForLayer(int layerID, const WebCore::IntRect&) { }
     virtual void renderNextFrame() { }
@@ -105,7 +106,7 @@ public:
     virtual WebCore::GraphicsDeviceAdapter* graphicsDeviceAdapter() const { return 0; }
 #endif
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
     virtual void scheduleAnimation() = 0;
 #endif
 
@@ -114,12 +115,12 @@ protected:
 
     WebPage* m_webPage;
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
     bool m_waitingForUIProcess;
 #endif
 };
 
-#if !PLATFORM(WIN) && !PLATFORM(QT)
+#if !PLATFORM(WIN) && !USE(COORDINATED_GRAPHICS)
 inline bool LayerTreeHost::supportsAcceleratedCompositing()
 {
     return true;
diff --git a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
index 0acd3486c..58869f399 100644
--- a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
@@ -20,7 +20,7 @@
 #include "config.h"
 #include "UpdateAtlas.h"
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 
 #include "GraphicsContext.h"
 #include "IntRect.h"
diff --git a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
index 74760a5b4..7d2223769 100644
--- a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
+++ b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
@@ -22,7 +22,7 @@
 
 #include "ShareableSurface.h"
 
-#if USE(UI_SIDE_COMPOSITING)
+#if USE(COORDINATED_GRAPHICS)
 namespace WebCore {
 class GraphicsContext;
 class IntRect;
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index 59d3bc5cb..59617dfd3 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -120,6 +120,10 @@
 #include <WebCore/Range.h>
 #include <WebCore/VisiblePosition.h>
 
+#if ENABLE(MHTML)
+#include <WebCore/MHTMLArchive.h>
+#endif
+
 #if ENABLE(PLUGIN_PROCESS)
 #if PLATFORM(MAC)
 #include "MachPort.h"
@@ -207,6 +211,10 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     , m_isInRedo(false)
     , m_isClosed(false)
     , m_tabToLinks(false)
+    , m_asynchronousPluginInitializationEnabled(false)
+    , m_asynchronousPluginInitializationEnabledForAllPlugins(false)
+    , m_artificialPluginInitializationDelayEnabled(false)
+    , m_scrollingPerformanceLoggingEnabled(false)
 #if PLATFORM(MAC)
     , m_windowIsVisible(false)
     , m_isSmartInsertDeleteEnabled(parameters.isSmartInsertDeleteEnabled)
@@ -296,13 +304,7 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     WebCore::provideVibrationTo(m_page.get(), new WebVibrationClient(this));
 #endif
 
-    // Qt does not yet call setIsInWindow. Until it does, just leave
-    // this line out so plug-ins and video will work. Eventually all platforms
-    // should call setIsInWindow and this comment and #if should be removed,
-    // leaving behind the setCanStartMedia call.
-#if !PLATFORM(QT)
     m_page->setCanStartMedia(false);
-#endif
 
     updatePreferences(parameters.store);
 
@@ -1190,43 +1192,27 @@ void WebPage::uninstallPageOverlay(PageOverlay* pageOverlay, bool fadeOut)
 #endif
 }
 
-PassRefPtr<WebImage> WebPage::snapshotInViewCoordinates(const IntRect& rect, ImageOptions options)
+static ImageOptions snapshotOptionsToImageOptions(SnapshotOptions snapshotOptions)
 {
-    FrameView* frameView = m_mainFrame->coreFrame()->view();
-    if (!frameView)
-        return 0;
-
-    IntSize bitmapSize = rect.size();
-    float deviceScaleFactor = corePage()->deviceScaleFactor();
-    bitmapSize.scale(deviceScaleFactor);
-
-    RefPtr<WebImage> snapshot = WebImage::create(bitmapSize, options);
-    if (!snapshot->bitmap())
-        return 0;
-    
-    OwnPtr<WebCore::GraphicsContext> graphicsContext = snapshot->bitmap()->createGraphicsContext();
-    graphicsContext->applyDeviceScaleFactor(deviceScaleFactor);
-    graphicsContext->translate(-rect.x(), -rect.y());
-
-    frameView->updateLayoutAndStyleIfNeededRecursive();
+    unsigned imageOptions = 0;
 
-    PaintBehavior oldBehavior = frameView->paintBehavior();
-    frameView->setPaintBehavior(oldBehavior | PaintBehaviorFlattenCompositingLayers);
-    frameView->paint(graphicsContext.get(), rect);
-    frameView->setPaintBehavior(oldBehavior);
+    if (snapshotOptions & SnapshotOptionsShareable)
+        imageOptions |= ImageOptionsShareable;
 
-    return snapshot.release();
+    return static_cast<ImageOptions>(imageOptions);
 }
 
-PassRefPtr<WebImage> WebPage::scaledSnapshotInDocumentCoordinates(const IntRect& rect, double scaleFactor, ImageOptions options)
+PassRefPtr<WebImage> WebPage::scaledSnapshotWithOptions(const IntRect& rect, double scaleFactor, SnapshotOptions options)
 {
     FrameView* frameView = m_mainFrame->coreFrame()->view();
     if (!frameView)
         return 0;
 
+    IntSize bitmapSize = rect.size();
     float combinedScaleFactor = scaleFactor * corePage()->deviceScaleFactor();
-    IntSize size(ceil(rect.width() * combinedScaleFactor), ceil(rect.height() * combinedScaleFactor));
-    RefPtr<WebImage> snapshot = WebImage::create(size, options);
+    bitmapSize.scale(combinedScaleFactor);
+
+    RefPtr<WebImage> snapshot = WebImage::create(bitmapSize, snapshotOptionsToImageOptions(options));
     if (!snapshot->bitmap())
         return 0;
 
@@ -1234,21 +1220,15 @@ PassRefPtr<WebImage> WebPage::scaledSnapshotInDocumentCoordinates(const IntRect&
     graphicsContext->applyDeviceScaleFactor(combinedScaleFactor);
     graphicsContext->translate(-rect.x(), -rect.y());
 
-    frameView->updateLayoutAndStyleIfNeededRecursive();
+    FrameView::SelectionInSnaphot shouldPaintSelection = FrameView::IncludeSelection;
+    if (options & SnapshotOptionsExcludeSelectionHighlighting)
+        shouldPaintSelection = FrameView::ExcludeSelection;
 
-    PaintBehavior oldBehavior = frameView->paintBehavior();
-    frameView->setPaintBehavior(oldBehavior | PaintBehaviorFlattenCompositingLayers);
-    frameView->paintContents(graphicsContext.get(), rect);
-    frameView->setPaintBehavior(oldBehavior);
+    frameView->paintContentsForSnapshot(graphicsContext.get(), rect, shouldPaintSelection);
 
     return snapshot.release();
 }
 
-PassRefPtr<WebImage> WebPage::snapshotInDocumentCoordinates(const IntRect& rect, ImageOptions options)
-{
-    return scaledSnapshotInDocumentCoordinates(rect, 1, options);
-}
-
 void WebPage::pageDidScroll()
 {
     m_uiClient.pageDidScroll(this);
@@ -1854,6 +1834,22 @@ void WebPage::getContentsAsString(uint64_t callbackID)
     send(Messages::WebPageProxy::StringCallback(resultString, callbackID));
 }
 
+#if ENABLE(MHTML)
+void WebPage::getContentsAsMHTMLData(uint64_t callbackID, bool useBinaryEncoding)
+{
+    CoreIPC::DataReference dataReference;
+
+    RefPtr<SharedBuffer> buffer = useBinaryEncoding
+        ? MHTMLArchive::generateMHTMLDataUsingBinaryEncoding(m_page.get())
+        : MHTMLArchive::generateMHTMLData(m_page.get());
+
+    if (buffer)
+        dataReference = CoreIPC::DataReference(reinterpret_cast<const uint8_t*>(buffer->data()), buffer->size());
+
+    send(Messages::WebPageProxy::DataCallback(dataReference, callbackID));
+}
+#endif
+
 void WebPage::getRenderTreeExternalRepresentation(uint64_t callbackID)
 {
     String resultString = renderTreeExternalRepresentation();
@@ -1976,6 +1972,11 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
     Settings* settings = m_page->settings();
 
     m_tabToLinks = store.getBoolValueForKey(WebPreferencesKey::tabsToLinksKey());
+    m_asynchronousPluginInitializationEnabled = store.getBoolValueForKey(WebPreferencesKey::asynchronousPluginInitializationEnabledKey());
+    m_asynchronousPluginInitializationEnabledForAllPlugins = store.getBoolValueForKey(WebPreferencesKey::asynchronousPluginInitializationEnabledForAllPluginsKey());
+    m_artificialPluginInitializationDelayEnabled = store.getBoolValueForKey(WebPreferencesKey::artificialPluginInitializationDelayEnabledKey());
+
+    m_scrollingPerformanceLoggingEnabled = store.getBoolValueForKey(WebPreferencesKey::scrollingPerformanceLoggingEnabledKey());
 
     // FIXME: This should be generated from macro expansion for all preferences,
     // but we currently don't match the naming of WebCore exactly so we are
@@ -2090,9 +2091,12 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
 #endif
 
     settings->setShouldRespectImageOrientation(store.getBoolValueForKey(WebPreferencesKey::shouldRespectImageOrientationKey()));
+    settings->setThirdPartyStorageBlockingEnabled(store.getBoolValueForKey(WebPreferencesKey::thirdPartyStorageBlockingEnabledKey()));
 
     settings->setDiagnosticLoggingEnabled(store.getBoolValueForKey(WebPreferencesKey::diagnosticLoggingEnabledKey()));
 
+    settings->setScrollingPerformanceLoggingEnabled(m_scrollingPerformanceLoggingEnabled);
+
     platformPreferencesDidChange(store);
 
     if (m_drawingArea)
@@ -3286,4 +3290,15 @@ void WebPage::setVisibilityState(int visibilityState, bool isInitialState)
 }
 #endif
 
+void WebPage::setScrollingPerformanceLoggingEnabled(bool enabled)
+{
+    m_scrollingPerformanceLoggingEnabled = enabled;
+
+    FrameView* frameView = m_mainFrame->coreFrame()->view();
+    if (!frameView)
+        return;
+
+    frameView->setScrollingPerformanceLoggingEnabled(enabled);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.h b/Source/WebKit2/WebProcess/WebPage/WebPage.h
index e3257a33a..bbfabd04a 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.h
@@ -346,9 +346,7 @@ public:
     WebCore::IntPoint screenToWindow(const WebCore::IntPoint&);
     WebCore::IntRect windowToScreen(const WebCore::IntRect&);
 
-    PassRefPtr<WebImage> snapshotInViewCoordinates(const WebCore::IntRect&, ImageOptions);
-    PassRefPtr<WebImage> snapshotInDocumentCoordinates(const WebCore::IntRect&, ImageOptions);
-    PassRefPtr<WebImage> scaledSnapshotInDocumentCoordinates(const WebCore::IntRect&, double scaleFactor, ImageOptions);
+    PassRefPtr<WebImage> scaledSnapshotWithOptions(const WebCore::IntRect&, double scaleFactor, SnapshotOptions);
 
     static const WebEvent* currentEvent();
 
@@ -570,6 +568,16 @@ public:
     uint64_t nativeWindowHandle() { return m_nativeWindowHandle; }
 #endif
 
+    bool asynchronousPluginInitializationEnabled() const { return m_asynchronousPluginInitializationEnabled; }
+    void setAsynchronousPluginInitializationEnabled(bool enabled) { m_asynchronousPluginInitializationEnabled = enabled; }
+    bool asynchronousPluginInitializationEnabledForAllPlugins() const { return m_asynchronousPluginInitializationEnabledForAllPlugins; }
+    void setAsynchronousPluginInitializationEnabledForAllPlugins(bool enabled) { m_asynchronousPluginInitializationEnabledForAllPlugins = enabled; }
+    bool artificialPluginInitializationDelayEnabled() const { return m_artificialPluginInitializationDelayEnabled; }
+    void setArtificialPluginInitializationDelayEnabled(bool enabled) { m_artificialPluginInitializationDelayEnabled = enabled; }
+
+    bool scrollingPerformanceLoggingEnabled() const { return m_scrollingPerformanceLoggingEnabled; }
+    void setScrollingPerformanceLoggingEnabled(bool);
+
 private:
     WebPage(uint64_t pageID, const WebPageCreationParameters&);
 
@@ -650,6 +658,9 @@ private:
     void viewWillEndLiveResize();
 
     void getContentsAsString(uint64_t callbackID);
+#if ENABLE(MHTML)
+    void getContentsAsMHTMLData(uint64_t callbackID, bool useBinaryEncoding);
+#endif
     void getMainResourceDataOfFrame(uint64_t frameID, uint64_t callbackID);
     void getResourceDataFromFrame(uint64_t frameID, const String& resourceURL, uint64_t callbackID);
     void getRenderTreeExternalRepresentation(uint64_t callbackID);
@@ -758,6 +769,12 @@ private:
     bool m_isClosed;
 
     bool m_tabToLinks;
+    
+    bool m_asynchronousPluginInitializationEnabled;
+    bool m_asynchronousPluginInitializationEnabledForAllPlugins;
+    bool m_artificialPluginInitializationDelayEnabled;
+
+    bool m_scrollingPerformanceLoggingEnabled;
 
 #if PLATFORM(MAC)
     // Whether the containing window is visible or not.
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
index 39c8114b5..e3ff23cad 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
@@ -91,6 +91,9 @@ messages -> WebPage {
 
     # Callbacks.
     GetContentsAsString(uint64_t callbackID)
+#if ENABLE(MHTML)
+    GetContentsAsMHTMLData(uint64_t callbackID, bool useBinaryEncoding)
+#endif
     GetMainResourceDataOfFrame(uint64_t frameID, uint64_t callbackID)
     GetResourceDataFromFrame(uint64_t frameID, WTF::String resourceURL, uint64_t callbackID)
     GetRenderTreeExternalRepresentation(uint64_t callbackID)
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
index 4dffb6edd..2433d770f 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
@@ -212,7 +212,10 @@ void TiledCoreAnimationDrawingArea::updatePreferences()
         m_debugInfoLayer = nullptr;
     }
 
+    bool scrollingPerformanceLoggingEnabled = m_webPage->scrollingPerformanceLoggingEnabled();
+
     ScrollingThread::dispatch(bind(&ScrollingTree::setDebugRootLayer, m_webPage->corePage()->scrollingCoordinator()->scrollingTree(), m_debugInfoLayer));
+    ScrollingThread::dispatch(bind(&ScrollingTree::setScrollingPerformanceLoggingEnabled, m_webPage->corePage()->scrollingCoordinator()->scrollingTree(), scrollingPerformanceLoggingEnabled));
 }
 
 void TiledCoreAnimationDrawingArea::dispatchAfterEnsuringUpdatedScrollPosition(const Function<void ()>& functionRef)
diff --git a/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp b/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
index 16278a38e..d03acf97a 100644
--- a/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
+++ b/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
@@ -36,6 +36,10 @@
 #include <unistd.h>
 #include <wtf/MainThread.h>
 
+#if USE(COORDINATED_GRAPHICS)
+#include "CoordinatedGraphicsLayer.h"
+#endif
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -76,6 +80,12 @@ WK_EXPORT int WebProcessMainEfl(int argc, char* argv[])
         g_object_unref(resolverEfl);
     }
 
+#if USE(COORDINATED_GRAPHICS)
+    CoordinatedGraphicsLayer::initFactory();
+#endif
+
+    WebCore::ResourceHandle::setIgnoreSSLErrors(true);
+
     int socket = atoi(argv[1]);
     WebProcess::shared().initialize(socket, RunLoop::main());
     RunLoop::run();
diff --git a/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp b/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
index 199957f43..defd418a0 100644
--- a/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
+++ b/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
@@ -80,6 +80,9 @@ WK_EXPORT int WebProcessMainGtk(int argc, char* argv[])
     soup_session_add_feature(session, SOUP_SESSION_FEATURE(soupCache.get()));
     soup_cache_load(soupCache.get());
 
+    // This is for compatibility, it will be removed when UI process can handle SSL errors.
+    WebCore::ResourceHandle::setIgnoreSSLErrors(true);
+
     RunLoop::run();
 
     return 0;
diff --git a/Source/WebKit2/WebProcess/mac/WebProcessMainMac.mm b/Source/WebKit2/WebProcess/mac/WebProcessMainMac.mm
index 1b67fc6c2..7e926ad3a 100644
--- a/Source/WebKit2/WebProcess/mac/WebProcessMainMac.mm
+++ b/Source/WebKit2/WebProcess/mac/WebProcessMainMac.mm
@@ -47,6 +47,10 @@
 #import <wtf/text/CString.h>
 #import <wtf/text/StringBuilder.h>
 
+#if HAVE(XPC)
+#import <xpc/xpc.h>
+#endif
+
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
 extern "C" kern_return_t bootstrap_register2(mach_port_t, name_t, mach_port_t, uint64_t);
 #endif
@@ -61,14 +65,51 @@ extern "C" kern_return_t bootstrap_register2(mach_port_t, name_t, mach_port_t, u
 
 using namespace WebCore;
 
+#if HAVE(XPC)
 namespace WebKit {
+int WebProcessMainXPC(xpc_connection_t xpcConnection, mach_port_t serverPort);
+}
 
-int WebProcessMain(const CommandLine& commandLine)
+extern "C" WK_EXPORT int WebKitMainXPC(xpc_connection_t xpcConnection, mach_port_t serverPort);
+
+int WebKitMainXPC(xpc_connection_t xpcConnection, mach_port_t serverPort)
 {
-    // Remove the WebProcess shim from the DYLD_INSERT_LIBRARIES environment variable so any processes spawned by
-    // the WebProcess don't try to insert the shim and crash.
-    EnvironmentUtilities::stripValuesEndingWithString("DYLD_INSERT_LIBRARIES", "/WebProcessShim.dylib");
+    ASSERT(!objc_collectingEnabled());
+
+    return WebKit::WebProcessMainXPC(xpcConnection, serverPort);
+}
+#endif
+
+namespace WebKit {
+
+#if HAVE(XPC)
+
+int WebProcessMainXPC(xpc_connection_t xpcConnection, mach_port_t serverPort)
+{
+    NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
+
+    InitWebCoreSystemInterface();
+    JSC::initializeThreading();
+    WTF::initializeMainThread();
+    RunLoop::initializeMainRunLoop();
+
+    // Initialize the shim.
+    // FIXME: Make the shim work.
+    WebProcess::shared().initializeShim();
+
+    // Create the connection.
+    WebProcess::shared().initialize(CoreIPC::Connection::Identifier(serverPort, xpcConnection), RunLoop::main());
+
+    WKAXRegisterRemoteApp();
 
+    [pool drain];
+
+    return 0;
+}
+#endif
+
+int WebProcessMain(const CommandLine& commandLine)
+{
     NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
 
     String serviceName = commandLine["servicename"];
@@ -165,7 +206,7 @@ int WebProcessMain(const CommandLine& commandLine)
     WebProcess::shared().initializeShim();
 
     // Create the connection.
-    WebProcess::shared().initialize(serverPort, RunLoop::main());
+    WebProcess::shared().initialize(CoreIPC::Connection::Identifier(serverPort), RunLoop::main());
 
     [pool drain];
 
diff --git a/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp b/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp
index cb72cb9be..28b200d13 100644
--- a/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp
+++ b/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp
@@ -38,7 +38,7 @@
 #include <wtf/MainThread.h>
 
 #if USE(ACCELERATED_COMPOSITING)
-#include "WebGraphicsLayer.h"
+#include "CoordinatedGraphicsLayer.h"
 #endif
 #if USE(QTKIT)
 #include "WebSystemInterface.h"
@@ -181,7 +181,7 @@ Q_DECL_EXPORT int WebProcessMainQt(QGuiApplication* app)
     }
 #endif
 #if USE(ACCELERATED_COMPOSITING)
-    WebGraphicsLayer::initFactory();
+    CoordinatedGraphicsLayer::initFactory();
 #endif
 
     WebKit::WebProcess::shared().initialize(identifier, RunLoop::main());
diff --git a/Source/WebKit2/mac/MainMac.cpp b/Source/WebKit2/mac/MainMacProcess.cpp
index 5afc1ef24..5afc1ef24 100644
--- a/Source/WebKit2/mac/MainMac.cpp
+++ b/Source/WebKit2/mac/MainMacProcess.cpp
diff --git a/Source/WebKit2/win/WebKit2.vcproj b/Source/WebKit2/win/WebKit2.vcproj
index a362b046d..ab6efdc8f 100755
--- a/Source/WebKit2/win/WebKit2.vcproj
+++ b/Source/WebKit2/win/WebKit2.vcproj
@@ -3281,7 +3281,7 @@
 					Name="C"
 					>
 					<File
-						RelativePath="..\UIProcess\API\C\WebKit2.h"
+						RelativePath="..\UIProcess\API\C\WebKit2_C.h"
 						>
 					</File>
 					<File
@@ -3753,14 +3753,6 @@
 					RelativePath="..\UIProcess\Launcher\ProcessLauncher.h"
 					>
 				</File>
-				<File
-					RelativePath="..\UIProcess\Launcher\ThreadLauncher.cpp"
-					>
-				</File>
-				<File
-					RelativePath="..\UIProcess\Launcher\ThreadLauncher.h"
-					>
-				</File>
 				<Filter
 					Name="win"
 					>
@@ -3768,10 +3760,6 @@
 						RelativePath="..\UIProcess\Launcher\win\ProcessLauncherWin.cpp"
 						>
 					</File>
-					<File
-						RelativePath="..\UIProcess\Launcher\win\ThreadLauncherWin.cpp"
-						>
-					</File>
 				</Filter>
 			</Filter>
 			<Filter
diff --git a/Source/WebKit2/win/WebKit2Generated.make b/Source/WebKit2/win/WebKit2Generated.make
index ce7991fbe..eee26864f 100644
--- a/Source/WebKit2/win/WebKit2Generated.make
+++ b/Source/WebKit2/win/WebKit2Generated.make
@@ -45,7 +45,7 @@ all:
     xcopy /y /d "..\Shared\API\c\WKURLResponse.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\Shared\API\c\WKUserContentURLPattern.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\cg\WKIconDatabaseCG.h" "%ConfigurationBuildDir%\include\WebKit2"
-    xcopy /y /d "..\UIProcess\API\C\WebKit2.h" "%ConfigurationBuildDir%\include\WebKit2"
+    xcopy /y /d "..\UIProcess\API\C\WebKit2_C.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKApplicationCacheManager.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKAuthenticationChallenge.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKAuthenticationDecisionListener.h" "%ConfigurationBuildDir%\include\WebKit2"
diff --git a/Source/api.pri b/Source/api.pri
index 61984d244..7e53cc99d 100644
--- a/Source/api.pri
+++ b/Source/api.pri
@@ -9,71 +9,64 @@ TARGET = QtWebKit
 
 WEBKIT_DESTDIR = $${ROOT_BUILD_DIR}/lib
 
-haveQt(5) {
-    # Use Qt5's module system
-    load(qt_build_config)
-    MODULE = webkit
-    MODULE_PRI = ../Tools/qmake/qt_webkit.pri
-
-    # ---------------- Custom developer-build handling -------------------
-    #
-    # The assumption for Qt developer builds is that the module file
-    # will be put into qtbase/mkspecs/modules, and the libraries into
-    # qtbase/lib, with rpath/install_name set to the Qt lib dir.
-    #
-    # For WebKit we don't want that behavior for the libraries, as we want
-    # them to be self-contained in the WebKit build dir.
-    #
-    CONFIG += force_independent
-
-    BASE_TARGET = $$TARGET
-
-    load(qt_module_config)
-
-    # Make sure the module config doesn't override our preferred build config.
-    debug_and_release:if(!debug|!release) {
-        # Removing debug_and_release causes issues with lib suffixes when building debug on Windows.
-        # Work around it by only removing build_all, and still create the Makefiles for both configurations.
-        win32*: CONFIG -= build_all
-        else: CONFIG -= debug_and_release
-    }
+# Use Qt5's module system
+load(qt_build_config)
+MODULE = webkit
+MODULE_PRI = ../Tools/qmake/qt_webkit.pri
 
-    # Allow doing a debug-only build of WebKit (not supported by Qt)
-    macx:!debug_and_release:debug: TARGET = $$BASE_TARGET
-
-    # Make sure the install_name of the QtWebKit library point to webkit
-    macx {
-        # We do our own absolute path so that we can trick qmake into
-        # using the webkit build path instead of the Qt install path.
-        CONFIG -= absolute_library_soname
-        QMAKE_LFLAGS_SONAME = $$QMAKE_LFLAGS_SONAME$$WEBKIT_DESTDIR/
-
-        !debug_and_release|build_pass {
-            # We also have to make sure the install_name is correct when
-            # the library is installed.
-            change_install_name.depends = install_target
-
-            # The install rules generated by qmake for frameworks are busted in
-            # that both the debug and the release makefile copy QtWebKit.framework
-            # into the install dir, so whatever changes we did to the release library
-            # will get overwritten when the debug library is installed. We work around
-            # that by running install_name on both, for both configs.
-            change_install_name.commands = framework_dir=\$\$(dirname $(TARGETD)); \
-                for file in \$\$(ls $$[QT_INSTALL_LIBS]/\$\$framework_dir/$$BASE_TARGET*); do \
-                    install_name_tool -id \$\$file \$\$file; \
-                done
-            default_install_target.target = install
-            default_install_target.depends += change_install_name
-
-            QMAKE_EXTRA_TARGETS += change_install_name default_install_target
-        }
-    }
-} else {
-    VERSION = $$QT_VERSION
-    DESTDIR = $$WEBKIT_DESTDIR
+# ---------------- Custom developer-build handling -------------------
+#
+# The assumption for Qt developer builds is that the module file
+# will be put into qtbase/mkspecs/modules, and the libraries into
+# qtbase/lib, with rpath/install_name set to the Qt lib dir.
+#
+# For WebKit we don't want that behavior for the libraries, as we want
+# them to be self-contained in the WebKit build dir.
+#
+CONFIG += force_independent
+
+BASE_TARGET = $$TARGET
+
+load(qt_module_config)
+
+# Make sure the module config doesn't override our preferred build config.
+debug_and_release:if(!debug|!release) {
+    # Removing debug_and_release causes issues with lib suffixes when building debug on Windows.
+    # Work around it by only removing build_all, and still create the Makefiles for both configurations.
+    win32*: CONFIG -= build_all
+    else: CONFIG -= debug_and_release
 }
 
-runSyncQt() # Generate forwarding headers for the QtWebKit API
+# Allow doing a debug-only build of WebKit (not supported by Qt)
+macx:!debug_and_release:debug: TARGET = $$BASE_TARGET
+
+# Make sure the install_name of the QtWebKit library point to webkit
+macx {
+    # We do our own absolute path so that we can trick qmake into
+    # using the webkit build path instead of the Qt install path.
+    CONFIG -= absolute_library_soname
+    QMAKE_LFLAGS_SONAME = $$QMAKE_LFLAGS_SONAME$$WEBKIT_DESTDIR/
+
+    !debug_and_release|build_pass {
+        # We also have to make sure the install_name is correct when
+        # the library is installed.
+        change_install_name.depends = install_target
+
+        # The install rules generated by qmake for frameworks are busted in
+        # that both the debug and the release makefile copy QtWebKit.framework
+        # into the install dir, so whatever changes we did to the release library
+        # will get overwritten when the debug library is installed. We work around
+        # that by running install_name on both, for both configs.
+        change_install_name.commands = framework_dir=\$\$(dirname $(TARGETD)); \
+            for file in \$\$(ls $$[QT_INSTALL_LIBS]/\$\$framework_dir/$$BASE_TARGET*); do \
+                install_name_tool -id \$\$file \$\$file; \
+            done
+        default_install_target.target = install
+        default_install_target.depends += change_install_name
+
+        QMAKE_EXTRA_TARGETS += change_install_name default_install_target
+    }
+}
 
 WEBKIT += wtf
 
@@ -91,52 +84,3 @@ WEBKIT += webcore
 }
 
 !no_webkit1: WEBKIT += webkit1
-
-# ------------- Install rules -------------
-
-haveQt(5) {
-    # Install rules handled by Qt's module system
-} else {
-    # For Qt4 we have to set up install rules manually
-
-    # Syncqt has already run at this point, so we can use headers.pri
-    # as a basis for our install-rules
-    HEADERS_PRI = $${ROOT_BUILD_DIR}/include/$${QT.webkit.name}/headers.pri
-    !include($$HEADERS_PRI): error(Failed to resolve install headers)
-
-    headers.files = $$SYNCQT.HEADER_FILES $$SYNCQT.HEADER_CLASSES
-    !isEmpty(INSTALL_HEADERS): headers.path = $$INSTALL_HEADERS/$${TARGET}
-    else: headers.path = $$[QT_INSTALL_HEADERS]/$${TARGET}
-    INSTALLS += headers
-
-    !isEmpty(INSTALL_LIBS): target.path = $$INSTALL_LIBS
-    else: target.path = $$[QT_INSTALL_LIBS]
-    INSTALLS += target
-
-    unix {
-        CONFIG += create_pc create_prl
-        QMAKE_PKGCONFIG_LIBDIR = $$target.path
-        QMAKE_PKGCONFIG_INCDIR = $$headers.path
-        QMAKE_PKGCONFIG_DESTDIR = pkgconfig
-        lib_replace.match = $$re_escape($$DESTDIR)
-        lib_replace.replace = $$[QT_INSTALL_LIBS]
-        QMAKE_PKGCONFIG_INSTALL_REPLACE += lib_replace
-    }
-
-    mac {
-        !static:contains(QT_CONFIG, qt_framework) {
-            # Build QtWebKit as a framework, to match how Qt was built
-            CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
-
-            # For debug_and_release configs, only copy headers in release
-            !debug_and_release|if(build_pass:CONFIG(release, debug|release)) {
-                FRAMEWORK_HEADERS.version = Versions
-                FRAMEWORK_HEADERS.files = $${headers.files}
-                FRAMEWORK_HEADERS.path = Headers
-                QMAKE_BUNDLE_DATA += FRAMEWORK_HEADERS
-            }
-        }
-
-        QMAKE_LFLAGS_SONAME = "$${QMAKE_LFLAGS_SONAME}$${DESTDIR}$${QMAKE_DIR_SEP}"
-    }
-}
diff --git a/Source/autotools/symbols.filter b/Source/autotools/symbols.filter
index ddeccf605..82ffc2e9a 100644
--- a/Source/autotools/symbols.filter
+++ b/Source/autotools/symbols.filter
@@ -157,6 +157,7 @@ _ZN7WebCore22RuntimeEnabledFeatures32setMultipleShadowSubtreesEnabledEb;
 _ZN7WebCore22RuntimeEnabledFeatures18isShadowDOMEnabledE;
 _ZN7WebCore22RuntimeEnabledFeatures22isCSSExclusionsEnabledE;
 _ZN7WebCore22RuntimeEnabledFeatures22isDialogElementEnabledE;
+_ZN7WebCore22RuntimeEnabledFeatures37isAuthorShadowDOMForAnyElementEnabledE;
 _ZNK7WebCore8Document13nodesFromRectEiijjjjbb;
 _ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_8NodeListE;
 _ZNK7WebCore6Editor26selectionStartHasMarkerForENS_14DocumentMarker10MarkerTypeEii;
diff --git a/Source/cmake/FindHarfBuzz.cmake b/Source/cmake/FindHarfBuzz.cmake
index 8a99019b5..a3488792a 100644
--- a/Source/cmake/FindHarfBuzz.cmake
+++ b/Source/cmake/FindHarfBuzz.cmake
@@ -24,12 +24,14 @@
 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 # POSSIBILITY OF SUCH DAMAGE.
 #
+# Try to find Harfbuzz include and library directories.
 #
+# After successful discovery, this will set for inclusion where needed:
+# HARFBUZZ_INCLUDE_DIRS - containg the HarfBuzz headers
+# HARFBUZZ_LIBRARIES - containg the HarfBuzz library
 
 INCLUDE(FindPkgConfig)
 
-PKG_CHECK_MODULES (harfbuzz REQUIRED harfbuzz>=0.9.0)
-
 PKG_CHECK_MODULES(PC_HARFBUZZ harfbuzz>=0.9.0)
 
 FIND_PATH(HARFBUZZ_INCLUDE_DIRS NAMES hb.h
diff --git a/Source/cmake/OptionsBlackBerry.cmake b/Source/cmake/OptionsBlackBerry.cmake
index af18cc1e9..59d05bc52 100644
--- a/Source/cmake/OptionsBlackBerry.cmake
+++ b/Source/cmake/OptionsBlackBerry.cmake
@@ -96,18 +96,23 @@ FIND_STAGING_LIBRARY(PROFILING_LIBRARY profilingS)
 FIND_STAGING_LIBRARY(LIB_INPUT_UTILITIES input_utilities)
 FIND_STAGING_LIBRARY(OTS_LIBRARY ots)
 
+# Add "-fPIC" to CMAKE_SHARED_LIBRARY_C_FLAGS and CMAKE_SHARED_LIBRARY_CXX_FLAGS
+# This is because "-fPIC" is not included in the default defines under Modules/Platform/QNX.cmake
+SET(CMAKE_SHARED_LIBRARY_C_FLAGS "-fPIC ${CMAKE_SHARED_LIBRARY_C_FLAGS}")
+SET(CMAKE_SHARED_LIBRARY_CXX_FLAGS "-fPIC ${CMAKE_SHARED_LIBRARY_CXX_FLAGS}")
+
 # Show unresolved symbols when doing the final shared object link
 IF (PROFILING)
-    SET(BLACKBERRY_LINK_FLAGS "-Wl,-z,defs -Wl,-zrelro -Wl,-E")
+    SET(BLACKBERRY_LINK_FLAGS "-Wl,-z,defs -Wl,-z,relro -Wl,-E")
 ELSE (PROFILING)
-    SET(BLACKBERRY_LINK_FLAGS "-Wl,-z,defs -Wl,-zrelro")
+    SET(BLACKBERRY_LINK_FLAGS "-Wl,-z,defs -Wl,-z,relro")
 ENDIF ()
 
 # Set custom CFLAGS for our port
 IF (CMAKE_COMPILER_IS_GNUCC)
     SET(CMAKE_CXX_FLAGS "-fstack-protector -fno-rtti -Wformat -Wformat-security -Werror=format-security ${CMAKE_CXX_FLAGS}")
     SET(CMAKE_C_FLAGS "-fstack-protector -fno-rtti -Wformat -Wformat-security -Werror=format-security ${CMAKE_C_FLAGS}")
-    SET(JSC_LINK_FLAGS "-N1024K")
+    SET(JSC_LINK_FLAGS "-Wl,-z,defs -Wl,-z,relro -N1024K")
 ENDIF ()
 
 IF (PROFILING)
@@ -173,9 +178,15 @@ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WORKERS ON)
 
 IF (ENABLE_GLES2)
     WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_3D_RENDERING ON)
+    WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_ACCELERATED_2D_CANVAS ON)
+    WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CSS_FILTERS ON)
+    WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CSS_SHADERS ON)
     WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WEBGL ON)
 ELSE ()
     WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_3D_RENDERING OFF)
+    WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_ACCELERATED_2D_CANVAS OFF)
+    WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CSS_FILTERS OFF)
+    WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CSS_SHADERS OFF)
     WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WEBGL OFF)
 ENDIF ()
 
diff --git a/Source/cmake/OptionsEfl.cmake b/Source/cmake/OptionsEfl.cmake
index 3c233162f..d96d22c5c 100644
--- a/Source/cmake/OptionsEfl.cmake
+++ b/Source/cmake/OptionsEfl.cmake
@@ -67,6 +67,7 @@ SET(THEME_BINARY_DIR ${CMAKE_BINARY_DIR}/WebKit/efl/DefaultTheme)
 SET(VERSION_SCRIPT "-Wl,--version-script,${CMAKE_MODULE_PATH}/eflsymbols.filter")
 
 WEBKIT_OPTION_BEGIN()
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_ANIMATION_API ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_API_TESTS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_BATTERY_STATUS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_BLOB ON)
@@ -82,6 +83,7 @@ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_GAMEPAD ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_GLIB_SUPPORT ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_INPUT_TYPE_COLOR ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_LEGACY_WEBKIT_BLOB_BUILDER ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_LINK_PREFETCH ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_MEDIA_CAPTURE ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_MICRODATA ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_NETSCAPE_PLUGIN_API OFF)
@@ -157,3 +159,23 @@ IF (ENABLE_WEBGL)
 ENDIF ()
 
 SET(CPACK_SOURCE_GENERATOR TBZ2)
+
+IF (WTF_USE_TILED_BACKING_STORE)
+  SET(WTF_USE_ACCELERATED_COMPOSITING 1)
+  ADD_DEFINITIONS(-DWTF_USE_ACCELERATED_COMPOSITING=1)
+
+  SET(WTF_USE_COORDINATED_GRAPHICS 1)
+  ADD_DEFINITIONS(-DWTF_USE_COORDINATED_GRAPHICS=1)
+
+  SET(WTF_USE_TEXTURE_MAPPER 1)
+  ADD_DEFINITIONS(-DWTF_USE_TEXTURE_MAPPER=1)
+
+  SET(WTF_USE_TEXTURE_MAPPER_GL 1)
+  ADD_DEFINITIONS(-DWTF_USE_TEXTURE_MAPPER_GL=1)
+
+  SET(WTF_USE_3D_GRAPHICS 1)
+  ADD_DEFINITIONS(-DWTF_USE_3D_GRAPHICS=1)
+
+  FIND_PACKAGE(OpenGL REQUIRED)
+ENDIF()
+
diff --git a/Source/cmake/OptionsWinCE.cmake b/Source/cmake/OptionsWinCE.cmake
index 270f00307..c8ff8ac60 100644
--- a/Source/cmake/OptionsWinCE.cmake
+++ b/Source/cmake/OptionsWinCE.cmake
@@ -1,7 +1,7 @@
 INCLUDE(OptionsWindows)
 
 ADD_DEFINITIONS(-D_CE_CRT_ALLOW_WIN_MINMAX)
-ADD_DEFINITIONS(-DWTF_USE_WINCE_UNICODE=1)
+ADD_DEFINITIONS(-DWTF_USE_WCHAR_UNICODE=1)
 ADD_DEFINITIONS(-DWTF_USE_WININET=1)
 ADD_DEFINITIONS(-DWTF_CPU_ARM_TRADITIONAL -DWINCEBASIC)
 ADD_DEFINITIONS(-DJS_NO_EXPORT)
diff --git a/Source/cmake/OptionsWindows.cmake b/Source/cmake/OptionsWindows.cmake
index 3fdcf687e..05681e82e 100644
--- a/Source/cmake/OptionsWindows.cmake
+++ b/Source/cmake/OptionsWindows.cmake
@@ -1,7 +1,7 @@
 ADD_DEFINITIONS(-DWTF_PLATFORM_WIN=1)
 SET(WTF_PLATFORM_WIN 1)
 
-ADD_DEFINITIONS(-DNOMINMAX -DUNICODE)
+ADD_DEFINITIONS(-D_HAS_EXCEPTIONS=0 -DNOMINMAX -DUNICODE)
 
 INCLUDE_DIRECTORIES(${JAVASCRIPTCORE_DIR}/os-win32)
 
@@ -10,7 +10,11 @@ IF (MSVC)
         /wd4018 /wd4065 /wd4068 /wd4099 /wd4100 /wd4127 /wd4138 /wd4180 /wd4189 /wd4201 /wd4244 /wd4251 /wd4275 /wd4288 /wd4291
         /wd4305 /wd4344 /wd4355 /wd4389 /wd4396 /wd4503 /wd4505 /wd4510 /wd4512 /wd4610 /wd4706 /wd4800 /wd4951 /wd4952 /wd4996)
 
+    STRING(REGEX REPLACE "/EH[a-z]+" "" CMAKE_CXX_FLAGS ${CMAKE_CXX_FLAGS}) # Disable C++ exceptions
+    STRING(REGEX REPLACE "/GR" "" CMAKE_CXX_FLAGS ${CMAKE_CXX_FLAGS}) # Disable RTTI
+
     IF (NOT MSVC_VERSION LESS 1500)
+        SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /MP")
         SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /MP")
     ENDIF ()
 ENDIF ()
diff --git a/Source/cmake/WebKitFeatures.cmake b/Source/cmake/WebKitFeatures.cmake
index 7eb3375a1..23bf1447b 100644
--- a/Source/cmake/WebKitFeatures.cmake
+++ b/Source/cmake/WebKitFeatures.cmake
@@ -25,6 +25,7 @@ MACRO (WEBKIT_OPTION_BEGIN)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_COMPOSITING "Toggle CSS COMPOSITING support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_EXCLUSIONS "Toggle CSS Exclusion support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_FILTERS "Toggle CSS Filters support" OFF)
+    WEBKIT_OPTION_DEFINE(ENABLE_CSS_HIERARCHIES "Toggle CSS Hierarchies support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_IMAGE_ORIENTATION "Toggle CSS image-orientation support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_IMAGE_RESOLUTION "Toggle CSS image-resolution support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_IMAGE_SET "Toggle CSS image-set support" OFF)
diff --git a/Source/cmakeconfig.h.cmake b/Source/cmakeconfig.h.cmake
index e256b0e58..df8cb176c 100644
--- a/Source/cmakeconfig.h.cmake
+++ b/Source/cmakeconfig.h.cmake
@@ -4,7 +4,7 @@
 #cmakedefine WEBKIT_USER_AGENT_MAJOR_VERSION @WEBKIT_USER_AGENT_MAJOR_VERSION@
 #cmakedefine WEBKIT_USER_AGENT_MINOR_VERSION @WEBKIT_USER_AGENT_MINOR_VERSION@
 
-
+#cmakedefine01 ENABLE_ANIMATION_API
 #cmakedefine01 ENABLE_API_TESTS
 #cmakedefine01 ENABLE_3D_RENDERING
 #cmakedefine01 ENABLE_ACCELERATED_2D_CANVAS
@@ -25,6 +25,8 @@
 #cmakedefine01 ENABLE_CSS_STICKY_POSITION
 #cmakedefine01 ENABLE_CSS_VARIABLES
 #cmakedefine01 ENABLE_CSS3_FLEXBOX
+#cmakedefine01 ENABLE_CSS_FILTERS
+#cmakedefine01 ENABLE_CSS_SHADERS
 #cmakedefine01 ENABLE_CUSTOM_SCHEME_HANDLER
 #cmakedefine01 ENABLE_DATALIST_ELEMENT
 #cmakedefine01 ENABLE_DATA_TRANSFER_ITEMS
diff --git a/Source/tests.pri b/Source/tests.pri
index 0042fc5fa..3c09864b1 100644
--- a/Source/tests.pri
+++ b/Source/tests.pri
@@ -44,10 +44,12 @@ SUBDIRS += \
 !no_webkit2 {
     WEBKIT2_TESTS_DIR = $$PWD/WebKit2/UIProcess/API/qt/tests
 
-    SUBDIRS += \
+    contains(DEFINES, HAVE_QTQUICK=1):SUBDIRS += \
         $$WEBKIT2_TESTS_DIR/inspectorserver \
         $$WEBKIT2_TESTS_DIR/publicapi \
         $$WEBKIT2_TESTS_DIR/qquickwebview \
-        $$WEBKIT2_TESTS_DIR/qmltests \
+        $$WEBKIT2_TESTS_DIR/qmltests
+
+    SUBDIRS += \
         $$WEBKIT2_TESTS_DIR/qrawwebview
 }
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/config.json b/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
index 37f86f4e1..c4f98ae69 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
@@ -15,6 +15,17 @@
                     { "name": "apple-xserve-3", "platform": "mac-lion" },
                     { "name": "apple-xserve-10", "platform": "mac-lion" },
                     { "name": "apple-xserve-11", "platform": "mac-lion" },
+
+                    { "name": "apple-mini-201", "platform": "mac-mountainlion"},
+                    { "name": "apple-mini-202", "platform": "mac-mountainlion"},
+                    { "name": "apple-mini-203", "platform": "mac-mountainlion"},
+                    { "name": "apple-mini-204", "platform": "mac-mountainlion"},
+                    { "name": "apple-mini-205", "platform": "mac-mountainlion"},
+                    { "name": "apple-mini-206", "platform": "mac-mountainlion"},
+                    { "name": "apple-mini-207", "platform": "mac-mountainlion"},
+                    { "name": "apple-mini-208", "platform": "mac-mountainlion"},
+                    { "name": "apple-mini-209", "platform": "mac-mountainlion"},
+                    { "name": "apple-mini-210", "platform": "mac-mountainlion"},
                     
                     { "name": "apple-windows-1", "platform": "win"},
                     { "name": "apple-windows-2", "platform": "win"},
@@ -62,7 +73,7 @@
                     { "name": "efl-linux-slave-1", "platform": "efl" },
                     { "name": "efl-linux-slave-2", "platform": "efl" },
                     { "name": "efl-linux-slave-3", "platform": "efl" },
-                    { "name": "efl-linux-slave-4", "platform": "efl" },
+                    { "name": "efl-linux-slave-4", "platform": "efl" }
                   ],
 
     "builders":   [ { "name": "Apple SnowLeopard Release (Build)", "type": "Build", "builddir": "snowleopard-release",
@@ -108,6 +119,41 @@
                       "platform": "mac-lion", "configuration": "release", "architectures": ["x86_64"],
                       "slavenames": ["apple-xserve-11"]
                     },
+                    { "name": "Apple MountainLion (Leaks)", "type": "BuildAndTestLeaks", "builddir": "mountainlion-leaks",
+                      "platform": "mac-mountainlion", "configuration": "debug", "architectures": ["x86_64"],
+                      "slavenames": ["apple-mini-201"]
+                    },
+                    { "name": "Apple MountainLion Debug (Build)", "type": "Build", "builddir": "mountainlion-debug",
+                      "platform": "mac-mountainlion", "configuration": "debug", "architectures": ["x86_64"],
+                      "triggers": ["mountainlion-debug-tests-wk1", "mountainlion-debug-tests-wk2"],
+                      "slavenames": ["apple-mini-202", "apple-mini-203"]
+                    },
+                    { "name": "Apple MountainLion Release (Build)", "type": "Build", "builddir": "mountainlion-release",
+                      "platform": "mac-mountainlion", "configuration": "release", "architectures": ["x86_64"],
+                      "triggers": ["mountainlion-release-tests-wk1", "mountainlion-release-tests-wk2", "mountainlion-release-perf"],
+                      "slavenames": ["apple-mini-204"]
+                    },
+                    { "name": "Apple MountainLion Debug WK1 (Tests)", "type": "Test", "builddir": "mountainlion-debug-tests-wk1",
+                      "platform": "mac-mountainlion", "configuration": "debug", "architectures": ["x86_64"],
+                      "slavenames": ["apple-mini-205"]
+                    },
+                    { "name": "Apple MountainLion Debug WK2 (Tests)", "type": "TestWebKit2", "builddir": "mountainlion-debug-tests-wk2",
+                      "platform": "mac-mountainlion", "configuration": "debug", "architectures": ["x86_64"],
+                      "slavenames": ["apple-mini-206", "apple-mini-207"]
+                    },
+                    { "name": "Apple MountainLion Release WK1 (Tests)", "type": "Test", "builddir": "mountainlion-release-tests-wk1",
+                      "platform": "mac-mountainlion", "configuration": "release", "architectures": ["x86_64"],
+                      "slavenames": ["apple-mini-208"]
+                    },
+                    { "name": "Apple MountainLion Release WK2 (Tests)", "type": "TestWebKit2", "builddir": "mountainlion-release-tests-wk2",
+                      "platform": "mac-mountainlion", "configuration": "release", "architectures": ["x86_64"],
+                      "slavenames": ["apple-mini-209"]
+                    },
+                    {
+                      "name": "Apple MountainLion Release (Perf)", "type": "DownloadAndPerfTest", "builddir": "mountainlion-release-perf-tests",
+                      "platform": "mac-mountainlion", "configuration": "release", "architectures": ["x86_64"],
+                      "slavenames": ["apple-mini-210"]
+                    },
                     {
                       "name": "Apple Win Release (Build)", "type": "Build", "builddir": "win-release",
                       "platform": "win", "configuration": "release", "architectures": ["i386"],
@@ -292,6 +338,9 @@
                     { "type": "PlatformSpecificScheduler", "platform": "mac-lion", "branch": "trunk", "treeStableTimer": 45.0,
                       "builderNames": ["Apple Lion Release (Build)", "Apple Lion Debug (Build)", "Apple Lion (Leaks)"]
                     },
+                    { "type": "PlatformSpecificScheduler", "platform": "mac-mountainlion", "branch": "trunk", "treeStableTimer": 45.0,
+                      "builderNames": ["Apple MountainLion Release (Build)", "Apple MountainLion Debug (Build)", "Apple MountainLion (Leaks)"]
+                    },
                     { "type": "PlatformSpecificScheduler", "platform": "win", "branch": "trunk", "treeStableTimer": 45.0,
                       "builderNames": ["Apple Win Release (Build)", "Apple Win Debug (Build)"]
                     },
@@ -310,6 +359,21 @@
                     { "type": "Triggerable", "name": "lion-debug-tests-wk2",
                       "builderNames": ["Apple Lion Debug WK2 (Tests)"]
                     },
+                    { "type": "Triggerable", "name": "mountainlion-release-tests-wk1",
+                      "builderNames": ["Apple MountainLion Release WK1 (Tests)"]
+                    },
+                    { "type": "Triggerable", "name": "mountainlion-release-tests-wk2",
+                      "builderNames": ["Apple MountainLion Release WK2 (Tests)"]
+                    },
+                    { "type": "Triggerable", "name": "mountainlion-release-perf",
+                      "builderNames": ["Apple MountainLion Release (Perf)"]
+                    },
+                    { "type": "Triggerable", "name": "mountainlion-debug-tests-wk1",
+                      "builderNames": ["Apple MountainLion Debug WK1 (Tests)"]
+                    },
+                    { "type": "Triggerable", "name": "mountainlion-debug-tests-wk2",
+                      "builderNames": ["Apple MountainLion Debug WK2 (Tests)"]
+                    },
                     { "type": "Triggerable", "name": "win-release-tests",
                       "builderNames": ["Apple Win 7 Release (Tests)"]
                     },
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
index c7346ec79..546844b38 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
@@ -195,7 +195,7 @@ class CompileWebKit(shell.Compile):
 
 class ArchiveBuiltProduct(shell.ShellCommand):
     command = ["python", "./Tools/BuildSlaveSupport/built-product-archive",
-               WithProperties("--platform=%(platform)s"), WithProperties("--%(configuration)s"), "archive"]
+               WithProperties("--platform=%(fullPlatform)s"), WithProperties("--%(configuration)s"), "archive"]
     name = "archive-built-product"
     description = ["archiving built product"]
     descriptionDone = ["archived built product"]
@@ -204,7 +204,7 @@ class ArchiveBuiltProduct(shell.ShellCommand):
 
 class ExtractBuiltProduct(shell.ShellCommand):
     command = ["python", "./Tools/BuildSlaveSupport/built-product-archive",
-               WithProperties("--platform=%(platform)s"), WithProperties("--%(configuration)s"), "extract"]
+               WithProperties("--platform=%(fullPlatform)s"), WithProperties("--%(configuration)s"), "extract"]
     name = "extract-built-product"
     description = ["extracting built product"]
     descriptionDone = ["extracted built product"]
@@ -349,10 +349,10 @@ class RunWebKitTests(shell.Test):
     def _parseNewRunWebKitTestsOutput(self, logText):
         incorrectLayoutLines = []
         expressions = [
-            ('flakes', re.compile(r'Unexpected flakiness.+:?\s*\((\d+)\)')),
+            ('flakes', re.compile(r'[Uu]nexpected flakiness.+:?\s*\((\d+)\)')),
             ('new passes', re.compile(r'Expected to .+, but passed:\s+\((\d+)\)')),
-            ('missing results', re.compile(r'no expected results found\s*:\s+\((\d+)\)')),
-            ('failures', re.compile(r'Regressions: Unexpected.+:?\s*\((\d+)\)')),
+            ('missing results', re.compile(r'(no expected results found|missing results)\s*:\s+\((\d+)\)')),
+            ('failures', re.compile(r'Regressions: [Uu]nexpected.+:?\s*\((\d+)\)')),
         ]
         testFailures = {}
 
@@ -421,13 +421,15 @@ class RunUnitTests(TestWithFailureCount):
     failedTestsFormatString = "%d unit tests failed or timed out"
 
     def start(self):
-        platform = self.getProperty('platform')
-        if platform == 'win':
+        platform = self.getProperty('fullPlatform')
+        if platform.startswith('win'):
             self.setCommand(self.command + ['--no-build'])
         if platform.startswith('mac'):
             self.setCommand(self.command + ['--no-build'])
         if platform.startswith('chromium'):
             self.setCommand(self.command + ['--chromium'])
+        if platform == 'chromium-android':
+            self.setCommand(self.command + ['--chromium-android'])
         return shell.Test.start(self)
 
     def countFailures(self, cmd):
@@ -603,7 +605,7 @@ class RunChromiumWebKitUnitTests(shell.Test):
     description = ["webkit-unit-tests running"]
     descriptionDone = ["webkit-unit-tests"]
     command = ["perl", "./Tools/Scripts/run-chromium-webkit-unit-tests",
-               WithProperties("--%(configuration)s")]
+               WithProperties("--%(configuration)s"), WithProperties("--platform=%(fullPlatform)s")]
 
 
 class RunAndUploadPerfTests(shell.Test):
@@ -712,8 +714,7 @@ class BuildFactory(Factory):
 def unitTestsSupported(configuration, platform):
     if platform.startswith('mac') and configuration == "release":
         return False; # https://bugs.webkit.org/show_bug.cgi?id=82652
-    return (platform == 'win' or platform.startswith('mac')
-            or (platform.startswith('chromium') and platform != 'chromium-android'))
+    return (platform == 'win' or platform.startswith('mac') or platform.startswith('chromium'))
 
 def pickLatestBuild(builder, requests):
     return max(requests, key=operator.attrgetter("submittedAt"))
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/builders.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/builders.js
index d45ce2233..3cb804af4 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/builders.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/builders.js
@@ -126,8 +126,8 @@ builders.cachedBuildInfos = function(platform, builderName, callback)
     var builderInfoURL = urlForBuilderInfo(platform, builderName);
     net.get(builderInfoURL, function(builderInfo) {
         var selectURL = urlForBuilderInfo(platform, builderName) + 'builds';
-        // // FIXME: limit to some reasonable number?
-        var selectParams = { select : builderInfo.cachedBuilds };
+        var start = Math.max(0, builderInfo.cachedBuilds.length - config.kBuildNumberLimit);
+        var selectParams = { select : builderInfo.cachedBuilds.slice(start) };
         var traditionalEncoding = true;
         selectURL += '?' + $.param(selectParams, traditionalEncoding);
         net.get(selectURL, callback);
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
index 6c405ed17..6c9cebf16 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
@@ -27,6 +27,8 @@ var config = config || {};
 
 (function() {
 
+config.kBuildNumberLimit = 20;
+
 config.kPlatforms = {
     'apple' : {
         label : 'Apple',
diff --git a/Tools/BuildSlaveSupport/built-product-archive b/Tools/BuildSlaveSupport/built-product-archive
index ae67e21b7..ac9ae3d50 100644
--- a/Tools/BuildSlaveSupport/built-product-archive
+++ b/Tools/BuildSlaveSupport/built-product-archive
@@ -51,14 +51,15 @@ def main():
         parser.error("Action is required")
         return 1
 
-    if not determineWebKitBuildDirectory(options.platform, options.configuration):
+    genericPlatform = options.platform.split('-', 1)[0]
+    if not determineWebKitBuildDirectory(genericPlatform, options.configuration):
         print >> sys.stderr, "Could not determine build directory"
         return 1
 
     if action == 'archive':
-        return archiveBuiltProduct(options.configuration, options.platform)
+        return archiveBuiltProduct(options.configuration, genericPlatform, options.platform)
     else:
-        return extractBuiltProduct(options.configuration, options.platform)
+        return extractBuiltProduct(options.configuration, genericPlatform)
 
 
 def determineWebKitBuildDirectory(platform, configuration):
@@ -116,7 +117,7 @@ def createZip(directoryToZip, configuration, archiveConfigurationOnMac=False):
         return subprocess.call(["zip", "-y", "-r", archiveFile, "."], cwd=directoryToZip)
 
 
-def archiveBuiltProduct(configuration, platform):
+def archiveBuiltProduct(configuration, platform, fullPlatform):
     assert platform in ('mac', 'win', 'qt', 'gtk', 'efl', 'chromium')
 
     configurationBuildDirectory = os.path.join(_buildDirectory, configuration.title())
@@ -164,10 +165,14 @@ def archiveBuiltProduct(configuration, platform):
     elif platform == 'chromium':
         thinDirectory = os.path.join(configurationBuildDirectory, "thin")
 
+        ignorePatterns = ['.svn', '*.a', '*.d', '*.dSYM', '*.o', '*.ilk', '*.lib', '*.idb',
+                          'BuildLog.htm', '*.obj', '*.pdb', '*.pch', '*.tlog', '*.lastbuildstate']
+
+        if fullPlatform and fullPlatform == 'chromium-android':
+            ignorePatterns.extend(['*.so', '*.pak', '*-unaligned.apk'])
+
         removeDirectoryIfExists(thinDirectory)
-        copyBuildFiles(configurationBuildDirectory, thinDirectory,
-            ['.svn', '*.a', '*.d', '*.dSYM', '*.o', '*.ilk', '*.lib', '*.idb', 'BuildLog.htm', '*.obj',
-            '*.pdb', '*.pch', '*.tlog', '*.lastbuildstate'])
+        copyBuildFiles(configurationBuildDirectory, thinDirectory, ignorePatterns)
         if createZip(thinDirectory, configuration):
             return 1
 
diff --git a/Tools/ChangeLog b/Tools/ChangeLog
index cd8ed7911..f8a5d2e64 100644
--- a/Tools/ChangeLog
+++ b/Tools/ChangeLog
@@ -1,3 +1,3744 @@
+2012-08-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Unreviewed trivial build fix: Newer Qt versions don't implicitly include qwindowsysteminterface.h
+        through the QTestLib headers anymore.
+
+        * DumpRenderTree/qt/EventSenderQt.cpp:
+        * WebKitTestRunner/Target.pri:
+        * WebKitTestRunner/qt/EventSenderProxyQt.cpp:
+
+2012-08-11  Sam Weinig  <sam@webkit.org>
+
+        Remove ability to run MiniBrowser in threaded mode, it hasn't worked for a long time
+        https://bugs.webkit.org/show_bug.cgi?id=93774
+
+        Reviewed by Dan Bernstein.
+
+        Remove support for opening windows using the shared thread WKContextRef. WKContextGetSharedThreadContext()
+        is going away, due to not working for a long time, and the first step is removing all the callers.
+
+        While here, remove the BrowserStatisticsWindow, which was not providing interesting information.
+
+        * MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj:
+        * MiniBrowser/mac/AppDelegate.h:
+        * MiniBrowser/mac/AppDelegate.m:
+        (-[BrowserAppDelegate init]):
+        (-[BrowserAppDelegate newWindow:]):
+        (-[BrowserAppDelegate openPanelDidEnd:returnCode:contextInfo:]):
+        * MiniBrowser/mac/BrowserStatisticsWindow.xib: Removed.
+        * MiniBrowser/mac/BrowserStatisticsWindowController.h: Removed.
+        * MiniBrowser/mac/BrowserStatisticsWindowController.m: Removed.
+        * MiniBrowser/mac/MainMenu.xib:
+        * MiniBrowser/win/BrowserView.cpp:
+        (BrowserView::create):
+
+2012-08-11  Sam Weinig  <sam@webkit.org>
+
+        Enable XPC Service based WebProcess with runtime flag
+        https://bugs.webkit.org/show_bug.cgi?id=93773
+
+        Reviewed by Dan Bernstein.
+
+        Convert --use-web-process-xpc-service passed to run-safari (and similar scripts)
+        to setting WEBKIT_USE_XPC_SERVICE_FOR_WEB_PROCESS=YES in the environment and setting
+        up __XPC_DYLD_FRAMEWORK_PATH and __XPC_DYLD_INSERT_LIBRARIES variables. NOTE: using
+        the XPC service is not the default code path.
+
+        * Scripts/webkitdirs.pm:
+        (shouldUseXPCServiceForWebProcess):
+        (determineShouldUseXPCServiceForWebProcess):
+        Add functions to extract --use-web-process-xpc-service from ARGV and set a
+        global variable.
+
+        (printHelpAndExitForRunAndDebugWebKitAppIfNeeded):
+        Add help text for --use-web-process-xpc-service.
+
+        (runMacWebKitApp):
+        Set the WEBKIT_USE_XPC_SERVICE_FOR_WEB_PROCESS environment variable and DYLD
+        if --use-web-process-xpc-service was passed on the command line.
+
+        (execMacWebKitAppForDebugging):
+        Set the WEBKIT_USE_XPC_SERVICE_FOR_WEB_PROCESS environment variable and DYLD
+        if --use-web-process-xpc-service was passed on the command line. Also, bail
+        if both --use-web-process-xpc-service and --target-web-process are passed on
+        the command line, as we don't currently support using both.
+
+2012-08-11  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [EFL] Bump harfbuzz dependency to v0.9.2
+        https://bugs.webkit.org/show_bug.cgi?id=93762
+
+        Reviewed by Eric Seidel.
+
+        EFL port has used harfbuzz 0.9.0 ver. However, the 0.9.2 version was released on 10th Aug 2012.
+        In addition, 0.9.0 ver. was disappeared. So, EFL port needs to use 0.9.2 ver. from now on.
+
+        * efl/jhbuild.modules:
+
+2012-08-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        run-perf-tests should upload memory statistics to perf-o-matic
+        https://bugs.webkit.org/show_bug.cgi?id=93690
+
+        Reviewed by Dirk Pranke.
+
+        Upload JS Heap and FastMalloc results for a test X/Y as: X/Y:JSHeap and X/Y:FastMalloc.
+        Note "JS Heap" is converted to the CamelCase JSHeap.
+
+        Also did some refactoring in PerfTest.parse_output and PerfTestRunnerTest and updated
+        some helps in PerfTest.parse_output per arv's comments.
+
+        * Scripts/webkitpy/performance_tests/perftest.py:
+        (PerfTest):
+        (PerfTest.parse_output): Include JSHeap and FastMalloc statistics in results as well as of Time.
+        Also refactored it to avoid hard-coding indices in _result_classes and moved complied regular
+        exressions out of the function to avoid re-compiling them every time the method runs.
+        (PerfTest.output_statistics): Convert ':' to ': ' as well as '/'.
+        (ChromiumStylePerfTest.parse_output): Removed an unused variable.
+        * Scripts/webkitpy/performance_tests/perftestsrunner.py:
+        (PerfTestsRunner._parse_args): Uploaded some helps per arv's feedback.
+        (PerfTestsRunner._output_json_path): Extracted from _generate_and_show_results to be used in
+        PerfTestRunnerTest.create_runner.
+        (PerfTestsRunner._generate_and_show_results):
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py:
+        (create_runner): Extracted runner.load_output_json from various tests.
+        (test_run_memory_test): Added.
+        (PerfTestRunner): Extracted _event_target_wrapper_and_inspector_results from various tests.
+        (test_run_with_json_output):
+        (test_run_with_description):
+        (test_run_generates_json_by_default):
+        (test_run_generates_and_show_results_page):
+        (test_run_with_json_source):
+        (test_run_with_multiple_repositories):
+
+2012-08-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        Add support for String initialization from literal to WTFString
+        https://bugs.webkit.org/show_bug.cgi?id=93426
+
+        Reviewed by Anders Carlsson.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/WTF/StringImpl.cpp:
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WTF/WTFString.cpp: Copied from Tools/TestWebKitAPI/Tests/WTF/StringImpl.cpp.
+        (TestWebKitAPI):
+        (TestWebKitAPI::TEST):
+
+2012-08-10  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        NRWT crashes when DRT with --encode-binary crashes just before it dumps pixels
+        https://bugs.webkit.org/show_bug.cgi?id=93728
+
+        Reviewed by Dirk Pranke.
+
+        * Scripts/webkitpy/layout_tests/port/driver.py:
+        (ContentBlock.decode_content): Check self.content is not None before calling base64.b64decode().
+
+2012-08-10  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium-Android][NRWT] Executable might not be pushed correctly when there are multiple builds
+        https://bugs.webkit.org/show_bug.cgi?id=93688
+
+        Reviewed by Dirk Pranke.
+
+        There might be other better methods, but this change is the smallest.
+        I think the chance of equal timestamp can be ignored because we flock
+        to avoid concurrent linkers.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidDriver._push_executable): Changed '<' to '!=' to compare the timestamp.
+
+2012-08-09  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium-Android] Skip layout tests directories that are not applicable
+        https://bugs.webkit.org/show_bug.cgi?id=93670
+
+        Reviewed by Dirk Pranke.
+
+        Added back ChromiumAndroidPort.skipped_layout_tests to skip some whole directories.
+        The method is more convenient to skip whole directories than SKIP in TestExpectations
+        because its higher priority. Will still use TestExpectations to skip individual tests.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.skipped_layout_tests):
+
+2012-08-09  Elliott Sprehn  <esprehn@chromium.org>
+
+        Add myself to the Contributor list.
+        https://bugs.webkit.org/show_bug.cgi?id=93653
+
+        Reviewed by Dirk Pranke.
+
+        Add my email to the contributor list.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-08-09  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: should log progress like ninja does
+        https://bugs.webkit.org/show_bug.cgi?id=93563
+
+        Reviewed by Ojan Vafai.
+
+        This change modifies the output of nrwt in the
+        non--debug-rwt-logging modes.
+
+        In non-verbose mode, the output changes from:
+          "Testing (50%): 96 ran as expected, 4 didn't, 100 left"
+        to:
+          "[100/200] foo.html (+4)"
+        or:
+          "[100/200] foo.html failed  unexpectedly (text diff)"
+
+        which indicates the earliest test currently running (optionally plus the
+        count of other currently-executing tests if we're running tests in parallel)
+        or the result of said test.
+
+        If the test produces unexpected results, that line is flushed
+        rather than erased (so we no longer need the %d didn't running
+        tally).
+
+        In --verbose mode, the output is similar, but every test gets a
+        line (and tests are logged in order of them being started, not
+        order of them being completed) (and in --details mode, the
+        first line of each test matches --verbose but the other lines
+        are unchanged).
+        
+        The overall result should be easier to read and is simpler to
+        implement as well (apart from managing the number of tests that
+        have started but not completed, which is slightly annoying).
+
+        This also matches the output style for test-webkitpy, more-or-less.
+
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py:
+        (LayoutTestRunner.run_tests):
+        (LayoutTestRunner._update_summary_with_result):
+        (LayoutTestRunner._handle_started_test):
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_runner_unittest.py:
+        (FakePrinter):
+        (FakePrinter.print_started_test):
+        (FakePrinter.print_finished_test):
+        * Scripts/webkitpy/layout_tests/views/printing.py:
+        (Printer.__init__):
+        (Printer.print_started_test):
+        (Printer.print_finished_test):
+        (Printer._print_test_trace):
+        (Printer._print_progress):
+        * Scripts/webkitpy/layout_tests/views/printing_unittest.py:
+        (test_details):
+
+2012-08-09  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] Add a process model constant for multiple processes
+        https://bugs.webkit.org/show_bug.cgi?id=93642
+
+        Reviewed by Anders Carlsson.
+
+        * MiniBrowser/mac/AppDelegate.h: Updated process model enum to match WebKit.
+
+2012-08-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Build fix after r125178.
+
+        * Scripts/webkitpy/performance_tests/perftest.py:
+        (PerfTest.parse_output): Don't include non-time results in the JSON output.
+        * Scripts/webkitpy/performance_tests/perftest_unittest.py: Updated the test outputs so to match
+        actual test outputs.
+        (MainTest.test_parse_output):
+        (MainTest.test_parse_output_with_failing_line):
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py: Ditto.
+
+2012-08-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        JSHeap and FastMallocStatistics based memory measurement for performance-tests
+        https://bugs.webkit.org/show_bug.cgi?id=90858
+
+        Reviewed by Ryosuke Niwa.
+
+        Measure the memory usage of the performancetests with the help of the windows.memory.usedJSHeapSize
+        object and the window.internals.fastMallocStatistics() function call.
+
+        * Scripts/webkitpy/performance_tests/perftest.py:
+        (PerfTest):
+        (PerfTest.parse_output):
+        (PerfTest.output_statistics):
+
+2012-08-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt][Win] Build system bug revealed by r124835
+        https://bugs.webkit.org/show_bug.cgi?id=93339
+
+        Reviewed by Tor Arne Vestbø.
+
+        Don't add "LC_ALL=c" on Windows in svnRevisionForDirectory() and in pathRelativeToSVNRepositoryRootForPath().
+
+        * Scripts/VCSUtils.pm:
+        (isWindows): Copied from webkitdirs.pm.
+        (svnRevisionForDirectory):
+        (pathRelativeToSVNRepositoryRootForPath):
+
+2012-08-08  Dirk Pranke  <dpranke@chromium.org>
+
+        update bot parsing of new-run-webkit-tests' output
+        https://bugs.webkit.org/show_bug.cgi?id=93537
+
+        Reviewed by Ryosuke Niwa.
+
+        This change updates the way we parse the output from
+        new-run-webkit-tests on the bots so that we can show a summary
+        of the results properly after I re-land the changes that were
+        reverted in r124994 and r124870.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (RunWebKitTests._parseNewRunWebKitTestsOutput):
+
+2012-08-08  Shane Stephens  <shanestephens@google.com>
+
+        Compile flag for CSS Hierarchies
+        https://bugs.webkit.org/show_bug.cgi?id=92433
+
+        Reviewed by Tony Chang.
+
+        * Scripts/webkitperl/FeatureList.pm:
+        * qmake/mkspecs/features/features.pri:
+
+2012-08-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Use char* instead of LChar* for the public interface of String construction from literals
+        https://bugs.webkit.org/show_bug.cgi?id=93402
+
+        Reviewed by Michael Saboff.
+
+        * TestWebKitAPI/Tests/WTF/StringImpl.cpp:
+        (TestWebKitAPI::TEST):
+
+2012-08-08  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: rename finder.py to layout_test_finder.py
+        https://bugs.webkit.org/show_bug.cgi?id=93557
+
+        Reviewed by Ryosuke Niwa.
+
+        One last cleanup per old review feedback from rniwa.
+
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_finder.py: Renamed from Tools/Scripts/webkitpy/layout_tests/controllers/finder.py.
+        (LayoutTestFinder):
+        (LayoutTestFinder.__init__):
+        (LayoutTestFinder.find_tests):
+        (LayoutTestFinder._strip_test_dir_prefixes):
+        (LayoutTestFinder._strip_test_dir_prefix):
+        (LayoutTestFinder._read_test_names_from_file):
+        (LayoutTestFinder._strip_comments):
+        (LayoutTestFinder.skip_tests):
+        (LayoutTestFinder.split_into_chunks):
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+
+2012-08-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Add Perf EWS IRC bot
+        https://bugs.webkit.org/show_bug.cgi?id=92913
+
+        Reviewed by Dirk Pranke.
+
+        Adds the preliminary implementation of perfalizer, a IRC bot that runs performance tests
+        based on IRC requests.
+
+        * Scripts/webkitpy/common/checkout/scm/scm_mock.py:
+        (MockSCM.head_svn_revision): The actual implementation returns string, so match that.
+        (MockSCM.svn_revision): Ditto.
+        * Scripts/webkitpy/common/net/bugzilla/bugzilla.py:
+        (Bugzilla.add_attachment_to_bug): Added mimetype.
+        * Scripts/webkitpy/common/net/bugzilla/bugzilla_mock.py:
+        (MockBugzilla.add_attachment_to_bug): Ditto.
+        * Scripts/webkitpy/common/system/filesystem.py:
+        (FileSystem.copytree): Added.
+        * Scripts/webkitpy/common/system/filesystem_mock.py:
+        (MockFileSystem.copytree): Added.
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py: Rebaselined tests
+        that had assumed revision numbers were integers.
+        (test_run_with_json_output):
+        (test_run_with_description):
+        (test_run_generates_json_by_default):
+        (test_run_generates_and_show_results_page):
+        (test_run_with_json_source):
+        (test_run_with_multiple_repositories):
+        * Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py:
+        * Scripts/webkitpy/tool/commands/__init__.py:
+        * Scripts/webkitpy/tool/commands/perfalizer.py: Added.
+        (PerfalizerTask):
+        (PerfalizerTask.__init__):
+        (PerfalizerTask._copy_build_product_without_patch):
+        (PerfalizerTask.run):
+        (PerfalizerTask.parent_command):
+        (PerfalizerTask.run_webkit_patch):
+        (PerfalizerTask._json_path):
+        (PerfalizerTask._results_page_path):
+        (PerfalizerTask._run_perf_test):
+        (PerfalizerTask.run_command):
+        (PerfalizerTask.command_passed):
+        (PerfalizerTask.command_failed):
+        (PerfalizerTask.refetch_patch):
+        (PerfalizerTask.expected_failures):
+        (PerfalizerTask.build_style):
+        (PerfTest): IRC command.
+        (PerfTest.execute):
+        (Perfalizer): IRC bot.
+        (Perfalizer.begin_work_queue):
+        (Perfalizer.work_item_log_path):
+        (Perfalizer._is_old_failure):
+        (Perfalizer.next_work_item):
+        (Perfalizer.process_work_item):
+        (Perfalizer.handle_unexpected_error):
+        (Perfalizer.handle_script_error):
+        * Scripts/webkitpy/tool/commands/perfalizer_unittest.py: Added.
+        (PerfalizerTaskTest):
+        (PerfalizerTaskTest._create_and_run_perfalizer):
+        (PerfalizerTaskTest._create_and_run_perfalizer.logger):
+        (PerfalizerTaskTest._create_and_run_perfalizer.run_webkit_patch):
+        (PerfalizerTaskTest._create_and_run_perfalizer.run_perf_test):
+        (PerfalizerTaskTest.test_run):
+        (PerfalizerTaskTest.test_run_with_clean_fails):
+        (PerfalizerTaskTest.test_run_with_update_fails):
+        (PerfalizerTaskTest.test_run_with_build_fails):
+        (PerfalizerTaskTest.test_run_with_perf_test_fails):
+        (PerfalizerTaskTest.test_run_without_results_page):
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+        (AbstractPatchQueueTest.test_upload_results_archive_for_patch): Rebaselined.
+        * Scripts/webkitpy/tool/commands/upload_unittest.py:
+        (test_attach_to_bug): Ditto.
+        (test_attach_to_bug_no_description_or_comment): Ditto.
+
+2012-08-08  Dirk Pranke  <dpranke@chromium.org>
+
+        webkit-patch rebaseline-expectations needs to support multiple expectations files
+        https://bugs.webkit.org/show_bug.cgi?id=89051
+
+        Reviewed by Adam Barth.
+
+        fixed the bug described above, added unit test in
+        test_expectations_unittest, and updated the tool tests
+        to not contain all of the "missing skia expectations" warnings.
+
+        * Scripts/webkitpy/layout_tests/models/test_expectations.py:
+        (TestExpectations.remove_rebaselined_tests):
+        (TestExpectations.remove_rebaselined_tests.without_rebaseline_modifier):
+        * Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py:
+        (RebaseliningTest.assertRemove):
+        (RebaseliningTest.test_remove):
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (RebaselineExpectations._update_expectations_files):
+        (RebaselineExpectations.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (TestRebaseline.test_rebaseline_updates_expectations_file_noop):
+        (test_rebaseline_expectations):
+
+2012-08-08  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] MiniBrowser crashes on quit if any windows were previously closed
+        https://bugs.webkit.org/show_bug.cgi?id=93529
+
+        Reviewed by John Sullivan.
+
+        * MiniBrowser/mac/AppDelegate.h:
+        * MiniBrowser/mac/AppDelegate.m:
+        (-[BrowserAppDelegate init]):
+        (-[BrowserAppDelegate newWindow:]):
+        (-[BrowserAppDelegate browserWindowWillClose:]):
+        (-[BrowserAppDelegate applicationWillTerminate:]):
+        (-[BrowserAppDelegate frontmostBrowserWindowController]):
+        Track browser windows explicitly, not relying on [NSApp windows]. Closed windows
+        are not automatically removed from the list until deallocated, so a refcounting
+        error can result in working on a closed window.
+
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (-[BrowserWindowController dealloc]): Moved code from -windowWillClose: here.
+        Releasing data members is -dealloc's job.
+        (-[BrowserWindowController windowWillClose:]): Notify BrowserAppDelegate that
+        the window is no longer open. Autorelease self, making sure that WKView and
+        then WebPageProxy get released.
+        (-[BrowserWindowController applicationTerminating]): Don't release _webView.pageRef.
+        WKView is responsible for its lifetime.
+        (closePage): Ditto.
+
+2012-08-08  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium-Android] Apply all Linux layout test expectations
+        https://bugs.webkit.org/show_bug.cgi?id=92653
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.skipped_layout_tests): Removed. Skip these tests in TestExpectations instead.
+
+2012-08-08  Josh Hawn  <jhawn@apple.com>
+
+        Add MountainLion WebKit Bots.
+        https://bugs.webkit.org/show_bug.cgi?id=93417
+
+        Reviewed by Stephanie Lewis.
+
+        Mountain Lion is now available, so we've added the appropriate Apple bots,
+        mirroring the configuration of the Lion bots.
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json:
+        Added 10 "apple-mini-###" slaves.
+        Added MountainLion Builders and Schedulers.
+
+2012-08-08  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [WK2] Coding style violation was brought with r125031
+        https://bugs.webkit.org/show_bug.cgi?id=93503
+
+        Reviewed by Alexey Proskuryakov.
+
+        WKURLResponseCopyMimeType is corrected to WKURLResponseCopyMIMEType.
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::didReceiveResponseForResource):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+        (WTR::LayoutTestController::dumpProgressFinishedCallback): Removed trailing whitespace that was brought with the same revision.
+
+2012-08-08  Peter Beverloo  <peter@chromium.org>
+
+        Buildmaster changes in preparation of a Chromium Android tester
+        https://bugs.webkit.org/show_bug.cgi?id=92251
+
+        Reviewed by Adam Barth.
+
+        Slightly update the build master's configuration in preparation of adding
+        a Chromium Android tester.
+
+        The change in built-product-archive is required as the out/ directory
+        for Android has a number of unstripped .so binaries and unaligned APKs,
+        causing the default release.zip file to be 2.7 gigabytes. By excluding
+        these file types, the file is only 59.7 megabytes. We can't disable
+        them for all of Chromium, as Mac and Linux do use their .so files.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (ArchiveBuiltProduct): Pass the full platform name instead of just the
+            generic type, i.e. chromium-android instead of chromium.
+        (ExtractBuiltProduct): Dito, stay consistent for this script.
+        (RunUnitTests): Pass --chromium-android as well as --chromium. Since we
+            now read the full platform name, stay on the safe side with 'win'
+            even though there (as far as I know) is no win-* platform.
+        (RunChromiumWebKitUnitTests): Dito. The platform wasn't being passed
+            at all, but we'll be needing different handling here.
+        (unitTestsSupported): Next to refactoring work required, as we'll be
+            running this test on a device, there is no reason to disable this
+            in the master's configuration.
+        * BuildSlaveSupport/built-product-archive:
+        (main): Determine the generic platform.
+        (archiveBuiltProduct): Use an identical set of ignorePatterns, but
+            extend the list with .so, .pak and -unaligned.apk for Android.
+
+2012-08-08  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed. Stop running tests on the mac-ews while we wait for more
+        hardware. As requested by lforschler.
+
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+
+2012-08-08  Peter Beverloo  <peter@chromium.org>
+
+        The cr-android EWS should actually be building Chromium for Android
+        https://bugs.webkit.org/show_bug.cgi?id=93489
+
+        Reviewed by Adam Barth.
+
+        The cr-android EWS bots should be building Chromium for Android, which
+        requires some additional flags to Chromium's default configuration.
+
+        * Scripts/webkitdirs.pm:
+        (buildChromium):
+        * Scripts/webkitpy/common/config/ports.py:
+        (DeprecatedPort.port):
+        (ChromiumAndroidPort):
+        (ChromiumAndroidPort.update_webkit_command):
+        (ChromiumAndroidPort.build_webkit_command):
+        * Scripts/webkitpy/common/config/ports_unittest.py:
+        (DeprecatedPortTest.test_chromium_android_port):
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+        (ChromiumAndroidEWS):
+        * Scripts/webkitpy/tool/steps/update_unittest.py:
+        (UpdateTest.test_update_command_non_interactive):
+        (UpdateTest.test_update_command_interactive):
+
+2012-08-08  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] MiniBrowser crashes on window.open()
+        https://bugs.webkit.org/show_bug.cgi?id=93413
+
+        Reviewed by Dan Bernstein.
+
+        * MiniBrowser/mac/BrowserWindowController.m: (createNewPage): This is a "create"
+        API, so it needs to return a retained result.
+
+        * MiniBrowser/mac/WebBundle/WebBundleMain.m: (didClearWindowObjectForFrame):
+        When this function is called, URL appears to be poorly defined. Sometimes, it's
+        the new URL, other times it's the old one. An "old" URL is null in a new page.
+
+2012-08-08  Loïc Yhuel  <loic.yhuel@softathome.com>
+
+        [Qt] Compile errors with OpenGLES2
+        https://bugs.webkit.org/show_bug.cgi?id=93206
+
+        Reviewed by Noam Rosenthal.
+
+        Fix build with OpenGLES2 on Linux desktop
+
+        * qmake/mkspecs/features/features.prf: Don't use GLX with OpenGLES2
+
+2012-08-08  Peter Beverloo  <peter@chromium.org>
+
+        Introduce cr-android bots in the EWS system
+        https://bugs.webkit.org/show_bug.cgi?id=93472
+
+        Reviewed by Adam Barth.
+
+        This adds the queue to the EWS scripts. Two builders are ready to be
+        attached to the queue. All webkitpy tests pass with this change applied.
+
+        * QueueStatusServer/model/queues.py:
+        (Queue):
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+        (ChromiumAndroidEWS):
+        * Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py:
+        (EarlyWarningSytemTest.test_builder_ewses):
+
+2012-08-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix GTK+ build with GTK2 after r121475.
+
+        * TestWebKitAPI/Tests/gtk/InputMethodFilter.cpp: Add missing
+        include required when building with GTK2.
+
+2012-08-08  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [WK2] [WTR] Provide Resource Response dumping.
+        https://bugs.webkit.org/show_bug.cgi?id=93454
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added missing dumpResourceResponseMIMETypes() method to testRunner. Provided resource response dumping.
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl:
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::didReceiveResponseForResource):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::LayoutTestController):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+        (WTR::LayoutTestController::dumpProgressFinishedCallback):
+        (WTR::LayoutTestController::dumpResourceResponseMIMETypes):
+        (WTR::LayoutTestController::shouldDumpResourceResponseMIMETypes):
+        (LayoutTestController):
+
+2012-08-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt][Win] Fix compilation of DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=93461
+
+        Reviewed by Tor Arne Vestbø.
+
+        DRT includes stdint.h, for which we have wrappers in Source/JavaScriptCore/os-win32. Use these not only
+        for libraries but any building template.
+
+        * qmake/mkspecs/features/default_post.prf:
+
+2012-08-08  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [WK2] [WTR] Refactoring: LayoutTestController::shouldDumpProgressFinishedCallback() should be const
+        https://bugs.webkit.org/show_bug.cgi?id=93457
+
+        Reviewed by Csaba Osztrogonác.
+
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+        (WTR::LayoutTestController::shouldDumpProgressFinishedCallback): Added constness.
+
+2012-08-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed typo fix after r124988.
+
+        * Scripts/webkitpy/layout_tests/models/test_expectations.py:
+        (TestExpectations):
+
+2012-08-07  YoungTaeck Song  <youngtaeck.song@samsung.com>
+
+        [WK2][EFL] Implement accelerated compositing on WK2 Efl port
+        https://bugs.webkit.org/show_bug.cgi?id=89840
+
+        Reviewed by Noam Rosenthal.
+
+        Implement accelerated composition with TiledBackingStore on WK2 Efl port.
+        Add OPENGL_LIBRARIES in CMakeList.txt.
+
+        * MiniBrowser/efl/CMakeLists.txt:
+        * WebKitTestRunner/PlatformEfl.cmake:
+
+2012-08-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [NRWT] REGRESSION(r124967): New tests without expected results handled as failures
+        https://bugs.webkit.org/show_bug.cgi?id=93434
+
+        Reviewed by Tony Chang.
+
+        Change back "missing results" to "no expected result found", because master.cfg's results parser expects it.
+
+        * Scripts/webkitpy/layout_tests/models/test_expectations.py:
+        (TestExpectations):
+
+2012-08-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+        buildbot: Remove the configuration of hfreyther*
+        https://bugs.webkit.org/show_bug.cgi?id=91849
+
+        Unreviewed typo fix after r123757.
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json:
+
+2012-08-07  Dirk Pranke  <dpranke@chromium.org>
+
+        REGRESSION: PrettyPatchTest.test_pretty_diff_encodings has been failing on Chromium Windows
+        https://bugs.webkit.org/show_bug.cgi?id=93192
+
+        Unreviewed, build fix.
+
+        Disabling the test for now as PrettyPatch is just broken on win32.
+
+        * Scripts/webkitpy/common/prettypatch_unittest.py:
+        (test_pretty_diff_encodings):
+
+2012-08-07  Dirk Pranke  <dpranke@chromium.org>
+
+        [NRWT] Would like an output mode similar to ORWT verbose one
+        https://bugs.webkit.org/show_bug.cgi?id=88702
+
+        Reviewed by Ryosuke Niwa.
+
+        Change the --verbose logging for new-run-webkit-tests so that
+        it matches ORWT more; we just print one line per test. Use
+        --debug-rwt-logging to get the full debug stream (aka old ORWT
+        --verbose).
+
+        * Scripts/webkitpy/layout_tests/models/test_expectations.py:
+        (TestExpectations):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (_set_up_derived_options):
+        (parse_args):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.test_retrying_and_flaky_tests):
+        * Scripts/webkitpy/layout_tests/views/printing.py:
+        (print_options):
+        (Printer._print_result_summary_entry):
+        (Printer._print_one_line_summary):
+        (Printer._print_test_result):
+        (Printer._print_baseline):
+        (Printer._print_unexpected_results):
+
+2012-08-07  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: handle errors from image diff better
+        https://bugs.webkit.org/show_bug.cgi?id=92934
+
+        Reviewed by Ojan Vafai.
+
+        Re-land the change in r124801 with a fix ... in the case where
+        the ImageDiff is passed a tolerance and passes the fuzzy check,
+        we were returning the wrong value (missing an empty error
+        string) and crashing; this patch fixes that and adds a test for
+        that case (TestImageDiffer.test_image_diff_passed).
+
+        * Scripts/webkitpy/layout_tests/controllers/single_test_runner.py:
+        (SingleTestRunner._compare_image):
+        (SingleTestRunner._compare_output_with_reference):
+        * Scripts/webkitpy/layout_tests/controllers/test_result_writer.py:
+        (write_test_result):
+        * Scripts/webkitpy/layout_tests/controllers/test_result_writer_unittest.py:
+        (TestResultWriterTest.test_reftest_diff_image.ImageDiffTestPort.diff_image):
+        (TestResultWriterTest):
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.diff_image):
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumPort.diff_image):
+        * Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py:
+        (ChromiumPortTestCase.test_diff_image_crashed):
+        * Scripts/webkitpy/layout_tests/port/image_diff.py:
+        (ImageDiffer.diff_image):
+        (ImageDiffer._read):
+        * Scripts/webkitpy/layout_tests/port/image_diff_unittest.py:
+        (TestImageDiffer.test_diff_image):
+        * Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py:
+        (MockDRTPortTest.test_diff_image_crashed):
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        (PortTestCase.test_diff_image):
+        (PortTestCase.test_diff_image_crashed):
+        (PortTestCase.test_diff_image_crashed.make_proc):
+        * Scripts/webkitpy/layout_tests/port/server_process_mock.py:
+        (MockServerProcess.__init__):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        (TestPort.diff_image):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.test_tolerance.ImageDiffTestPort.diff_image):
+
+2012-08-07  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: --no-build isn't working
+        https://bugs.webkit.org/show_bug.cgi?id=93415
+
+        Reviewed by Ryosuke Niwa.
+
+        Turns out our optimization to avoid calling
+        webkit-build-directory N times for each worker broke --no-build.
+
+        Fixing, and adding a test.
+
+        Also, the gtk port wasn't using the default check_build() logic,
+        but I don't know why not. Removing their custom hook and will
+        verify that this is okay in the review ...
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.__init__):
+        (Port.check_build):
+        (Port._build_path):
+        * Scripts/webkitpy/layout_tests/port/gtk.py:
+        (GtkPort._path_to_image_diff):
+        * Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py:
+        (MockDRTPortTest.test_check_build):
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        (test_path_to_apache_config_file):
+        (test_check_build):
+        (test_check_build.build_driver_called):
+
+2012-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        run-perf-tests should support --no-show-results
+        https://bugs.webkit.org/show_bug.cgi?id=93409
+
+        Reviewed by Dirk Pranke.
+
+        Add the support for --no-show-results.
+
+        Also replace only local paths to jquery and flot instead of embedding them.
+        The results page is still standalone in that it tries to load scripts
+        from both webkit.org and local filesystem.
+
+        * Scripts/webkitpy/performance_tests/perftestsrunner.py:
+        (PerfTestsRunner._parse_args):
+        (PerfTestsRunner.run):
+        (PerfTestsRunner._generate_and_show_results):
+        (PerfTestsRunner._generate_output_files):
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py:
+        (create_runner_and_setup_results_template):
+        (test_run_generates_and_show_results_page):
+        (test_run_respects_no_show_results):
+
+2012-08-07  Dirk Pranke  <dpranke@chromium.org>
+
+        test-webkitpy hangs in a new checkout on snow leopard
+        https://bugs.webkit.org/show_bug.cgi?id=93301
+
+        Reviewed by Ryosuke Niwa.
+
+        This change works around what appears to be a bug in Python
+        2.6.1 (the version that ships on Mac Snow Leopard) that causes
+        the multiprocessing module to hang after we use the
+        autoinstaller; I'm guessing it's some sort of python sockets
+        issue. I was unable to reproduce this with 2.6.5 or newer
+        versions of Python.
+
+        * Scripts/webkitpy/common/system/autoinstall.py:
+        (AutoInstaller.install):
+        * Scripts/webkitpy/test/main.py:
+        (Tester._run_tests):
+        * Scripts/webkitpy/thirdparty/__init__.py:
+        (AutoinstallImportHook._install_mechanize):
+        (AutoinstallImportHook._install_pep8):
+        (AutoinstallImportHook._install_pylint):
+        (AutoinstallImportHook._install_buildbot):
+        (AutoinstallImportHook._install_coverage):
+        (AutoinstallImportHook._install_eliza):
+        (AutoinstallImportHook._install_irc):
+        (AutoinstallImportHook._install_webpagereplay):
+        (AutoinstallImportHook._install):
+        (autoinstall_everything):
+
+2012-08-07  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium-Android][NRWT] Fix 2 FIXMEs in chromium_android.py
+        https://bugs.webkit.org/show_bug.cgi?id=93381
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidDriver.__init__):
+        (ChromiumAndroidDriver._push_executable): Remove temporary lines as the chromium change has been landed: http://src.chromium.org/viewvc/chrome?view=rev&revision=150371
+        (ChromiumAndroidDriver._setup_performance): Update all scaling governor files.
+        (ChromiumAndroidDriver._teardown_performance): Update all scaling governor files.
+
+2012-08-07  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Add support to DumpRenderTree [EventSender] for GestureTapDown events.
+        https://bugs.webkit.org/show_bug.cgi?id=93286
+
+        Reviewed by James Robinson.
+
+        Adds support to generate GestureTapDown events from EventSender, to facilitate
+        link highlighting layout tests.
+ 
+        Added a GestureTapEvent to one existing test, more tests to follow when LinkHighlight CLs start to land.
+
+        * DumpRenderTree/chromium/TestRunner/EventSender.cpp:
+        (EventSender::EventSender):
+        (EventSender::gestureTapDown):
+        (EventSender::gestureEvent):
+        * DumpRenderTree/chromium/TestRunner/EventSender.h:
+        (EventSender):
+
+2012-08-07  Marcelo Lira  <marcelo.lira@openbossa.org>
+
+        [Qt] Add support for the Gamepad API
+        https://bugs.webkit.org/show_bug.cgi?id=90637
+
+        Reviewed by Alexis Menard.
+
+        If the libudev library is present, the GAMEPAD flag is
+        turned on by default for the Qt port.
+
+        * Scripts/webkitperl/FeatureList.pm:
+        * qmake/mkspecs/features/features.prf:
+
+2012-08-07  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Turn on CSS Variables
+        https://bugs.webkit.org/show_bug.cgi?id=93376
+
+        Reviewed by Antonio Gomes.
+
+        Turn on CSS Variables for BlackBerry port.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-08-07  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Make it possible to build without QtQuick
+
+        Reviewed by Simon Hausmann.
+
+        * Tools.pro:
+        * qmake/mkspecs/features/features.prf:
+
+2012-08-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove Qt 4 specific code paths
+        https://bugs.webkit.org/show_bug.cgi?id=88161
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/EventSenderQt.cpp:
+        (EventSender::touchCancel):
+        (EventSender::sendTouchEvent):
+        * DumpRenderTree/qt/EventSenderQt.h:
+        (EventSender):
+        * DumpRenderTree/qt/ImageDiff.pro:
+        * DumpRenderTree/qt/main.cpp:
+        (main):
+        * QtTestBrowser/QtTestBrowser.pro:
+        * QtTestBrowser/cookiejar.cpp:
+        (TestBrowserCookieJar::TestBrowserCookieJar):
+        * QtTestBrowser/launcherwindow.cpp:
+        (LauncherWindow::setDiskCache):
+        * qmake/configure.pri:
+        * qmake/mkspecs/features/default_post.prf:
+        * qmake/mkspecs/features/default_pre.prf:
+        * qmake/mkspecs/features/features.prf:
+        * qmake/mkspecs/features/functions.prf:
+        * qmake/mkspecs/features/qtwebkit.prf: Removed.
+        * qmake/mkspecs/features/unix/default_pre.prf:
+
+2012-08-07  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] MiniBrowser should only synthesize multiple touch points if Ctrl is pressed
+        https://bugs.webkit.org/show_bug.cgi?id=93277
+
+        Reviewed by Jocelyn Turcotte.
+
+        MiniBrowser's multi-touch mocking does not check if Ctrl is pressed
+        when registering multiple touch points based on pressed mouse buttons
+        and sends inconsistent touch events to the WebView which triggers an
+        assert in the pinch gesture recognizer.
+        MiniBrowserApplication::updateTouchPoint should only register multiple
+        touch points if the Ctrl button is pressed else it should ignore the
+        update request.
+
+        * MiniBrowser/qt/MiniBrowserApplication.cpp:
+        (MiniBrowserApplication::updateTouchPoint):
+
+2012-08-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+        REGRESSION(r124800): It broke NRWT result parsing of build.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=93346
+
+        Rubber-stamped by Simon Hausmann.
+
+        Change back "unexpected" to "Unexpected", because master.cfg's results parser expects it.
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.test_retrying_and_flaky_tests):
+        * Scripts/webkitpy/layout_tests/views/printing.py:
+        (Printer._print_unexpected_results):
+
+2012-08-06  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [NRWT] runs platform specific tests that it shouldn't with --force
+        https://bugs.webkit.org/show_bug.cgi?id=91089
+
+        Reviewed by Dirk Pranke.
+
+        Ignore other platform's directories from platform/.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port._expanded_paths):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.test_platform_tests_are_found):
+        Updated integration test in accordance to the new behavior.
+
+2012-08-06  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [EFL] Enable link prefetch
+        https://bugs.webkit.org/show_bug.cgi?id=93281
+
+        Reviewed by Kentaro Hara.
+
+        * Scripts/webkitperl/FeatureList.pm: Enable LINK_PREFETCH feature.
+
+2012-08-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124801.
+        http://trac.webkit.org/changeset/124801
+        https://bugs.webkit.org/show_bug.cgi?id=93338
+
+        It broke NRWT (Requested by Ossy on #webkit).
+
+        * Scripts/webkitpy/layout_tests/controllers/single_test_runner.py:
+        (SingleTestRunner._compare_image):
+        (SingleTestRunner._compare_output_with_reference):
+        * Scripts/webkitpy/layout_tests/controllers/test_result_writer.py:
+        (write_test_result):
+        * Scripts/webkitpy/layout_tests/controllers/test_result_writer_unittest.py:
+        (TestResultWriterTest.test_reftest_diff_image.ImageDiffTestPort.diff_image):
+        (TestResultWriterTest):
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.diff_image):
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumPort.diff_image):
+        * Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py:
+        (ChromiumPortTestCase.test_diff_image):
+        * Scripts/webkitpy/layout_tests/port/image_diff.py:
+        (ImageDiffer.diff_image):
+        (ImageDiffer._read):
+        * Scripts/webkitpy/layout_tests/port/image_diff_unittest.py:
+        (TestImageDiffer.test_diff_image):
+        * Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py:
+        (MockDRTPortTest.test_diff_image):
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        (PortTestCase.test_diff_image):
+        * Scripts/webkitpy/layout_tests/port/server_process_mock.py:
+        (MockServerProcess.__init__):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        (TestPort.diff_image):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.test_tolerance.ImageDiffTestPort.diff_image):
+
+2012-08-06  Wei James  <james.wei@intel.com>
+
+        [Chromium]duplicated command line options in Android LayoutTest
+        https://bugs.webkit.org/show_bug.cgi?id=93233
+
+        Reviewed by Tony Chang.
+
+        Duplicated options found in Android layout test command line:
+        --encode-binary and --enable-hardware-gpu.
+
+        If there are multiple ChromiumAndroidPort instances,
+        these two options will be appended for multiple times.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.additional_drt_flag):
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.__init__):
+        (ChromiumAndroidPort.additional_drt_flag):
+        * Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py:
+        (ChromiumAndroidTwoPortsTest):
+        (ChromiumAndroidTwoPortsTest.test_options_with_two_ports):
+        * Scripts/webkitpy/layout_tests/port/driver.py:
+        (Driver.cmd_line):
+
+2012-08-03  Brady Eidson  <beidson@apple.com>
+
+        Out-of-process plug-ins should support asynchronous initialization
+        <rdar://problem/10598594> and https://bugs.webkit.org/show_bug.cgi?id=92919
+
+        Reviewed by Anders Carlsson.
+
+        Add a plug-in with an NPP_New that takes 550ms (a reasonable trade-off between a solid test and a slow running test)
+        for testing asynchronous plug-in initialization.
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/TestNetscapePlugIn/Tests/SlowNPPNew.cpp: Copied from Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.h.
+        (SlowNPPNew):
+        (SlowNPPNew::SlowNPPNew):
+        (SlowNPPNew::NPP_New):
+
+2012-08-06  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium-Android] Virtual test suites fail
+        https://bugs.webkit.org/show_bug.cgi?id=92515
+
+        Reviewed by Dirk Pranke.
+
+        The failure is because our bypassing of DriverProxy.
+        Repeat the logic of virtual tests in DriverProxy in ChromiumAndroidDriver
+        and restart DRT when the command line changes.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidDriver.__init__):
+        (ChromiumAndroidDriver.cmd_line): Added comments about why we override this and have _drt_cmd_line().
+        (ChromiumAndroidDriver.run_test): Repeat the logic of virtual tests in DriverProxy.
+        (ChromiumAndroidDriver.start): Restart DRT when the command line changes.
+        (ChromiumAndroidDriver._start_once):
+
+2012-08-06  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Remove NRWT --shard-ref-tests
+        https://bugs.webkit.org/show_bug.cgi?id=91539
+
+        This is basically a revert of "[Chromium-Android] Run ref tests together to avoid expensive driver restarts"
+        (https://bugs.webkit.org/show_bug.cgi?id=91533, http://trac.webkit.org/changeset/122914),
+        with some conflicts resolved (because of refactory of Manager/LayoutTestRunner/Sharder classes).
+
+        Reviewed by Dirk Pranke.
+
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py:
+        (LayoutTestRunner.run_tests):
+        (Sharder.shard_tests):
+        (Sharder._shard_in_two):
+        (Sharder._shard_by_directory):
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_runner_unittest.py:
+        (SharderTests):
+        (SharderTests.get_test_input):
+        (SharderTests.get_shards):
+        (SharderTests.test_shard_by_dir):
+        (SharderTests.test_shard_in_two):
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._test_input_for_file):
+        (Manager._test_is_slow):
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.__init__):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (parse_args):
+
+2012-08-06  Luciano Wolf  <luciano.wolf@openbossa.org>
+
+        [Qt] Default sizes for input-text and text-area are different when running DRT/WTR
+        https://bugs.webkit.org/show_bug.cgi?id=91990
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Initializing TestFonts information into WTR binary. Doing it 
+        later leads to wrong font names usage (Dejavu Serif instead
+        of Liberation Serif).
+
+        * WebKitTestRunner/Target.pri:
+        * WebKitTestRunner/qt/main.cpp:
+        (main):
+
+2012-08-06  Jeff Timanus  <twiz@chromium.org>
+
+        Add twiz@{chromium|google}.org to the set of non-committer contributors.
+        https://bugs.webkit.org/show_bug.cgi?id=93288
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-08-06  Adam Barth  <abarth@webkit.org>
+
+        REGRESSION(124789): EWS errors out because --print option is missing
+        https://bugs.webkit.org/show_bug.cgi?id=93299
+
+        Unreviewed.
+
+        The --print option doesn't exist anymore.  Let's try --quiet instead.
+
+        * Scripts/webkitpy/tool/steps/runtests.py:
+        (RunTests.run):
+        * Scripts/webkitpy/tool/steps/runtests_unittest.py:
+
+2012-08-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        run-webkit-tests should have ability to add description to its JSON output
+        https://bugs.webkit.org/show_bug.cgi?id=93296
+
+        Reviewed by Dirk Pranke.
+
+        Add --description option.
+
+        * Scripts/webkitpy/performance_tests/perftestsrunner.py:
+        (PerfTestsRunner._parse_args):
+        (PerfTestsRunner._generate_and_show_results):
+        (PerfTestsRunner._generate_results_dict):
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py:
+        (test_run_with_description):
+
+2012-08-06  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: handle errors from image diff better
+        https://bugs.webkit.org/show_bug.cgi?id=92934
+
+        Reviewed by Ojan Vafai.
+
+        Currently if ImageDiff crashes, returns a weird exit code, or
+        produces any stderr output, it's basically swallowed. This
+        change ensures that we log errors to stderr, and also appends
+        the error to the stderr for the test (so it'll show up in
+        results.html).
+
+        Most importantly, it'll cause diff_image() to fail and we'll
+        report ImageHashMismatch ... this may be kinda untrue, but I
+        think it's better than ignoring the error.
+
+        * Scripts/webkitpy/layout_tests/controllers/single_test_runner.py:
+        (SingleTestRunner._compare_image):
+        (SingleTestRunner._compare_output_with_reference):
+        * Scripts/webkitpy/layout_tests/controllers/test_result_writer.py:
+        (write_test_result):
+        * Scripts/webkitpy/layout_tests/controllers/test_result_writer_unittest.py:
+        (TestResultWriterTest.test_reftest_diff_image.ImageDiffTestPort.diff_image):
+        (TestResultWriterTest):
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.diff_image):
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumPort.diff_image):
+        * Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py:
+        (ChromiumPortTestCase.test_diff_image_crashed):
+        * Scripts/webkitpy/layout_tests/port/driver.py:
+        (Driver.run_test):
+        * Scripts/webkitpy/layout_tests/port/image_diff.py:
+        (ImageDiffer.diff_image):
+        (ImageDiffer._read):
+        * Scripts/webkitpy/layout_tests/port/image_diff_unittest.py:
+        (TestImageDiffer.test_diff_image):
+        * Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py:
+        (MockDRTPortTest.test_diff_image_crashed):
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        (PortTestCase.test_diff_image):
+        (PortTestCase):
+        (PortTestCase.test_diff_image_crashed):
+        (PortTestCase.test_diff_image_crashed.make_proc):
+        * Scripts/webkitpy/layout_tests/port/server_process_mock.py:
+        (MockServerProcess.__init__):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        (TestPort.diff_image):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.test_tolerance.ImageDiffTestPort.diff_image):
+
+2012-08-06  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: clean up printing.py
+        https://bugs.webkit.org/show_bug.cgi?id=93026
+
+        Reviewed by Dirk Pranke.
+
+        This patch cleans up the implementation of printing.py now
+        that we're not using all the original complexity.
+
+        There should be no changes in functionality and everything
+        should be covered by the existing tests.
+
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py:
+        (LayoutTestRunner.run_tests):
+        * Scripts/webkitpy/layout_tests/views/printing.py:
+        (Printer.__init__):
+        (Printer.__del__):
+        (Printer.print_config):
+        (Printer.print_found):
+        (Printer.print_expected):
+        (Printer.print_workers_and_shards):
+        (Printer):
+        (Printer._print_expected_results_of_type):
+        (Printer.print_results):
+        (Printer._print_timing_statistics):
+        (Printer._print_aggregate_test_statistics):
+        (Printer._print_individual_test_times):
+        (Printer._print_test_list_timing):
+        (Printer._print_directory_timings):
+        (Printer._print_statistics_for_test_timings):
+        (Printer._print_result_summary):
+        (Printer._print_result_summary_entry):
+        (Printer._print_one_line_summary):
+        (Printer.print_finished_test):
+        (Printer._print_test_result):
+        (Printer._print_test_trace):
+        (Printer._print_baseline):
+        (Printer._print_unexpected_test_result):
+        (Printer._print_progress):
+        (Printer._print_unexpected_results):
+        (Printer._print_unexpected_results.add_result):
+        (Printer._print_quiet):
+        (Printer._print_default):
+        (Printer._print_debug):
+        (Printer._print_for_bot):
+        (Printer.write_update):
+        (Printer.writeln):
+        * Scripts/webkitpy/layout_tests/views/printing_unittest.py:
+        (Testprinter.get_printer):
+        (Testprinter.test_print_config):
+        (Testprinter.test_print_one_line_summary):
+        (Testprinter.test_print_unexpected_results):
+        (test_details):
+
+2012-08-06  Dirk Pranke  <dpranke@chromium.org>
+
+        change bots to pass --debug-rwt-logging instead of --verbose to new-run-webkit-tests
+        https://bugs.webkit.org/show_bug.cgi?id=93043
+
+        Reviewed by Ryosuke Niwa.
+
+        in preparation for the cleanup of the logging flags in new-run-webkit-tests.
+
+        * Scripts/run-webkit-tests:
+
+2012-08-06  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: clean up logging, part 1
+        https://bugs.webkit.org/show_bug.cgi?id=93018
+
+        Reviewed by Ojan Vafai.
+
+        remove --print, --help-printing from nrwt, add three new options:
+        --quiet, which just logs warnings,errors, and unexpected results
+        --debug-rwt-logging, a new name for --verbose
+        --details, to get the old --print trace-everything behavior
+
+        This patch does not implement the new "one line per test"
+        --verbose behavior specified in bug 88702, and there's a bunch
+        of internal cleanup I can do in printing.py that I'll defer to
+        a later patch to make things easier to review.
+
+        This patch deletes a lot of unit tests that are no longer
+        necessary since there aren't so many logging combinations.
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (run):
+        (main):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (parse_args):
+        (passing_run):
+        (StreamTestingMixin.assertContains):
+        (MainTest.test_child_processes_2):
+        (MainTest.test_child_processes_min):
+        (MainTest.test_full_results_html):
+        (MainTest.test_no_tests_found):
+        (MainTest.test_no_tests_found_2):
+        (MainTest.test_repeat_each_iterations_num_tests):
+        (MainTest.test_additional_platform_directory):
+        (RebaselineTest.assertBaselines):
+        * Scripts/webkitpy/layout_tests/views/printing.py:
+        (print_options):
+        (Printer.__init__):
+        (Printer.enabled):
+        (Printer.print_unexpected_results):
+        * Scripts/webkitpy/layout_tests/views/printing_unittest.py:
+        (TestUtilityFunctions.test_print_options):
+        (Testprinter.get_result_summary):
+        (Testprinter.test_configure_and_cleanup):
+        (Testprinter.test_print_config):
+        (Testprinter.test_print_one_line_summary):
+        (Testprinter.test_print_unexpected_results):
+        (test_details):
+        (test_default):
+        (test_quiet):
+        (test_verbose):
+
+2012-08-06  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium-Android] Store test executable, data and fonts in /data/local/tmp
+        https://bugs.webkit.org/show_bug.cgi?id=91910
+
+        /data/local/tmp is a directory with permission 0777 by default.
+        Place DumpRenderTree resources here so that both the native test app and
+        the NRWT script can access them even if adb shell isn't running as root.
+
+        Reviewed by Adam Barth.
+
+        * DumpRenderTree/chromium/TestShellAndroid.cpp:
+        (createFIFO): Set fifo mode to 0666 to allow unrooted adb shell to access.
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.driver_cmd_line):
+        (ChromiumAndroidDriver.__init__):
+        (ChromiumAndroidDriver._setup_test):
+        (ChromiumAndroidDriver._push_executable):
+        * Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py:
+        (ChromiumAndroidPortTest.make_port):
+        (ChromiumAndroidPortTest.test_expectations_files):
+        (ChromiumAndroidDriverTest.test_drt_cmd_line):
+
+2012-08-06  Abhishek Arya  <inferno@chromium.org>
+
+        [Chromium] Re-expose layoutTestController as various fuzzers depend on it
+        https://bugs.webkit.org/show_bug.cgi?id=93282
+
+        Reviewed by Ryosuke Niwa.
+
+        Unfortunately, various fuzzers used in the Chromium project still depends on
+        window.layoutTestController. Re-expose the object while they're making the transition.
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::bindJSObjectsToWindow):
+
+2012-08-06  Balazs Kelemen  <kbalazs@webkit.org>
+
+        WTR should be able to load external resources
+        https://bugs.webkit.org/show_bug.cgi?id=89382
+
+        Reviewed by Ryosuke Niwa.
+
+        Allow to load an external resource as the main frame
+        and allow all subsequent external loads for such a main
+        frame. This behavior is necessary for being able to run
+        performance tests (https://bugs.webkit.org/show_bug.cgi?id=84008).
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::isLocalHost):
+        (WTR):
+        (WTR::isHTTPOrHTTPSScheme):
+        (WTR::InjectedBundlePage::willSendRequestForFrame):
+
+2012-08-06  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [WK2] REGRESSION(124596) lot of web process unresponsiveness appears on Apple bots
+        https://bugs.webkit.org/show_bug.cgi?id=93120
+
+        Reviewed by Csaba Osztrogonác.
+
+        Set the short timeout back to 15 seconds and add more time to WebKitTestRunner
+        so it will be able to detect an unresponsive web process.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.default_timeout_ms):
+        * WebKitTestRunner/TestController.cpp:
+        (WTR):
+
+2012-08-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.am: Add jhbuildutils.py to EXTRA_DIST.
+
+2012-08-06  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL] EFL's LayoutTestController needs removeAllVisitedLinks implementation
+        https://bugs.webkit.org/show_bug.cgi?id=82724
+
+        Reviewed by Csaba Osztrogonác.
+
+        * DumpRenderTree/efl/LayoutTestControllerEfl.cpp:
+        (LayoutTestController::removeAllVisitedLinks):
+
+2012-08-06  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [WK2][GTK] Implement a new spell checker API for WebKit2GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=90268
+
+        Reviewed by Martin Robinson.
+
+        Ignore WebKitTextChecker.* private files for gtk-doc.
+
+        * gtk/generate-gtkdoc:
+        (get_webkit2_options):
+
+2012-08-06  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed. Roll out r124728 because of build bot test fail.
+
+        * Scripts/webkitpy/common/config/watchlist:
+
+2012-08-05  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed. Change my email address for watch list.
+
+        * Scripts/webkitpy/common/config/watchlist:
+
+2012-08-04  Nico Weber  <thakis@chromium.org>
+
+        [Chromium Mac] Tests are exiting early due to failures to load missingImage.png
+        https://bugs.webkit.org/show_bug.cgi?id=93186
+
+        Reviewed by Ryosuke Niwa.
+
+        Add missingImage.png to DumpRenderTree.app's Resource folder.
+        Depends on http://crrev.com/150037 rolling into webkit first.
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+
+2012-08-03  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Stop exposing window.layoutTestController in layout tests in favor of window.testRunner
+        https://bugs.webkit.org/show_bug.cgi?id=93173
+
+        Reviewed by Adam Barth.
+
+        Don't expose window.layoutTestController since all layout tests use window.testRunner
+        instead of window.layoutTestController as of r124685.
+
+        We can safely rename classes and files to use TestRunner once this patch is landed.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::makeWindowObject):
+        * DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp:
+        (notifyTestCompletion):
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
+        (PluginTest::waitUntilDone):
+        (PluginTest::notifyDone):
+        * DumpRenderTree/TestNetscapePlugIn/Tests/mac/ConvertPoint.cpp:
+        (ConvertPoint::NPP_SetWindow):
+        * DumpRenderTree/TestNetscapePlugIn/main.cpp:
+        (handleEventCarbon):
+        (handleEventCocoa):
+        (handleEventWin):
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::bindJSObjectsToWindow):
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::initJSObjects):
+        * Scripts/bencher:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::makeWindowObject):
+
+2012-08-04  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed: Web Inspector: extend instrumenting methods set in ReportMemoryUsage clang plugin
+        Three methods addString, addVectorPtr and addInstrumentedVectorPtr were added to the list of instrumentation methods.
+
+        * clang/ReportMemoryUsagePlugin/ReportMemoryUsage.cpp:
+        (clang::ReportMemoryUsageConsumer::ReportMemoryUsageConsumer):
+
+2012-08-03  Yaron Friedman  <yfriedman@chromium.org>
+
+        [Chrome-Android] - Prepare apk tests for switch to checked in SDK.
+        https://bugs.webkit.org/show_bug.cgi?id=92931
+
+        Reviewed by Adam Barth.
+
+        Pass Android-specific gyp variables to the native test generator,
+        avoiding any dependencies on environment variables during build time.
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+        * TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp:
+
+2012-08-03  Rick Byers  <rbyers@chromium.org>
+
+        Double tap gesture should send dblclick event
+        https://bugs.webkit.org/show_bug.cgi?id=92412
+
+        Reviewed by Adam Barth.
+
+        Enable EventSender to set the tap count on tap gesture events.  The
+        delta X/Y parameters were not actually being used anymore (used to be
+        used for radius information).
+
+        * DumpRenderTree/chromium/TestRunner/EventSender.cpp:
+        (EventSender::gestureEvent):
+
+2012-08-03  Ryosuke Niwa  <rniwa@webkit.org>
+
+        run-perf-tests should generate JSON output and results page by default
+        https://bugs.webkit.org/show_bug.cgi?id=93042
+
+        Reviewed by Eric Seidel.
+
+        Generate results JSON and page named PerfTestResults.json and PerfTestResults.html by default.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.perf_results_directory): Added.
+        * Scripts/webkitpy/performance_tests/perftestsrunner.py:
+        (PerfTestsRunner): Added _DEFAULT_JSON_FILENAME.
+        (PerfTestsRunner._parse_args): Added --no-results option in the case a user doens't want to generate
+        results JSON or results page.
+        (PerfTestsRunner.run):
+        (PerfTestsRunner._generate_and_show_results): Extracted from run. Set the default json file path using
+        port's perf_results_directory and call show_results_html_file at the end if the results page is generated.
+        (PerfTestsRunner._generate_results_dict): Renamed from _generate_output to disambiguate it from
+        _generate_and_show_results.
+        (PerfTestsRunner._generate_output_files): Takes results page's path instead of a boolean indicating
+        whether results page should be generated or not.
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py:
+        (create_runner_and_setup_results_template):
+        (test_run_respects_results_output): Added.
+        (test_run_generates_json_by_default): Added.
+        (test_run_generates_and_show_results_page): Added a check to ensure show_results_html_file is called.
+
+2012-08-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124628.
+        http://trac.webkit.org/changeset/124628
+        https://bugs.webkit.org/show_bug.cgi?id=93155
+
+        Causes random crashes of DRT on Chromium bots (Requested by
+        dimich on #webkit).
+
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/chromium/MockWebKitPlatformSupport.cpp:
+        (MockWebKitPlatformSupport::createMediaStreamCenter):
+        * DumpRenderTree/chromium/MockWebKitPlatformSupport.h:
+        (MockWebKitPlatformSupport):
+        * DumpRenderTree/chromium/MockWebMediaStreamCenter.cpp:
+        * DumpRenderTree/chromium/MockWebMediaStreamCenter.h:
+        * DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.cpp: Removed.
+        * DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.h: Removed.
+
+2012-08-03  Brady Eidson  <beidson@apple.com>
+
+        Small part of "Out-of-process plug-ins should support asynchronous initialization."
+        <rdar://problem/10598594> and https://bugs.webkit.org/show_bug.cgi?id=92919
+
+        Reviewed by Anders Carlsson.
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::resetStateToConsistentValues): Reset all preferences related to asynchronous plugin initialization.
+
+2012-08-02  Jeffrey Pfau  <jpfau@apple.com>
+
+        Add API for enabling blanket third-party data blocking
+        https://bugs.webkit.org/show_bug.cgi?id=93022
+
+        Reviewed by Anders Carlsson.
+
+        Added test for default setting of new third-party storage blocking API.
+
+        * TestWebKitAPI/Tests/WebKit2/WKPreferences.cpp:
+        (TestWebKitAPI::TEST):
+
+2012-08-03  Arvid Nilsson  <anilsson@rim.com>
+
+        Unreviewed, adding self to committers.py after becoming committer.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-08-03  Ádám Kallai  <kadam@inf.u-szeged.hu>
+
+        Limited the number of queried cached build infos in URLs used by Garden-o-matic.
+        https://bugs.webkit.org/show_bug.cgi?id=92992.
+
+        Reviewed by Adam Barth.
+
+        I added a limit to the cached builds that are included in the URL to avoid too long URLs in Garden-o-matic.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/builders.js:
+        (.):
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js:
+
+2012-08-03  Tommy Widenflycht  <tommyw@google.com>
+
+        [chromium] MediaStream API: Add MockWebRTCPeerConnectionHandler
+        https://bugs.webkit.org/show_bug.cgi?id=93091
+
+        Reviewed by Adam Barth.
+
+        Add a skeleton MockWebRTCPeerConnectionHandler to DumpRenderTree,
+        to complete the infrastructure for RTCPeerConnection.
+
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/chromium/MockWebKitPlatformSupport.cpp:
+        (MockWebKitPlatformSupport::createRTCPeerConnectionHandler):
+        * DumpRenderTree/chromium/MockWebKitPlatformSupport.h:
+        (MockWebKitPlatformSupport):
+        * DumpRenderTree/chromium/MockWebMediaStreamCenter.cpp:
+        * DumpRenderTree/chromium/MockWebMediaStreamCenter.h:
+        * DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.cpp: Copied from Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.h.
+        (MockWebRTCPeerConnectionHandler::MockWebRTCPeerConnectionHandler):
+        (MockWebRTCPeerConnectionHandler::initialize):
+        * DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.h: Copied from Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.h.
+        (WebKit):
+        (MockWebRTCPeerConnectionHandler):
+        (MockWebRTCPeerConnectionHandler::MockWebRTCPeerConnectionHandler):
+
+2012-08-03  Hugo Parente Lima  <hugo.lima@openbossa.org>
+
+        [Qt][WK2] There's no way to test the gesture tap on WTR
+        https://bugs.webkit.org/show_bug.cgi?id=92895
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        WTR doesn't create the QQuickItem from C++, not from QML, so a call
+        to componentComplete() was added to mimic the QML behaviour.
+
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+        (WTR::PlatformWebView::PlatformWebView):
+
+2012-08-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Unreviewed, rolling out r124567.
+        http://trac.webkit.org/changeset/124567
+        https://bugs.webkit.org/show_bug.cgi?id=89382
+
+        Broke some tests with external resources
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::willSendRequestForFrame):
+
+2012-08-03  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, rolling out r124614.
+        http://trac.webkit.org/changeset/124614
+        https://bugs.webkit.org/show_bug.cgi?id=91727
+
+        gstreamer core .po files mess up the build again
+
+        * Scripts/webkitdirs.pm:
+        (buildAutotoolsProject):
+        * gtk/jhbuild.modules:
+
+2012-08-03  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK][jhbuild] Switch to GStreamer 0.11 build
+        https://bugs.webkit.org/show_bug.cgi?id=91727
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Switch build-webkit --gtk to GStreamer 0.11 support and build the
+        necessary GStreamer git modules from JHBuild.
+
+        * Scripts/webkitdirs.pm:
+        (buildAutotoolsProject): Build WebKit with GStreamer 0.11 support.
+        * gtk/jhbuild.modules: GStreamer build support.
+
+2012-08-03  Nico Weber  <thakis@chromium.org>
+
+        [chromium mac] DumpRenderTree compile fails with warning/error in LayoutTestHelper.mm with 10.7sdk
+        https://bugs.webkit.org/show_bug.cgi?id=92820
+
+        Reviewed by Jochen Eisinger.
+
+        When building with the 10.7 SDK, use newer functions to switch color
+        profiles. Note that these newer functions aren't available on 10.6,
+        but we don't intend to ship DRT to users, and no bots that currently
+        build with the 10.7 SDK ship their binaries to 10.6 testers.
+
+        The new code was copied from Apple's DRT/mac/LayoutTestHelper.m.
+
+        * DumpRenderTree/chromium/LayoutTestHelper.mm:
+        (installLayoutTestColorProfile):
+        (restoreUserColorProfile):
+        (saveCurrentColorProfile):
+
+2012-08-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        StringImpl created from literal should be BufferInternal
+        https://bugs.webkit.org/show_bug.cgi?id=92940
+
+        Reviewed by Anders Carlsson.
+
+        Add tests for the contruction of strings from literal.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/WTF/AtomicString.cpp: Added.
+        (TestWebKitAPI):
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WTF/StringImpl.cpp: Added.
+        (TestWebKitAPI):
+        (TestWebKitAPI::TEST):
+
+2012-08-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [nrwt] fix unit tests after turned pixel testing to be a per test setting
+        https://bugs.webkit.org/show_bug.cgi?id=93112
+
+        Reviewed by Csaba Osztrogonác.
+
+        Change unit tests in accordance of per test switching of pixel testing.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py:
+        (ChromiumAndroidDriverTest.test_command_from_driver_input):
+        * Scripts/webkitpy/layout_tests/port/driver_unittest.py:
+        (DriverTest.test_no_timeout):
+
+2012-08-03  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Populate .qmake.cache from the top-level project file
+
+        This makes it possible to build webkit without using the perl build
+        script. The duplicated logic in build-webkit will be removed when we
+        remove the Qt4 code paths. The build-webkit script will then simply
+        call 'qmake WebKit.pro' from WEBKITOUTPUTDIR.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * qmake/mkspecs/features/win32/default_pre.prf:
+
+2012-08-03  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Move build config default to build-webkit instead of default_pre
+
+        Allows the qmake buildsystem have its own default.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Scripts/webkitdirs.pm:
+        (buildQMakeProjects):
+        * qmake/mkspecs/features/default_pre.prf:
+
+2012-08-03  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Unreviewed build fix for GTK after r124581.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (runTest): Fix wrong variable name in ASSERT.
+
+2012-08-03  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Always save CONFIG & DEFINES in default_pre
+
+        Always doing it is cheaper than checking whether it needs to be done.
+        apart from that, it would break configuration initiated from another
+        project.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * qmake/mkspecs/features/default_pre.prf:
+
+2012-08-03  Joone Hur  <joone.hur@intel.com>
+
+        [EFL][DRT] fast/loader/stop-provisional-loads.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=92219
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        This patch adds the ability to tell DRT to call ewk_frame_stop 
+        inside of a didStartProvisionalLoadForFrame signal handler.
+        It allows to pass fast/loader/stop-provisional-loads.html.
+
+        * DumpRenderTree/efl/DumpRenderTreeChrome.cpp:
+        (DumpRenderTreeChrome::onFrameProvisionalLoad):
+
+2012-08-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [WTR] process unresponsiveness is reported to the wrong test
+        https://bugs.webkit.org/show_bug.cgi?id=88404
+
+        2nd unreviewed buildfix.
+
+        * WebKitTestRunner/TestInvocation.cpp:
+
+2012-08-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [WTR] process unresponsiveness is reported to the wrong test
+        https://bugs.webkit.org/show_bug.cgi?id=88404
+
+        Unreviewed buildfix. Also made the change on the array size
+        suggested on review because I forgot it when landed.
+
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::TestInvocation::invoke):
+
+2012-08-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [WTR] process unresponsiveness is reported to the wrong test
+        https://bugs.webkit.org/show_bug.cgi?id=88404
+
+        Reviewed by Zoltan Herczeg.
+
+        Do resetting to consistent state after the finished test,
+        not before the next. This way we can report unresponsiveness
+        to the test that triggered it, and we do a restart before the
+        next test so it will start in a functional state.
+
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        (WebKitDriver._check_for_driver_crash):
+        Print the error line for unresponsive web process, otherwise
+        it's hard to tell what happened.
+        * WebKitTestRunner/TestController.cpp:
+        (WTR):
+        Decreased the default short timeout so we can detect unresponsiveness
+        before the timer of the test harness times out. It was unnecessarily
+        high anyway, we should get answer from the web process in those cases
+        when the short timeout is used in less than a second.
+        (WTR::TestController::runTest):
+        (WTR::TestController::run):
+        * WebKitTestRunner/TestController.h:
+        (TestController):
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::TestInvocation::invoke):
+        (WTR::TestInvocation::dump):
+        (WTR::TestInvocation::didReceiveMessageFromInjectedBundle):
+        * WebKitTestRunner/TestInvocation.h:
+        (TestInvocation): Make the dump function static as it doesn't need an object.
+
+2012-08-03  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [EFL] (REGRESSION 124581) : EFL 64-bit Debug bot is red and build is exiting early after 20 test crashes
+        https://bugs.webkit.org/show_bug.cgi?id=93084
+
+        Reviewed by Csaba Osztrogonác.
+
+        Fix regression introduced in r124581.
+
+        * DumpRenderTree/efl/DumpRenderTree.cpp:
+        (getFinalTestURL): Convert the path into a full file URL.
+        (runTest):
+
+2012-08-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        All ports should support per test switching of pixel testing
+        https://bugs.webkit.org/show_bug.cgi?id=92398
+
+        Reviewed by Dirk Pranke.
+
+        Teach all test drivers to accept a per test control of whether
+        to dump pixels. Drivers now accept a -p/--pixel-test argument
+        on the standart input that means that running the current
+        test as pixel test is allowed (even if the expected hash is
+        missing). Removed the --pixel-tests command line option since
+        there is no need for it anymore.
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/DumpRenderTree.h:
+        (TestCommand::TestCommand):
+        (TestCommand):
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/DumpRenderTreeCommon.cpp: Added.
+        (CommandTokenizer):
+        (CommandTokenizer::CommandTokenizer):
+        (CommandTokenizer::pump):
+        (CommandTokenizer::next):
+        (CommandTokenizer::hasNext):
+        (die):
+        (parseInputLine):
+        Common logic to parse the input line from the standard input (or from the command line
+        in standalone mode). Made it somewhat general so we can easily add more arguments if
+        there is a need.
+
+        * DumpRenderTree/chromium/DumpRenderTree.cpp:
+        (runTest):
+        (main):
+
+        * DumpRenderTree/chromium/TestRunner/AccessibilityControllerChromium.cpp: Renamed from Tools/DumpRenderTree/chromium/TestRunner/AccessibilityController.cpp.
+        * DumpRenderTree/chromium/TestRunner/AccessibilityControllerChromium.h: Renamed from Tools/DumpRenderTree/chromium/TestRunner/AccessibilityController.h.
+        * DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp: Renamed from Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElement.cpp.
+        * DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.h: Renamed from Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElement.h.
+        Renamed these files with a Chromium suffix because they were clashing with the common ones used by other ports after adding the root
+        DumpRenderTree directory to the include path.
+
+        * DumpRenderTree/chromium/TestRunner/TestInterfaces.cpp:
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+        (TestShell::runFileTest):
+        (TestShell::dump):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestParams::TestParams):
+        (TestShell):
+        * DumpRenderTree/efl/CMakeLists.txt:
+        * DumpRenderTree/efl/DumpRenderTree.cpp:
+        (parseCommandLineOptions):
+        (runTest):
+        (shouldDumpPixelsAndCompareWithExpected):
+        (main):
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (initializeGlobalsFromCommandLineOptions):
+        (dump):
+        (runTest):
+        (main):
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (initializeGlobalsFromCommandLineOptions):
+        (dumpRenderTree):
+        (dump):
+        (runTest):
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::DumpRenderTree):
+        (WebCore::DumpRenderTree::open):
+        (WebCore::DumpRenderTree::processLine):
+        (WebCore::DumpRenderTree::dump):
+        * DumpRenderTree/qt/DumpRenderTreeQt.h:
+        (DumpRenderTree):
+        * DumpRenderTree/qt/main.cpp:
+        (isOption):
+        (printUsage):
+        (main):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (dump):
+        (runTest):
+        (dllLauncherEntryPoint):
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        * DumpRenderTree/wscript:
+        * DumpRenderTree/wx/DumpRenderTreeWx.cpp:
+        (dump):
+        (runTest):
+        (MyApp::OnInit):
+        * GNUmakefile.am:
+
+        * Scripts/old-run-webkit-tests:
+        * Scripts/old-run-webkit-tests:
+        Pass --pixel-test before the hash.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.should_run_as_pixel_test): Removed now that all ports supports it.
+        * Scripts/webkitpy/layout_tests/port/driver.py:
+        (Driver.cmd_line): Don't pass --pixel-tests anymore.
+        (Driver._command_from_driver_input):
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort.should_run_as_pixel_test):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        (TestPort.should_run_as_pixel_test):
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::TestController):
+        (WTR::TestController::initialize):
+        (WTR::TestCommand::TestCommand):
+        (TestCommand):
+        (WTR):
+        (CommandTokenizer):
+        (WTR::CommandTokenizer::CommandTokenizer):
+        (WTR::CommandTokenizer::pump):
+        (WTR::CommandTokenizer::next):
+        (WTR::CommandTokenizer::hasNext):
+        (WTR::die):
+        (WTR::parseInputLine):
+        (WTR::TestController::runTest):
+        * WebKitTestRunner/TestController.h:
+        (TestController):
+        Duplicate the logic for parsing the command line because
+        unfortunately there is no way to share code between
+        WebKitTestRunner and DumpRenderTree.
+
+2012-08-03  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: clang plugin for checking native memory instrumentation coverage.
+        https://bugs.webkit.org/show_bug.cgi?id=92650
+
+        Reviewed by Yury Semikhatsky.
+
+        This is the clang plugin for checking native memory instrumentation coverage.
+        The idea: InspectorMemoryAgent traverses through instrumented objects and collects pointers and their sizes and types.
+        It is doing that with help of reportMemoryUsage function that needs to be implemented in each, significant
+        from native memory footprint point of view, WebCore class.
+        This plugin checks that the list of class members is matching with the list of members reported in reportMemoryUsage function
+        and makes a warning for the each member that needs to be reported.
+
+        * clang/ReportMemoryUsagePlugin/CMakeLists.txt: Added.
+        * clang/ReportMemoryUsagePlugin/Makefile: Added.
+        * clang/ReportMemoryUsagePlugin/ReportMemoryUsage.cpp: Added.
+        (clang):
+        (AddMemberCallVisitor):
+        (clang::AddMemberCallVisitor::VisitCallExpr):
+        (clang::AddMemberCallVisitor::instrumentedMembers):
+        (ReportMemoryUsageVisitor):
+        (clang::ReportMemoryUsageVisitor::ReportMemoryUsageVisitor):
+        (clang::ReportMemoryUsageVisitor::VisitCXXMethodDecl):
+        (clang::ReportMemoryUsageVisitor::emitWarning):
+        (clang::ReportMemoryUsageVisitor::findInstrumentationMethod):
+        (clang::ReportMemoryUsageVisitor::needsToBeInstrumented):
+        (clang::ReportMemoryUsageVisitor::CheckMembersCoverage):
+        (ReportMemoryUsageConsumer):
+        (clang::ReportMemoryUsageConsumer::ReportMemoryUsageConsumer):
+        (clang::ReportMemoryUsageConsumer::HandleTranslationUnit):
+        (ReportMemoryUsageAction):
+        (clang::ReportMemoryUsageAction::CreateASTConsumer):
+        (clang::ReportMemoryUsageAction::ParseArgs):
+        * clang/ReportMemoryUsagePlugin/tests/Source/WebCore/Test.cpp: Added.
+        (aNamespace):
+        (MemoryInstrumentation):
+        (MemoryClassInfo):
+        (aNamespace::MemoryClassInfo::MemoryClassInfo):
+        (aNamespace::MemoryClassInfo::addMember):
+        (aNamespace::MemoryClassInfo::addInstrumentedMember):
+        (OwnPtr):
+        (aNamespace::OwnPtr::OwnPtr):
+        (RefPtr):
+        (aNamespace::RefPtr::RefPtr):
+        (Vector):
+        (String):
+        (NotInstrumentedClass):
+        (InstrumentedClass):
+        (aNamespace::InstrumentedClass::reportMemoryUsage):
+        (InstrumentedChildClass):
+        (aNamespace::InstrumentedChildClass::reportMemoryUsage):
+        (InstrumentedChildChildClass):
+        (InstrumentedChildChildClass::reportMemoryUsage):
+        (main):
+
+2012-08-03  Joone Hur  <joone.hur@intel.com>
+
+        [EFL][DRT] WebKitAnimation API compile-time disabled
+        https://bugs.webkit.org/show_bug.cgi?id=84593
+
+        Reviewed by Laszlo Gombos.
+
+        Enable ENABLE_ANIMATION_API by default on the Efl port.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-08-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        WTR should be able to load external resources
+        https://bugs.webkit.org/show_bug.cgi?id=89382
+
+        Reviewed by Ryosuke Niwa.
+
+        Allow to load an external resource as the main frame
+        and allow all subsequent external loads for such a main
+        frame. This behavior is necessary for being able to run
+        performance tests (wkb.ug/84008).
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::isLocalHost):
+        (WTR):
+        (WTR::isHTTPOrHTTPSScheme):
+        (WTR::InjectedBundlePage::willSendRequestForFrame):
+
+2012-08-02  Joone Hur  <joone.hur@intel.com>
+
+        [GTK] Build break when building DumpRenderTree/gtk/EditingCallbacks.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=93061
+
+        Unreviewed, Fix build break for WebKitGtk+.
+
+        Use webkit_dom_element_get_class_name instead of webkit_dom_html_element_get_class_name.
+
+        * DumpRenderTree/gtk/EditingCallbacks.cpp:
+        (shouldShowDeleteInterfaceForElement):
+
+2012-08-02  Dirk Pranke  <dpranke@chromium.org>
+
+        test-webkitpy can fail on a clean checkout
+        https://bugs.webkit.org/show_bug.cgi?id=93039
+
+        Reviewed by Adam Barth.
+
+        Now that we run tests in parallel that can cause the installer
+        to try and install packages in parallel (even the same package),
+        and that probably won't work. We fix this by autoinstalling
+        everything up front (serially).
+
+        * Scripts/webkitpy/test/main.py:
+        (Tester._run_tests):
+        * Scripts/webkitpy/thirdparty/__init__.py:
+        (autoinstall_everything):
+
+2012-06-15  David Barton  <dbarton@mathscribe.com>
+
+        MathML: nested square root symbols have varying descenders
+        https://bugs.webkit.org/show_bug.cgi?id=43819
+
+        Reviewed by Eric Seidel.
+
+        Allow the STIXGeneral font to be used during layout tests, especially for MathML.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (allowedFontFamilySet):
+        * WebKitTestRunner/InjectedBundle/mac/ActivateFonts.mm:
+        (WTR::allowedFontFamilySet):
+
+2012-08-02  Dirk Pranke  <dpranke@chromium.org>
+
+        test-webkitpy: some tests need to run by themselves
+        https://bugs.webkit.org/show_bug.cgi?id=92926
+
+        Reviewed by Ojan Vafai.
+
+        Due to timing issues some of the executive tests will collide
+        and fail if they're run concurrently. This patch adds support
+        for writing tests that will be executed one at a time
+        (serially); to get them, add "serial_" to the front of the test
+        method name. 
+
+        * Scripts/webkitpy/common/system/executive_unittest.py:
+        (ExecutiveTest.serial_test_kill_process):
+        (ExecutiveTest.serial_test_kill_all):
+        (ExecutiveTest.serial_test_check_running_pid):
+        (ExecutiveTest.serial_test_running_pids):
+        (ExecutiveTest.serial_test_run_in_parallel):
+        * Scripts/webkitpy/test/main.py:
+        (Tester._run_tests):
+        (Tester._test_names):
+
+2012-08-02  Dirk Pranke  <dpranke@chromium.org>
+
+        test-webkitpy: integrate proper support for integration tests
+        https://bugs.webkit.org/show_bug.cgi?id=92925
+
+        Reviewed by Ojan Vafai.
+
+        This patch merges the custom loader I used for integration tests
+        into the main test-webkitpy code. Integration tests are not run
+        by default yet, but at least they can be run.
+
+        * Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py:
+        (MockTestShellTest.test_test_shell_parse_options):
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        (test_path_to_apache_config_file):
+        * Scripts/webkitpy/layout_tests/servers/http_server_integrationtest.py:
+        (WebsocketserverTest):
+        * Scripts/webkitpy/test/main.py:
+        (Tester._parse_args):
+        (Tester._run_tests):
+        (Tester._test_names):
+        (Tester._log_exception):
+        (_Loader):
+        (_Loader.getTestCaseNames):
+        (_Loader.getTestCaseNames.isTestMethod):
+
+2012-08-02  Dirk Pranke  <dpranke@chromium.org>
+
+        test-webkitpy: clean up runner in preparation for running tests serially as necessary
+        https://bugs.webkit.org/show_bug.cgi?id=92922
+
+        Reviewed by Ojan Vafai.
+
+        In order to run some tests by themselves (serially, rather than
+        in parallel with other tests), we will need to be able to run
+        multiple test suites; this causes us to move loading the logic
+        for finding test method names out of the runner and into main.
+
+        I'm taking advantage of this to simplify some other stuff from
+        the runner as well; it is now very simple and doesn't expose its
+        dependency on unittest.TestResult at all (nor will the Printer
+        use TestResult).
+
+        Subsequent patches will move the custom loader from
+        port_testcase so that we can properly choose whether to run
+        integration tests and/or serial tests, and then update the
+        appropriate tests to run only serially.
+
+        * Scripts/webkitpy/test/main.py:
+        (Tester._run_tests):
+        (Tester):
+        (Tester._check_imports):
+        (Tester._test_names):
+        (Tester._all_test_names):
+        * Scripts/webkitpy/test/printer.py:
+        (Printer.__init__):
+        (Printer.write_update):
+        (Printer):
+        (Printer.print_finished_test):
+        (Printer.print_result):
+        * Scripts/webkitpy/test/runner.py:
+        (unit_test_name):
+        (Runner.__init__):
+        (Runner.run):
+        (Runner.handle):
+        (_Worker.handle):
+        * Scripts/webkitpy/test/runner_unittest.py:
+        (FakeLoader.loadTestsFromName):
+        (RunnerTest.test_run):
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        Turn on tests for the mac-ews, for realz this time.
+
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+        (MacEWS):
+
+2012-08-02  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium-Android] Run layout tests on multiple devices in parallel
+        https://bugs.webkit.org/show_bug.cgi?id=92877
+
+        Reviewed by Dirk Pranke.
+
+        Moved methods that run command on a particular device from ChromiumAndroidPort to ChromiumAndroidDriver.
+        The drivers run adb commands with the '-s serial_number' parameter which specifies the device according to the work_number.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.__init__):
+        (ChromiumAndroidPort.default_child_processes): Default to the number of attached devices.
+        (ChromiumAndroidPort.test_expectations): Removed because it is unused. 
+        (ChromiumAndroidPort.setup_test_run): Most contents moved into ChromiumAndroidDriver._setup_test()
+        (ChromiumAndroidPort.clean_up_test_run): Now the http server is stopped here.
+        (ChromiumAndroidPort._get_devices):
+        (ChromiumAndroidPort._get_device_serial):
+        (ChromiumAndroidDriver):
+        (ChromiumAndroidDriver.__init__):
+        (ChromiumAndroidDriver.__del__):
+        (ChromiumAndroidDriver._setup_test): Original contents of ChromiumAndroidPort.setup_test_run().
+        (ChromiumAndroidDriver._push_executable): Moved from ChromiumAndroidPort.
+        (ChromiumAndroidDriver._push_fonts): Moved from ChromiumAndroidPort.
+        (ChromiumAndroidDriver._push_test_resources): Moved from ChromiumAndroidPort.
+        (ChromiumAndroidDriver._synchronize_datetime): Moved from ChromiumAndroidPort.
+        (ChromiumAndroidDriver._run_adb_command): Moved from ChromiumAndroidPort.
+        (ChromiumAndroidDriver._teardown_performance): Moved from ChromiumAndroidPort.
+        (ChromiumAndroidDriver._get_crash_log): Moved from ChromiumAndroidPort.
+        (ChromiumAndroidDriver.cmd_line):
+        (ChromiumAndroidDriver._file_exists_on_device):
+        (ChromiumAndroidDriver._remove_all_pipes):
+        (ChromiumAndroidDriver._start):
+        (ChromiumAndroidDriver._start_once):
+        (ChromiumAndroidDriver.stop):
+        * Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py:
+        (MockRunCommand):
+        (MockRunCommand.__init__):
+        (MockRunCommand.mock_run_command_fn):
+        (MockRunCommand.mock_no_device):
+        (MockRunCommand.mock_one_device):
+        (MockRunCommand.mock_two_devices):
+        (MockRunCommand.mock_no_tombstone_dir):
+        (MockRunCommand.mock_no_tombstone_file):
+        (MockRunCommand.mock_ten_tombstones):
+        (MockRunCommand.mock_logcat):
+        (ChromiumAndroidPortTest):
+        (ChromiumAndroidPortTest.make_port):
+        (ChromiumAndroidPortTest.test_driver_cmd_line):
+        (ChromiumAndroidPortTest.test_get_devices_no_device):
+        (ChromiumAndroidPortTest.test_get_devices_one_device):
+        (ChromiumAndroidPortTest.test_get_devices_two_devices):
+        (ChromiumAndroidPortTest.test_get_device_serial_no_device):
+        (ChromiumAndroidPortTest.test_get_device_serial_one_device):
+        (ChromiumAndroidPortTest.test_get_device_serial_two_devices):
+        (ChromiumAndroidDriverTest):
+        (ChromiumAndroidDriverTest.setUp):
+        (ChromiumAndroidDriverTest.test_get_last_stacktrace):
+        (ChromiumAndroidDriverTest.test_get_crash_log):
+        (ChromiumAndroidDriverTest.test_cmd_line):
+        (ChromiumAndroidDriverTwoDriversTest):
+        (ChromiumAndroidDriverTwoDriversTest.test_two_drivers):
+        * Scripts/webkitpy/layout_tests/port/driver.py:
+        (Driver.run_test):
+        (Driver._get_crash_log): Added to allow subclasses to override.
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (parse_args): Removed the --adb-args command-line parameter because now we select device automatically. Added --adb-device to specify devices.
+
+2012-08-02  Dinu Jacob  <dinu.jacob@nokia.com>
+
+        WebKitTestRunner needs layoutTestController.setUserStyleSheetEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=42679
+
+        Reviewed by Eric Seidel.
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl: Added 
+        setUserStyleSheetEnabled and setUserStyleSheetLocation.
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::LayoutTestController): Initialize new members added.
+        (WTR::LayoutTestController::setUserStyleSheetEnabled): Added.
+        (WTR::LayoutTestController::setUserStyleSheetLocation): Added.
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h: Added members
+        userStyleSheetEnabled, and m_userStyleSheetLocation and methods
+        setUserStyleSheetEnabled, and setUserStyleSheetLocation.
+
+2012-08-02  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: Fire speech start event at the same time as sound start event
+        https://bugs.webkit.org/show_bug.cgi?id=92971
+
+        Reviewed by Adam Barth.
+
+        Update the MockWebSpeechRecognizer to not fire "speech started" events
+        separately.
+
+        * DumpRenderTree/chromium/MockWebSpeechRecognizer.cpp:
+        (MockWebSpeechRecognizer::start):
+
+2012-08-02  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] make sometimes using a single core
+        https://bugs.webkit.org/show_bug.cgi?id=92998
+
+        Reviewed by Martin Robinson.
+
+        In the GTK 64-bit Release buildbot some builds use a single core
+        for the make process. I suspect this is because in those cases
+        nproc reports a single core available. The proposed solution is to
+        always rely on all the cores available in the machine.
+
+        * Scripts/webkitdirs.pm:
+        (determineNumberOfCPUs):
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        Re-land http://trac.webkit.org/changeset/94441 now that lforschler is ready.
+
+        This patch enables testing on the mac-ews bots.
+
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] Merge final nits to DumpRenderTree.gyp for Android
+        https://bugs.webkit.org/show_bug.cgi?id=90920
+
+        Reviewed by Tony Chang.
+
+        This patch contains the last few small changes to DumpRenderTree.gyp
+        from the chromium-android branch. After this change, this file will be
+        fully merged.
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+
+2012-08-02  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Toggle the type of ant compile for webkit_unit_tests and TestWebKitAPI
+        https://bugs.webkit.org/show_bug.cgi?id=92858
+
+        Reviewed by Adam Barth.
+
+        Now that the sdk_build variable is available, we can remove these two differences
+        as well. This goes together with Adam's bug 90920.
+
+        After this patch, the whole Tools/ directory will be unforked :-).
+
+        * TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp:
+
+2012-08-02  Zoltan Arvai  <zarvai@inf.u-szeged.hu>
+
+        [Qt] MSVC specific buildfix for DRT.
+        https://bugs.webkit.org/show_bug.cgi?id=92978
+
+        Reviewed by Simon Hausmann.
+
+        DumpRenderTree/qt subdirectory is missing from generated makefile under MSVC build, need to be added to the pro file.
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+
+2012-08-02  Alexander Shalamov  <alexander.shalamov@intel.com>
+
+        [EFL][WK2] WTR is failing when X server is not running
+        https://bugs.webkit.org/show_bug.cgi?id=92719
+
+        Reviewed by Hajime Morita.
+
+        EFL's WebKitTestRunner doesn't execute tests when X server is not running.
+        This patch fixes the problem by checking environment variable before ecore x initialization.
+
+        * Scripts/webkitpy/layout_tests/port/efl.py:
+        (EflPort.setup_environ_for_server):
+        * WebKitTestRunner/efl/main.cpp:
+        (main):
+
+2012-08-01  Dirk Pranke  <dpranke@chromium.org>
+
+        REGRESSION(r123893): Reftest mismatches are run through ImageDiff with 0.1 tolerance
+        https://bugs.webkit.org/show_bug.cgi?id=92847
+
+        Reviewed by Ojan Vafai.
+
+        I was failing to distinguish between 'None' and 0 :(. Fixed and added tests.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.diff_image):
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        (PortTestCase.test_diff_image.make_proc):
+        (PortTestCase.test_diff_image):
+
+2012-08-01  Dirk Pranke  <dpranke@chromium.org>
+
+        test-webkitpy: clean up handling of tests to skip
+        https://bugs.webkit.org/show_bug.cgi?id=92909
+
+        Reviewed by Ryosuke Niwa.
+
+        This change moves the handling of tests to skip into main.py
+        where it is at least slightly more findable and generic.
+
+        Also fix a couple of lint nits.
+
+        * Scripts/webkitpy/test/finder.py:
+        (Finder.__init__):
+        (Finder.skip):
+        (Finder._default_names):
+        * Scripts/webkitpy/test/main.py:
+        (main):
+        (Tester.skip):
+        * Scripts/webkitpy/test/main_unittest.py:
+        (TesterTest.test_no_tests_found):
+        * Scripts/webkitpy/test/runner_unittest.py:
+
+2012-08-01  Dirk Pranke  <dpranke@chromium.org>
+
+        test-webkitpy: remove --skip-integrationtests flag
+        https://bugs.webkit.org/show_bug.cgi?id=92907
+
+        Reviewed by Ryosuke Niwa.
+
+        This flag is no longer used since the tests complete quickly.
+        
+        Also clean up the unused skip_if_parallel arg in finder, and
+        make a couple of lint fixes.
+
+        * Scripts/webkitpy/test/finder.py:
+        (Finder.find_names):
+        (Finder._default_names):
+        * Scripts/webkitpy/test/finder_unittest.py:
+        (FinderTest.check_names):
+        (FinderTest.test_default_names):
+        * Scripts/webkitpy/test/main.py:
+        (Tester._parse_args):
+        (Tester.run):
+        * Scripts/webkitpy/test/main_unittest.py:
+        (TesterTest.test_no_tests_found):
+
+2012-08-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Generalize SheriffIRCBot to prepare for PerfBot
+        https://bugs.webkit.org/show_bug.cgi?id=92912
+
+        Reviewed by Adam Barth.
+
+        Renamed SheriffIRCBot to IRCBot and generalized to support non-sheriffbot IRC bot in the future.
+        This will be useful when I add an experimental perf EWS IRC bot.
+
+        * Scripts/webkitpy/tool/bot/irc_command.py:
+        (Whois.execute):
+        * Scripts/webkitpy/tool/bot/irc_command_unittest.py:
+        (IRCCommandTest):
+        * Scripts/webkitpy/tool/bot/ircbot.py: Moved from Tools/Scripts/webkitpy/tool/bot/sheriffircbot.py.
+        (Eliza): Moved from irc_command.
+        (Eliza.__init__):
+        (Eliza.execute):
+        (IRCBot):
+        (IRCBot.__init__):
+        (IRCBot.irc_delegate):
+        (IRCBot._parse_command_and_args):
+        (IRCBot.process_message):
+        * Scripts/webkitpy/tool/bot/ircbot_unittest.py: Moved from Tools/Scripts/webkitpy/tool/bot/sheriffircbot_unittest.py.
+        (run):
+        (IRCBotTest):
+        (IRCBotTest.test_eliza): Moved from IRCCommandTest.
+        (IRCBotTest.test_parse_command_and_args):
+        (IRCBotTest.test_exception_during_command):
+        * Scripts/webkitpy/tool/bot/sheriffircbot.py: Removed.
+        * Scripts/webkitpy/tool/bot/sheriffircbot_unittest.py: Removed.
+        * Scripts/webkitpy/tool/commands/sheriffbot.py:
+        (SheriffBot.begin_work_queue):
+        * Scripts/webkitpy/webkitpy.pyproj:
+
+2012-08-01  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: reenable the test for --verbose working in child processes
+        https://bugs.webkit.org/show_bug.cgi?id=92894
+
+        Reviewed by Ryosuke Niwa.
+
+        This change rewrites the test to not use outputcapture, meaning
+        that the MockHost can propagate to Worker properly and things
+        work again :).
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.test_verbose_in_child_processes):
+
+2012-08-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        run-perf-tests --build-directory doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=92051
+
+        Reviewed by Dirk Pranke.
+
+        The bug was caused by not prepending build_directory even when one is defined.
+        Fixed that.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port._build_path):
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        (PortTest.test_build_path):
+
+2012-08-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123865.
+        http://trac.webkit.org/changeset/123865
+        https://bugs.webkit.org/show_bug.cgi?id=92891
+
+        This patch is causing the style-queue to fall behind
+        (Requested by abarth on #webkit).
+
+        * Scripts/webkitpy/tool/commands/queues.py:
+        (AbstractReviewQueue.begin_work_queue):
+        (StyleQueue.__init__):
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+        (StyleQueueTest.test_style_queue_with_style_exception):
+        (test_style_queue_with_watch_list_exception):
+
+2012-08-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        run-perf-tests throws an exception when the output json is malformed
+        https://bugs.webkit.org/show_bug.cgi?id=92887
+
+        Reviewed by Dirk Pranke.
+
+        Catch exceptions and gracefully fail. Also split _generate_json into smaller methods.
+
+        * Scripts/webkitpy/performance_tests/perftestsrunner.py:
+        (PerfTestsRunner):
+        (PerfTestsRunner.run):
+        (PerfTestsRunner._generate_output): Extracted from _generate_json.
+        (PerfTestsRunner._merge_source_json): Ditto; catch all exceptions since they are too many
+        exceptions to consder here.
+        (PerfTestsRunner._merge_outputs): Ditto.
+        (PerfTestsRunner._generate_output_files): Extracted from _generate_json.
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py:
+        (_test_run_with_json_output): Don't assert logs when we except an non-zero exit code.
+        (create_runner_and_setup_results_template): Extracted from test_run_generates_results_page.
+        (test_run_generates_results_page):
+        (test_run_with_bad_output_json): Added.
+        (test_run_with_bad_json_source): Added.
+        (test_run_with_upload_json):
+
+2012-08-01  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Regression(r124135): nrwt: --verbose logging does not work right on windows
+        https://bugs.webkit.org/show_bug.cgi?id=92845
+
+        Reviewed by Dirk Pranke.
+
+        Disabled the failing test. The Workers spawned by this test are using Host()
+        instead of MockHost() and trying to access the real filesystem instead of the
+        MockFilesytem.
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.disabled_test_verbose):
+
+2012-08-01  Arnaud Renevier  <a.renevier@sisa.samsung.com>
+
+        keyring.get_password may raise an exception.
+        https://bugs.webkit.org/show_bug.cgi?id=92876
+
+        Reviewed by Dirk Pranke.
+
+        keyring.get_password sometimes raises an exception. We wrap this call,
+        and also set_password to avoid breaking webkit-patch in that case.
+
+        * Scripts/webkitpy/common/net/credentials.py:
+        (Credentials._offer_to_store_credentials_in_keyring):
+        (Credentials.read_credentials):
+
+2012-08-01  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Layout Test fast/text/descent-clip-in-scaled-page.html is failing on linux since it was added
+        https://bugs.webkit.org/show_bug.cgi?id=91386
+
+        Reviewed by Tony Chang.
+
+        Added font mapping from SubpixelPositioningAhem to Ahem on Linux and Android
+        (used in layout test fast/text/descent-clip-in-scaled-page.html).
+        Added font mapping from SubpixelPositioning to Times New Roman on Android to match Linux
+        (used in platform/chromium-linux/fast/text/chromium-linux-text-subpixel-positioning.html)
+
+        * DumpRenderTree/chromium/android_main_fonts.xml:
+        * DumpRenderTree/chromium/fonts.conf:
+
+2012-08-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124325.
+        http://trac.webkit.org/changeset/124325
+        https://bugs.webkit.org/show_bug.cgi?id=92865
+
+        broke android build (Requested by mnaganov on #webkit).
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+
+2012-08-01  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL] Dump a backtrace in case of a crash on the UIProcess
+        https://bugs.webkit.org/show_bug.cgi?id=92843
+
+        Reviewed by Csaba Osztrogonác.
+
+        We are already dumping the backtraces when automated tests are
+        crashing, but only for the WebProcess. This patch adds the same
+        hooks for the UIProcess.
+
+        * TestWebKitAPI/efl/main.cpp:
+        (main):
+        * WebKitTestRunner/efl/main.cpp:
+        (main):
+
+2012-08-01  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] Merge final nits to DumpRenderTree.gyp for Android
+        https://bugs.webkit.org/show_bug.cgi?id=90920
+
+        Reviewed by Tony Chang.
+
+        This patch contains the last few small changes to DumpRenderTree.gyp
+        from the chromium-android branch. After this change, this file will be
+        fully merged.
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+
+2012-08-01  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] ImageDiff should use float division instead of integer
+        https://bugs.webkit.org/show_bug.cgi?id=92859
+
+        Reviewed by Zoltan Herczeg.
+
+        * DumpRenderTree/qt/ImageDiff.cpp:
+        (main):
+
+2012-08-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124313.
+        http://trac.webkit.org/changeset/124313
+        https://bugs.webkit.org/show_bug.cgi?id=92855
+
+        Compilation failed on Chromium ports (Requested by yosin on
+        #webkit).
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/DumpRenderTree.h:
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/DumpRenderTreeCommon.cpp: Removed.
+        * DumpRenderTree/chromium/DumpRenderTree.cpp:
+        (runTest):
+        (main):
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+        (TestShell::runFileTest):
+        (TestShell::dump):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestParams):
+        (TestParams::TestParams):
+        (TestShell):
+        * DumpRenderTree/efl/CMakeLists.txt:
+        * DumpRenderTree/efl/DumpRenderTree.cpp:
+        (parseCommandLineOptions):
+        (getFinalTestURL):
+        (getExpectedPixelHash):
+        (runTest):
+        (shouldDumpPixelsAndCompareWithExpected):
+        (main):
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (initializeGlobalsFromCommandLineOptions):
+        (dump):
+        (runTest):
+        (main):
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (initializeGlobalsFromCommandLineOptions):
+        (dumpRenderTree):
+        (dump):
+        (runTest):
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::processLine):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (dump):
+        (runTest):
+        (dllLauncherEntryPoint):
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        * DumpRenderTree/wscript:
+        * DumpRenderTree/wx/DumpRenderTreeWx.cpp:
+        (dump):
+        (runTest):
+        (MyApp::OnInit):
+        * GNUmakefile.am:
+        * Scripts/old-run-webkit-tests:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.supports_switching_pixel_tests_per_test):
+        (Port):
+        (Port._supports_switching_pixel_tests_per_test):
+        (Port.should_run_as_pixel_test):
+        * Scripts/webkitpy/layout_tests/port/driver.py:
+        (Driver.cmd_line):
+        (Driver._command_from_driver_input):
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort._supports_switching_pixel_tests_per_test):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        (TestPort.supports_switching_pixel_tests_per_test):
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::TestController):
+        (WTR::TestController::initialize):
+        (WTR::TestController::runTest):
+        * WebKitTestRunner/TestController.h:
+        (TestController):
+
+2012-08-01  Balazs Kelemen  <kbalazs@webkit.org>
+
+        All ports should support per test switching of pixel testing
+        https://bugs.webkit.org/show_bug.cgi?id=92398
+
+        Reviewed by Dirk Pranke.
+
+        Teach all test drivers to accept a per test control of whether
+        to dump pixels. Drivers now accept a -p/--pixel-test argument
+        on the standart input that means that running the current
+        test as pixel test is allowed (even if the expected hash is
+        missing). Removed the --pixel-tests command line option since
+        there is no need for it anymore.
+
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/DumpRenderTree.h:
+        (TestCommand::TestCommand):
+        (TestCommand):
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/DumpRenderTreeCommon.cpp: Added.
+        (CommandTokenizer):
+        (CommandTokenizer::CommandTokenizer):
+        (CommandTokenizer::pump):
+        (CommandTokenizer::next):
+        (CommandTokenizer::hasNext):
+        (die):
+        (parseInputLine):
+        Common logic to parse the input line from the standard input (or from the command line
+        in standalone mode). Made it somewhat general so we can easily add more arguments if
+        there is a need.
+        * DumpRenderTree/chromium/DumpRenderTree.cpp:
+        (runTest):
+        (main):
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+        (TestShell::runFileTest):
+        (TestShell::dump):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestParams::TestParams):
+        (TestShell):
+        * DumpRenderTree/efl/CMakeLists.txt:
+        * DumpRenderTree/efl/DumpRenderTree.cpp:
+        (parseCommandLineOptions):
+        (runTest):
+        (shouldDumpPixelsAndCompareWithExpected):
+        (main):
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (initializeGlobalsFromCommandLineOptions):
+        (dump):
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (initializeGlobalsFromCommandLineOptions):
+        (dumpRenderTree):
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::processLine):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (dump):
+        (runTest):
+        (dllLauncherEntryPoint):
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        * DumpRenderTree/wscript:
+        * DumpRenderTree/wx/DumpRenderTreeWx.cpp:
+        (dump):
+        (runTest):
+        (MyApp::OnInit):
+        * Scripts/old-run-webkit-tests: Pass --pixel-test before the hash.
+        Changed the separator form ' to : because it don't need to be escaped
+        when passing manually on the comand line.
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.should_run_as_pixel_test): Removed now that all ports supports it.
+        * Scripts/webkitpy/layout_tests/port/driver.py:
+        (Driver.cmd_line): Don't pass --pixel-tests anymore.
+        (Driver._command_from_driver_input):
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::TestController):
+        (WTR::TestController::initialize):
+        (WTR::TestCommand::TestCommand):
+        (TestCommand):
+        (WTR):
+        (CommandTokenizer):
+        (WTR::CommandTokenizer::CommandTokenizer):
+        (WTR::CommandTokenizer::pump):
+        (WTR::CommandTokenizer::next):
+        (WTR::CommandTokenizer::hasNext):
+        (WTR::die):
+        (WTR::parseInputLine):
+        (WTR::TestController::runTest):
+        * WebKitTestRunner/TestController.h:
+        (TestController):
+        Duplicate the logic for parsing the command line because
+        unfortunately there is no way to share code between
+        WebKitTestRunner and DumpRenderTree.
+
+2012-08-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Add the jhbuild source directory to the __builtin__ object
+
+        Reviewed by Philippe Normand.
+
+        It seems that the jhbuild script explicitly looks for the SRCDIR __builtin__ when
+        initializing. This is necessary for loading the jhbuild from the checkout directory.
+
+        * jhbuild/jhbuildutils.py:
+        (enter_jhbuild_environment_if_available): Set SRCDIR to the source directory.
+
+2012-07-31  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: move actual test-running code into layout_test_runner.py
+        https://bugs.webkit.org/show_bug.cgi?id=92806
+
+        Reviewed by Ryosuke Niwa.
+
+        This is the final patch in manager-refactoring series (for now).
+        This moves all of the logic to actually run the tests into
+        layout_test_runner (in a new LayoutTestRunner) class. Now
+        the mechanics of actually executing all of  the tests are
+        contained in one file (of course the actual work of talking to
+        DRT/WTR and diff'ing the results is still in single_test_runner).
+
+        Now manager is left with setting up and tearing down the test
+        environment, finding the tests to run, and processing the
+        results of the tests, which is a pretty managable amount of code
+        (no pun intended).
+
+        The unit tests for manager were split in two and all of the
+        runner-specific tests moved into layout_test_runner_unittest.
+        They were significantly cleaned up to be easier to read and
+        maintain as a part of this.
+
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py:
+        (TestRunInterruptedException):
+        (TestRunInterruptedException.__init__):
+        (TestRunInterruptedException.__reduce__):
+        (LayoutTestRunner):
+        (LayoutTestRunner.__init__):
+        (LayoutTestRunner.test_key):
+        (LayoutTestRunner.run_tests):
+        (LayoutTestRunner.run_tests.worker_factory):
+        (LayoutTestRunner.run_tests.instead):
+        (LayoutTestRunner._mark_interrupted_tests_as_skipped):
+        (LayoutTestRunner._interrupt_if_at_failure_limits):
+        (LayoutTestRunner._interrupt_if_at_failure_limits.interrupt_if_at_failure_limit):
+        (LayoutTestRunner._update_summary_with_result):
+        (LayoutTestRunner.start_servers_with_lock):
+        (LayoutTestRunner.stop_servers_with_lock):
+        (LayoutTestRunner.handle):
+        (LayoutTestRunner._handle_started_test):
+        (LayoutTestRunner._handle_finished_test_list):
+        (LayoutTestRunner._handle_finished_test_list.find):
+        (LayoutTestRunner._handle_finished_test):
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_runner_unittest.py:
+        (FakePrinter):
+        (FakePrinter.print_workers_and_shards):
+        (FakePrinter.print_finished_test):
+        (FakePrinter.write):
+        (FakePrinter.write_update):
+        (FakePrinter.flush):
+        (LockCheckingRunner):
+        (LockCheckingRunner.__init__):
+        (LockCheckingRunner.handle_finished_list):
+        (LayoutTestRunnerTests):
+        (LayoutTestRunnerTests._runner):
+        (LayoutTestRunnerTests._result_summary):
+        (LayoutTestRunnerTests._run_tests):
+        (LayoutTestRunnerTests.test_http_locking):
+        (LayoutTestRunnerTests.test_perf_locking):
+        (LayoutTestRunnerTests.test_interrupt_if_at_failure_limits):
+        (LayoutTestRunnerTests.test_update_summary_with_result):
+        (LayoutTestRunnerTests.test_servers_started):
+        (LayoutTestRunnerTests.test_servers_started.start_http_server):
+        (LayoutTestRunnerTests.test_servers_started.start_websocket_server):
+        (LayoutTestRunnerTests.test_servers_started.stop_http_server):
+        (LayoutTestRunnerTests.test_servers_started.stop_websocket_server):
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (summarize_results):
+        (Manager.__init__):
+        (Manager._is_http_test):
+        (Manager):
+        (Manager._is_websocket_test):
+        (Manager._websocket_tests):
+        (Manager._prepare_lists):
+        (Manager._is_ref_test):
+        (Manager.run):
+        (Manager._run_tests):
+        (Manager._look_for_new_crash_logs):
+        (Manager._show_results_html_file):
+        * Scripts/webkitpy/layout_tests/controllers/manager_unittest.py:
+        (ManagerTest.test_look_for_new_crash_logs):
+        (ResultSummaryTest.summarized_results):
+        (ResultSummaryTest.test_summarized_results_wontfix):
+
+2012-07-31  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: move sharding logic into layout_test_runner.py
+        https://bugs.webkit.org/show_bug.cgi?id=92805
+
+        Reviewed by Ryosuke Niwa.
+
+        The sharding logic is specific to how we actually run the tests,
+        so it belongs in this file instead of manager.py or finder.py.
+
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py:
+        (Worker._run_single_test):
+        (TestShard):
+        (TestShard.__init__):
+        (TestShard.__repr__):
+        (TestShard.__eq__):
+        (Sharder):
+        (Sharder.__init__):
+        (Sharder.shard_tests):
+        (Sharder.shard_tests.or):
+        (Sharder._shard_in_two):
+        (Sharder._shard_every_file):
+        (Sharder._shard_by_directory):
+        (Sharder._resize_shards):
+        (Sharder._resize_shards.divide_and_round_up):
+        (Sharder._resize_shards.extract_and_flatten):
+        (Sharder._resize_shards.split_at):
+        (Sharder._dir_for_test_input):
+        (Sharder.test_key):
+        (Sharder.natural_sort_key):
+        (Sharder.natural_sort_key.tryint):
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_runner_unittest.py: Added.
+        (SharderTests):
+        (SharderTests.get_test_input):
+        (SharderTests.get_shards):
+        (SharderTests.get_shards.split):
+        (SharderTests.assert_shards):
+        (SharderTests.test_shard_by_dir):
+        (SharderTests.test_shard_by_dir_sharding_ref_tests):
+        (SharderTests.test_shard_every_file):
+        (SharderTests.test_shard_in_two):
+        (SharderTests.test_shard_in_two_sharding_ref_tests):
+        (SharderTests.test_shard_in_two_has_no_locked_shards):
+        (SharderTests.test_shard_in_two_has_no_unlocked_shards):
+        (SharderTests.test_multiple_locked_shards):
+        (NaturalCompareTest):
+        (NaturalCompareTest.assert_cmp):
+        (NaturalCompareTest.test_natural_compare):
+        (KeyCompareTest):
+        (KeyCompareTest.setUp):
+        (KeyCompareTest.setUp.split):
+        (KeyCompareTest.assert_cmp):
+        (KeyCompareTest.test_test_key):
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager.__init__):
+        (Manager._prepare_lists):
+        (Manager._is_ref_test):
+        (Manager._run_tests):
+        (Manager._handle_finished_test):
+        * Scripts/webkitpy/layout_tests/controllers/manager_unittest.py:
+        (ManagerTest.get_options):
+        (ManagerTest.test_interrupt_if_at_failure_limits):
+        (ManagerTest.test_update_summary_with_result):
+        (ManagerTest.test_needs_servers.get_manager_with_tests):
+        (ManagerTest.integration_test_needs_servers.get_manager_with_tests):
+        (ManagerTest.test_look_for_new_crash_logs.get_manager_with_tests):
+        (ManagerTest.test_servers_started):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (parse_args):
+
+2012-07-31  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: rename worker.py to layout_test_runner.py
+        https://bugs.webkit.org/show_bug.cgi?id=92804
+
+        Reviewed by Ojan Vafai.
+
+        Home stretch of this round of manager refactoring ... I will be
+        moving all of the actual test-running code (which includes the
+        code that shards the tests for the workers) into a different
+        module, and it makes sense for that module to contain the actual
+        worker code, so I'm renaming worker.py to layout_test_runner.py.
+
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py: Renamed from Tools/Scripts/webkitpy/layout_tests/controllers/worker.py.
+        (Worker):
+        (Worker.__init__):
+        (Worker.__del__):
+        (Worker.start):
+        (Worker.handle):
+        (Worker._update_test_input):
+        (Worker._run_test):
+        (Worker.stop):
+        (Worker._timeout):
+        (Worker._kill_driver):
+        (Worker._run_test_with_timeout):
+        (Worker._clean_up_after_test):
+        (Worker._run_test_in_another_thread):
+        (Worker._run_test_in_another_thread.SingleTestThread):
+        (Worker._run_test_in_another_thread.SingleTestThread.__init__):
+        (Worker._run_test_in_another_thread.SingleTestThread.run):
+        (Worker._run_test_in_this_thread):
+        (Worker._run_single_test):
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._run_tests.worker_factory):
+
+2012-07-31  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: clean up names in sharding code
+        https://bugs.webkit.org/show_bug.cgi?id=92785
+
+        Reviewed by Ryosuke Niwa.
+
+        More refactoring ... this makes the methods use TestInputs
+        consistently (and updates the names accordingly) and improves
+        encapsulation a bit. The sharding code is now pretty
+        self-contained.
+
+        This change adds no new functionality and is covered by the
+        existing (updated) tests.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (TestShard.visible.__init__):
+        (TestShard.visible.__repr__):
+        (Manager._dir_for_test_input):
+        (Manager._shard_tests):
+        (Manager._shard_in_two):
+        (Manager._shard_every_file):
+        (Manager._shard_by_directory):
+        (Manager._run_tests):
+        * Scripts/webkitpy/layout_tests/controllers/manager_unittest.py:
+        (ManagerWrapper._test_input_for_file):
+        (ShardingTests.get_shards):
+        * Scripts/webkitpy/layout_tests/models/test_input.py:
+        (TestInput.__init__):
+        (TestInput.__repr__):
+
+2012-07-31  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: clean up TestInputs in preparation for cleaning up sharding
+        https://bugs.webkit.org/show_bug.cgi?id=92784
+
+        Reviewed by Ryosuke Niwa.
+
+        Currently, in order to shard the tests you need to refer to
+        state in the manager as well as the state in the TestInputs;
+        this change embeds the necessary state into the TestInputs so
+        sharding them can be a standalone operation.
+
+        The actual clean up of the sharding will follow in a subsequent patch.
+
+        Covered by existing tests; no new functionality. However, I did
+        rework the sharding tests to be less dependent on the test
+        scaffolding and easier to follow.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._test_input_for_file):
+        (Manager._shard_in_two):
+        (Manager._shard_every_file):
+        (Manager._shard_by_directory):
+        * Scripts/webkitpy/layout_tests/controllers/manager_unittest.py:
+        (ManagerWrapper._test_input_for_file):
+        (ShardingTests.assert_shards):
+        (ShardingTests.test_shard_by_dir):
+        (ShardingTests.test_shard_by_dir_sharding_ref_tests):
+        (ShardingTests.test_shard_every_file):
+        (ShardingTests.test_shard_in_two):
+        (ShardingTests.test_shard_in_two_sharding_ref_tests):
+        (ShardingTests.test_shard_in_two_has_no_unlocked_shards):
+        (ShardingTests.test_multiple_locked_shards):
+        * Scripts/webkitpy/layout_tests/models/test_input.py:
+        (TestInput.__init__):
+        (TestInput.__repr__):
+
+2012-07-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL] Dump a backtrace in case of a crash
+        https://bugs.webkit.org/show_bug.cgi?id=92489
+
+        Reviewed by Csaba Osztrogonác.
+
+        Dump a stack trace in case of a unexpected signal. This should
+        provide a better report at the build bots when WTR crashes.
+
+        * DumpRenderTree/efl/DumpRenderTree.cpp:
+        (main):
+        * TestWebKitAPI/efl/InjectedBundleController.cpp:
+        (TestWebKitAPI::InjectedBundleController::platformInitialize):
+        * WebKitTestRunner/InjectedBundle/efl/InjectedBundleEfl.cpp:
+        (WTR::InjectedBundle::platformInitialize):
+
+2012-07-31  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [BlackBerry] Enable CSS Filter Effects
+        https://bugs.webkit.org/show_bug.cgi?id=92685
+
+        Reviewed by Rob Buis.
+
+        Enable CSS filter effects, with the exception of custom effects (CSS shaders) and reference effects (SVG effects)
+
+        Internally reviewed by Arvid Nilsson <anilsson@rim.com> and Antonio Gomes <agomes@rim.com>.
+
+        * Scripts/webkitperl/FeatureList.pm: Acknowledge CSS filter effects.
+
+2012-07-31  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: clean up prepare_lists_and_print_output, run, set_up_run a bit
+        https://bugs.webkit.org/show_bug.cgi?id=92781
+
+        Reviewed by Ryosuke Niwa.
+
+        More refactoring ... rename prepare_lists_and_print_output to
+        just prepare_lists so that it only has a single purpose, and
+        clean up the surrounding code a bit as well.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._collect_tests):
+        (Manager._prepare_lists):
+        (Manager._set_up_run):
+        (Manager.run):
+
+2012-07-31  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: clean up self._test_files_list vs. self._test_files, other nits
+        https://bugs.webkit.org/show_bug.cgi?id=92702
+
+        Reviewed by Ojan Vafai.
+
+        Get rid of self._test_files, rename self._test_files_list to
+        self._test_names (removing the confusion between the two fields).
+
+        Also inline the one call to _parse_expectations, remove the one
+        use of more_tests_to_skip, and fix a couple of minor nits.
+
+        * Scripts/webkitpy/layout_tests/controllers/finder.py:
+        (LayoutTestFinder.split_into_chunks):
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager.__init__):
+        (Manager._collect_tests):
+        (Manager._http_tests):
+        (Manager._websocket_tests):
+        (Manager._is_perf_test):
+        (Manager.prepare_lists_and_print_output):
+        (Manager.needs_servers):
+        (Manager.run):
+        (Manager._mark_interrupted_tests_as_skipped):
+        (Manager._update_summary_with_result):
+        (Manager._upload_json_files):
+        * Scripts/webkitpy/layout_tests/controllers/manager_unittest.py:
+        (ManagerTest.test_interrupt_if_at_failure_limits):
+        (ManagerTest.test_needs_servers.get_manager_with_tests):
+        (ManagerTest.test_servers_started):
+
+2012-07-31  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: --verbose logging does not work right on windows
+        https://bugs.webkit.org/show_bug.cgi?id=92673
+
+        Reviewed by Ojan Vafai.
+
+        Add a test for r124090.
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.test_verbose):
+
+2012-07-31  Dirk Pranke  <dpranke@chromium.org>
+
+        REGRESSION(124116): Number of skipped tests isn't printed anymore
+        https://bugs.webkit.org/show_bug.cgi?id=92736
+
+        Reviewed by Tony Chang.
+
+        Add the skipped number back in; it was useful ... also clean up
+        the formatting a little bit.
+
+        * Scripts/webkitpy/layout_tests/views/printing.py:
+        (Printer.print_found):
+
+2012-07-31  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: Throw exception for start() when already started
+        https://bugs.webkit.org/show_bug.cgi?id=92756
+
+        Reviewed by Adam Barth.
+
+        Fix the task queue in MockWebSpeechRecognizer.
+        It's important that we remove the task from the queue before we run
+        it, as running the task could alter the queue's state.
+
+        * DumpRenderTree/chromium/MockWebSpeechRecognizer.cpp:
+        (MockWebSpeechRecognizer::abort):
+        (MockWebSpeechRecognizer::setError):
+        (MockWebSpeechRecognizer::clearTaskQueue):
+        (MockWebSpeechRecognizer::StepTask::runIfValid):
+        * DumpRenderTree/chromium/MockWebSpeechRecognizer.h:
+        (MockWebSpeechRecognizer):
+
+2012-07-31  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: move handling the initial list of tests to skip to finder
+        https://bugs.webkit.org/show_bug.cgi?id=92701
+
+        Reviewed by Ryosuke Niwa.
+
+        More refactoring of manager ...
+
+        * Scripts/webkitpy/layout_tests/controllers/finder.py:
+        (LayoutTestFinder.skip_tests):
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._collect_tests):
+        (Manager.prepare_lists_and_print_output):
+
+2012-07-31  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] Kill the concept of secondary shared process
+        https://bugs.webkit.org/show_bug.cgi?id=92676
+
+        Reviewed by Sam Weinig.
+
+        * MiniBrowser/win/BrowserView.cpp: (BrowserView::create): Update Windows build fix.
+        Don't create a new context for every view.
+
+2012-07-31  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Don't use ninja for building Chromium for Android
+        https://bugs.webkit.org/show_bug.cgi?id=92764
+
+        Reviewed by Adam Barth.
+
+        When Ninja projects files are generated (which will be done for Android),
+        make sure that the Android builder doesn't unintentionally switch to
+        using Ninja. We should make that switch at a predetermined time.
+
+        * Scripts/webkitdirs.pm:
+        (buildChromium):
+
+2012-07-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Add a mechanism to dump the stack trace in case of a crash
+        https://bugs.webkit.org/show_bug.cgi?id=92666
+
+        Reviewed by Csaba Osztrogonác.
+
+        Move crash signal handlers to WTFInstallReportBacktraceOnCrashHook()
+        and eliminate some duplicated code.
+
+        * DumpRenderTree/qt/main.cpp:
+        (main):
+        * WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp:
+        (WTR::InjectedBundle::platformInitialize):
+
+2012-07-31  Jochen Eisinger  <jochen@chromium.org>
+
+        [chromium] move EventSender into TestRunner.a
+        https://bugs.webkit.org/show_bug.cgi?id=92277
+
+        Reviewed by Adam Barth.
+
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+        * DumpRenderTree/chromium/TestRunner/EventSender.cpp: Renamed from Tools/DumpRenderTree/chromium/EventSender.cpp.
+        * DumpRenderTree/chromium/TestRunner/EventSender.h: Renamed from Tools/DumpRenderTree/chromium/EventSender.h.
+        * DumpRenderTree/chromium/TestRunner/TestInterfaces.cpp:
+        (TestInterfaces::Internal::eventSender):
+        (TestInterfaces::Internal):
+        (TestInterfaces::Internal::Internal):
+        (TestInterfaces::Internal::~Internal):
+        (TestInterfaces::Internal::setWebView):
+        (TestInterfaces::Internal::setDelegate):
+        (TestInterfaces::Internal::bindTo):
+        (TestInterfaces::Internal::resetAll):
+        (TestInterfaces::eventSender):
+        * DumpRenderTree/chromium/TestRunner/TestInterfaces.h:
+        (TestInterfaces):
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::initialize):
+        (TestShell::createMainWindow):
+        (TestShell::~TestShell):
+        (TestShell::resetTestController):
+        (TestShell::bindJSObjectsToWindow):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestShell::eventSender):
+        (TestShell):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+
+2012-07-31  Jochen Eisinger  <jochen@chromium.org>
+
+        Unreviewed. Update watchlist
+
+        * Scripts/webkitpy/common/config/watchlist: Turned out to be less useful than I had hoped
+
+2012-07-31  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, update watchlist
+
+        * Scripts/webkitpy/common/config/watchlist:
+        - Improve "Forms" filename pattern.
+        - tkent stops watching Chromium DRT. It was not so helpful.
+
+2012-07-31  Martin Robinson  <mrobinson@igalia.com>
+
+        [jhbuild] Also try to load jhbuild Python module from the source checkout
+
+        Reviewed by Philippe Normand.
+
+        JHBuild also seems to have an installation mode where it prefers to load its
+        Python modules from the source checkout. This seems to be used particularly
+        on the GTK+ 64-bit release bot. We should fall back to this mode.
+
+        * jhbuild/jhbuildutils.py:
+        (enter_jhbuild_environment_if_available): Use the source checkout if there
+        is no installation path.
+
+2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Revert r124153 and land the "right" build fix per ap's comment on the bug 92676.
+
+        * MiniBrowser/win/BrowserView.cpp:
+        (BrowserView::create):
+
+2012-07-30  Sam Weinig  <sam@webkit.org>
+
+        Rename WebKit2.h to WebKit2_C.h
+        https://bugs.webkit.org/show_bug.cgi?id=92704
+
+        Reviewed by Dan Bernstein.
+
+        * MiniBrowser/mac/MiniBrowser_Prefix.pch:
+        * MiniBrowser/win/BrowserView.h:
+        * TestWebKitAPI/config.h:
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        * WebKitTestRunner/WebKitTestRunnerPrefix.h:
+        * WebKitTestRunner/config.h:
+        Update for changed header file name.
+
+2012-07-30  Dirk Pranke  <dpranke@chromium.org>
+
+        chromium win compile broken after removing webkit.py
+        https://bugs.webkit.org/show_bug.cgi?id=92549
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove the stub file for webkit.py now that it's no longer
+        necessary.
+
+        * Scripts/webkitpy/layout_tests/port/webkit.py: Removed.
+
+2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Windows build fix attempt after r124092.
+
+        * MiniBrowser/win/BrowserView.cpp:
+        (BrowserView::create):
+
+2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove erroneously committed debugging print call from a test.
+
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py:
+        (test_run_generates_results_page):
+
+2012-07-30  Arnaud Renevier  <a.renevier@sisa.samsung.com>
+
+        webkit-patch: system keyring is not used to read my password
+        https://bugs.webkit.org/show_bug.cgi?id=92532
+
+        Reviewed by Dirk Pranke.
+
+        In case no username can be fetched from environment, git or keychain,
+        prompt for username, and try to get password from keyring associated
+        with that username.
+
+        * Scripts/webkitpy/common/net/credentials.py:
+        (Credentials.read_credentials):
+        * Scripts/webkitpy/common/net/credentials_unittest.py:
+        (test_keyring_without_git_repo_nor_keychain):
+        (test_keyring_without_git_repo_nor_keychain.MockKeyring):
+        (test_keyring_without_git_repo_nor_keychain.MockKeyring.get_password):
+        (test_keyring_without_git_repo_nor_keychain.FakeCredentials):
+        (test_keyring_without_git_repo_nor_keychain.FakeCredentials._credentials_from_keychain):
+        (test_keyring_without_git_repo_nor_keychain.FakeCredentials._credentials_from_environment):
+        (test_keyring_without_git_repo_nor_keychain.FakeUser):
+        (test_keyring_without_git_repo_nor_keychain.FakeUser.prompt):
+        (test_keyring_without_git_repo_nor_keychain.FakeUser.prompt_password):
+
+2012-07-30  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: move the code that identifies the chunk of tests to run into finder
+        https://bugs.webkit.org/show_bug.cgi?id=92694
+
+        Reviewed by Ryosuke Niwa.
+
+        Another patch to make manager.py smaller and clearer; this patch moves
+        the handling of breaking the list of tests into chunks (--run-part,
+        --run-chunk) from manager.py to finder.py.
+
+        There are no functional changes and this is covered by existing tests.
+
+        * Scripts/webkitpy/layout_tests/controllers/finder.py:
+        (Finder.__init__):
+        (Finder._read_test_files):
+        (Finder):
+        (Finder.split_into_chunks_if_necessary):
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager.__init__):
+        (Manager._collect_tests):
+        (Manager._parse_expectations):
+        (Manager.prepare_lists_and_print_output):
+
+2012-07-30  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: split test-finding code out from manager.py
+        https://bugs.webkit.org/show_bug.cgi?id=92693
+
+        Reviewed by Ryosuke Niwa.
+
+        In the interest of making manager.py smaller, this patch moves
+        the code that actually takes the command line arguments and
+        --test-file lists of tests to run and expands them into an
+        actual list of tests out into a separate module.
+
+        * Scripts/webkitpy/layout_tests/controllers/finder.py: Added.
+        (LayoutTestFinder):
+        (LayoutTestFinder.__init__):
+        (LayoutTestFinder.find_tests):
+        (LayoutTestFinder._strip_test_dir_prefixes):
+        (LayoutTestFinder._strip_test_dir_prefix):
+        (LayoutTestFinder._read_test_names_from_file):
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._collect_tests):
+        (Manager._handle_finished_test):
+        * Scripts/webkitpy/layout_tests/models/test_expectations.py:
+        (strip_comments):
+
+2012-07-30  Adam Barth  <abarth@webkit.org>
+
+        commit-queue is corrupting ChangeLogs
+        https://bugs.webkit.org/show_bug.cgi?id=92681
+
+        Reviewed by Tony Chang.
+
+        Some commits made with the commit-queue are ending up with duplicate
+        ChangeLog entries. I've hot-patched the servers to not use a special
+        merge driver for ChangeLogs, which should fix this issue. This patch
+        removes the merge driver from our cold-boot.sh script so that we won't
+        use it on new commit-queue instances.
+
+        * EWSTools/cold-boot.sh:
+
+2012-07-28  Sam Weinig  <sam@webkit.org>
+
+        Add ability to load from a string to the ObjC WK API
+        https://bugs.webkit.org/show_bug.cgi?id=92590
+
+        Reviewed by Dan Bernstein.
+
+        Add tests for [WKBrowsingContextController loadHTMLString:baseURL:]. We will be able
+        to greatly improve these tests (to test more than just not crashing) when methods to
+        access page content are added (soon!).
+
+        Adds:
+            Test: WKBrowsingContextLoadDelegateTest_SimpleLoadOfHTMLString
+            Test: WKBrowsingContextLoadDelegateTest_SimpleLoadOfHTMLString_NilBaseURL
+            Test: WKBrowsingContextLoadDelegateTest_SimpleLoadOfHTMLString_NilHTMLStringAndBaseURL
+
+        * TestWebKitAPI/Tests/WebKit2ObjC/WKBrowsingContextLoadDelegateTest.mm:
+        Adds tests and refactors delegates to not use global state.
+
+2012-07-30  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [CMake] TestWebKitAPI bundle should link with WTF
+        https://bugs.webkit.org/show_bug.cgi?id=92616
+
+        Reviewed by Antonio Gomes.
+
+        Fixes build when shared core is disabled.
+
+        * TestWebKitAPI/CMakeLists.txt:
+
+2012-07-30  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: clean up handling of 'expected' stats
+        https://bugs.webkit.org/show_bug.cgi?id=92527
+
+        Reviewed by Tony Chang.
+
+        This patch alters the way we compute and log the "expected"
+        results and how we treat skipped tests; we will now log the
+        number of skipped tests separately from the categories, e.g.:
+
+        Found 31607 tests; running 24464.
+        Expect: 23496 passes   (23496 now,    0 wontfix)
+        Expect:   548 failures (  543 now,    5 wontfix)
+        Expect:   420 flaky    (  245 now,  175 wontfix)
+
+        (so that the "expect" totals add up to the "running" totals);
+        in addition, the totals in the one-line-progress reflect the
+        number of tests we will actually run. If --iterations or
+        --repeat-each are specified, the number of tests we run are
+        multiplied as appropriate, but the "expect" numbers are
+        unchanged, since we don't count multiple invocations of the same
+        test multiple times. In addition, if we are using --run-part or
+        --run-chunk, the tests we don't run are treated as skipped
+        for consistency. We will also log the values for --iterations
+        and --repeat each as part of the found/running line.
+
+        Previously the code had parsed and re-parsed the
+        TestExpectations files several times in an attempt to come up
+        with some sane statistics, but this was expensive and lead to
+        confusing layer; treating files as skipped in the way described
+        above is more consistent and cleaner.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._split_into_chunks_if_necessary):
+        (Manager.prepare_lists_and_print_output):
+        (Manager.run):
+        * Scripts/webkitpy/layout_tests/controllers/manager_unittest.py:
+        (ManagerTest.test_interrupt_if_at_failure_limits):
+        (ManagerTest.test_update_summary_with_result):
+        (ManagerTest.test_look_for_new_crash_logs):
+        (ResultSummaryTest.get_result_summary):
+        * Scripts/webkitpy/layout_tests/models/result_summary.py:
+        (ResultSummary.__init__):
+        * Scripts/webkitpy/layout_tests/models/test_expectations.py:
+        (TestExpectationParser.expectation_for_skipped_test):
+        (TestExpectations.__init__):
+        (TestExpectations.add_skipped_tests):
+          Here we make add_skipped_tests() public, so that we can update
+          the expectations for tests that we are skipping due to
+          --run-part or --run-chunk; we use the wontfix flag so that
+          the tests that are intentionally skipped aren't considered
+          "fixable".
+        * Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py:
+        (SkippedTests.check):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (parse_args):
+        * Scripts/webkitpy/layout_tests/views/printing.py:
+        (Printer.print_found):
+        (Printer):
+        (Printer.print_expected):
+        (Printer._print_result_summary):
+        (Printer._print_result_summary_entry):
+          Here we split out printing the number of tests found and run
+          from the expected results, to be clearer and so that we don't
+          have to reparse the expectations to update the stats.
+        * Scripts/webkitpy/layout_tests/views/printing_unittest.py:
+        (Testprinter.get_result_summary):
+
+2012-07-30  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Propagate gesture events to plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=92281
+
+        Reviewed by Adam Barth.
+
+        Update TestWebPlugin to receive events, and output logs for the events.
+
+        * DumpRenderTree/chromium/TestWebPlugin.cpp:
+        (TestWebPlugin::handleInputEvent):
+        * DumpRenderTree/chromium/TestWebPlugin.h:
+        (TestWebPlugin::acceptsInputEvents):
+        (TestWebPlugin):
+
+2012-07-30  Raphael Kubo da Costa  <rakuco@webkit.org>
+
+        [jhbuild] gnutls 2.12.14 does not build with glibc 2.16.0
+        https://bugs.webkit.org/show_bug.cgi?id=90643
+
+        Reviewed by Gustavo Noronha Silva.
+
+        The 2.x series of gnutls has a version of Gnulib that is
+        incompatible with glibc 2.16.0, which now does not define gets()
+        by default.
+
+        After talking to kov, mrobinson and philn, it looks like it makes
+        sense to simply remove gnutls from jhbuild.modules and rely on the
+        version installed on the system being recent enough.
+
+        This means at least version 2.12.8 for PKCS11 support, or at the
+        very least 2.11.0 (these are the minimum versions enforced by
+        glib-networking's configure.ac).
+
+        * efl/jhbuild.modules: Do not build gnutls anymore, make
+        glib-networking depend on glib instead, and move the libgcrypt
+        dependency to eet, which is what currently needs it.
+        * gtk/jhbuild.modules: Do not build gnutls anymore.
+
+2012-07-30  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: --verbose logging does not work right on windows
+        https://bugs.webkit.org/show_bug.cgi?id=92673
+
+        Unreviewed, build fix.
+
+        The --verbose log level is not being propagated to the worker
+        processes on windows properly; this has been broken ever since I
+        refactored logging into the message pool directly :(.
+
+        Also, fixing this revealed that outputcapture wasn't saving and
+        restoring log levels correctly, so I had to fix that as well.
+
+        * Scripts/webkitpy/common/message_pool.py:
+        (_MessagePool._start_workers):
+        (_MessagePool._worker_log_level):
+        (_Worker.__init__):
+        (_Worker._set_up_logging):
+        (_WorkerLogHandler.__init__):
+        * Scripts/webkitpy/common/system/outputcapture.py:
+        (OutputCapture.capture_output):
+        (OutputCapture.restore_output):
+
+2012-07-30  Dirk Pranke  <dpranke@chromium.org>
+
+        After r123895, new-run-webkit-tests can fail with TypeError when a test crashes
+        https://bugs.webkit.org/show_bug.cgi?id=92664
+
+        Reviewed by Michael Saboff.
+
+        Updated to handle crash_logs being returned as a tuple of (stderr, crash_log).
+
+        * Scripts/webkitpy/layout_tests/port/mac.py:
+        (MacPort.look_for_new_crash_logs):
+
+2012-07-30  Stephen White  <senorblanco@chromium.org>
+
+        Added a SkiaGraphics definition to the watchlist file; cc'ed myself
+        to that group.  Unreviewed.
+
+        * Scripts/webkitpy/common/config/watchlist:
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123966 and r123967.
+        http://trac.webkit.org/changeset/123966
+        http://trac.webkit.org/changeset/123967
+        https://bugs.webkit.org/show_bug.cgi?id=92656
+
+        This patch is causing assertion failures on the debug bot
+        (also rolling out a dependent patch) (Requested by mrobinson
+        on #webkit).
+
+        * gtk/generate-gtkdoc:
+        (get_webkit2_options):
+
+2012-07-30  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Add a non-subprocess jhbuild environment and use it for run-gtk-tests
+        https://bugs.webkit.org/show_bug.cgi?id=92626
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Instead of always shelling out to enter a jhbuild environment, add a Python
+        hook for entering a jhbuild environment directly. This avoids requiring a
+        script to be wrapped in jhbuild.
+
+        * GNUmakefile.am: Remove gtk/run-api-tests from the distribution list.
+        * Scripts/run-gtk-tests: Move most of the logic from run-api-tests here
+        with additional code for entering a jhbuild environment directly.
+        * gtk/run-api-tests: Removed.
+        * jhbuild/jhbuild-wrapper: Use the new helper methods defined in jhbuildutils.py.
+        * jhbuild/jhbuildutils.py: Add some new helper methods here including
+        a method which can transform the current environment into a jhbuild-ified one.
+
+2012-07-30  Alexander Pavlov  <apavlov@chromium.org>
+
+        Unreviewed, upgrade apavlov to reviewer.
+        http://lists.webkit.org/mailman/private/webkit-committers/2012-July/000184.html
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-07-30  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Adapt to changes in the SharedArray platform API
+        https://bugs.webkit.org/show_bug.cgi?id=92631
+
+        Reviewed by Rob Buis.
+
+        Adapt to changes in the SharedArray platform API. No behavioural change.
+
+        * DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp:
+        (LayoutTestController::webHistoryItemCount):
+
+2012-07-30  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][NRWT] REGRESSION(123729): Forcing pixel tests with -p doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=92627
+
+        Reviewed by Noam Rosenthal.
+
+        Remove the default behavior I added in r123729 so that we run all tests as pixel
+        test with -p. It was intentional but it seems like we don't have consensus on
+        that we want it.
+
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort._supports_switching_pixel_tests_per_test):
+
 2012-07-30  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
 
         [EFL][WTR] Enforce SHIFT modifier to upper case keys in event sender.
diff --git a/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp b/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
index 29773fb35..f04708322 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
+++ b/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
@@ -96,6 +96,19 @@
             'sources': [
                 '<@(test_runner_files)',
             ],
+            'conditions': [
+                ['toolkit_uses_gtk == 1', {
+                    'defines': [
+                        'WTF_USE_GTK=1',
+                    ],
+                    'dependencies': [
+                        '<(chromium_src_dir)/build/linux/system.gyp:gtk',
+                    ],
+                    'include_dirs': [
+                        '<(source_dir)/WebKit/chromium/public/gtk',
+                    ],
+                }],
+            ],
         },
         {
             'target_name': 'DumpRenderTree',
@@ -120,6 +133,7 @@
             'include_dirs': [
                 '<(chromium_src_dir)',
                 '<(source_dir)/WebKit/chromium/public',
+                '<(tools_dir)/DumpRenderTree',
                 '<(DEPTH)',
             ],
             'defines': [
@@ -212,6 +226,7 @@
                         '<(tools_dir)/DumpRenderTree/fonts/WebKitWeightWatcher700.ttf',
                         '<(tools_dir)/DumpRenderTree/fonts/WebKitWeightWatcher800.ttf',
                         '<(tools_dir)/DumpRenderTree/fonts/WebKitWeightWatcher900.ttf',
+                        '<(SHARED_INTERMEDIATE_DIR)/webkit/missingImage.png',
                         '<(SHARED_INTERMEDIATE_DIR)/webkit/textAreaResizeCorner.png',
                     ],
                 },{ # OS!="mac"
@@ -474,8 +489,18 @@
                         '--output',
                         '<(PRODUCT_DIR)/DumpRenderTree_apk',
                         '--ant-args',
+                        '-DANDROID_SDK=<(android_sdk)',
+                        '--ant-args',
+                        '-DANDROID_SDK_ROOT=<(android_sdk_root)',
+                        '--ant-args',
+                        '-DANDROID_SDK_TOOLS=<(android_sdk_tools)',
+                        '--ant-args',
+                        '-DANDROID_SDK_VERSION=<(android_sdk_version)',
+                        '--ant-args',
+                        '-DANDROID_TOOLCHAIN=<(android_toolchain)',
+                        '--ant-args',
                         '-DPRODUCT_DIR=<(ant_build_out)',
-                        '--ant-compile',
+                        '--sdk-build=<(sdk_build)',
                         '--app_abi',
                         '<(android_app_abi)',
                     ],
diff --git a/Tools/DumpRenderTree/DumpRenderTree.gypi b/Tools/DumpRenderTree/DumpRenderTree.gypi
index dce1e361d..996c83d87 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.gypi
+++ b/Tools/DumpRenderTree/DumpRenderTree.gypi
@@ -6,8 +6,6 @@
             'chromium/DRTDevToolsClient.cpp',
             'chromium/DRTDevToolsClient.h',
             'chromium/DumpRenderTree.cpp',
-            'chromium/EventSender.cpp',
-            'chromium/EventSender.h',
             'chromium/LayoutTestController.cpp',
             'chromium/LayoutTestController.h',
             'chromium/MockGrammarCheck.cpp',
@@ -56,14 +54,18 @@
             'chromium/WebViewHost.h',
         ],
         'test_runner_files': [
-            'chromium/TestRunner/AccessibilityController.cpp',
-            'chromium/TestRunner/AccessibilityController.h',
-            'chromium/TestRunner/AccessibilityUIElement.cpp',
-            'chromium/TestRunner/AccessibilityUIElement.h',
+            'DumpRenderTree.h',
+            'DumpRenderTreeCommon.cpp',
+            'chromium/TestRunner/AccessibilityControllerChromium.cpp',
+            'chromium/TestRunner/AccessibilityControllerChromium.h',
+            'chromium/TestRunner/AccessibilityUIElementChromium.cpp',
+            'chromium/TestRunner/AccessibilityUIElementChromium.h',
             'chromium/TestRunner/CppBoundClass.cpp',
             'chromium/TestRunner/CppBoundClass.h',
             'chromium/TestRunner/CppVariant.cpp',
             'chromium/TestRunner/CppVariant.h',
+            'chromium/TestRunner/EventSender.cpp',
+            'chromium/TestRunner/EventSender.h',
             'chromium/TestRunner/GamepadController.cpp',
             'chromium/TestRunner/GamepadController.h',
             'chromium/TestRunner/Task.cpp',
diff --git a/Tools/DumpRenderTree/DumpRenderTree.h b/Tools/DumpRenderTree/DumpRenderTree.h
index 0e598be4a..18d8cda0e 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.h
+++ b/Tools/DumpRenderTree/DumpRenderTree.h
@@ -65,4 +65,14 @@ extern RefPtr<LayoutTestController> gLayoutTestController;
 void dump();
 void displayWebView();
 
+struct TestCommand {
+    TestCommand() : shouldDumpPixels(false) { }
+
+    std::string pathOrURL;
+    bool shouldDumpPixels;
+    std::string expectedPixelHash;
+};
+
+TestCommand parseInputLine(const std::string&);
+
 #endif // DumpRenderTree_h
diff --git a/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj b/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
index 83bffd448..b7904f6e3 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
+++ b/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
@@ -67,6 +67,7 @@
 		4437730E125CBC3600AAE02C /* WebArchiveDumpSupport.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 44A997830FCDE86400580F10 /* WebArchiveDumpSupport.cpp */; };
 		4437730F125CBC4D00AAE02C /* WebArchiveDumpSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 44A997820FCDE86400580F10 /* WebArchiveDumpSupport.h */; };
 		4AD6A11413C8124000EA9737 /* FormValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AD6A11313C8124000EA9737 /* FormValue.cpp */; };
+		5106803E15CC7B10001A8A23 /* SlowNPPNew.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5106803D15CC7B10001A8A23 /* SlowNPPNew.cpp */; };
 		515F429C15C07872007C8F90 /* PluginScriptableObjectOverridesAllProperties.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 515F429B15C07872007C8F90 /* PluginScriptableObjectOverridesAllProperties.cpp */; };
 		5185F6B210714E07007AA393 /* HistoryDelegate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5185F69F10714A57007AA393 /* HistoryDelegate.mm */; };
 		5185F6B310714E12007AA393 /* HistoryDelegate.h in Headers */ = {isa = PBXBuildFile; fileRef = 5185F69E10714A57007AA393 /* HistoryDelegate.h */; };
@@ -89,6 +90,7 @@
 		8CCDA82A151A72D10003F937 /* SampleFont.sfont in Copy Font Files */ = {isa = PBXBuildFile; fileRef = 8CCDA81F151A56550003F937 /* SampleFont.sfont */; };
 		9340994C08540CAE007F3BC8 /* DumpRenderTreePrefix.h in Headers */ = {isa = PBXBuildFile; fileRef = 32A70AAB03705E1F00C91783 /* DumpRenderTreePrefix.h */; };
 		9340995108540CAE007F3BC8 /* WebKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 9335435F03D75502008635CE /* WebKit.framework */; };
+		9830F31F15C81181005AB206 /* DumpRenderTreeCommon.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9830F31E15C81181005AB206 /* DumpRenderTreeCommon.cpp */; };
 		A817090008B163EF00CCB9FB /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = A84F608908B136DA00E9745F /* Cocoa.framework */; };
 		A817090408B164D300CCB9FB /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = A817090308B164D300CCB9FB /* JavaScriptCore.framework */; };
 		A84F608A08B136DA00E9745F /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = A84F608908B136DA00E9745F /* Cocoa.framework */; };
@@ -277,6 +279,7 @@
 		44A997820FCDE86400580F10 /* WebArchiveDumpSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebArchiveDumpSupport.h; path = cf/WebArchiveDumpSupport.h; sourceTree = "<group>"; };
 		44A997830FCDE86400580F10 /* WebArchiveDumpSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebArchiveDumpSupport.cpp; path = cf/WebArchiveDumpSupport.cpp; sourceTree = "<group>"; };
 		4AD6A11313C8124000EA9737 /* FormValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FormValue.cpp; sourceTree = "<group>"; };
+		5106803D15CC7B10001A8A23 /* SlowNPPNew.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SlowNPPNew.cpp; path = TestNetscapePlugIn/Tests/SlowNPPNew.cpp; sourceTree = SOURCE_ROOT; };
 		515F429B15C07872007C8F90 /* PluginScriptableObjectOverridesAllProperties.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginScriptableObjectOverridesAllProperties.cpp; sourceTree = "<group>"; };
 		5185F69E10714A57007AA393 /* HistoryDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HistoryDelegate.h; path = mac/HistoryDelegate.h; sourceTree = "<group>"; };
 		5185F69F10714A57007AA393 /* HistoryDelegate.mm */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; name = HistoryDelegate.mm; path = mac/HistoryDelegate.mm; sourceTree = "<group>"; };
@@ -289,6 +292,7 @@
 		8CCDA81F151A56550003F937 /* SampleFont.sfont */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xml; name = SampleFont.sfont; path = fonts/SampleFont.sfont; sourceTree = "<group>"; };
 		9335435F03D75502008635CE /* WebKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = WebKit.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		9340995408540CAF007F3BC8 /* DumpRenderTree */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = DumpRenderTree; sourceTree = BUILT_PRODUCTS_DIR; };
+		9830F31E15C81181005AB206 /* DumpRenderTreeCommon.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DumpRenderTreeCommon.cpp; sourceTree = "<group>"; };
 		A803FF7409CAAD08009B2A37 /* DumpRenderTree.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.h; fileEncoding = 4; path = DumpRenderTree.h; sourceTree = "<group>"; };
 		A817090308B164D300CCB9FB /* JavaScriptCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = JavaScriptCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		A84F608908B136DA00E9745F /* Cocoa.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Cocoa.framework; path = /System/Library/Frameworks/Cocoa.framework; sourceTree = "<absolute>"; };
@@ -421,6 +425,7 @@
 		08FB7794FE84155DC02AAC07 /* DumpRenderTree */ = {
 			isa = PBXGroup;
 			children = (
+				9830F31E15C81181005AB206 /* DumpRenderTreeCommon.cpp */,
 				32A70AAB03705E1F00C91783 /* DumpRenderTreePrefix.h */,
 				1422A2750AF6F4BD00E1A883 /* Delegates */,
 				1422A2690AF6F45200E1A883 /* Controllers */,
@@ -550,6 +555,7 @@
 				1AD9D2FD12028409001A70D1 /* PluginScriptableNPObjectInvokeDefault.cpp */,
 				515F429B15C07872007C8F90 /* PluginScriptableObjectOverridesAllProperties.cpp */,
 				1A1E4296141141C400388758 /* PrivateBrowsing.cpp */,
+				5106803D15CC7B10001A8A23 /* SlowNPPNew.cpp */,
 			);
 			path = Tests;
 			sourceTree = "<group>";
@@ -899,6 +905,7 @@
 				1A1E4298141141C400388758 /* PrivateBrowsing.cpp in Sources */,
 				1A66C35114576A920099A115 /* ContentsScaleFactor.cpp in Sources */,
 				515F429C15C07872007C8F90 /* PluginScriptableObjectOverridesAllProperties.cpp in Sources */,
+				5106803E15CC7B10001A8A23 /* SlowNPPNew.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -955,6 +962,7 @@
 				29CFBA2E12273A1000BC30C0 /* AccessibilityTextMarkerMac.mm in Sources */,
 				3A5626CB131CA02A002BE6D9 /* StorageTrackerDelegate.mm in Sources */,
 				80045AEE147718E7008290A8 /* AccessibilityNotificationHandler.mm in Sources */,
+				9830F31F15C81181005AB206 /* DumpRenderTreeCommon.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Tools/DumpRenderTree/DumpRenderTreeCommon.cpp b/Tools/DumpRenderTree/DumpRenderTreeCommon.cpp
new file mode 100644
index 000000000..48d832258
--- /dev/null
+++ b/Tools/DumpRenderTree/DumpRenderTreeCommon.cpp
@@ -0,0 +1,82 @@
+#include "config.h"
+#include "DumpRenderTree.h"
+
+#include <algorithm>
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string>
+
+class CommandTokenizer {
+public:
+    explicit CommandTokenizer(const std::string& input)
+        : m_input(input)
+        , m_posNextSeparator(0)
+    {
+        pump();
+    }
+
+    bool hasNext() const;
+    std::string next();
+
+private:
+    void pump();
+    static const char kSeparator = '\'';
+    const std::string& m_input;
+    std::string m_next;
+    size_t m_posNextSeparator;
+};
+
+void CommandTokenizer::pump()
+{
+    if (m_posNextSeparator == std::string::npos || m_posNextSeparator == m_input.size()) {
+        m_next = std::string();
+        return;
+    }
+    size_t start = m_posNextSeparator ? m_posNextSeparator + 1 : 0;
+    m_posNextSeparator = m_input.find(kSeparator, start);
+    size_t size = m_posNextSeparator == std::string::npos ? std::string::npos : m_posNextSeparator - start;
+    m_next = std::string(m_input, start, size);
+}
+
+std::string CommandTokenizer::next()
+{
+    ASSERT(hasNext());
+
+    std::string oldNext = m_next;
+    pump();
+    return oldNext;
+}
+
+bool CommandTokenizer::hasNext() const
+{
+    return !m_next.empty();
+}
+
+NO_RETURN static void die(const std::string& inputLine)
+{
+    fprintf(stderr, "Unexpected input line: %s\n", inputLine.c_str());
+    exit(1);
+}
+
+TestCommand parseInputLine(const std::string& inputLine)
+{
+    TestCommand result;
+    CommandTokenizer tokenizer(inputLine);
+    if (!tokenizer.hasNext())
+        die(inputLine);
+
+    result.pathOrURL = tokenizer.next();
+    if (!tokenizer.hasNext())
+        return result;
+
+    std::string arg = tokenizer.next();
+    if (arg != std::string("-p") && arg != std::string("--pixel-test"))
+        die(inputLine);
+    result.shouldDumpPixels = true;
+
+    if (tokenizer.hasNext())
+        result.expectedPixelHash = tokenizer.next();
+
+    return result;
+}
diff --git a/Tools/DumpRenderTree/LayoutTestController.cpp b/Tools/DumpRenderTree/LayoutTestController.cpp
index e6b3670aa..2bd2c9a09 100644
--- a/Tools/DumpRenderTree/LayoutTestController.cpp
+++ b/Tools/DumpRenderTree/LayoutTestController.cpp
@@ -2210,7 +2210,6 @@ static void layoutTestControllerObjectFinalize(JSObjectRef object)
 
 void LayoutTestController::makeWindowObject(JSContextRef context, JSObjectRef windowObject, JSValueRef* exception)
 {
-    JSRetainPtr<JSStringRef> layoutTestContollerStr(Adopt, JSStringCreateWithUTF8CString("layoutTestController"));
     JSRetainPtr<JSStringRef> testRunnerStr(Adopt, JSStringCreateWithUTF8CString("testRunner"));
     ref();
     ref();
@@ -2219,7 +2218,6 @@ void LayoutTestController::makeWindowObject(JSContextRef context, JSObjectRef wi
     JSValueRef layoutTestContollerObject = JSObjectMake(context, classRef, this);
     JSClassRelease(classRef);
 
-    JSObjectSetProperty(context, windowObject, layoutTestContollerStr.get(), layoutTestContollerObject, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
     JSObjectSetProperty(context, windowObject, testRunnerStr.get(), layoutTestContollerObject, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
 }
 
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp
index 4ce959201..05f3a8c21 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp
@@ -892,8 +892,8 @@ void notifyTestCompletion(NPP npp, NPObject* object)
 {
     NPVariant result;
     NPString script;
-    script.UTF8Characters = "javascript:window.layoutTestController.notifyDone();";
-    script.UTF8Length = strlen("javascript:window.layoutTestController.notifyDone();");
+    script.UTF8Characters = "javascript:window.testRunner.notifyDone();";
+    script.UTF8Length = strlen("javascript:window.testRunner.notifyDone();");
     browser->evaluate(npp, object, &script, &result);
     browser->releasevariantvalue(&result);
 }
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
index 6cd65ed26..540b75699 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
@@ -254,12 +254,12 @@ void PluginTest::log(const char* format, ...)
 
 void PluginTest::waitUntilDone()
 {
-    executeScript("layoutTestController.waitUntilDone()");
+    executeScript("testRunner.waitUntilDone()");
 }
 
 void PluginTest::notifyDone()
 {
-    executeScript("layoutTestController.notifyDone()");
+    executeScript("testRunner.notifyDone()");
 }
 
 void PluginTest::registerCreateTestFunction(const string& identifier, CreateTestFunction createTestFunction)
diff --git a/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.h b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/SlowNPPNew.cpp
index 46a72086c..bd2a76a19 100644
--- a/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.h
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/SlowNPPNew.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,51 +23,26 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ThreadLauncher_h
-#define ThreadLauncher_h
+#include "PluginTest.h"
 
-#include "Connection.h"
-#include "PlatformProcessIdentifier.h"
-#include <wtf/RefPtr.h>
-#include <wtf/Threading.h>
+#include <string.h>
 
-#if PLATFORM(QT)
-QT_BEGIN_NAMESPACE
-class QLocalSocket;
-QT_END_NAMESPACE
-#endif
+using namespace std;
 
-namespace WebKit {
-
-class ThreadLauncher : public ThreadSafeRefCounted<ThreadLauncher> {
+class SlowNPPNew : public PluginTest {
 public:
-    class Client {
-    public:
-        virtual ~Client() { }
-        virtual void didFinishLaunching(ThreadLauncher*, CoreIPC::Connection::Identifier) = 0;
-    };
-    
-    static PassRefPtr<ThreadLauncher> create(Client* client)
+    SlowNPPNew(NPP npp, const string& identifier)
+        : PluginTest(npp, identifier)
     {
-        return adoptRef(new ThreadLauncher(client));
     }
-
-    bool isLaunching() const { return m_isLaunching; }
-
-    void invalidate();
-
+    
 private:
-    explicit ThreadLauncher(Client*);
-
-    void launchThread();
-    void didFinishLaunchingThread(CoreIPC::Connection::Identifier);
-
-    static CoreIPC::Connection::Identifier createWebThread();
-
-    bool m_isLaunching;
-    Client* m_client;
+    
+    virtual NPError NPP_New(NPMIMEType pluginType, uint16_t mode, int16_t argc, char* argn[], char* argv[], NPSavedData *saved)
+    {
+        usleep(550000);
+        return NPERR_NO_ERROR;
+    }
 };
 
-} // namespace WebKit
-
-#endif // ThreadLauncher_h
+static PluginTest::Register<SlowNPPNew> slowNPPNew("slow-npp-new");
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/mac/ConvertPoint.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/mac/ConvertPoint.cpp
index 96a6cc757..0beb7de0a 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/mac/ConvertPoint.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/mac/ConvertPoint.cpp
@@ -74,7 +74,7 @@ private:
         if (testConvert())
             executeScript("document.getElementById('result').innerHTML = 'SUCCESS!'");
 
-        executeScript("setTimeout(function() { layoutTestController.notifyDone() }, 0)");
+        executeScript("setTimeout(function() { testRunner.notifyDone() }, 0)");
         return NPERR_NO_ERROR;
     }
 };
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp
index 2f81c8435..fd92bfdac 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp
@@ -506,7 +506,7 @@ static int16_t handleEventCarbon(NPP instance, PluginObject* obj, EventRecord* e
             if (obj->testKeyboardFocusForPlugins) {
                 obj->eventLogging = false;
                 obj->testKeyboardFocusForPlugins = FALSE;
-                executeScript(obj, "layoutTestController.notifyDone();");
+                executeScript(obj, "testRunner.notifyDone();");
             }
             break;
         case autoKey:
@@ -599,7 +599,7 @@ static int16_t handleEventCocoa(NPP instance, PluginObject* obj, NPCocoaEvent* e
                 if (obj->testKeyboardFocusForPlugins) {
                     obj->eventLogging = false;
                     obj->testKeyboardFocusForPlugins = FALSE;
-                    executeScript(obj, "layoutTestController.notifyDone();");
+                    executeScript(obj, "testRunner.notifyDone();");
                 }
             }
             return 1;
@@ -723,7 +723,7 @@ static int16_t handleEventWin(NPP instance, PluginObject* obj, NPEvent* event)
         if (obj->testKeyboardFocusForPlugins) {
             obj->eventLogging = false;
             obj->testKeyboardFocusForPlugins = FALSE;
-            executeScript(obj, "layoutTestController.notifyDone();");
+            executeScript(obj, "testRunner.notifyDone();");
         }
         break;
     case WM_LBUTTONDOWN:
diff --git a/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp b/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp
index f88bae599..fd59a417e 100644
--- a/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp
+++ b/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp
@@ -308,9 +308,8 @@ void LayoutTestController::waitForPolicyDelegate()
 size_t LayoutTestController::webHistoryItemCount()
 {
     SharedArray<BlackBerry::WebKit::WebPage::BackForwardEntry> backForwardList;
-    unsigned size;
-    BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->getBackForwardList(backForwardList, size);
-    return size;
+    BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->getBackForwardList(backForwardList);
+    return backForwardList.length();
 }
 
 int LayoutTestController::windowCount()
diff --git a/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp b/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp
index 6155f441f..ae5502cd2 100644
--- a/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp
@@ -29,11 +29,12 @@
  */
 
 #include "config.h"
+#include "DumpRenderTree.h"
 
 #include "MockWebKitPlatformSupport.h"
 #include "TestShell.h"
-#include "WebCompositor.h"
 #include "webkit/support/webkit_support.h"
+#include <public/WebCompositor.h>
 #include <v8/include/v8-testing.h>
 #include <v8/include/v8.h>
 #include <wtf/OwnPtr.h>
@@ -44,7 +45,6 @@ using namespace std;
 static const char optionComplexText[] = "--complex-text";
 static const char optionDumpAllPixels[] = "--dump-all-pixels";
 static const char optionNotree[] = "--notree";
-static const char optionPixelTests[] = "--pixel-tests";
 static const char optionThreaded[] = "--threaded";
 static const char optionDebugRenderTree[] = "--debug-render-tree";
 static const char optionDebugLayerTree[] = "--debug-layer-tree";
@@ -85,17 +85,12 @@ private:
     OwnPtr<MockWebKitPlatformSupport> m_mockPlatform;
 };
 
-static void runTest(TestShell& shell, TestParams& params, const string& testName)
+static void runTest(TestShell& shell, TestParams& params, const string& inputLine)
 {
     int oldTimeoutMsec = shell.layoutTestTimeout();
-    params.pixelHash = "";
-    string pathOrURL = testName;
-    string::size_type separatorPosition = pathOrURL.find("'");
-    if (separatorPosition != string::npos) {
-        params.pixelHash = pathOrURL.substr(separatorPosition + 1);
-        pathOrURL.erase(separatorPosition);
-    }
-    params.testUrl = webkit_support::CreateURLForPathOrURL(pathOrURL);
+    TestCommand command = parseInputLine(inputLine);
+    params.testUrl = webkit_support::CreateURLForPathOrURL(command.pathOrURL);
+    params.pixelHash = command.shouldDumpPixels;
     webkit_support::SetCurrentDirectoryForFileURL(params.testUrl);
     v8::V8::SetFlagsFromString(shell.javaScriptFlags().c_str(), shell.javaScriptFlags().length());
     if (shell.stressOpt() || shell.stressDeopt()) {
@@ -108,11 +103,11 @@ static void runTest(TestShell& shell, TestParams& params, const string& testName
           bool isLastLoad = (i == (v8::Testing::GetStressRuns() - 1));
           shell.setDumpWhenFinished(isLastLoad);
           shell.resetTestController();
-          shell.runFileTest(params);
+          shell.runFileTest(params, command.shouldDumpPixels);
       }
     } else {
       shell.resetTestController();
-      shell.runFileTest(params);
+      shell.runFileTest(params, command.shouldDumpPixels);
     }
     shell.setLayoutTestTimeout(oldTimeoutMsec);
 }
@@ -146,8 +141,6 @@ int main(int argc, char* argv[])
             serverMode = true;
         else if (argument == optionNotree)
             params.dumpTree = false;
-        else if (argument == optionPixelTests)
-            params.dumpPixels = true;
         else if (argument == optionDebugRenderTree)
             params.debugRenderTree = true;
         else if (argument == optionDebugLayerTree)
diff --git a/Tools/DumpRenderTree/chromium/LayoutTestHelper.mm b/Tools/DumpRenderTree/chromium/LayoutTestHelper.mm
index 978f74c06..5ecac6692 100644
--- a/Tools/DumpRenderTree/chromium/LayoutTestHelper.mm
+++ b/Tools/DumpRenderTree/chromium/LayoutTestHelper.mm
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -40,13 +41,97 @@
 
 namespace {
 
+#if defined(MAC_OS_X_VERSION_10_7) && MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_7
+
+CFURLRef sUserColorProfileURL;
+
+void installLayoutTestColorProfile()
+{
+    // To make sure we get consistent colors (not dependent on the chosen color
+    // space of the main display), we force the generic RGB color profile.
+    // This causes a change the user can see.
+    
+    CFUUIDRef mainDisplayID = CGDisplayCreateUUIDFromDisplayID(CGMainDisplayID());
+    
+    if (!sUserColorProfileURL) {
+        CFDictionaryRef deviceInfo = ColorSyncDeviceCopyDeviceInfo(kColorSyncDisplayDeviceClass, mainDisplayID);
+
+        if (!deviceInfo) {
+            NSLog(@"No display attached to system; not setting main display's color profile.");
+            CFRelease(mainDisplayID);
+            return;
+        }
+
+        CFDictionaryRef profileInfo = (CFDictionaryRef)CFDictionaryGetValue(deviceInfo, kColorSyncCustomProfiles);
+        if (profileInfo) {
+            sUserColorProfileURL = (CFURLRef)CFDictionaryGetValue(profileInfo, CFSTR("1"));
+            CFRetain(sUserColorProfileURL);
+        } else {
+            profileInfo = (CFDictionaryRef)CFDictionaryGetValue(deviceInfo, kColorSyncFactoryProfiles);
+            CFDictionaryRef factoryProfile = (CFDictionaryRef)CFDictionaryGetValue(profileInfo, CFSTR("1"));
+            sUserColorProfileURL = (CFURLRef)CFDictionaryGetValue(factoryProfile, kColorSyncDeviceProfileURL);
+            CFRetain(sUserColorProfileURL);
+        }
+        
+        CFRelease(deviceInfo);
+    }
+
+    ColorSyncProfileRef genericRGBProfile = ColorSyncProfileCreateWithName(kColorSyncGenericRGBProfile);
+    CFErrorRef error;
+    CFURLRef profileURL = ColorSyncProfileGetURL(genericRGBProfile, &error);
+    if (!profileURL) {
+        NSLog(@"Failed to get URL of Generic RGB color profile! Many pixel tests may fail as a result. Error: %@", error);
+        
+        if (sUserColorProfileURL) {
+            CFRelease(sUserColorProfileURL);
+            sUserColorProfileURL = 0;
+        }
+        
+        CFRelease(genericRGBProfile);
+        CFRelease(mainDisplayID);
+        return;
+    }
+        
+    CFMutableDictionaryRef profileInfo = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+    CFDictionarySetValue(profileInfo, kColorSyncDeviceDefaultProfileID, profileURL);
+    
+    if (!ColorSyncDeviceSetCustomProfiles(kColorSyncDisplayDeviceClass, mainDisplayID, profileInfo)) {
+        NSLog(@"Failed to set color profile for main display! Many pixel tests may fail as a result.");
+        
+        if (sUserColorProfileURL) {
+            CFRelease(sUserColorProfileURL);
+            sUserColorProfileURL = 0;
+        }
+    }
+    
+    CFRelease(profileInfo);
+    CFRelease(genericRGBProfile);
+    CFRelease(mainDisplayID);
+}
+
+void restoreUserColorProfile(void)
+{
+    // This is used as a signal handler, and thus the calls into ColorSync are unsafe.
+    // But we might as well try to restore the user's color profile, we're going down anyway...
+    
+    if (!sUserColorProfileURL)
+        return;
+    
+    CFUUIDRef mainDisplayID = CGDisplayCreateUUIDFromDisplayID(CGMainDisplayID());
+    CFMutableDictionaryRef profileInfo = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+    CFDictionarySetValue(profileInfo, kColorSyncDeviceDefaultProfileID, sUserColorProfileURL);
+    ColorSyncDeviceSetCustomProfiles(kColorSyncDisplayDeviceClass, mainDisplayID, profileInfo);
+    CFRelease(mainDisplayID);
+    CFRelease(profileInfo);
+}
+
+#else // For Snow Leopard and before, use older CM* API.
+
 const char colorProfilePath[] = "/System/Library/ColorSync/Profiles/Generic RGB Profile.icc";
 
 CMProfileLocation initialColorProfileLocation; // The locType field is initialized to 0 which is the same as cmNoProfileBase.
 
-} // namespace
-
-static void installLayoutTestColorProfile()
+void installLayoutTestColorProfile()
 {
     // To make sure we get consistent colors (not dependent on the Main display),
     // we force the generic rgb color profile.  This cases a change the user can
@@ -76,7 +161,7 @@ static void installLayoutTestColorProfile()
     }
 }
 
-static void restoreUserColorProfile(void)
+void restoreUserColorProfile(void)
 {
     // This is used as a signal handler, and thus the calls into ColorSync are unsafe.
     // But we might as well try to restore the user's color profile, we're going down anyway...
@@ -90,13 +175,17 @@ static void restoreUserColorProfile(void)
     }
 }
 
-static void simpleSignalHandler(int sig)
+#endif
+
+void simpleSignalHandler(int sig)
 {
     // Try to restore the color profile and try to go down cleanly
     restoreUserColorProfile();
     exit(128 + sig);
 }
 
+} // namespace
+
 int main(int argc, char* argv[])
 {
     NSAutoreleasePool* pool = [[NSAutoreleasePool alloc] init];
diff --git a/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.cpp b/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.cpp
index 7204732de..502addea9 100644
--- a/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.cpp
+++ b/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.cpp
@@ -118,7 +118,6 @@ void MockWebSpeechRecognizer::start(const WebSpeechRecognitionHandle& handle, co
     m_taskQueue.append(adoptPtr(new ClientCallTask(this, &WebSpeechRecognizerClient::didStart)));
     m_taskQueue.append(adoptPtr(new ClientCallTask(this, &WebSpeechRecognizerClient::didStartAudio)));
     m_taskQueue.append(adoptPtr(new ClientCallTask(this, &WebSpeechRecognizerClient::didStartSound)));
-    m_taskQueue.append(adoptPtr(new ClientCallTask(this, &WebSpeechRecognizerClient::didStartSpeech)));
 
     if (!m_mockTranscripts.isEmpty()) {
         ASSERT(m_mockTranscripts.size() == m_mockConfidences.size());
@@ -131,7 +130,6 @@ void MockWebSpeechRecognizer::start(const WebSpeechRecognitionHandle& handle, co
     } else
         m_taskQueue.append(adoptPtr(new NoMatchTask(this)));
 
-    m_taskQueue.append(adoptPtr(new ClientCallTask(this, &WebSpeechRecognizerClient::didEndSpeech)));
     m_taskQueue.append(adoptPtr(new ClientCallTask(this, &WebSpeechRecognizerClient::didEndSound)));
     m_taskQueue.append(adoptPtr(new ClientCallTask(this, &WebSpeechRecognizerClient::didEndAudio)));
     m_taskQueue.append(adoptPtr(new ClientCallTask(this, &WebSpeechRecognizerClient::didEnd)));
@@ -153,7 +151,7 @@ void MockWebSpeechRecognizer::abort(const WebSpeechRecognitionHandle& handle, We
     m_handle = handle;
     m_client = client;
 
-    m_taskQueue.clear();
+    clearTaskQueue();
     m_wasAborted = true;
     m_taskQueue.append(adoptPtr(new ClientCallTask(this, &WebSpeechRecognizerClient::didEnd)));
     startTaskQueue();
@@ -167,7 +165,7 @@ void MockWebSpeechRecognizer::addMockResult(const WebString& transcript, float c
 
 void MockWebSpeechRecognizer::setError(int code, const WebString& message)
 {
-    m_taskQueue.clear();
+    clearTaskQueue();
     m_taskQueue.append(adoptPtr(new ErrorTask(this, code, message)));
     m_taskQueue.append(adoptPtr(new ClientCallTask(this, &WebSpeechRecognizerClient::didEnd)));
     startTaskQueue();
@@ -191,17 +189,22 @@ void MockWebSpeechRecognizer::startTaskQueue()
     m_taskQueueRunning = true;
 }
 
-void MockWebSpeechRecognizer::StepTask::runIfValid()
+void MockWebSpeechRecognizer::clearTaskQueue()
 {
-    ASSERT(m_object->m_taskQueueRunning);
+    m_taskQueue.clear();
+    m_taskQueueRunning = false;
+}
 
+void MockWebSpeechRecognizer::StepTask::runIfValid()
+{
     if (m_object->m_taskQueue.isEmpty()) {
         m_object->m_taskQueueRunning = false;
         return;
     }
 
-    m_object->m_taskQueue[0]->run();
+    OwnPtr<Task> task = m_object->m_taskQueue[0].release();
     m_object->m_taskQueue.remove(0);
+    task->run();
 
     if (m_object->m_taskQueue.isEmpty()) {
         m_object->m_taskQueueRunning = false;
diff --git a/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.h b/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.h
index 7716186d1..eb7c3e95b 100644
--- a/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.h
+++ b/Tools/DumpRenderTree/chromium/MockWebSpeechRecognizer.h
@@ -72,6 +72,7 @@ public:
 private:
     MockWebSpeechRecognizer();
     void startTaskQueue();
+    void clearTaskQueue();
 
     TaskList m_taskList;
     WebKit::WebSpeechRecognitionHandle m_handle;
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityController.cpp b/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityControllerChromium.cpp
index c6e4404c2..b1d2948ae 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityController.cpp
+++ b/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityControllerChromium.cpp
@@ -29,7 +29,7 @@
  */
 
 #include "config.h"
-#include "AccessibilityController.h"
+#include "AccessibilityControllerChromium.h"
 
 #include "WebAccessibilityObject.h"
 #include "WebFrame.h"
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityController.h b/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityControllerChromium.h
index 967259536..11c082b3e 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityController.h
+++ b/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityControllerChromium.h
@@ -28,10 +28,10 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef AccessibilityController_h
-#define AccessibilityController_h
+#ifndef AccessibilityControllerChromium_h
+#define AccessibilityControllerChromium_h
 
-#include "AccessibilityUIElement.h"
+#include "AccessibilityUIElementChromium.h"
 #include "CppBoundClass.h"
 
 namespace WebKit {
@@ -81,4 +81,4 @@ private:
     WebKit::WebView* m_webView;
 };
 
-#endif // AccessibilityController_h
+#endif // AccessibilityControllerChromium_h
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElement.cpp b/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp
index 583806585..c56b151e6 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElement.cpp
+++ b/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp
@@ -29,7 +29,7 @@
  */
 
 #include "config.h"
-#include "AccessibilityUIElement.h"
+#include "AccessibilityUIElementChromium.h"
 
 #include "WebAccessibilityObject.h"
 #include "platform/WebCString.h"
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElement.h b/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.h
index 8ae6d412f..1b48a53b6 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElement.h
+++ b/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.h
@@ -28,8 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef AccessibilityUIElement_h
-#define AccessibilityUIElement_h
+#ifndef AccessibilityUIElementChromium_h
+#define AccessibilityUIElementChromium_h
 
 #include "CppBoundClass.h"
 #include "WebAccessibilityObject.h"
@@ -164,4 +164,4 @@ private:
     ElementList m_elements;
 };
 
-#endif // AccessibilityUIElement_h
+#endif // AccessibilityUIElementChromium_h
diff --git a/Tools/DumpRenderTree/chromium/EventSender.cpp b/Tools/DumpRenderTree/chromium/TestRunner/EventSender.cpp
index 5f49b8fdf..cafaca9ac 100644
--- a/Tools/DumpRenderTree/chromium/EventSender.cpp
+++ b/Tools/DumpRenderTree/chromium/TestRunner/EventSender.cpp
@@ -286,6 +286,7 @@ EventSender::EventSender()
     bindMethod("gestureScrollFirstPoint", &EventSender::gestureScrollFirstPoint);
     bindMethod("gestureScrollUpdate", &EventSender::gestureScrollUpdate);
     bindMethod("gestureTap", &EventSender::gestureTap);
+    bindMethod("gestureTapDown", &EventSender::gestureTapDown);
     bindMethod("gestureLongPress", &EventSender::gestureLongPress);
     bindMethod("gestureTwoFingerTap", &EventSender::gestureTwoFingerTap);
     bindMethod("zoomPageIn", &EventSender::zoomPageIn);
@@ -1112,6 +1113,12 @@ void EventSender::gestureTap(const CppArgumentList& arguments, CppVariant* resul
     gestureEvent(WebInputEvent::GestureTap, arguments);
 }
 
+void EventSender::gestureTapDown(const CppArgumentList& arguments, CppVariant* result)
+{
+    result->setNull();
+    gestureEvent(WebInputEvent::GestureTapDown, arguments);
+}
+
 void EventSender::gestureLongPress(const CppArgumentList& arguments, CppVariant* result)
 {
     result->setNull();
@@ -1166,13 +1173,17 @@ void EventSender::gestureEvent(WebInputEvent::Type type, const CppArgumentList&
         event.y = m_currentGestureLocation.y;
         break;
     case WebInputEvent::GestureTap:
-        if (arguments.size() >= 4) {
+        if (arguments.size() >= 3) {
+            // Tap count.
             event.deltaX = static_cast<float>(arguments[2].toDouble());
-            event.deltaY = static_cast<float>(arguments[3].toDouble());
         }
         event.x = point.x;
         event.y = point.y;
         break;
+    case WebInputEvent::GestureTapDown:
+        event.x = point.x;
+        event.y = point.y;
+        break;
     case WebInputEvent::GestureLongPress:
         event.x = point.x;
         event.y = point.y;
diff --git a/Tools/DumpRenderTree/chromium/EventSender.h b/Tools/DumpRenderTree/chromium/TestRunner/EventSender.h
index c187f0e47..828e7c842 100644
--- a/Tools/DumpRenderTree/chromium/EventSender.h
+++ b/Tools/DumpRenderTree/chromium/TestRunner/EventSender.h
@@ -105,6 +105,7 @@ public:
     void gestureScrollFirstPoint(const CppArgumentList&, CppVariant*);
     void gestureScrollUpdate(const CppArgumentList&, CppVariant*);
     void gestureTap(const CppArgumentList&, CppVariant*);
+    void gestureTapDown(const CppArgumentList&, CppVariant*);
     void gestureLongPress(const CppArgumentList&, CppVariant*);
     void gestureTwoFingerTap(const CppArgumentList&, CppVariant*);
     void gestureEvent(WebKit::WebInputEvent::Type, const CppArgumentList&);
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/TestInterfaces.cpp b/Tools/DumpRenderTree/chromium/TestRunner/TestInterfaces.cpp
index edd50dfab..ccec086aa 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/TestInterfaces.cpp
+++ b/Tools/DumpRenderTree/chromium/TestRunner/TestInterfaces.cpp
@@ -31,7 +31,8 @@
 #include "config.h"
 #include "TestInterfaces.h"
 
-#include "AccessibilityController.h"
+#include "AccessibilityControllerChromium.h"
+#include "EventSender.h"
 #include "GamepadController.h"
 #include "TextInputController.h"
 #include "platform/WebString.h"
@@ -53,9 +54,11 @@ public:
     void resetAll();
 
     AccessibilityController* accessibilityController() { return m_accessibilityController.get(); }
+    EventSender* eventSender() { return m_eventSender.get(); }
 
 private:
     OwnPtr<AccessibilityController> m_accessibilityController;
+    OwnPtr<EventSender> m_eventSender;
     OwnPtr<GamepadController> m_gamepadController;
     OwnPtr<TextInputController> m_textInputController;
 };
@@ -63,6 +66,7 @@ private:
 TestInterfaces::Internal::Internal()
 {
     m_accessibilityController = adoptPtr(new AccessibilityController());
+    m_eventSender = adoptPtr(new EventSender());
     m_gamepadController = adoptPtr(new GamepadController());
     m_textInputController = adoptPtr(new TextInputController());
 }
@@ -70,10 +74,12 @@ TestInterfaces::Internal::Internal()
 TestInterfaces::Internal::~Internal()
 {
     m_accessibilityController->setWebView(0);
+    m_eventSender->setWebView(0);
     // m_gamepadController doesn't depend on WebView.
     m_textInputController->setWebView(0);
 
     // m_accessibilityController doesn't depend on TestDelegate.
+    m_eventSender->setDelegate(0);
     m_gamepadController->setDelegate(0);
     // m_textInputController doesn't depend on TestDelegate.
 }
@@ -81,6 +87,7 @@ TestInterfaces::Internal::~Internal()
 void TestInterfaces::Internal::setWebView(WebView* webView)
 {
     m_accessibilityController->setWebView(webView);
+    m_eventSender->setWebView(webView);
     // m_gamepadController doesn't depend on WebView.
     m_textInputController->setWebView(webView);
 }
@@ -88,6 +95,7 @@ void TestInterfaces::Internal::setWebView(WebView* webView)
 void TestInterfaces::Internal::setDelegate(TestDelegate* delegate)
 {
     // m_accessibilityController doesn't depend on TestDelegate.
+    m_eventSender->setDelegate(delegate);
     m_gamepadController->setDelegate(delegate);
     // m_textInputController doesn't depend on TestDelegate.
 }
@@ -95,6 +103,7 @@ void TestInterfaces::Internal::setDelegate(TestDelegate* delegate)
 void TestInterfaces::Internal::bindTo(WebFrame* frame)
 {
     m_accessibilityController->bindToJavascript(frame, WebString::fromUTF8("accessibilityController"));
+    m_eventSender->bindToJavascript(frame, WebString::fromUTF8("eventSender"));
     m_gamepadController->bindToJavascript(frame, WebString::fromUTF8("gamepadController"));
     m_textInputController->bindToJavascript(frame, WebString::fromUTF8("textInputController"));
 }
@@ -102,6 +111,7 @@ void TestInterfaces::Internal::bindTo(WebFrame* frame)
 void TestInterfaces::Internal::resetAll()
 {
     m_accessibilityController->reset();
+    m_eventSender->reset();
     m_gamepadController->reset();
     // m_textInputController doesn't have any state to reset.
 }
@@ -140,3 +150,8 @@ AccessibilityController* TestInterfaces::accessibilityController()
 {
     return m_internal->accessibilityController();
 }
+
+EventSender* TestInterfaces::eventSender()
+{
+    return m_internal->eventSender();
+}
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/TestInterfaces.h b/Tools/DumpRenderTree/chromium/TestRunner/TestInterfaces.h
index 5615223e6..917695461 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/TestInterfaces.h
+++ b/Tools/DumpRenderTree/chromium/TestRunner/TestInterfaces.h
@@ -37,6 +37,7 @@ class WebView;
 }
 
 class AccessibilityController;
+class EventSender;
 class TestDelegate;
 
 class TestInterfaces {
@@ -50,6 +51,7 @@ public:
     void resetAll();
 
     AccessibilityController* accessibilityController();
+    EventSender* eventSender();
 
 private:
     class Internal;
diff --git a/Tools/DumpRenderTree/chromium/TestShell.cpp b/Tools/DumpRenderTree/chromium/TestShell.cpp
index 6f991ff33..29a2a3130 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.cpp
+++ b/Tools/DumpRenderTree/chromium/TestShell.cpp
@@ -36,7 +36,6 @@
 #include "LayoutTestController.h"
 #include "MockWebPrerenderingSupport.h"
 #include "platform/WebArrayBufferView.h"
-#include "WebCompositor.h"
 #include "WebDataSource.h"
 #include "WebDocument.h"
 #include "WebElement.h"
@@ -44,23 +43,23 @@
 #include "WebHistoryItem.h"
 #include "WebIDBFactory.h"
 #include "WebTestingSupport.h"
-#include "platform/WebThread.h"
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
 #include "WebPermissions.h"
-#include "platform/WebPoint.h"
 #include "WebRuntimeFeatures.h"
 #include "WebScriptController.h"
 #include "WebSettings.h"
-#include "platform/WebSize.h"
-#include "platform/WebString.h"
-#include "platform/WebURLRequest.h"
-#include "platform/WebURLResponse.h"
 #include "WebView.h"
 #include "WebViewHost.h"
 #include "skia/ext/platform_canvas.h"
 #include "webkit/support/webkit_support.h"
 #include "webkit/support/webkit_support_gfx.h"
+#include <public/Platform.h>
+#include <public/WebCompositor.h>
+#include <public/WebPoint.h>
+#include <public/WebSize.h>
+#include <public/WebString.h>
+#include <public/WebThread.h>
+#include <public/WebURLRequest.h>
+#include <public/WebURLResponse.h>
 #include <algorithm>
 #include <cctype>
 #include <vector>
@@ -106,6 +105,7 @@ TestShell::TestShell()
     , m_testIsPreparing(false)
     , m_focusedWidget(0)
     , m_devTools(0)
+    , m_dumpPixelsForCurrentTest(false)
     , m_allowExternalPages(false)
     , m_acceleratedCompositingForVideoEnabled(false)
     , m_threadedCompositingEnabled(false)
@@ -152,7 +152,6 @@ void TestShell::initialize()
     m_webPermissions = adoptPtr(new WebPermissions(this));
     m_testInterfaces = adoptPtr(new TestInterfaces());
     m_layoutTestController = adoptPtr(new LayoutTestController(this));
-    m_eventSender = adoptPtr(new EventSender());
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
     m_notificationPresenter = adoptPtr(new NotificationPresenter(this));
 #endif
@@ -163,7 +162,7 @@ void TestShell::initialize()
     WTF::initializeThreading();
 
     if (m_threadedCompositingEnabled) {
-        m_webCompositorThread = adoptPtr(WebKit::webKitPlatformSupport()->createThread("Compositor"));
+        m_webCompositorThread = adoptPtr(WebKit::Platform::current()->createThread("Compositor"));
         WebCompositor::initialize(m_webCompositorThread.get());
     } else
         WebCompositor::initialize(0);
@@ -178,8 +177,6 @@ void TestShell::createMainWindow()
     m_webView = m_webViewHost->webView();
     m_testInterfaces->setDelegate(m_webViewHost.get());
     m_testInterfaces->setWebView(m_webView);
-    m_eventSender->setDelegate(m_webViewHost.get());
-    m_eventSender->setWebView(m_webView);
     m_drtDevToolsAgent->setWebView(m_webView);
 }
 
@@ -187,8 +184,6 @@ TestShell::~TestShell()
 {
     m_testInterfaces->setDelegate(0);
     m_testInterfaces->setWebView(0);
-    m_eventSender->setDelegate(0);
-    m_eventSender->setWebView(0);
     m_drtDevToolsAgent->setWebView(0);
 }
 
@@ -237,13 +232,16 @@ void TestShell::resetWebSettings(WebView& webView)
     m_prefs.applyTo(&webView);
 }
 
-void TestShell::runFileTest(const TestParams& params)
+void TestShell::runFileTest(const TestParams& params, bool shouldDumpPixels)
 {
     ASSERT(params.testUrl.isValid());
+    m_dumpPixelsForCurrentTest = shouldDumpPixels;
     m_testIsPreparing = true;
     m_params = params;
     string testUrl = m_params.testUrl.spec();
 
+    m_layoutTestController->setShouldGeneratePixelResults(shouldDumpPixels);
+
     if (testUrl.find("loading/") != string::npos
         || testUrl.find("loading\\") != string::npos)
         m_layoutTestController->setShouldDumpFrameLoadCallbacks(true);
@@ -301,7 +299,6 @@ void TestShell::resetTestController()
     m_webPermissions->reset();
     m_testInterfaces->resetAll();
     m_layoutTestController->reset();
-    m_eventSender->reset();
     m_webViewHost->reset();
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
     m_notificationPresenter->reset();
@@ -609,7 +606,7 @@ void TestShell::dump()
     if (dumpedAnything && m_params.printSeparators)
         m_printer.handleTextFooter();
 
-    if (m_params.dumpPixels && shouldGeneratePixelResults) {
+    if (m_dumpPixelsForCurrentTest && shouldGeneratePixelResults) {
         // Image output: we write the image data to the file given on the
         // command line (for the dump pixels argument), and the MD5 sum to
         // stdout.
@@ -730,7 +727,6 @@ void TestShell::bindJSObjectsToWindow(WebFrame* frame)
     m_testInterfaces->bindTo(frame);
     m_layoutTestController->bindToJavascript(frame, WebString::fromUTF8("layoutTestController"));
     m_layoutTestController->bindToJavascript(frame, WebString::fromUTF8("testRunner"));
-    m_eventSender->bindToJavascript(frame, WebString::fromUTF8("eventSender"));
 }
 
 WebViewHost* TestShell::createNewWindow(const WebKit::WebURL& url)
diff --git a/Tools/DumpRenderTree/chromium/TestShell.h b/Tools/DumpRenderTree/chromium/TestShell.h
index 07781636b..005d374a2 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.h
+++ b/Tools/DumpRenderTree/chromium/TestShell.h
@@ -31,8 +31,7 @@
 #ifndef TestShell_h
 #define TestShell_h
 
-#include "AccessibilityController.h"
-#include "EventSender.h"
+#include "AccessibilityControllerChromium.h"
 #include "GamepadController.h"
 #include "LayoutTestController.h"
 #include "NotificationPresenter.h"
@@ -64,7 +63,6 @@ class WebPermissions;
 
 struct TestParams {
     bool dumpTree;
-    bool dumpPixels;
     bool debugRenderTree;
     bool debugLayerTree;
     bool printSeparators;
@@ -73,7 +71,6 @@ struct TestParams {
 
     TestParams()
         : dumpTree(true)
-        , dumpPixels(false)
         , debugRenderTree(false)
         , debugLayerTree(false)
         , printSeparators(false) { }
@@ -91,7 +88,7 @@ public:
     // Returns the host for the main WebView.
     WebViewHost* webViewHost() const { return m_webViewHost.get(); }
     LayoutTestController* layoutTestController() const { return m_layoutTestController.get(); }
-    EventSender* eventSender() const { return m_eventSender.get(); }
+    EventSender* eventSender() const { return m_testInterfaces->eventSender(); }
     AccessibilityController* accessibilityController() const { return m_testInterfaces->accessibilityController(); }
 #if ENABLE(NOTIFICATIONS)
     NotificationPresenter* notificationPresenter() const { return m_notificationPresenter.get(); }
@@ -104,7 +101,7 @@ public:
     WebPermissions* webPermissions() { return m_webPermissions.get(); }
 
     void bindJSObjectsToWindow(WebKit::WebFrame*);
-    void runFileTest(const TestParams&);
+    void runFileTest(const TestParams&, bool shouldDumpPixelTests);
     void callJSGC();
     void resetTestController();
     void waitTestFinished();
@@ -214,7 +211,6 @@ private:
     OwnPtr<DRTDevToolsAgent> m_drtDevToolsAgent;
     OwnPtr<DRTDevToolsClient> m_drtDevToolsClient;
     OwnPtr<TestInterfaces> m_testInterfaces;
-    OwnPtr<EventSender> m_eventSender;
     OwnPtr<LayoutTestController> m_layoutTestController;
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
     OwnPtr<NotificationPresenter> m_notificationPresenter;
@@ -226,6 +222,7 @@ private:
 #endif
 
     TestParams m_params;
+    bool m_dumpPixelsForCurrentTest;
     int m_timeout; // timeout value in millisecond
     bool m_allowExternalPages;
     bool m_acceleratedCompositingForVideoEnabled;
diff --git a/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp b/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp
index 5f04fff5b..188158440 100644
--- a/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp
+++ b/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp
@@ -44,9 +44,12 @@
 
 namespace {
 
-const char fontMainConfigFile[] = "/data/drt/android_main_fonts.xml";
-const char fontFallbackConfigFile[] = "/data/drt/android_fallback_fonts.xml";
-const char fontsDir[] = "/data/drt/fonts/";
+// Must be same as DEVICE_DRT_DIR in Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py.
+#define DEVICE_DRT_DIR "/data/local/tmp/drt/"
+
+const char fontMainConfigFile[] = DEVICE_DRT_DIR "android_main_fonts.xml";
+const char fontFallbackConfigFile[] = DEVICE_DRT_DIR "android_fallback_fonts.xml";
+const char fontsDir[] = DEVICE_DRT_DIR "fonts/";
 
 const char optionInFIFO[] = "--in-fifo=";
 const char optionOutFIFO[] = "--out-fifo=";
@@ -72,7 +75,9 @@ void removeArg(int index, int* argc, char*** argv)
 void createFIFO(const char* fifoPath)
 {
     unlink(fifoPath);
-    if (mkfifo(fifoPath, 0600)) {
+    // 0666 is rw-rw-rw-, to allow adb shell to read/write the fifo.
+    // Explicitly call chmod to ensure the mode is set despite umask.
+    if (mkfifo(fifoPath, 0666) || chmod(fifoPath, 0666)) {
         androidLogError("Failed to create fifo %s: %s\n", fifoPath, strerror(errno));
         exit(EXIT_FAILURE);
     }
diff --git a/Tools/DumpRenderTree/chromium/TestWebPlugin.cpp b/Tools/DumpRenderTree/chromium/TestWebPlugin.cpp
index 570192cbb..bbeba6f9b 100644
--- a/Tools/DumpRenderTree/chromium/TestWebPlugin.cpp
+++ b/Tools/DumpRenderTree/chromium/TestWebPlugin.cpp
@@ -27,6 +27,7 @@
 #include "TestWebPlugin.h"
 
 #include "WebFrame.h"
+#include "WebInputEvent.h"
 #include "platform/WebGraphicsContext3D.h"
 #include "WebKit.h"
 #include "platform/WebKitPlatformSupport.h"
@@ -364,3 +365,47 @@ unsigned TestWebPlugin::loadProgram(const CString& vertexSource,
     return program;
 }
 
+bool TestWebPlugin::handleInputEvent(const WebKit::WebInputEvent& event, WebKit::WebCursorInfo& info)
+{
+    const char* eventName = 0;
+    switch (event.type) {
+    case WebKit::WebInputEvent::Undefined:           eventName = "unknown"; break;
+
+    case WebKit::WebInputEvent::MouseDown:           eventName = "MouseDown"; break;
+    case WebKit::WebInputEvent::MouseUp:             eventName = "MouseUp"; break;
+    case WebKit::WebInputEvent::MouseMove:           eventName = "MouseMove"; break;
+    case WebKit::WebInputEvent::MouseEnter:          eventName = "MouseEnter"; break;
+    case WebKit::WebInputEvent::MouseLeave:          eventName = "MouseLeave"; break;
+    case WebKit::WebInputEvent::ContextMenu:         eventName = "ContextMenu"; break;
+
+    case WebKit::WebInputEvent::MouseWheel:          eventName = "MouseWheel"; break;
+
+    case WebKit::WebInputEvent::RawKeyDown:          eventName = "RawKeyDown"; break;
+    case WebKit::WebInputEvent::KeyDown:             eventName = "KeyDown"; break;
+    case WebKit::WebInputEvent::KeyUp:               eventName = "KeyUp"; break;
+    case WebKit::WebInputEvent::Char:                eventName = "Char"; break;
+
+    case WebKit::WebInputEvent::GestureScrollBegin:  eventName = "GestureScrollBegin"; break;
+    case WebKit::WebInputEvent::GestureScrollEnd:    eventName = "GestureScrollEnd"; break;
+    case WebKit::WebInputEvent::GestureScrollUpdate: eventName = "GestureScrollUpdate"; break;
+    case WebKit::WebInputEvent::GestureFlingStart:   eventName = "GestureFlingStart"; break;
+    case WebKit::WebInputEvent::GestureFlingCancel:  eventName = "GestureFlingCancel"; break;
+    case WebKit::WebInputEvent::GestureTap:          eventName = "GestureTap"; break;
+    case WebKit::WebInputEvent::GestureTapDown:      eventName = "GestureTapDown"; break;
+    case WebKit::WebInputEvent::GestureDoubleTap:    eventName = "GestureDoubleTap"; break;
+    case WebKit::WebInputEvent::GestureTwoFingerTap: eventName = "GestureTwoFingerTap"; break;
+    case WebKit::WebInputEvent::GestureLongPress:    eventName = "GestureLongPress"; break;
+    case WebKit::WebInputEvent::GesturePinchBegin:   eventName = "GesturePinchBegin"; break;
+    case WebKit::WebInputEvent::GesturePinchEnd:     eventName = "GesturePinchEnd"; break;
+    case WebKit::WebInputEvent::GesturePinchUpdate:  eventName = "GesturePinchUpdate"; break;
+
+    case WebKit::WebInputEvent::TouchStart:          eventName = "TouchStart"; break;
+    case WebKit::WebInputEvent::TouchMove:           eventName = "TouchMove"; break;
+    case WebKit::WebInputEvent::TouchEnd:            eventName = "TouchEnd"; break;
+    case WebKit::WebInputEvent::TouchCancel:         eventName = "TouchCancel"; break;
+    }
+
+    printf("Plugin received event: %s\n", eventName ? eventName : "unknown");
+    return false;
+}
+
diff --git a/Tools/DumpRenderTree/chromium/TestWebPlugin.h b/Tools/DumpRenderTree/chromium/TestWebPlugin.h
index 4c9f2f4d2..025b11095 100644
--- a/Tools/DumpRenderTree/chromium/TestWebPlugin.h
+++ b/Tools/DumpRenderTree/chromium/TestWebPlugin.h
@@ -60,8 +60,8 @@ public:
                                 bool isVisible);
     virtual void updateFocus(bool) { }
     virtual void updateVisibility(bool) { }
-    virtual bool acceptsInputEvents() { return false; }
-    virtual bool handleInputEvent(const WebKit::WebInputEvent&, WebKit::WebCursorInfo&) { return false; }
+    virtual bool acceptsInputEvents() { return true; }
+    virtual bool handleInputEvent(const WebKit::WebInputEvent&, WebKit::WebCursorInfo&);
     virtual void didReceiveResponse(const WebKit::WebURLResponse&) { }
     virtual void didReceiveData(const char* data, int dataLength) { }
     virtual void didFinishLoading() { }
diff --git a/Tools/DumpRenderTree/chromium/WebViewHost.cpp b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
index ba5ecf0c8..115c405ec 100644
--- a/Tools/DumpRenderTree/chromium/WebViewHost.cpp
+++ b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "WebViewHost.h"
 
+#include "EventSender.h"
 #include "LayoutTestController.h"
 #include "MockGrammarCheck.h"
 #include "MockWebSpeechInputController.h"
diff --git a/Tools/DumpRenderTree/chromium/android_main_fonts.xml b/Tools/DumpRenderTree/chromium/android_main_fonts.xml
index 8a4cbe0f8..b6afa7944 100644
--- a/Tools/DumpRenderTree/chromium/android_main_fonts.xml
+++ b/Tools/DumpRenderTree/chromium/android_main_fonts.xml
@@ -23,6 +23,8 @@
             <name>Times</name>
             <name>Times New Roman</name>
             <name>Monaco</name>
+            <!-- Match chromium-linux. See comments of SubpixelPositioning in fonts.conf -->
+            <name>SubpixelPositioning</name>
         </nameset>
         <fileset>
             <file>Times_New_Roman.ttf</file>
@@ -107,10 +109,12 @@
     <family>
         <nameset>
             <name>Ahem</name>
+            <!-- Match chromium-linux. See comments of SubpixelPositioning in fonts.conf -->
+            <name>SubpixelPositioningAhem</name>
         </nameset>
         <fileset>
             <file>AHEM____.TTF</file>
         </fileset>
     </family>
 
-</familyset>
\ No newline at end of file
+</familyset>
diff --git a/Tools/DumpRenderTree/chromium/fonts.conf b/Tools/DumpRenderTree/chromium/fonts.conf
index 8e4f8d712..d337b1243 100644
--- a/Tools/DumpRenderTree/chromium/fonts.conf
+++ b/Tools/DumpRenderTree/chromium/fonts.conf
@@ -239,4 +239,14 @@
     </edit>
   </match>
 
+  <match target="pattern">
+    <!-- See comments above -->
+    <test name="family" compare="eq">
+      <string>SubpixelPositioningAhem</string>
+    </test>
+    <edit name="family" mode="assign">
+      <string>ahem</string>
+    </edit>
+  </match>
+
 </fontconfig>
diff --git a/Tools/DumpRenderTree/efl/CMakeLists.txt b/Tools/DumpRenderTree/efl/CMakeLists.txt
index e1dacf901..067dbd32b 100644
--- a/Tools/DumpRenderTree/efl/CMakeLists.txt
+++ b/Tools/DumpRenderTree/efl/CMakeLists.txt
@@ -1,4 +1,5 @@
 SET(DumpRenderTree_SOURCES
+    ${TOOLS_DIR}/DumpRenderTree/DumpRenderTreeCommon.cpp
     ${TOOLS_DIR}/DumpRenderTree/CyclicRedundancyCheck.cpp
     ${TOOLS_DIR}/DumpRenderTree/GCController.cpp
     ${TOOLS_DIR}/DumpRenderTree/LayoutTestController.cpp
diff --git a/Tools/DumpRenderTree/efl/DumpRenderTree.cpp b/Tools/DumpRenderTree/efl/DumpRenderTree.cpp
index c2c9d71c0..0713cb60c 100644
--- a/Tools/DumpRenderTree/efl/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/efl/DumpRenderTree.cpp
@@ -48,6 +48,7 @@
 #include <getopt.h>
 #include <stdlib.h>
 #include <unistd.h>
+#include <wtf/Assertions.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringBuilder.h>
@@ -64,7 +65,7 @@ extern Ewk_History_Item* prevTestBFItem;
 RefPtr<LayoutTestController> gLayoutTestController;
 volatile bool done = false;
 
-static int dumpPixels = false;
+static bool dumpPixelsForCurrentTest;
 static int dumpTree = true;
 static int printSeparators = true;
 static int useX11Window = false;
@@ -192,7 +193,6 @@ static bool parseCommandLineOptions(int argc, char** argv)
 {
     static const option options[] = {
         {"notree", no_argument, &dumpTree, false},
-        {"pixel-tests", no_argument, &dumpPixels, true},
         {"tree", no_argument, &dumpTree, true},
         {"gui", no_argument, &useX11Window, true},
         {0, 0, 0, 0}
@@ -210,32 +210,6 @@ static bool parseCommandLineOptions(int argc, char** argv)
     return true;
 }
 
-static String getFinalTestURL(const String& testURL)
-{
-    const size_t hashSeparatorPos = testURL.find("'");
-    if (hashSeparatorPos != notFound)
-        return getFinalTestURL(testURL.left(hashSeparatorPos));
-
-    // Convert the path into a full file URL if it does not look
-    // like an HTTP/S URL (doesn't start with http:// or https://).
-    if (!testURL.startsWith("http://") && !testURL.startsWith("https://")) {
-        char* cFilePath = ecore_file_realpath(testURL.utf8().data());
-        const String filePath = String::fromUTF8(cFilePath);
-        free(cFilePath);
-
-        if (ecore_file_exists(filePath.utf8().data()))
-            return String("file://") + filePath;
-    }
-
-    return testURL;
-}
-
-static String getExpectedPixelHash(const String& testURL)
-{
-    const size_t hashSeparatorPos = testURL.find("'");
-    return (hashSeparatorPos != notFound) ? testURL.substring(hashSeparatorPos + 1) : String();
-}
-
 static inline bool isGlobalHistoryTest(const String& cTestPathOrURL)
 {
     return cTestPathOrURL.contains("/globalhistory/");
@@ -267,13 +241,31 @@ static void createLayoutTestController(const String& testURL, const String& expe
     }
 }
 
-static void runTest(const char* cTestPathOrURL)
+static String getFinalTestURL(const String& testURL)
+{
+    if (!testURL.startsWith("http://") && !testURL.startsWith("https://")) {
+        char* cFilePath = ecore_file_realpath(testURL.utf8().data());
+        const String filePath = String::fromUTF8(cFilePath);
+        free(cFilePath);
+
+        if (ecore_file_exists(filePath.utf8().data()))
+            return String("file://") + filePath;
+    }
+
+    return testURL;
+}
+
+static void runTest(const char* inputLine)
 {
-    const String testPathOrURL = String::fromUTF8(cTestPathOrURL);
+    TestCommand command = parseInputLine(inputLine);
+    const String testPathOrURL(command.pathOrURL.c_str());
     ASSERT(!testPathOrURL.isEmpty());
+    dumpPixelsForCurrentTest = command.shouldDumpPixels;
+    const String expectedPixelHash(command.expectedPixelHash.c_str());
 
+    // Convert the path into a full file URL if it does not look
+    // like an HTTP/S URL (doesn't start with http:// or https://).
     const String testURL = getFinalTestURL(testPathOrURL);
-    const String expectedPixelHash = getExpectedPixelHash(testPathOrURL);
 
     browser->resetDefaultsToConsistentValues();
     createLayoutTestController(testURL, expectedPixelHash);
@@ -351,7 +343,7 @@ static bool shouldDumpFrameScrollPosition()
 
 static bool shouldDumpPixelsAndCompareWithExpected()
 {
-    return dumpPixels && gLayoutTestController->generatePixelResults() && !gLayoutTestController->dumpDOMAsWebArchive() && !gLayoutTestController->dumpSourceAsWebArchive();
+    return dumpPixelsForCurrentTest && gLayoutTestController->generatePixelResults() && !gLayoutTestController->dumpDOMAsWebArchive() && !gLayoutTestController->dumpSourceAsWebArchive();
 }
 
 static bool shouldDumpBackForwardList()
@@ -450,6 +442,8 @@ int main(int argc, char** argv)
     if (!initEfl())
         return EXIT_FAILURE;
 
+    WTFInstallReportBacktraceOnCrashHook();
+
     OwnPtr<Ecore_Evas> ecoreEvas = adoptPtr(initEcoreEvas());
     browser = DumpRenderTreeChrome::create(ecore_evas_get(ecoreEvas.get()));
     addFontsToEnvironment();
@@ -458,7 +452,7 @@ int main(int argc, char** argv)
         printSeparators = true;
         runTestingServerLoop();
     } else {
-        printSeparators = (optind < argc - 1 || (dumpPixels && dumpTree));
+        printSeparators = (optind < argc - 1 || (dumpPixelsForCurrentTest && dumpTree));
         for (int i = optind; i != argc; ++i)
             runTest(argv[i]);
     }
diff --git a/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp b/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp
index 03e8148bc..0d1fa4b63 100644
--- a/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp
+++ b/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp
@@ -682,6 +682,15 @@ void DumpRenderTreeChrome::onFrameProvisionalLoad(void*, Evas_Object* frame, voi
         const String frameName(DumpRenderTreeSupportEfl::suitableDRTFrameName(frame));
         printf("%s - didStartProvisionalLoadForFrame\n", frameName.utf8().data());
     }
+
+    if (!topLoadingFrame && !done)
+        topLoadingFrame = frame;
+  
+    if (!done && gLayoutTestController->stopProvisionalFrameLoads()) { 
+        const String frameName(DumpRenderTreeSupportEfl::suitableDRTFrameName(frame));
+        printf("%s - stopping load in didStartProvisionalLoadForFrame callback\n", frameName.utf8().data());
+        ewk_frame_stop(frame);
+    }   
 }
 
 void DumpRenderTreeChrome::onFrameProvisionalLoadFailed(void*, Evas_Object* frame, void*)
diff --git a/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp b/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
index bf986e1a8..71891dcb4 100644
--- a/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
+++ b/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
@@ -786,7 +786,11 @@ void LayoutTestController::evaluateScriptInIsolatedWorld(unsigned worldID, JSObj
 
 void LayoutTestController::removeAllVisitedLinks()
 {
-    notImplemented();
+    Ewk_History* history = ewk_view_history_get(browser->mainView());
+    if (!history)
+        return;
+
+    ewk_history_clear(history);
 }
 
 bool LayoutTestController::callShouldCloseOnWebView()
diff --git a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
index 57cd05917..fae866609 100644
--- a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
@@ -73,7 +73,7 @@ extern gchar* webkit_web_frame_get_response_mime_type(WebKitWebFrame* frame);
 
 volatile bool done;
 static bool printSeparators;
-static int dumpPixels;
+static bool dumpPixelsForCurrentTest;
 static int dumpTree = 1;
 static int useTimeoutWatchdog = 1;
 
@@ -97,7 +97,7 @@ static WebKitWebHistoryItem* prevTestBFItem = NULL;
 
 const unsigned historyItemIndent = 8;
 
-static void runTest(const string& testPathOrURL);
+static void runTest(const string& inputLine);
 
 static void didRunInsecureContent(WebKitWebFrame*, WebKitSecurityOrigin*, const char* url);
 
@@ -544,7 +544,6 @@ static void initializeGlobalsFromCommandLineOptions(int argc, char *argv[])
 {
     struct option options[] = {
         {"notree", no_argument, &dumpTree, false},
-        {"pixel-tests", no_argument, &dumpPixels, true},
         {"tree", no_argument, &dumpTree, true},
         {"no-timeout", no_argument, &useTimeoutWatchdog, false},
         {NULL, 0, NULL, 0}
@@ -624,7 +623,7 @@ void dump()
         }
     }
 
-    if (dumpPixels
+    if (dumpPixelsForCurrentTest
      && gLayoutTestController->generatePixelResults()
      && !gLayoutTestController->dumpDOMAsWebArchive()
      && !gLayoutTestController->dumpSourceAsWebArchive()) {
@@ -687,18 +686,13 @@ static void sendPixelResultsEOF()
     fflush(stderr);
 }
 
-static void runTest(const string& testPathOrURL)
+static void runTest(const string& inputLine)
 {
-    ASSERT(!testPathOrURL.empty());
+    ASSERT(!inputLine.empty());
 
-    // Look for "'" as a separator between the path or URL, and the pixel dump hash that follows.
-    string testURL(testPathOrURL);
-    string expectedPixelHash;
-    size_t separatorPos = testURL.find("'");
-    if (separatorPos != string::npos) {
-        testURL = string(testPathOrURL, 0, separatorPos);
-        expectedPixelHash = string(testPathOrURL, separatorPos + 1);
-    }
+    TestCommand command = parseInputLine(inputLine);
+    string& testURL = command.pathOrURL;
+    dumpPixelsForCurrentTest = command.shouldDumpPixels;
 
     // Convert the path into a full file URL if it does not look
     // like an HTTP/S URL (doesn't start with http:// or https://).
@@ -712,7 +706,7 @@ static void runTest(const string& testPathOrURL)
 
     resetDefaultsToConsistentValues();
 
-    gLayoutTestController = LayoutTestController::create(testURL, expectedPixelHash);
+    gLayoutTestController = LayoutTestController::create(testURL, command.expectedPixelHash);
     topLoadingFrame = 0;
     done = false;
 
@@ -1447,7 +1441,7 @@ int main(int argc, char* argv[])
         printSeparators = true;
         runTestingServerLoop();
     } else {
-        printSeparators = (optind < argc-1 || (dumpPixels && dumpTree));
+        printSeparators = (optind < argc-1 || (dumpPixelsForCurrentTest && dumpTree));
         for (int i = optind; i != argc; ++i)
             runTest(argv[i]);
     }
diff --git a/Tools/DumpRenderTree/gtk/EditingCallbacks.cpp b/Tools/DumpRenderTree/gtk/EditingCallbacks.cpp
index 2ef80dc39..c5fa009fb 100644
--- a/Tools/DumpRenderTree/gtk/EditingCallbacks.cpp
+++ b/Tools/DumpRenderTree/gtk/EditingCallbacks.cpp
@@ -138,7 +138,7 @@ gboolean shouldDeleteRange(WebKitWebView* webView, WebKitDOMRange* range)
 
 gboolean shouldShowDeleteInterfaceForElement(WebKitWebView* webView, WebKitDOMHTMLElement* element)
 {
-    GOwnPtr<gchar> elementClassName(webkit_dom_html_element_get_class_name(element));
+    GOwnPtr<gchar> elementClassName(webkit_dom_element_get_class_name(WEBKIT_DOM_ELEMENT(element)));
     return g_str_equal(elementClassName.get(), "needsDeletionUI");
 }
 
diff --git a/Tools/DumpRenderTree/mac/DumpRenderTree.mm b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
index abba535ed..cbd893f85 100644
--- a/Tools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -140,7 +140,7 @@ static HistoryDelegate *historyDelegate;
 PolicyDelegate *policyDelegate;
 StorageTrackerDelegate *storageDelegate;
 
-static int dumpPixels;
+static bool dumpPixelsForCurrentTest;
 static int threaded;
 static int dumpTree = YES;
 static int useTimeoutWatchdog = YES;
@@ -322,6 +322,7 @@ static NSSet *allowedFontFamilySet()
         @"Skia",
         @"STFangsong",
         @"STHeiti",
+        @"STIXGeneral",
         @"STKaiti",
         @"STSong",
         @"Symbol",
@@ -780,7 +781,6 @@ static void initializeGlobalsFromCommandLineOptions(int argc, const char *argv[]
 {
     struct option options[] = {
         {"notree", no_argument, &dumpTree, NO},
-        {"pixel-tests", no_argument, &dumpPixels, YES},
         {"tree", no_argument, &dumpTree, YES},
         {"threaded", no_argument, &threaded, YES},
         {"complex-text", no_argument, &forceComplexText, YES},
@@ -849,7 +849,7 @@ void dumpRenderTree(int argc, const char *argv[])
     initializeGlobalsFromCommandLineOptions(argc, argv);
     prepareConsistentTestingEnvironment();
     addTestPluginsToPluginSearchPath(argv[0]);
-    if (dumpPixels)
+    if (dumpPixelsForCurrentTest)
         installSignalHandlers();
 
     if (forceComplexText)
@@ -874,7 +874,7 @@ void dumpRenderTree(int argc, const char *argv[])
         printSeparators = YES;
         runTestingServerLoop();
     } else {
-        printSeparators = (optind < argc-1 || (dumpPixels && dumpTree));
+        printSeparators = (optind < argc - 1 || (dumpPixelsForCurrentTest && dumpTree));
         for (int i = optind; i != argc; ++i)
             runTest(argv[i]);
     }
@@ -1195,7 +1195,7 @@ void dump()
         }            
     }
 
-    if (dumpPixels && gLayoutTestController->generatePixelResults())
+    if (dumpPixelsForCurrentTest && gLayoutTestController->generatePixelResults())
         // FIXME: when isPrinting is set, dump the image with page separators.
         dumpWebViewAsPixelsAndCompareWithExpected(gLayoutTestController->expectedPixelHash());
 
@@ -1276,19 +1276,13 @@ static void resetWebViewToConsistentStateBeforeTesting()
     [mainFrame _clearOpener];
 }
 
-static void runTest(const string& testPathOrURL)
+static void runTest(const string& inputLine)
 {
-    ASSERT(!testPathOrURL.empty());
-    
-    // Look for "'" as a separator between the path or URL, and the pixel dump hash that follows.
-    string pathOrURL(testPathOrURL);
-    string expectedPixelHash;
-    
-    size_t separatorPos = pathOrURL.find("'");
-    if (separatorPos != string::npos) {
-        pathOrURL = string(testPathOrURL, 0, separatorPos);
-        expectedPixelHash = string(testPathOrURL, separatorPos + 1);
-    }
+    ASSERT(!inputLine.empty());
+
+    TestCommand command = parseInputLine(inputLine);
+    const string& pathOrURL = command.pathOrURL;
+    dumpPixelsForCurrentTest = command.shouldDumpPixels;
 
     NSString *pathOrURLString = [NSString stringWithUTF8String:pathOrURL.c_str()];
     if (!pathOrURLString) {
@@ -1310,7 +1304,7 @@ static void runTest(const string& testPathOrURL)
     
     resetWebViewToConsistentStateBeforeTesting();
 
-    gLayoutTestController = LayoutTestController::create(testURL, expectedPixelHash);
+    gLayoutTestController = LayoutTestController::create(testURL, command.expectedPixelHash);
     topLoadingFrame = nil;
     ASSERT(!draggingInfo); // the previous test should have called eventSender.mouseUp to drop!
     releaseAndZero(&draggingInfo);
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTree.pro b/Tools/DumpRenderTree/qt/DumpRenderTree.pro
index f47fb4344..6cd068ccf 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTree.pro
+++ b/Tools/DumpRenderTree/qt/DumpRenderTree.pro
@@ -13,18 +13,19 @@ WEBKIT += wtf webcore
 !v8: WEBKIT += javascriptcore
 
 INCLUDEPATH += \
+    $$PWD/ \
     $$PWD/.. \
     $${ROOT_WEBKIT_DIR}/Source/WebKit/qt/WebCoreSupport \
     $${ROOT_WEBKIT_DIR}/Source/WTF
 
-QT = core gui network testlib webkit
+QT = core gui network testlib webkit widgets printsupport
 macx: QT += xml
-haveQt(5): QT += widgets printsupport
 
 contains(DEFINES, HAVE_FONTCONFIG=1): PKGCONFIG += fontconfig
 
 HEADERS += \
     $$PWD/../WorkQueue.h \
+    $$PWD/../DumpRenderTree.h \
     DumpRenderTreeQt.h \
     EventSenderQt.h \
     TextInputControllerQt.h \
@@ -36,6 +37,7 @@ HEADERS += \
 
 SOURCES += \
     $$PWD/../WorkQueue.cpp \
+    $$PWD/../DumpRenderTreeCommon.cpp \
     DumpRenderTreeQt.cpp \
     EventSenderQt.cpp \
     TextInputControllerQt.cpp \
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
index 0ecf622f3..8f64e2750 100755
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
@@ -30,6 +30,7 @@
  */
 
 #include "config.h"
+#include "DumpRenderTree.h"
 
 #include "DumpRenderTreeQt.h"
 #include "DumpRenderTreeSupportQt.h"
@@ -388,8 +389,7 @@ WebViewGraphicsBased::WebViewGraphicsBased(QWidget* parent)
 }
 
 DumpRenderTree::DumpRenderTree()
-    : m_dumpPixelsForAllTests(false)
-    , m_stdin(0)
+    : m_stdin(0)
     , m_enableTextOutput(false)
     , m_standAloneMode(false)
     , m_graphicsBased(false)
@@ -604,10 +604,8 @@ void DumpRenderTree::open(const QUrl& url)
     if (isWebInspectorTest(url))
         layoutTestController()->showWebInspector();
 
-    if (isDumpAsTextTest(url)) {
+    if (isDumpAsTextTest(url))
         layoutTestController()->dumpAsText();
-        setDumpPixelsForAllTests(false);
-    }
 
     if (isGlobalHistoryTest(url))
         layoutTestController()->dumpHistoryCallbacks();
@@ -690,44 +688,27 @@ void DumpRenderTree::loadNextTestInStandAloneMode()
 
 void DumpRenderTree::processLine(const QString &input)
 {
-    QString line = input;
-
-    m_dumpPixelsForCurrentTest = false;
-    m_expectedHash = QString();
-    // single quote marks the pixel dump hash
-    int indexOfFirstSeparator = line.indexOf('\'');
-    int indexOfSecondSeparator = line.indexOf('\'', indexOfFirstSeparator + 1);
-    if (indexOfFirstSeparator > -1) {
-        int indexOfPixelHash = indexOfFirstSeparator + 1;
-
-        // NRWT passes --pixel-test if we should dump pixels for the test.
-        const QString expectedArg(QLatin1String("--pixel-test"));
-        QString argTest = line.mid(indexOfFirstSeparator + 1, expectedArg.length());
-        if (argTest == expectedArg) {
-            m_dumpPixelsForCurrentTest = true;
-            indexOfPixelHash = indexOfSecondSeparator == -1 ? -1 : indexOfSecondSeparator + 1;
-        }
-        if (indexOfPixelHash != -1 && indexOfPixelHash < line.size())
-            m_expectedHash = line.mid(indexOfPixelHash);
-        line.remove(indexOfFirstSeparator, line.length());
-    }
-
-    if (line.startsWith(QLatin1String("http:"))
-            || line.startsWith(QLatin1String("https:"))
-            || line.startsWith(QLatin1String("file:"))
-            || line == QLatin1String("about:blank")) {
-        open(QUrl(line));
+    TestCommand command = parseInputLine(std::string(input.toLatin1().constData()));
+    QString pathOrURL = QLatin1String(command.pathOrURL.c_str());
+    m_dumpPixelsForCurrentTest = command.shouldDumpPixels;
+    m_expectedHash = QLatin1String(command.expectedPixelHash.c_str());
+
+    if (pathOrURL.startsWith(QLatin1String("http:"))
+            || pathOrURL.startsWith(QLatin1String("https:"))
+            || pathOrURL.startsWith(QLatin1String("file:"))
+            || pathOrURL == QLatin1String("about:blank")) {
+        open(QUrl(pathOrURL));
     } else {
-        QFileInfo fi(line);
+        QFileInfo fi(pathOrURL);
 
         if (!fi.exists()) {
             QDir currentDir = QDir::currentPath();
 
             // Try to be smart about where the test is located
             if (currentDir.dirName() == QLatin1String("LayoutTests"))
-                fi = QFileInfo(currentDir, line.replace(QRegExp(".*?LayoutTests/(.*)"), "\\1"));
-            else if (!line.contains(QLatin1String("LayoutTests")))
-                fi = QFileInfo(currentDir, line.prepend(QLatin1String("LayoutTests/")));
+                fi = QFileInfo(currentDir, pathOrURL.replace(QRegExp(".*?LayoutTests/(.*)"), "\\1"));
+            else if (!pathOrURL.contains(QLatin1String("LayoutTests")))
+                fi = QFileInfo(currentDir, pathOrURL.prepend(QLatin1String("LayoutTests/")));
 
             if (!fi.exists()) {
                 emit ready();
@@ -741,11 +722,6 @@ void DumpRenderTree::processLine(const QString &input)
     fflush(stdout);
 }
 
-void DumpRenderTree::setDumpPixelsForAllTests(bool dump)
-{
-    m_dumpPixelsForAllTests = dump;
-}
-
 void DumpRenderTree::closeRemainingWindows()
 {
     foreach (QObject* widget, windows)
@@ -757,7 +733,6 @@ void DumpRenderTree::initJSObjects()
 {
     QWebFrame *frame = qobject_cast<QWebFrame*>(sender());
     Q_ASSERT(frame);
-    frame->addToJavaScriptWindowObject(QLatin1String("layoutTestController"), m_controller);
     frame->addToJavaScriptWindowObject(QLatin1String("testRunner"), m_controller);
     frame->addToJavaScriptWindowObject(QLatin1String("eventSender"), m_eventSender);
     frame->addToJavaScriptWindowObject(QLatin1String("textInputController"), m_textInputController);
@@ -961,7 +936,7 @@ void DumpRenderTree::dump()
     fputs("#EOF\n", stdout);
     fputs("#EOF\n", stderr);
 
-    if ((m_dumpPixelsForAllTests || m_dumpPixelsForCurrentTest) && !m_controller->shouldDumpAsText()) {
+    if (m_dumpPixelsForCurrentTest && !m_controller->shouldDumpAsText()) {
         QImage image;
         if (!m_controller->isPrinting()) {
             image = QImage(m_page->viewportSize(), QImage::Format_ARGB32);
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
index c4f92983f..a9cf3cd73 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
@@ -82,8 +82,6 @@ public:
     void setGraphicsBased(bool flag) { m_graphicsBased = flag; }
     bool isGraphicsBased() { return m_graphicsBased; }
 
-    void setDumpPixelsForAllTests(bool);
-
     void closeRemainingWindows();
     void resetToConsistentStateBeforeTesting(const QUrl&);
 
@@ -142,7 +140,6 @@ private:
     QString dumpFrameScrollPosition(QWebFrame* frame);
     LayoutTestController *m_controller;
 
-    bool m_dumpPixelsForAllTests;
     bool m_dumpPixelsForCurrentTest;
     QString m_expectedHash;
     QStringList m_standAloneModeTestList;
diff --git a/Tools/DumpRenderTree/qt/EventSenderQt.cpp b/Tools/DumpRenderTree/qt/EventSenderQt.cpp
index c0506efe2..58a75a728 100644
--- a/Tools/DumpRenderTree/qt/EventSenderQt.cpp
+++ b/Tools/DumpRenderTree/qt/EventSenderQt.cpp
@@ -31,6 +31,7 @@
 
 #include <QGraphicsSceneMouseEvent>
 #include <QtTest/QtTest>
+#include <qpa/qwindowsysteminterface.h>
 
 #define KEYCODE_DEL         127
 #define KEYCODE_BACKSPACE   8
@@ -477,13 +478,11 @@ void EventSender::touchEnd()
     m_touchActive = false;
 }
 
-#if QT_VERSION >= 0x050000
 void EventSender::touchCancel()
 {
     sendTouchEvent(QEvent::TouchCancel);
     m_touchActive = false;
 }
-#endif
 
 void EventSender::clearTouchPoints()
 {
@@ -511,7 +510,6 @@ void EventSender::cancelTouchPoint(int index)
 
 void EventSender::sendTouchEvent(QEvent::Type type)
 {
-#if HAVE(QT5)
     static QTouchDevice* device = 0;
     if (!device) {
         device = new QTouchDevice;
@@ -520,9 +518,6 @@ void EventSender::sendTouchEvent(QEvent::Type type)
     }
 
     QTouchEvent event(type, device, m_touchModifiers);
-#else
-    QTouchEvent event(type, QTouchEvent::TouchScreen, m_touchModifiers);
-#endif
     event.setTouchPoints(m_touchPoints);
     sendEvent(m_page, &event);
     QList<QTouchEvent::TouchPoint>::Iterator it = m_touchPoints.begin();
diff --git a/Tools/DumpRenderTree/qt/EventSenderQt.h b/Tools/DumpRenderTree/qt/EventSenderQt.h
index 2ca1b1184..4ec6f92bb 100644
--- a/Tools/DumpRenderTree/qt/EventSenderQt.h
+++ b/Tools/DumpRenderTree/qt/EventSenderQt.h
@@ -74,9 +74,7 @@ public slots:
     void touchStart();
     void touchMove();
     void touchEnd();
-#if QT_VERSION >= 0x050000
     void touchCancel();
-#endif
     void zoomPageIn();
     void zoomPageOut();
     void textZoomIn();
diff --git a/Tools/DumpRenderTree/qt/ImageDiff.cpp b/Tools/DumpRenderTree/qt/ImageDiff.cpp
index a1da2e026..7afa1ee18 100644
--- a/Tools/DumpRenderTree/qt/ImageDiff.cpp
+++ b/Tools/DumpRenderTree/qt/ImageDiff.cpp
@@ -119,7 +119,7 @@ int main(int argc, char* argv[])
                 if (difference <= tolerance) {
                     difference = 0;
                 } else {
-                    difference = qRound(difference * 100) / 100;
+                    difference = qRound(difference * 100) / 100.0f;
                     difference = qMax(difference, qreal(0.01));
                 }
 
diff --git a/Tools/DumpRenderTree/qt/ImageDiff.pro b/Tools/DumpRenderTree/qt/ImageDiff.pro
index 729ec259a..40bcdfb3c 100644
--- a/Tools/DumpRenderTree/qt/ImageDiff.pro
+++ b/Tools/DumpRenderTree/qt/ImageDiff.pro
@@ -9,7 +9,6 @@ TEMPLATE = app
 TARGET = ImageDiff
 DESTDIR = $$ROOT_BUILD_DIR/bin
 
-QT = core gui
-haveQt(5): QT += widgets
+QT = core gui widgets
 
 SOURCES = ImageDiff.cpp
diff --git a/Tools/DumpRenderTree/qt/main.cpp b/Tools/DumpRenderTree/qt/main.cpp
index 22fbc75c3..410ac7c35 100644
--- a/Tools/DumpRenderTree/qt/main.cpp
+++ b/Tools/DumpRenderTree/qt/main.cpp
@@ -53,7 +53,6 @@
 #endif
 
 #include <limits.h>
-#include <signal.h>
 
 #include <wtf/ExportMacros.h>
 #include <wtf/Assertions.h>
@@ -67,11 +66,11 @@ void messageHandler(QtMsgType type, const char *message)
     // do nothing
 }
 
-// We only support -v or --pixel-tests or --stdout or --stderr or -, all the others will be 
+// We only support -v or --stdout or --stderr or -, all the others will be
 // pass as test case name (even -abc.html is a valid test case name)
 bool isOption(const QString& str)
 {
-    return str == QString("-v") || str == QString("--pixel-tests")
+    return str == QString("-v")
            || str == QString("--stdout") || str == QString("--stderr")
            || str == QString("--timeout") || str == QString("--no-timeout")
            || str == QString("-");
@@ -90,39 +89,11 @@ QString takeOptionValue(QStringList& arguments, int index)
 
 void printUsage()
 {
-    fprintf(stderr, "Usage: DumpRenderTree [-v|--pixel-tests] [--stdout output_filename] [-stderr error_filename] [--no-timeout] [--timeout timeout_MS] filename [filename2..n]\n");
-    fprintf(stderr, "Or folder containing test files: DumpRenderTree [-v|--pixel-tests] dirpath\n");
+    fprintf(stderr, "Usage: DumpRenderTree [-v] [--stdout output_filename] [-stderr error_filename] [--no-timeout] [--timeout timeout_MS] filename [filename2..n]\n");
+    fprintf(stderr, "Or folder containing test files: DumpRenderTree [-v] dirpath\n");
     fflush(stderr);
 }
 
-#if HAVE(SIGNAL_H)
-typedef void (*SignalHandler)(int);
-
-static NO_RETURN void crashHandler(int sig)
-{
-    WTFReportBacktrace();
-    exit(128 + sig);
-}
-
-static void setupSignalHandlers(SignalHandler handler)
-{
-    signal(SIGILL, handler);    /* 4:   illegal instruction (not reset when caught) */
-    signal(SIGTRAP, handler);   /* 5:   trace trap (not reset when caught) */
-    signal(SIGFPE, handler);    /* 8:   floating point exception */
-    signal(SIGBUS, handler);    /* 10:  bus error */
-    signal(SIGSEGV, handler);   /* 11:  segmentation violation */
-    signal(SIGSYS, handler);    /* 12:  bad argument to system call */
-    signal(SIGPIPE, handler);   /* 13:  write on a pipe with no reader */
-    signal(SIGXCPU, handler);   /* 24:  exceeded CPU time limit */
-    signal(SIGXFSZ, handler);   /* 25:  exceeded file size limit */
-}
-
-static void WTFCrashHook()
-{
-    setupSignalHandlers(SIG_DFL);
-}
-#endif
-
 int main(int argc, char* argv[])
 {
 #ifdef Q_OS_WIN
@@ -152,32 +123,9 @@ int main(int argc, char* argv[])
     QApplication app(argc, argv);
     app.setQuitOnLastWindowClosed(false);
 
-#if HAVE(QT5)
     QCoreApplication::setAttribute(Qt::AA_Use96Dpi, true);
-#else
-#ifdef Q_WS_X11
-    QX11Info::setAppDpiY(0, 96);
-    QX11Info::setAppDpiX(0, 96);
-#endif
-
-   /*
-    * QApplication will initialize the default application font based
-    * on the application DPI at construction time, which might be
-    * different from the DPI we explicitly set using QX11Info above.
-    * See: https://bugreports.qt.nokia.com/browse/QTBUG-21603
-    *
-    * To ensure that the application font DPI matches the application
-    * DPI, we override the application font using the font we get from
-    * a QWidget, which has already been resolved against the existing
-    * default font, but with the correct paint-device DPI.
-   */
-    QApplication::setFont(QWidget().font());
-#endif
 
-#if HAVE(SIGNAL_H)
-    setupSignalHandlers(&crashHandler);
-    WTFSetCrashHook(&WTFCrashHook);
-#endif
+    WTFInstallReportBacktraceOnCrashHook();
 
     QStringList args = app.arguments();
     if (args.count() < (!suppressQtDebugOutput ? 3 : 2)) {
@@ -190,13 +138,7 @@ int main(int argc, char* argv[])
 
     WebCore::DumpRenderTree dumper;
 
-    int index = args.indexOf(QLatin1String("--pixel-tests"));
-    if (index != -1) {
-        dumper.setDumpPixelsForAllTests(true);
-        args.removeAt(index);
-    }
-
-    index = args.indexOf(QLatin1String("--stdout"));
+    int index = args.indexOf(QLatin1String("--stdout"));
     if (index != -1) {
         QString fileName = takeOptionValue(args, index);
         dumper.setRedirectOutputFileName(fileName);
diff --git a/Tools/DumpRenderTree/win/DumpRenderTree.cpp b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
index f402a02ca..312430d56 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
@@ -80,7 +80,7 @@ static LPCWSTR fontsEnvironmentVariable = L"WEBKIT_TESTFONTS";
 const LPCWSTR kDumpRenderTreeClassName = L"DumpRenderTreeWindow";
 
 static bool dumpTree = true;
-static bool dumpPixels;
+static bool dumpPixelsForCurrentTest;
 static bool dumpAllPixels;
 static bool printSeparators;
 static bool leakChecking = false;
@@ -759,7 +759,7 @@ void dump()
         fflush(stderr);
     }
 
-    if (dumpPixels
+    if (dumpPixelsForCurrentTest
      && gLayoutTestController->generatePixelResults()
      && !gLayoutTestController->dumpDOMAsWebArchive()
      && !gLayoutTestController->dumpSourceAsWebArchive())
@@ -948,20 +948,14 @@ static void sizeWebViewForCurrentTest()
     ::SetWindowPos(webViewWindow, 0, 0, 0, width, height, SWP_NOMOVE);
 }
 
-static void runTest(const string& testPathOrURL)
+static void runTest(const string& inputLine)
 {
+    TestCommand command = parseInputLine(inputLine);
+    const string& pathOrURL = command.pathOrURL;
+    dumpPixelsForCurrentTest = command.shouldDumpPixels;
+
     static BSTR methodBStr = SysAllocString(TEXT("GET"));
 
-    // Look for "'" as a separator between the path or URL, and the pixel dump hash that follows.
-    string pathOrURL(testPathOrURL);
-    string expectedPixelHash;
-    
-    size_t separatorPos = pathOrURL.find("'");
-    if (separatorPos != string::npos) {
-        pathOrURL = string(testPathOrURL, 0, separatorPos);
-        expectedPixelHash = string(testPathOrURL, separatorPos + 1);
-    }
-    
     BSTR urlBStr;
  
     CFStringRef str = CFStringCreateWithCString(0, pathOrURL.c_str(), kCFStringEncodingWindowsLatin1);
@@ -983,7 +977,7 @@ static void runTest(const string& testPathOrURL)
 
     CFRelease(url);
 
-    ::gLayoutTestController = LayoutTestController::create(pathOrURL, expectedPixelHash);
+    ::gLayoutTestController = LayoutTestController::create(pathOrURL, command.expectedPixelHash);
     done = false;
     topLoadingFrame = 0;
 
@@ -1337,11 +1331,6 @@ extern "C" __declspec(dllexport) int WINAPI dllLauncherEntryPoint(int argc, cons
             continue;
         }
 
-        if (!stricmp(argv[i], "--pixel-tests")) {
-            dumpPixels = true;
-            continue;
-        }
-
         if (!stricmp(argv[i], "--complex-text")) {
             forceComplexText = true;
             continue;
diff --git a/Tools/DumpRenderTree/win/DumpRenderTree.vcproj b/Tools/DumpRenderTree/win/DumpRenderTree.vcproj
index 4843c390e..7e242a1cd 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTree.vcproj
+++ b/Tools/DumpRenderTree/win/DumpRenderTree.vcproj
@@ -563,6 +563,10 @@
 			>
 		</File>
 		<File
+			RelativePath="..\DumpRenderTreeCommon.cpp"
+			>
+		</File>
+		<File
 			RelativePath="..\DumpRenderTreePrefix.h"
 			>
 		</File>
diff --git a/Tools/DumpRenderTree/wscript b/Tools/DumpRenderTree/wscript
index 645c7d641..b32929450 100644
--- a/Tools/DumpRenderTree/wscript
+++ b/Tools/DumpRenderTree/wscript
@@ -40,6 +40,7 @@ include_paths = [
                 'wx'
                 ]
 sources = [
+            'DumpRenderTreeCommon.cpp',
             'LayoutTestController.cpp',
             'WorkQueue.cpp',
             'wx/DumpRenderTreeWx.cpp',
diff --git a/Tools/DumpRenderTree/wx/DumpRenderTreeWx.cpp b/Tools/DumpRenderTree/wx/DumpRenderTreeWx.cpp
index 31add11a2..45b852d88 100644
--- a/Tools/DumpRenderTree/wx/DumpRenderTreeWx.cpp
+++ b/Tools/DumpRenderTree/wx/DumpRenderTreeWx.cpp
@@ -50,7 +50,7 @@
 volatile bool done = true;
 volatile bool notified = false;
 static bool printSeparators = true;
-static int dumpPixels;
+static int dumpPixelsForCurrentTest;
 static int dumpTree = 1;
 time_t startTime; // to detect timeouts / failed tests
 
@@ -203,7 +203,7 @@ void dump()
         }
     }
 
-    if (dumpPixels
+    if (dumpPixelsForCurrentTest
         && gLayoutTestController->generatePixelResults()
         && !gLayoutTestController->dumpDOMAsWebArchive()
         && !gLayoutTestController->dumpSourceAsWebArchive()) {
@@ -218,26 +218,21 @@ void dump()
     gLayoutTestController.clear();
 }
 
-static void runTest(const wxString testPathOrURL)
+static void runTest(const wxString inputLine)
 {
     done = false;
     time(&startTime);
-    string pathOrURLString(testPathOrURL.char_str());
-    string pathOrURL(pathOrURLString);
-    string expectedPixelHash;
-
-    size_t separatorPos = pathOrURL.find("'");
-    if (separatorPos != string::npos) {
-        pathOrURL = string(pathOrURLString, 0, separatorPos);
-        expectedPixelHash = string(pathOrURLString, separatorPos + 1);
-    }
+
+    TestCommand command = parseInputLine(std::string(inputLine.ToAscii()));
+    string& pathOrURL = command.pathOrURL;
+    dumpPixelsForCurrentTest = command.shouldDumpPixels;
     
     // CURL isn't happy if we don't have a protocol.
     size_t http = pathOrURL.find("http://");
     if (http == string::npos)
         pathOrURL.insert(0, "file://");
     
-    gLayoutTestController = LayoutTestController::create(pathOrURL, expectedPixelHash);
+    gLayoutTestController = LayoutTestController::create(pathOrURL, command.expectedPixelHash);
     if (!gLayoutTestController) {
         wxTheApp->ExitMainLoop();
     }
@@ -282,11 +277,6 @@ bool MyApp::OnInit()
             continue;
         }
         
-        if (!option.CmpNoCase(_T("--pixel-tests"))) {
-            dumpPixels = true;
-            continue;
-        }
-        
         if (!option.CmpNoCase(_T("--tree"))) {
             dumpTree = true;
             continue;
@@ -323,7 +313,7 @@ bool MyApp::OnInit()
         }
     
     } else {
-        printSeparators = (optind < argc-1 || (dumpPixels && dumpTree));
+        printSeparators = (optind < argc - 1 || (dumpPixelsForCurrentTest && dumpTree));
         for (int i = optind; i != argc; ++i) {
             runTest(wxTheApp->argv[1]);
         }
diff --git a/Tools/EWSTools/cold-boot.sh b/Tools/EWSTools/cold-boot.sh
index 98f9fea13..81516b4b0 100755
--- a/Tools/EWSTools/cold-boot.sh
+++ b/Tools/EWSTools/cold-boot.sh
@@ -78,8 +78,6 @@ cat >> .git/config <<EOF
 [user]
 	email = commit-queue@webkit.org
 	name = Commit Queue
-[merge "changelog"]
-	driver = perl $PWD/Tools/Scripts/resolve-ChangeLogs --merge-driver %O %B %A
 EOF
 fi
 
diff --git a/Tools/GNUmakefile.am b/Tools/GNUmakefile.am
index dab94b205..c1933565c 100644
--- a/Tools/GNUmakefile.am
+++ b/Tools/GNUmakefile.am
@@ -106,6 +106,7 @@ endif
 
 Programs_DumpRenderTree_SOURCES = \
 	Tools/DumpRenderTree/DumpRenderTree.h \
+	Tools/DumpRenderTree/DumpRenderTreeCommon.cpp \
 	Tools/DumpRenderTree/DumpRenderTreePrefix.h \
 	Tools/DumpRenderTree/AccessibilityController.cpp \
 	Tools/DumpRenderTree/AccessibilityController.h \
@@ -255,7 +256,7 @@ EXTRA_DIST += \
 	Tools/gtk/common.py \
 	Tools/gtk/generate-gtkdoc \
 	Tools/gtk/gtkdoc.py \
-	Tools/gtk/run-api-tests \
+	Tools/jhbuild/jhbuildutils.py \
 	Tools/Scripts/VCSUtils.pm \
 	Tools/Scripts/run-gtk-tests \
 	Tools/Scripts/webkit-build-directory \
diff --git a/Tools/MiniBrowser/MBToolbarItem.h b/Tools/MiniBrowser/MBToolbarItem.h
index cc5a4b4cf..9971d4c10 100644
--- a/Tools/MiniBrowser/MBToolbarItem.h
+++ b/Tools/MiniBrowser/MBToolbarItem.h
@@ -24,5 +24,4 @@
  */
 
 @interface MBToolbarItem : NSToolbarItem
-{ }
 @end
diff --git a/Tools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj b/Tools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj
index fb69e89f6..0e0cc502e 100644
--- a/Tools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj
+++ b/Tools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj
@@ -21,8 +21,6 @@
 		BCBD384011B08A6800E01E54 /* WebBundleMain.m in Sources */ = {isa = PBXBuildFile; fileRef = BCBD383D11B08A3100E01E54 /* WebBundleMain.m */; };
 		BCBD384411B08AAD00E01E54 /* WebKit2.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BC8FB5A7116AA1FE0080D413 /* WebKit2.framework */; };
 		BCBD38D011B08C0200E01E54 /* WebBundle.bundle in Copy WebBundle */ = {isa = PBXBuildFile; fileRef = BCBD381D11B0898200E01E54 /* WebBundle.bundle */; };
-		BCE625EE117FC80E00572433 /* BrowserStatisticsWindow.xib in Resources */ = {isa = PBXBuildFile; fileRef = BCE625ED117FC80E00572433 /* BrowserStatisticsWindow.xib */; };
-		BCE625F1117FC82700572433 /* BrowserStatisticsWindowController.m in Sources */ = {isa = PBXBuildFile; fileRef = BCE625F0117FC82700572433 /* BrowserStatisticsWindowController.m */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -74,9 +72,6 @@
 		BCA8CBE011E578A000812FB7 /* WebBundle.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = WebBundle.xcconfig; sourceTree = "<group>"; };
 		BCBD381D11B0898200E01E54 /* WebBundle.bundle */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = WebBundle.bundle; sourceTree = BUILT_PRODUCTS_DIR; };
 		BCBD383D11B08A3100E01E54 /* WebBundleMain.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = WebBundleMain.m; sourceTree = "<group>"; };
-		BCE625ED117FC80E00572433 /* BrowserStatisticsWindow.xib */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = BrowserStatisticsWindow.xib; path = mac/BrowserStatisticsWindow.xib; sourceTree = "<group>"; };
-		BCE625EF117FC82700572433 /* BrowserStatisticsWindowController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BrowserStatisticsWindowController.h; path = mac/BrowserStatisticsWindowController.h; sourceTree = "<group>"; };
-		BCE625F0117FC82700572433 /* BrowserStatisticsWindowController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; name = BrowserStatisticsWindowController.m; path = mac/BrowserStatisticsWindowController.m; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -112,8 +107,6 @@
 				256AC3D90F4B6AC300CF3369 /* AppDelegate.m */,
 				BC329496116A941B008635D0 /* BrowserWindowController.h */,
 				BC329497116A941B008635D0 /* BrowserWindowController.m */,
-				BCE625EF117FC82700572433 /* BrowserStatisticsWindowController.h */,
-				BCE625F0117FC82700572433 /* BrowserStatisticsWindowController.m */,
 				51E244F811EFCE07008228D1 /* MBToolbarItem.h */,
 				51E244F911EFCE07008228D1 /* MBToolbarItem.m */,
 			);
@@ -167,7 +160,6 @@
 			children = (
 				BC3294A2116A9852008635D0 /* BrowserWindow.xib */,
 				1DDD58150DA1D0A300B32029 /* MainMenu.xib */,
-				BCE625ED117FC80E00572433 /* BrowserStatisticsWindow.xib */,
 			);
 			name = Resources;
 			sourceTree = "<group>";
@@ -274,7 +266,6 @@
 			files = (
 				BC72B89511E57E07001EB4EA /* MainMenu.xib in Resources */,
 				BC72B89611E57E0F001EB4EA /* BrowserWindow.xib in Resources */,
-				BCE625EE117FC80E00572433 /* BrowserStatisticsWindow.xib in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -295,7 +286,6 @@
 				256AC3DA0F4B6AC300CF3369 /* AppDelegate.m in Sources */,
 				BC329487116A92E2008635D0 /* main.m in Sources */,
 				BC329498116A941B008635D0 /* BrowserWindowController.m in Sources */,
-				BCE625F1117FC82700572433 /* BrowserStatisticsWindowController.m in Sources */,
 				51E244FA11EFCE07008228D1 /* MBToolbarItem.m in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
diff --git a/Tools/MiniBrowser/efl/CMakeLists.txt b/Tools/MiniBrowser/efl/CMakeLists.txt
index fc4fcf370..ae359a668 100644
--- a/Tools/MiniBrowser/efl/CMakeLists.txt
+++ b/Tools/MiniBrowser/efl/CMakeLists.txt
@@ -28,6 +28,7 @@ SET(MiniBrowser_LIBRARIES
     ${LIBSOUP24_LIBRARIES}
     ${LIBXML2_LIBRARIES}
     ${LIBXSLT_LIBRARIES}
+    ${OPENGL_LIBRARIES}
     ${SQLITE_LIBRARIES}
 )
 
diff --git a/Tools/MiniBrowser/mac/AppDelegate.h b/Tools/MiniBrowser/mac/AppDelegate.h
index 5d7855014..6129ea396 100644
--- a/Tools/MiniBrowser/mac/AppDelegate.h
+++ b/Tools/MiniBrowser/mac/AppDelegate.h
@@ -23,23 +23,12 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-enum ProcessModel {
-    kProcessModelSharedSecondaryThread,
-    kProcessModelSharedSecondaryProcess
-};
-typedef unsigned long ProcessModel;
-
 @interface BrowserAppDelegate : NSObject <NSApplicationDelegate> {
-    ProcessModel _currentProcessModel;
-    WKContextRef _threadContext;
     WKContextRef _processContext;
     WKPageGroupRef _pageGroup;
+    NSMutableSet *_browserWindows;
 }
 
-- (WKContextRef)getCurrentContext;
-
-- (IBAction)setSharedProcessProcessModel:(id)sender;
-- (IBAction)setSharedThreadProcessModel:(id)sender;
-- (IBAction)showStatisticsWindow:(id)sender;
+- (void)browserWindowWillClose:(NSWindow *)window;
 
 @end
diff --git a/Tools/MiniBrowser/mac/AppDelegate.m b/Tools/MiniBrowser/mac/AppDelegate.m
index c8d7f8d0a..a620c798e 100644
--- a/Tools/MiniBrowser/mac/AppDelegate.m
+++ b/Tools/MiniBrowser/mac/AppDelegate.m
@@ -26,7 +26,6 @@
 #import "AppDelegate.h"
 
 #import "BrowserWindowController.h"
-#import "BrowserStatisticsWindowController.h"
 
 #import <WebKit2/WKContextPrivate.h>
 #import <WebKit2/WKStringCF.h>
@@ -113,11 +112,6 @@ static void populateVisitedLinks(WKContextRef context, const void *clientInfo)
 {
     self = [super init];
     if (self) {
-        if ([NSEvent modifierFlags] & NSShiftKeyMask)
-            _currentProcessModel = kProcessModelSharedSecondaryThread;
-        else
-            _currentProcessModel = kProcessModelSharedSecondaryProcess;
-
         WKContextHistoryClient historyClient = {
             kWKContextHistoryClientCurrentVersion,
             self,
@@ -128,10 +122,6 @@ static void populateVisitedLinks(WKContextRef context, const void *clientInfo)
             populateVisitedLinks
         };
 
-        _threadContext = WKContextGetSharedThreadContext();
-        WKContextSetHistoryClient(_threadContext, &historyClient);
-        WKContextSetCacheModel(_threadContext, kWKCacheModelPrimaryWebBrowser);
-
         CFStringRef bundlePathCF = (CFStringRef)[[NSBundle mainBundle] pathForAuxiliaryExecutable:@"WebBundle.bundle"];
         WKStringRef bundlePath = WKStringCreateWithCFString(bundlePathCF);
 
@@ -153,6 +143,8 @@ static void populateVisitedLinks(WKContextRef context, const void *clientInfo)
         WKStringRef pageGroupIdentifier = WKStringCreateWithCFString(CFSTR("MiniBrowser"));
         _pageGroup = WKPageGroupCreateWithIdentifier(pageGroupIdentifier);
         WKRelease(pageGroupIdentifier);
+
+        _browserWindows = [[NSMutableSet alloc] init];
     }
 
     return self;
@@ -160,52 +152,16 @@ static void populateVisitedLinks(WKContextRef context, const void *clientInfo)
 
 - (IBAction)newWindow:(id)sender
 {
-    BrowserWindowController *controller = [[BrowserWindowController alloc] initWithContext:[self getCurrentContext] pageGroup:_pageGroup];
+    BrowserWindowController *controller = [[BrowserWindowController alloc] initWithContext:_processContext pageGroup:_pageGroup];
     [[controller window] makeKeyAndOrderFront:sender];
+    [_browserWindows addObject:[controller window]];
     
     [controller loadURLString:defaultURL];
 }
 
-- (WKContextRef)getCurrentContext
-{
-    return (_currentProcessModel == kProcessModelSharedSecondaryThread) ? _threadContext : _processContext;
-}
-
-- (BOOL)validateMenuItem:(NSMenuItem *)menuItem
-{
-    if ([menuItem action] == @selector(setSharedProcessProcessModel:))
-        [menuItem setState:_currentProcessModel == kProcessModelSharedSecondaryProcess ? NSOnState : NSOffState];
-    else if ([menuItem action] == @selector(setSharedThreadProcessModel:))
-        [menuItem setState:_currentProcessModel == kProcessModelSharedSecondaryThread ? NSOnState : NSOffState];
-    return YES;
-}        
-
-- (void)_setProcessModel:(ProcessModel)processModel
-{
-    if (processModel == _currentProcessModel)
-        return;
- 
-    _currentProcessModel = processModel;
-}
-
-- (IBAction)setSharedProcessProcessModel:(id)sender
-{
-    [self _setProcessModel:kProcessModelSharedSecondaryProcess];
-}
-
-- (IBAction)setSharedThreadProcessModel:(id)sender
-{
-    [self _setProcessModel:kProcessModelSharedSecondaryThread];
-}
-
-- (IBAction)showStatisticsWindow:(id)sender
+- (void)browserWindowWillClose:(NSWindow *)window
 {
-    static BrowserStatisticsWindowController* windowController;
-    if (!windowController)
-        windowController = [[BrowserStatisticsWindowController alloc] initWithThreadedWKContextRef:_threadContext
-                                                                               processWKContextRef:_processContext];
-
-    [[windowController window] makeKeyAndOrderFront:self];
+    [_browserWindows removeObject:window];
 }
 
 - (void)applicationDidFinishLaunching:(NSNotification *)aNotification
@@ -215,13 +171,11 @@ static void populateVisitedLinks(WKContextRef context, const void *clientInfo)
 
 - (void)applicationWillTerminate:(NSNotification *)notification
 {
-    NSArray* windows = [NSApp windows];
-    for (NSWindow* window in windows) {
+    for (NSWindow* window in _browserWindows) {
         id delegate = [window delegate];
-        if ([delegate isKindOfClass:[BrowserWindowController class]]) {
-            BrowserWindowController *controller = (BrowserWindowController *)delegate;
-            [controller applicationTerminating];
-        }
+        assert([delegate isKindOfClass:[BrowserWindowController class]]);
+        BrowserWindowController *controller = (BrowserWindowController *)delegate;
+        [controller applicationTerminating];
     }
 
     WKRelease(_processContext);
@@ -233,8 +187,10 @@ static void populateVisitedLinks(WKContextRef context, const void *clientInfo)
     NSArray* windows = [NSApp windows];
     for (NSWindow* window in windows) {
         id delegate = [window delegate];
-        if ([delegate isKindOfClass:[BrowserWindowController class]])
-            return (BrowserWindowController *)delegate;
+        assert([delegate isKindOfClass:[BrowserWindowController class]]);
+        BrowserWindowController *controller = (BrowserWindowController *)delegate;
+        assert([_browserWindows containsObject:[controller window]]);
+        return controller;
     }
 
     return 0;
@@ -261,7 +217,7 @@ static void populateVisitedLinks(WKContextRef context, const void *clientInfo)
 
     BrowserWindowController *controller = [self frontmostBrowserWindowController];
     if (!controller) {
-        controller = [[BrowserWindowController alloc] initWithContext:[self getCurrentContext] pageGroup:_pageGroup];
+        controller = [[BrowserWindowController alloc] initWithContext:_processContext pageGroup:_pageGroup];
         [[controller window] makeKeyAndOrderFront:self];
     }
     
diff --git a/Tools/MiniBrowser/mac/BrowserStatisticsWindow.xib b/Tools/MiniBrowser/mac/BrowserStatisticsWindow.xib
deleted file mode 100644
index ae2b5f8c7..000000000
--- a/Tools/MiniBrowser/mac/BrowserStatisticsWindow.xib
+++ /dev/null
@@ -1,974 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<archive type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="7.10">
-	<data>
-		<int key="IBDocument.SystemTarget">1060</int>
-		<string key="IBDocument.SystemVersion">10D573</string>
-		<string key="IBDocument.InterfaceBuilderVersion">762</string>
-		<string key="IBDocument.AppKitVersion">1038.29</string>
-		<string key="IBDocument.HIToolboxVersion">460.00</string>
-		<object class="NSMutableDictionary" key="IBDocument.PluginVersions">
-			<string key="NS.key.0">com.apple.InterfaceBuilder.CocoaPlugin</string>
-			<string key="NS.object.0">762</string>
-		</object>
-		<object class="NSMutableArray" key="IBDocument.EditedObjectIDs">
-			<bool key="EncodedWithXMLCoder">YES</bool>
-			<integer value="2"/>
-		</object>
-		<object class="NSArray" key="IBDocument.PluginDependencies">
-			<bool key="EncodedWithXMLCoder">YES</bool>
-			<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-		</object>
-		<object class="NSMutableDictionary" key="IBDocument.Metadata">
-			<bool key="EncodedWithXMLCoder">YES</bool>
-			<object class="NSArray" key="dict.sortedKeys" id="0">
-				<bool key="EncodedWithXMLCoder">YES</bool>
-			</object>
-			<object class="NSMutableArray" key="dict.values">
-				<bool key="EncodedWithXMLCoder">YES</bool>
-			</object>
-		</object>
-		<object class="NSMutableArray" key="IBDocument.RootObjects" id="1000">
-			<bool key="EncodedWithXMLCoder">YES</bool>
-			<object class="NSCustomObject" id="1001">
-				<string key="NSClassName">BrowserStatisticsWindowController</string>
-			</object>
-			<object class="NSCustomObject" id="1003">
-				<string key="NSClassName">FirstResponder</string>
-			</object>
-			<object class="NSCustomObject" id="1004">
-				<string key="NSClassName">NSApplication</string>
-			</object>
-			<object class="NSWindowTemplate" id="1005">
-				<int key="NSWindowStyleMask">15</int>
-				<int key="NSWindowBacking">2</int>
-				<string key="NSWindowRect">{{196, 352}, {398, 158}}</string>
-				<int key="NSWTFlags">544735232</int>
-				<string key="NSWindowTitle">Window</string>
-				<string key="NSWindowClass">NSWindow</string>
-				<nil key="NSViewClass"/>
-				<string key="NSWindowContentMaxSize">{1.79769e+308, 1.79769e+308}</string>
-				<object class="NSView" key="NSWindowView" id="1006">
-					<reference key="NSNextResponder"/>
-					<int key="NSvFlags">256</int>
-					<object class="NSMutableArray" key="NSSubviews">
-						<bool key="EncodedWithXMLCoder">YES</bool>
-						<object class="NSBox" id="349928848">
-							<reference key="NSNextResponder" ref="1006"/>
-							<int key="NSvFlags">45</int>
-							<object class="NSMutableArray" key="NSSubviews">
-								<bool key="EncodedWithXMLCoder">YES</bool>
-								<object class="NSView" id="737205069">
-									<reference key="NSNextResponder" ref="349928848"/>
-									<int key="NSvFlags">256</int>
-									<object class="NSMutableArray" key="NSSubviews">
-										<bool key="EncodedWithXMLCoder">YES</bool>
-										<object class="NSMatrix" id="840724334">
-											<reference key="NSNextResponder" ref="737205069"/>
-											<int key="NSvFlags">256</int>
-											<string key="NSFrame">{{18, 14}, {318, 42}}</string>
-											<reference key="NSSuperview" ref="737205069"/>
-											<bool key="NSEnabled">YES</bool>
-											<int key="NSNumRows">3</int>
-											<int key="NSNumCols">3</int>
-											<object class="NSMutableArray" key="NSCells">
-												<bool key="EncodedWithXMLCoder">YES</bool>
-												<object class="NSTextFieldCell" id="66669903">
-													<int key="NSCellFlags">68288064</int>
-													<int key="NSCellFlags2">71435264</int>
-													<string key="NSContents"/>
-													<object class="NSFont" key="NSSupport" id="57559">
-														<string key="NSName">LucidaGrande-Bold</string>
-														<double key="NSSize">11</double>
-														<int key="NSfFlags">16</int>
-													</object>
-													<reference key="NSControlView" ref="840724334"/>
-													<object class="NSColor" key="NSBackgroundColor" id="159766406">
-														<int key="NSColorSpace">6</int>
-														<string key="NSCatalogName">System</string>
-														<string key="NSColorName">controlColor</string>
-														<object class="NSColor" key="NSColor">
-															<int key="NSColorSpace">3</int>
-															<bytes key="NSWhite">MC42NjY2NjY2NjY3AA</bytes>
-														</object>
-													</object>
-													<object class="NSColor" key="NSTextColor" id="822671316">
-														<int key="NSColorSpace">6</int>
-														<string key="NSCatalogName">System</string>
-														<string key="NSColorName">controlTextColor</string>
-														<object class="NSColor" key="NSColor">
-															<int key="NSColorSpace">3</int>
-															<bytes key="NSWhite">MAA</bytes>
-														</object>
-													</object>
-												</object>
-												<object class="NSTextFieldCell" id="792638244">
-													<int key="NSCellFlags">68288064</int>
-													<int key="NSCellFlags2">71435264</int>
-													<string key="NSContents">Shared Process</string>
-													<reference key="NSSupport" ref="57559"/>
-													<reference key="NSControlView" ref="840724334"/>
-													<int key="NSTag">1</int>
-													<reference key="NSBackgroundColor" ref="159766406"/>
-													<reference key="NSTextColor" ref="822671316"/>
-												</object>
-												<object class="NSTextFieldCell" id="220500282">
-													<int key="NSCellFlags">68288064</int>
-													<int key="NSCellFlags2">71435264</int>
-													<string key="NSContents">Shared Thread</string>
-													<reference key="NSSupport" ref="57559"/>
-													<reference key="NSControlView" ref="840724334"/>
-													<reference key="NSBackgroundColor" ref="159766406"/>
-													<reference key="NSTextColor" ref="822671316"/>
-												</object>
-												<object class="NSTextFieldCell" id="822378002">
-													<int key="NSCellFlags">68288064</int>
-													<int key="NSCellFlags2">71435264</int>
-													<string key="NSContents">Pages</string>
-													<reference key="NSSupport" ref="57559"/>
-													<reference key="NSControlView" ref="840724334"/>
-													<reference key="NSBackgroundColor" ref="159766406"/>
-													<reference key="NSTextColor" ref="822671316"/>
-												</object>
-												<object class="NSTextFieldCell" id="665973187">
-													<int key="NSCellFlags">68288064</int>
-													<int key="NSCellFlags2">71435264</int>
-													<string key="NSContents">-100</string>
-													<object class="NSFont" key="NSSupport" id="422232155">
-														<string key="NSName">LucidaGrande</string>
-														<double key="NSSize">11</double>
-														<int key="NSfFlags">16</int>
-													</object>
-													<reference key="NSControlView" ref="840724334"/>
-													<int key="NSTag">11</int>
-													<reference key="NSBackgroundColor" ref="159766406"/>
-													<reference key="NSTextColor" ref="822671316"/>
-												</object>
-												<object class="NSTextFieldCell" id="534624797">
-													<int key="NSCellFlags">68288064</int>
-													<int key="NSCellFlags2">71435264</int>
-													<string key="NSContents">-100</string>
-													<reference key="NSSupport" ref="422232155"/>
-													<reference key="NSControlView" ref="840724334"/>
-													<int key="NSTag">21</int>
-													<reference key="NSBackgroundColor" ref="159766406"/>
-													<reference key="NSTextColor" ref="822671316"/>
-												</object>
-												<object class="NSTextFieldCell" id="576107244">
-													<int key="NSCellFlags">68288064</int>
-													<int key="NSCellFlags2">71435264</int>
-													<string key="NSContents">Frames</string>
-													<reference key="NSSupport" ref="57559"/>
-													<reference key="NSControlView" ref="840724334"/>
-													<reference key="NSBackgroundColor" ref="159766406"/>
-													<reference key="NSTextColor" ref="822671316"/>
-												</object>
-												<object class="NSTextFieldCell" id="775125133">
-													<int key="NSCellFlags">68288064</int>
-													<int key="NSCellFlags2">71435264</int>
-													<string key="NSContents">-100</string>
-													<reference key="NSSupport" ref="422232155"/>
-													<reference key="NSControlView" ref="840724334"/>
-													<int key="NSTag">12</int>
-													<reference key="NSBackgroundColor" ref="159766406"/>
-													<reference key="NSTextColor" ref="822671316"/>
-												</object>
-												<object class="NSTextFieldCell" id="1058484862">
-													<int key="NSCellFlags">68288064</int>
-													<int key="NSCellFlags2">71435264</int>
-													<string key="NSContents">-100</string>
-													<reference key="NSSupport" ref="422232155"/>
-													<reference key="NSControlView" ref="840724334"/>
-													<int key="NSTag">22</int>
-													<reference key="NSBackgroundColor" ref="159766406"/>
-													<reference key="NSTextColor" ref="822671316"/>
-												</object>
-											</object>
-											<string key="NSCellSize">{106, 14}</string>
-											<string key="NSIntercellSpacing">{0, 0}</string>
-											<int key="NSMatrixFlags">-2080374784</int>
-											<nil key="NSCellClass"/>
-											<object class="NSTextFieldCell" key="NSProtoCell" id="609012621">
-												<int key="NSCellFlags">68288064</int>
-												<int key="NSCellFlags2">71435264</int>
-												<string key="NSContents">Page Namespaces</string>
-												<reference key="NSSupport" ref="57559"/>
-												<reference key="NSBackgroundColor" ref="159766406"/>
-												<reference key="NSTextColor" ref="822671316"/>
-											</object>
-											<int key="NSSelectedRow">-1</int>
-											<int key="NSSelectedCol">-1</int>
-											<reference key="NSBackgroundColor" ref="159766406"/>
-											<reference key="NSCellBackgroundColor" ref="159766406"/>
-										</object>
-									</object>
-									<string key="NSFrame">{{1, 1}, {354, 66}}</string>
-									<reference key="NSSuperview" ref="349928848"/>
-								</object>
-							</object>
-							<string key="NSFrame">{{25, 56}, {356, 82}}</string>
-							<reference key="NSSuperview" ref="1006"/>
-							<string key="NSOffsets">{0, 0}</string>
-							<object class="NSTextFieldCell" key="NSTitleCell">
-								<int key="NSCellFlags">67239424</int>
-								<int key="NSCellFlags2">0</int>
-								<string key="NSContents">Statistics</string>
-								<object class="NSFont" key="NSSupport">
-									<string key="NSName">LucidaGrande</string>
-									<double key="NSSize">11</double>
-									<int key="NSfFlags">3100</int>
-								</object>
-								<object class="NSColor" key="NSBackgroundColor">
-									<int key="NSColorSpace">6</int>
-									<string key="NSCatalogName">System</string>
-									<string key="NSColorName">textBackgroundColor</string>
-									<object class="NSColor" key="NSColor">
-										<int key="NSColorSpace">3</int>
-										<bytes key="NSWhite">MQA</bytes>
-									</object>
-								</object>
-								<object class="NSColor" key="NSTextColor">
-									<int key="NSColorSpace">3</int>
-									<bytes key="NSWhite">MCAwLjgwMDAwMDAxMTkAA</bytes>
-								</object>
-							</object>
-							<reference key="NSContentView" ref="737205069"/>
-							<int key="NSBorderType">1</int>
-							<int key="NSBoxType">0</int>
-							<int key="NSTitlePosition">2</int>
-							<bool key="NSTransparent">NO</bool>
-						</object>
-						<object class="NSButton" id="913385411">
-							<reference key="NSNextResponder" ref="1006"/>
-							<int key="NSvFlags">268</int>
-							<string key="NSFrame">{{288, 12}, {96, 32}}</string>
-							<reference key="NSSuperview" ref="1006"/>
-							<bool key="NSEnabled">YES</bool>
-							<object class="NSButtonCell" key="NSCell" id="465163606">
-								<int key="NSCellFlags">67239424</int>
-								<int key="NSCellFlags2">134217728</int>
-								<string key="NSContents">Refresh</string>
-								<object class="NSFont" key="NSSupport">
-									<string key="NSName">LucidaGrande</string>
-									<double key="NSSize">13</double>
-									<int key="NSfFlags">1044</int>
-								</object>
-								<reference key="NSControlView" ref="913385411"/>
-								<int key="NSButtonFlags">-2038284033</int>
-								<int key="NSButtonFlags2">129</int>
-								<string key="NSAlternateContents"/>
-								<string key="NSKeyEquivalent"/>
-								<int key="NSPeriodicDelay">200</int>
-								<int key="NSPeriodicInterval">25</int>
-							</object>
-						</object>
-					</object>
-					<string key="NSFrameSize">{398, 158}</string>
-					<reference key="NSSuperview"/>
-				</object>
-				<string key="NSScreenRect">{{0, 0}, {1680, 1028}}</string>
-				<string key="NSMaxSize">{1.79769e+308, 1.79769e+308}</string>
-			</object>
-		</object>
-		<object class="IBObjectContainer" key="IBDocument.Objects">
-			<object class="NSMutableArray" key="connectionRecords">
-				<bool key="EncodedWithXMLCoder">YES</bool>
-				<object class="IBConnectionRecord">
-					<object class="IBOutletConnection" key="connection">
-						<string key="label">window</string>
-						<reference key="source" ref="1001"/>
-						<reference key="destination" ref="1005"/>
-					</object>
-					<int key="connectionID">3</int>
-				</object>
-				<object class="IBConnectionRecord">
-					<object class="IBOutletConnection" key="connection">
-						<string key="label">delegate</string>
-						<reference key="source" ref="1005"/>
-						<reference key="destination" ref="1001"/>
-					</object>
-					<int key="connectionID">4</int>
-				</object>
-				<object class="IBConnectionRecord">
-					<object class="IBActionConnection" key="connection">
-						<string key="label">refreshStatistics:</string>
-						<reference key="source" ref="1001"/>
-						<reference key="destination" ref="913385411"/>
-					</object>
-					<int key="connectionID">83</int>
-				</object>
-				<object class="IBConnectionRecord">
-					<object class="IBOutletConnection" key="connection">
-						<string key="label">_basicStatsMatrix</string>
-						<reference key="source" ref="1001"/>
-						<reference key="destination" ref="840724334"/>
-					</object>
-					<int key="connectionID">84</int>
-				</object>
-			</object>
-			<object class="IBMutableOrderedSet" key="objectRecords">
-				<object class="NSArray" key="orderedObjects">
-					<bool key="EncodedWithXMLCoder">YES</bool>
-					<object class="IBObjectRecord">
-						<int key="objectID">0</int>
-						<reference key="object" ref="0"/>
-						<reference key="children" ref="1000"/>
-						<nil key="parent"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">-2</int>
-						<reference key="object" ref="1001"/>
-						<reference key="parent" ref="0"/>
-						<string key="objectName">File's Owner</string>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">-1</int>
-						<reference key="object" ref="1003"/>
-						<reference key="parent" ref="0"/>
-						<string key="objectName">First Responder</string>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">-3</int>
-						<reference key="object" ref="1004"/>
-						<reference key="parent" ref="0"/>
-						<string key="objectName">Application</string>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">1</int>
-						<reference key="object" ref="1005"/>
-						<object class="NSMutableArray" key="children">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<reference ref="1006"/>
-						</object>
-						<reference key="parent" ref="0"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">2</int>
-						<reference key="object" ref="1006"/>
-						<object class="NSMutableArray" key="children">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<reference ref="349928848"/>
-							<reference ref="913385411"/>
-						</object>
-						<reference key="parent" ref="1005"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">5</int>
-						<reference key="object" ref="349928848"/>
-						<object class="NSMutableArray" key="children">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<reference ref="840724334"/>
-						</object>
-						<reference key="parent" ref="1006"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">37</int>
-						<reference key="object" ref="913385411"/>
-						<object class="NSMutableArray" key="children">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<reference ref="465163606"/>
-						</object>
-						<reference key="parent" ref="1006"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">38</int>
-						<reference key="object" ref="465163606"/>
-						<reference key="parent" ref="913385411"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">75</int>
-						<reference key="object" ref="840724334"/>
-						<object class="NSMutableArray" key="children">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<reference ref="1058484862"/>
-							<reference ref="534624797"/>
-							<reference ref="220500282"/>
-							<reference ref="792638244"/>
-							<reference ref="66669903"/>
-							<reference ref="665973187"/>
-							<reference ref="822378002"/>
-							<reference ref="775125133"/>
-							<reference ref="576107244"/>
-							<reference ref="609012621"/>
-						</object>
-						<reference key="parent" ref="349928848"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">87</int>
-						<reference key="object" ref="1058484862"/>
-						<reference key="parent" ref="840724334"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">86</int>
-						<reference key="object" ref="534624797"/>
-						<reference key="parent" ref="840724334"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">85</int>
-						<reference key="object" ref="220500282"/>
-						<reference key="parent" ref="840724334"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">48</int>
-						<reference key="object" ref="792638244"/>
-						<reference key="parent" ref="840724334"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">42</int>
-						<reference key="object" ref="66669903"/>
-						<reference key="parent" ref="840724334"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">46</int>
-						<reference key="object" ref="665973187"/>
-						<reference key="parent" ref="840724334"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">43</int>
-						<reference key="object" ref="822378002"/>
-						<reference key="parent" ref="840724334"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">47</int>
-						<reference key="object" ref="775125133"/>
-						<reference key="parent" ref="840724334"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">44</int>
-						<reference key="object" ref="576107244"/>
-						<reference key="parent" ref="840724334"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">82</int>
-						<reference key="object" ref="609012621"/>
-						<reference key="parent" ref="840724334"/>
-					</object>
-				</object>
-			</object>
-			<object class="NSMutableDictionary" key="flattenedProperties">
-				<bool key="EncodedWithXMLCoder">YES</bool>
-				<object class="NSArray" key="dict.sortedKeys">
-					<bool key="EncodedWithXMLCoder">YES</bool>
-					<string>1.IBEditorWindowLastContentRect</string>
-					<string>1.IBPluginDependency</string>
-					<string>1.IBWindowTemplateEditedContentRect</string>
-					<string>1.NSWindowTemplate.visibleAtLaunch</string>
-					<string>1.WindowOrigin</string>
-					<string>1.editorWindowContentRectSynchronizationRect</string>
-					<string>2.IBPluginDependency</string>
-					<string>37.IBPluginDependency</string>
-					<string>38.IBPluginDependency</string>
-					<string>5.IBPluginDependency</string>
-				</object>
-				<object class="NSMutableArray" key="dict.values">
-					<bool key="EncodedWithXMLCoder">YES</bool>
-					<string>{{362, 638}, {398, 158}}</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>{{362, 638}, {398, 158}}</string>
-					<integer value="1"/>
-					<string>{196, 240}</string>
-					<string>{{202, 428}, {480, 270}}</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-				</object>
-			</object>
-			<object class="NSMutableDictionary" key="unlocalizedProperties">
-				<bool key="EncodedWithXMLCoder">YES</bool>
-				<reference key="dict.sortedKeys" ref="0"/>
-				<object class="NSMutableArray" key="dict.values">
-					<bool key="EncodedWithXMLCoder">YES</bool>
-				</object>
-			</object>
-			<nil key="activeLocalization"/>
-			<object class="NSMutableDictionary" key="localizations">
-				<bool key="EncodedWithXMLCoder">YES</bool>
-				<reference key="dict.sortedKeys" ref="0"/>
-				<object class="NSMutableArray" key="dict.values">
-					<bool key="EncodedWithXMLCoder">YES</bool>
-				</object>
-			</object>
-			<nil key="sourceID"/>
-			<int key="maxID">88</int>
-		</object>
-		<object class="IBClassDescriber" key="IBDocument.Classes">
-			<object class="NSMutableArray" key="referencedPartialClassDescriptions">
-				<bool key="EncodedWithXMLCoder">YES</bool>
-				<object class="IBPartialClassDescription">
-					<string key="className">BrowserStatisticsWindowController</string>
-					<string key="superclassName">NSWindowController</string>
-					<object class="NSMutableDictionary" key="actions">
-						<string key="NS.key.0">refreshStatistics:</string>
-						<string key="NS.object.0">id</string>
-					</object>
-					<object class="NSMutableDictionary" key="outlets">
-						<string key="NS.key.0">_basicStatsMatrix</string>
-						<string key="NS.object.0">NSMatrix</string>
-					</object>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBProjectSource</string>
-						<string key="minorKey">mac/BrowserStatisticsWindowController.h</string>
-					</object>
-				</object>
-			</object>
-			<object class="NSMutableArray" key="referencedPartialClassDescriptionsV3.2+">
-				<bool key="EncodedWithXMLCoder">YES</bool>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSActionCell</string>
-					<string key="superclassName">NSCell</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSActionCell.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSApplication</string>
-					<string key="superclassName">NSResponder</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier" id="580408357">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSApplication.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSApplication</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier" id="153722584">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSApplicationScripting.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSApplication</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier" id="814670282">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSColorPanel.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSApplication</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSHelpManager.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSApplication</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSPageLayout.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSApplication</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSUserInterfaceItemSearching.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSBox</string>
-					<string key="superclassName">NSView</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSBox.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSButton</string>
-					<string key="superclassName">NSControl</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSButton.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSButtonCell</string>
-					<string key="superclassName">NSActionCell</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSButtonCell.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSCell</string>
-					<string key="superclassName">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSCell.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSControl</string>
-					<string key="superclassName">NSView</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier" id="423015697">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSControl.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSFormatter</string>
-					<string key="superclassName">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSFormatter.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSMatrix</string>
-					<string key="superclassName">NSControl</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSMatrix.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSMenu</string>
-					<string key="superclassName">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier" id="571428989">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSMenu.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSAccessibility.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<reference key="sourceIdentifier" ref="580408357"/>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<reference key="sourceIdentifier" ref="153722584"/>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<reference key="sourceIdentifier" ref="814670282"/>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<reference key="sourceIdentifier" ref="423015697"/>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSDictionaryController.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSDragging.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSFontManager.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSFontPanel.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSKeyValueBinding.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<reference key="sourceIdentifier" ref="571428989"/>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSNibLoading.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSOutlineView.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSPasteboard.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSSavePanel.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSTableView.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSToolbarItem.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier" id="214998123">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSView.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSArchiver.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSClassDescription.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSError.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSFileManager.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSKeyValueCoding.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSKeyValueObserving.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSKeyedArchiver.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSObject.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSObjectScripting.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSPortCoder.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSRunLoop.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSScriptClassDescription.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSScriptKeyValueCoding.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSScriptObjectSpecifiers.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSScriptWhoseTests.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSThread.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSURL.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSURLConnection.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">Foundation.framework/Headers/NSURLDownload.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSResponder</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSInterfaceStyle.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSResponder</string>
-					<string key="superclassName">NSObject</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSResponder.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSTextFieldCell</string>
-					<string key="superclassName">NSActionCell</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSTextFieldCell.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSView</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSClipView.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSView</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSMenuItem.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSView</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSRulerView.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSView</string>
-					<string key="superclassName">NSResponder</string>
-					<reference key="sourceIdentifier" ref="214998123"/>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSWindow</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSDrawer.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSWindow</string>
-					<string key="superclassName">NSResponder</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSWindow.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSWindow</string>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSWindowScripting.h</string>
-					</object>
-				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">NSWindowController</string>
-					<string key="superclassName">NSResponder</string>
-					<object class="NSMutableDictionary" key="actions">
-						<string key="NS.key.0">showWindow:</string>
-						<string key="NS.object.0">id</string>
-					</object>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBFrameworkSource</string>
-						<string key="minorKey">AppKit.framework/Headers/NSWindowController.h</string>
-					</object>
-				</object>
-			</object>
-		</object>
-		<int key="IBDocument.localizationMode">0</int>
-		<string key="IBDocument.TargetRuntimeIdentifier">IBCocoaFramework</string>
-		<object class="NSMutableDictionary" key="IBDocument.PluginDeclaredDependencyDefaults">
-			<string key="NS.key.0">com.apple.InterfaceBuilder.CocoaPlugin.macosx</string>
-			<integer value="1060" key="NS.object.0"/>
-		</object>
-		<object class="NSMutableDictionary" key="IBDocument.PluginDeclaredDevelopmentDependencies">
-			<string key="NS.key.0">com.apple.InterfaceBuilder.CocoaPlugin.InterfaceBuilder3</string>
-			<integer value="3000" key="NS.object.0"/>
-		</object>
-		<bool key="IBDocument.PluginDeclaredDependenciesTrackSystemTargetVersion">YES</bool>
-		<string key="IBDocument.LastKnownRelativeProjectPath">../MiniBrowser.xcodeproj</string>
-		<int key="IBDocument.defaultPropertyAccessControl">3</int>
-	</data>
-</archive>
diff --git a/Tools/MiniBrowser/mac/BrowserStatisticsWindowController.h b/Tools/MiniBrowser/mac/BrowserStatisticsWindowController.h
deleted file mode 100644
index 6b4438f47..000000000
--- a/Tools/MiniBrowser/mac/BrowserStatisticsWindowController.h
+++ /dev/null
@@ -1,20 +0,0 @@
-//
-//  BrowserStatisticsWindowController.h
-//  MiniBrowser
-//
-//  Created by Sam Weinig on 4/21/10.
-//  Copyright 2010 Apple Inc. All rights reserved.
-//
-
-@interface BrowserStatisticsWindowController : NSWindowController {
-    IBOutlet NSMatrix *_basicStatsMatrix;
-
-    WKContextRef _threadContext;
-    WKContextRef _processContext;
-}
-
-- (id)initWithThreadedWKContextRef:(WKContextRef)threadContext processWKContextRef:(WKContextRef)processContext;
-
-- (IBAction)refreshStatistics:(id)sender;
-
-@end
diff --git a/Tools/MiniBrowser/mac/BrowserStatisticsWindowController.m b/Tools/MiniBrowser/mac/BrowserStatisticsWindowController.m
deleted file mode 100644
index 878821a86..000000000
--- a/Tools/MiniBrowser/mac/BrowserStatisticsWindowController.m
+++ /dev/null
@@ -1,47 +0,0 @@
-//
-//  BrowserStatisticsWindowController.m
-//  MiniBrowser
-//
-//  Created by Sam Weinig on 4/21/10.
-//  Copyright 2010 Apple Inc. All rights reserved.
-//
-
-#import "BrowserStatisticsWindowController.h"
-
-#import <WebKit2/WKContextPrivate.h>
-
-@implementation BrowserStatisticsWindowController
-
-- (id)initWithThreadedWKContextRef:(WKContextRef)threadContext processWKContextRef:(WKContextRef)processContext
-{
-    if ((self = [super initWithWindowNibName:@"BrowserStatisticsWindow"])) {
-        _threadContext = WKRetain(threadContext);
-        _processContext = WKRetain(processContext);
-    }
-
-    return self;
-}
-
-- (void)dealloc
-{
-    WKRelease(_threadContext);
-    _threadContext = 0;
-
-    WKRelease(_processContext);
-    _processContext = 0;
-    
-    [super dealloc];
-}
-
-- (void)windowDidLoad
-{
-    [super windowDidLoad];
-    [self refreshStatistics:nil];
-}
-
-- (IBAction)refreshStatistics:(id)sender
-{
-    // FIXME: (Re-)implement.
-}
-
-@end
diff --git a/Tools/MiniBrowser/mac/BrowserWindowController.m b/Tools/MiniBrowser/mac/BrowserWindowController.m
index 72d37beac..e6b6f542d 100644
--- a/Tools/MiniBrowser/mac/BrowserWindowController.m
+++ b/Tools/MiniBrowser/mac/BrowserWindowController.m
@@ -25,6 +25,7 @@
 
 #import "BrowserWindowController.h"
 
+#import "AppDelegate.h"
 #import <WebKit2/WKPagePrivate.h>
 #import <WebKit2/WKStringCF.h>
 #import <WebKit2/WKURLCF.h>
@@ -58,7 +59,10 @@
 
 - (void)dealloc
 {
-    assert(!_context);
+    WKRelease(_context);
+    WKRelease(_pageGroup);
+    [_webView release];
+
     [super dealloc];
 }
 
@@ -163,16 +167,14 @@
 
 - (void)windowWillClose:(NSNotification *)notification
 {
-    WKRelease(_context);
-    _context = 0;
-    WKRelease(_pageGroup);
-    _pageGroup = 0;
+    [(BrowserAppDelegate *)[NSApp delegate] browserWindowWillClose:[self window]];
+    [self autorelease];
 }
 
 - (void)applicationTerminating
 {
+    // FIXME: Why are we bothering to close the page? This doesn't even prevent LEAK output.
     WKPageClose(_webView.pageRef);
-    WKRelease(_webView.pageRef);
 }
 
 #define DefaultMinimumZoomFactor (.5)
@@ -412,7 +414,7 @@ static WKPageRef createNewPage(WKPageRef page, WKURLRequestRef request, WKDictio
     BrowserWindowController *controller = [[BrowserWindowController alloc] initWithContext:WKPageGetContext(page) pageGroup:WKPageGetPageGroup(page)];
     [controller loadWindow];
 
-    return controller->_webView.pageRef;
+    return WKRetain(controller->_webView.pageRef);
 }
 
 static void showPage(WKPageRef page, const void *clientInfo)
@@ -426,7 +428,6 @@ static void closePage(WKPageRef page, const void *clientInfo)
     LOG(@"closePage");
     WKPageClose(page);
     [[(BrowserWindowController *)clientInfo window] close];
-    WKRelease(page);
 }
 
 static void runJavaScriptAlert(WKPageRef page, WKStringRef message, WKFrameRef frame, const void* clientInfo)
diff --git a/Tools/MiniBrowser/mac/MainMenu.xib b/Tools/MiniBrowser/mac/MainMenu.xib
index b6939956d..164dba466 100644
--- a/Tools/MiniBrowser/mac/MainMenu.xib
+++ b/Tools/MiniBrowser/mac/MainMenu.xib
@@ -2,13 +2,13 @@
 <archive type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="7.10">
 	<data>
 		<int key="IBDocument.SystemTarget">1080</int>
-		<string key="IBDocument.SystemVersion">12A265</string>
-		<string key="IBDocument.InterfaceBuilderVersion">2816</string>
-		<string key="IBDocument.AppKitVersion">1186</string>
-		<string key="IBDocument.HIToolboxVersion">624.00</string>
+		<string key="IBDocument.SystemVersion">12A256</string>
+		<string key="IBDocument.InterfaceBuilderVersion">2547</string>
+		<string key="IBDocument.AppKitVersion">1185</string>
+		<string key="IBDocument.HIToolboxVersion">622.00</string>
 		<object class="NSMutableDictionary" key="IBDocument.PluginVersions">
 			<string key="NS.key.0">com.apple.InterfaceBuilder.CocoaPlugin</string>
-			<string key="NS.object.0">2816</string>
+			<string key="NS.object.0">2547</string>
 		</object>
 		<object class="NSArray" key="IBDocument.IntegratedClassDependencies">
 			<bool key="EncodedWithXMLCoder">YES</bool>
@@ -934,65 +934,6 @@
 									<reference key="NSOnImage" ref="35465992"/>
 									<reference key="NSMixedImage" ref="502551668"/>
 								</object>
-								<object class="NSMenuItem" id="208343368">
-									<reference key="NSMenu" ref="865232259"/>
-									<string key="NSTitle">Show Statistics Window</string>
-									<string key="NSKeyEquiv"/>
-									<int key="NSMnemonicLoc">2147483647</int>
-									<reference key="NSOnImage" ref="35465992"/>
-									<reference key="NSMixedImage" ref="502551668"/>
-								</object>
-								<object class="NSMenuItem" id="162978490">
-									<reference key="NSMenu" ref="865232259"/>
-									<bool key="NSIsDisabled">YES</bool>
-									<bool key="NSIsSeparator">YES</bool>
-									<string key="NSTitle"/>
-									<string key="NSKeyEquiv"/>
-									<int key="NSMnemonicLoc">2147483647</int>
-									<reference key="NSOnImage" ref="35465992"/>
-									<reference key="NSMixedImage" ref="502551668"/>
-								</object>
-								<object class="NSMenuItem" id="340689355">
-									<reference key="NSMenu" ref="865232259"/>
-									<string key="NSTitle">Process Model</string>
-									<string key="NSKeyEquiv"/>
-									<int key="NSMnemonicLoc">2147483647</int>
-									<reference key="NSOnImage" ref="35465992"/>
-									<reference key="NSMixedImage" ref="502551668"/>
-									<string key="NSAction">submenuAction:</string>
-									<object class="NSMenu" key="NSSubmenu" id="935112943">
-										<string key="NSTitle">Process Model</string>
-										<object class="NSMutableArray" key="NSMenuItems">
-											<bool key="EncodedWithXMLCoder">YES</bool>
-											<object class="NSMenuItem" id="993856752">
-												<reference key="NSMenu" ref="935112943"/>
-												<string key="NSTitle">Shared Process</string>
-												<string key="NSKeyEquiv"/>
-												<int key="NSMnemonicLoc">2147483647</int>
-												<reference key="NSOnImage" ref="35465992"/>
-												<reference key="NSMixedImage" ref="502551668"/>
-											</object>
-											<object class="NSMenuItem" id="516840223">
-												<reference key="NSMenu" ref="935112943"/>
-												<string key="NSTitle">Shared Thread</string>
-												<string key="NSKeyEquiv"/>
-												<int key="NSMnemonicLoc">2147483647</int>
-												<reference key="NSOnImage" ref="35465992"/>
-												<reference key="NSMixedImage" ref="502551668"/>
-											</object>
-										</object>
-									</object>
-								</object>
-								<object class="NSMenuItem" id="377902755">
-									<reference key="NSMenu" ref="865232259"/>
-									<bool key="NSIsDisabled">YES</bool>
-									<bool key="NSIsSeparator">YES</bool>
-									<string key="NSTitle"/>
-									<string key="NSKeyEquiv"/>
-									<int key="NSMnemonicLoc">2147483647</int>
-									<reference key="NSOnImage" ref="35465992"/>
-									<reference key="NSMixedImage" ref="502551668"/>
-								</object>
 								<object class="NSMenuItem" id="191469404">
 									<reference key="NSMenu" ref="865232259"/>
 									<string key="NSTitle">Dump Source To Console</string>
@@ -1489,30 +1430,6 @@
 					</object>
 					<int key="connectionID">570</int>
 				</object>
-				<object class="IBConnectionRecord">
-					<object class="IBActionConnection" key="connection">
-						<string key="label">setSharedProcessProcessModel:</string>
-						<reference key="source" ref="976324537"/>
-						<reference key="destination" ref="993856752"/>
-					</object>
-					<int key="connectionID">543</int>
-				</object>
-				<object class="IBConnectionRecord">
-					<object class="IBActionConnection" key="connection">
-						<string key="label">setSharedThreadProcessModel:</string>
-						<reference key="source" ref="976324537"/>
-						<reference key="destination" ref="516840223"/>
-					</object>
-					<int key="connectionID">544</int>
-				</object>
-				<object class="IBConnectionRecord">
-					<object class="IBActionConnection" key="connection">
-						<string key="label">showStatisticsWindow:</string>
-						<reference key="source" ref="976324537"/>
-						<reference key="destination" ref="208343368"/>
-					</object>
-					<int key="connectionID">554</int>
-				</object>
 			</object>
 			<object class="IBMutableOrderedSet" key="objectRecords">
 				<object class="NSArray" key="orderedObjects">
@@ -2178,14 +2095,10 @@
 						<reference key="object" ref="865232259"/>
 						<object class="NSMutableArray" key="children">
 							<bool key="EncodedWithXMLCoder">YES</bool>
-							<reference ref="340689355"/>
 							<reference ref="878165919"/>
-							<reference ref="162978490"/>
 							<reference ref="137933275"/>
 							<reference ref="1027125810"/>
 							<reference ref="864702084"/>
-							<reference ref="208343368"/>
-							<reference ref="377902755"/>
 							<reference ref="191469404"/>
 							<reference ref="624939128"/>
 							<reference ref="15772092"/>
@@ -2193,48 +2106,11 @@
 						<reference key="parent" ref="816668511"/>
 					</object>
 					<object class="IBObjectRecord">
-						<int key="objectID">537</int>
-						<reference key="object" ref="340689355"/>
-						<object class="NSMutableArray" key="children">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<reference ref="935112943"/>
-						</object>
-						<reference key="parent" ref="865232259"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">538</int>
-						<reference key="object" ref="935112943"/>
-						<object class="NSMutableArray" key="children">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<reference ref="993856752"/>
-							<reference ref="516840223"/>
-						</object>
-						<reference key="parent" ref="340689355"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">539</int>
-						<reference key="object" ref="993856752"/>
-						<reference key="parent" ref="935112943"/>
-					</object>
-					<object class="IBObjectRecord">
-						<int key="objectID">540</int>
-						<reference key="object" ref="516840223"/>
-						<object class="NSMutableArray" key="children">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-						</object>
-						<reference key="parent" ref="935112943"/>
-					</object>
-					<object class="IBObjectRecord">
 						<int key="objectID">545</int>
 						<reference key="object" ref="878165919"/>
 						<reference key="parent" ref="865232259"/>
 					</object>
 					<object class="IBObjectRecord">
-						<int key="objectID">546</int>
-						<reference key="object" ref="162978490"/>
-						<reference key="parent" ref="865232259"/>
-					</object>
-					<object class="IBObjectRecord">
 						<int key="objectID">548</int>
 						<reference key="object" ref="137933275"/>
 						<reference key="parent" ref="865232259"/>
@@ -2245,11 +2121,6 @@
 						<reference key="parent" ref="865232259"/>
 					</object>
 					<object class="IBObjectRecord">
-						<int key="objectID">552</int>
-						<reference key="object" ref="208343368"/>
-						<reference key="parent" ref="865232259"/>
-					</object>
-					<object class="IBObjectRecord">
 						<int key="objectID">553</int>
 						<reference key="object" ref="864702084"/>
 						<reference key="parent" ref="865232259"/>
@@ -2280,11 +2151,6 @@
 						<reference key="parent" ref="466310130"/>
 					</object>
 					<object class="IBObjectRecord">
-						<int key="objectID">565</int>
-						<reference key="object" ref="377902755"/>
-						<reference key="parent" ref="865232259"/>
-					</object>
-					<object class="IBObjectRecord">
 						<int key="objectID">566</int>
 						<reference key="object" ref="191469404"/>
 						<reference key="parent" ref="865232259"/>
@@ -2385,15 +2251,9 @@
 					<string>5.IBPluginDependency</string>
 					<string>534.IBPluginDependency</string>
 					<string>535.IBPluginDependency</string>
-					<string>537.IBPluginDependency</string>
-					<string>538.IBPluginDependency</string>
-					<string>539.IBPluginDependency</string>
-					<string>540.IBPluginDependency</string>
 					<string>545.IBPluginDependency</string>
-					<string>546.IBPluginDependency</string>
 					<string>548.IBPluginDependency</string>
 					<string>550.IBPluginDependency</string>
-					<string>552.IBPluginDependency</string>
 					<string>553.IBPluginDependency</string>
 					<string>555.IBPluginDependency</string>
 					<string>556.IBPluginDependency</string>
@@ -2401,7 +2261,6 @@
 					<string>558.IBPluginDependency</string>
 					<string>56.IBPluginDependency</string>
 					<string>562.IBPluginDependency</string>
-					<string>565.IBPluginDependency</string>
 					<string>566.IBPluginDependency</string>
 					<string>568.IBPluginDependency</string>
 					<string>569.IBPluginDependency</string>
@@ -2529,13 +2388,6 @@
 					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
 					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
 					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
 				</object>
 			</object>
 			<object class="NSMutableDictionary" key="unlocalizedProperties">
@@ -2558,45 +2410,6 @@
 				<object class="IBPartialClassDescription">
 					<string key="className">BrowserAppDelegate</string>
 					<string key="superclassName">NSObject</string>
-					<object class="NSMutableDictionary" key="actions">
-						<bool key="EncodedWithXMLCoder">YES</bool>
-						<object class="NSArray" key="dict.sortedKeys">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<string>setSharedProcessProcessModel:</string>
-							<string>setSharedThreadProcessModel:</string>
-							<string>showStatisticsWindow:</string>
-						</object>
-						<object class="NSArray" key="dict.values">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<string>id</string>
-							<string>id</string>
-							<string>id</string>
-						</object>
-					</object>
-					<object class="NSMutableDictionary" key="actionInfosByName">
-						<bool key="EncodedWithXMLCoder">YES</bool>
-						<object class="NSArray" key="dict.sortedKeys">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<string>setSharedProcessProcessModel:</string>
-							<string>setSharedThreadProcessModel:</string>
-							<string>showStatisticsWindow:</string>
-						</object>
-						<object class="NSArray" key="dict.values">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<object class="IBActionInfo">
-								<string key="name">setSharedProcessProcessModel:</string>
-								<string key="candidateClassName">id</string>
-							</object>
-							<object class="IBActionInfo">
-								<string key="name">setSharedThreadProcessModel:</string>
-								<string key="candidateClassName">id</string>
-							</object>
-							<object class="IBActionInfo">
-								<string key="name">showStatisticsWindow:</string>
-								<string key="candidateClassName">id</string>
-							</object>
-						</object>
-					</object>
 					<object class="IBClassDescriptionSource" key="sourceIdentifier">
 						<string key="majorKey">IBProjectSource</string>
 						<string key="minorKey">./Classes/BrowserAppDelegate.h</string>
@@ -2619,6 +2432,7 @@
 							<string>removeReinsertWebView:</string>
 							<string>resetZoom:</string>
 							<string>showHideWebView:</string>
+							<string>togglePaginationMode:</string>
 							<string>toggleZoomMode:</string>
 							<string>zoomIn:</string>
 							<string>zoomOut:</string>
@@ -2638,6 +2452,7 @@
 							<string>id</string>
 							<string>id</string>
 							<string>id</string>
+							<string>id</string>
 						</object>
 					</object>
 					<object class="NSMutableDictionary" key="actionInfosByName">
@@ -2654,6 +2469,7 @@
 							<string>removeReinsertWebView:</string>
 							<string>resetZoom:</string>
 							<string>showHideWebView:</string>
+							<string>togglePaginationMode:</string>
 							<string>toggleZoomMode:</string>
 							<string>zoomIn:</string>
 							<string>zoomOut:</string>
@@ -2701,6 +2517,10 @@
 								<string key="candidateClassName">id</string>
 							</object>
 							<object class="IBActionInfo">
+								<string key="name">togglePaginationMode:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
 								<string key="name">toggleZoomMode:</string>
 								<string key="candidateClassName">id</string>
 							</object>
@@ -2917,59 +2737,6 @@
 						<string key="minorKey">./Classes/NSDocumentController.h</string>
 					</object>
 				</object>
-				<object class="IBPartialClassDescription">
-					<string key="className">WebView</string>
-					<object class="NSMutableDictionary" key="actions">
-						<bool key="EncodedWithXMLCoder">YES</bool>
-						<object class="NSArray" key="dict.sortedKeys">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<string>reloadFromOrigin:</string>
-							<string>resetPageZoom:</string>
-							<string>zoomPageIn:</string>
-							<string>zoomPageOut:</string>
-						</object>
-						<object class="NSArray" key="dict.values">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<string>id</string>
-							<string>id</string>
-							<string>id</string>
-							<string>id</string>
-						</object>
-					</object>
-					<object class="NSMutableDictionary" key="actionInfosByName">
-						<bool key="EncodedWithXMLCoder">YES</bool>
-						<object class="NSArray" key="dict.sortedKeys">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<string>reloadFromOrigin:</string>
-							<string>resetPageZoom:</string>
-							<string>zoomPageIn:</string>
-							<string>zoomPageOut:</string>
-						</object>
-						<object class="NSArray" key="dict.values">
-							<bool key="EncodedWithXMLCoder">YES</bool>
-							<object class="IBActionInfo">
-								<string key="name">reloadFromOrigin:</string>
-								<string key="candidateClassName">id</string>
-							</object>
-							<object class="IBActionInfo">
-								<string key="name">resetPageZoom:</string>
-								<string key="candidateClassName">id</string>
-							</object>
-							<object class="IBActionInfo">
-								<string key="name">zoomPageIn:</string>
-								<string key="candidateClassName">id</string>
-							</object>
-							<object class="IBActionInfo">
-								<string key="name">zoomPageOut:</string>
-								<string key="candidateClassName">id</string>
-							</object>
-						</object>
-					</object>
-					<object class="IBClassDescriptionSource" key="sourceIdentifier">
-						<string key="majorKey">IBProjectSource</string>
-						<string key="minorKey">./Classes/WebView.h</string>
-					</object>
-				</object>
 			</object>
 		</object>
 		<int key="IBDocument.localizationMode">0</int>
diff --git a/Tools/MiniBrowser/mac/MiniBrowser_Prefix.pch b/Tools/MiniBrowser/mac/MiniBrowser_Prefix.pch
index a4e648ee7..24ff04c07 100644
--- a/Tools/MiniBrowser/mac/MiniBrowser_Prefix.pch
+++ b/Tools/MiniBrowser/mac/MiniBrowser_Prefix.pch
@@ -27,7 +27,7 @@
     #import <Cocoa/Cocoa.h>
 #endif
 
-#import <WebKit2/WebKit2.h>
+#import <WebKit2/WebKit2_C.h>
 
 #define ENABLE_LOGGING 0
 
diff --git a/Tools/MiniBrowser/mac/WebBundle/WebBundleMain.m b/Tools/MiniBrowser/mac/WebBundle/WebBundleMain.m
index 2da3e9596..509038a9c 100644
--- a/Tools/MiniBrowser/mac/WebBundle/WebBundleMain.m
+++ b/Tools/MiniBrowser/mac/WebBundle/WebBundleMain.m
@@ -44,7 +44,8 @@ void didClearWindowObjectForFrame(WKBundlePageRef page, WKBundleFrameRef frame,
     WKRelease(wkURL);
 
     LOG(@"WKBundlePageClient - didClearWindowForFrame %@", [(NSURL *)cfURL absoluteString]);
-    CFRelease(cfURL);
+    if (cfURL)
+        CFRelease(cfURL);
 
     WKStringRef messageName = WKStringCreateWithCFString(CFSTR("Callback"));
     WKStringRef messageBody = WKStringCreateWithCFString(CFSTR("Window was cleared"));
diff --git a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
index f11f90d8c..1277a13b2 100644
--- a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
+++ b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
@@ -216,10 +216,16 @@ bool MiniBrowserApplication::notify(QObject* target, QEvent* event)
 
 void MiniBrowserApplication::updateTouchPoint(const QMouseEvent* mouseEvent, QTouchEvent::TouchPoint touchPoint, Qt::MouseButton mouseButton)
 {
+    // Ignore inserting additional touch points if Ctrl isn't held because it produces
+    // inconsistent touch events and results in assers in the gesture recognizers.
+    if (!m_holdingControl && m_touchPoints.size() && !m_touchPoints.contains(mouseButton))
+        return;
+
     if (m_holdingControl && touchPoint.state() == Qt::TouchPointReleased) {
         m_heldTouchPoints.insert(mouseButton);
         return;
     }
+
     // Gesture recognition uses the screen position for the initial threshold
     // but since the canvas translates touch events we actually need to pass
     // the screen position as the scene position to deliver the appropriate
diff --git a/Tools/MiniBrowser/win/BrowserView.cpp b/Tools/MiniBrowser/win/BrowserView.cpp
index bd5dcba65..03a46cb19 100644
--- a/Tools/MiniBrowser/win/BrowserView.cpp
+++ b/Tools/MiniBrowser/win/BrowserView.cpp
@@ -82,13 +82,7 @@ void BrowserView::create(RECT webViewRect, BrowserWindow* parentWindow)
 {
     assert(!m_webView);
 
-    bool isShiftKeyDown = ::GetKeyState(VK_SHIFT) & HIGH_BIT_MASK_SHORT;
-
-    WKContextRef context;
-    if (isShiftKeyDown)
-        context = WKContextGetSharedThreadContext();
-    else
-        context = WKContextGetSharedProcessContext();
+    static WKContextRef context = WKContextCreate();
 
     m_webView = WKViewCreate(webViewRect, context, 0, parentWindow->window());
 
diff --git a/Tools/MiniBrowser/win/BrowserView.h b/Tools/MiniBrowser/win/BrowserView.h
index 08c5e4a39..e170a7df7 100644
--- a/Tools/MiniBrowser/win/BrowserView.h
+++ b/Tools/MiniBrowser/win/BrowserView.h
@@ -26,7 +26,7 @@
 #ifndef BrowserView_h
 #define BrowserView_h
 
-#include <WebKit2/WebKit2.h>
+#include <WebKit2/WebKit2_C.h>
 #include <string>
 
 class BrowserWindow;
diff --git a/Tools/QtTestBrowser/QtTestBrowser.pro b/Tools/QtTestBrowser/QtTestBrowser.pro
index 6c9352cbc..5c123f90f 100644
--- a/Tools/QtTestBrowser/QtTestBrowser.pro
+++ b/Tools/QtTestBrowser/QtTestBrowser.pro
@@ -42,10 +42,9 @@ WEBKIT += wtf webcore
 
 DESTDIR = $$ROOT_BUILD_DIR/bin
 
-QT += network webkit
+QT += network webkit printsupport widgets
 
 macx:QT += xml
-haveQt(5): QT += printsupport widgets
 
 contains(DEFINES, HAVE_FONTCONFIG=1): PKGCONFIG += fontconfig
 
diff --git a/Tools/QtTestBrowser/cookiejar.cpp b/Tools/QtTestBrowser/cookiejar.cpp
index b8ed7d003..ca1b84637 100644
--- a/Tools/QtTestBrowser/cookiejar.cpp
+++ b/Tools/QtTestBrowser/cookiejar.cpp
@@ -29,11 +29,7 @@
 
 #include "cookiejar.h"
 
-#if HAVE(QT5)
 #include <QStandardPaths>
-#else
-#include <QDesktopServices>
-#endif
 #include <QDir>
 #include <QTextStream>
 
@@ -48,12 +44,8 @@ TestBrowserCookieJar::TestBrowserCookieJar(QObject* parent)
     connect(&m_timer, SIGNAL(timeout()), this, SLOT(saveToDisk()));
 
 #ifndef QT_NO_DESKTOPSERVICES
-#if HAVE(QT5)
     QString path = QStandardPaths::writableLocation(QStandardPaths::CacheLocation);
 #else
-    QString path = QDesktopServices::storageLocation(QDesktopServices::CacheLocation);
-#endif
-#else
     QString path = QDir::homePath() + "/.QtTestBrowser";
 #endif
 
diff --git a/Tools/QtTestBrowser/launcherwindow.cpp b/Tools/QtTestBrowser/launcherwindow.cpp
index e4ae456db..4fc90d702 100644
--- a/Tools/QtTestBrowser/launcherwindow.cpp
+++ b/Tools/QtTestBrowser/launcherwindow.cpp
@@ -66,11 +66,7 @@
 #endif
 
 #if !defined(QT_NO_NETWORKDISKCACHE) && !defined(QT_NO_DESKTOPSERVICES)
-#if HAVE(QT5)
 #include <QStandardPaths>
-#else
-#include <QDesktopServices>
-#endif
 #include <QtNetwork/QNetworkDiskCache>
 #endif
 
@@ -808,11 +804,7 @@ void LauncherWindow::setDiskCache(bool enable)
     QNetworkDiskCache* cache = 0;
     if (enable) {
         cache = new QNetworkDiskCache();
-#if HAVE(QT5)
         QString cacheLocation = QStandardPaths::writableLocation(QStandardPaths::CacheLocation);
-#else
-        QString cacheLocation = QDesktopServices::storageLocation(QDesktopServices::CacheLocation);
-#endif
         cache->setCacheDirectory(cacheLocation);
     }
     page()->networkAccessManager()->setCache(cache);
diff --git a/Tools/QueueStatusServer/model/queues.py b/Tools/QueueStatusServer/model/queues.py
index 3c4b77d51..afdd9ea19 100644
--- a/Tools/QueueStatusServer/model/queues.py
+++ b/Tools/QueueStatusServer/model/queues.py
@@ -40,6 +40,7 @@ class Queue(object):
         "commit-queue",
         "style-queue",
         "chromium-ews",  # aka cr-linux-ews
+        "cr-android-ews",
         "qt-ews",
         "qt-wk2-ews",
         "gtk-ews",
diff --git a/Tools/Scripts/VCSUtils.pm b/Tools/Scripts/VCSUtils.pm
index dd404ce00..4da78720a 100644
--- a/Tools/Scripts/VCSUtils.pm
+++ b/Tools/Scripts/VCSUtils.pm
@@ -366,6 +366,11 @@ sub determineVCSRoot()
     return determineSVNRoot();
 }
 
+sub isWindows()
+{
+    return ($^O eq "MSWin32") || 0;
+}
+
 sub svnRevisionForDirectory($)
 {
     my ($dir) = @_;
@@ -373,10 +378,15 @@ sub svnRevisionForDirectory($)
 
     if (isSVNDirectory($dir)) {
         my $escapedDir = escapeSubversionPath($dir);
-        my $svnInfo = `LC_ALL=C svn info $escapedDir | grep Revision:`;
+        my $command = "svn info $escapedDir | grep Revision:";
+        $command = "LC_ALL=C $command" if !isWindows();
+        my $svnInfo = `$command`;
         ($revision) = ($svnInfo =~ m/Revision: (\d+).*/g);
     } elsif (isGitDirectory($dir)) {
-        my $gitLog = `cd $dir && LC_ALL=C git log --grep='git-svn-id: ' -n 1 | grep git-svn-id:`;
+        my $command = "git log --grep='git-svn-id: ' -n 1 | grep git-svn-id:";
+        $command = "LC_ALL=C $command" if !isWindows();
+        $command = "cd $dir && $command";
+        my $gitLog = `$command`;
         ($revision) = ($gitLog =~ m/ +git-svn-id: .+@(\d+) /g);
     }
     if (!defined($revision)) {
@@ -394,9 +404,13 @@ sub pathRelativeToSVNRepositoryRootForPath($)
     my $svnInfo;
     if (isSVN()) {
         my $escapedRelativePath = escapeSubversionPath($relativePath);
-        $svnInfo = `LC_ALL=C svn info $escapedRelativePath`;
+        my $command = "svn info $escapedRelativePath";
+        $command = "LC_ALL=C $command" if !isWindows();
+        $svnInfo = `$command`;
     } elsif (isGit()) {
-        $svnInfo = `LC_ALL=C git svn info $relativePath`;
+        my $command = "git svn info $relativePath";
+        $command = "LC_ALL=C $command" if !isWindows();
+        $svnInfo = `$command`;
     }
 
     $svnInfo =~ /.*^URL: (.*?)$/m;
diff --git a/Tools/Scripts/bencher b/Tools/Scripts/bencher
index cdedf22e6..0b44da14a 100755
--- a/Tools/Scripts/bencher
+++ b/Tools/Scripts/bencher
@@ -717,9 +717,9 @@ def emitBenchRunCodeFile(name, plan, benchDataPath, benchPath)
     
     preCode = Benchfile.create("bencher-pre") {
       | file |
-      doublePuts($stderr,file,"if (window.layoutTestController) {")
-      doublePuts($stderr,file,"    layoutTestController.dumpAsText(window.enablePixelTesting);")
-      doublePuts($stderr,file,"    layoutTestController.waitUntilDone();")
+      doublePuts($stderr,file,"if (window.testRunner) {")
+      doublePuts($stderr,file,"    testRunner.dumpAsText(window.enablePixelTesting);")
+      doublePuts($stderr,file,"    testRunner.waitUntilDone();")
       doublePuts($stderr,file,"}")
       doublePuts($stderr,file,"")
       doublePuts($stderr,file,"function debug(msg)")
@@ -730,7 +730,7 @@ def emitBenchRunCodeFile(name, plan, benchDataPath, benchPath)
       doublePuts($stderr,file,"}")
       doublePuts($stderr,file,"")
       doublePuts($stderr,file,"function quit() {")
-      doublePuts($stderr,file,"    layoutTestController.notifyDone();")
+      doublePuts($stderr,file,"    testRunner.notifyDone();")
       doublePuts($stderr,file,"}")
       doublePuts($stderr,file,"")
       doublePuts($stderr,file,"__bencher_continuation=null;")
diff --git a/Tools/Scripts/old-run-webkit-tests b/Tools/Scripts/old-run-webkit-tests
index 09443c87c..18ae056a1 100755
--- a/Tools/Scripts/old-run-webkit-tests
+++ b/Tools/Scripts/old-run-webkit-tests
@@ -748,12 +748,16 @@ for my $test (@tests) {
     print $tests_run_fh "$test\n";
 
     # Try to read expected hash file for pixel tests
-    my $suffixExpectedHash = "";
-    if ($pixelTests && !$resetResults) {
-        my $expectedPixelDir = expectedDirectoryForTest($base, 0, "png");
-        if (my $expectedHash = readChecksumFromPng(File::Spec->catfile($expectedPixelDir, "$base-$expectedTag.png"))) {
-            # Format expected hash into a suffix string that is appended to the path / URL passed to DRT.
-            $suffixExpectedHash = "'$expectedHash";
+    my $suffixPixelTest = "";
+    if ($pixelTests) {
+        # ' is the separator between arguments.
+        $suffixPixelTest = "'--pixel-test";
+        if (!$resetResults) {
+            my $expectedPixelDir = expectedDirectoryForTest($base, 0, "png");
+            if (my $expectedHash = readChecksumFromPng(File::Spec->catfile($expectedPixelDir, "$base-$expectedTag.png"))) {
+                # Format expected hash into a suffix string that is appended to the path / URL passed to DRT.
+                $suffixPixelTest = "'--pixel-test'$expectedHash";
+            }
         }
     }
 
@@ -789,11 +793,11 @@ for my $test (@tests) {
         } elsif ($test !~ /^http\/tests\/local\// && $test !~ /^http\/tests\/ssl\//) {
             my $path = canonpath($test);
             $path =~ s/^http\/tests\///;
-            print OUT "http://127.0.0.1:$httpdPort/$path$suffixExpectedHash\n";
+            print OUT "http://127.0.0.1:$httpdPort/$path$suffixPixelTest\n";
         } elsif ($test =~ /^http\/tests\/ssl\//) {
             my $path = canonpath($test);
             $path =~ s/^http\/tests\///;
-            print OUT "https://127.0.0.1:$httpdSSLPort/$path$suffixExpectedHash\n";
+            print OUT "https://127.0.0.1:$httpdSSLPort/$path$suffixPixelTest\n";
         } else {
             my $testPath = "$testDirectory/$test";
             if (isCygwin()) {
@@ -801,7 +805,7 @@ for my $test (@tests) {
             } else {
                 $testPath = canonpath($testPath);
             }
-            print OUT "$testPath$suffixExpectedHash\n";
+            print OUT "$testPath$suffixPixelTest\n";
         }
     } else {
         my $testPath = "$testDirectory/$test";
@@ -810,7 +814,7 @@ for my $test (@tests) {
         } else {
             $testPath = canonpath($testPath);
         }
-        print OUT "$testPath$suffixExpectedHash\n" if defined $testPath;
+        print OUT "$testPath$suffixPixelTest\n" if defined $testPath;
     }
 
     # DumpRenderTree is expected to dump two "blocks" to stdout for each test.
diff --git a/Tools/Scripts/run-gtk-tests b/Tools/Scripts/run-gtk-tests
index 3a07e9e6c..4f1d4c15f 100755
--- a/Tools/Scripts/run-gtk-tests
+++ b/Tools/Scripts/run-gtk-tests
@@ -1,6 +1,6 @@
 #!/usr/bin/env python
 #
-# Copyright (C) 2012 Igalia S.L.
+# Copyright (C) 2011, 2012 Igalia S.L.
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -20,18 +20,320 @@
 import subprocess
 import os
 import sys
-
-api_tests_command = []
+import optparse
+import re
+from signal import alarm, signal, SIGALRM, SIGKILL
+from gi.repository import Gio, GLib
 
 top_level_directory = os.path.normpath(os.path.join(os.path.dirname(__file__), "..", ".."))
-run_api_tests_path = os.path.join(top_level_directory, 'Tools', 'gtk', 'run-api-tests')
+sys.path.append(os.path.join(top_level_directory, "Tools", "jhbuild"))
+sys.path.append(os.path.join(top_level_directory, "Tools", "gtk"))
+import common
+import jhbuildutils
+
+class SkippedTest:
+    ENTIRE_SUITE = None
+
+    def __init__(self, test, test_case, reason, bug=None):
+        self.test = test
+        self.test_case = test_case
+        self.reason = reason
+        self.bug = bug
+
+    def __str__(self):
+        skipped_test_str = "%s" % self.test
+
+        if not(self.skip_entire_suite()):
+            skipped_test_str += " [%s]" % self.test_case
+
+        skipped_test_str += ": %s " % self.reason
+        if self.bug is not None:
+            skipped_test_str += "(https://bugs.webkit.org/show_bug.cgi?id=%d)" % self.bug
+        return skipped_test_str
+
+    def skip_entire_suite(self):
+        return self.test_case == SkippedTest.ENTIRE_SUITE
+
+class TestTimeout(Exception):
+    pass
+
+class TestRunner:
+    TEST_DIRS = [ "unittests", "WebKit2APITests", "TestWebKitAPI" ]
+
+    SKIPPED = [
+        SkippedTest("unittests/testdownload", "/webkit/download/not-found", "Test fails in GTK Linux 64-bit Release bot", 82329),
+        SkippedTest("unittests/testwebview", "/webkit/webview/icon-uri", "Test times out in GTK Linux 64-bit Release bot", 82328),
+        SkippedTest("unittests/testwebresource", "/webkit/webresource/sub_resource_loading", "Test fails in GTK Linux 64-bit Release bot", 82330),
+        SkippedTest("unittests/testwebinspector", "/webkit/webinspector/close-and-inspect", "Test is flaky in GTK Linux 32-bit Release bot", 82869),
+        SkippedTest("WebKit2APITests/TestWebKitWebView", "/webkit2/WebKitWebView/mouse-target", "Test is flaky in GTK Linux 32-bit Release bot", 82866),
+        SkippedTest("WebKit2APITests/TestResources", "/webkit2/WebKitWebView/resources", "Test is flaky in GTK Linux 32-bit Release bot", 82868),
+        SkippedTest("WebKit2APITests/TestWebKitFindController", "/webkit2/WebKitFindController/next", "Test fails ", 91083),
+        SkippedTest("WebKit2APITests/TestWebKitFindController", "/webkit2/WebKitFindController/previous", "Test fails", 91083),
+        SkippedTest("WebKit2APITests/TestWebKitFindController", "/webkit2/WebKitFindController/hide", "Test  always fails in Xvfb", 89810),
+        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.WKConnection", "Tests fail and time out out", 84959),
+        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.RestoreSessionStateContainingFormData", "Session State is not implemented in GTK+ port", 84960),
+        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.SpacebarScrolling", "Test fails", 84961),
+        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.NewFirstVisuallyNonEmptyLayoutForImages", "Test is flaky", 85066),
+        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.NewFirstVisuallyNonEmptyLayoutFrames", "Test fails", 85037),
+        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.MouseMoveAfterCrash", "Test is flaky", 85066),
+        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.CanHandleRequest", "Test fails", 88453),
+        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.WKPageGetScaleFactorNotZero", "Test fails and times out", 88455),
+    ]
+
+    def __init__(self, options, tests=[]):
+        self._options = options
+        self._programs_path = common.build_path("Programs")
+        self._tests = self._get_tests(tests)
+        self._skipped_tests = TestRunner.SKIPPED
+
+        # These SPI daemons need to be active for the accessibility tests to work.
+        self._spi_registryd = None
+        self._spi_bus_launcher = None
+
+    def _get_tests(self, tests):
+        if tests:
+            return tests
+
+        tests = []
+        for test_dir in self.TEST_DIRS:
+            absolute_test_dir = os.path.join(self._programs_path, test_dir)
+            if not os.path.isdir(absolute_test_dir):
+                continue
+            for test_file in os.listdir(absolute_test_dir):
+                if not test_file.lower().startswith("test"):
+                    continue
+                test_path = os.path.join(self._programs_path, test_dir, test_file)
+                if os.path.isfile(test_path) and os.access(test_path, os.X_OK):
+                    tests.append(test_path)
+        return tests
+
+    def _lookup_atspi2_binary(self, filename):
+        exec_prefix = common.pkg_config_file_variable('atspi-2', 'exec_prefix')
+        if not exec_prefix:
+            return None
+        for path in ['libexec', 'lib/at-spi2-core', 'lib32/at-spi2-core', 'lib64/at-spi2-core']:
+            filepath = os.path.join(exec_prefix, path, filename)
+            if os.path.isfile(filepath):
+                return filepath
+
+        return None
+
+    def _start_accessibility_daemons(self):
+        return False
+        spi_bus_launcher_path = self._lookup_atspi2_binary('at-spi-bus-launcher')
+        spi_registryd_path = self._lookup_atspi2_binary('at-spi2-registryd')
+        if not spi_bus_launcher_path or not spi_registryd_path:
+            return False
+
+        try:
+            self._ally_bus_launcher = subprocess.Popen([spi_bus_launcher_path], env=self._test_env)
+        except:
+            sys.stderr.write("Failed to launch the accessibility bus\n")
+            sys.stderr.flush()
+            return False
+
+        # We need to wait until the SPI bus is launched before trying to start the SPI
+        # registry, so we spin a main loop until the bus name appears on DBus.
+        loop = GLib.MainLoop()
+        Gio.bus_watch_name(Gio.BusType.SESSION, 'org.a11y.Bus', Gio.BusNameWatcherFlags.NONE,
+                           lambda *args: loop.quit(), None)
+        loop.run()
+
+        try:
+            self._spi_registryd = subprocess.Popen([spi_registryd_path], env=self._test_env)
+        except:
+            sys.stderr.write("Failed to launch the accessibility registry\n")
+            sys.stderr.flush()
+            return False
+
+        return True
+
+    def _setup_testing_environment(self):
+        self._test_env = os.environ
+        self._test_env["DISPLAY"] = self._options.display
+        self._test_env["WEBKIT_INSPECTOR_PATH"] = os.path.abspath(os.path.join(self._programs_path, 'resources', 'inspector'))
+        self._test_env['GSETTINGS_BACKEND'] = 'memory'
+        self._test_env["TEST_WEBKIT_API_WEBKIT2_RESOURCES_PATH"] = common.top_level_path("Tools", "TestWebKitAPI", "Tests", "WebKit2")
+        self._test_env["TEST_WEBKIT_API_WEBKIT2_INJECTED_BUNDLE_PATH"] = common.build_path("Libraries")
+        self._test_env["WEBKIT_EXEC_PATH"] = self._programs_path
+
+        try:
+            self._xvfb = subprocess.Popen(["Xvfb", self._options.display, "-screen", "0", "800x600x24", "-nolisten", "tcp"],
+                                          stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        except Exception as e:
+            sys.stderr.write("Failed to run Xvfb: %s\n" % e)
+            sys.stderr.flush()
+            return False
+
+        # If we cannot start the accessibility daemons, we can just skip the accessibility tests.
+        if not self._start_accessibility_daemons():
+            print "Could not start accessibility bus, so skipping TestWebKitAccessibility"
+            self._skipped_tests.append(SkippedTest("WebKit2APITests/TestWebKitAccessibility", SkippedTest.ENTIRE_SUITE, "Could not start accessibility bus"))
+        return True
+
+    def _tear_down_testing_environment(self):
+        if self._spi_registryd:
+            self._spi_registryd.terminate()
+        if self._spi_bus_launcher:
+            self._spi_bus_launcher.terminate()
+        self._xvfb.terminate()
+
+    def _test_cases_to_skip(self, test_program):
+        if self._options.skipped_action != 'skip':
+            return []
+
+        test_cases = []
+        for skipped in self._skipped_tests:
+            if test_program.endswith(skipped.test) and not skipped.skip_entire_suite():
+                test_cases.append(skipped.test_case)
+        return test_cases
+
+    def _should_run_test_program(self, test_program):
+        # This is not affected by the command-line arguments, since programs are skipped for
+        # problems in the harness, such as failing to start the accessibility bus.
+        for skipped in self._skipped_tests:
+            if test_program.endswith(skipped.test) and skipped.skip_entire_suite():
+                return False
+        return True
+
+    def _get_child_pid_from_test_output(self, output):
+        if not output:
+            return -1
+        match = re.search(r'\(pid=(?P<child_pid>[0-9]+)\)', output)
+        if not match:
+            return -1
+        return int(match.group('child_pid'))
+
+    def _kill_process(self, pid):
+        try:
+            os.kill(pid, SIGKILL)
+        except OSError:
+            # Process already died.
+            pass
+
+    def _run_test_command(self, command, timeout=-1):
+        def alarm_handler(signum, frame):
+            raise TestTimeout
+
+        p = subprocess.Popen(command, stdout=subprocess.PIPE, env=self._test_env)
+        if timeout > 0:
+            signal(SIGALRM, alarm_handler)
+            alarm(timeout)
+
+        stdout = ""
+        try:
+            stdout = p.communicate()[0]
+            if timeout > 0:
+                alarm(0)
+            sys.stdout.write(stdout)
+            sys.stdout.flush()
+        except TestTimeout:
+            self._kill_process(p.pid)
+            child_pid = self._get_child_pid_from_test_output(stdout)
+            if child_pid > 0:
+                self._kill_process(child_pid)
+            raise
+
+        return not p.returncode
+
+    def _run_test_glib(self, test_program):
+        tester_command = ['gtester']
+        if self._options.verbose:
+            tester_command.append('--verbose')
+        for test_case in self._test_cases_to_skip(test_program):
+            tester_command.extend(['-s', test_case])
+        tester_command.append(test_program)
+
+        return self._run_test_command(tester_command, self._options.timeout)
+
+    def _run_test_google(self, test_program):
+        tester_command = [test_program]
+        skipped_tests_cases = self._test_cases_to_skip(test_program)
+        if skipped_tests_cases:
+            tester_command.append("--gtest_filter=-%s" % ":".join(skipped_tests_cases))
+
+        return self._run_test_command(tester_command, self._options.timeout)
+
+    def _run_test(self, test_program):
+        if "unittests" in test_program or "WebKit2APITests" in test_program:
+            return self._run_test_glib(test_program)
+
+        if "TestWebKitAPI" in test_program:
+            return self._run_test_google(test_program)
+
+        return False
+
+    def run_tests(self):
+        if not self._tests:
+            sys.stderr.write("ERROR: tests not found in %s.\n" % (self._programs_path))
+            sys.stderr.flush()
+            return 1
+
+        if not self._setup_testing_environment():
+            return 1
+
+        # Remove skipped tests now instead of when we find them, because
+        # some tests might be skipped while setting up the test environment.
+        self._tests = [test for test in self._tests if self._should_run_test_program(test)]
+
+        failed_tests = []
+        timed_out_tests = []
+        try:
+            for test in self._tests:
+                success = True
+                try:
+                    success = self._run_test(test)
+                except TestTimeout:
+                    sys.stdout.write("TEST: %s: TIMEOUT\n" % test)
+                    sys.stdout.flush()
+                    timed_out_tests.append(test)
+
+                if not success:
+                    failed_tests.append(test)
+        finally:
+            self._tear_down_testing_environment()
+
+        if failed_tests:
+            names = [test.replace(self._programs_path, '', 1) for test in failed_tests]
+            sys.stdout.write("Tests failed: %s\n" % ", ".join(names))
+            sys.stdout.flush()
+
+        if timed_out_tests:
+            names = [test.replace(self._programs_path, '', 1) for test in timed_out_tests]
+            sys.stdout.write("Tests that timed out: %s\n" % ", ".join(names))
+            sys.stdout.flush()
+
+        if self._skipped_tests and self._options.skipped_action == 'skip':
+            sys.stdout.write("Tests skipped:\n%s\n" % "\n".join([str(skipped) for skipped in self._skipped_tests]))
+            sys.stdout.flush()
+
+        return len(failed_tests)
 
-if os.path.exists(os.path.join(top_level_directory, 'WebKitBuild', 'Dependencies')):
-    jhbuild_wrapper_path = os.path.join(top_level_directory, 'Tools', 'jhbuild', 'jhbuild-wrapper')
-    api_tests_command = [jhbuild_wrapper_path, '--gtk', 'run', run_api_tests_path]
-else:
-    api_tests_command = [run_api_tests_path]
+if __name__ == "__main__":
+    if not jhbuildutils.enter_jhbuild_environment_if_available("gtk"):
+        print "***"
+        print "*** Warning: jhbuild environment not present. Run update-webkitgtk-libs before build-webkit to ensure proper testing."
+        print "***"
 
-api_tests_command.extend(sys.argv[1:])
-sys.exit(subprocess.Popen(api_tests_command).wait())
+    option_parser = optparse.OptionParser(usage='usage: %prog [options] [test...]')
+    option_parser.add_option('-r', '--release',
+                             action='store_true', dest='release',
+                             help='Run in Release')
+    option_parser.add_option('-d', '--debug',
+                             action='store_true', dest='debug',
+                             help='Run in Debug')
+    option_parser.add_option('-v', '--verbose',
+                             action='store_true', dest='verbose',
+                             help='Run gtester in verbose mode')
+    option_parser.add_option('--display', action='store', dest='display', default=':55',
+                             help='Display to run Xvfb')
+    option_parser.add_option('--skipped', action='store', dest='skipped_action',
+                             choices=['skip', 'ignore', 'only'], default='skip',
+                             metavar='skip|ignore|only',
+                             help='Specifies how to treat the skipped tests')
+    option_parser.add_option('-t', '--timeout',
+                             action='store', type='int', dest='timeout', default=10,
+                             help='Time in seconds until a test times out')
+    options, args = option_parser.parse_args()
 
+    sys.exit(TestRunner(options, args).run_tests())
diff --git a/Tools/Scripts/run-webkit-tests b/Tools/Scripts/run-webkit-tests
index a29029c79..aca8d5dc9 100755
--- a/Tools/Scripts/run-webkit-tests
+++ b/Tools/Scripts/run-webkit-tests
@@ -93,7 +93,7 @@ if (useNewRunWebKitTests()) {
     }
 
     if (runningOnBuildBot()) {
-        push(@ARGV, "--verbose", "--verbose");
+        push(@ARGV, "--debug-rwt-logging");
     }
 }
 
diff --git a/Tools/Scripts/webkitdirs.pm b/Tools/Scripts/webkitdirs.pm
index f8793dff3..e5bf957c0 100755
--- a/Tools/Scripts/webkitdirs.pm
+++ b/Tools/Scripts/webkitdirs.pm
@@ -105,6 +105,7 @@ my $forceChromiumUpdate;
 my $isInspectorFrontend;
 my $isWK2;
 my $shouldTargetWebProcess;
+my $shouldUseXPCServiceForWebProcess;
 my $shouldUseGuardMalloc;
 my $xcodeVersion;
 
@@ -351,7 +352,7 @@ sub determineNumberOfCPUs
     } elsif (isLinux()) {
         # First try the nproc utility, if it exists. If we get no
         # results fall back to just interpretting /proc directly.
-        chomp($numberOfCPUs = `nproc 2> /dev/null`);
+        chomp($numberOfCPUs = `nproc --all 2> /dev/null`);
         if ($numberOfCPUs eq "") {
             $numberOfCPUs = (grep /processor/, `cat /proc/cpuinfo`);
         }
@@ -1441,6 +1442,18 @@ sub determineShouldTargetWebProcess
     $shouldTargetWebProcess = checkForArgumentAndRemoveFromARGV("--target-web-process");
 }
 
+sub shouldUseXPCServiceForWebProcess
+{
+    determineShouldUseXPCServiceForWebProcess();
+    return $shouldUseXPCServiceForWebProcess;
+}
+
+sub determineShouldUseXPCServiceForWebProcess
+{
+    return if defined($shouldUseXPCServiceForWebProcess);
+    $shouldUseXPCServiceForWebProcess = checkForArgumentAndRemoveFromARGV("--use-web-process-xpc-service");
+}
+
 sub debugger
 {
     determineDebugger();
@@ -1480,6 +1493,9 @@ sub setUpGuardMallocIfNeeded
 
     if ($shouldUseGuardMalloc) {
         appendToEnvironmentVariableList("DYLD_INSERT_LIBRARIES", "/usr/lib/libgmalloc.dylib");
+        if (shouldUseXPCServiceForWebProcess()) {
+            appendToEnvironmentVariableList("__XPC_DYLD_INSERT_LIBRARIES", "/usr/lib/libgmalloc.dylib");
+        }
     }
 }
 
@@ -2311,10 +2327,10 @@ sub buildQMakeProjects
     if ($passedConfig =~ m/debug/i) {
         push @buildArgs, "CONFIG-=release";
         push @buildArgs, "CONFIG+=debug";
-    } elsif ($passedConfig =~ m/release/i) {
+    } elsif (!$passedConfig or $passedConfig =~ m/release/i) {
         push @buildArgs, "CONFIG+=release";
         push @buildArgs, "CONFIG-=debug";
-    } elsif ($passedConfig) {
+    } else {
         die "Build type $passedConfig is not supported with --qt.\n";
     }
     push @buildArgs, "CONFIG-=debug_and_release" if ($passedConfig && isDarwin());
@@ -2579,7 +2595,9 @@ sub buildChromium($@)
 
     # We might need to update DEPS or re-run GYP if things have changed.
     if (checkForArgumentAndRemoveFromArrayRef("--update-chromium", \@options)) {
-        system("perl", "Tools/Scripts/update-webkit-chromium", "--force") == 0 or die $!;
+        my @updateCommand = ("perl", "Tools/Scripts/update-webkit-chromium", "--force");
+        push @updateCommand, "--chromium-android" if isChromiumAndroid();
+        system(@updateCommand) == 0 or die $!;
     }
 
     my $result = 1;
@@ -2589,7 +2607,7 @@ sub buildChromium($@)
     } elsif (isCygwin() || isWindows()) {
         # Windows build - builds the root visual studio solution.
         $result = buildChromiumVisualStudioProject("Source/WebKit/chromium/All.sln", $clean);
-    } elsif (isChromiumNinja()) {
+    } elsif (isChromiumNinja() && !isChromiumAndroid()) {
         $result = buildChromiumNinja("all", $clean, @options);
     } elsif (isLinux() || isChromiumAndroid() || isChromiumMacMake()) {
         # Linux build - build using make.
@@ -2676,15 +2694,16 @@ sub printHelpAndExitForRunAndDebugWebKitAppIfNeeded
 
     print STDERR <<EOF;
 Usage: @{[basename($0)]} [options] [args ...]
-  --help                Show this help message
-  --no-saved-state      Disable application resume for the session on Mac OS 10.7
-  --guard-malloc        Enable Guard Malloc (Mac OS X only)
+  --help                            Show this help message
+  --no-saved-state                  Disable application resume for the session on Mac OS 10.7
+  --guard-malloc                    Enable Guard Malloc (OS X only)
+  --use-web-process-xpc-service     Launch the Web Process as an XPC Service (OS X only)
 EOF
 
     if ($includeOptionsForDebugging) {
         print STDERR <<EOF;
-  --target-web-process  Debug the web process
-  --use-lldb            Use LLDB
+  --target-web-process              Debug the web process
+  --use-lldb                        Use LLDB
 EOF
     }
 
@@ -2708,6 +2727,12 @@ sub runMacWebKitApp($;$)
 
     setUpGuardMallocIfNeeded();
 
+    if (shouldUseXPCServiceForWebProcess()) {
+        $ENV{__XPC_DYLD_FRAMEWORK_PATH} = $productDir;
+        appendToEnvironmentVariableList("__XPC_DYLD_INSERT_LIBRARIES", File::Spec->catfile($productDir, "WebProcessShim.dylib"));
+        $ENV{WEBKIT_USE_XPC_SERVICE_FOR_WEB_PROCESS} = "YES";
+    }
+
     if (defined($useOpenCommand) && $useOpenCommand == USE_OPEN_COMMAND) {
         return system("open", "-W", "-a", $appPath, "--args", argumentsForRunAndDebugMacWebKitApp());
     }
@@ -2745,9 +2770,18 @@ sub execMacWebKitAppForDebugging($)
 
     my @architectureFlags = ($architectureSwitch, architecture());
     if (!shouldTargetWebProcess()) {
+        if (shouldUseXPCServiceForWebProcess()) {
+            $ENV{__XPC_DYLD_FRAMEWORK_PATH} = $productDir;
+            appendToEnvironmentVariableList("__XPC_DYLD_INSERT_LIBRARIES", File::Spec->catfile($productDir, "WebProcessShim.dylib"));
+            $ENV{WEBKIT_USE_XPC_SERVICE_FOR_WEB_PROCESS} = "YES";
+        }
         print "Starting @{[basename($appPath)]} under $debugger with DYLD_FRAMEWORK_PATH set to point to built WebKit in $productDir.\n";
         exec { $debuggerPath } $debuggerPath, @architectureFlags, $argumentsSeparator, $appPath, argumentsForRunAndDebugMacWebKitApp() or die;
     } else {
+        if (shouldUseXPCServiceForWebProcess()) {
+            die "Targetting the Web Process is not compatible with using an XPC Service for the Web Process at this time.";
+        }
+        
         my $webProcessShimPath = File::Spec->catfile($productDir, "WebProcessShim.dylib");
         my $webProcessPath = File::Spec->catdir($productDir, "WebProcess.app");
         my $webKit2ExecutablePath = File::Spec->catfile($productDir, "WebKit2.framework", "WebKit2");
diff --git a/Tools/Scripts/webkitperl/FeatureList.pm b/Tools/Scripts/webkitperl/FeatureList.pm
index 77cc1f763..930947828 100644
--- a/Tools/Scripts/webkitperl/FeatureList.pm
+++ b/Tools/Scripts/webkitperl/FeatureList.pm
@@ -53,6 +53,7 @@ my (
     $cssBoxDecorationBreakSupport,
     $cssExclusionsSupport,
     $cssFiltersSupport,
+    $cssHierarchiesSupport,
     $cssImageOrientationSupport,
     $cssImageResolutionSupport,
     $cssRegionsSupport,
@@ -145,7 +146,7 @@ my @features = (
       define => "ENABLE_ACCELERATED_2D_CANVAS", default => 0, value => \$accelerated2DCanvasSupport },
 
     { option => "animation-api", desc => "Toggle Animation API support",
-      define => "ENABLE_ANIMATION_API", default => isBlackBerry(), value => \$animationAPISupport },
+      define => "ENABLE_ANIMATION_API", default => (isBlackBerry() || isEfl()), value => \$animationAPISupport },
 
     { option => "battery-status", desc => "Toggle Battery Status support",
       define => "ENABLE_BATTERY_STATUS", default => (isEfl() || isBlackBerry()), value => \$batteryStatusSupport },
@@ -163,11 +164,14 @@ my @features = (
       define => "ENABLE_CSS_EXCLUSIONS", default => 1, value => \$cssExclusionsSupport },
 
     { option => "css-filters", desc => "Toggle CSS Filters support",
-      define => "ENABLE_CSS_FILTERS", default => isAppleWebKit(), value => \$cssFiltersSupport },
+      define => "ENABLE_CSS_FILTERS", default => isAppleWebKit() || isBlackBerry(), value => \$cssFiltersSupport },
 
     { option => "css3-flexbox", desc => "Toggle CSS3 Flexbox support",
       define => "ENABLE_CSS3_FLEXBOX", default => 1, value => \$css3FlexboxSupport },
 
+    { option => "css-hierarchies", desc => "Toggle CSS Hierarchy support",
+      define => "ENABLE_CSS_HIERARCHIES", default => 0, value => \$cssHierarchiesSupport },
+
     { option => "css-box-decoration-break", desc => "Toggle CSS box-decoration-break support",
       define => "ENABLE_CSS_BOX_DECORATION_BREAK", default => 1, value => \$cssBoxDecorationBreakSupport },
 
@@ -187,7 +191,7 @@ my @features = (
       define => "ENABLE_CSS_COMPOSITING", default => 0, value => \$cssCompositingSupport },
 
     { option => "css-variables", desc => "Toggle CSS Variable support",
-      define => "ENABLE_CSS_VARIABLES", default => isEfl(), value => \$cssVariablesSupport },
+      define => "ENABLE_CSS_VARIABLES", default => (isBlackBerry() || isEfl()), value => \$cssVariablesSupport },
 
     { option => "custom-scheme-handler", desc => "Toggle Custom Scheme Handler support",
       define => "ENABLE_CUSTOM_SCHEME_HANDLER", default => (isBlackBerry() || isEfl()), value => \$customSchemeHandlerSupport },
@@ -226,7 +230,7 @@ my @features = (
       define => "ENABLE_FULLSCREEN_API", default => (isAppleMacWebKit() || isEfl() || isGtk() || isBlackBerry() || isQt()), value => \$fullscreenAPISupport },
 
     { option => "gamepad", desc => "Toggle Gamepad support",
-      define => "ENABLE_GAMEPAD", default => (isEfl() || isGtk()), value => \$gamepadSupport },
+      define => "ENABLE_GAMEPAD", default => (isEfl() || isGtk() || isQt()), value => \$gamepadSupport },
 
     { option => "geolocation", desc => "Toggle Geolocation support",
       define => "ENABLE_GEOLOCATION", default => (isAppleWebKit() || isGtk() || isBlackBerry()), value => \$geolocationSupport },
@@ -280,7 +284,7 @@ my @features = (
       define => "ENABLE_LEGACY_WEBKIT_BLOB_BUILDER", default => (isGtk() || isChromium() || isBlackBerry() || isEfl()), value => \$legacyWebKitBlobBuilderSupport },
 
     { option => "link-prefetch", desc => "Toggle Link Prefetch support",
-      define => "ENABLE_LINK_PREFETCH", default => isGtk(), value => \$linkPrefetchSupport },
+      define => "ENABLE_LINK_PREFETCH", default => (isGtk() || isEfl()), value => \$linkPrefetchSupport },
 
     { option => "link-prerender", desc => "Toggle Link Prerender support",
       define => "ENABLE_LINK_PRERENDER", default => 0, value => \$linkPrerenderSupport },
diff --git a/Tools/Scripts/webkitpy/common/checkout/scm/scm_mock.py b/Tools/Scripts/webkitpy/common/checkout/scm/scm_mock.py
index 8b6c76499..9dd01e8d4 100644
--- a/Tools/Scripts/webkitpy/common/checkout/scm/scm_mock.py
+++ b/Tools/Scripts/webkitpy/common/checkout/scm/scm_mock.py
@@ -69,10 +69,10 @@ class MockSCM(object):
         return ["MockFile1"]
 
     def head_svn_revision(self):
-        return 1234
+        return '1234'
 
     def svn_revision(self, path):
-        return 5678
+        return '5678'
 
     def create_patch(self, git_commit, changed_files=None):
         return "Patch1"
diff --git a/Tools/Scripts/webkitpy/common/config/committers.py b/Tools/Scripts/webkitpy/common/config/committers.py
index b1b8a3fac..ddfddf9a9 100644
--- a/Tools/Scripts/webkitpy/common/config/committers.py
+++ b/Tools/Scripts/webkitpy/common/config/committers.py
@@ -127,6 +127,7 @@ contributors_who_are_not_committers = [
     Contributor("Dongsung Huang", "luxtella@company100.net", "Huang"),
     Contributor("Douglas Davidson", "ddavidso@apple.com"),
     Contributor("Edward O'Connor", "eoconnor@apple.com", "hober"),
+    Contributor("Elliott Sprehn", "esprehn@chromium.org", "esprehn"),
     Contributor("Eric Penner", "epenner@chromium.org", "epenner"),
     Contributor("Felician Marton", ["felician@inf.u-szeged.hu", "marton.felician.zoltan@stud.u-szeged.hu"], "Felician"),
     Contributor("Finnur Thorarinsson", ["finnur@chromium.org", "finnur.webkit@gmail.com"], "finnur"),
@@ -136,6 +137,7 @@ contributors_who_are_not_committers = [
     Contributor("Hao Zheng", "zhenghao@chromium.org"),
     Contributor("Ian Hickson", "ian@hixie.ch", "hixie"),
     Contributor("Janos Badics", "jbadics@inf.u-szeged.hu", 'dicska'),
+    Contributor("Jeff Timanus", ["twiz@chromium.org", "twiz@google.com"], "twiz"),
     Contributor("Jing Zhao", "jingzhao@chromium.org"),
     Contributor("John Bates", ["jbates@google.com", "jbates@chromium.org"], "jbates"),
     Contributor("John Bauman", ["jbauman@chromium.org", "jbauman@google.com"], "jbauman"),
@@ -182,7 +184,6 @@ committers_unable_to_review = [
     Committer("Alec Flett", ["alecflett@chromium.org", "alecflett@google.com"], "alecf"),
     Committer(u"Alexander F\u00e6r\u00f8y", ["ahf@0x90.dk", "alexander.faeroy@nokia.com"], "ahf"),
     Committer("Alexander Kellett", ["lypanov@mac.com", "a-lists001@lypanov.net", "lypanov@kde.org"], "lypanov"),
-    Committer("Alexander Pavlov", "apavlov@chromium.org", "apavlov"),
     Committer("Alexandru Chiculita", "achicu@adobe.com", "achicu"),
     Committer("Alice Boxhall", "aboxhall@chromium.org", "aboxhall"),
     Committer("Allan Sandfeld Jensen", ["allan.jensen@nokia.com", "kde@carewolf.com", "sandfeld@kde.org"], "carewolf"),
@@ -202,6 +203,7 @@ committers_unable_to_review = [
     Committer("Anton D'Auria", "adauria@apple.com", "antonlefou"),
     Committer("Anton Muhin", "antonm@chromium.org", "antonm"),
     Committer("Arko Saha", "arko@motorola.com", "arkos"),
+    Committer("Arvid Nilsson", "anilsson@rim.com", "anilsson"),
     Committer("Balazs Kelemen", "kbalazs@webkit.org", "kbalazs"),
     Committer("Ben Murdoch", "benm@google.com", "benm"),
     Committer("Ben Wells", "benwells@chromium.org", "benwells"),
@@ -415,6 +417,7 @@ reviewers_list = [
     Reviewer("Adele Peterson", "adele@apple.com", "adele"),
     Reviewer("Adrienne Walker", ["enne@google.com", "enne@chromium.org"], "enne"),
     Reviewer("Alejandro G. Castro", ["alex@igalia.com", "alex@webkit.org"], "alexg__"),
+    Reviewer("Alexander Pavlov", ["apavlov@chromium.org", "pavlov81@gmail.com"], "apavlov"),
     Reviewer("Alexey Proskuryakov", ["ap@webkit.org", "ap@apple.com"], "ap"),
     Reviewer("Alexis Menard", ["alexis.menard@openbossa.org", "menard@kde.org"], "darktears"),
     Reviewer("Alice Liu", "alice.liu@apple.com", "aliu"),
diff --git a/Tools/Scripts/webkitpy/common/config/ports.py b/Tools/Scripts/webkitpy/common/config/ports.py
index c086238fd..1d76b4218 100644
--- a/Tools/Scripts/webkitpy/common/config/ports.py
+++ b/Tools/Scripts/webkitpy/common/config/ports.py
@@ -59,6 +59,7 @@ class DeprecatedPort(object):
     def port(port_name):
         ports = {
             "chromium": ChromiumPort,
+            "chromium-android": ChromiumAndroidPort,
             "chromium-xvfb": ChromiumXVFBPort,
             "gtk": GtkPort,
             "mac": MacPort,
@@ -193,6 +194,20 @@ class ChromiumPort(DeprecatedPort):
         return None
 
 
+class ChromiumAndroidPort(ChromiumPort):
+    port_flag_name = "chromium-android"
+
+    def update_webkit_command(self, non_interactive=False):
+        command = super(ChromiumAndroidPort, self).update_webkit_command(non_interactive=non_interactive)
+        command.append("--chromium-android")
+        return command
+
+    def build_webkit_command(self, build_style=None):
+        command = super(ChromiumAndroidPort, self).build_webkit_command(build_style=build_style)
+        command.append("--chromium-android")
+        return command
+
+
 class ChromiumXVFBPort(ChromiumPort):
     port_flag_name = "chromium-xvfb"
 
diff --git a/Tools/Scripts/webkitpy/common/config/ports_unittest.py b/Tools/Scripts/webkitpy/common/config/ports_unittest.py
index e0b77c82e..df5bf7352 100644
--- a/Tools/Scripts/webkitpy/common/config/ports_unittest.py
+++ b/Tools/Scripts/webkitpy/common/config/ports_unittest.py
@@ -59,6 +59,10 @@ class DeprecatedPortTest(unittest.TestCase):
         self.assertEquals(ChromiumPort().build_webkit_command(build_style="debug"), DeprecatedPort().script_shell_command("build-webkit") + ["--debug", "--chromium", "--update-chromium"])
         self.assertEquals(ChromiumPort().update_webkit_command(), DeprecatedPort().script_shell_command("update-webkit") + ["--chromium"])
 
+    def test_chromium_android_port(self):
+        self.assertEquals(ChromiumAndroidPort().build_webkit_command(), ChromiumPort().build_webkit_command() + ["--chromium-android"])
+        self.assertEquals(ChromiumAndroidPort().update_webkit_command(), ChromiumPort().update_webkit_command() + ["--chromium-android"])
+
     def test_chromium_xvfb_port(self):
         self.assertEquals(ChromiumXVFBPort().run_webkit_tests_command(), ['xvfb-run'] + DeprecatedPort().script_shell_command('new-run-webkit-tests') + ['--chromium', '--skip-failing-tests'])
 
diff --git a/Tools/Scripts/webkitpy/common/config/watchlist b/Tools/Scripts/webkitpy/common/config/watchlist
index 127772c80..e5c9c2776 100755
--- a/Tools/Scripts/webkitpy/common/config/watchlist
+++ b/Tools/Scripts/webkitpy/common/config/watchlist
@@ -12,9 +12,6 @@
 #
 {
     "DEFINITIONS": {
-        "ChromiumDumpRenderTree": {
-            "filename": r"Tools/DumpRenderTree/chromium/",
-        },
         "ChromiumGraphics": {
             "filename": r"Source/WebCore/platform/graphics/chromium/",
         },
@@ -26,13 +23,11 @@
             "filename": r"Source/WebCore/bindings/objc/PublicDOMInterfaces.h"
         },
         "Forms": {
-            "filename": r"Source/WebCore/html/HTML(DataList|FieldSet|Form|FormControl|Input|Keygen|Label"
-                        r"|Legend|OptGroup|Option|Output|Select|TextArea|TextFormControl)Element\."
-                        r"|Source/WebCore/html/FormAssociatedElement\."
+            "filename": r"Source/WebCore/html/HTML(DataList|FieldSet|Input|Keygen|Label|Legend|OptGroup|Option|Output|Select|TextArea)Element\."
+                        r"|Source/WebCore/html/.*Form[A-Z].*\."
                         r"|Source/WebCore/html/\w*InputType\."
                         r"|Source/WebCore/html/shadow/(SliderThumbElement|TextControlInnerElements)\."
-                        r"|Source/WebCore/rendering/Render(FileUploadControl|ListBox|MenuList|Slider|TextControl"
-                        r"|TextControlMultiLine|TextControlSingleLine)\."
+                        r"|Source/WebCore/rendering/Render(FileUploadControl|ListBox|MenuList|Slider|TextControl.*)\."
         },
         "GStreamerGraphics": {
             "filename": r"Source/WebCore/platform/graphics/gstreamer/",
@@ -69,6 +64,10 @@
             "less": r"[Ss]ecurityOrigin(?!\.(h|cpp))",
             "filename": r"XSS|[Ss]ecurity",
         },
+        "SkiaGraphics": {
+            "filename": r"Source/WebCore/platform/graphics/skia/"
+                        r"|Source/WebCore/platform/graphics/filters/skia/",
+        },
         "V8Bindings": {
             "filename": r"Source/WebCore/bindings/v8/",
         },
@@ -224,7 +223,6 @@
         "BlackBerry": [ "mifenton@rim.com" ],
         "CMake": [ "rakuco@webkit.org", "gyuyoung.kim@samsung.com" ],
         "CSS": [ "alexis.menard@openbossa.org", "macpherson@chromium.org", "cmarcelo@webkit.org" ],
-        "ChromiumDumpRenderTree": [ "tkent@chromium.org", ],
         "ChromiumGraphics": [ "jamesr@chromium.org", "cc-bugs@google.com" ],
         "ChromiumPublicApi": [ "abarth@webkit.org", "dglazkov@chromium.org", "fishd@chromium.org", "jamesr@chromium.org", "tkent+wkapi@chromium.org" ],
         "DOMAttributes": [ "cmarcelo@webkit.org", ],
@@ -233,14 +231,15 @@
         "EFLWebKit2PublicAPI": [ "gyuyoung.kim@samsung.com" ],
         "Editing": [ "mifenton@rim.com" ],
         "Forms": [ "tkent@chromium.org", "mifenton@rim.com" ],
-        "FrameLoader": [ "abarth@webkit.org", "japhet@chromium.org", "jochen@chromium.org" ],
+        "FrameLoader": [ "abarth@webkit.org", "japhet@chromium.org" ],
         "GStreamerGraphics": [ "alexis.menard@openbossa.org", "pnormand@igalia.com", "gns@gnome.org", "mrobinson@webkit.org" ],
         "GtkWebKit2PublicAPI": [ "cgarcia@igalia.com", "gns@gnome.org", "mrobinson@webkit.org" ],
-        "Loader": [ "japhet@chromium.org", "jochen@chromium.org" ],
+        "Loader": [ "japhet@chromium.org" ],
         "MathML": [ "dbarton@mathscribe.com" ],
         "Media": [ "feature-media-reviews@chromium.org", "eric.carlson@apple.com" ],
         "NetworkInfo": [ "gyuyoung.kim@samsung.com" ],
         "OpenGL" : [ "noam.rosenthal@nokia.com" ],
+        "SkiaGraphics": [ "senorblanco@chromium.org" ],
         "QtBuildSystem" : [ "vestbo@webkit.org", ],
         "QtGraphics" : [ "noam.rosenthal@nokia.com" ],
         "QtWebKit2PlatformSpecific": [ "alexis.menard@openbossa.org", "zoltan@webkit.org", "cmarcelo@webkit.org" ],
@@ -253,7 +252,7 @@
         "TestFailures": [ "abarth@webkit.org", "dglazkov@chromium.org" ],
         "TextureMapper" : [ "noam.rosenthal@nokia.com" ],
         "ThreadingFiles|ThreadingUsage": [ "levin+threading@chromium.org", ],
-        "V8Bindings|BindingsScripts": [ "abarth@webkit.org", "japhet@chromium.org", "haraken@chromium.org", "jochen@chromium.org" ],
+        "V8Bindings|BindingsScripts": [ "abarth@webkit.org", "japhet@chromium.org", "haraken@chromium.org" ],
         "WatchListScript": [ "levin+watchlist@chromium.org", ],
         "WebIDL": [ "abarth@webkit.org", "ojan@chromium.org" ],
         "WebKitGTKTranslations": [ "gns@gnome.org", "mrobinson@webkit.org" ],
diff --git a/Tools/Scripts/webkitpy/common/message_pool.py b/Tools/Scripts/webkitpy/common/message_pool.py
index 2d90cbe0b..2e1e85e5c 100644
--- a/Tools/Scripts/webkitpy/common/message_pool.py
+++ b/Tools/Scripts/webkitpy/common/message_pool.py
@@ -104,12 +104,22 @@ class _MessagePool(object):
             host = self._host
 
         for worker_number in xrange(self._num_workers):
-            worker = _Worker(host, self._messages_to_manager, self._messages_to_worker, self._worker_factory, worker_number, self._running_inline, self if self._running_inline else None)
+            worker = _Worker(host, self._messages_to_manager, self._messages_to_worker, self._worker_factory, worker_number, self._running_inline, self if self._running_inline else None, self._worker_log_level())
             self._workers.append(worker)
             worker.start()
             if self._worker_startup_delay_secs:
                 time.sleep(self._worker_startup_delay_secs)
 
+    def _worker_log_level(self):
+        log_level = logging.NOTSET
+        for handler in logging.root.handlers:
+            if handler.level != logging.NOTSET:
+                if log_level == logging.NOTSET:
+                    log_level = handler.level
+                else:
+                    log_level = min(log_level, handler.level)
+        return log_level
+
     def wait(self):
         try:
             self._start_workers()
@@ -192,12 +202,13 @@ class _Message(object):
 
 
 class _Worker(multiprocessing.Process):
-    def __init__(self, host, messages_to_manager, messages_to_worker, worker_factory, worker_number, running_inline, manager):
+    def __init__(self, host, messages_to_manager, messages_to_worker, worker_factory, worker_number, running_inline, manager, log_level):
         super(_Worker, self).__init__()
         self.host = host
         self.worker_number = worker_number
         self.name = 'worker/%d' % worker_number
         self.log_messages = []
+        self.log_level = log_level
         self._running_inline = running_inline
         self._manager = manager
 
@@ -300,12 +311,14 @@ class _Worker(multiprocessing.Process):
 
         self._log_handler = _WorkerLogHandler(self)
         self._logger.addHandler(self._log_handler)
+        self._logger.setLevel(self.log_level)
 
 
 class _WorkerLogHandler(logging.Handler):
     def __init__(self, worker):
         logging.Handler.__init__(self)
         self._worker = worker
+        self.setLevel(worker.log_level)
 
     def emit(self, record):
         self._worker.log_messages.append(record)
diff --git a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
index e48293b89..eecadf226 100644
--- a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
+++ b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
@@ -578,19 +578,14 @@ class Bugzilla(object):
             return file_object.name
         return "bug-%s-%s.%s" % (bug_id, timestamp(), extension)
 
-    def add_attachment_to_bug(self,
-                              bug_id,
-                              file_or_string,
-                              description,
-                              filename=None,
-                              comment_text=None):
+    def add_attachment_to_bug(self, bug_id, file_or_string, description, filename=None, comment_text=None, mimetype=None):
         self.authenticate()
         log('Adding attachment "%s" to %s' % (description, self.bug_url_for_bug_id(bug_id)))
         self.browser.open(self.add_attachment_url(bug_id))
         self.browser.select_form(name="entryform")
         file_object = self._file_object_for_upload(file_or_string)
         filename = filename or self._filename_for_upload(file_object, bug_id)
-        self._fill_attachment_form(description, file_object, filename=filename)
+        self._fill_attachment_form(description, file_object, filename=filename, mimetype=mimetype)
         if comment_text:
             log(comment_text)
             self.browser['comment'] = comment_text
diff --git a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_mock.py b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_mock.py
index cd12c8033..71b080ce9 100644
--- a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_mock.py
+++ b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_mock.py
@@ -393,13 +393,9 @@ class MockBugzilla(object):
         log("MOCK bug comment: bug_id=%s, cc=%s\n--- Begin comment ---\n%s\n--- End comment ---\n" % (
             bug_id, cc, comment_text))
 
-    def add_attachment_to_bug(self,
-                              bug_id,
-                              file_or_string,
-                              description,
-                              filename=None,
-                              comment_text=None):
-        log("MOCK add_attachment_to_bug: bug_id=%s, description=%s filename=%s" % (bug_id, description, filename))
+    def add_attachment_to_bug(self, bug_id, file_or_string, description, filename=None, comment_text=None, mimetype=None):
+        log("MOCK add_attachment_to_bug: bug_id=%s, description=%s filename=%s mimetype=%s" %
+            (bug_id, description, filename, mimetype))
         if comment_text:
             log("-- Begin comment --")
             log(comment_text)
diff --git a/Tools/Scripts/webkitpy/common/net/credentials.py b/Tools/Scripts/webkitpy/common/net/credentials.py
index d76405b39..21aeaeafe 100644
--- a/Tools/Scripts/webkitpy/common/net/credentials.py
+++ b/Tools/Scripts/webkitpy/common/net/credentials.py
@@ -131,9 +131,12 @@ class Credentials(object):
             return
         if not User().confirm("Store password in system keyring?", User.DEFAULT_NO):
             return
-        self._keyring.set_password(self.host, username, password)
+        try:
+            self._keyring.set_password(self.host, username, password)
+        except:
+            pass
 
-    def read_credentials(self):
+    def read_credentials(self, user=User):
         username, password = self._credentials_from_environment()
         # FIXME: We don't currently support pulling the username from one
         # source and the password from a separate source.
@@ -142,13 +145,17 @@ class Credentials(object):
         if not username or not password:
             username, password = self._credentials_from_keychain(username)
 
+        if not username:
+            username = user.prompt("%s login: " % self.host)
+
         if username and not password and self._keyring:
-            password = self._keyring.get_password(self.host, username)
+            try:
+                password = self._keyring.get_password(self.host, username)
+            except:
+                pass
 
-        if not username:
-            username = User.prompt("%s login: " % self.host)
         if not password:
-            password = User.prompt_password("%s password for %s: " % (self.host, username))
+            password = user.prompt_password("%s password for %s: " % (self.host, username))
             self._offer_to_store_credentials_in_keyring(username, password)
 
         return (username, password)
diff --git a/Tools/Scripts/webkitpy/common/net/credentials_unittest.py b/Tools/Scripts/webkitpy/common/net/credentials_unittest.py
index 2ab160c88..a797e3d1b 100644
--- a/Tools/Scripts/webkitpy/common/net/credentials_unittest.py
+++ b/Tools/Scripts/webkitpy/common/net/credentials_unittest.py
@@ -32,6 +32,7 @@ import unittest
 from webkitpy.common.net.credentials import Credentials
 from webkitpy.common.system.executive import Executive
 from webkitpy.common.system.outputcapture import OutputCapture
+from webkitpy.common.system.user_mock import MockUser
 from webkitpy.thirdparty.mock import Mock
 from webkitpy.tool.mocktool import MockOptions
 from webkitpy.common.system.executive_mock import MockExecutive
@@ -179,6 +180,33 @@ password: "SECRETSAUCE"
             # credential source could be affected by the user's environment.
             self.assertEqual(credentials.read_credentials(), ("test@webkit.org", "NOMNOMNOM"))
 
+    def test_keyring_without_git_repo_nor_keychain(self):
+        class MockKeyring(object):
+            def get_password(self, host, username):
+                return "NOMNOMNOM"
+
+        class FakeCredentials(MockedCredentials):
+            def _credentials_from_keychain(self, username):
+                return (None, None)
+
+            def _credentials_from_environment(self):
+                return (None, None)
+
+        class FakeUser(MockUser):
+            @classmethod
+            def prompt(cls, message, repeat=1, raw_input=raw_input):
+                return "test@webkit.org"
+
+            @classmethod
+            def prompt_password(cls, message, repeat=1, raw_input=raw_input):
+                raise AssertionError("should not prompt for password")
+
+        with _TemporaryDirectory(suffix="not_a_git_repo") as temp_dir_path:
+            credentials = FakeCredentials("fake.hostname", cwd=temp_dir_path, keyring=MockKeyring())
+            # FIXME: Using read_credentials here seems too broad as higher-priority
+            # credential source could be affected by the user's environment.
+            self.assertEqual(credentials.read_credentials(FakeUser), ("test@webkit.org", "NOMNOMNOM"))
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/common/prettypatch_unittest.py b/Tools/Scripts/webkitpy/common/prettypatch_unittest.py
index 6a3c79a7a..37fa844fd 100644
--- a/Tools/Scripts/webkitpy/common/prettypatch_unittest.py
+++ b/Tools/Scripts/webkitpy/common/prettypatch_unittest.py
@@ -27,6 +27,7 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 import os.path
+import sys
 import unittest
 
 from webkitpy.common.system.executive import Executive
@@ -69,6 +70,10 @@ Index: latin1_test
         if not self.check_ruby():
             return
 
+        if sys.platform == 'win32':
+            # FIXME: disabled due to https://bugs.webkit.org/show_bug.cgi?id=93192
+            return
+
         pretty_patch = PrettyPatch(Executive(), self._webkit_root())
         pretty = pretty_patch.pretty_diff(self._diff_with_multiple_encodings)
         self.assertTrue(pretty)  # We got some output
diff --git a/Tools/Scripts/webkitpy/common/system/autoinstall.py b/Tools/Scripts/webkitpy/common/system/autoinstall.py
index e5bc0b2cb..00aff83ff 100755
--- a/Tools/Scripts/webkitpy/common/system/autoinstall.py
+++ b/Tools/Scripts/webkitpy/common/system/autoinstall.py
@@ -456,7 +456,7 @@ class AutoInstaller(object):
             _log.debug('URL for %s already downloaded.  Skipping...'
                        % target_name)
             _log.debug('    "%s"' % url)
-            return
+            return False
 
         self._log_transfer("Auto-installing package: %s" % target_name,
                             url, target_path, log_method=_log.info)
@@ -484,6 +484,7 @@ class AutoInstaller(object):
             shutil.rmtree(scratch_dir)
         _log.debug('Auto-installed %s to:' % target_name)
         _log.debug('    "%s"' % target_path)
+        return True
 
 
 if __name__=="__main__":
diff --git a/Tools/Scripts/webkitpy/common/system/executive_unittest.py b/Tools/Scripts/webkitpy/common/system/executive_unittest.py
index c041b6372..79a8281cd 100644
--- a/Tools/Scripts/webkitpy/common/system/executive_unittest.py
+++ b/Tools/Scripts/webkitpy/common/system/executive_unittest.py
@@ -152,7 +152,7 @@ class ExecutiveTest(unittest.TestCase):
         output = executive.run_and_throw_if_fail(command_line('echo', unicode_tor_input), quiet=True, decode_output=False)
         self.assertEquals(output, encoded_tor)
 
-    def test_kill_process(self):
+    def serial_test_kill_process(self):
         executive = Executive()
         process = subprocess.Popen(never_ending_command(), stdout=subprocess.PIPE)
         self.assertEqual(process.poll(), None)  # Process is running
@@ -169,8 +169,8 @@ class ExecutiveTest(unittest.TestCase):
         # Killing again should fail silently.
         executive.kill_process(process.pid)
 
-        # Now test kill_all ; we do this in the same test as kill
-        # so that we don't collide when running tests in parallel.
+    def serial_test_kill_all(self):
+        executive = Executive()
         process = subprocess.Popen(never_ending_command(), stdout=subprocess.PIPE)
         self.assertEqual(process.poll(), None)  # Process is running
         executive.kill_all(never_ending_command()[0])
@@ -202,13 +202,13 @@ class ExecutiveTest(unittest.TestCase):
         self._assert_windows_image_name("foo.baz", "foo.baz")
         self._assert_windows_image_name("foo.baz.exe", "foo.baz.exe")
 
-    def test_check_running_pid(self):
+    def serial_test_check_running_pid(self):
         executive = Executive()
         self.assertTrue(executive.check_running_pid(os.getpid()))
         # Maximum pid number on Linux is 32768 by default
         self.assertFalse(executive.check_running_pid(100000))
 
-    def test_running_pids(self):
+    def serial_test_running_pids(self):
         if sys.platform in ("win32", "cygwin"):
             return  # This function isn't implemented on Windows yet.
 
@@ -216,7 +216,9 @@ class ExecutiveTest(unittest.TestCase):
         pids = executive.running_pids()
         self.assertTrue(os.getpid() in pids)
 
-    def test_run_in_parallel(self):
+    def serial_test_run_in_parallel(self):
+        # We run this test serially to avoid overloading the machine and throwing off the timing.
+
         if sys.platform in ("win32", "cygwin"):
             return  # This function isn't implemented properly on windows yet.
         import multiprocessing
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem.py b/Tools/Scripts/webkitpy/common/system/filesystem.py
index 687a31322..d8ee167ae 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem.py
@@ -262,6 +262,9 @@ class FileSystem(object):
         """Delete the directory rooted at path, whether empty or not."""
         shutil.rmtree(path, ignore_errors=True)
 
+    def copytree(self, source, destination):
+        shutil.copytree(source, destination)
+
     def split(self, path):
         """Return (dirname, basename + '.' + ext)"""
         return os.path.split(path)
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem_mock.py b/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
index a4eb695bf..c2d823a81 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
@@ -378,6 +378,16 @@ class MockFileSystem(object):
 
         self.dirs = set(filter(lambda d: not d.startswith(path), self.dirs))
 
+    def copytree(self, source, destination):
+        source = self.normpath(source)
+        destination = self.normpath(destination)
+
+        for source_file in self.files:
+            if source_file.startswith(source):
+                destination_path = self.join(destination, self.relpath(source_file, source))
+                self.maybe_make_directory(self.dirname(destination_path))
+                self.files[destination_path] = self.files[source_file]
+
     def split(self, path):
         idx = path.rfind(self.sep)
         if idx == -1:
diff --git a/Tools/Scripts/webkitpy/common/system/outputcapture.py b/Tools/Scripts/webkitpy/common/system/outputcapture.py
index 4f931b7d1..78a12f0e2 100644
--- a/Tools/Scripts/webkitpy/common/system/outputcapture.py
+++ b/Tools/Scripts/webkitpy/common/system/outputcapture.py
@@ -68,11 +68,15 @@ class OutputCapture(object):
         self._logs = StringIO()
         self._logs_handler = logging.StreamHandler(self._logs)
         self._logs_handler.setLevel(self._log_level)
-        logging.getLogger().addHandler(self._logs_handler)
+        self._logger = logging.getLogger()
+        self._orig_log_level = self._logger.level
+        self._logger.addHandler(self._logs_handler)
+        self._logger.setLevel(min(self._log_level, self._orig_log_level))
         return (self._capture_output_with_name("stdout"), self._capture_output_with_name("stderr"))
 
     def restore_output(self):
-        logging.getLogger().removeHandler(self._logs_handler)
+        self._logger.removeHandler(self._logs_handler)
+        self._logger.setLevel(self._orig_log_level)
         self._logs_handler.flush()
         self._logs.flush()
         logs_string = self._logs.getvalue()
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_finder.py b/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_finder.py
new file mode 100644
index 000000000..a7b49831c
--- /dev/null
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_finder.py
@@ -0,0 +1,178 @@
+# Copyright (C) 2012 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import errno
+import logging
+import re
+
+from webkitpy.layout_tests.models import test_expectations
+
+
+_log = logging.getLogger(__name__)
+
+
+class LayoutTestFinder(object):
+    def __init__(self, port, options):
+        self._port = port
+        self._options = options
+        self._filesystem = self._port.host.filesystem
+        self.LAYOUT_TESTS_DIRECTORY = 'LayoutTests'
+
+    def find_tests(self, options, args):
+        paths = self._strip_test_dir_prefixes(args)
+        if options.test_list:
+            paths += self._strip_test_dir_prefixes(self._read_test_names_from_file(options.test_list, self._port.TEST_PATH_SEPARATOR))
+        paths = set(paths)
+        test_files = self._port.tests(paths)
+        return (paths, test_files)
+
+    def _strip_test_dir_prefixes(self, paths):
+        return [self._strip_test_dir_prefix(path) for path in paths if path]
+
+    def _strip_test_dir_prefix(self, path):
+        # Handle both "LayoutTests/foo/bar.html" and "LayoutTests\foo\bar.html" if
+        # the filesystem uses '\\' as a directory separator.
+        if path.startswith(self.LAYOUT_TESTS_DIRECTORY + self._port.TEST_PATH_SEPARATOR):
+            return path[len(self.LAYOUT_TESTS_DIRECTORY + self._port.TEST_PATH_SEPARATOR):]
+        if path.startswith(self.LAYOUT_TESTS_DIRECTORY + self._filesystem.sep):
+            return path[len(self.LAYOUT_TESTS_DIRECTORY + self._filesystem.sep):]
+        return path
+
+    def _read_test_names_from_file(self, filenames, test_path_separator):
+        fs = self._filesystem
+        tests = []
+        for filename in filenames:
+            try:
+                if test_path_separator != fs.sep:
+                    filename = filename.replace(test_path_separator, fs.sep)
+                file_contents = fs.read_text_file(filename).split('\n')
+                for line in file_contents:
+                    line = self._strip_comments(line)
+                    if line:
+                        tests.append(line)
+            except IOError, e:
+                if e.errno == errno.ENOENT:
+                    _log.critical('')
+                    _log.critical('--test-list file "%s" not found' % file)
+                raise
+        return tests
+
+    @staticmethod
+    def _strip_comments(line):
+        commentIndex = line.find('//')
+        if commentIndex is -1:
+            commentIndex = len(line)
+
+        line = re.sub(r'\s+', ' ', line[:commentIndex].strip())
+        if line == '':
+            return None
+        else:
+            return line
+
+    def skip_tests(self, paths, all_tests_list, expectations, http_tests):
+        all_tests = set(all_tests_list)
+
+        tests_to_skip = expectations.get_tests_with_result_type(test_expectations.SKIP)
+        if self._options.skip_failing_tests:
+            tests_to_skip.update(expectations.get_tests_with_result_type(test_expectations.FAIL))
+            tests_to_skip.update(expectations.get_tests_with_result_type(test_expectations.FLAKY))
+
+        if self._options.skipped == 'only':
+            tests_to_skip = all_tests - tests_to_skip
+        elif self._options.skipped == 'ignore':
+            tests_to_skip = set()
+        elif self._options.skipped == 'default':
+            pass  # listed for completeness
+
+        # make sure we're explicitly running any tests passed on the command line.
+        tests_to_skip -= paths
+
+        # unless of course we don't want to run the HTTP tests :)
+        if not self._options.http:
+            tests_to_skip.update(set(http_tests))
+
+        return tests_to_skip
+
+    def split_into_chunks(self, test_names):
+        """split into a list to run and a set to skip, based on --run-chunk and --run-part."""
+        if not self._options.run_chunk and not self._options.run_part:
+            return test_names, set()
+
+        # If the user specifies they just want to run a subset of the tests,
+        # just grab a subset of the non-skipped tests.
+        chunk_value = self._options.run_chunk or self._options.run_part
+        try:
+            (chunk_num, chunk_len) = chunk_value.split(":")
+            chunk_num = int(chunk_num)
+            assert(chunk_num >= 0)
+            test_size = int(chunk_len)
+            assert(test_size > 0)
+        except AssertionError:
+            _log.critical("invalid chunk '%s'" % chunk_value)
+            return (None, None)
+
+        # Get the number of tests
+        num_tests = len(test_names)
+
+        # Get the start offset of the slice.
+        if self._options.run_chunk:
+            chunk_len = test_size
+            # In this case chunk_num can be really large. We need
+            # to make the slave fit in the current number of tests.
+            slice_start = (chunk_num * chunk_len) % num_tests
+        else:
+            # Validate the data.
+            assert(test_size <= num_tests)
+            assert(chunk_num <= test_size)
+
+            # To count the chunk_len, and make sure we don't skip
+            # some tests, we round to the next value that fits exactly
+            # all the parts.
+            rounded_tests = num_tests
+            if rounded_tests % test_size != 0:
+                rounded_tests = (num_tests + test_size - (num_tests % test_size))
+
+            chunk_len = rounded_tests / test_size
+            slice_start = chunk_len * (chunk_num - 1)
+            # It does not mind if we go over test_size.
+
+        # Get the end offset of the slice.
+        slice_end = min(num_tests, slice_start + chunk_len)
+
+        tests_to_run = test_names[slice_start:slice_end]
+
+        _log.debug('chunk slice [%d:%d] of %d is %d tests' % (slice_start, slice_end, num_tests, (slice_end - slice_start)))
+
+        # If we reached the end and we don't have enough tests, we run some
+        # from the beginning.
+        if slice_end - slice_start < chunk_len:
+            extra = chunk_len - (slice_end - slice_start)
+            _log.debug('   last chunk is partial, appending [0:%d]' % extra)
+            tests_to_run.extend(test_names[0:extra])
+
+        return (tests_to_run, set(test_names) - set(tests_to_run))
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py b/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py
new file mode 100644
index 000000000..ae3422561
--- /dev/null
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py
@@ -0,0 +1,627 @@
+# Copyright (C) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import logging
+import math
+import re
+import threading
+import time
+
+from webkitpy.common import message_pool
+from webkitpy.layout_tests.controllers import single_test_runner
+from webkitpy.layout_tests.models import test_expectations
+from webkitpy.layout_tests.models import test_failures
+from webkitpy.layout_tests.models import test_results
+from webkitpy.tool import grammar
+
+
+_log = logging.getLogger(__name__)
+
+
+TestExpectations = test_expectations.TestExpectations
+
+# Export this so callers don't need to know about message pools.
+WorkerException = message_pool.WorkerException
+
+
+class TestRunInterruptedException(Exception):
+    """Raised when a test run should be stopped immediately."""
+    def __init__(self, reason):
+        Exception.__init__(self)
+        self.reason = reason
+        self.msg = reason
+
+    def __reduce__(self):
+        return self.__class__, (self.reason,)
+
+
+class LayoutTestRunner(object):
+    def __init__(self, options, port, printer, results_directory, expectations, test_is_slow_fn):
+        self._options = options
+        self._port = port
+        self._printer = printer
+        self._results_directory = results_directory
+        self._expectations = None
+        self._test_is_slow = test_is_slow_fn
+        self._sharder = Sharder(self._port.split_test, self._port.TEST_PATH_SEPARATOR, self._options.max_locked_shards)
+
+        self._current_result_summary = None
+        self._needs_http = None
+        self._needs_websockets = None
+        self._retrying = False
+        self._test_files_list = []
+        self._all_results = []
+        self._group_stats = {}
+        self._worker_stats = {}
+        self._filesystem = self._port.host.filesystem
+
+    def test_key(self, test_name):
+        return self._sharder.test_key(test_name)
+
+    def run_tests(self, test_inputs, expectations, result_summary, num_workers, needs_http, needs_websockets, retrying):
+        """Returns a tuple of (interrupted, keyboard_interrupted, thread_timings, test_timings, individual_test_timings):
+            interrupted is whether the run was interrupted
+            keyboard_interrupted is whether the interruption was because someone typed Ctrl^C
+            thread_timings is a list of dicts with the total runtime
+                of each thread with 'name', 'num_tests', 'total_time' properties
+            test_timings is a list of timings for each sharded subdirectory
+                of the form [time, directory_name, num_tests]
+            individual_test_timings is a list of run times for each test
+                in the form {filename:filename, test_run_time:test_run_time}
+            result_summary: summary object to populate with the results
+        """
+        self._current_result_summary = result_summary
+        self._expectations = expectations
+        self._needs_http = needs_http
+        self._needs_websockets = needs_websockets
+        self._retrying = retrying
+        self._test_files_list = [test_input.test_name for test_input in test_inputs]
+        self._printer.num_tests = len(self._test_files_list)
+        self._printer.num_completed = 0
+
+        self._all_results = []
+        self._group_stats = {}
+        self._worker_stats = {}
+        self._has_http_lock = False
+        self._remaining_locked_shards = []
+
+        keyboard_interrupted = False
+        interrupted = False
+
+        self._printer.write_update('Sharding tests ...')
+        locked_shards, unlocked_shards = self._sharder.shard_tests(test_inputs, int(self._options.child_processes), self._options.fully_parallel)
+
+        # FIXME: We don't have a good way to coordinate the workers so that
+        # they don't try to run the shards that need a lock if we don't actually
+        # have the lock. The easiest solution at the moment is to grab the
+        # lock at the beginning of the run, and then run all of the locked
+        # shards first. This minimizes the time spent holding the lock, but
+        # means that we won't be running tests while we're waiting for the lock.
+        # If this becomes a problem in practice we'll need to change this.
+
+        all_shards = locked_shards + unlocked_shards
+        self._remaining_locked_shards = locked_shards
+        if locked_shards and self._options.http:
+            self.start_servers_with_lock(2 * min(num_workers, len(locked_shards)))
+
+        num_workers = min(num_workers, len(all_shards))
+        self._printer.print_workers_and_shards(num_workers, len(all_shards), len(locked_shards))
+
+        if self._options.dry_run:
+            return (keyboard_interrupted, interrupted, self._worker_stats.values(), self._group_stats, self._all_results)
+
+        self._printer.write_update('Starting %s ...' % grammar.pluralize('worker', num_workers))
+
+        try:
+            with message_pool.get(self, self._worker_factory, num_workers, self._port.worker_startup_delay_secs(), self._port.host) as pool:
+                pool.run(('test_list', shard.name, shard.test_inputs) for shard in all_shards)
+        except KeyboardInterrupt:
+            self._printer.flush()
+            self._printer.writeln('Interrupted, exiting ...')
+            keyboard_interrupted = True
+        except TestRunInterruptedException, e:
+            _log.warning(e.reason)
+            interrupted = True
+        except Exception, e:
+            _log.debug('%s("%s") raised, exiting' % (e.__class__.__name__, str(e)))
+            raise
+        finally:
+            self.stop_servers_with_lock()
+
+        # FIXME: should this be a class instead of a tuple?
+        return (interrupted, keyboard_interrupted, self._worker_stats.values(), self._group_stats, self._all_results)
+
+    def _worker_factory(self, worker_connection):
+        results_directory = self._results_directory
+        if self._retrying:
+            self._filesystem.maybe_make_directory(self._filesystem.join(self._results_directory, 'retries'))
+            results_directory = self._filesystem.join(self._results_directory, 'retries')
+        return Worker(worker_connection, results_directory, self._options)
+
+    def _mark_interrupted_tests_as_skipped(self, result_summary):
+        for test_name in self._test_files_list:
+            if test_name not in result_summary.results:
+                result = test_results.TestResult(test_name, [test_failures.FailureEarlyExit()])
+                # FIXME: We probably need to loop here if there are multiple iterations.
+                # FIXME: Also, these results are really neither expected nor unexpected. We probably
+                # need a third type of result.
+                result_summary.add(result, expected=False, test_is_slow=self._test_is_slow(test_name))
+
+    def _interrupt_if_at_failure_limits(self, result_summary):
+        # Note: The messages in this method are constructed to match old-run-webkit-tests
+        # so that existing buildbot grep rules work.
+        def interrupt_if_at_failure_limit(limit, failure_count, result_summary, message):
+            if limit and failure_count >= limit:
+                message += " %d tests run." % (result_summary.expected + result_summary.unexpected)
+                self._mark_interrupted_tests_as_skipped(result_summary)
+                raise TestRunInterruptedException(message)
+
+        interrupt_if_at_failure_limit(
+            self._options.exit_after_n_failures,
+            result_summary.unexpected_failures,
+            result_summary,
+            "Exiting early after %d failures." % result_summary.unexpected_failures)
+        interrupt_if_at_failure_limit(
+            self._options.exit_after_n_crashes_or_timeouts,
+            result_summary.unexpected_crashes + result_summary.unexpected_timeouts,
+            result_summary,
+            # This differs from ORWT because it does not include WebProcess crashes.
+            "Exiting early after %d crashes and %d timeouts." % (result_summary.unexpected_crashes, result_summary.unexpected_timeouts))
+
+    def _update_summary_with_result(self, result_summary, result):
+        if result.type == test_expectations.SKIP:
+            exp_str = got_str = 'SKIP'
+            expected = True
+        else:
+            expected = self._expectations.matches_an_expected_result(result.test_name, result.type, self._options.pixel_tests or test_failures.is_reftest_failure(result.failures))
+            exp_str = self._expectations.get_expectations_string(result.test_name)
+            got_str = self._expectations.expectation_to_string(result.type)
+
+        result_summary.add(result, expected, self._test_is_slow(result.test_name))
+
+        self._printer.print_finished_test(result, expected, exp_str, got_str)
+
+        self._interrupt_if_at_failure_limits(result_summary)
+
+    def start_servers_with_lock(self, number_of_servers):
+        self._printer.write_update('Acquiring http lock ...')
+        self._port.acquire_http_lock()
+        if self._needs_http:
+            self._printer.write_update('Starting HTTP server ...')
+            self._port.start_http_server(number_of_servers=number_of_servers)
+        if self._needs_websockets:
+            self._printer.write_update('Starting WebSocket server ...')
+            self._port.start_websocket_server()
+        self._has_http_lock = True
+
+    def stop_servers_with_lock(self):
+        if self._has_http_lock:
+            if self._needs_http:
+                self._printer.write_update('Stopping HTTP server ...')
+                self._port.stop_http_server()
+            if self._needs_websockets:
+                self._printer.write_update('Stopping WebSocket server ...')
+                self._port.stop_websocket_server()
+            self._printer.write_update('Releasing server lock ...')
+            self._port.release_http_lock()
+            self._has_http_lock = False
+
+    def handle(self, name, source, *args):
+        method = getattr(self, '_handle_' + name)
+        if method:
+            return method(source, *args)
+        raise AssertionError('unknown message %s received from %s, args=%s' % (name, source, repr(args)))
+
+    def _handle_started_test(self, worker_name, test_input, test_timeout_sec):
+        self._printer.print_started_test(test_input.test_name)
+
+    def _handle_finished_test_list(self, worker_name, list_name, num_tests, elapsed_time):
+        self._group_stats[list_name] = (num_tests, elapsed_time)
+
+        def find(name, test_lists):
+            for i in range(len(test_lists)):
+                if test_lists[i].name == name:
+                    return i
+            return -1
+
+        index = find(list_name, self._remaining_locked_shards)
+        if index >= 0:
+            self._remaining_locked_shards.pop(index)
+            if not self._remaining_locked_shards:
+                self.stop_servers_with_lock()
+
+    def _handle_finished_test(self, worker_name, result, elapsed_time, log_messages=[]):
+        self._worker_stats.setdefault(worker_name, {'name': worker_name, 'num_tests': 0, 'total_time': 0})
+        self._worker_stats[worker_name]['total_time'] += elapsed_time
+        self._worker_stats[worker_name]['num_tests'] += 1
+        self._all_results.append(result)
+        self._update_summary_with_result(self._current_result_summary, result)
+
+
+class Worker(object):
+    def __init__(self, caller, results_directory, options):
+        self._caller = caller
+        self._worker_number = caller.worker_number
+        self._name = caller.name
+        self._results_directory = results_directory
+        self._options = options
+
+        # The remaining fields are initialized in start()
+        self._host = None
+        self._port = None
+        self._batch_size = None
+        self._batch_count = None
+        self._filesystem = None
+        self._driver = None
+        self._tests_run_file = None
+        self._tests_run_filename = None
+
+    def __del__(self):
+        self.stop()
+
+    def start(self):
+        """This method is called when the object is starting to be used and it is safe
+        for the object to create state that does not need to be pickled (usually this means
+        it is called in a child process)."""
+        self._host = self._caller.host
+        self._filesystem = self._host.filesystem
+        self._port = self._host.port_factory.get(self._options.platform, self._options)
+
+        self._batch_count = 0
+        self._batch_size = self._options.batch_size or 0
+        tests_run_filename = self._filesystem.join(self._results_directory, "tests_run%d.txt" % self._worker_number)
+        self._tests_run_file = self._filesystem.open_text_file_for_writing(tests_run_filename)
+
+    def handle(self, name, source, test_list_name, test_inputs):
+        assert name == 'test_list'
+        start_time = time.time()
+        for test_input in test_inputs:
+            self._run_test(test_input)
+        elapsed_time = time.time() - start_time
+        self._caller.post('finished_test_list', test_list_name, len(test_inputs), elapsed_time)
+
+    def _update_test_input(self, test_input):
+        if test_input.reference_files is None:
+            # Lazy initialization.
+            test_input.reference_files = self._port.reference_files(test_input.test_name)
+        if test_input.reference_files:
+            test_input.should_run_pixel_test = True
+        else:
+            test_input.should_run_pixel_test = self._port.should_run_as_pixel_test(test_input)
+
+    def _run_test(self, test_input):
+        self._update_test_input(test_input)
+        test_timeout_sec = self._timeout(test_input)
+        start = time.time()
+        self._caller.post('started_test', test_input, test_timeout_sec)
+
+        result = self._run_test_with_timeout(test_input, test_timeout_sec)
+
+        elapsed_time = time.time() - start
+        self._caller.post('finished_test', result, elapsed_time)
+
+        self._clean_up_after_test(test_input, result)
+
+    def stop(self):
+        _log.debug("%s cleaning up" % self._name)
+        self._kill_driver()
+        if self._tests_run_file:
+            self._tests_run_file.close()
+            self._tests_run_file = None
+
+    def _timeout(self, test_input):
+        """Compute the appropriate timeout value for a test."""
+        # The DumpRenderTree watchdog uses 2.5x the timeout; we want to be
+        # larger than that. We also add a little more padding if we're
+        # running tests in a separate thread.
+        #
+        # Note that we need to convert the test timeout from a
+        # string value in milliseconds to a float for Python.
+        driver_timeout_sec = 3.0 * float(test_input.timeout) / 1000.0
+        if not self._options.run_singly:
+            return driver_timeout_sec
+
+        thread_padding_sec = 1.0
+        thread_timeout_sec = driver_timeout_sec + thread_padding_sec
+        return thread_timeout_sec
+
+    def _kill_driver(self):
+        # Be careful about how and when we kill the driver; if driver.stop()
+        # raises an exception, this routine may get re-entered via __del__.
+        driver = self._driver
+        self._driver = None
+        if driver:
+            _log.debug("%s killing driver" % self._name)
+            driver.stop()
+
+    def _run_test_with_timeout(self, test_input, timeout):
+        if self._options.run_singly:
+            return self._run_test_in_another_thread(test_input, timeout)
+        return self._run_test_in_this_thread(test_input)
+
+    def _clean_up_after_test(self, test_input, result):
+        self._batch_count += 1
+        test_name = test_input.test_name
+        self._tests_run_file.write(test_name + "\n")
+
+        if result.failures:
+            # Check and kill DumpRenderTree if we need to.
+            if any([f.driver_needs_restart() for f in result.failures]):
+                self._kill_driver()
+                # Reset the batch count since the shell just bounced.
+                self._batch_count = 0
+
+            # Print the error message(s).
+            _log.debug("%s %s failed:" % (self._name, test_name))
+            for f in result.failures:
+                _log.debug("%s  %s" % (self._name, f.message()))
+        elif result.type == test_expectations.SKIP:
+            _log.debug("%s %s skipped" % (self._name, test_name))
+        else:
+            _log.debug("%s %s passed" % (self._name, test_name))
+
+        if self._batch_size > 0 and self._batch_count >= self._batch_size:
+            self._kill_driver()
+            self._batch_count = 0
+
+    def _run_test_in_another_thread(self, test_input, thread_timeout_sec):
+        """Run a test in a separate thread, enforcing a hard time limit.
+
+        Since we can only detect the termination of a thread, not any internal
+        state or progress, we can only run per-test timeouts when running test
+        files singly.
+
+        Args:
+          test_input: Object containing the test filename and timeout
+          thread_timeout_sec: time to wait before killing the driver process.
+        Returns:
+          A TestResult
+        """
+        worker = self
+
+        driver = self._port.create_driver(self._worker_number)
+
+        class SingleTestThread(threading.Thread):
+            def __init__(self):
+                threading.Thread.__init__(self)
+                self.result = None
+
+            def run(self):
+                self.result = worker._run_single_test(driver, test_input)
+
+        thread = SingleTestThread()
+        thread.start()
+        thread.join(thread_timeout_sec)
+        result = thread.result
+        if thread.isAlive():
+            # If join() returned with the thread still running, the
+            # DumpRenderTree is completely hung and there's nothing
+            # more we can do with it.  We have to kill all the
+            # DumpRenderTrees to free it up. If we're running more than
+            # one DumpRenderTree thread, we'll end up killing the other
+            # DumpRenderTrees too, introducing spurious crashes. We accept
+            # that tradeoff in order to avoid losing the rest of this
+            # thread's results.
+            _log.error('Test thread hung: killing all DumpRenderTrees')
+
+        driver.stop()
+
+        if not result:
+            result = test_results.TestResult(test_input.test_name, failures=[], test_run_time=0)
+        return result
+
+    def _run_test_in_this_thread(self, test_input):
+        """Run a single test file using a shared DumpRenderTree process.
+
+        Args:
+          test_input: Object containing the test filename, uri and timeout
+
+        Returns: a TestResult object.
+        """
+        if self._driver and self._driver.has_crashed():
+            self._kill_driver()
+        if not self._driver:
+            self._driver = self._port.create_driver(self._worker_number)
+        return self._run_single_test(self._driver, test_input)
+
+    def _run_single_test(self, driver, test_input):
+        return single_test_runner.run_single_test(self._port, self._options,
+            test_input, driver, self._name)
+
+
+class TestShard(object):
+    """A test shard is a named list of TestInputs."""
+
+    def __init__(self, name, test_inputs):
+        self.name = name
+        self.test_inputs = test_inputs
+        self.requires_lock = test_inputs[0].requires_lock
+
+    def __repr__(self):
+        return "TestShard(name='%s', test_inputs=%s, requires_lock=%s'" % (self.name, self.test_inputs, self.requires_lock)
+
+    def __eq__(self, other):
+        return self.name == other.name and self.test_inputs == other.test_inputs
+
+
+class Sharder(object):
+    def __init__(self, test_split_fn, test_path_separator, max_locked_shards):
+        self._split = test_split_fn
+        self._sep = test_path_separator
+        self._max_locked_shards = max_locked_shards
+
+    def shard_tests(self, test_inputs, num_workers, fully_parallel):
+        """Groups tests into batches.
+        This helps ensure that tests that depend on each other (aka bad tests!)
+        continue to run together as most cross-tests dependencies tend to
+        occur within the same directory.
+        Return:
+            Two list of TestShards. The first contains tests that must only be
+            run under the server lock, the second can be run whenever.
+        """
+
+        # FIXME: Move all of the sharding logic out of manager into its
+        # own class or module. Consider grouping it with the chunking logic
+        # in prepare_lists as well.
+        if num_workers == 1:
+            return self._shard_in_two(test_inputs)
+        elif fully_parallel:
+            return self._shard_every_file(test_inputs)
+        return self._shard_by_directory(test_inputs, num_workers)
+
+    def _shard_in_two(self, test_inputs):
+        """Returns two lists of shards, one with all the tests requiring a lock and one with the rest.
+
+        This is used when there's only one worker, to minimize the per-shard overhead."""
+        locked_inputs = []
+        unlocked_inputs = []
+        for test_input in test_inputs:
+            if test_input.requires_lock:
+                locked_inputs.append(test_input)
+            else:
+                unlocked_inputs.append(test_input)
+
+        locked_shards = []
+        unlocked_shards = []
+        if locked_inputs:
+            locked_shards = [TestShard('locked_tests', locked_inputs)]
+        if unlocked_inputs:
+            unlocked_shards = [TestShard('unlocked_tests', unlocked_inputs)]
+
+        return locked_shards, unlocked_shards
+
+    def _shard_every_file(self, test_inputs):
+        """Returns two lists of shards, each shard containing a single test file.
+
+        This mode gets maximal parallelism at the cost of much higher flakiness."""
+        locked_shards = []
+        unlocked_shards = []
+        for test_input in test_inputs:
+            # Note that we use a '.' for the shard name; the name doesn't really
+            # matter, and the only other meaningful value would be the filename,
+            # which would be really redundant.
+            if test_input.requires_lock:
+                locked_shards.append(TestShard('.', [test_input]))
+            else:
+                unlocked_shards.append(TestShard('.', [test_input]))
+
+        return locked_shards, unlocked_shards
+
+    def _shard_by_directory(self, test_inputs, num_workers):
+        """Returns two lists of shards, each shard containing all the files in a directory.
+
+        This is the default mode, and gets as much parallelism as we can while
+        minimizing flakiness caused by inter-test dependencies."""
+        locked_shards = []
+        unlocked_shards = []
+        tests_by_dir = {}
+        # FIXME: Given that the tests are already sorted by directory,
+        # we can probably rewrite this to be clearer and faster.
+        for test_input in test_inputs:
+            directory = self._split(test_input.test_name)[0]
+            tests_by_dir.setdefault(directory, [])
+            tests_by_dir[directory].append(test_input)
+
+        for directory, test_inputs in tests_by_dir.iteritems():
+            shard = TestShard(directory, test_inputs)
+            if test_inputs[0].requires_lock:
+                locked_shards.append(shard)
+            else:
+                unlocked_shards.append(shard)
+
+        # Sort the shards by directory name.
+        locked_shards.sort(key=lambda shard: shard.name)
+        unlocked_shards.sort(key=lambda shard: shard.name)
+
+        # Put a ceiling on the number of locked shards, so that we
+        # don't hammer the servers too badly.
+
+        # FIXME: For now, limit to one shard or set it
+        # with the --max-locked-shards. After testing to make sure we
+        # can handle multiple shards, we should probably do something like
+        # limit this to no more than a quarter of all workers, e.g.:
+        # return max(math.ceil(num_workers / 4.0), 1)
+        return (self._resize_shards(locked_shards, self._max_locked_shards, 'locked_shard'),
+                unlocked_shards)
+
+    def _resize_shards(self, old_shards, max_new_shards, shard_name_prefix):
+        """Takes a list of shards and redistributes the tests into no more
+        than |max_new_shards| new shards."""
+
+        # This implementation assumes that each input shard only contains tests from a
+        # single directory, and that tests in each shard must remain together; as a
+        # result, a given input shard is never split between output shards.
+        #
+        # Each output shard contains the tests from one or more input shards and
+        # hence may contain tests from multiple directories.
+
+        def divide_and_round_up(numerator, divisor):
+            return int(math.ceil(float(numerator) / divisor))
+
+        def extract_and_flatten(shards):
+            test_inputs = []
+            for shard in shards:
+                test_inputs.extend(shard.test_inputs)
+            return test_inputs
+
+        def split_at(seq, index):
+            return (seq[:index], seq[index:])
+
+        num_old_per_new = divide_and_round_up(len(old_shards), max_new_shards)
+        new_shards = []
+        remaining_shards = old_shards
+        while remaining_shards:
+            some_shards, remaining_shards = split_at(remaining_shards, num_old_per_new)
+            new_shards.append(TestShard('%s_%d' % (shard_name_prefix, len(new_shards) + 1), extract_and_flatten(some_shards)))
+        return new_shards
+
+    def test_key(self, test_name):
+        """Turns a test name into a list with two sublists, the natural key of the
+        dirname, and the natural key of the basename.
+
+        This can be used when sorting paths so that files in a directory.
+        directory are kept together rather than being mixed in with files in
+        subdirectories."""
+        dirname, basename = self._split(test_name)
+        return (self.natural_sort_key(dirname + self._sep), self.natural_sort_key(basename))
+
+    @staticmethod
+    def natural_sort_key(string_to_split):
+        """ Turns a string into a list of string and number chunks, i.e. "z23a" -> ["z", 23, "a"]
+
+        This can be used to implement "natural sort" order. See:
+        http://www.codinghorror.com/blog/2007/12/sorting-for-humans-natural-sort-order.html
+        http://nedbatchelder.com/blog/200712.html#e20071211T054956
+        """
+        def tryint(val):
+            try:
+                return int(val)
+            except ValueError:
+                return val
+
+        return [tryint(chunk) for chunk in re.split('(\d+)', string_to_split)]
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner_unittest.py b/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner_unittest.py
new file mode 100644
index 000000000..4dd2ae7ae
--- /dev/null
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner_unittest.py
@@ -0,0 +1,375 @@
+#!/usr/bin/python
+# Copyright (C) 2012 Google Inc. All rights reserved.
+# Copyright (C) 2010 Gabor Rapcsanyi (rgabor@inf.u-szeged.hu), University of Szeged
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from webkitpy.common.host_mock import MockHost
+from webkitpy.layout_tests import run_webkit_tests
+from webkitpy.layout_tests.models import test_expectations
+from webkitpy.layout_tests.models import test_failures
+from webkitpy.layout_tests.models.result_summary import ResultSummary
+from webkitpy.layout_tests.models.test_input import TestInput
+from webkitpy.layout_tests.models.test_results import TestResult
+from webkitpy.layout_tests.controllers.layout_test_runner import LayoutTestRunner, Sharder, TestRunInterruptedException
+
+
+TestExpectations = test_expectations.TestExpectations
+
+
+class FakePrinter(object):
+    num_completed = 0
+    num_tests = 0
+
+    def print_workers_and_shards(self, num_workers, num_shards, num_locked_shards):
+        pass
+
+    def print_started_test(self, test_name):
+        pass
+
+    def print_finished_test(self, result, expected, exp_str, got_str):
+        pass
+
+    def write(self, msg):
+        pass
+
+    def write_update(self, msg):
+        pass
+
+    def flush(self):
+        pass
+
+
+class LockCheckingRunner(LayoutTestRunner):
+    def __init__(self, port, options, printer, tester, http_lock):
+        super(LockCheckingRunner, self).__init__(options, port, printer, port.results_directory(), TestExpectations(port, []), lambda test_name: False)
+        self._finished_list_called = False
+        self._tester = tester
+        self._should_have_http_lock = http_lock
+
+    def handle_finished_list(self, source, list_name, num_tests, elapsed_time):
+        if not self._finished_list_called:
+            self._tester.assertEquals(list_name, 'locked_tests')
+            self._tester.assertTrue(self._remaining_locked_shards)
+            self._tester.assertTrue(self._has_http_lock is self._should_have_http_lock)
+
+        super(LockCheckingRunner, self).handle_finished_list(source, list_name, num_tests, elapsed_time)
+
+        if not self._finished_list_called:
+            self._tester.assertEquals(self._remaining_locked_shards, [])
+            self._tester.assertFalse(self._has_http_lock)
+            self._finished_list_called = True
+
+
+class LayoutTestRunnerTests(unittest.TestCase):
+    def _runner(self, port=None):
+        # FIXME: we shouldn't have to use run_webkit_tests.py to get the options we need.
+        options = run_webkit_tests.parse_args(['--platform', 'test-mac-snowleopard'])[0]
+        options.child_processes = '1'
+
+        host = MockHost()
+        port = port or host.port_factory.get(options.platform, options=options)
+        return LockCheckingRunner(port, options, FakePrinter(), self, True)
+
+    def _result_summary(self, runner, tests):
+        return ResultSummary(TestExpectations(runner._port, tests), tests, 1, set())
+
+    def _run_tests(self, runner, tests):
+        test_inputs = [TestInput(test, 6000) for test in tests]
+        expectations = TestExpectations(runner._port, tests)
+        runner.run_tests(test_inputs, expectations, self._result_summary(runner, tests),
+            num_workers=1, needs_http=any('http' in test for test in tests), needs_websockets=any(['websocket' in test for test in tests]), retrying=False)
+
+    def test_http_locking(self):
+        runner = self._runner()
+        self._run_tests(runner, ['http/tests/passes/text.html', 'passes/text.html'])
+
+    def test_perf_locking(self):
+        runner = self._runner()
+        self._run_tests(runner, ['http/tests/passes/text.html', 'perf/foo/test.html'])
+
+    def test_interrupt_if_at_failure_limits(self):
+        runner = self._runner()
+        runner._options.exit_after_n_failures = None
+        runner._options.exit_after_n_crashes_or_times = None
+        test_names = ['passes/text.html', 'passes/image.html']
+        runner._test_files_list = test_names
+
+        result_summary = self._result_summary(runner, test_names)
+        result_summary.unexpected_failures = 100
+        result_summary.unexpected_crashes = 50
+        result_summary.unexpected_timeouts = 50
+        # No exception when the exit_after* options are None.
+        runner._interrupt_if_at_failure_limits(result_summary)
+
+        # No exception when we haven't hit the limit yet.
+        runner._options.exit_after_n_failures = 101
+        runner._options.exit_after_n_crashes_or_timeouts = 101
+        runner._interrupt_if_at_failure_limits(result_summary)
+
+        # Interrupt if we've exceeded either limit:
+        runner._options.exit_after_n_crashes_or_timeouts = 10
+        self.assertRaises(TestRunInterruptedException, runner._interrupt_if_at_failure_limits, result_summary)
+        self.assertEquals(result_summary.results['passes/text.html'].type, test_expectations.SKIP)
+        self.assertEquals(result_summary.results['passes/image.html'].type, test_expectations.SKIP)
+
+        runner._options.exit_after_n_crashes_or_timeouts = None
+        runner._options.exit_after_n_failures = 10
+        exception = self.assertRaises(TestRunInterruptedException, runner._interrupt_if_at_failure_limits, result_summary)
+
+    def test_update_summary_with_result(self):
+        # Reftests expected to be image mismatch should be respected when pixel_tests=False.
+        runner = self._runner()
+        runner._options.pixel_tests = False
+        test = 'failures/expected/reftest.html'
+        expectations = TestExpectations(runner._port, tests=[test])
+        runner._expectations = expectations
+        result_summary = ResultSummary(expectations, [test], 1, set())
+        result = TestResult(test_name=test, failures=[test_failures.FailureReftestMismatchDidNotOccur()])
+        runner._update_summary_with_result(result_summary, result)
+        self.assertEquals(1, result_summary.expected)
+        self.assertEquals(0, result_summary.unexpected)
+
+    def test_servers_started(self):
+
+        def start_http_server(number_of_servers=None):
+            self.http_started = True
+
+        def start_websocket_server():
+            self.websocket_started = True
+
+        def stop_http_server():
+            self.http_stopped = True
+
+        def stop_websocket_server():
+            self.websocket_stopped = True
+
+        host = MockHost()
+        port = host.port_factory.get('test-mac-leopard')
+        port.start_http_server = start_http_server
+        port.start_websocket_server = start_websocket_server
+        port.stop_http_server = stop_http_server
+        port.stop_websocket_server = stop_websocket_server
+
+        self.http_started = self.http_stopped = self.websocket_started = self.websocket_stopped = False
+        runner = self._runner(port=port)
+        runner._needs_http = True
+        runner._needs_websockets = False
+        runner.start_servers_with_lock(number_of_servers=4)
+        self.assertEquals(self.http_started, True)
+        self.assertEquals(self.websocket_started, False)
+        runner.stop_servers_with_lock()
+        self.assertEquals(self.http_stopped, True)
+        self.assertEquals(self.websocket_stopped, False)
+
+        self.http_started = self.http_stopped = self.websocket_started = self.websocket_stopped = False
+        runner._needs_http = True
+        runner._needs_websockets = True
+        runner.start_servers_with_lock(number_of_servers=4)
+        self.assertEquals(self.http_started, True)
+        self.assertEquals(self.websocket_started, True)
+        runner.stop_servers_with_lock()
+        self.assertEquals(self.http_stopped, True)
+        self.assertEquals(self.websocket_stopped, True)
+
+        self.http_started = self.http_stopped = self.websocket_started = self.websocket_stopped = False
+        runner._needs_http = False
+        runner._needs_websockets = False
+        runner.start_servers_with_lock(number_of_servers=4)
+        self.assertEquals(self.http_started, False)
+        self.assertEquals(self.websocket_started, False)
+        runner.stop_servers_with_lock()
+        self.assertEquals(self.http_stopped, False)
+        self.assertEquals(self.websocket_stopped, False)
+
+
+class SharderTests(unittest.TestCase):
+
+    test_list = [
+        "http/tests/websocket/tests/unicode.htm",
+        "animations/keyframes.html",
+        "http/tests/security/view-source-no-refresh.html",
+        "http/tests/websocket/tests/websocket-protocol-ignored.html",
+        "fast/css/display-none-inline-style-change-crash.html",
+        "http/tests/xmlhttprequest/supported-xml-content-types.html",
+        "dom/html/level2/html/HTMLAnchorElement03.html",
+        "ietestcenter/Javascript/11.1.5_4-4-c-1.html",
+        "dom/html/level2/html/HTMLAnchorElement06.html",
+        "perf/object-keys.html",
+    ]
+
+    def get_test_input(self, test_file):
+        return TestInput(test_file, requires_lock=(test_file.startswith('http') or test_file.startswith('perf')))
+
+    def get_shards(self, num_workers, fully_parallel, test_list=None, max_locked_shards=1):
+        def split(test_name):
+            idx = test_name.rfind('/')
+            if idx != -1:
+                return (test_name[0:idx], test_name[idx + 1:])
+
+        self.sharder = Sharder(split, '/', max_locked_shards)
+        test_list = test_list or self.test_list
+        return self.sharder.shard_tests([self.get_test_input(test) for test in test_list], num_workers, fully_parallel)
+
+    def assert_shards(self, actual_shards, expected_shard_names):
+        self.assertEquals(len(actual_shards), len(expected_shard_names))
+        for i, shard in enumerate(actual_shards):
+            expected_shard_name, expected_test_names = expected_shard_names[i]
+            self.assertEquals(shard.name, expected_shard_name)
+            self.assertEquals([test_input.test_name for test_input in shard.test_inputs],
+                              expected_test_names)
+
+    def test_shard_by_dir(self):
+        locked, unlocked = self.get_shards(num_workers=2, fully_parallel=False)
+
+        # Note that although there are tests in multiple dirs that need locks,
+        # they are crammed into a single shard in order to reduce the # of
+        # workers hitting the server at once.
+        self.assert_shards(locked,
+             [('locked_shard_1',
+               ['http/tests/security/view-source-no-refresh.html',
+                'http/tests/websocket/tests/unicode.htm',
+                'http/tests/websocket/tests/websocket-protocol-ignored.html',
+                'http/tests/xmlhttprequest/supported-xml-content-types.html',
+                'perf/object-keys.html'])])
+        self.assert_shards(unlocked,
+            [('animations', ['animations/keyframes.html']),
+             ('dom/html/level2/html', ['dom/html/level2/html/HTMLAnchorElement03.html',
+                                      'dom/html/level2/html/HTMLAnchorElement06.html']),
+             ('fast/css', ['fast/css/display-none-inline-style-change-crash.html']),
+             ('ietestcenter/Javascript', ['ietestcenter/Javascript/11.1.5_4-4-c-1.html'])])
+
+    def test_shard_every_file(self):
+        locked, unlocked = self.get_shards(num_workers=2, fully_parallel=True)
+        self.assert_shards(locked,
+            [('.', ['http/tests/websocket/tests/unicode.htm']),
+             ('.', ['http/tests/security/view-source-no-refresh.html']),
+             ('.', ['http/tests/websocket/tests/websocket-protocol-ignored.html']),
+             ('.', ['http/tests/xmlhttprequest/supported-xml-content-types.html']),
+             ('.', ['perf/object-keys.html'])]),
+        self.assert_shards(unlocked,
+            [('.', ['animations/keyframes.html']),
+             ('.', ['fast/css/display-none-inline-style-change-crash.html']),
+             ('.', ['dom/html/level2/html/HTMLAnchorElement03.html']),
+             ('.', ['ietestcenter/Javascript/11.1.5_4-4-c-1.html']),
+             ('.', ['dom/html/level2/html/HTMLAnchorElement06.html'])])
+
+    def test_shard_in_two(self):
+        locked, unlocked = self.get_shards(num_workers=1, fully_parallel=False)
+        self.assert_shards(locked,
+            [('locked_tests',
+              ['http/tests/websocket/tests/unicode.htm',
+               'http/tests/security/view-source-no-refresh.html',
+               'http/tests/websocket/tests/websocket-protocol-ignored.html',
+               'http/tests/xmlhttprequest/supported-xml-content-types.html',
+               'perf/object-keys.html'])])
+        self.assert_shards(unlocked,
+            [('unlocked_tests',
+              ['animations/keyframes.html',
+               'fast/css/display-none-inline-style-change-crash.html',
+               'dom/html/level2/html/HTMLAnchorElement03.html',
+               'ietestcenter/Javascript/11.1.5_4-4-c-1.html',
+               'dom/html/level2/html/HTMLAnchorElement06.html'])])
+
+    def test_shard_in_two_has_no_locked_shards(self):
+        locked, unlocked = self.get_shards(num_workers=1, fully_parallel=False,
+             test_list=['animations/keyframe.html'])
+        self.assertEquals(len(locked), 0)
+        self.assertEquals(len(unlocked), 1)
+
+    def test_shard_in_two_has_no_unlocked_shards(self):
+        locked, unlocked = self.get_shards(num_workers=1, fully_parallel=False,
+             test_list=['http/tests/websocket/tests/unicode.htm'])
+        self.assertEquals(len(locked), 1)
+        self.assertEquals(len(unlocked), 0)
+
+    def test_multiple_locked_shards(self):
+        locked, unlocked = self.get_shards(num_workers=4, fully_parallel=False, max_locked_shards=2)
+        self.assert_shards(locked,
+            [('locked_shard_1',
+              ['http/tests/security/view-source-no-refresh.html',
+               'http/tests/websocket/tests/unicode.htm',
+               'http/tests/websocket/tests/websocket-protocol-ignored.html']),
+             ('locked_shard_2',
+              ['http/tests/xmlhttprequest/supported-xml-content-types.html',
+               'perf/object-keys.html'])])
+
+        locked, unlocked = self.get_shards(num_workers=4, fully_parallel=False)
+        self.assert_shards(locked,
+            [('locked_shard_1',
+              ['http/tests/security/view-source-no-refresh.html',
+               'http/tests/websocket/tests/unicode.htm',
+               'http/tests/websocket/tests/websocket-protocol-ignored.html',
+               'http/tests/xmlhttprequest/supported-xml-content-types.html',
+               'perf/object-keys.html'])])
+
+
+class NaturalCompareTest(unittest.TestCase):
+    def assert_cmp(self, x, y, result):
+        self.assertEquals(cmp(Sharder.natural_sort_key(x), Sharder.natural_sort_key(y)), result)
+
+    def test_natural_compare(self):
+        self.assert_cmp('a', 'a', 0)
+        self.assert_cmp('ab', 'a', 1)
+        self.assert_cmp('a', 'ab', -1)
+        self.assert_cmp('', '', 0)
+        self.assert_cmp('', 'ab', -1)
+        self.assert_cmp('1', '2', -1)
+        self.assert_cmp('2', '1', 1)
+        self.assert_cmp('1', '10', -1)
+        self.assert_cmp('2', '10', -1)
+        self.assert_cmp('foo_1.html', 'foo_2.html', -1)
+        self.assert_cmp('foo_1.1.html', 'foo_2.html', -1)
+        self.assert_cmp('foo_1.html', 'foo_10.html', -1)
+        self.assert_cmp('foo_2.html', 'foo_10.html', -1)
+        self.assert_cmp('foo_23.html', 'foo_10.html', 1)
+        self.assert_cmp('foo_23.html', 'foo_100.html', -1)
+
+
+class KeyCompareTest(unittest.TestCase):
+    def setUp(self):
+        def split(test_name):
+            idx = test_name.rfind('/')
+            if idx != -1:
+                return (test_name[0:idx], test_name[idx + 1:])
+
+        self.sharder = Sharder(split, '/', 1)
+
+    def assert_cmp(self, x, y, result):
+        self.assertEquals(cmp(self.sharder.test_key(x), self.sharder.test_key(y)), result)
+
+    def test_test_key(self):
+        self.assert_cmp('/a', '/a', 0)
+        self.assert_cmp('/a', '/b', -1)
+        self.assert_cmp('/a2', '/a10', -1)
+        self.assert_cmp('/a2/foo', '/a10/foo', -1)
+        self.assert_cmp('/a/foo11', '/a/foo2', 1)
+        self.assert_cmp('/ab', '/a/a/b', -1)
+        self.assert_cmp('/a/a/b', '/ab', 1)
+        self.assert_cmp('/foo-bar/baz', '/foo/baz', -1)
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py b/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
index 0544918f4..e6924a3ee 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
@@ -45,7 +45,8 @@ import sys
 import time
 
 from webkitpy.common import message_pool
-from webkitpy.layout_tests.controllers import worker
+from webkitpy.layout_tests.controllers.layout_test_finder import LayoutTestFinder
+from webkitpy.layout_tests.controllers.layout_test_runner import LayoutTestRunner, TestRunInterruptedException, WorkerException
 from webkitpy.layout_tests.controllers.test_result_writer import TestResultWriter
 from webkitpy.layout_tests.layout_package import json_layout_results_generator
 from webkitpy.layout_tests.layout_package import json_results_generator
@@ -253,36 +254,6 @@ def summarize_results(port_obj, expectations, result_summary, retry_summary, tes
     return results
 
 
-class TestRunInterruptedException(Exception):
-    """Raised when a test run should be stopped immediately."""
-    def __init__(self, reason):
-        Exception.__init__(self)
-        self.reason = reason
-        self.msg = reason
-
-    def __reduce__(self):
-        return self.__class__, (self.reason,)
-
-
-# Export this so callers don't need to know about message pools.
-WorkerException = message_pool.WorkerException
-
-
-class TestShard(object):
-    """A test shard is a named list of TestInputs."""
-
-    # FIXME: Make this class visible, used by workers as well.
-    def __init__(self, name, test_inputs):
-        self.name = name
-        self.test_inputs = test_inputs
-
-    def __repr__(self):
-        return "TestShard(name='%s', test_inputs=%s'" % (self.name, self.test_inputs)
-
-    def __eq__(self, other):
-        return self.name == other.name and self.test_inputs == other.test_inputs
-
-
 class Manager(object):
     """A class for managing running a series of tests on a series of layout
     test files."""
@@ -305,240 +276,67 @@ class Manager(object):
         self.PERF_SUBDIR = 'perf'
         self.WEBSOCKET_SUBDIR = 'websocket' + port.TEST_PATH_SEPARATOR
         self.LAYOUT_TESTS_DIRECTORY = 'LayoutTests'
-        self._has_http_lock = False
-
-        self._remaining_locked_shards = []
 
         # disable wss server. need to install pyOpenSSL on buildbots.
         # self._websocket_secure_server = websocket_server.PyWebSocket(
         #        options.results_directory, use_tls=True, port=9323)
 
-        # a set of test files, and the same tests as a list
-
         self._paths = set()
-
-        # FIXME: Rename to test_names.
-        self._test_files = set()
-        self._test_files_list = None
-        self._result_queue = Queue.Queue()
+        self._test_names = None
         self._retrying = False
         self._results_directory = self._port.results_directory()
-
-        self._all_results = []
-        self._group_stats = {}
-        self._worker_stats = {}
-        self._current_result_summary = None
+        self._finder = LayoutTestFinder(self._port, self._options)
+        self._runner = LayoutTestRunner(self._options, self._port, self._printer, self._results_directory, self._expectations, self._test_is_slow)
 
     def _collect_tests(self, args):
-        """Find all the files to test.
-
-        Args:
-          args: list of test arguments from the command line
-
-        """
-        paths = self._strip_test_dir_prefixes(args)
-        if self._options.test_list:
-            paths += self._strip_test_dir_prefixes(read_test_files(self._filesystem, self._options.test_list, self._port.TEST_PATH_SEPARATOR))
-        self._paths = set(paths)
-        self._test_files = self._port.tests(paths)
-
-    def _strip_test_dir_prefixes(self, paths):
-        return [self._strip_test_dir_prefix(path) for path in paths if path]
-
-    def _strip_test_dir_prefix(self, path):
-        # Handle both "LayoutTests/foo/bar.html" and "LayoutTests\foo\bar.html" if
-        # the filesystem uses '\\' as a directory separator.
-        if path.startswith(self.LAYOUT_TESTS_DIRECTORY + self._port.TEST_PATH_SEPARATOR):
-            return path[len(self.LAYOUT_TESTS_DIRECTORY + self._port.TEST_PATH_SEPARATOR):]
-        if path.startswith(self.LAYOUT_TESTS_DIRECTORY + self._filesystem.sep):
-            return path[len(self.LAYOUT_TESTS_DIRECTORY + self._filesystem.sep):]
-        return path
+        return self._finder.find_tests(self._options, args)
 
     def _is_http_test(self, test):
-        return self.HTTP_SUBDIR in test or self.WEBSOCKET_SUBDIR in test
+        return self.HTTP_SUBDIR in test or self._is_websocket_test(test)
+
+    def _is_websocket_test(self, test):
+        return self.WEBSOCKET_SUBDIR in test
 
     def _http_tests(self):
-        return set(test for test in self._test_files if self._is_http_test(test))
+        return set(test for test in self._test_names if self._is_http_test(test))
 
     def _websocket_tests(self):
-        return set(test for test in self._test_files if self.WEBSOCKET_SUBDIR in test)
+        return set(test for test in self._test_files if self._is_websocket(test))
 
     def _is_perf_test(self, test):
         return self.PERF_SUBDIR == test or (self.PERF_SUBDIR + self._port.TEST_PATH_SEPARATOR) in test
 
-    def _parse_expectations(self):
-        self._expectations = test_expectations.TestExpectations(self._port, self._test_files)
-
-    def _split_into_chunks_if_necessary(self, skipped):
-        if not self._options.run_chunk and not self._options.run_part:
-            return skipped
-
-        # If the user specifies they just want to run a subset of the tests,
-        # just grab a subset of the non-skipped tests.
-        chunk_value = self._options.run_chunk or self._options.run_part
-        test_files = self._test_files_list
-        try:
-            (chunk_num, chunk_len) = chunk_value.split(":")
-            chunk_num = int(chunk_num)
-            assert(chunk_num >= 0)
-            test_size = int(chunk_len)
-            assert(test_size > 0)
-        except AssertionError:
-            _log.critical("invalid chunk '%s'" % chunk_value)
-            return None
-
-        # Get the number of tests
-        num_tests = len(test_files)
-
-        # Get the start offset of the slice.
-        if self._options.run_chunk:
-            chunk_len = test_size
-            # In this case chunk_num can be really large. We need
-            # to make the slave fit in the current number of tests.
-            slice_start = (chunk_num * chunk_len) % num_tests
-        else:
-            # Validate the data.
-            assert(test_size <= num_tests)
-            assert(chunk_num <= test_size)
-
-            # To count the chunk_len, and make sure we don't skip
-            # some tests, we round to the next value that fits exactly
-            # all the parts.
-            rounded_tests = num_tests
-            if rounded_tests % test_size != 0:
-                rounded_tests = (num_tests + test_size - (num_tests % test_size))
-
-            chunk_len = rounded_tests / test_size
-            slice_start = chunk_len * (chunk_num - 1)
-            # It does not mind if we go over test_size.
-
-        # Get the end offset of the slice.
-        slice_end = min(num_tests, slice_start + chunk_len)
-
-        files = test_files[slice_start:slice_end]
-
-        _log.debug('chunk slice [%d:%d] of %d is %d tests' % (slice_start, slice_end, num_tests, (slice_end - slice_start)))
-
-        # If we reached the end and we don't have enough tests, we run some
-        # from the beginning.
-        if slice_end - slice_start < chunk_len:
-            extra = chunk_len - (slice_end - slice_start)
-            _log.debug('   last chunk is partial, appending [0:%d]' % extra)
-            files.extend(test_files[0:extra])
-
-        len_skip_chunk = int(len(files) * len(skipped) / float(len(self._test_files)))
-        skip_chunk_list = list(skipped)[0:len_skip_chunk]
-        skip_chunk = set(skip_chunk_list)
-
-        # FIXME: This is a total hack.
-        # Update expectations so that the stats are calculated correctly.
-        # We need to pass a list that includes the right # of skipped files
-        # to ParseExpectations so that ResultSummary() will get the correct
-        # stats. So, we add in the subset of skipped files, and then
-        # subtract them back out.
-        self._test_files_list = files + skip_chunk_list
-        self._test_files = set(self._test_files_list)
-
-        self._parse_expectations()
-
-        self._test_files = set(files)
-        self._test_files_list = files
-
-        return skip_chunk
-
-    # FIXME: This method is way too long and needs to be broken into pieces.
-    def prepare_lists_and_print_output(self):
-        """Create appropriate subsets of test lists and returns a
-        ResultSummary object. Also prints expected test counts.
-        """
-
-        # Remove skipped - both fixable and ignored - files from the
-        # top-level list of files to test.
-        found_test_files = set(self._test_files)
-        num_all_test_files = len(self._test_files)
-
-        skipped = self._expectations.get_tests_with_result_type(test_expectations.SKIP)
-        if not self._options.http:
-            skipped.update(set(self._http_tests()))
-
-        if self._options.skipped == 'only':
-            self._test_files = self._test_files.intersection(skipped)
-        elif self._options.skipped == 'default':
-            self._test_files -= skipped
-        elif self._options.skipped == 'ignore':
-            pass  # just to be clear that we're ignoring the skip list.
-
-        if self._options.skip_failing_tests:
-            self._test_files -= self._expectations.get_tests_with_result_type(test_expectations.FAIL)
-            self._test_files -= self._expectations.get_tests_with_result_type(test_expectations.FLAKY)
-
-        # now make sure we're explicitly running any tests passed on the command line.
-        self._test_files.update(found_test_files.intersection(self._paths))
-
-        num_to_run = len(self._test_files)
-        num_skipped = num_all_test_files - num_to_run
-
-        if not num_to_run:
-            _log.critical('No tests to run.')
-            return None
+    def _prepare_lists(self):
+        tests_to_skip = self._finder.skip_tests(self._paths, self._test_names, self._expectations, self._http_tests())
+        self._test_names = list(set(self._test_names) - tests_to_skip)
 
         # Create a sorted list of test files so the subset chunk,
         # if used, contains alphabetically consecutive tests.
-        self._test_files_list = list(self._test_files)
         if self._options.randomize_order:
-            random.shuffle(self._test_files_list)
+            random.shuffle(self._test_names)
         else:
-            self._test_files_list.sort(key=lambda test: test_key(self._port, test))
+            self._test_names.sort(key=self._runner.test_key)
 
-        skipped = self._split_into_chunks_if_necessary(skipped)
+        self._test_names, tests_in_other_chunks = self._finder.split_into_chunks(self._test_names)
+        self._expectations.add_skipped_tests(tests_in_other_chunks)
+        tests_to_skip.update(tests_in_other_chunks)
 
-        # FIXME: It's unclear how --repeat-each and --iterations should interact with chunks?
-        if self._options.repeat_each:
+        if self._options.repeat_each > 1:
             list_with_repetitions = []
-            for test in self._test_files_list:
+            for test in self._test_names:
                 list_with_repetitions += ([test] * self._options.repeat_each)
-            self._test_files_list = list_with_repetitions
-
-        if self._options.iterations:
-            self._test_files_list = self._test_files_list * self._options.iterations
-
-        iterations =  \
-            (self._options.repeat_each if self._options.repeat_each else 1) * \
-            (self._options.iterations if self._options.iterations else 1)
-        result_summary = ResultSummary(self._expectations, self._test_files | skipped, iterations)
-
-        self._printer.print_expected(num_all_test_files, result_summary, self._expectations.get_tests_with_result_type)
-
-        if self._options.skipped != 'ignore':
-            # Note that we don't actually run the skipped tests (they were
-            # subtracted out of self._test_files, above), but we stub out the
-            # results here so the statistics can remain accurate.
-            for test in skipped:
-                result = test_results.TestResult(test)
-                result.type = test_expectations.SKIP
-                for iteration in range(iterations):
-                    result_summary.add(result, expected=True, test_is_slow=self._test_is_slow(test))
-
-        return result_summary
-
-    def _get_dir_for_test_file(self, test_file):
-        """Returns the highest-level directory by which to shard the given
-        test file."""
-        directory, test_file = self._port.split_test(test_file)
-
-        # The http tests are very stable on mac/linux.
-        # TODO(ojan): Make the http server on Windows be apache so we can
-        # turn shard the http tests there as well. Switching to apache is
-        # what made them stable on linux/mac.
-        return directory
-
-    def _get_test_input_for_file(self, test_file):
-        """Returns the appropriate TestInput object for the file. Mostly this
-        is used for looking up the timeout value (in ms) to use for the given
-        test."""
-        if self._test_is_slow(test_file):
-            return TestInput(test_file, self._options.slow_time_out_ms)
-        return TestInput(test_file, self._options.time_out_ms)
+            self._test_names = list_with_repetitions
+
+        if self._options.iterations > 1:
+            self._test_names = self._test_names * self._options.iterations
+
+        iterations = self._options.repeat_each * self._options.iterations
+        return ResultSummary(self._expectations, set(self._test_names), iterations, tests_to_skip)
+
+    def _test_input_for_file(self, test_file):
+        return TestInput(test_file,
+            self._options.slow_time_out_ms if self._test_is_slow(test_file) else self._options.time_out_ms,
+            self._test_requires_lock(test_file))
 
     def _test_requires_lock(self, test_file):
         """Return True if the test needs to be locked when
@@ -550,261 +348,15 @@ class Manager(object):
     def _test_is_slow(self, test_file):
         return self._expectations.has_modifier(test_file, test_expectations.SLOW)
 
-    def _is_ref_test(self, test_input):
-        if test_input.reference_files is None:
-            # Lazy initialization.
-            test_input.reference_files = self._port.reference_files(test_input.test_name)
-        return bool(test_input.reference_files)
-
-    def _shard_tests(self, test_files, num_workers, fully_parallel, shard_ref_tests):
-        """Groups tests into batches.
-        This helps ensure that tests that depend on each other (aka bad tests!)
-        continue to run together as most cross-tests dependencies tend to
-        occur within the same directory.
-        Return:
-            Two list of TestShards. The first contains tests that must only be
-            run under the server lock, the second can be run whenever.
-        """
-
-        # FIXME: Move all of the sharding logic out of manager into its
-        # own class or module. Consider grouping it with the chunking logic
-        # in prepare_lists as well.
-        if num_workers == 1:
-            return self._shard_in_two(test_files, shard_ref_tests)
-        elif fully_parallel:
-            return self._shard_every_file(test_files)
-        return self._shard_by_directory(test_files, num_workers, shard_ref_tests)
-
-    def _shard_in_two(self, test_files, shard_ref_tests):
-        """Returns two lists of shards, one with all the tests requiring a lock and one with the rest.
-
-        This is used when there's only one worker, to minimize the per-shard overhead."""
-        locked_inputs = []
-        locked_ref_test_inputs = []
-        unlocked_inputs = []
-        unlocked_ref_test_inputs = []
-        for test_file in test_files:
-            test_input = self._get_test_input_for_file(test_file)
-            if self._test_requires_lock(test_file):
-                if shard_ref_tests and self._is_ref_test(test_input):
-                    locked_ref_test_inputs.append(test_input)
-                else:
-                    locked_inputs.append(test_input)
-            else:
-                if shard_ref_tests and self._is_ref_test(test_input):
-                    unlocked_ref_test_inputs.append(test_input)
-                else:
-                    unlocked_inputs.append(test_input)
-        locked_inputs.extend(locked_ref_test_inputs)
-        unlocked_inputs.extend(unlocked_ref_test_inputs)
-
-        locked_shards = []
-        unlocked_shards = []
-        if locked_inputs:
-            locked_shards = [TestShard('locked_tests', locked_inputs)]
-        if unlocked_inputs:
-            unlocked_shards.append(TestShard('unlocked_tests', unlocked_inputs))
-
-        return locked_shards, unlocked_shards
-
-    def _shard_every_file(self, test_files):
-        """Returns two lists of shards, each shard containing a single test file.
-
-        This mode gets maximal parallelism at the cost of much higher flakiness."""
-        locked_shards = []
-        unlocked_shards = []
-        for test_file in test_files:
-            test_input = self._get_test_input_for_file(test_file)
-
-            # Note that we use a '.' for the shard name; the name doesn't really
-            # matter, and the only other meaningful value would be the filename,
-            # which would be really redundant.
-            if self._test_requires_lock(test_file):
-                locked_shards.append(TestShard('.', [test_input]))
-            else:
-                unlocked_shards.append(TestShard('.', [test_input]))
-
-        return locked_shards, unlocked_shards
-
-    def _shard_by_directory(self, test_files, num_workers, shard_ref_tests):
-        """Returns two lists of shards, each shard containing all the files in a directory.
-
-        This is the default mode, and gets as much parallelism as we can while
-        minimizing flakiness caused by inter-test dependencies."""
-        locked_shards = []
-        unlocked_shards = []
-        tests_by_dir = {}
-        ref_tests_by_dir = {}
-        # FIXME: Given that the tests are already sorted by directory,
-        # we can probably rewrite this to be clearer and faster.
-        for test_file in test_files:
-            directory = self._get_dir_for_test_file(test_file)
-            test_input = self._get_test_input_for_file(test_file)
-            if shard_ref_tests and self._is_ref_test(test_input):
-                ref_tests_by_dir.setdefault(directory, [])
-                ref_tests_by_dir[directory].append(test_input)
-            else:
-                tests_by_dir.setdefault(directory, [])
-                tests_by_dir[directory].append(test_input)
-
-        for directory, test_inputs in tests_by_dir.iteritems():
-            shard = TestShard(directory, test_inputs)
-            if self._test_requires_lock(directory):
-                locked_shards.append(shard)
-            else:
-                unlocked_shards.append(shard)
-
-        for directory, test_inputs in ref_tests_by_dir.iteritems():
-            # '~' to place the ref tests after other tests after sorted.
-            shard = TestShard('~ref:' + directory, test_inputs)
-            if self._test_requires_lock(directory):
-                locked_shards.append(shard)
-            else:
-                unlocked_shards.append(shard)
-
-        # Sort the shards by directory name.
-        locked_shards.sort(key=lambda shard: shard.name)
-        unlocked_shards.sort(key=lambda shard: shard.name)
-
-        return (self._resize_shards(locked_shards, self._max_locked_shards(num_workers),
-                                    'locked_shard'),
-                unlocked_shards)
-
-    def _max_locked_shards(self, num_workers):
-        # Put a ceiling on the number of locked shards, so that we
-        # don't hammer the servers too badly.
-
-        # FIXME: For now, limit to one shard or set it
-        # with the --max-locked-shards. After testing to make sure we
-        # can handle multiple shards, we should probably do something like
-        # limit this to no more than a quarter of all workers, e.g.:
-        # return max(math.ceil(num_workers / 4.0), 1)
-        if self._options.max_locked_shards:
-            num_of_locked_shards = self._options.max_locked_shards
-        else:
-            num_of_locked_shards = 1
-
-        return num_of_locked_shards
-
-    def _resize_shards(self, old_shards, max_new_shards, shard_name_prefix):
-        """Takes a list of shards and redistributes the tests into no more
-        than |max_new_shards| new shards."""
-
-        # This implementation assumes that each input shard only contains tests from a
-        # single directory, and that tests in each shard must remain together; as a
-        # result, a given input shard is never split between output shards.
-        #
-        # Each output shard contains the tests from one or more input shards and
-        # hence may contain tests from multiple directories.
-
-        def divide_and_round_up(numerator, divisor):
-            return int(math.ceil(float(numerator) / divisor))
-
-        def extract_and_flatten(shards):
-            test_inputs = []
-            for shard in shards:
-                test_inputs.extend(shard.test_inputs)
-            return test_inputs
-
-        def split_at(seq, index):
-            return (seq[:index], seq[index:])
-
-        num_old_per_new = divide_and_round_up(len(old_shards), max_new_shards)
-        new_shards = []
-        remaining_shards = old_shards
-        while remaining_shards:
-            some_shards, remaining_shards = split_at(remaining_shards, num_old_per_new)
-            new_shards.append(TestShard('%s_%d' % (shard_name_prefix, len(new_shards) + 1),
-                                        extract_and_flatten(some_shards)))
-        return new_shards
-
-    def _run_tests(self, file_list, result_summary, num_workers):
-        """Runs the tests in the file_list.
-
-        Return: A tuple (interrupted, keyboard_interrupted, thread_timings,
-            test_timings, individual_test_timings)
-            interrupted is whether the run was interrupted
-            keyboard_interrupted is whether the interruption was because someone
-              typed Ctrl^C
-            thread_timings is a list of dicts with the total runtime
-              of each thread with 'name', 'num_tests', 'total_time' properties
-            test_timings is a list of timings for each sharded subdirectory
-              of the form [time, directory_name, num_tests]
-            individual_test_timings is a list of run times for each test
-              in the form {filename:filename, test_run_time:test_run_time}
-            result_summary: summary object to populate with the results
-        """
-        self._current_result_summary = result_summary
-        self._all_results = []
-        self._group_stats = {}
-        self._worker_stats = {}
-
-        keyboard_interrupted = False
-        interrupted = False
-
-        self._printer.write_update('Sharding tests ...')
-        locked_shards, unlocked_shards = self._shard_tests(file_list, int(self._options.child_processes), self._options.fully_parallel, self._options.shard_ref_tests)
-
-        # FIXME: We don't have a good way to coordinate the workers so that
-        # they don't try to run the shards that need a lock if we don't actually
-        # have the lock. The easiest solution at the moment is to grab the
-        # lock at the beginning of the run, and then run all of the locked
-        # shards first. This minimizes the time spent holding the lock, but
-        # means that we won't be running tests while we're waiting for the lock.
-        # If this becomes a problem in practice we'll need to change this.
-
-        all_shards = locked_shards + unlocked_shards
-        self._remaining_locked_shards = locked_shards
-        if locked_shards and self._options.http:
-            self.start_servers_with_lock(2 * min(num_workers, len(locked_shards)))
-
-        num_workers = min(num_workers, len(all_shards))
-        self._printer.print_workers_and_shards(num_workers, len(all_shards), len(locked_shards))
-
-        def worker_factory(worker_connection):
-            return worker.Worker(worker_connection, self.results_directory(), self._options)
-
-        if self._options.dry_run:
-            return (keyboard_interrupted, interrupted, self._worker_stats.values(), self._group_stats, self._all_results)
-
-        self._printer.write_update('Starting %s ...' % grammar.pluralize('worker', num_workers))
-
-        try:
-            with message_pool.get(self, worker_factory, num_workers, self._port.worker_startup_delay_secs(), self._port.host) as pool:
-                pool.run(('test_list', shard.name, shard.test_inputs) for shard in all_shards)
-        except KeyboardInterrupt:
-            self._printer.flush()
-            self._printer.write('Interrupted, exiting ...')
-            keyboard_interrupted = True
-        except TestRunInterruptedException, e:
-            _log.warning(e.reason)
-            interrupted = True
-        except Exception, e:
-            _log.debug('%s("%s") raised, exiting' % (e.__class__.__name__, str(e)))
-            raise
-        finally:
-            self.stop_servers_with_lock()
-
-        # FIXME: should this be a class instead of a tuple?
-        return (interrupted, keyboard_interrupted, self._worker_stats.values(), self._group_stats, self._all_results)
-
-    def results_directory(self):
-        if not self._retrying:
-            return self._results_directory
-        else:
-            self._filesystem.maybe_make_directory(self._filesystem.join(self._results_directory, 'retries'))
-            return self._filesystem.join(self._results_directory, 'retries')
-
     def needs_servers(self):
-        return any(self._test_requires_lock(test_name) for test_name in self._test_files) and self._options.http
+        return any(self._test_requires_lock(test_name) for test_name in self._test_names) and self._options.http
 
     def _set_up_run(self):
-        """Configures the system to be ready to run tests.
-
-        Returns a ResultSummary object if we should continue to run tests,
-        or None if we should abort.
+        self._printer.write_update("Checking build ...")
+        if not self._port.check_build(self.needs_servers()):
+            _log.error("Build check failed")
+            return False
 
-        """
         # This must be started before we check the system dependencies,
         # since the helper may do things to make the setup correct.
         if self._options.pixel_tests:
@@ -816,7 +368,7 @@ class Manager(object):
             self._printer.write_update("Checking system dependencies ...")
             if not self._port.check_sys_deps(self.needs_servers()):
                 self._port.stop_helper()
-                return None
+                return False
 
         if self._options.clobber_old_results:
             self._clobber_old_results()
@@ -825,43 +377,42 @@ class Manager(object):
         self._port.host.filesystem.maybe_make_directory(self._results_directory)
 
         self._port.setup_test_run()
-
-        self._printer.write_update("Preparing tests ...")
-        result_summary = self.prepare_lists_and_print_output()
-        if not result_summary:
-            return None
-
-        return result_summary
+        return True
 
     def run(self, args):
         """Run all our tests on all our test files and return the number of unexpected results (0 == success)."""
         self._printer.write_update("Collecting tests ...")
         try:
-            self._collect_tests(args)
-        except IOError as e:
-            # This is raised when the --test-list doesn't exist.
-            return -1
-
-        self._printer.write_update("Checking build ...")
-        if not self._port.check_build(self.needs_servers()):
-            _log.error("Build check failed")
+            self._paths, self._test_names = self._collect_tests(args)
+        except IOError as exception:
+            # This is raised if --test-list doesn't exist
             return -1
 
         self._printer.write_update("Parsing expectations ...")
-        self._parse_expectations()
+        self._expectations = test_expectations.TestExpectations(self._port, self._test_names)
+
+        num_all_test_files_found = len(self._test_names)
+        result_summary = self._prepare_lists()
 
-        result_summary = self._set_up_run()
-        if not result_summary:
+        # Check to make sure we're not skipping every test.
+        if not self._test_names:
+            _log.critical('No tests to run.')
             return -1
 
-        assert(len(self._test_files))
+        self._printer.print_found(num_all_test_files_found, len(self._test_names), self._options.repeat_each, self._options.iterations)
+        self._printer.print_expected(result_summary, self._expectations.get_tests_with_result_type)
+
+        if not self._set_up_run():
+            return -1
 
         start_time = time.time()
 
-        interrupted, keyboard_interrupted, thread_timings, test_timings, individual_test_timings = self._run_tests(self._test_files_list, result_summary, int(self._options.child_processes))
+        interrupted, keyboard_interrupted, thread_timings, test_timings, individual_test_timings = \
+            self._run_tests(self._test_names, result_summary, int(self._options.child_processes))
 
         # We exclude the crashes from the list of results to retry, because
         # we want to treat even a potentially flaky crash as an error.
+
         failures = self._get_failures(result_summary, include_crashes=self._port.should_retry_crashes(), include_missing=False)
         retry_summary = result_summary
         while (len(failures) and self._options.retry_failures and not self._retrying and not interrupted and not keyboard_interrupted):
@@ -869,9 +420,9 @@ class Manager(object):
             _log.info("Retrying %d unexpected failure(s) ..." % len(failures))
             _log.info('')
             self._retrying = True
-            retry_summary = ResultSummary(self._expectations, failures.keys())
+            retry_summary = ResultSummary(self._expectations, failures.keys(), 1, set())
             # Note that we intentionally ignore the return value here.
-            self._run_tests(failures.keys(), retry_summary, num_workers=1)
+            self._run_tests(failures.keys(), retry_summary, 1)
             failures = self._get_failures(retry_summary, include_crashes=True, include_missing=True)
 
         end_time = time.time()
@@ -906,28 +457,11 @@ class Manager(object):
 
         return self._port.exit_code_from_summarized_results(unexpected_results)
 
-    def start_servers_with_lock(self, number_of_servers):
-        self._printer.write_update('Acquiring http lock ...')
-        self._port.acquire_http_lock()
-        if self._http_tests():
-            self._printer.write_update('Starting HTTP server ...')
-            self._port.start_http_server(number_of_servers=number_of_servers)
-        if self._websocket_tests():
-            self._printer.write_update('Starting WebSocket server ...')
-            self._port.start_websocket_server()
-        self._has_http_lock = True
-
-    def stop_servers_with_lock(self):
-        if self._has_http_lock:
-            if self._http_tests():
-                self._printer.write_update('Stopping HTTP server ...')
-                self._port.stop_http_server()
-            if self._websocket_tests():
-                self._printer.write_update('Stopping WebSocket server ...')
-                self._port.stop_websocket_server()
-            self._printer.write_update('Releasing server lock ...')
-            self._port.release_http_lock()
-            self._has_http_lock = False
+    def _run_tests(self, tests, result_summary, num_workers):
+        test_inputs = [self._test_input_for_file(test) for test in tests]
+        needs_http = any(self._is_http_test(test) for test in tests)
+        needs_websockets = any(self._is_websocket_test(test) for test in tests)
+        return self._runner.run_tests(test_inputs, self._expectations, result_summary, num_workers, needs_http, needs_websockets, self._retrying)
 
     def _clean_up_run(self):
         """Restores the system after we're done running tests."""
@@ -963,52 +497,6 @@ class Manager(object):
                 writer = TestResultWriter(self._port._filesystem, self._port, self._port.results_directory(), test)
                 writer.write_crash_log(crash_log)
 
-    def _mark_interrupted_tests_as_skipped(self, result_summary):
-        for test_name in self._test_files:
-            if test_name not in result_summary.results:
-                result = test_results.TestResult(test_name, [test_failures.FailureEarlyExit()])
-                # FIXME: We probably need to loop here if there are multiple iterations.
-                # FIXME: Also, these results are really neither expected nor unexpected. We probably
-                # need a third type of result.
-                result_summary.add(result, expected=False, test_is_slow=self._test_is_slow(test_name))
-
-    def _interrupt_if_at_failure_limits(self, result_summary):
-        # Note: The messages in this method are constructed to match old-run-webkit-tests
-        # so that existing buildbot grep rules work.
-        def interrupt_if_at_failure_limit(limit, failure_count, result_summary, message):
-            if limit and failure_count >= limit:
-                message += " %d tests run." % (result_summary.expected + result_summary.unexpected)
-                self._mark_interrupted_tests_as_skipped(result_summary)
-                raise TestRunInterruptedException(message)
-
-        interrupt_if_at_failure_limit(
-            self._options.exit_after_n_failures,
-            result_summary.unexpected_failures,
-            result_summary,
-            "Exiting early after %d failures." % result_summary.unexpected_failures)
-        interrupt_if_at_failure_limit(
-            self._options.exit_after_n_crashes_or_timeouts,
-            result_summary.unexpected_crashes + result_summary.unexpected_timeouts,
-            result_summary,
-            # This differs from ORWT because it does not include WebProcess crashes.
-            "Exiting early after %d crashes and %d timeouts." % (result_summary.unexpected_crashes, result_summary.unexpected_timeouts))
-
-    def _update_summary_with_result(self, result_summary, result):
-        if result.type == test_expectations.SKIP:
-            exp_str = got_str = 'SKIP'
-            expected = True
-        else:
-            expected = self._expectations.matches_an_expected_result(result.test_name, result.type, self._options.pixel_tests or test_failures.is_reftest_failure(result.failures))
-            exp_str = self._expectations.get_expectations_string(result.test_name)
-            got_str = self._expectations.expectation_to_string(result.type)
-
-        result_summary.add(result, expected, self._test_is_slow(result.test_name))
-
-        # FIXME: there's too many arguments to this function.
-        self._printer.print_finished_test(result, expected, exp_str, got_str, result_summary, self._retrying, self._test_files_list)
-
-        self._interrupt_if_at_failure_limits(result_summary)
-
     def _clobber_old_results(self):
         # Just clobber the actual test results directories since the other
         # files in the results directory are explicitly used for cross-run
@@ -1076,7 +564,7 @@ class Manager(object):
             self._port, self._options.builder_name, self._options.build_name,
             self._options.build_number, self._results_directory,
             BUILDER_BASE_URL, individual_test_timings,
-            self._expectations, result_summary, self._test_files_list,
+            self._expectations, result_summary, self._test_names,
             self._options.test_results_server,
             "layout-tests",
             self._options.master_name)
@@ -1122,84 +610,3 @@ class Manager(object):
 
         results_filename = self._filesystem.join(self._results_directory, "results.html")
         self._port.show_results_html_file(results_filename)
-
-    def handle(self, name, source, *args):
-        method = getattr(self, '_handle_' + name)
-        if method:
-            return method(source, *args)
-        raise AssertionError('unknown message %s received from %s, args=%s' % (name, source, repr(args)))
-
-    def _handle_started_test(self, worker_name, test_input, test_timeout_sec):
-        # FIXME: log that we've started another test.
-        pass
-
-    def _handle_finished_test_list(self, worker_name, list_name, num_tests, elapsed_time):
-        self._group_stats[list_name] = (num_tests, elapsed_time)
-
-        def find(name, test_lists):
-            for i in range(len(test_lists)):
-                if test_lists[i].name == name:
-                    return i
-            return -1
-
-        index = find(list_name, self._remaining_locked_shards)
-        if index >= 0:
-            self._remaining_locked_shards.pop(index)
-            if not self._remaining_locked_shards:
-                self.stop_servers_with_lock()
-
-    def _handle_finished_test(self, worker_name, result, elapsed_time, log_messages=[]):
-        self._worker_stats.setdefault(worker_name, {'name': worker_name, 'num_tests': 0, 'total_time': 0})
-        self._worker_stats[worker_name]['total_time'] += elapsed_time
-        self._worker_stats[worker_name]['num_tests'] += 1
-        self._all_results.append(result)
-        self._update_summary_with_result(self._current_result_summary, result)
-
-
-def read_test_files(fs, filenames, test_path_separator):
-    tests = []
-    for filename in filenames:
-        try:
-            if test_path_separator != fs.sep:
-                filename = filename.replace(test_path_separator, fs.sep)
-            file_contents = fs.read_text_file(filename).split('\n')
-            for line in file_contents:
-                line = test_expectations.strip_comments(line)
-                if line:
-                    tests.append(line)
-        except IOError, e:
-            if e.errno == errno.ENOENT:
-                _log.critical('')
-                _log.critical('--test-list file "%s" not found' % filename)
-            raise
-    return tests
-
-
-# FIXME: These two free functions belong either on manager (since it's the only one
-# which uses them) or in a different file (if they need to be re-used).
-def test_key(port, test_name):
-    """Turns a test name into a list with two sublists, the natural key of the
-    dirname, and the natural key of the basename.
-
-    This can be used when sorting paths so that files in a directory.
-    directory are kept together rather than being mixed in with files in
-    subdirectories."""
-    dirname, basename = port.split_test(test_name)
-    return (natural_sort_key(dirname + port.TEST_PATH_SEPARATOR), natural_sort_key(basename))
-
-
-def natural_sort_key(string_to_split):
-    """ Turn a string into a list of string and number chunks.
-        "z23a" -> ["z", 23, "a"]
-
-        Can be used to implement "natural sort" order. See:
-            http://www.codinghorror.com/blog/2007/12/sorting-for-humans-natural-sort-order.html
-            http://nedbatchelder.com/blog/200712.html#e20071211T054956
-    """
-    def tryint(val):
-        try:
-            return int(val)
-        except ValueError:
-            return val
-
-    return [tryint(chunk) for chunk in re.split('(\d+)', string_to_split)]
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/manager_unittest.py b/Tools/Scripts/webkitpy/layout_tests/controllers/manager_unittest.py
index 576d423af..ce511813d 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/manager_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/manager_unittest.py
@@ -30,309 +30,27 @@
 
 """Unit tests for manager.py."""
 
-import StringIO
 import sys
 import time
 import unittest
 
-from webkitpy.common.system.filesystem_mock import MockFileSystem
-from webkitpy.common.system import outputcapture
-from webkitpy.thirdparty.mock import Mock
-from webkitpy import layout_tests
-from webkitpy.layout_tests.port import port_testcase
-
-from webkitpy import layout_tests
-from webkitpy.layout_tests import run_webkit_tests
-from webkitpy.layout_tests.controllers import manager
-from webkitpy.layout_tests.controllers.manager import interpret_test_failures,  Manager, natural_sort_key, test_key, TestRunInterruptedException, TestShard
-from webkitpy.layout_tests.models import result_summary
+from webkitpy.common.host_mock import MockHost
+from webkitpy.layout_tests.controllers.manager import Manager, interpret_test_failures, summarize_results
 from webkitpy.layout_tests.models import test_expectations
 from webkitpy.layout_tests.models import test_failures
 from webkitpy.layout_tests.models import test_results
 from webkitpy.layout_tests.models.result_summary import ResultSummary
-from webkitpy.layout_tests.models.test_expectations import TestExpectations
-from webkitpy.layout_tests.models.test_results import TestResult
-from webkitpy.layout_tests.views import printing
+from webkitpy.thirdparty.mock import Mock
 from webkitpy.tool.mocktool import MockOptions
-from webkitpy.common.system.executive_mock import MockExecutive
-from webkitpy.common.host_mock import MockHost
-
-
-class ManagerWrapper(Manager):
-    def __init__(self, ref_tests, **kwargs):
-        Manager.__init__(self, **kwargs)
-        self._ref_tests = ref_tests
-
-    def _get_test_input_for_file(self, test_file):
-        return test_file
-
-    def _is_ref_test(self, test_input):
-        return test_input in self._ref_tests
-
-
-class ShardingTests(unittest.TestCase):
-    test_list = [
-        "http/tests/websocket/tests/unicode.htm",
-        "animations/keyframes.html",
-        "http/tests/security/view-source-no-refresh.html",
-        "http/tests/websocket/tests/websocket-protocol-ignored.html",
-        "fast/css/display-none-inline-style-change-crash.html",
-        "http/tests/xmlhttprequest/supported-xml-content-types.html",
-        "dom/html/level2/html/HTMLAnchorElement03.html",
-        "ietestcenter/Javascript/11.1.5_4-4-c-1.html",
-        "dom/html/level2/html/HTMLAnchorElement06.html",
-        "perf/object-keys.html",
-    ]
-
-    ref_tests = [
-        "http/tests/security/view-source-no-refresh.html",
-        "http/tests/websocket/tests/websocket-protocol-ignored.html",
-        "ietestcenter/Javascript/11.1.5_4-4-c-1.html",
-        "dom/html/level2/html/HTMLAnchorElement06.html",
-    ]
-
-    def get_shards(self, num_workers, fully_parallel, shard_ref_tests=False, test_list=None, max_locked_shards=None):
-        test_list = test_list or self.test_list
-        host = MockHost()
-        port = host.port_factory.get(port_name='test')
-        port._filesystem = MockFileSystem()
-        options = MockOptions(max_locked_shards=max_locked_shards)
-        self.manager = ManagerWrapper(self.ref_tests, port=port, options=options, printer=Mock())
-        return self.manager._shard_tests(test_list, num_workers, fully_parallel, shard_ref_tests)
-
-    def test_shard_by_dir(self):
-        locked, unlocked = self.get_shards(num_workers=2, fully_parallel=False)
-
-        # Note that although there are tests in multiple dirs that need locks,
-        # they are crammed into a single shard in order to reduce the # of
-        # workers hitting the server at once.
-        self.assertEquals(locked,
-            [TestShard('locked_shard_1',
-              ['http/tests/security/view-source-no-refresh.html',
-               'http/tests/websocket/tests/unicode.htm',
-               'http/tests/websocket/tests/websocket-protocol-ignored.html',
-               'http/tests/xmlhttprequest/supported-xml-content-types.html',
-               'perf/object-keys.html'])])
-        self.assertEquals(unlocked,
-            [TestShard('animations',
-                       ['animations/keyframes.html']),
-             TestShard('dom/html/level2/html',
-                       ['dom/html/level2/html/HTMLAnchorElement03.html',
-                        'dom/html/level2/html/HTMLAnchorElement06.html']),
-             TestShard('fast/css',
-                       ['fast/css/display-none-inline-style-change-crash.html']),
-             TestShard('ietestcenter/Javascript',
-                       ['ietestcenter/Javascript/11.1.5_4-4-c-1.html'])])
-
-    def test_shard_by_dir_sharding_ref_tests(self):
-        locked, unlocked = self.get_shards(num_workers=2, fully_parallel=False, shard_ref_tests=True)
-
-        # Note that although there are tests in multiple dirs that need locks,
-        # they are crammed into a single shard in order to reduce the # of
-        # workers hitting the server at once.
-        self.assertEquals(locked,
-            [TestShard('locked_shard_1',
-              ['http/tests/websocket/tests/unicode.htm',
-               'http/tests/xmlhttprequest/supported-xml-content-types.html',
-               'perf/object-keys.html',
-               'http/tests/security/view-source-no-refresh.html',
-               'http/tests/websocket/tests/websocket-protocol-ignored.html'])])
-        self.assertEquals(unlocked,
-            [TestShard('animations',
-                       ['animations/keyframes.html']),
-             TestShard('dom/html/level2/html',
-                       ['dom/html/level2/html/HTMLAnchorElement03.html']),
-             TestShard('fast/css',
-                       ['fast/css/display-none-inline-style-change-crash.html']),
-             TestShard('~ref:dom/html/level2/html',
-                       ['dom/html/level2/html/HTMLAnchorElement06.html']),
-             TestShard('~ref:ietestcenter/Javascript',
-                       ['ietestcenter/Javascript/11.1.5_4-4-c-1.html'])])
-
-    def test_shard_every_file(self):
-        locked, unlocked = self.get_shards(num_workers=2, fully_parallel=True)
-        self.assertEquals(locked,
-            [TestShard('.', ['http/tests/websocket/tests/unicode.htm']),
-             TestShard('.', ['http/tests/security/view-source-no-refresh.html']),
-             TestShard('.', ['http/tests/websocket/tests/websocket-protocol-ignored.html']),
-             TestShard('.', ['http/tests/xmlhttprequest/supported-xml-content-types.html']),
-             TestShard('.', ['perf/object-keys.html'])]),
-        self.assertEquals(unlocked,
-            [TestShard('.', ['animations/keyframes.html']),
-             TestShard('.', ['fast/css/display-none-inline-style-change-crash.html']),
-             TestShard('.', ['dom/html/level2/html/HTMLAnchorElement03.html']),
-             TestShard('.', ['ietestcenter/Javascript/11.1.5_4-4-c-1.html']),
-             TestShard('.', ['dom/html/level2/html/HTMLAnchorElement06.html'])])
-
-    def test_shard_in_two(self):
-        locked, unlocked = self.get_shards(num_workers=1, fully_parallel=False)
-        self.assertEquals(locked,
-            [TestShard('locked_tests',
-                       ['http/tests/websocket/tests/unicode.htm',
-                        'http/tests/security/view-source-no-refresh.html',
-                        'http/tests/websocket/tests/websocket-protocol-ignored.html',
-                        'http/tests/xmlhttprequest/supported-xml-content-types.html',
-                        'perf/object-keys.html'])])
-        self.assertEquals(unlocked,
-            [TestShard('unlocked_tests',
-                       ['animations/keyframes.html',
-                        'fast/css/display-none-inline-style-change-crash.html',
-                        'dom/html/level2/html/HTMLAnchorElement03.html',
-                        'ietestcenter/Javascript/11.1.5_4-4-c-1.html',
-                        'dom/html/level2/html/HTMLAnchorElement06.html'])])
-
-    def test_shard_in_two_sharding_ref_tests(self):
-        locked, unlocked = self.get_shards(num_workers=1, fully_parallel=False, shard_ref_tests=True)
-        self.assertEquals(locked,
-            [TestShard('locked_tests',
-                       ['http/tests/websocket/tests/unicode.htm',
-                        'http/tests/xmlhttprequest/supported-xml-content-types.html',
-                        'perf/object-keys.html',
-                        'http/tests/security/view-source-no-refresh.html',
-                        'http/tests/websocket/tests/websocket-protocol-ignored.html'])])
-        self.assertEquals(unlocked,
-            [TestShard('unlocked_tests',
-                       ['animations/keyframes.html',
-                        'fast/css/display-none-inline-style-change-crash.html',
-                        'dom/html/level2/html/HTMLAnchorElement03.html',
-                        'ietestcenter/Javascript/11.1.5_4-4-c-1.html',
-                        'dom/html/level2/html/HTMLAnchorElement06.html'])])
-
-    def test_shard_in_two_has_no_locked_shards(self):
-        locked, unlocked = self.get_shards(num_workers=1, fully_parallel=False,
-             test_list=['animations/keyframe.html'])
-        self.assertEquals(len(locked), 0)
-        self.assertEquals(len(unlocked), 1)
-
-    def test_shard_in_two_has_no_unlocked_shards(self):
-        locked, unlocked = self.get_shards(num_workers=1, fully_parallel=False,
-             test_list=['http/tests/webcoket/tests/unicode.htm'])
-        self.assertEquals(len(locked), 1)
-        self.assertEquals(len(unlocked), 0)
-
-    def test_multiple_locked_shards(self):
-        locked, unlocked = self.get_shards(num_workers=4, fully_parallel=False, max_locked_shards=2)
-        self.assertEqual(locked,
-            [TestShard('locked_shard_1',
-                       ['http/tests/security/view-source-no-refresh.html',
-                        'http/tests/websocket/tests/unicode.htm',
-                        'http/tests/websocket/tests/websocket-protocol-ignored.html']),
-             TestShard('locked_shard_2',
-                        ['http/tests/xmlhttprequest/supported-xml-content-types.html',
-                         'perf/object-keys.html'])])
-
-        locked, unlocked = self.get_shards(num_workers=4, fully_parallel=False)
-        self.assertEquals(locked,
-            [TestShard('locked_shard_1',
-                       ['http/tests/security/view-source-no-refresh.html',
-                        'http/tests/websocket/tests/unicode.htm',
-                        'http/tests/websocket/tests/websocket-protocol-ignored.html',
-                        'http/tests/xmlhttprequest/supported-xml-content-types.html',
-                        'perf/object-keys.html'])])
-
-
-class LockCheckingManager(Manager):
-    def __init__(self, port, options, printer, tester, http_lock):
-        super(LockCheckingManager, self).__init__(port, options, printer)
-        self._finished_list_called = False
-        self._tester = tester
-        self._should_have_http_lock = http_lock
-
-    def handle_finished_list(self, source, list_name, num_tests, elapsed_time):
-        if not self._finished_list_called:
-            self._tester.assertEquals(list_name, 'locked_tests')
-            self._tester.assertTrue(self._remaining_locked_shards)
-            self._tester.assertTrue(self._has_http_lock is self._should_have_http_lock)
-
-        super(LockCheckingManager, self).handle_finished_list(source, list_name, num_tests, elapsed_time)
-
-        if not self._finished_list_called:
-            self._tester.assertEquals(self._remaining_locked_shards, [])
-            self._tester.assertFalse(self._has_http_lock)
-            self._finished_list_called = True
 
 
 class ManagerTest(unittest.TestCase):
-    def get_options(self):
-        return MockOptions(pixel_tests=False, new_baseline=False, time_out_ms=6000, slow_time_out_ms=30000, worker_model='inline')
-
-    def test_http_locking(tester):
-        options, args = run_webkit_tests.parse_args(['--platform=test', '--print=nothing', 'http/tests/passes', 'passes'])
-        host = MockHost()
-        port = host.port_factory.get(port_name=options.platform, options=options)
-        run_webkit_tests._set_up_derived_options(port, options)
-        printer = printing.Printer(port, options, StringIO.StringIO(), StringIO.StringIO())
-        manager = LockCheckingManager(port, options, printer, tester, True)
-        num_unexpected_results = manager.run(args)
-        printer.cleanup()
-        tester.assertEquals(num_unexpected_results, 0)
-
-    def test_perf_locking(tester):
-        options, args = run_webkit_tests.parse_args(['--platform=test', '--print=nothing', '--no-http', 'passes', 'perf/'])
-        host = MockHost()
-        port = host.port_factory.get(port_name=options.platform, options=options)
-        run_webkit_tests._set_up_derived_options(port, options)
-        printer = printing.Printer(port, options, StringIO.StringIO(), StringIO.StringIO())
-        manager = LockCheckingManager(port, options, printer, tester, False)
-        num_unexpected_results = manager.run(args)
-        printer.cleanup()
-        tester.assertEquals(num_unexpected_results, 0)
-
-    def test_interrupt_if_at_failure_limits(self):
-        port = Mock()  # FIXME: This should be a tighter mock.
-        port.TEST_PATH_SEPARATOR = '/'
-        port._filesystem = MockFileSystem()
-        manager = Manager(port=port, options=MockOptions(), printer=Mock())
-
-        manager._options = MockOptions(exit_after_n_failures=None, exit_after_n_crashes_or_timeouts=None)
-        manager._test_files = ['foo/bar.html', 'baz.html']
-        manager._test_is_slow = lambda test_name: False
-
-        result_summary = ResultSummary(expectations=Mock(), test_files=manager._test_files)
-        result_summary.unexpected_failures = 100
-        result_summary.unexpected_crashes = 50
-        result_summary.unexpected_timeouts = 50
-        # No exception when the exit_after* options are None.
-        manager._interrupt_if_at_failure_limits(result_summary)
-
-        # No exception when we haven't hit the limit yet.
-        manager._options.exit_after_n_failures = 101
-        manager._options.exit_after_n_crashes_or_timeouts = 101
-        manager._interrupt_if_at_failure_limits(result_summary)
-
-        # Interrupt if we've exceeded either limit:
-        manager._options.exit_after_n_crashes_or_timeouts = 10
-        self.assertRaises(TestRunInterruptedException, manager._interrupt_if_at_failure_limits, result_summary)
-
-        self.assertEquals(result_summary.results['foo/bar.html'].type, test_expectations.SKIP)
-        self.assertEquals(result_summary.results['baz.html'].type, test_expectations.SKIP)
-
-        manager._options.exit_after_n_crashes_or_timeouts = None
-        manager._options.exit_after_n_failures = 10
-        exception = self.assertRaises(TestRunInterruptedException, manager._interrupt_if_at_failure_limits, result_summary)
-
-    def test_update_summary_with_result(self):
-        host = MockHost()
-        port = host.port_factory.get('test-win-xp')
-        test = 'failures/expected/reftest.html'
-        port.expectations_dict = lambda: {'': 'WONTFIX : failures/expected/reftest.html = IMAGE'}
-        expectations = TestExpectations(port, tests=[test])
-        # Reftests expected to be image mismatch should be respected when pixel_tests=False.
-        manager = Manager(port=port, options=MockOptions(pixel_tests=False, exit_after_n_failures=None, exit_after_n_crashes_or_timeouts=None), printer=Mock())
-        manager._expectations = expectations
-        result_summary = ResultSummary(expectations=expectations, test_files=[test])
-        result = TestResult(test_name=test, failures=[test_failures.FailureReftestMismatchDidNotOccur()])
-        manager._update_summary_with_result(result_summary, result)
-        self.assertEquals(1, result_summary.expected)
-        self.assertEquals(0, result_summary.unexpected)
-
     def test_needs_servers(self):
         def get_manager_with_tests(test_names):
             port = Mock()  # FIXME: Use a tighter mock.
             port.TEST_PATH_SEPARATOR = '/'
-            manager = Manager(port, options=MockOptions(http=True), printer=Mock())
-            manager._test_files = set(test_names)
-            manager._test_files_list = test_names
+            manager = Manager(port, options=MockOptions(http=True, max_locked_shards=1), printer=Mock())
+            manager._test_names = test_names
             return manager
 
         manager = get_manager_with_tests(['fast/html'])
@@ -345,7 +63,7 @@ class ManagerTest(unittest.TestCase):
         def get_manager_with_tests(test_names):
             host = MockHost()
             port = host.port_factory.get()
-            manager = Manager(port, options=MockOptions(test_list=None, http=True), printer=Mock())
+            manager = Manager(port, options=MockOptions(test_list=None, http=True, max_locked_shards=1), printer=Mock())
             manager._collect_tests(test_names)
             return manager
 
@@ -366,110 +84,17 @@ class ManagerTest(unittest.TestCase):
         def get_manager_with_tests(test_names):
             host = MockHost()
             port = host.port_factory.get('test-mac-leopard')
-            manager = Manager(port, options=MockOptions(test_list=None, http=True), printer=Mock())
+            manager = Manager(port, options=MockOptions(test_list=None, http=True, max_locked_shards=1), printer=Mock())
             manager._collect_tests(test_names)
             return manager
         host = MockHost()
         port = host.port_factory.get('test-mac-leopard')
         tests = ['failures/expected/crash.html']
         expectations = test_expectations.TestExpectations(port, tests)
-        rs = result_summary.ResultSummary(expectations, tests)
+        rs = ResultSummary(expectations, tests, 1, set())
         manager = get_manager_with_tests(tests)
         manager._look_for_new_crash_logs(rs, time.time())
 
-    def test_servers_started(self):
-
-        def start_http_server(number_of_servers=None):
-            self.http_started = True
-
-        def start_websocket_server():
-            self.websocket_started = True
-
-        def stop_http_server():
-            self.http_stopped = True
-
-        def stop_websocket_server():
-            self.websocket_stopped = True
-
-        host = MockHost()
-        port = host.port_factory.get('test-mac-leopard')
-        port.start_http_server = start_http_server
-        port.start_websocket_server = start_websocket_server
-        port.stop_http_server = stop_http_server
-        port.stop_websocket_server = stop_websocket_server
-
-        self.http_started = self.http_stopped = self.websocket_started = self.websocket_stopped = False
-        manager = Manager(port=port, options=MockOptions(http=True), printer=Mock())
-        manager._test_files = ['http/tests/pass.txt']
-        manager.start_servers_with_lock(number_of_servers=4)
-        self.assertEquals(self.http_started, True)
-        self.assertEquals(self.websocket_started, False)
-        manager.stop_servers_with_lock()
-        self.assertEquals(self.http_stopped, True)
-        self.assertEquals(self.websocket_stopped, False)
-
-        self.http_started = self.http_stopped = self.websocket_started = self.websocket_stopped = False
-        manager = Manager(port=port, options=MockOptions(http=True), printer=Mock())
-        manager._test_files = ['websocket/pass.txt']
-        manager.start_servers_with_lock(number_of_servers=4)
-        self.assertEquals(self.http_started, True)
-        self.assertEquals(self.websocket_started, True)
-        manager.stop_servers_with_lock()
-        self.assertEquals(self.http_stopped, True)
-        self.assertEquals(self.websocket_stopped, True)
-
-        self.http_started = self.http_stopped = self.websocket_started = self.websocket_stopped = False
-        manager = Manager(port=port, options=MockOptions(http=True), printer=Mock())
-        manager._test_files = ['perf/foo/test.html']
-        manager.start_servers_with_lock(number_of_servers=4)
-        self.assertEquals(self.http_started, False)
-        self.assertEquals(self.websocket_started, False)
-        manager.stop_servers_with_lock()
-        self.assertEquals(self.http_stopped, False)
-        self.assertEquals(self.websocket_stopped, False)
-
-
-
-class NaturalCompareTest(unittest.TestCase):
-    def assert_cmp(self, x, y, result):
-        self.assertEquals(cmp(natural_sort_key(x), natural_sort_key(y)), result)
-
-    def test_natural_compare(self):
-        self.assert_cmp('a', 'a', 0)
-        self.assert_cmp('ab', 'a', 1)
-        self.assert_cmp('a', 'ab', -1)
-        self.assert_cmp('', '', 0)
-        self.assert_cmp('', 'ab', -1)
-        self.assert_cmp('1', '2', -1)
-        self.assert_cmp('2', '1', 1)
-        self.assert_cmp('1', '10', -1)
-        self.assert_cmp('2', '10', -1)
-        self.assert_cmp('foo_1.html', 'foo_2.html', -1)
-        self.assert_cmp('foo_1.1.html', 'foo_2.html', -1)
-        self.assert_cmp('foo_1.html', 'foo_10.html', -1)
-        self.assert_cmp('foo_2.html', 'foo_10.html', -1)
-        self.assert_cmp('foo_23.html', 'foo_10.html', 1)
-        self.assert_cmp('foo_23.html', 'foo_100.html', -1)
-
-
-class KeyCompareTest(unittest.TestCase):
-    def setUp(self):
-        host = MockHost()
-        self.port = host.port_factory.get('test')
-
-    def assert_cmp(self, x, y, result):
-        self.assertEquals(cmp(test_key(self.port, x), test_key(self.port, y)), result)
-
-    def test_test_key(self):
-        self.assert_cmp('/a', '/a', 0)
-        self.assert_cmp('/a', '/b', -1)
-        self.assert_cmp('/a2', '/a10', -1)
-        self.assert_cmp('/a2/foo', '/a10/foo', -1)
-        self.assert_cmp('/a/foo11', '/a/foo2', 1)
-        self.assert_cmp('/ab', '/a/a/b', -1)
-        self.assert_cmp('/a/a/b', '/ab', 1)
-        self.assert_cmp('/foo-bar/baz', '/foo/baz', -1)
-
 
 class ResultSummaryTest(unittest.TestCase):
 
@@ -509,7 +134,7 @@ class ResultSummaryTest(unittest.TestCase):
     def get_result_summary(self, port, test_names, expectations_str):
         port.expectations_dict = lambda: {'': expectations_str}
         expectations = test_expectations.TestExpectations(port, test_names)
-        return test_names, result_summary.ResultSummary(expectations, test_names), expectations
+        return test_names, ResultSummary(expectations, test_names, 1, set()), expectations
 
     # FIXME: Use this to test more of summarize_results. This was moved from printing_unittest.py.
     def summarized_results(self, port, expected, passing, flaky, extra_tests=[], extra_expectations=None):
@@ -545,8 +170,8 @@ class ResultSummaryTest(unittest.TestCase):
             retry.add(self.get_result('passes/text.html'), True, test_is_slow)
             retry.add(self.get_result('failures/expected/timeout.html'), True, test_is_slow)
             retry.add(self.get_result('failures/expected/crash.html'), True, test_is_slow)
-        unexpected_results = manager.summarize_results(port, exp, rs, retry, test_timings={}, only_unexpected=True, interrupted=False)
-        expected_results = manager.summarize_results(port, exp, rs, retry, test_timings={}, only_unexpected=False, interrupted=False)
+        unexpected_results = summarize_results(port, exp, rs, retry, test_timings={}, only_unexpected=True, interrupted=False)
+        expected_results = summarize_results(port, exp, rs, retry, test_timings={}, only_unexpected=False, interrupted=False)
         return expected_results, unexpected_results
 
     def test_no_svn_revision(self):
@@ -569,6 +194,3 @@ class ResultSummaryTest(unittest.TestCase):
         port._filesystem.write_text_file(port._filesystem.join(port.layout_tests_dir(), "failures/expected/wontfix.html"), "Dummy test contents")
         expected_results, unexpected_results = self.summarized_results(port, expected=False, passing=False, flaky=False, extra_tests=['failures/expected/wontfix.html'], extra_expectations='BUGX WONTFIX : failures/expected/wontfix.html = TEXT\n')
         self.assertTrue(expected_results['tests']['failures']['expected']['wontfix.html']['wontfix'])
-
-if __name__ == '__main__':
-    port_testcase.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py b/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py
index 88cbabf23..b36130ded 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py
@@ -264,12 +264,18 @@ class SingleTestRunner(object):
             failures.append(test_failures.FailureMissingImageHash())
         elif driver_output.image_hash != expected_driver_output.image_hash:
             diff_result = self._port.diff_image(driver_output.image, expected_driver_output.image)
-            driver_output.image_diff = diff_result[0]
-            if driver_output.image_diff:
-                failures.append(test_failures.FailureImageHashMismatch(diff_result[1]))
+            err_str = diff_result[2]
+            if err_str:
+                _log.warning('  %s : %s' % (self._test_name, err_str))
+                failures.append(test_failures.FailureImageHashMismatch())
+                driver_output.error = (driver_output.error or '') + err_str
             else:
-                # See https://bugs.webkit.org/show_bug.cgi?id=69444 for why this isn't a full failure.
-                _log.warning('  %s -> pixel hash failed (but pixel test still passes)' % self._test_name)
+                driver_output.image_diff = diff_result[0]
+                if driver_output.image_diff:
+                    failures.append(test_failures.FailureImageHashMismatch(diff_result[1]))
+                else:
+                    # See https://bugs.webkit.org/show_bug.cgi?id=69444 for why this isn't a full failure.
+                    _log.warning('  %s -> pixel hash failed (but pixel test still passes)' % self._test_name)
         return failures
 
     def _run_reftest(self):
@@ -317,4 +323,8 @@ class SingleTestRunner(object):
                 failures.append(test_failures.FailureReftestMismatchDidNotOccur(reference_filename))
         elif driver_output1.image_hash != driver_output2.image_hash:
             failures.append(test_failures.FailureReftestMismatch(reference_filename))
+
+        # recompute in case we added to stderr during diff_image
+        has_stderr = driver_output1.has_stderr() or driver_output2.has_stderr()
+
         return TestResult(self._test_name, failures, total_test_time, has_stderr)
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer.py b/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer.py
index 243a11d8d..67f42e3b6 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer.py
@@ -69,7 +69,7 @@ def write_test_result(filesystem, port, test_name, driver_output,
             # FIXME: This work should be done earlier in the pipeline (e.g., when we compare images for non-ref tests).
             # FIXME: We should always have 2 images here.
             if driver_output.image and expected_driver_output.image:
-                diff_image, diff_percent = port.diff_image(driver_output.image, expected_driver_output.image, tolerance=0)
+                diff_image, diff_percent, err_str = port.diff_image(driver_output.image, expected_driver_output.image, tolerance=0)
                 if diff_image:
                     writer.write_image_diff_files(diff_image)
                     failure.diff_percent = diff_percent
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer_unittest.py b/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer_unittest.py
index 3b9b522ad..dfd604187 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer_unittest.py
@@ -42,7 +42,7 @@ class TestResultWriterTest(unittest.TestCase):
         class ImageDiffTestPort(TestPort):
             def diff_image(self, expected_contents, actual_contents, tolerance=None):
                 used_tolerance_values.append(tolerance)
-                return (True, 1)
+                return (True, 1, None)
 
         host = MockHost()
         port = ImageDiffTestPort(host)
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/worker.py b/Tools/Scripts/webkitpy/layout_tests/controllers/worker.py
deleted file mode 100644
index b1583fff3..000000000
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/worker.py
+++ /dev/null
@@ -1,231 +0,0 @@
-# Copyright (C) 2011 Google Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-#     * Neither the name of Google Inc. nor the names of its
-# contributors may be used to endorse or promote products derived from
-# this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-"""Handle messages from the Manager and executes actual tests."""
-
-import logging
-import threading
-import time
-
-from webkitpy.layout_tests.controllers import single_test_runner
-from webkitpy.layout_tests.models import test_expectations
-from webkitpy.layout_tests.models import test_results
-
-
-_log = logging.getLogger(__name__)
-
-
-class Worker(object):
-    def __init__(self, caller, results_directory, options):
-        self._caller = caller
-        self._worker_number = caller.worker_number
-        self._name = caller.name
-        self._results_directory = results_directory
-        self._options = options
-
-        # The remaining fields are initialized in start()
-        self._host = None
-        self._port = None
-        self._batch_size = None
-        self._batch_count = None
-        self._filesystem = None
-        self._driver = None
-        self._tests_run_file = None
-        self._tests_run_filename = None
-
-    def __del__(self):
-        self.stop()
-
-    def start(self):
-        """This method is called when the object is starting to be used and it is safe
-        for the object to create state that does not need to be pickled (usually this means
-        it is called in a child process)."""
-        self._host = self._caller.host
-        self._filesystem = self._host.filesystem
-        self._port = self._host.port_factory.get(self._options.platform, self._options)
-
-        self._batch_count = 0
-        self._batch_size = self._options.batch_size or 0
-        tests_run_filename = self._filesystem.join(self._results_directory, "tests_run%d.txt" % self._worker_number)
-        self._tests_run_file = self._filesystem.open_text_file_for_writing(tests_run_filename)
-
-    def handle(self, name, source, test_list_name, test_inputs):
-        assert name == 'test_list'
-        start_time = time.time()
-        for test_input in test_inputs:
-            self._run_test(test_input)
-        elapsed_time = time.time() - start_time
-        self._caller.post('finished_test_list', test_list_name, len(test_inputs), elapsed_time)
-
-    def _update_test_input(self, test_input):
-        if test_input.reference_files is None:
-            # Lazy initialization.
-            test_input.reference_files = self._port.reference_files(test_input.test_name)
-        if test_input.reference_files:
-            test_input.should_run_pixel_test = True
-        else:
-            test_input.should_run_pixel_test = self._port.should_run_as_pixel_test(test_input)
-
-    def _run_test(self, test_input):
-        self._update_test_input(test_input)
-        test_timeout_sec = self._timeout(test_input)
-        start = time.time()
-        self._caller.post('started_test', test_input, test_timeout_sec)
-
-        result = self._run_test_with_timeout(test_input, test_timeout_sec)
-
-        elapsed_time = time.time() - start
-        self._caller.post('finished_test', result, elapsed_time)
-
-        self._clean_up_after_test(test_input, result)
-
-    def stop(self):
-        _log.debug("%s cleaning up" % self._name)
-        self._kill_driver()
-        if self._tests_run_file:
-            self._tests_run_file.close()
-            self._tests_run_file = None
-
-    def _timeout(self, test_input):
-        """Compute the appropriate timeout value for a test."""
-        # The DumpRenderTree watchdog uses 2.5x the timeout; we want to be
-        # larger than that. We also add a little more padding if we're
-        # running tests in a separate thread.
-        #
-        # Note that we need to convert the test timeout from a
-        # string value in milliseconds to a float for Python.
-        driver_timeout_sec = 3.0 * float(test_input.timeout) / 1000.0
-        if not self._options.run_singly:
-            return driver_timeout_sec
-
-        thread_padding_sec = 1.0
-        thread_timeout_sec = driver_timeout_sec + thread_padding_sec
-        return thread_timeout_sec
-
-    def _kill_driver(self):
-        # Be careful about how and when we kill the driver; if driver.stop()
-        # raises an exception, this routine may get re-entered via __del__.
-        driver = self._driver
-        self._driver = None
-        if driver:
-            _log.debug("%s killing driver" % self._name)
-            driver.stop()
-
-    def _run_test_with_timeout(self, test_input, timeout):
-        if self._options.run_singly:
-            return self._run_test_in_another_thread(test_input, timeout)
-        return self._run_test_in_this_thread(test_input)
-
-    def _clean_up_after_test(self, test_input, result):
-        self._batch_count += 1
-        test_name = test_input.test_name
-        self._tests_run_file.write(test_name + "\n")
-
-        if result.failures:
-            # Check and kill DumpRenderTree if we need to.
-            if any([f.driver_needs_restart() for f in result.failures]):
-                self._kill_driver()
-                # Reset the batch count since the shell just bounced.
-                self._batch_count = 0
-
-            # Print the error message(s).
-            _log.debug("%s %s failed:" % (self._name, test_name))
-            for f in result.failures:
-                _log.debug("%s  %s" % (self._name, f.message()))
-        elif result.type == test_expectations.SKIP:
-            _log.debug("%s %s skipped" % (self._name, test_name))
-        else:
-            _log.debug("%s %s passed" % (self._name, test_name))
-
-        if self._batch_size > 0 and self._batch_count >= self._batch_size:
-            self._kill_driver()
-            self._batch_count = 0
-
-    def _run_test_in_another_thread(self, test_input, thread_timeout_sec):
-        """Run a test in a separate thread, enforcing a hard time limit.
-
-        Since we can only detect the termination of a thread, not any internal
-        state or progress, we can only run per-test timeouts when running test
-        files singly.
-
-        Args:
-          test_input: Object containing the test filename and timeout
-          thread_timeout_sec: time to wait before killing the driver process.
-        Returns:
-          A TestResult
-        """
-        worker = self
-
-        driver = self._port.create_driver(self._worker_number)
-
-        class SingleTestThread(threading.Thread):
-            def __init__(self):
-                threading.Thread.__init__(self)
-                self.result = None
-
-            def run(self):
-                self.result = worker._run_single_test(driver, test_input)
-
-        thread = SingleTestThread()
-        thread.start()
-        thread.join(thread_timeout_sec)
-        result = thread.result
-        if thread.isAlive():
-            # If join() returned with the thread still running, the
-            # DumpRenderTree is completely hung and there's nothing
-            # more we can do with it.  We have to kill all the
-            # DumpRenderTrees to free it up. If we're running more than
-            # one DumpRenderTree thread, we'll end up killing the other
-            # DumpRenderTrees too, introducing spurious crashes. We accept
-            # that tradeoff in order to avoid losing the rest of this
-            # thread's results.
-            _log.error('Test thread hung: killing all DumpRenderTrees')
-
-        driver.stop()
-
-        if not result:
-            result = test_results.TestResult(test_input.test_name, failures=[], test_run_time=0)
-        return result
-
-    def _run_test_in_this_thread(self, test_input):
-        """Run a single test file using a shared DumpRenderTree process.
-
-        Args:
-          test_input: Object containing the test filename, uri and timeout
-
-        Returns: a TestResult object.
-        """
-        if self._driver and self._driver.has_crashed():
-            self._kill_driver()
-        if not self._driver:
-            self._driver = self._port.create_driver(self._worker_number)
-        return self._run_single_test(self._driver, test_input)
-
-    def _run_single_test(self, driver, test_input):
-        return single_test_runner.run_single_test(self._port, self._options,
-            test_input, driver, self._name)
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/result_summary.py b/Tools/Scripts/webkitpy/layout_tests/models/result_summary.py
index b0512127f..5bb501061 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/result_summary.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/result_summary.py
@@ -31,7 +31,7 @@ from webkitpy.layout_tests.models.test_expectations import TestExpectations, SKI
 
 
 class ResultSummary(object):
-    def __init__(self, expectations, test_files, iterations=1):
+    def __init__(self, expectations, test_files, iterations, expected_skips):
         self.total = len(test_files) * iterations
         self.remaining = self.total
         self.expectations = expectations
@@ -48,8 +48,8 @@ class ResultSummary(object):
         self.failures = {}
         self.total_failures = 0
         self.expected_skips = 0
-        self.total_tests_by_expectation[SKIP] = 0
-        self.tests_by_expectation[SKIP] = set()
+        self.total_tests_by_expectation[SKIP] = len(expected_skips)
+        self.tests_by_expectation[SKIP] = expected_skips
         for expectation in TestExpectations.EXPECTATIONS.values():
             self.tests_by_expectation[expectation] = set()
             self.total_tests_by_expectation[expectation] = 0
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
index 9c6d478d4..bab741839 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
@@ -96,23 +96,6 @@ def suffixes_for_expectations(expectations):
     return set(suffixes)
 
 
-# FIXME: This method is no longer used here in this module. Remove remaining callsite in manager.py and this method.
-def strip_comments(line):
-    """Strips comments from a line and return None if the line is empty
-    or else the contents of line with leading and trailing spaces removed
-    and all other whitespace collapsed"""
-
-    commentIndex = line.find('//')
-    if commentIndex is -1:
-        commentIndex = len(line)
-
-    line = re.sub(r'\s+', ' ', line[:commentIndex].strip())
-    if line == '':
-        return None
-    else:
-        return line
-
-
 class ParseError(Exception):
     def __init__(self, warnings):
         super(ParseError, self).__init__()
@@ -232,6 +215,10 @@ class TestExpectationParser(object):
         expectation_line = TestExpectationLine()
         expectation_line.original_string = test_name
         expectation_line.modifiers = [TestExpectationParser.DUMMY_BUG_MODIFIER, TestExpectationParser.SKIP_MODIFIER]
+        # FIXME: It's not clear what the expectations for a skipped test should be; the expectations
+        # might be different for different entries in a Skipped file, or from the command line, or from
+        # only running parts of the tests. It's also not clear if it matters much.
+        expectation_line.modifiers.append(TestExpectationParser.WONTFIX_MODIFIER)
         expectation_line.name = test_name
         # FIXME: we should pass in a more descriptive string here.
         expectation_line.filename = '<Skipped file>'
@@ -703,18 +690,16 @@ class TestExpectations(object):
                     'crash': CRASH,
                     'missing': MISSING}
 
-    EXPECTATION_DESCRIPTIONS = {SKIP: ('skipped', 'skipped'),
-                                PASS: ('pass', 'passes'),
-                                TEXT: ('text diff mismatch',
-                                       'text diff mismatch'),
-                                IMAGE: ('image mismatch', 'image mismatch'),
-                                IMAGE_PLUS_TEXT: ('image and text mismatch',
-                                                  'image and text mismatch'),
-                                AUDIO: ('audio mismatch', 'audio mismatch'),
-                                CRASH: ('crash', 'crashes'),
-                                TIMEOUT: ('test timed out', 'tests timed out'),
-                                MISSING: ('no expected result found',
-                                          'no expected results found')}
+    # (aggregated by category, pass/fail/skip, type)
+    EXPECTATION_DESCRIPTIONS = {SKIP: ('skipped', 'skipped', ''),
+                                PASS: ('passes', 'passed', ''),
+                                TEXT: ('text failures', 'failed', ' (text diff)'),
+                                IMAGE: ('image-only failures', 'failed', ' (image diff)'),
+                                IMAGE_PLUS_TEXT: ('both image and text failures', 'failed', ' (both image and text diffs'),
+                                AUDIO: ('audio failures', 'failed', ' (audio diff)'),
+                                CRASH: ('crashes', 'crashed', ''),
+                                TIMEOUT: ('timeouts', 'timed out', ''),
+                                MISSING: ('no expected results found', 'no expected result found', '')}
 
     EXPECTATION_ORDER = (PASS, CRASH, TIMEOUT, MISSING, IMAGE_PLUS_TEXT, TEXT, IMAGE, AUDIO, SKIP)
 
@@ -759,7 +744,7 @@ class TestExpectations(object):
                 self._expectations += expectations
 
         # FIXME: move ignore_tests into port.skipped_layout_tests()
-        self._add_skipped_tests(port.skipped_layout_tests(tests).union(set(port.get_option('ignore_tests', []))))
+        self.add_skipped_tests(port.skipped_layout_tests(tests).union(set(port.get_option('ignore_tests', []))))
 
         self._has_warnings = False
         self._report_warnings()
@@ -867,10 +852,13 @@ class TestExpectations(object):
 
         return TestExpectationSerializer.list_to_string(self._expectations, self._parser._test_configuration_converter, modified_expectations)
 
-    def remove_rebaselined_tests(self, except_these_tests):
-        """Returns a copy of the expectations with the tests removed."""
+    def remove_rebaselined_tests(self, except_these_tests, filename):
+        """Returns a copy of the expectations in the file with the tests removed."""
         def without_rebaseline_modifier(expectation):
-            return not (not expectation.is_invalid() and expectation.name in except_these_tests and "rebaseline" in expectation.modifiers)
+            return not (not expectation.is_invalid() and
+                        expectation.name in except_these_tests and
+                        "rebaseline" in expectation.modifiers and
+                        filename == expectation.filename)
 
         return TestExpectationSerializer.list_to_string(filter(without_rebaseline_modifier, self._expectations))
 
@@ -882,7 +870,7 @@ class TestExpectations(object):
             if self._is_lint_mode or self._test_config in expectation_line.matching_configurations:
                 self._model.add_expectation_line(expectation_line)
 
-    def _add_skipped_tests(self, tests_to_skip):
+    def add_skipped_tests(self, tests_to_skip):
         if not tests_to_skip:
             return
         for test in self._expectations:
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
index c780dac23..b65151d72 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
@@ -284,7 +284,7 @@ class SkippedTests(Base):
 
         # Check that the expectation is for BUG_DUMMY SKIP : ... = PASS
         self.assertEquals(exp.get_modifiers('failures/expected/text.html'),
-                          [TestExpectationParser.DUMMY_BUG_MODIFIER, TestExpectationParser.SKIP_MODIFIER])
+                          [TestExpectationParser.DUMMY_BUG_MODIFIER, TestExpectationParser.SKIP_MODIFIER, TestExpectationParser.WONTFIX_MODIFIER])
         self.assertEquals(exp.get_expectations('failures/expected/text.html'), set([PASS]))
 
     def test_skipped_tests_work(self):
@@ -456,9 +456,9 @@ BUGY WIN DEBUG : failures/expected/foo.html = CRASH
 
 class RebaseliningTest(Base):
     """Test rebaselining-specific functionality."""
-    def assertRemove(self, input_expectations, tests, expected_expectations):
+    def assertRemove(self, input_expectations, tests, expected_expectations, filename):
         self.parse_exp(input_expectations, is_lint_mode=False)
-        actual_expectations = self._exp.remove_rebaselined_tests(tests)
+        actual_expectations = self._exp.remove_rebaselined_tests(tests, filename)
         self.assertEqual(expected_expectations, actual_expectations)
 
     def test_remove(self):
@@ -467,7 +467,19 @@ class RebaseliningTest(Base):
                           'BUGZ REBASELINE : failures/expected/crash.html = CRASH\n',
                           ['failures/expected/text.html'],
                           'BUGY : failures/expected/image.html = IMAGE\n'
-                          'BUGZ REBASELINE : failures/expected/crash.html = CRASH\n')
+                          'BUGZ REBASELINE : failures/expected/crash.html = CRASH\n',
+                          'expectations')
+
+        # test that we don't remove lines from the expectations if we're asking for the overrides
+        self.assertRemove('BUGX REBASELINE : failures/expected/text.html = TEXT\n'
+                          'BUGY : failures/expected/image.html = IMAGE\n'
+                          'BUGZ REBASELINE : failures/expected/crash.html = CRASH\n',
+                          ['failures/expected/text.html'],
+                          'BUGX REBASELINE : failures/expected/text.html = TEXT\n'
+                          'BUGY : failures/expected/image.html = IMAGE\n'
+                          'BUGZ REBASELINE : failures/expected/crash.html = CRASH\n',
+                          'overrides')
+
 
     def test_no_get_rebaselining_failures(self):
         self.parse_exp(self.get_basic_expectations())
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/test_input.py b/Tools/Scripts/webkitpy/layout_tests/models/test_input.py
index 5a016f621..56f2d52bd 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/test_input.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/test_input.py
@@ -32,21 +32,15 @@
 class TestInput(object):
     """Groups information about a test for easy passing of data."""
 
-    def __init__(self, test_name, timeout):
-        """Holds the input parameters for a test.
-        Args:
-          test: name of test (not an absolute path!)
-          timeout: Timeout in msecs the driver should use while running the test
-          """
-        self.test_name = test_name
-        self.timeout = timeout
-
+    def __init__(self, test_name, timeout=None, requires_lock=None, reference_files=None, should_run_pixel_tests=None):
         # TestInput objects are normally constructed by the manager and passed
-        # to the workers, but these two fields are set lazily in the workers
-        # because they require us to figure out if the test is a reftest or not
-        # and we want to be able to do that in parallel.
-        self.should_run_pixel_tests = None
-        self.reference_files = None
+        # to the workers, but these some fields are set lazily in the workers where possible
+        # because they require us to look at the filesystem and we want to be able to do that in parallel.
+        self.test_name = test_name
+        self.timeout = timeout  # in msecs; should rename this for consistency
+        self.requires_lock = requires_lock
+        self.reference_files = reference_files
+        self.should_run_pixel_tests = should_run_pixel_tests
 
     def __repr__(self):
-        return "TestInput('%s', %d, %s, %s)" % (self.test_name, self.timeout, self.should_run_pixel_tests, self.reference_files)
+        return "TestInput('%s', timeout=%s, requires_lock=%s, reference_files=%s, should_run_pixel_tests=%s)" % (self.test_name, self.timeout, self.requires_lock, self.reference_files, self.should_run_pixel_tests)
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/base.py b/Tools/Scripts/webkitpy/layout_tests/port/base.py
index ad70f042d..cf7104c28 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/base.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/base.py
@@ -142,12 +142,20 @@ class Port(object):
         self._test_configuration = None
         self._reftest_list = {}
         self._results_directory = None
+        self._root_was_set = hasattr(options, 'root') and options.root
+
+    def additional_drt_flag(self):
+        return []
 
     def default_pixel_tests(self):
         # FIXME: Disable until they are run by default on build.webkit.org.
         return False
 
     def default_timeout_ms(self):
+        if self.get_option('webkit_test_runner'):
+            # Add some more time to WebKitTestRunner because it needs to syncronise the state
+            # with the web process and we want to detect if there is a problem with that in the driver.
+            return 50 * 1000
         return 35 * 1000
 
     def wdiff_available(self):
@@ -207,7 +215,7 @@ class Port(object):
         """This routine is used to ensure that the build is up to date
         and all the needed binaries are present."""
         # If we're using a pre-built copy of WebKit (--root), we assume it also includes a build of DRT.
-        if not self.get_option('root') and self.get_option('build') and not self._build_driver():
+        if not self._root_was_set and self.get_option('build') and not self._build_driver():
             return False
         if not self._check_driver():
             return False
@@ -311,7 +319,7 @@ class Port(object):
         return expected_audio != actual_audio
 
     def diff_image(self, expected_contents, actual_contents, tolerance=None):
-        """Compare two images and return a tuple of an image diff, and a percentage difference (0-100).
+        """Compare two images and return a tuple of an image diff, a percentage difference (0-100), and an error string.
 
         |tolerance| should be a percentage value (0.0 - 100.0).
         If it is omitted, the port default tolerance value is used.
@@ -319,13 +327,14 @@ class Port(object):
         If an error occurs (like ImageDiff isn't found, or crashes, we log an error and return True (for a diff).
         """
         if not actual_contents and not expected_contents:
-            return (None, 0)
+            return (None, 0, None)
         if not actual_contents or not expected_contents:
-            return (True, 0)
+            return (True, 0, None)
         if not self._image_differ:
             self._image_differ = image_diff.ImageDiffer(self)
         self.set_option_default('tolerance', 0.1)
-        tolerance = tolerance or self.get_option('tolerance')
+        if tolerance is None:
+            tolerance = self.get_option('tolerance')
         return self._image_differ.diff_image(expected_contents, actual_contents, tolerance)
 
     def diff_text(self, expected_text, actual_text, expected_filename, actual_filename):
@@ -559,7 +568,7 @@ class Port(object):
             expanded_paths.append(path)
             if self.test_isdir(path) and not path.startswith('platform'):
                 for platform_dir in all_platform_dirs:
-                    if fs.isdir(fs.join(platform_dir, path)):
+                    if fs.isdir(fs.join(platform_dir, path)) and platform_dir in self.baseline_search_path():
                         expanded_paths.append(self.relative_test_filename(fs.join(platform_dir, path)))
 
         return expanded_paths
@@ -787,6 +796,9 @@ class Port(object):
             self._results_directory = self._filesystem.abspath(option_val)
         return self._results_directory
 
+    def perf_results_directory(self):
+        return self._build_path()
+
     def default_results_directory(self):
         """Absolute path to the default place to store the test results."""
         # Results are store relative to the built products to make it easy
@@ -1151,11 +1163,13 @@ class Port(object):
         if not root_directory:
             build_directory = self.get_option('build_directory')
             if build_directory:
-                root_directory = self._filesystem.join(self.get_option('configuration'))
+                root_directory = self._filesystem.join(build_directory, self.get_option('configuration'))
             else:
                 root_directory = self._config.build_directory(self.get_option('configuration'))
             # Set --root so that we can pass this to subprocesses and avoid making the
             # slow call to config.build_directory() N times in each worker.
+            # FIXME: This is like @memoized, but more annoying and fragile; there should be another
+            # way to propagate values without mutating the options list.
             self.set_option_default('root', root_directory)
         return self._filesystem.join(self._filesystem.abspath(root_directory), *comps)
 
@@ -1277,21 +1291,9 @@ class Port(object):
                 return suite.args
         return []
 
-    def supports_switching_pixel_tests_per_test(self):
-        if self.get_option('webkit_test_runner'):
-            return True
-        return self._supports_switching_pixel_tests_per_test()
-
-    def _supports_switching_pixel_tests_per_test(self):
-        # FIXME: all ports should support it.
-        return False
-
     def should_run_as_pixel_test(self, test_input):
         if not self._options.pixel_tests:
             return False
-        if not self.supports_switching_pixel_tests_per_test():
-            # Cannot do more filtering without this.
-            return True
         if self._options.pixel_test_directories:
             return any(test_input.test_name.startswith(directory) for directory in self._options.pixel_test_directories)
         return self._should_run_as_pixel_test(test_input)
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py
index 019873567..c68e441aa 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py
@@ -437,6 +437,10 @@ class PortTest(unittest.TestCase):
         self.assertFalse('passes/text.html' in tests)
         self.assertTrue('virtual/passes/text.html' in tests)
 
+    def test_build_path(self):
+        port = self.make_port(options=optparse.Values({'build_directory': '/my-build-directory/'}))
+        self.assertEqual(port._build_path(), '/my-build-directory/Release')
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
index b72783c5d..38ce4b198 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
@@ -190,18 +190,16 @@ class ChromiumPort(Port):
                                        override_step, logging)
 
     def diff_image(self, expected_contents, actual_contents, tolerance=None):
-        # FIXME: need unit tests for this.
-
         # tolerance is not used in chromium. Make sure caller doesn't pass tolerance other than zero or None.
         assert (tolerance is None) or tolerance == 0
 
         # If only one of them exists, return that one.
         if not actual_contents and not expected_contents:
-            return (None, 0)
+            return (None, 0, None)
         if not actual_contents:
-            return (expected_contents, 0)
+            return (expected_contents, 0, None)
         if not expected_contents:
-            return (actual_contents, 0)
+            return (actual_contents, 0, None)
 
         tempdir = self._filesystem.mkdtemp()
 
@@ -221,28 +219,22 @@ class ChromiumPort(Port):
         comand = [executable, '--diff', native_actual_filename, native_expected_filename, native_diff_filename]
 
         result = None
+        err_str = None
         try:
             exit_code = self._executive.run_command(comand, return_exit_code=True)
             if exit_code == 0:
                 # The images are the same.
                 result = None
-            elif exit_code != 1:
-                _log.error("image diff returned an exit code of %s" % exit_code)
-                # Returning None here causes the script to think that we
-                # successfully created the diff even though we didn't.
-                # FIXME: Consider raising an exception here, so that the error
-                # is not accidentally overlooked while the test passes.
-                result = None
-        except OSError, e:
-            if e.errno == errno.ENOENT or e.errno == errno.EACCES:
-                _compare_available = False
+            elif exit_code == 1:
+                result = self._filesystem.read_binary_file(native_diff_filename)
             else:
-                raise
+                err_str = "image diff returned an exit code of %s" % exit_code
+        except OSError, e:
+            err_str = 'error running image diff: %s' % str(e)
         finally:
-            if exit_code == 1:
-                result = self._filesystem.read_binary_file(native_diff_filename)
             self._filesystem.rmtree(str(tempdir))
-        return (result, 0)  # FIXME: how to get % diff?
+
+        return (result, 0, err_str or None)  # FIXME: how to get % diff?
 
     def path_from_chromium_base(self, *comps):
         """Returns the full path to path made by joining the top of the
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py
index fa85f10d5..7106a20f5 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py
@@ -27,9 +27,10 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+import copy
 import logging
 import os
-import shlex
+import re
 import threading
 import time
 
@@ -44,25 +45,22 @@ _log = logging.getLogger(__name__)
 
 # The root directory for test resources, which has the same structure as the
 # source root directory of Chromium.
-# This path is defined in base/base_paths_android.cc and
-# webkit/support/platform_support_android.cc.
+# This path is defined in Chromium's base/test/test_support_android.cc.
 DEVICE_SOURCE_ROOT_DIR = '/data/local/tmp/'
 COMMAND_LINE_FILE = DEVICE_SOURCE_ROOT_DIR + 'chrome-native-tests-command-line'
 
 # The directory to put tools and resources of DumpRenderTree.
-DEVICE_DRT_DIR = '/data/drt/'
+# If change this, must also change Tools/DumpRenderTree/chromium/TestShellAndroid.cpp
+# and Chromium's webkit/support/platform_support_android.cc.
+DEVICE_DRT_DIR = DEVICE_SOURCE_ROOT_DIR + 'drt/'
 DEVICE_FORWARDER_PATH = DEVICE_DRT_DIR + 'forwarder'
 DEVICE_DRT_STAMP_PATH = DEVICE_DRT_DIR + 'DumpRenderTree.stamp'
 
 DRT_APP_PACKAGE = 'org.chromium.native_test'
 DRT_ACTIVITY_FULL_NAME = DRT_APP_PACKAGE + '/.ChromeNativeTestActivity'
-DRT_APP_DIR = '/data/user/0/' + DRT_APP_PACKAGE + '/'
-DRT_APP_FILES_DIR = DEVICE_SOURCE_ROOT_DIR
-DRT_APP_CACHE_DIR = DRT_APP_DIR + 'cache/'
+DRT_APP_CACHE_DIR = DEVICE_DRT_DIR + 'cache/'
 
-# This only works for single core devices so far.
-# FIXME: Find a solution for multi-core devices.
-SCALING_GOVERNOR = "/sys/devices/system/cpu/cpu0/cpufreq/scaling_governor"
+SCALING_GOVERNORS_PATTERN = "/sys/devices/system/cpu/cpu*/cpufreq/scaling_governor"
 
 # All the test cases are still served to DumpRenderTree through file protocol,
 # but we use a file-to-http feature to bridge the file request to host's http
@@ -155,27 +153,19 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
     def __init__(self, host, port_name, **kwargs):
         super(ChromiumAndroidPort, self).__init__(host, port_name, **kwargs)
 
-        if not hasattr(self._options, 'additional_drt_flag'):
-            self._options.additional_drt_flag = []
-        self._options.additional_drt_flag.append('--encode-binary')
-
-        # The Chromium port for Android always uses the hardware GPU path.
-        self._options.additional_drt_flag.append('--enable-hardware-gpu')
-
-        # Shard ref tests so that they run together to avoid repeatedly driver restarts.
-        self._options.shard_ref_tests = True
-
         self._operating_system = 'android'
         self._version = 'icecreamsandwich'
-        self._original_governor = None
-        self._android_base_dir = None
 
         self._host_port = factory.PortFactory(host).get('chromium', **kwargs)
 
-        self._adb_command = ['adb']
-        adb_args = self.get_option('adb_args')
-        if adb_args:
-            self._adb_command += shlex.split(adb_args)
+        if hasattr(self._options, 'adb_device'):
+            self._devices = self._options.adb_device
+        else:
+            self._devices = []
+
+    def additional_drt_flag(self):
+        # The Chromium port for Android always uses the hardware GPU path.
+        return ['--encode-binary', '--enable-hardware-gpu']
 
     def default_timeout_ms(self):
         # Android platform has less computing power than desktop platforms.
@@ -184,8 +174,7 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
         return 10 * 1000
 
     def default_child_processes(self):
-        # Because of the nature of apk, we don't support more than one process.
-        return 1
+        return len(self._get_devices())
 
     def baseline_search_path(self):
         return map(self._webkit_baseline_path, self.FALLBACK_PATHS)
@@ -217,15 +206,6 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
         android_expectations_file = self.path_from_webkit_base('LayoutTests', 'platform', 'chromium', 'test_expectations_android.txt')
         return super(ChromiumAndroidPort, self).expectations_files() + [android_expectations_file]
 
-    def test_expectations(self):
-        # Automatically apply all expectation rules of chromium-linux to
-        # chromium-android.
-        # FIXME: This is a temporary measure to reduce the manual work when
-        # updating WebKit. This method should be removed when we merge
-        # test_expectations_android.txt into TestExpectations.
-        expectations = super(ChromiumAndroidPort, self).test_expectations()
-        return expectations.replace('LINUX ', 'LINUX ANDROID ')
-
     def start_http_server(self, additional_dirs=None, number_of_servers=0):
         # The http server runs during the whole testing period, so ignore this call.
         pass
@@ -235,39 +215,48 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
         pass
 
     def setup_test_run(self):
-        self._run_adb_command(['root'])
-        self._setup_performance()
-        # Required by webkit_support::GetWebKitRootDirFilePath().
-        # Other directories will be created automatically by adb push.
-        self._run_adb_command(['shell', 'mkdir', '-p', DEVICE_SOURCE_ROOT_DIR + 'chrome'])
-        # Allow the DumpRenderTree app to fully access the directory.
-        # The native code needs the permission to write temporary files here.
-        self._run_adb_command(['shell', 'chmod', '777', DEVICE_SOURCE_ROOT_DIR])
-
-        self._push_executable()
-        self._push_fonts()
-        self._synchronize_datetime()
-
-        # Delete the disk cache if any to ensure a clean test run.
-        # This is like what's done in ChromiumPort.setup_test_run but on the device.
-        self._run_adb_command(['shell', 'rm', '-r', DRT_APP_CACHE_DIR])
-
         # Start the HTTP server so that the device can access the test cases.
         super(ChromiumAndroidPort, self).start_http_server(additional_dirs={TEST_PATH_PREFIX: self.layout_tests_dir()})
 
-        _log.debug('Starting forwarder')
-        self._run_adb_command(['shell', '%s %s' % (DEVICE_FORWARDER_PATH, FORWARD_PORTS)])
-
     def clean_up_test_run(self):
-        # Leave the forwarder and tests httpd server there because they are
-        # useful for debugging and do no harm to subsequent tests.
-        self._teardown_performance()
+        super(ChromiumAndroidPort, self).stop_http_server()
 
     def skipped_layout_tests(self, test_list):
+        # This method is more convenient to skip whole directories than SKIP in TestExpectations
+        # because its higher priority.
+        # Still use TestExpectations to skip individual tests.
         return self._real_tests([
-            # Canvas tests are run as virtual gpu tests.
-            'fast/canvas',
+            # Only run these tests as virtual gpu tests.
             'canvas/philip',
+            'fast/canvas',
+
+            # Skip tests of other platforms to save time.
+            'platform/gtk',
+            'platform/mac',
+            'platform/mac-wk2',
+            'platform/qt',
+            'platform/win',
+
+            # Features not supported.
+            'compositing/plugins',
+            'plugins',
+            'http/tests/plugins',
+            'platform/chromium/compositing/plugins',
+            'platform/chromium/plugins',
+
+            'http/tests/inspector',
+            'http/tests/inspector-enabled',
+            'inspector',
+            'platform/chromium/inspector',
+
+            'accessibility',
+            'platform/chromium/accessibility',
+
+            'fast/dom/MediaStream',
+            'fast/mediastream',
+            'fast/notifications',
+            'fast/speech',
+            'webaudio',
         ])
 
     def create_driver(self, worker_number, no_timeout=False):
@@ -275,6 +264,10 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
         # See comments in ChromiumAndroidDriver.start().
         return ChromiumAndroidDriver(self, worker_number, pixel_tests=self.get_option('pixel_tests'), no_timeout=no_timeout)
 
+    def driver_cmd_line(self):
+        # Override to return the actual DumpRenderTree command line.
+        return self.create_driver(0)._drt_cmd_line(self.get_option('pixel_tests'), [])
+
     # Overridden private functions.
 
     def _build_path(self, *comps):
@@ -319,35 +312,84 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
     def _driver_class(self):
         return ChromiumAndroidDriver
 
-    def _get_crash_log(self, name, pid, stdout, stderr, newer_than):
-        if not stdout:
-            stdout = ''
-        stdout += '********* Logcat:\n' + self._get_logcat()
-        if not stderr:
-            stderr = ''
-        stderr += '********* Tombstone file:\n' + self._get_last_stacktrace()
-        return super(ChromiumAndroidPort, self)._get_crash_log(name, pid, stdout, stderr, newer_than)
-
     # Local private functions.
 
+    def _get_devices(self):
+        if not self._devices:
+            re_device = re.compile('^([a-zA-Z0-9_:.-]+)\tdevice$', re.MULTILINE)
+            result = self._executive.run_command(['adb', 'devices'], error_handler=self._executive.ignore_error)
+            self._devices = re_device.findall(result)
+            if not self._devices:
+                raise AssertionError('No devices attached. Result of "adb devices": %s' % result)
+        return self._devices
+
+    def _get_device_serial(self, worker_number):
+        devices = self._get_devices()
+        if worker_number >= len(devices):
+            raise AssertionError('Worker number exceeds available number of devices')
+        return devices[worker_number]
+
+
+class ChromiumAndroidDriver(driver.Driver):
+    def __init__(self, port, worker_number, pixel_tests, no_timeout=False):
+        super(ChromiumAndroidDriver, self).__init__(port, worker_number, pixel_tests, no_timeout)
+        self._cmd_line = None
+        self._in_fifo_path = DEVICE_DRT_DIR + 'DumpRenderTree.in'
+        self._out_fifo_path = DEVICE_DRT_DIR + 'DumpRenderTree.out'
+        self._err_fifo_path = DEVICE_DRT_DIR + 'DumpRenderTree.err'
+        self._read_stdout_process = None
+        self._read_stderr_process = None
+        self._forwarder_process = None
+        self._has_setup = False
+        self._original_governors = {}
+        self._adb_command = ['adb', '-s', port._get_device_serial(worker_number)]
+
+    def __del__(self):
+        self._teardown_performance()
+        super(ChromiumAndroidDriver, self).__del__()
+
+    def _setup_test(self):
+        if self._has_setup:
+            return
+
+        self._has_setup = True
+        self._run_adb_command(['root'])
+        self._setup_performance()
+        # Required by webkit_support::GetWebKitRootDirFilePath().
+        # Other directories will be created automatically by adb push.
+        self._run_adb_command(['shell', 'mkdir', '-p', DEVICE_SOURCE_ROOT_DIR + 'chrome'])
+
+        # Allow the DumpRenderTree app to fully access the directory.
+        # The native code needs the permission to write temporary files and create pipes here.
+        self._run_adb_command(['shell', 'mkdir', '-p', DEVICE_DRT_DIR])
+        self._run_adb_command(['shell', 'chmod', '777', DEVICE_DRT_DIR])
+
+        self._push_executable()
+        self._push_fonts()
+        self._synchronize_datetime()
+
+        # Delete the disk cache if any to ensure a clean test run.
+        # This is like what's done in ChromiumPort.setup_test_run but on the device.
+        self._run_adb_command(['shell', 'rm', '-r', DRT_APP_CACHE_DIR])
+
     def _push_executable(self):
-        drt_host_path = self._path_to_driver()
-        forwarder_host_path = self._path_to_forwarder()
+        drt_host_path = self._port._path_to_driver()
+        forwarder_host_path = self._port._path_to_forwarder()
         host_stamp = int(float(max(os.stat(drt_host_path).st_mtime,
                                    os.stat(forwarder_host_path).st_mtime)))
         device_stamp = int(float(self._run_adb_command([
             'shell', 'cat %s 2>/dev/null || echo 0' % DEVICE_DRT_STAMP_PATH])))
-        if device_stamp < host_stamp:
+        if device_stamp != host_stamp:
             _log.debug('Pushing executable')
             self._push_to_device(forwarder_host_path, DEVICE_FORWARDER_PATH)
             self._run_adb_command(['uninstall', DRT_APP_PACKAGE])
             install_result = self._run_adb_command(['install', drt_host_path])
             if install_result.find('Success') == -1:
                 raise AssertionError('Failed to install %s onto device: %s' % (drt_host_path, install_result))
-            self._push_to_device(self._build_path('DumpRenderTree.pak'), DEVICE_DRT_DIR + 'DumpRenderTree.pak')
-            self._push_to_device(self._build_path('DumpRenderTree_resources'), DEVICE_DRT_DIR + 'DumpRenderTree_resources')
-            self._push_to_device(self._build_path('android_main_fonts.xml'), DEVICE_DRT_DIR + 'android_main_fonts.xml')
-            self._push_to_device(self._build_path('android_fallback_fonts.xml'), DEVICE_DRT_DIR + 'android_fallback_fonts.xml')
+            self._push_to_device(self._port._build_path('DumpRenderTree.pak'), DEVICE_DRT_DIR + 'DumpRenderTree.pak')
+            self._push_to_device(self._port._build_path('DumpRenderTree_resources'), DEVICE_DRT_DIR + 'DumpRenderTree_resources')
+            self._push_to_device(self._port._build_path('android_main_fonts.xml'), DEVICE_DRT_DIR + 'android_main_fonts.xml')
+            self._push_to_device(self._port._build_path('android_fallback_fonts.xml'), DEVICE_DRT_DIR + 'android_fallback_fonts.xml')
             # Version control of test resources is dependent on executables,
             # because we will always rebuild executables when resources are
             # updated.
@@ -357,7 +399,7 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
     def _push_fonts(self):
         if not self._check_version(DEVICE_FONTS_DIR, FONT_FILES_VERSION):
             _log.debug('Pushing fonts')
-            path_to_ahem_font = self._build_path('AHEM____.TTF')
+            path_to_ahem_font = self._port._build_path('AHEM____.TTF')
             self._push_to_device(path_to_ahem_font, DEVICE_FONTS_DIR + 'AHEM____.TTF')
             for (host_dir, font_file) in HOST_FONT_FILES:
                 self._push_to_device(host_dir + font_file, DEVICE_FONTS_DIR + font_file)
@@ -367,14 +409,14 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
     def _push_test_resources(self):
         _log.debug('Pushing test resources')
         for resource in TEST_RESOURCES_TO_PUSH:
-            self._push_to_device(self.layout_tests_dir() + '/' + resource, DEVICE_LAYOUT_TESTS_DIR + resource)
+            self._push_to_device(self._port.layout_tests_dir() + '/' + resource, DEVICE_LAYOUT_TESTS_DIR + resource)
 
     def _synchronize_datetime(self):
         # The date/time between host and device may not be synchronized.
         # We need to make them synchronized, otherwise tests might fail.
         try:
             # Get seconds since 1970-01-01 00:00:00 UTC.
-            host_datetime = self._executive.run_command(['date', '-u', '+%s'])
+            host_datetime = self._port._executive.run_command(['date', '-u', '+%s'])
         except:
             # Reset to 1970-01-01 00:00:00 UTC.
             host_datetime = 0
@@ -394,10 +436,10 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
     def _run_adb_command(self, cmd, ignore_error=False):
         _log.debug('Run adb command: ' + str(cmd))
         if ignore_error:
-            error_handler = self._executive.ignore_error
+            error_handler = self._port._executive.ignore_error
         else:
             error_handler = None
-        result = self._executive.run_command(self._adb_command + cmd, error_handler=error_handler)
+        result = self._port._executive.run_command(self._adb_command + cmd, error_handler=error_handler)
         # Limit the length to avoid too verbose output of commands like 'adb logcat' and 'cat /data/tombstones/tombstone01'
         # whose outputs are normally printed in later logs.
         _log.debug('Run adb result: ' + result[:80])
@@ -443,37 +485,39 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
 
     def _setup_performance(self):
         # Disable CPU scaling and drop ram cache to reduce noise in tests
-        if not self._original_governor:
-            self._original_governor = self._run_adb_command(['shell', 'cat', SCALING_GOVERNOR], ignore_error=True)
-            if self._original_governor:
-                self._run_adb_command(['shell', 'echo', 'performance', '>', SCALING_GOVERNOR])
+        if not self._original_governors:
+            governor_files = self._run_adb_command(['shell', 'ls', SCALING_GOVERNORS_PATTERN])
+            if governor_files.find('No such file or directory') == -1:
+                for file in governor_files.split():
+                    self._original_governors[file] = self._run_adb_command(['shell', 'cat', file]).strip()
+                    self._run_adb_command(['shell', 'echo', 'performance', '>', file])
 
     def _teardown_performance(self):
-        if self._original_governor:
-            self._run_adb_command(['shell', 'echo', self._original_governor, SCALING_GOVERNOR])
-        self._original_governor = None
-
-
-class ChromiumAndroidDriver(driver.Driver):
-    def __init__(self, port, worker_number, pixel_tests, no_timeout=False):
-        super(ChromiumAndroidDriver, self).__init__(port, worker_number, pixel_tests, no_timeout)
-        self._pixel_tests = pixel_tests
-        self._in_fifo_path = DRT_APP_FILES_DIR + 'DumpRenderTree.in'
-        self._out_fifo_path = DRT_APP_FILES_DIR + 'DumpRenderTree.out'
-        self._err_fifo_path = DRT_APP_FILES_DIR + 'DumpRenderTree.err'
-        self._read_stdout_process = None
-        self._read_stderr_process = None
+        for file, original_content in self._original_governors.items():
+            self._run_adb_command(['shell', 'echo', original_content, '>', file])
+        self._original_governors = {}
 
     def _command_wrapper(cls, wrapper_option):
         # Ignore command wrapper which is not applicable on Android.
         return []
 
+    def _get_crash_log(self, stdout, stderr, newer_than):
+        if not stdout:
+            stdout = ''
+        stdout += '********* Logcat:\n' + self._get_logcat()
+        if not stderr:
+            stderr = ''
+        stderr += '********* Tombstone file:\n' + self._get_last_stacktrace()
+        return super(ChromiumAndroidDriver, self)._get_crash_log(stdout, stderr, newer_than)
+
     def cmd_line(self, pixel_tests, per_test_args):
-        return self._port._adb_command + ['shell']
+        # The returned command line is used to start _server_process. In our case, it's an interactive 'adb shell'.
+        # The command line passed to the DRT process is returned by _drt_cmd_line() instead.
+        return self._adb_command + ['shell']
 
     def _file_exists_on_device(self, full_file_path):
         assert full_file_path.startswith('/')
-        return self._port._run_adb_command(['shell', 'ls', full_file_path]).strip() == full_file_path
+        return self._run_adb_command(['shell', 'ls', full_file_path]).strip() == full_file_path
 
     def _drt_cmd_line(self, pixel_tests, per_test_args):
         return driver.Driver.cmd_line(self, pixel_tests, per_test_args) + [
@@ -496,24 +540,35 @@ class ChromiumAndroidDriver(driver.Driver):
                 self._file_exists_on_device(self._err_fifo_path))
 
     def _remove_all_pipes(self):
-        self._port._run_adb_command(['shell', 'rm', self._in_fifo_path, self._out_fifo_path, self._err_fifo_path])
+        self._run_adb_command(['shell', 'rm', self._in_fifo_path, self._out_fifo_path, self._err_fifo_path])
         return (not self._file_exists_on_device(self._in_fifo_path) and
                 not self._file_exists_on_device(self._out_fifo_path) and
                 not self._file_exists_on_device(self._err_fifo_path))
 
+    def run_test(self, driver_input):
+        base = self._port.lookup_virtual_test_base(driver_input.test_name)
+        if base:
+            driver_input = copy.copy(driver_input)
+            driver_input.args = self._port.lookup_virtual_test_args(driver_input.test_name)
+            driver_input.test_name = base
+        return super(ChromiumAndroidDriver, self).run_test(driver_input)
+
     def start(self, pixel_tests, per_test_args):
         # Only one driver instance is allowed because of the nature of Android activity.
-        # The single driver needs to switch between pixel test and no pixel test mode by itself.
-        if pixel_tests != self._pixel_tests:
+        # The single driver needs to restart DumpRenderTree when the command line changes.
+        cmd_line = self._drt_cmd_line(pixel_tests, per_test_args)
+        if cmd_line != self._cmd_line:
             self.stop()
-            self._pixel_tests = pixel_tests
+            self._cmd_line = cmd_line
         super(ChromiumAndroidDriver, self).start(pixel_tests, per_test_args)
 
     def _start(self, pixel_tests, per_test_args):
+        self._setup_test()
+
         for retries in range(3):
             if self._start_once(pixel_tests, per_test_args):
                 return
-            _log.error('Failed to start DumpRenderTree application. Retries=%d. Log:%s' % (retries, self._port._get_logcat()))
+            _log.error('Failed to start DumpRenderTree application. Retries=%d. Log:%s' % (retries, self._get_logcat()))
             self.stop()
             time.sleep(2)
         raise AssertionError('Failed to start DumpRenderTree application multiple times. Give up.')
@@ -521,9 +576,14 @@ class ChromiumAndroidDriver(driver.Driver):
     def _start_once(self, pixel_tests, per_test_args):
         super(ChromiumAndroidDriver, self)._start(pixel_tests, per_test_args)
 
-        self._port._run_adb_command(['logcat', '-c'])
-        self._port._run_adb_command(['shell', 'echo'] + self._drt_cmd_line(pixel_tests, per_test_args) + ['>', COMMAND_LINE_FILE])
-        start_result = self._port._run_adb_command(['shell', 'am', 'start', '-e', 'RunInSubThread', '-n', DRT_ACTIVITY_FULL_NAME])
+        _log.debug('Starting forwarder')
+        self._forwarder_process = server_process.ServerProcess(
+            self._port, 'Forwarder', self._adb_command + ['shell', '%s -D %s' % (DEVICE_FORWARDER_PATH, FORWARD_PORTS)])
+        self._forwarder_process.start()
+
+        self._run_adb_command(['logcat', '-c'])
+        self._run_adb_command(['shell', 'echo'] + self._cmd_line + ['>', COMMAND_LINE_FILE])
+        start_result = self._run_adb_command(['shell', 'am', 'start', '-e', 'RunInSubThread', '-n', DRT_ACTIVITY_FULL_NAME])
         if start_result.find('Exception') != -1:
             _log.error('Failed to start DumpRenderTree application. Exception:\n' + start_result)
             return False
@@ -540,13 +600,13 @@ class ChromiumAndroidDriver(driver.Driver):
         # Start a process to read from the stdout fifo of the DumpRenderTree app and print to stdout.
         _log.debug('Redirecting stdout to ' + self._out_fifo_path)
         self._read_stdout_process = server_process.ServerProcess(
-            self._port, 'ReadStdout', self._port._adb_command + ['shell', 'cat', self._out_fifo_path], universal_newlines=True)
+            self._port, 'ReadStdout', self._adb_command + ['shell', 'cat', self._out_fifo_path], universal_newlines=True)
         self._read_stdout_process.start()
 
         # Start a process to read from the stderr fifo of the DumpRenderTree app and print to stdout.
         _log.debug('Redirecting stderr to ' + self._err_fifo_path)
         self._read_stderr_process = server_process.ServerProcess(
-            self._port, 'ReadStderr', self._port._adb_command + ['shell', 'cat', self._err_fifo_path], universal_newlines=True)
+            self._port, 'ReadStderr', self._adb_command + ['shell', 'cat', self._err_fifo_path], universal_newlines=True)
         self._read_stderr_process.start()
 
         _log.debug('Redirecting stdin to ' + self._in_fifo_path)
@@ -587,7 +647,7 @@ class ChromiumAndroidDriver(driver.Driver):
             return True
 
     def stop(self):
-        self._port._run_adb_command(['shell', 'am', 'force-stop', DRT_APP_PACKAGE])
+        self._run_adb_command(['shell', 'am', 'force-stop', DRT_APP_PACKAGE])
 
         if self._read_stdout_process:
             self._read_stdout_process.kill()
@@ -604,6 +664,10 @@ class ChromiumAndroidDriver(driver.Driver):
             self._server_process = None
         super(ChromiumAndroidDriver, self).stop()
 
+        if self._forwarder_process:
+            self._forwarder_process.stop(kill_directly=True)
+            self._forwarder_process = None
+
         if not ChromiumAndroidDriver._loop_with_timeout(self._remove_all_pipes, DRT_START_STOP_TIMEOUT_SECS):
             raise AssertionError('Failed to remove fifo files. May be locked.')
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py
index 65b6a2d7b..c79546bb8 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py
@@ -39,12 +39,82 @@ from webkitpy.layout_tests.port import chromium_android
 from webkitpy.layout_tests.port import chromium_port_testcase
 from webkitpy.layout_tests.port import driver
 from webkitpy.layout_tests.port import driver_unittest
+from webkitpy.tool.mocktool import MockOptions
+
+class MockRunCommand(object):
+    def __init__(self):
+        self._mock_logcat = ''
+        self._mock_devices_output = ''
+        self._mock_devices = []
+        self._mock_ls_tombstones = ''
+
+    def mock_run_command_fn(self, args):
+        if args[0] != 'adb':
+            return ''
+        if args[1] == 'devices':
+            return self._mock_devices_output
+
+        assert len(args) > 3
+        assert args[1] == '-s'
+        assert args[2] in self._mock_devices
+        if args[3] == 'shell':
+            if args[4:] == ['ls', '-n', '/data/tombstones']:
+                return self._mock_ls_tombstones
+            elif args[4] == 'cat':
+                return args[5] + '\nmock_contents\n'
+        elif args[3] == 'logcat':
+            return self._mock_logcat
+        return ''
+
+    def mock_no_device(self):
+        self._mock_devices = []
+        self._mock_devices_output = 'List of devices attached'
+
+    def mock_one_device(self):
+        self._mock_devices = ['123456789ABCDEF0']
+        self._mock_devices_output = ('List of devices attached\n'
+                                     '%s\tdevice\n' % self._mock_devices[0])
+
+    def mock_two_devices(self):
+        self._mock_devices = ['123456789ABCDEF0', '23456789ABCDEF01']
+        self._mock_devices_output = ('* daemon not running. starting it now on port 5037 *'
+                                     '* daemon started successfully *'
+                                     'List of devices attached\n'
+                                     '%s\tdevice\n'
+                                     '%s\tdevice\n' % (self._mock_devices[0], self._mock_devices[1]))
+
+    def mock_no_tombstone_dir(self):
+        self._mock_ls_tombstones = '/data/tombstones: No such file or directory'
+
+    def mock_no_tombstone_file(self):
+        self._mock_ls_tombstones = ''
+
+    def mock_ten_tombstones(self):
+        self._mock_ls_tombstones = ('-rw------- 1000     1000       218643 2012-04-26 18:15 tombstone_00\n'
+                                    '-rw------- 1000     1000       241695 2012-04-26 18:15 tombstone_01\n'
+                                    '-rw------- 1000     1000       219472 2012-04-26 18:16 tombstone_02\n'
+                                    '-rw------- 1000     1000        45316 2012-04-27 16:33 tombstone_03\n'
+                                    '-rw------- 1000     1000        82022 2012-04-23 16:57 tombstone_04\n'
+                                    '-rw------- 1000     1000        82015 2012-04-23 16:57 tombstone_05\n'
+                                    '-rw------- 1000     1000        81974 2012-04-23 16:58 tombstone_06\n'
+                                    '-rw------- 1000     1000       237409 2012-04-26 17:41 tombstone_07\n'
+                                    '-rw------- 1000     1000       276089 2012-04-26 18:15 tombstone_08\n'
+                                    '-rw------- 1000     1000       219618 2012-04-26 18:15 tombstone_09\n')
+
+    def mock_logcat(self, content):
+        self._mock_logcat = content
 
 
 class ChromiumAndroidPortTest(chromium_port_testcase.ChromiumPortTestCase):
     port_name = 'chromium-android'
     port_maker = chromium_android.ChromiumAndroidPort
-    mock_logcat = ''
+
+    def make_port(self, **kwargs):
+        port = super(ChromiumAndroidPortTest, self).make_port(**kwargs)
+        self.mock_run_command = MockRunCommand()
+        self.mock_run_command.mock_one_device()
+        port._executive = MockExecutive2(run_command_fn=self.mock_run_command.mock_run_command_fn)
+        return port
 
     def test_attributes(self):
         port = self.make_port()
@@ -59,51 +129,69 @@ class ChromiumAndroidPortTest(chromium_port_testcase.ChromiumPortTestCase):
         # using a custom expectations file.
         pass
 
-    @staticmethod
-    def mock_run_command_fn(args):
-        if args[1] == 'shell':
-            if args[2:] == ['ls', '-n', '/data/tombstones']:
-                # For 'adb shell ls -n /data/tombstones'
-                return ('-rw------- 1000     1000       218643 2012-04-26 18:15 tombstone_00\n'
-                        '-rw------- 1000     1000       241695 2012-04-26 18:15 tombstone_01\n'
-                        '-rw------- 1000     1000       219472 2012-04-26 18:16 tombstone_02\n'
-                        '-rw------- 1000     1000        45316 2012-04-27 16:33 tombstone_03\n'
-                        '-rw------- 1000     1000        82022 2012-04-23 16:57 tombstone_04\n'
-                        '-rw------- 1000     1000        82015 2012-04-23 16:57 tombstone_05\n'
-                        '-rw------- 1000     1000        81974 2012-04-23 16:58 tombstone_06\n'
-                        '-rw------- 1000     1000       237409 2012-04-26 17:41 tombstone_07\n'
-                        '-rw------- 1000     1000       276089 2012-04-26 18:15 tombstone_08\n'
-                        '-rw------- 1000     1000       219618 2012-04-26 18:15 tombstone_09\n')
-            elif args[2] == 'cat':
-                return args[3] + '\nmock_contents\n'
-        elif args[1] == 'logcat':
-            return ChromiumAndroidPortTest.mock_logcat
-        else:
-            return ''
+    def test_get_devices_no_device(self):
+        port = self.make_port()
+        self.mock_run_command.mock_no_device()
+        self.assertRaises(AssertionError, port._get_devices)
 
-    def test_get_last_stacktrace(self):
+    def test_get_devices_one_device(self):
+        port = self.make_port()
+        self.mock_run_command.mock_one_device()
+        self.assertEquals(self.mock_run_command._mock_devices, port._get_devices())
+        self.assertEquals(1, port.default_child_processes())
+
+    def test_get_devices_two_devices(self):
         port = self.make_port()
+        self.mock_run_command.mock_two_devices()
+        self.assertEquals(self.mock_run_command._mock_devices, port._get_devices())
+        self.assertEquals(2, port.default_child_processes())
 
-        def mock_run_command_no_dir(args):
-            return '/data/tombstones: No such file or directory'
-        port._executive = MockExecutive2(run_command_fn=mock_run_command_no_dir)
-        self.assertEquals(port._get_last_stacktrace(), '')
+    def test_get_device_serial_no_device(self):
+        port = self.make_port()
+        self.mock_run_command.mock_no_device()
+        self.assertRaises(AssertionError, port._get_device_serial, 0)
 
-        def mock_run_command_no_file(args):
-            return ''
-        port._executive = MockExecutive2(run_command_fn=mock_run_command_no_file)
-        self.assertEquals(port._get_last_stacktrace(), '')
+    def test_get_device_serial_one_device(self):
+        port = self.make_port()
+        self.mock_run_command.mock_one_device()
+        self.assertEquals(self.mock_run_command._mock_devices[0], port._get_device_serial(0))
+        self.assertRaises(AssertionError, port._get_device_serial, 1)
+
+    def test_get_device_serial_two_devices(self):
+        port = self.make_port()
+        self.mock_run_command.mock_two_devices()
+        self.assertEquals(self.mock_run_command._mock_devices[0], port._get_device_serial(0))
+        self.assertEquals(self.mock_run_command._mock_devices[1], port._get_device_serial(1))
+        self.assertRaises(AssertionError, port._get_device_serial, 2)
+
+
+class ChromiumAndroidDriverTest(unittest.TestCase):
+    def setUp(self):
+        self.mock_run_command = MockRunCommand()
+        self.mock_run_command.mock_one_device()
+        self.port = chromium_android.ChromiumAndroidPort(
+                MockSystemHost(executive=MockExecutive2(run_command_fn=self.mock_run_command.mock_run_command_fn)),
+                'chromium-android')
+        self.driver = chromium_android.ChromiumAndroidDriver(self.port, worker_number=0, pixel_tests=True)
 
-        port._executive = MockExecutive2(run_command_fn=ChromiumAndroidPortTest.mock_run_command_fn)
-        self.assertEquals(port._get_last_stacktrace(),
+    def test_get_last_stacktrace(self):
+        self.mock_run_command.mock_no_tombstone_dir()
+        self.assertEquals(self.driver._get_last_stacktrace(), '')
+
+        self.mock_run_command.mock_no_tombstone_file()
+        self.assertEquals(self.driver._get_last_stacktrace(), '')
+
+        self.mock_run_command.mock_ten_tombstones()
+        self.assertEquals(self.driver._get_last_stacktrace(),
                           '-rw------- 1000 1000 45316 2012-04-27 16:33 tombstone_03\n'
                           '/data/tombstones/tombstone_03\nmock_contents\n')
 
     def test_get_crash_log(self):
-        port = self.make_port()
-        port._executive = MockExecutive2(run_command_fn=ChromiumAndroidPortTest.mock_run_command_fn)
-        ChromiumAndroidPortTest.mock_logcat = 'logcat contents\n'
-        self.assertEquals(port._get_crash_log('foo', 1234, 'out bar\nout baz\n', 'err bar\nerr baz\n', newer_than=None),
+        self.mock_run_command.mock_logcat('logcat contents\n')
+        self.mock_run_command.mock_ten_tombstones()
+        self.driver._crashed_process_name = 'foo'
+        self.driver._crashed_pid = 1234
+        self.assertEquals(self.driver._get_crash_log('out bar\nout baz\n', 'err bar\nerr baz\n', newer_than=None),
             ('err bar\n'
              'err baz\n'
              '********* Tombstone file:\n'
@@ -121,7 +209,10 @@ class ChromiumAndroidPortTest(chromium_port_testcase.ChromiumPortTestCase):
              u'STDERR: -rw------- 1000 1000 45316 2012-04-27 16:33 tombstone_03\n'
              u'STDERR: /data/tombstones/tombstone_03\n'
              u'STDERR: mock_contents\n'))
-        self.assertEquals(port._get_crash_log(None, None, None, None, newer_than=None),
+
+        self.driver._crashed_process_name = None
+        self.driver._crashed_pid = None
+        self.assertEquals(self.driver._get_crash_log(None, None, newer_than=None),
             ('********* Tombstone file:\n'
              '-rw------- 1000 1000 45316 2012-04-27 16:33 tombstone_03\n'
              '/data/tombstones/tombstone_03\n'
@@ -134,26 +225,16 @@ class ChromiumAndroidPortTest(chromium_port_testcase.ChromiumPortTestCase):
              u'STDERR: /data/tombstones/tombstone_03\n'
              u'STDERR: mock_contents\n'))
 
-    def test_driver_cmd_line(self):
-        # Overriding PortTestCase.test_cmd_line(). Use ChromiumAndroidDriverTest.test_cmd_line() instead.
-        return
-
-
-class ChromiumAndroidDriverTest(unittest.TestCase):
-    def setUp(self):
-        mock_port = chromium_android.ChromiumAndroidPort(MockSystemHost(), 'chromium-android')
-        self.driver = chromium_android.ChromiumAndroidDriver(mock_port, worker_number=0, pixel_tests=True)
-
     def test_cmd_line(self):
         cmd_line = self.driver.cmd_line(True, ['anything'])
-        self.assertEquals(['adb', 'shell'], cmd_line)
+        self.assertEquals(['adb', '-s', self.mock_run_command._mock_devices[0], 'shell'], cmd_line)
 
     def test_drt_cmd_line(self):
         cmd_line = self.driver._drt_cmd_line(True, ['--a'])
         self.assertTrue('--a' in cmd_line)
-        self.assertTrue('--in-fifo=' + chromium_android.DRT_APP_FILES_DIR + 'DumpRenderTree.in' in cmd_line)
-        self.assertTrue('--out-fifo=' + chromium_android.DRT_APP_FILES_DIR + 'DumpRenderTree.out' in cmd_line)
-        self.assertTrue('--err-fifo=' + chromium_android.DRT_APP_FILES_DIR + 'DumpRenderTree.err' in cmd_line)
+        self.assertTrue('--in-fifo=' + chromium_android.DEVICE_DRT_DIR + 'DumpRenderTree.in' in cmd_line)
+        self.assertTrue('--out-fifo=' + chromium_android.DEVICE_DRT_DIR + 'DumpRenderTree.out' in cmd_line)
+        self.assertTrue('--err-fifo=' + chromium_android.DEVICE_DRT_DIR + 'DumpRenderTree.err' in cmd_line)
 
     def test_read_prompt(self):
         self.driver._server_process = driver_unittest.MockServerProcess(lines=['root@android:/ # '])
@@ -163,13 +244,46 @@ class ChromiumAndroidDriverTest(unittest.TestCase):
 
     def test_command_from_driver_input(self):
         driver_input = driver.DriverInput('foo/bar/test.html', 10, 'checksum', True)
-        expected_command = "/data/local/tmp/third_party/WebKit/LayoutTests/foo/bar/test.html'checksum\n"
+        expected_command = "/data/local/tmp/third_party/WebKit/LayoutTests/foo/bar/test.html'--pixel-test'checksum\n"
         self.assertEquals(self.driver._command_from_driver_input(driver_input), expected_command)
 
         driver_input = driver.DriverInput('http/tests/foo/bar/test.html', 10, 'checksum', True)
-        expected_command = "http://127.0.0.1:8000/foo/bar/test.html'checksum\n"
+        expected_command = "http://127.0.0.1:8000/foo/bar/test.html'--pixel-test'checksum\n"
         self.assertEquals(self.driver._command_from_driver_input(driver_input), expected_command)
 
 
+class ChromiumAndroidDriverTwoDriversTest(unittest.TestCase):
+    def test_two_drivers(self):
+        mock_run_command = MockRunCommand()
+        mock_run_command.mock_two_devices()
+        port = chromium_android.ChromiumAndroidPort(
+                MockSystemHost(executive=MockExecutive2(run_command_fn=mock_run_command.mock_run_command_fn)),
+                'chromium-android')
+        driver0 = chromium_android.ChromiumAndroidDriver(port, worker_number=0, pixel_tests=True)
+        driver1 = chromium_android.ChromiumAndroidDriver(port, worker_number=1, pixel_tests=True)
+
+        cmd_line0 = driver0.cmd_line(True, ['anything'])
+        self.assertEquals(['adb', '-s', mock_run_command._mock_devices[0], 'shell'], cmd_line0)
+
+        cmd_line1 = driver1.cmd_line(True, ['anything'])
+        self.assertEquals(['adb', '-s', mock_run_command._mock_devices[1], 'shell'], cmd_line1)
+
+
+class ChromiumAndroidTwoPortsTest(unittest.TestCase):
+    def test_options_with_two_ports(self):
+        options = MockOptions(additional_drt_flag=['--foo=bar', '--foo=baz'])
+        mock_run_command = MockRunCommand()
+        mock_run_command.mock_two_devices()
+        port0 = chromium_android.ChromiumAndroidPort(
+                MockSystemHost(executive=MockExecutive2(run_command_fn=mock_run_command.mock_run_command_fn)),
+                'chromium-android', options=options)
+        port1 = chromium_android.ChromiumAndroidPort(
+                MockSystemHost(executive=MockExecutive2(run_command_fn=mock_run_command.mock_run_command_fn)),
+                'chromium-android', options=options)
+        cmd_line = port1.driver_cmd_line()
+        self.assertEquals(cmd_line.count('--encode-binary'), 1)
+        self.assertEquals(cmd_line.count('--enable-hardware-gpu'), 1)
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py
index 7d4c235f3..fb90d1b9b 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py
@@ -158,6 +158,11 @@ class ChromiumPortTestCase(port_testcase.PortTestCase):
             exception_raised = True
         self.assertFalse(exception_raised)
 
+    def test_diff_image_crashed(self):
+        port = ChromiumPortTestCase.TestLinuxPort()
+        port._executive = MockExecutive2(exit_code=2)
+        self.assertEquals(port.diff_image("EXPECTED", "ACTUAL"), (None, 0, 'image diff returned an exit code of 2'))
+
     def test_expectations_files(self):
         port = self.make_port()
         port.port_name = 'chromium'
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/driver.py b/Tools/Scripts/webkitpy/layout_tests/port/driver.py
index 781823b8d..85049970b 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/driver.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/driver.py
@@ -166,8 +166,7 @@ class Driver(object):
 
         crash_log = None
         if self.has_crashed():
-            self.error_from_test, crash_log = self._port._get_crash_log(self._crashed_process_name,
-                self._crashed_pid, text, self.error_from_test, newer_than=start_time)
+            self.error_from_test, crash_log = self._get_crash_log(text, self.error_from_test, newer_than=start_time)
 
             # If we don't find a crash log use a placeholder error message instead.
             if not crash_log:
@@ -188,6 +187,9 @@ class Driver(object):
             crashed_process_name=self._crashed_process_name,
             crashed_pid=self._crashed_pid, crash_log=crash_log)
 
+    def _get_crash_log(self, stdout, stderr, newer_than):
+        return self._port._get_crash_log(self._crashed_process_name, self._crashed_pid, stdout, stderr, newer_than)
+
     # FIXME: Seems this could just be inlined into callers.
     @classmethod
     def _command_wrapper(cls, wrapper_option):
@@ -292,9 +294,8 @@ class Driver(object):
         # FIXME: We need to pass --timeout=SECONDS to WebKitTestRunner for WebKit2.
 
         cmd.extend(self._port.get_option('additional_drt_flag', []))
+        cmd.extend(self._port.additional_drt_flag())
 
-        if pixel_tests and not self._port.supports_switching_pixel_tests_per_test():
-            cmd.append('--pixel-tests')
         cmd.extend(per_test_args)
 
         cmd.append('-')
@@ -319,6 +320,8 @@ class Driver(object):
             _log.debug('WebProcess crash, pid = %s, error_line = %s' % (str(pid), error_line))
             if error_line.startswith("#PROCESS UNRESPONSIVE - WebProcess"):
                 self._subprocess_was_unresponsive = True
+                # We want to show this since it's not a regular crash and probably we don't have a crash log.
+                self.error_from_test += error_line
             return True
         return self.has_crashed()
 
@@ -335,11 +338,9 @@ class Driver(object):
 
         assert not driver_input.image_hash or driver_input.should_run_pixel_test
 
+        # ' is the separator between arguments.
         if driver_input.should_run_pixel_test:
-            if self._port.supports_switching_pixel_tests_per_test():
-                # We did not start the driver with --pixel-tests, instead we specify it per test.
-                # "'" is the separator of command fields.
-                command += "'" + '--pixel-test'
+            command += "'--pixel-test"
         if driver_input.image_hash:
             command += "'" + driver_input.image_hash
         return command + "\n"
@@ -439,7 +440,7 @@ class ContentBlock(object):
         self.decoded_content = None
 
     def decode_content(self):
-        if self.encoding == 'base64':
+        if self.encoding == 'base64' and self.content is not None:
             self.decoded_content = base64.b64decode(self.content)
         else:
             self.decoded_content = self.content
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/driver_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/driver_unittest.py
index 705c1bb7b..5e2019b1b 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/driver_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/driver_unittest.py
@@ -163,7 +163,7 @@ class DriverTest(unittest.TestCase):
     def test_no_timeout(self):
         port = TestWebKitPort()
         driver = Driver(port, 0, pixel_tests=True, no_timeout=True)
-        self.assertEquals(driver.cmd_line(True, []), ['/mock-build/DumpRenderTree', '--no-timeout', '--pixel-tests', '-'])
+        self.assertEquals(driver.cmd_line(True, []), ['/mock-build/DumpRenderTree', '--no-timeout', '-'])
 
     def test_check_for_driver_crash(self):
         port = TestWebKitPort()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/efl.py b/Tools/Scripts/webkitpy/layout_tests/port/efl.py
index 25a81d2da..e5635744d 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/efl.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/efl.py
@@ -27,6 +27,8 @@
 
 """WebKit Efl implementation of the Port interface."""
 
+import os
+
 from webkitpy.layout_tests.models.test_configuration import TestConfiguration
 from webkitpy.layout_tests.port.base import Port
 from webkitpy.layout_tests.port.pulseaudio_sanitizer import PulseAudioSanitizer
@@ -51,6 +53,10 @@ class EflPort(Port, PulseAudioSanitizer):
 
     def setup_environ_for_server(self, server_name=None):
         env = super(EflPort, self).setup_environ_for_server(server_name)
+        # If DISPLAY environment variable is unset in the system
+        # e.g. on build bot, remove DISPLAY variable from the dictionary
+        if not 'DISPLAY' in os.environ:
+            del env['DISPLAY']
         env['TEST_RUNNER_INJECTED_BUNDLE_FILENAME'] = self._build_path('lib', 'libTestRunnerInjectedBundle.so')
         env['TEST_RUNNER_PLUGIN_PATH'] = self._build_path('lib')
         if self.webprocess_cmd_prefix:
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/gtk.py b/Tools/Scripts/webkitpy/layout_tests/port/gtk.py
index 29ab861ce..efebf2db0 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/gtk.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/gtk.py
@@ -82,9 +82,6 @@ class GtkPort(Port, PulseAudioSanitizer):
     def _path_to_image_diff(self):
         return self._build_path('Programs', 'ImageDiff')
 
-    def check_build(self, needs_http):
-        return self._check_driver()
-
     def _path_to_apache(self):
         if self._is_redhat_based():
             return '/usr/sbin/httpd'
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/image_diff.py b/Tools/Scripts/webkitpy/layout_tests/port/image_diff.py
index 2cccc1f5e..08202ace5 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/image_diff.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/image_diff.py
@@ -62,8 +62,7 @@ class ImageDiffer(object):
                 len(expected_contents), expected_contents))
             return self._read()
         except IOError as exception:
-            _log.error("Failed to compute an image diff: %s" % str(exception))
-            return (True, 0)
+            return (None, 0, "Failed to compute an image diff: %s" % str(exception))
 
     def _start(self, tolerance):
         command = [self._port._path_to_image_diff(), '--tolerance', str(tolerance)]
@@ -77,7 +76,7 @@ class ImageDiffer(object):
         output = None
         output_image = ""
 
-        while True:
+        while not self._process.timed_out and not self._process.has_crashed():
             output = self._process.read_stdout_line(deadline)
             if self._process.timed_out or self._process.has_crashed() or not output:
                 break
@@ -93,12 +92,14 @@ class ImageDiffer(object):
                 break
 
         stderr = self._process.pop_all_buffered_stderr()
+        err_str = ''
         if stderr:
-            _log.warn("ImageDiff produced stderr output:\n" + stderr)
+            err_str += "ImageDiff produced stderr output:\n" + stderr
         if self._process.timed_out:
-            _log.error("ImageDiff timed out")
+            err_str += "ImageDiff timed out\n"
         if self._process.has_crashed():
-            _log.error("ImageDiff crashed")
+            err_str += "ImageDiff crashed\n"
+
         # FIXME: There is no need to shut down the ImageDiff server after every diff.
         self._process.stop()
 
@@ -106,10 +107,10 @@ class ImageDiffer(object):
         if output and output.startswith('diff'):
             m = re.match('diff: (.+)% (passed|failed)', output)
             if m.group(2) == 'passed':
-                return [None, 0]
+                return (None, 0, None)
             diff_percent = float(m.group(1))
 
-        return (output_image, diff_percent)
+        return (output_image, diff_percent, err_str or None)
 
     def stop(self):
         if self._process:
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/image_diff_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/image_diff_unittest.py
index b06756c35..46cc98a11 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/image_diff_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/image_diff_unittest.py
@@ -46,7 +46,12 @@ class FakePort(object):
 
 
 class TestImageDiffer(unittest.TestCase):
-    def test_diff_image(self):
+    def test_diff_image_failed(self):
         port = FakePort(['diff: 100% failed\n'])
         image_differ = ImageDiffer(port)
-        self.assertEquals(image_differ.diff_image('foo', 'bar', 0.1), ('', 100.0))
+        self.assertEquals(image_differ.diff_image('foo', 'bar', 0.1), ('', 100.0, None))
+
+    def test_diff_image_passed(self):
+        port = FakePort(['diff: 0% passed\n'])
+        image_differ = ImageDiffer(port)
+        self.assertEquals(image_differ.diff_image('foo', 'bar', 0.1), (None, 0, None))
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mac.py b/Tools/Scripts/webkitpy/layout_tests/port/mac.py
index 756bd2abe..d0caa5b22 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mac.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mac.py
@@ -235,7 +235,7 @@ class MacPort(ApplePort):
         for (test_name, process_name, pid) in crashed_processes:
             # Passing None for output.  This is a second pass after the test finished so
             # if the output had any loggine we would have already collected it.
-            crash_log = self._get_crash_log(process_name, pid, None, None, start_time, wait_for_log=False)
+            crash_log = self._get_crash_log(process_name, pid, None, None, start_time, wait_for_log=False)[1]
             if not crash_log:
                 continue
             crash_logs[test_name] = crash_log
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
index 964ef07ef..56ae5a532 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
@@ -60,6 +60,9 @@ class MockDRTPortTest(port_testcase.PortTestCase):
     def test_diff_image(self):
         pass
 
+    def test_diff_image_crashed(self):
+        pass
+
     def test_uses_apache(self):
         pass
 
@@ -87,6 +90,10 @@ class MockDRTPortTest(port_testcase.PortTestCase):
     def test_get_crash_log(self):
         pass
 
+    def test_check_build(self):
+        pass
+
+
 class MockDRTTest(unittest.TestCase):
     def input_line(self, port, test_name, checksum=None):
         url = port.create_driver(0).test_to_uri(test_name)
@@ -259,7 +266,3 @@ class MockTestShellTest(MockDRTTest):
         self.assertTrue(options.test_shell)
         self.assertTrue(options.pixel_tests)
         self.assertEquals(options.pixel_path, '/tmp/png_result0.png')
-
-
-if __name__ == '__main__':
-    port_testcase.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
index a366e8951..44bf16768 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
@@ -254,17 +254,37 @@ class PortTestCase(unittest.TestCase):
         self.proc = None
 
         def make_proc(port, nm, cmd, env):
-            self.proc = MockServerProcess(port, nm, cmd, env, lines=['diff: 100% failed\n'])
+            self.proc = MockServerProcess(port, nm, cmd, env, lines=['diff: 100% failed\n', 'diff: 100% failed\n'])
             return self.proc
 
         port._server_process_constructor = make_proc
         port.setup_test_run()
-        self.assertEquals(port.diff_image('foo', 'bar'), ('', 100.0))
+        self.assertEquals(port.diff_image('foo', 'bar'), ('', 100.0, None))
         self.assertEquals(self.proc.cmd[1:3], ["--tolerance", "0.1"])
+
+        self.assertEquals(port.diff_image('foo', 'bar', None), ('', 100.0, None))
+        self.assertEquals(self.proc.cmd[1:3], ["--tolerance", "0.1"])
+
+        self.assertEquals(port.diff_image('foo', 'bar', 0), ('', 100.0, None))
+        self.assertEquals(self.proc.cmd[1:3], ["--tolerance", "0"])
+
         port.clean_up_test_run()
         self.assertTrue(self.proc.stopped)
         self.assertEquals(port._image_differ, None)
 
+    def test_diff_image_crashed(self):
+        port = self.make_port()
+        self.proc = None
+
+        def make_proc(port, nm, cmd, env):
+            self.proc = MockServerProcess(port, nm, cmd, env, crashed=True)
+            return self.proc
+
+        port._server_process_constructor = make_proc
+        port.setup_test_run()
+        self.assertEquals(port.diff_image('foo', 'bar'), ('', 0, 'ImageDiff crashed\n'))
+        port.clean_up_test_run()
+
     def test_check_wdiff(self):
         port = self.make_port()
         port.check_wdiff()
@@ -563,33 +583,26 @@ class PortTestCase(unittest.TestCase):
         port._apache_config_file_name_for_platform = lambda platform: 'httpd.conf'
         self.assertEquals(port._path_to_apache_config_file(), '/mock-checkout/LayoutTests/http/conf/httpd.conf')
 
-
-# FIXME: This class and main() should be merged into test-webkitpy.
-class EnhancedTestLoader(unittest.TestLoader):
-    integration_tests = False
-    unit_tests = True
-
-    def getTestCaseNames(self, testCaseClass):
-        def isTestMethod(attrname, testCaseClass=testCaseClass):
-            if not hasattr(getattr(testCaseClass, attrname), '__call__'):
-                return False
-            return ((self.unit_tests and attrname.startswith('test_')) or
-                    (self.integration_tests and attrname.startswith('integration_test_')))
-        testFnNames = filter(isTestMethod, dir(testCaseClass))
-        testFnNames.sort()
-        return testFnNames
-
-
-def main(argv=None):
-    if argv is None:
-        argv = sys.argv
-
-    test_loader = EnhancedTestLoader()
-    if '-i' in argv:
-        test_loader.integration_tests = True
-        argv.remove('-i')
-    if '--no-unit-tests' in argv:
-        test_loader.unit_tests = False
-        argv.remove('--no-unit-tests')
-
-    unittest.main(argv=argv, testLoader=test_loader)
+    def test_check_build(self):
+        port = self.make_port(options=MockOptions(build=True))
+        self.build_called = False
+
+        def build_driver_called():
+            self.build_called = True
+            return True
+
+        port._build_driver = build_driver_called
+        port.check_build(False)
+        self.assertTrue(self.build_called)
+
+        port = self.make_port(options=MockOptions(root='/tmp', build=True))
+        self.build_called = False
+        port._build_driver = build_driver_called
+        port.check_build(False)
+        self.assertFalse(self.build_called, None)
+
+        port = self.make_port(options=MockOptions(build=False))
+        self.build_called = False
+        port._build_driver = build_driver_called
+        port.check_build(False)
+        self.assertFalse(self.build_called, None)
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/qt.py b/Tools/Scripts/webkitpy/layout_tests/port/qt.py
index 392ab028f..6e7b0988d 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/qt.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/qt.py
@@ -184,13 +184,3 @@ class QtPort(Port):
             return False
         return result
 
-    def _supports_switching_pixel_tests_per_test(self):
-        return True
-
-    def _should_run_as_pixel_test(self, test_input):
-        return any(test_input.test_name.startswith(directory)
-                   for directory in QtPort._default_pixel_test_directories())
-
-    @staticmethod
-    def _default_pixel_test_directories():
-        return ['compositing']
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/server_process_mock.py b/Tools/Scripts/webkitpy/layout_tests/port/server_process_mock.py
index ae48523eb..d234ebdc3 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/server_process_mock.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/server_process_mock.py
@@ -28,10 +28,10 @@
 
 
 class MockServerProcess(object):
-    def __init__(self, port_obj=None, name=None, cmd=None, env=None, universal_newlines=False, lines=None):
+    def __init__(self, port_obj=None, name=None, cmd=None, env=None, universal_newlines=False, lines=None, crashed=False):
         self.timed_out = False
         self.lines = lines or []
-        self.crashed = False
+        self.crashed = crashed
         self.writes = []
         self.cmd = cmd
         self.env = env
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/test.py b/Tools/Scripts/webkitpy/layout_tests/port/test.py
index 5714661fd..6302120d2 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/test.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/test.py
@@ -219,6 +219,10 @@ layer at (0,0) size 800x34
 
     tests.add('websocket/tests/passes/text.html')
 
+    # For testing test are properly included from platform directories.
+    tests.add('platform/test-mac-leopard/http/test.html')
+    tests.add('platform/test-win-win7/http/test.html')
+
     # For --no-http tests, test that platform specific HTTP tests are properly skipped.
     tests.add('platform/test-snow-leopard/http/test.html')
     tests.add('platform/test-snow-leopard/websocket/test.html')
@@ -402,8 +406,8 @@ class TestPort(Port):
     def diff_image(self, expected_contents, actual_contents, tolerance=None):
         diffed = actual_contents != expected_contents
         if diffed:
-            return ["< %s\n---\n> %s\n" % (expected_contents, actual_contents), 1]
-        return (None, 0)
+            return ("< %s\n---\n> %s\n" % (expected_contents, actual_contents), 1, None)
+        return (None, 0, None)
 
     def layout_tests_dir(self):
         return LAYOUT_TEST_DIR
@@ -513,10 +517,6 @@ class TestPort(Port):
             VirtualTestSuite('virtual/skipped', 'failures/expected', ['--virtual-arg2']),
         ]
 
-    def supports_switching_pixel_tests_per_test(self):
-        # Let it true so we can test the --pixel-test-directory option.
-        return True
-
 
 class TestDriver(Driver):
     """Test/Dummy implementation of the DumpRenderTree interface."""
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/webkit.py b/Tools/Scripts/webkitpy/layout_tests/port/webkit.py
deleted file mode 100755
index 058787c71..000000000
--- a/Tools/Scripts/webkitpy/layout_tests/port/webkit.py
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env python
-# Copyright (C) 2010 Google Inc. All rights reserved.
-# Copyright (C) 2010 Gabor Rapcsanyi <rgabor@inf.u-szeged.hu>, University of Szeged
-# Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-#     * Neither the Google name nor the names of its
-# contributors may be used to endorse or promote products derived from
-# this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# FIXME: this is a stub file needed to ensure that chrome still compiles
-# until we can remove this from the browser_tests.isolate file downstream.
-# See https://bugs.webkit.org/show_bug.cgi?id=92549
-pass
diff --git a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
index 95a07f59e..06b3032ff 100755
--- a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
+++ b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
@@ -97,11 +97,6 @@ def run(port, options, args, regular_output=sys.stderr, buildbot_output=sys.stdo
         for warning in warnings:
             _log.warning(warning)
 
-        if options.help_printing:
-            printer.help_printing()
-            printer.cleanup()
-            return 0
-
         if options.lint_test_files:
             return lint(port, options)
 
@@ -182,6 +177,9 @@ def _set_up_derived_options(port, options):
 
         options.pixel_test_directories = list(varified_dirs)
 
+    if options.run_singly:
+        options.verbose = True
+
     return warnings
 
 
@@ -246,8 +244,9 @@ def parse_args(args=None):
         optparse.make_option("--per-tile-painting",
             action="store_true",
             help="Use per-tile painting of composited pages"),
-        optparse.make_option("--adb-args", type="string",
-            help="Arguments parsed to Android adb, to select device, etc."),
+        optparse.make_option("--adb-device",
+            action="append", default=[],
+            help="Run Android layout tests on these devices."),
     ]))
 
     option_group_definitions.append(("EFL-specific Options", [
@@ -368,7 +367,6 @@ def parse_args(args=None):
         optparse.make_option("-n", "--dry-run", action="store_true",
             default=False,
             help="Do everything but actually run the tests or upload results."),
-        # old-run-webkit-tests has --valgrind instead of wrapper.
         optparse.make_option("--wrapper",
             help="wrapper command to insert before invocations of "
                  "DumpRenderTree; option is split on whitespace before "
@@ -383,7 +381,6 @@ def parse_args(args=None):
             help="Run all tests, even those marked SKIP in the test list (same as --skipped=ignore)"),
         optparse.make_option("--time-out-ms",
             help="Set the timeout for each test"),
-        # old-run-webkit-tests calls --randomize-order --random:
         optparse.make_option("--randomize-order", action="store_true",
             default=False, help=("Run tests in random order (useful "
                                 "for tracking down corruption)")),
@@ -392,15 +389,11 @@ def parse_args(args=None):
                  "of the layout tests")),
         optparse.make_option("--run-part", help=("Run a specified part (n:m), "
                   "the nth of m parts, of the layout tests")),
-        # old-run-webkit-tests calls --batch-size: --nthly n
-        #   Restart DumpRenderTree every n tests (default: 1000)
         optparse.make_option("--batch-size",
             help=("Run a the tests in batches (n), after every n tests, "
                   "DumpRenderTree is relaunched."), type="int", default=None),
-        # old-run-webkit-tests calls --run-singly: -1|--singly
-        # Isolate each test case run (implies --nthly 1 --verbose)
         optparse.make_option("--run-singly", action="store_true",
-            default=False, help="run a separate DumpRenderTree for each test"),
+            default=False, help="run a separate DumpRenderTree for each test (implies --verbose)"),
         optparse.make_option("--child-processes",
             help="Number of DumpRenderTrees to run in parallel."),
         # FIXME: Display default number of child processes that will run.
@@ -412,21 +405,16 @@ def parse_args(args=None):
         optparse.make_option("--exit-after-n-crashes-or-timeouts", type="int",
             default=None, help="Exit after the first N crashes instead of "
             "running all tests"),
-        optparse.make_option("--iterations", type="int", help="Number of times to run the set of tests (e.g. ABCABCABC)"),
-        optparse.make_option("--repeat-each", type="int", help="Number of times to run each test (e.g. AAABBBCCC)"),
+        optparse.make_option("--iterations", type="int", default=1, help="Number of times to run the set of tests (e.g. ABCABCABC)"),
+        optparse.make_option("--repeat-each", type="int", default=1, help="Number of times to run each test (e.g. AAABBBCCC)"),
         optparse.make_option("--retry-failures", action="store_true",
             default=True,
             help="Re-try any tests that produce unexpected results (default)"),
         optparse.make_option("--no-retry-failures", action="store_false",
             dest="retry_failures",
             help="Don't re-try any tests that produce unexpected results."),
-        optparse.make_option("--max-locked-shards", type="int",
+        optparse.make_option("--max-locked-shards", type="int", default=1,
             help="Set the maximum number of locked shards"),
-        # For chromium-android to reduce the cost of restarting the driver.
-        # FIXME: Remove the option once per-test arg is supported:
-        # https://bugs.webkit.org/show_bug.cgi?id=91539.
-        optparse.make_option("--shard-ref-tests", action="store_true",
-            help="Run ref tests in dedicated shard(s). Enabled on Android by default."),
         optparse.make_option("--additional-env-var", type="string", action="append", default=[],
             help="Passes that environment variable to the tests (--additional-env-var=NAME=VALUE)"),
     ]))
@@ -484,7 +472,7 @@ def main(argv=None):
         traceback.print_exc(file=sys.stderr)
         raise
 
-    logging.getLogger().setLevel(logging.DEBUG if options.verbose else logging.INFO)
+    logging.getLogger().setLevel(logging.DEBUG if options.debug_rwt_logging else logging.INFO)
     return run(port, options, args)
 
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
index 6e85977b2..ecb58b89d 100755
--- a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
@@ -60,10 +60,7 @@ from webkitpy.tool.mocktool import MockOptions
 
 def parse_args(extra_args=None, record_results=False, tests_included=False, new_results=False, print_nothing=True):
     extra_args = extra_args or []
-    if print_nothing:
-        args = ['--print', 'nothing']
-    else:
-        args = []
+    args = []
     if not '--platform' in extra_args:
         args.extend(['--platform', 'test'])
     if not record_results:
@@ -95,7 +92,7 @@ def passing_run(extra_args=None, port_obj=None, record_results=False, tests_incl
     buildbot_output = StringIO.StringIO()
     regular_output = StringIO.StringIO()
     res = run_webkit_tests.run(port_obj, options, parsed_args, buildbot_output=buildbot_output, regular_output=regular_output)
-    return res == 0 and not regular_output.getvalue() and not buildbot_output.getvalue()
+    return res == 0
 
 
 def logging_run(extra_args=None, port_obj=None, record_results=False, tests_included=False, host=None, new_results=False, shared_port=True):
@@ -186,9 +183,6 @@ class StreamTestingMixin(object):
     def assertContains(self, stream, string):
         self.assertTrue(string in stream.getvalue())
 
-    def assertContainsLine(self, stream, string):
-        self.assertTrue(string in stream.buflist)
-
     def assertEmpty(self, stream):
         self.assertFalse(stream.getvalue())
 
@@ -310,13 +304,13 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
     def test_child_processes_2(self):
         if self.should_test_processes:
             _, _, regular_output, _ = logging_run(
-                ['--print', 'config', '--child-processes', '2'], shared_port=False)
+                ['--debug-rwt-logging', '--child-processes', '2'], shared_port=False)
             self.assertTrue(any(['Running 2 ' in line for line in regular_output.buflist]))
 
     def test_child_processes_min(self):
         if self.should_test_processes:
             _, _, regular_output, _ = logging_run(
-                ['--print', 'config', '--child-processes', '2', 'passes'],
+                ['--debug-rwt-logging', '--child-processes', '2', 'passes'],
                 tests_included=True, shared_port=False)
             self.assertTrue(any(['Running 1 ' in line for line in regular_output.buflist]))
 
@@ -349,12 +343,6 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
         res, out, err, user = logging_run(['--full-results-html'])
         self.assertEqual(res, 0)
 
-    def test_help_printing(self):
-        res, out, err, user = logging_run(['--help-printing'])
-        self.assertEqual(res, 0)
-        self.assertEmpty(out)
-        self.assertNotEmpty(err)
-
     def test_hung_thread(self):
         res, out, err, user = logging_run(['--run-singly', '--time-out-ms=50',
                                           'failures/expected/hang.html'],
@@ -378,13 +366,13 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
         res, out, err, user = logging_run(['resources'], tests_included=True)
         self.assertEqual(res, -1)
         self.assertEmpty(out)
-        self.assertContainsLine(err, 'No tests to run.\n')
+        self.assertContains(err, 'No tests to run.\n')
 
     def test_no_tests_found_2(self):
         res, out, err, user = logging_run(['foo'], tests_included=True)
         self.assertEqual(res, -1)
         self.assertEmpty(out)
-        self.assertContainsLine(err, 'No tests to run.\n')
+        self.assertContains(err, 'No tests to run.\n')
 
     def test_randomize_order(self):
         # FIXME: verify order was shuffled
@@ -439,11 +427,11 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
         host = MockHost()
         res, out, err, _ = logging_run(['--iterations', '2',
                                         '--repeat-each', '4',
-                                        '--print', 'everything',
+                                        '--debug-rwt-logging',
                                         'passes/text.html', 'failures/expected/text.html'],
                                        tests_included=True, host=host, record_results=True)
-        self.assertContainsLine(out, "=> Results: 8/16 tests passed (50.0%)\n")
-        self.assertContainsLine(err, "All 16 tests ran as expected.\n")
+        self.assertContains(out, "=> Results: 8/16 tests passed (50.0%)\n")
+        self.assertContains(err, "All 16 tests ran as expected.\n")
 
     def test_run_chunk(self):
         # Test that we actually select the right chunk
@@ -761,7 +749,7 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
 
     def test_retrying_and_flaky_tests(self):
         host = MockHost()
-        res, out, err, _ = logging_run(['failures/flaky'], tests_included=True, host=host)
+        res, out, err, _ = logging_run(['--debug-rwt-logging', 'failures/flaky'], tests_included=True, host=host)
         self.assertEquals(res, 0)
         self.assertTrue('Retrying' in err.getvalue())
         self.assertTrue('Unexpected flakiness' in out.getvalue())
@@ -776,7 +764,7 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
         self.assertEquals(res, 1)
         self.assertTrue('Clobbering old results' in err.getvalue())
         self.assertTrue('flaky/text.html' in err.getvalue())
-        self.assertTrue('Unexpected text diff' in out.getvalue())
+        self.assertTrue('Unexpected text failures' in out.getvalue())
         self.assertFalse('Unexpected flakiness' in out.getvalue())
         self.assertTrue(host.filesystem.exists('/tmp/layout-test-results/failures/flaky/text-actual.txt'))
         self.assertFalse(host.filesystem.exists('retries'))
@@ -795,7 +783,7 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
         class ImageDiffTestPort(TestPort):
             def diff_image(self, expected_contents, actual_contents, tolerance=None):
                 self.tolerance_used_for_diff_image = self._options.tolerance
-                return (True, 1)
+                return (True, 1, None)
 
         def get_port_for_run(args):
             options, parsed_args = run_webkit_tests.parse_args(args)
@@ -863,7 +851,7 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
         self.assertTrue(passing_run(['--additional-platform-directory', '/tmp/foo', '--additional-platform-directory', '/tmp/bar']))
 
         res, buildbot_output, regular_output, user = logging_run(['--additional-platform-directory', 'foo'])
-        self.assertContainsLine(regular_output, '--additional-platform-directory=foo is ignored since it is not absolute\n')
+        self.assertContains(regular_output, '--additional-platform-directory=foo is ignored since it is not absolute\n')
 
     def test_additional_expectations(self):
         host = MockHost()
@@ -894,8 +882,9 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
         self.assertTrue(MainTest.has_test_of_type(batch_tests_run_http, 'websocket'))
 
     def test_platform_tests_are_found(self):
-        tests_run = get_tests_run(['http'], tests_included=True, flatten_batches=True)
-        self.assertTrue('platform/test-snow-leopard/http/test.html' in tests_run)
+        tests_run = get_tests_run(['--platform', 'test-mac-leopard', 'http'], tests_included=True, flatten_batches=True)
+        self.assertTrue('platform/test-mac-leopard/http/test.html' in tests_run)
+        self.assertFalse('platform/test-win-win7/http/test.html' in tests_run)
 
     def test_output_diffs(self):
         # Test to ensure that we don't generate -wdiff.html or -pretty.html if wdiff and PrettyPatch
@@ -928,6 +917,21 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
         # This is empty because we don't even get a chance to configure the logger before failing.
         self.assertEquals(logs, '')
 
+    def test_verbose_in_child_processes(self):
+        # When we actually run multiple processes, we may have to reconfigure logging in the
+        # child process (e.g., on win32) and we need to make sure that works and we still
+        # see the verbose log output. However, we can't use logging_run() because using
+        # outputcapture to capture stdout and stderr latter results in a nonpicklable host.
+        options, parsed_args = parse_args(['--verbose', '--fully-parallel', '--child-processes', '2', 'passes/text.html', 'passes/image.html'], tests_included=True, print_nothing=False)
+        host = MockHost()
+        port_obj = host.port_factory.get(port_name=options.platform, options=options)
+        buildbot_output = StringIO.StringIO()
+        regular_output = StringIO.StringIO()
+        res = run_webkit_tests.run(port_obj, options, parsed_args, buildbot_output=buildbot_output, regular_output=regular_output)
+        self.assertTrue('text.html passed' in regular_output.getvalue())
+        self.assertTrue('image.html passed' in regular_output.getvalue())
+
+
 class EndToEndTest(unittest.TestCase):
     def parse_full_results(self, full_results_text):
         json_to_eval = full_results_text.replace("ADD_RESULTS(", "").replace(");", "")
@@ -974,7 +978,7 @@ class RebaselineTest(unittest.TestCase, StreamTestingMixin):
             baseline = file + "-expected" + ext
             baseline_msg = 'Writing new expected result "%s"\n' % baseline
             self.assertTrue(any(f.find(baseline) != -1 for f in file_list))
-            self.assertContainsLine(err, baseline_msg)
+            self.assertContains(err, baseline_msg)
 
     # FIXME: Add tests to ensure that we're *not* writing baselines when we're not
     # supposed to be.
diff --git a/Tools/Scripts/webkitpy/layout_tests/servers/http_server_integrationtest.py b/Tools/Scripts/webkitpy/layout_tests/servers/http_server_integrationtest.py
index a02e4c5b8..237d689ce 100755
--- a/Tools/Scripts/webkitpy/layout_tests/servers/http_server_integrationtest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/servers/http_server_integrationtest.py
@@ -38,8 +38,6 @@ import sys
 import tempfile
 import unittest
 
-from webkitpy.layout_tests.port import port_testcase
-
 
 class BaseTest(unittest.TestCase):
     """Basic framework for script tests."""
@@ -145,7 +143,3 @@ class WebsocketserverTest(BaseTest):
     # FIXME: test TLS at some point?
     PORTS = (8880, )
     SCRIPT_NAME = 'new-run-webkit-websocketserver'
-
-
-if __name__ == '__main__':
-    port_testcase.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/views/printing.py b/Tools/Scripts/webkitpy/layout_tests/views/printing.py
index 1c2fecd7b..c23fd7d40 100644
--- a/Tools/Scripts/webkitpy/layout_tests/views/printing.py
+++ b/Tools/Scripts/webkitpy/layout_tests/views/printing.py
@@ -38,115 +38,21 @@ from webkitpy.layout_tests.models import test_expectations
 from webkitpy.layout_tests.models.test_expectations import TestExpectations
 from webkitpy.layout_tests.views.metered_stream import MeteredStream
 
-NUM_SLOW_TESTS_TO_LOG = 10
 
-PRINT_DEFAULT = "misc,one-line-progress,one-line-summary,unexpected,unexpected-results,updates"
-PRINT_EVERYTHING = "actual,config,expected,misc,one-line-progress,one-line-summary,slowest,timing,unexpected,unexpected-results,updates"
-
-HELP_PRINTING = """
-Output for run-webkit-tests is controlled by a comma-separated list of
-values passed to --print.  Values either influence the overall output, or
-the output at the beginning of the run, during the run, or at the end:
-
-Overall options:
-    nothing             don't print anything. This overrides every other option
-    default             include the default options. This is useful for logging
-                        the default options plus additional settings.
-    everything          print (almost) everything (except the trace-* options,
-                        see below for the full list )
-    misc                print miscellaneous things like blank lines
-
-At the beginning of the run:
-    config              print the test run configuration
-    expected            print a summary of what is expected to happen
-                        (# passes, # failures, etc.)
-
-During the run:
-    one-line-progress   print a one-line progress message or bar
-    unexpected          print any unexpected results as they occur
-    updates             print updates on which stage is executing
-    trace-everything    print detailed info on every test's results
-                        (baselines, expectation, time it took to run). If
-                        this is specified it will override the '*-progress'
-                        options, the 'trace-unexpected' option, and the
-                        'unexpected' option.
-    trace-unexpected    like 'trace-everything', but only for tests with
-                        unexpected results. If this option is specified,
-                        it will override the 'unexpected' option.
-
-At the end of the run:
-    actual              print a summary of the actual results
-    slowest             print %(slowest)d slowest tests and the time they took
-    timing              print timing statistics
-    unexpected-results  print a list of the tests with unexpected results
-    one-line-summary    print a one-line summary of the run
-
-Notes:
-    - If 'nothing' is specified, it overrides all of the other options.
-    - Specifying --verbose is equivalent to --print everything plus it
-      changes the format of the log messages to add timestamps and other
-      information. If you specify --verbose and --print X, then X overrides
-      the --print everything implied by --verbose.
-
---print 'everything' is equivalent to --print '%(everything)s'.
-
-The default (--print default) is equivalent to --print '%(default)s'.
-""" % {'slowest': NUM_SLOW_TESTS_TO_LOG, 'everything': PRINT_EVERYTHING,
-       'default': PRINT_DEFAULT}
+NUM_SLOW_TESTS_TO_LOG = 10
 
 
 def print_options():
     return [
-        # Note: We use print_options rather than just 'print' because print
-        # is a reserved word.
-        # Note: Also, we don't specify a default value so we can detect when
-        # no flag is specified on the command line and use different defaults
-        # based on whether or not --verbose is specified (since --print
-        # overrides --verbose).
-        optparse.make_option("--print", dest="print_options",
-            help=("controls print output of test run. "
-                  "Use --help-printing for more.")),
-        optparse.make_option("--help-printing", action="store_true",
-            help="show detailed help on controlling print output"),
-        optparse.make_option("-v", "--verbose", action="store_true",
-            default=False, help="include debug-level logging"),
-   ]
-
-
-def parse_print_options(print_options, verbose):
-    """Parse the options provided to --print and dedup and rank them.
-
-    Returns
-        a set() of switches that govern how logging is done
-
-    """
-    if print_options:
-        switches = set(print_options.split(','))
-    elif verbose:
-        switches = set(PRINT_EVERYTHING.split(','))
-    else:
-        switches = set(PRINT_DEFAULT.split(','))
-
-    if 'nothing' in switches:
-        return set()
-
-    if 'everything' in switches:
-        switches.discard('everything')
-        switches.update(set(PRINT_EVERYTHING.split(',')))
-
-    if 'default' in switches:
-        switches.discard('default')
-        switches.update(set(PRINT_DEFAULT.split(',')))
-
-    if 'trace-everything' in switches:
-        switches.discard('one-line-progress')
-        switches.discard('trace-unexpected')
-        switches.discard('unexpected')
-
-    if 'trace-unexpected' in switches:
-        switches.discard('unexpected')
-
-    return switches
+        optparse.make_option('-q', '--quiet', action='store_true', default=False,
+                             help='run quietly (errors, warnings, and progress only)'),
+        optparse.make_option('-v', '--verbose', action='store_true', default=False,
+                             help='print a summarized result for every test (one line per test)'),
+        optparse.make_option('--details', action='store_true', default=False,
+                             help='print detailed results for every test'),
+        optparse.make_option('--debug-rwt-logging', action='store_true', default=False,
+                             help='print timestamps and debug information for run-webkit-tests itself'),
+    ]
 
 
 class Printer(object):
@@ -162,21 +68,14 @@ class Printer(object):
     By default the buildbot-parsed code gets logged to stdout, and regular
     output gets logged to stderr."""
     def __init__(self, port, options, regular_output, buildbot_output, logger=None):
-        """
-        Args
-          port               interface to port-specific routines
-          options            OptionParser object with command line settings
-          regular_output     stream to which output intended only for humans
-                             should be written
-          buildbot_output    stream to which output intended to be read by
-                             the buildbots (and humans) should be written
-          logger             optional logger to integrate into the stream.
-        """
+        self.num_completed = 0
+        self.num_tests = 0
         self._port = port
         self._options = options
         self._buildbot_stream = buildbot_output
-        self._meter = MeteredStream(regular_output, options.verbose, logger=logger)
-        self.switches = parse_print_options(options.print_options, options.verbose)
+        self._meter = MeteredStream(regular_output, options.debug_rwt_logging, logger=logger)
+        self._running_tests = []
+        self._completed_tests = []
 
     def cleanup(self):
         self._meter.cleanup()
@@ -184,77 +83,54 @@ class Printer(object):
     def __del__(self):
         self.cleanup()
 
-    # These two routines just hide the implementation of the switches.
-    def disabled(self, option):
-        return not option in self.switches
-
-    def enabled(self, option):
-        return option in self.switches
-
-    def help_printing(self):
-        self._write(HELP_PRINTING)
-
     def print_config(self):
-        """Prints the configuration for the test run."""
-        self._print_config("Using port '%s'" % self._port.name())
-        self._print_config("Test configuration: %s" % self._port.test_configuration())
-        self._print_config("Placing test results in %s" % self._options.results_directory)
+        self._print_default("Using port '%s'" % self._port.name())
+        self._print_default("Test configuration: %s" % self._port.test_configuration())
+        self._print_default("Placing test results in %s" % self._options.results_directory)
 
         # FIXME: should these options be in printing_options?
         if self._options.new_baseline:
-            self._print_config("Placing new baselines in %s" % self._port.baseline_path())
+            self._print_default("Placing new baselines in %s" % self._port.baseline_path())
 
         fs = self._port.host.filesystem
         fallback_path = [fs.split(x)[1] for x in self._port.baseline_search_path()]
-        self._print_config("Baseline search path: %s -> generic" % " -> ".join(fallback_path))
+        self._print_default("Baseline search path: %s -> generic" % " -> ".join(fallback_path))
 
-        self._print_config("Using %s build" % self._options.configuration)
+        self._print_default("Using %s build" % self._options.configuration)
         if self._options.pixel_tests:
-            self._print_config("Pixel tests enabled")
+            self._print_default("Pixel tests enabled")
         else:
-            self._print_config("Pixel tests disabled")
+            self._print_default("Pixel tests disabled")
+
+        self._print_default("Regular timeout: %s, slow test timeout: %s" %
+                  (self._options.time_out_ms, self._options.slow_time_out_ms))
 
-        self._print_config("Regular timeout: %s, slow test timeout: %s" %
-                           (self._options.time_out_ms, self._options.slow_time_out_ms))
+        self._print_default('Command line: ' + ' '.join(self._port.driver_cmd_line()))
+        self._print_default('')
 
-        self._print_config('Command line: ' + ' '.join(self._port.driver_cmd_line()))
-        self._print_config('')
+    def print_found(self, num_all_test_files, num_to_run, repeat_each, iterations):
+        found_str = 'Found %s; running %d' % (grammar.pluralize('test', num_all_test_files), num_to_run)
+        if repeat_each * iterations > 1:
+            found_str += ' (%d times each: --repeat-each=%d --iterations=%d)' % (repeat_each * iterations, repeat_each, iterations)
+        found_str += ', skipping %d' % (num_all_test_files - num_to_run)
+        self._print_default(found_str + '.')
 
-    def print_expected(self, num_all_test_files, result_summary, tests_with_result_type_callback):
-        self._print_expected('Found %s.' % grammar.pluralize('test', num_all_test_files))
+    def print_expected(self, result_summary, tests_with_result_type_callback):
         self._print_expected_results_of_type(result_summary, test_expectations.PASS, "passes", tests_with_result_type_callback)
         self._print_expected_results_of_type(result_summary, test_expectations.FAIL, "failures", tests_with_result_type_callback)
         self._print_expected_results_of_type(result_summary, test_expectations.FLAKY, "flaky", tests_with_result_type_callback)
-        self._print_expected_results_of_type(result_summary, test_expectations.SKIP, "skipped", tests_with_result_type_callback)
-        self._print_expected('')
-
-        if self._options.repeat_each > 1:
-            self._print_expected('Running each test %d times.' % self._options.repeat_each)
-        if self._options.iterations > 1:
-            self._print_expected('Running %d iterations of the tests.' % self._options.iterations)
-        if self._options.iterations > 1 or self._options.repeat_each > 1:
-            self._print_expected('')
+        self._print_debug('')
 
     def print_workers_and_shards(self, num_workers, num_shards, num_locked_shards):
         driver_name = self._port.driver_name()
         if num_workers == 1:
-            self._print_config("Running 1 %s over %s." %
-                (driver_name, grammar.pluralize('shard', num_shards)))
+            self._print_default("Running 1 %s over %s." % (driver_name, grammar.pluralize('shard', num_shards)))
         else:
-            self._print_config("Running %d %ss in parallel over %d shards (%d locked)." %
+            self._print_default("Running %d %ss in parallel over %d shards (%d locked)." %
                 (num_workers, driver_name, num_shards, num_locked_shards))
-        self._print_config('')
-
-    def _print_expected_results_of_type(self, result_summary,
-                                        result_type, result_type_str, tests_with_result_type_callback):
-        """Print the number of the tests in a given result class.
-
-        Args:
-          result_summary - the object containing all the results to report on
-          result_type - the particular result type to report in the summary.
-          result_type_str - a string description of the result_type.
-          expectations - populated TestExpectations object for stats
-        """
+        self._print_default('')
+
+    def _print_expected_results_of_type(self, result_summary, result_type, result_type_str, tests_with_result_type_callback):
         tests = tests_with_result_type_callback(result_type)
         now = result_summary.tests_by_timeline[test_expectations.NOW]
         wontfix = result_summary.tests_by_timeline[test_expectations.WONTFIX]
@@ -263,12 +139,9 @@ class Printer(object):
         # nicely-aligned table.
         fmtstr = ("Expect: %%5d %%-8s (%%%dd now, %%%dd wontfix)"
                   % (self._num_digits(now), self._num_digits(wontfix)))
-        self._print_expected(fmtstr %
-            (len(tests), result_type_str, len(tests & now), len(tests & wontfix)))
+        self._print_debug(fmtstr % (len(tests), result_type_str, len(tests & now), len(tests & wontfix)))
 
     def _num_digits(self, num):
-        """Returns the number of digits needed to represent the length of a
-        sequence."""
         ndigits = 1
         if len(num):
             ndigits = int(math.log10(len(num))) + 1
@@ -277,61 +150,36 @@ class Printer(object):
     def print_results(self, run_time, thread_timings, test_timings, individual_test_timings, result_summary, unexpected_results):
         self._print_timing_statistics(run_time, thread_timings, test_timings, individual_test_timings, result_summary)
         self._print_result_summary(result_summary)
-
-        self.print_one_line_summary(result_summary.total - result_summary.expected_skips, result_summary.expected - result_summary.expected_skips, result_summary.unexpected)
-
-        self.print_unexpected_results(unexpected_results)
+        self._print_one_line_summary(result_summary.total - result_summary.expected_skips,
+                                     result_summary.expected - result_summary.expected_skips,
+                                     result_summary.unexpected)
+        self._print_unexpected_results(unexpected_results)
 
     def _print_timing_statistics(self, total_time, thread_timings,
                                  directory_test_timings, individual_test_timings,
                                  result_summary):
-        """Record timing-specific information for the test run.
-
-        Args:
-          total_time: total elapsed time (in seconds) for the test run
-          thread_timings: wall clock time each thread ran for
-          directory_test_timings: timing by directory
-          individual_test_timings: timing by file
-          result_summary: summary object for the test run
-        """
-        self.print_timing("Test timing:")
-        self.print_timing("  %6.2f total testing time" % total_time)
-        self.print_timing("")
-        self.print_timing("Thread timing:")
+        self._print_debug("Test timing:")
+        self._print_debug("  %6.2f total testing time" % total_time)
+        self._print_debug("")
+        self._print_debug("Thread timing:")
         cuml_time = 0
         for t in thread_timings:
-            self.print_timing("    %10s: %5d tests, %6.2f secs" %
-                  (t['name'], t['num_tests'], t['total_time']))
+            self._print_debug("    %10s: %5d tests, %6.2f secs" % (t['name'], t['num_tests'], t['total_time']))
             cuml_time += t['total_time']
-        self.print_timing("   %6.2f cumulative, %6.2f optimal" %
-              (cuml_time, cuml_time / int(self._options.child_processes)))
-        self.print_timing("")
+        self._print_debug("   %6.2f cumulative, %6.2f optimal" % (cuml_time, cuml_time / int(self._options.child_processes)))
+        self._print_debug("")
 
         self._print_aggregate_test_statistics(individual_test_timings)
-        self._print_individual_test_times(individual_test_timings,
-                                          result_summary)
+        self._print_individual_test_times(individual_test_timings, result_summary)
         self._print_directory_timings(directory_test_timings)
 
     def _print_aggregate_test_statistics(self, individual_test_timings):
-        """Prints aggregate statistics (e.g. median, mean, etc.) for all tests.
-        Args:
-          individual_test_timings: List of TestResults for all tests.
-        """
         times_for_dump_render_tree = [test_stats.test_run_time for test_stats in individual_test_timings]
-        self._print_statistics_for_test_timings("PER TEST TIME IN TESTSHELL (seconds):",
-                                                times_for_dump_render_tree)
-
-    def _print_individual_test_times(self, individual_test_timings,
-                                     result_summary):
-        """Prints the run times for slow, timeout and crash tests.
-        Args:
-          individual_test_timings: List of TestStats for all tests.
-          result_summary: summary object for test run
-        """
-        # Reverse-sort by the time spent in DumpRenderTree.
-        individual_test_timings.sort(lambda a, b:
-            cmp(b.test_run_time, a.test_run_time))
+        self._print_statistics_for_test_timings("PER TEST TIME IN TESTSHELL (seconds):", times_for_dump_render_tree)
 
+    def _print_individual_test_times(self, individual_test_timings, result_summary):
+        # Reverse-sort by the time spent in DumpRenderTree.
+        individual_test_timings.sort(lambda a, b: cmp(b.test_run_time, a.test_run_time))
         num_printed = 0
         slow_tests = []
         timeout_or_crash_tests = []
@@ -354,63 +202,37 @@ class Printer(object):
                 num_printed = num_printed + 1
                 unexpected_slow_tests.append(test_tuple)
 
-        self.print_timing("")
-        self._print_test_list_timing("%s slowest tests that are not "
-            "marked as SLOW and did not timeout/crash:" % NUM_SLOW_TESTS_TO_LOG, unexpected_slow_tests)
-        self.print_timing("")
+        self._print_debug("")
+        self._print_test_list_timing("%s slowest tests that are not marked as SLOW and did not timeout/crash:" %
+            NUM_SLOW_TESTS_TO_LOG, unexpected_slow_tests)
+        self._print_debug("")
         self._print_test_list_timing("Tests marked as SLOW:", slow_tests)
-        self.print_timing("")
-        self._print_test_list_timing("Tests that timed out or crashed:",
-                                     timeout_or_crash_tests)
-        self.print_timing("")
+        self._print_debug("")
+        self._print_test_list_timing("Tests that timed out or crashed:", timeout_or_crash_tests)
+        self._print_debug("")
 
     def _print_test_list_timing(self, title, test_list):
-        """Print timing info for each test.
-
-        Args:
-          title: section heading
-          test_list: tests that fall in this section
-        """
-        if self.disabled('slowest'):
-            return
-
-        self.print_timing(title)
+        self._print_debug(title)
         for test_tuple in test_list:
             test_run_time = round(test_tuple.test_run_time, 1)
-            self.print_timing("  %s took %s seconds" % (test_tuple.test_name, test_run_time))
+            self._print_debug("  %s took %s seconds" % (test_tuple.test_name, test_run_time))
 
     def _print_directory_timings(self, directory_test_timings):
-        """Print timing info by directory for any directories that
-        take > 10 seconds to run.
-
-        Args:
-          directory_test_timing: time info for each directory
-        """
         timings = []
         for directory in directory_test_timings:
             num_tests, time_for_directory = directory_test_timings[directory]
-            timings.append((round(time_for_directory, 1), directory,
-                            num_tests))
+            timings.append((round(time_for_directory, 1), directory, num_tests))
         timings.sort()
 
-        self.print_timing("Time to process slowest subdirectories:")
+        self._print_debug("Time to process slowest subdirectories:")
         min_seconds_to_print = 10
         for timing in timings:
             if timing[0] > min_seconds_to_print:
-                self.print_timing(
-                    "  %s took %s seconds to run %s tests." % (timing[1],
-                    timing[0], timing[2]))
-        self.print_timing("")
+                self._print_debug("  %s took %s seconds to run %s tests." % (timing[1], timing[0], timing[2]))
+        self._print_debug("")
 
     def _print_statistics_for_test_timings(self, title, timings):
-        """Prints the median, mean and standard deviation of the values in
-        timings.
-
-        Args:
-          title: Title for these timings.
-          timings: A list of floats representing times.
-        """
-        self.print_timing(title)
+        self._print_debug(title)
         timings.sort()
 
         num_tests = len(timings)
@@ -432,158 +254,131 @@ class Printer(object):
             sum_of_deviations = math.pow(timing - mean, 2)
 
         std_deviation = math.sqrt(sum_of_deviations / num_tests)
-        self.print_timing("  Median:          %6.3f" % median)
-        self.print_timing("  Mean:            %6.3f" % mean)
-        self.print_timing("  90th percentile: %6.3f" % percentile90)
-        self.print_timing("  99th percentile: %6.3f" % percentile99)
-        self.print_timing("  Standard dev:    %6.3f" % std_deviation)
-        self.print_timing("")
+        self._print_debug("  Median:          %6.3f" % median)
+        self._print_debug("  Mean:            %6.3f" % mean)
+        self._print_debug("  90th percentile: %6.3f" % percentile90)
+        self._print_debug("  99th percentile: %6.3f" % percentile99)
+        self._print_debug("  Standard dev:    %6.3f" % std_deviation)
+        self._print_debug("")
 
     def _print_result_summary(self, result_summary):
-        """Print a short summary about how many tests passed.
+        if not self._options.debug_rwt_logging:
+            return
 
-        Args:
-          result_summary: information to log
-        """
         failed = result_summary.total_failures
         total = result_summary.total - result_summary.expected_skips
-        passed = total - failed
+        passed = total - failed - result_summary.remaining
         pct_passed = 0.0
         if total > 0:
             pct_passed = float(passed) * 100 / total
 
-        self.print_actual("")
-        self.print_actual("=> Results: %d/%d tests passed (%.1f%%)" %
-                     (passed, total, pct_passed))
-        self.print_actual("")
-        self._print_result_summary_entry(result_summary,
-            test_expectations.NOW, "Tests to be fixed")
+        self._print_for_bot("=> Results: %d/%d tests passed (%.1f%%)" % (passed, total, pct_passed))
+        self._print_for_bot("")
+        self._print_result_summary_entry(result_summary, test_expectations.NOW, "Tests to be fixed")
 
-        self.print_actual("")
-        self._print_result_summary_entry(result_summary,
-            test_expectations.WONTFIX,
+        self._print_for_bot("")
+        # FIXME: We should be skipping anything marked WONTFIX, so we shouldn't bother logging these stats.
+        self._print_result_summary_entry(result_summary, test_expectations.WONTFIX,
             "Tests that will only be fixed if they crash (WONTFIX)")
-        self.print_actual("")
+        self._print_for_bot("")
 
-    def _print_result_summary_entry(self, result_summary, timeline,
-                                    heading):
-        """Print a summary block of results for a particular timeline of test.
-
-        Args:
-          result_summary: summary to print results for
-          timeline: the timeline to print results for (NOT, WONTFIX, etc.)
-          heading: a textual description of the timeline
-        """
+    def _print_result_summary_entry(self, result_summary, timeline, heading):
         total = len(result_summary.tests_by_timeline[timeline])
         not_passing = (total -
            len(result_summary.tests_by_expectation[test_expectations.PASS] &
                result_summary.tests_by_timeline[timeline]))
-        self.print_actual("=> %s (%d):" % (heading, not_passing))
+        self._print_for_bot("=> %s (%d):" % (heading, not_passing))
 
         for result in TestExpectations.EXPECTATION_ORDER:
-            if result == test_expectations.PASS:
+            if result in (test_expectations.PASS, test_expectations.SKIP):
                 continue
             results = (result_summary.tests_by_expectation[result] &
                        result_summary.tests_by_timeline[timeline])
             desc = TestExpectations.EXPECTATION_DESCRIPTIONS[result]
             if not_passing and len(results):
                 pct = len(results) * 100.0 / not_passing
-                self.print_actual("  %5d %-24s (%4.1f%%)" %
-                    (len(results), desc[len(results) != 1], pct))
-
-
-    def print_actual(self, msg):
-        if self.disabled('actual'):
-            return
-        self._buildbot_stream.write("%s\n" % msg)
-
-    def _print_config(self, msg):
-        self.write(msg, 'config')
-
-    def _print_expected(self, msg):
-        self.write(msg, 'expected')
-
-    def print_timing(self, msg):
-        self.write(msg, 'timing')
-
-    def print_one_line_summary(self, total, expected, unexpected):
-        """Print a one-line summary of the test run to stdout.
-
-        Args:
-          total: total number of tests run
-          expected: number of expected results
-          unexpected: number of unexpected results
-        """
-        if self.disabled('one-line-summary'):
-            return
+                self._print_for_bot("  %5d %-24s (%4.1f%%)" % (len(results), desc[0], pct))
 
+    def _print_one_line_summary(self, total, expected, unexpected):
         incomplete = total - expected - unexpected
         incomplete_str = ''
         if incomplete:
-            self._write("")
+            self._print_default("")
             incomplete_str = " (%d didn't run)" % incomplete
 
+        if self._options.verbose or self._options.debug_rwt_logging or unexpected:
+            self.writeln("")
+
+        summary = ''
         if unexpected == 0:
             if expected == total:
                 if expected > 1:
-                    self._write("All %d tests ran as expected." % expected)
+                    summary = "All %d tests ran as expected." % expected
                 else:
-                    self._write("The test ran as expected.")
+                    summary = "The test ran as expected."
             else:
-                self._write("%s ran as expected%s." % (grammar.pluralize('test', expected), incomplete_str))
+                summary = "%s ran as expected%s." % (grammar.pluralize('test', expected), incomplete_str)
         else:
-            self._write("%s ran as expected, %d didn't%s:" % (grammar.pluralize('test', expected), unexpected, incomplete_str))
-        self._write("")
-
-    def print_finished_test(self, result, expected, exp_str, got_str, result_summary, retrying, test_files_list):
-        self.print_test_result(result, expected, exp_str, got_str)
-        self.print_progress(result_summary, retrying, test_files_list)
-
-    def print_test_result(self, result, expected, exp_str, got_str):
-        """Print the result of the test as determined by --print.
-
-        This routine is used to print the details of each test as it completes.
-
-        Args:
-            result   - The actual TestResult object
-            expected - Whether the result we got was an expected result
-            exp_str  - What we expected to get (used for tracing)
-            got_str  - What we actually got (used for tracing)
-
-        Note that we need all of these arguments even though they seem
-        somewhat redundant, in order to keep this routine from having to
-        known anything about the set of expectations.
-        """
-        if (self.enabled('trace-everything') or
-            self.enabled('trace-unexpected') and not expected):
+            summary = "%s ran as expected, %d didn't%s:" % (grammar.pluralize('test', expected), unexpected, incomplete_str)
+
+        self._print_quiet(summary)
+        self._print_quiet("")
+
+    def print_started_test(self, test_name):
+        self._running_tests.append(test_name)
+        if len(self._running_tests) > 1:
+            suffix = ' (+%d)' % (len(self._running_tests) - 1)
+        else:
+            suffix = ''
+        if self._options.verbose:
+            write = self._meter.write_update
+        else:
+            write = self._meter.write_throttled_update
+        write('[%d/%d] %s%s' % (self.num_completed, self.num_tests, test_name, suffix))
+
+    def print_finished_test(self, result, expected, exp_str, got_str):
+        self.num_completed += 1
+        test_name = result.test_name
+        if self._options.details:
             self._print_test_trace(result, exp_str, got_str)
-        elif not expected and self.enabled('unexpected'):
-            self._print_unexpected_test_result(result)
+        elif (self._options.verbose and not self._options.debug_rwt_logging) or not expected:
+            desc = TestExpectations.EXPECTATION_DESCRIPTIONS[result.type]
+            suffix = ' ' + desc[1]
+            if not expected:
+                suffix += ' unexpectedly' + desc[2]
+            self.writeln("[%d/%d] %s%s" % (self.num_completed, self.num_tests, test_name, suffix))
+        elif self.num_completed == self.num_tests:
+            self._meter.write_update('')
+        else:
+            desc = TestExpectations.EXPECTATION_DESCRIPTIONS[result.type]
+            suffix = ' ' + desc[1]
+            if test_name == self._running_tests[0]:
+                self._completed_tests.insert(0, [test_name, suffix])
+            else:
+                self._completed_tests.append([test_name, suffix])
+
+            for test_name, suffix in self._completed_tests:
+                self._meter.write_throttled_update('[%d/%d] %s%s' % (self.num_completed, self.num_tests, test_name, suffix))
+            self._completed_tests = []
+        self._running_tests.remove(test_name)
 
     def _print_test_trace(self, result, exp_str, got_str):
-        """Print detailed results of a test (triggered by --print trace-*).
-        For each test, print:
-           - location of the expected baselines
-           - expected results
-           - actual result
-           - timing info
-        """
         test_name = result.test_name
-        self._write('trace: %s' % test_name)
+        self._print_default('[%d/%d] %s' % (self.num_completed, self.num_tests, test_name))
 
         base = self._port.lookup_virtual_test_base(test_name)
         if base:
             args = ' '.join(self._port.lookup_virtual_test_args(test_name))
-            self._write(' base: %s' % base)
-            self._write(' args: %s' % args)
+            self._print_default(' base: %s' % base)
+            self._print_default(' args: %s' % args)
 
         for extension in ('.txt', '.png', '.wav', '.webarchive'):
             self._print_baseline(test_name, extension)
 
-        self._write('  exp: %s' % exp_str)
-        self._write('  got: %s' % got_str)
-        self._write(' took: %-.3f' % result.test_run_time)
-        self._write('')
+        self._print_default('  exp: %s' % exp_str)
+        self._print_default('  got: %s' % got_str)
+        self._print_default(' took: %-.3f' % result.test_run_time)
+        self._print_default('')
 
     def _print_baseline(self, test_name, extension):
         baseline = self._port.expected_filename(test_name, extension)
@@ -591,37 +386,12 @@ class Printer(object):
             relpath = self._port.relative_test_filename(baseline)
         else:
             relpath = '<none>'
-        self._write('  %s: %s' % (extension[1:], relpath))
+        self._print_default('  %s: %s' % (extension[1:], relpath))
 
-    def _print_unexpected_test_result(self, result):
-        """Prints one unexpected test result line."""
-        desc = TestExpectations.EXPECTATION_DESCRIPTIONS[result.type][0]
-        self.write("  %s -> unexpected %s" % (result.test_name, desc), "unexpected")
-
-    def print_progress(self, result_summary, retrying, test_list):
+    def _print_progress(self, result_summary, retrying, test_list):
         """Print progress through the tests as determined by --print."""
-        if self.disabled('one-line-progress'):
-            return
-
-        if result_summary.remaining == 0:
-            self._meter.write_update('')
-            return
-
-        percent_complete = 100 * (result_summary.expected +
-            result_summary.unexpected) / result_summary.total
-        action = "Testing"
-        if retrying:
-            action = "Retrying"
-
-        self._meter.write_throttled_update("%s (%d%%): %d ran as expected, %d didn't, %d left" %
-            (action, percent_complete, result_summary.expected,
-             result_summary.unexpected, result_summary.remaining))
-
-    def print_unexpected_results(self, unexpected_results):
-        """Prints a list of the unexpected results to the buildbot stream."""
-        if self.disabled('unexpected-results'):
-            return
-
+    def _print_unexpected_results(self, unexpected_results):
+        # Prints to the buildbot stream
         passes = {}
         flaky = {}
         regressions = {}
@@ -634,17 +404,11 @@ class Printer(object):
             expected = results['expected'].split(" ")
             if actual == ['PASS']:
                 if 'CRASH' in expected:
-                    add_to_dict_of_lists(passes,
-                                         'Expected to crash, but passed',
-                                         test)
+                    add_to_dict_of_lists(passes, 'Expected to crash, but passed', test)
                 elif 'TIMEOUT' in expected:
-                    add_to_dict_of_lists(passes,
-                                         'Expected to timeout, but passed',
-                                          test)
+                    add_to_dict_of_lists(passes, 'Expected to timeout, but passed', test)
                 else:
-                    add_to_dict_of_lists(passes,
-                                         'Expected to fail, but passed',
-                                         test)
+                    add_to_dict_of_lists(passes, 'Expected to fail, but passed', test)
             elif len(actual) > 1:
                 # We group flaky tests by the first actual result we got.
                 add_to_dict_of_lists(flaky, actual[0], test)
@@ -654,23 +418,21 @@ class Printer(object):
         resultsjsonparser.for_each_test(unexpected_results['tests'], add_result)
 
         if len(passes) or len(flaky) or len(regressions):
-            self._buildbot_stream.write("\n")
-
+            self._print_for_bot("")
         if len(passes):
             for key, tests in passes.iteritems():
-                self._buildbot_stream.write("%s: (%d)\n" % (key, len(tests)))
+                self._print_for_bot("%s: (%d)" % (key, len(tests)))
                 tests.sort()
                 for test in tests:
-                    self._buildbot_stream.write("  %s\n" % test)
-                self._buildbot_stream.write("\n")
-            self._buildbot_stream.write("\n")
+                    self._print_for_bot("  %s" % test)
+                self._print_for_bot("")
+            self._print_for_bot("")
 
         if len(flaky):
             descriptions = TestExpectations.EXPECTATION_DESCRIPTIONS
             for key, tests in flaky.iteritems():
                 result = TestExpectations.EXPECTATIONS[key.lower()]
-                self._buildbot_stream.write("Unexpected flakiness: %s (%d)\n"
-                    % (descriptions[result][1], len(tests)))
+                self._print_for_bot("Unexpected flakiness: %s (%d)" % (descriptions[result][0], len(tests)))
                 tests.sort()
 
                 for test in tests:
@@ -679,41 +441,41 @@ class Printer(object):
                     expected = result['expected'].split(" ")
                     result = TestExpectations.EXPECTATIONS[key.lower()]
                     new_expectations_list = list(set(actual) | set(expected))
-                    self._buildbot_stream.write("  %s = %s\n" %
-                        (test, " ".join(new_expectations_list)))
-                self._buildbot_stream.write("\n")
-            self._buildbot_stream.write("\n")
+                    self._print_for_bot("  %s = %s" % (test, " ".join(new_expectations_list)))
+                self._print_for_bot("")
+            self._print_for_bot("")
 
         if len(regressions):
             descriptions = TestExpectations.EXPECTATION_DESCRIPTIONS
             for key, tests in regressions.iteritems():
                 result = TestExpectations.EXPECTATIONS[key.lower()]
-                self._buildbot_stream.write(
-                    "Regressions: Unexpected %s : (%d)\n" % (
-                    descriptions[result][1], len(tests)))
+                self._print_for_bot("Regressions: Unexpected %s : (%d)" % (descriptions[result][0], len(tests)))
                 tests.sort()
                 for test in tests:
-                    self._buildbot_stream.write("  %s = %s\n" % (test, key))
-                self._buildbot_stream.write("\n")
-            self._buildbot_stream.write("\n")
+                    self._print_for_bot("  %s = %s" % (test, key))
+                self._print_for_bot("")
 
-        if len(unexpected_results['tests']) and self._options.verbose:
-            self._buildbot_stream.write("%s\n" % ("-" * 78))
+        if len(unexpected_results['tests']) and self._options.debug_rwt_logging:
+            self._print_for_bot("%s" % ("-" * 78))
 
-    def write_update(self, msg):
-        if self.disabled('updates'):
-            return
-        self._meter.write_update(msg)
+    def _print_quiet(self, msg):
+        self.writeln(msg)
 
-    def write(self, msg, option="misc"):
-        if self.disabled(option):
-            return
-        self._write(msg)
+    def _print_default(self, msg):
+        if not self._options.quiet:
+            self.writeln(msg)
+
+    def _print_debug(self, msg):
+        if self._options.debug_rwt_logging:
+            self.writeln(msg)
 
-    def writeln(self, *args, **kwargs):
-        self._meter.writeln(*args, **kwargs)
+    def _print_for_bot(self, msg):
+        self._buildbot_stream.write(msg + "\n")
+
+    def write_update(self, msg):
+        self._meter.write_update(msg)
 
-    def _write(self, msg):
+    def writeln(self, msg):
         self._meter.writeln(msg)
 
     def flush(self):
diff --git a/Tools/Scripts/webkitpy/layout_tests/views/printing_unittest.py b/Tools/Scripts/webkitpy/layout_tests/views/printing_unittest.py
index f8dd61db7..17fc4b9a3 100644
--- a/Tools/Scripts/webkitpy/layout_tests/views/printing_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/views/printing_unittest.py
@@ -57,36 +57,6 @@ class TestUtilityFunctions(unittest.TestCase):
         options, args = get_options([])
         self.assertTrue(options is not None)
 
-    def test_parse_print_options(self):
-        def test_switches(args, expected_switches_str, verbose=False):
-            options, args = get_options(args)
-            if expected_switches_str:
-                expected_switches = set(expected_switches_str.split(','))
-            else:
-                expected_switches = set()
-            switches = printing.parse_print_options(options.print_options,
-                                                    verbose)
-            self.assertEqual(expected_switches, switches)
-
-        # test that we default to the default set of switches
-        test_switches([], printing.PRINT_DEFAULT)
-
-        # test that verbose defaults to everything
-        test_switches([], printing.PRINT_EVERYTHING, verbose=True)
-
-        # test that --print default does what it's supposed to
-        test_switches(['--print', 'default'], printing.PRINT_DEFAULT)
-
-        # test that --print nothing does what it's supposed to
-        test_switches(['--print', 'nothing'], None)
-
-        # test that --print everything does what it's supposed to
-        test_switches(['--print', 'everything'], printing.PRINT_EVERYTHING)
-
-        # this tests that '--print X' overrides '--verbose'
-        test_switches(['--print', 'actual'], 'actual', verbose=True)
-
-
 
 class  Testprinter(unittest.TestCase):
     def assertEmpty(self, stream):
@@ -102,7 +72,7 @@ class  Testprinter(unittest.TestCase):
         stream.buflist = []
         stream.buf = ''
 
-    def get_printer(self, args=None, tty=False):
+    def get_printer(self, args=None):
         args = args or []
         printing_options = printing.print_options()
         option_parser = optparse.OptionParser(option_list=printing_options)
@@ -112,7 +82,6 @@ class  Testprinter(unittest.TestCase):
         nproc = 2
 
         regular_output = StringIO.StringIO()
-        regular_output.isatty = lambda: tty
         buildbot_output = StringIO.StringIO()
         printer = printing.Printer(self._port, options, regular_output, buildbot_output)
         return printer, regular_output, buildbot_output
@@ -130,62 +99,19 @@ class  Testprinter(unittest.TestCase):
         port.test_expectations_overrides = lambda: None
         expectations = test_expectations.TestExpectations(self._port, test_names)
 
-        rs = result_summary.ResultSummary(expectations, test_names)
+        rs = result_summary.ResultSummary(expectations, test_names, 1, set())
         return test_names, rs, expectations
 
-    def test_help_printer(self):
-        # Here and below we'll call the "regular" printer err and the
-        # buildbot printer out; this corresponds to how things run on the
-        # bots with stderr and stdout.
-        printer, err, out = self.get_printer()
-
-        # This routine should print something to stdout. testing what it is
-        # is kind of pointless.
-        printer.help_printing()
-        self.assertNotEmpty(err)
-        self.assertEmpty(out)
-
-    def do_switch_tests(self, method_name, switch, to_buildbot,
-                        message='hello', exp_err=None, exp_bot=None):
-        def do_helper(method_name, switch, message, exp_err, exp_bot):
-            printer, err, bot = self.get_printer(['--print', switch], tty=True)
-            getattr(printer, method_name)(message)
-            self.assertEqual(err.buflist, exp_err)
-            self.assertEqual(bot.buflist, exp_bot)
-
-        if to_buildbot:
-            if exp_err is None:
-                exp_err = []
-            if exp_bot is None:
-                exp_bot = [message + "\n"]
-        else:
-            if exp_err is None:
-                exp_err = [message + "\n"]
-            if exp_bot is None:
-                exp_bot = []
-        do_helper(method_name, 'nothing', 'hello', [], [])
-        do_helper(method_name, switch, 'hello', exp_err, exp_bot)
-        do_helper(method_name, 'everything', 'hello', exp_err, exp_bot)
-
     def test_configure_and_cleanup(self):
         # This test verifies that calling cleanup repeatedly and deleting
         # the object is safe.
-        printer, err, out = self.get_printer(['--print', 'everything'])
+        printer, err, out = self.get_printer()
         printer.cleanup()
         printer.cleanup()
         printer = None
 
-    def test_print_actual(self):
-        # Actual results need to be logged to the buildbot's stream.
-        self.do_switch_tests('print_actual', 'actual', to_buildbot=True)
-
-    def test_print_actual_buildbot(self):
-        # FIXME: Test that the format of the actual results matches what the
-        # buildbot is expecting.
-        pass
-
-    def test_fallback_path_in_config(self):
-        printer, err, out = self.get_printer(['--print', 'everything'])
+    def test_print_config(self):
+        printer, err, out = self.get_printer()
         # FIXME: it's lame that i have to set these options directly.
         printer._options.results_directory = '/tmp'
         printer._options.pixel_tests = True
@@ -195,201 +121,32 @@ class  Testprinter(unittest.TestCase):
         printer.print_config()
         self.assertTrue('Baseline search path: test-mac-leopard -> test-mac-snowleopard -> generic' in err.getvalue())
 
-    def test_print_config(self):
-        self.do_switch_tests('_print_config', 'config', to_buildbot=False)
-
-    def test_print_expected(self):
-        self.do_switch_tests('_print_expected', 'expected', to_buildbot=False)
-
-    def test_print_timing(self):
-        self.do_switch_tests('print_timing', 'timing', to_buildbot=False)
-
-    def test_write_update(self):
-        # Note that there shouldn't be a carriage return here; updates()
-        # are meant to be overwritten.
-        self.do_switch_tests('write_update', 'updates', to_buildbot=False,
-                             message='hello', exp_err=['hello'])
+        self.reset(err)
+        printer._options.quiet = True
+        printer.print_config()
+        self.assertFalse('Baseline search path: test-mac-leopard -> test-mac-snowleopard -> generic' in err.getvalue())
 
     def test_print_one_line_summary(self):
-        printer, err, out = self.get_printer(['--print', 'nothing'])
-        printer.print_one_line_summary(1, 1, 0)
-        self.assertEmpty(err)
-
-        printer, err, out = self.get_printer(['--print', 'one-line-summary'])
-        printer.print_one_line_summary(1, 1, 0)
+        printer, err, out = self.get_printer()
+        printer._print_one_line_summary(1, 1, 0)
         self.assertWritten(err, ["The test ran as expected.\n", "\n"])
 
-        printer, err, out = self.get_printer(['--print', 'everything'])
-        printer.print_one_line_summary(1, 1, 0)
+        printer, err, out = self.get_printer()
+        printer._print_one_line_summary(1, 1, 0)
         self.assertWritten(err, ["The test ran as expected.\n", "\n"])
 
-        printer, err, out = self.get_printer(['--print', 'everything'])
-        printer.print_one_line_summary(2, 1, 1)
-        self.assertWritten(err, ["1 test ran as expected, 1 didn't:\n", "\n"])
+        printer, err, out = self.get_printer()
+        printer._print_one_line_summary(2, 1, 1)
+        self.assertWritten(err, ["\n", "1 test ran as expected, 1 didn't:\n", "\n"])
 
-        printer, err, out = self.get_printer(['--print', 'everything'])
-        printer.print_one_line_summary(3, 2, 1)
-        self.assertWritten(err, ["2 tests ran as expected, 1 didn't:\n", "\n"])
+        printer, err, out = self.get_printer()
+        printer._print_one_line_summary(3, 2, 1)
+        self.assertWritten(err, ["\n", "2 tests ran as expected, 1 didn't:\n", "\n"])
 
-        printer, err, out = self.get_printer(['--print', 'everything'])
-        printer.print_one_line_summary(3, 2, 0)
+        printer, err, out = self.get_printer()
+        printer._print_one_line_summary(3, 2, 0)
         self.assertWritten(err, ['\n', "2 tests ran as expected (1 didn't run).\n", '\n'])
 
-
-    def test_print_test_result(self):
-        # Note here that we don't use meaningful exp_str and got_str values;
-        # the actual contents of the string are treated opaquely by
-        # print_test_result() when tracing, and usually we don't want
-        # to test what exactly is printed, just that something
-        # was printed (or that nothing was printed).
-        #
-        # FIXME: this is actually some goofy layering; it would be nice
-        # we could refactor it so that the args weren't redundant. Maybe
-        # the TestResult should contain what was expected, and the
-        # strings could be derived from the TestResult?
-        printer, err, out = self.get_printer(['--print', 'nothing'])
-        result = self.get_result('passes/image.html')
-        printer.print_test_result(result, expected=False, exp_str='',
-                                  got_str='')
-        self.assertEmpty(err)
-
-        printer, err, out = self.get_printer(['--print', 'unexpected'])
-        printer.print_test_result(result, expected=True, exp_str='',
-                                  got_str='')
-        self.assertEmpty(err)
-        printer.print_test_result(result, expected=False, exp_str='',
-                                  got_str='')
-        self.assertWritten(err, ['  passes/image.html -> unexpected pass\n'])
-
-        printer, err, out = self.get_printer(['--print', 'everything'])
-        printer.print_test_result(result, expected=True, exp_str='',
-                                  got_str='')
-        self.assertEmpty(err)
-
-        printer.print_test_result(result, expected=False, exp_str='',
-                                  got_str='')
-        self.assertWritten(err, ['  passes/image.html -> unexpected pass\n'])
-
-        printer, err, out = self.get_printer(['--print', 'nothing'])
-        printer.print_test_result(result, expected=False, exp_str='',
-                                  got_str='')
-        self.assertEmpty(err)
-
-        printer, err, out = self.get_printer(['--print',
-                                              'trace-unexpected'])
-        printer.print_test_result(result, expected=True, exp_str='',
-                                  got_str='')
-        self.assertEmpty(err)
-
-        printer, err, out = self.get_printer(['--print',
-                                              'trace-unexpected'])
-        printer.print_test_result(result, expected=False, exp_str='',
-                                  got_str='')
-        self.assertNotEmpty(err)
-
-        printer, err, out = self.get_printer(['--print',
-                                              'trace-unexpected'])
-        result = self.get_result("passes/text.html")
-        printer.print_test_result(result, expected=False, exp_str='',
-                                  got_str='')
-        self.assertNotEmpty(err)
-
-        printer, err, out = self.get_printer(['--print',
-                                              'trace-unexpected'])
-        result = self.get_result("passes/text.html")
-        printer.print_test_result(result, expected=False, exp_str='',
-                                  got_str='')
-        self.assertNotEmpty(err)
-
-        printer, err, out = self.get_printer(['--print', 'trace-everything'])
-        result = self.get_result('passes/image.html')
-        printer.print_test_result(result, expected=True, exp_str='',
-                                  got_str='')
-        result = self.get_result('failures/expected/missing_text.html')
-        printer.print_test_result(result, expected=True, exp_str='',
-                                  got_str='')
-        result = self.get_result('failures/expected/missing_check.html')
-        printer.print_test_result(result, expected=True, exp_str='',
-                                  got_str='')
-        result = self.get_result('failures/expected/missing_image.html')
-        printer.print_test_result(result, expected=True, exp_str='',
-                                  got_str='')
-        self.assertNotEmpty(err)
-
-        printer, err, out = self.get_printer(['--print', 'trace-everything'])
-        result = self.get_result('passes/image.html')
-        printer.print_test_result(result, expected=False, exp_str='',
-                                  got_str='')
-
-    def test_print_progress(self):
-        expectations = ''
-
-        printer, err, out = self.get_printer(['--print', 'nothing'])
-        tests = ['passes/text.html', 'failures/expected/timeout.html',
-                 'failures/expected/crash.html']
-        paths, rs, exp = self.get_result_summary(tests, expectations)
-
-        # First, test that we print nothing when we shouldn't print anything.
-        printer.print_progress(rs, False, paths)
-        self.assertEmpty(out)
-        self.assertEmpty(err)
-
-        printer.print_progress(rs, True, paths)
-        self.assertEmpty(out)
-        self.assertEmpty(err)
-
-        # Now test that we do print things.
-        printer, err, out = self.get_printer(['--print', 'one-line-progress'])
-        printer.print_progress(rs, False, paths)
-        self.assertEmpty(out)
-        self.assertNotEmpty(err)
-
-        printer, err, out = self.get_printer(['--print', 'one-line-progress'])
-        printer.print_progress(rs, True, paths)
-        self.assertEmpty(out)
-        self.assertNotEmpty(err)
-
-        printer, err, out = self.get_printer(['--print', 'one-line-progress'])
-        rs.remaining = 0
-        printer.print_progress(rs, False, paths)
-        self.assertEmpty(out)
-        self.assertNotEmpty(err)
-
-        printer.print_progress(rs, True, paths)
-        self.assertEmpty(out)
-        self.assertNotEmpty(err)
-
-
-
-    def test_write_nothing(self):
-        printer, err, out = self.get_printer(['--print', 'nothing'])
-        printer.write("foo")
-        self.assertEmpty(err)
-
-    def test_write_misc(self):
-        printer, err, out = self.get_printer(['--print', 'misc'])
-        printer.write("foo")
-        self.assertNotEmpty(err)
-
-        printer, err, out = self.get_printer(['--print', 'misc'])
-        printer.write("foo", "config")
-        self.assertEmpty(err)
-
-    def test_write_everything(self):
-        printer, err, out = self.get_printer(['--print', 'everything'])
-        printer.write("foo")
-        self.assertNotEmpty(err)
-
-        printer, err, out = self.get_printer(['--print', 'everything'])
-        printer.write("foo", "config")
-        self.assertNotEmpty(err)
-
-    def test_write_verbose(self):
-        printer, err, out = self.get_printer(['--verbose'])
-        printer.write("foo")
-        self.assertTrue("foo" in err.buflist[0])
-        self.assertEmpty(out)
-
     def test_print_unexpected_results(self):
         # This routine is the only one that prints stuff that the bots
         # care about.
@@ -442,37 +199,31 @@ class  Testprinter(unittest.TestCase):
         tests = ['passes/text.html', 'failures/expected/timeout.html', 'failures/expected/crash.html']
         expectations = ''
 
-        printer, err, out = self.get_printer(['--print', 'nothing'])
-        ur = get_unexpected_results(expected=False, passing=False, flaky=False)
-        printer.print_unexpected_results(ur)
-        self.assertEmpty(err)
-        self.assertEmpty(out)
-
-        printer, err, out = self.get_printer(['--print', 'unexpected-results'])
+        printer, err, out = self.get_printer()
 
         # test everything running as expected
         ur = get_unexpected_results(expected=True, passing=False, flaky=False)
-        printer.print_unexpected_results(ur)
+        printer._print_unexpected_results(ur)
         self.assertEmpty(err)
         self.assertEmpty(out)
 
         # test failures
-        printer, err, out = self.get_printer(['--print', 'unexpected-results'])
+        printer, err, out = self.get_printer()
         ur = get_unexpected_results(expected=False, passing=False, flaky=False)
-        printer.print_unexpected_results(ur)
+        printer._print_unexpected_results(ur)
         self.assertEmpty(err)
         self.assertNotEmpty(out)
 
         # test unexpected flaky
-        printer, err, out = self.get_printer(['--print', 'unexpected-results'])
+        printer, err, out = self.get_printer()
         ur = get_unexpected_results(expected=False, passing=False, flaky=True)
-        printer.print_unexpected_results(ur)
+        printer._print_unexpected_results(ur)
         self.assertEmpty(err)
         self.assertNotEmpty(out)
 
-        printer, err, out = self.get_printer(['--print', 'everything'])
+        printer, err, out = self.get_printer()
         ur = get_unexpected_results(expected=False, passing=False, flaky=False)
-        printer.print_unexpected_results(ur)
+        printer._print_unexpected_results(ur)
         self.assertEmpty(err)
         self.assertNotEmpty(out)
 
@@ -480,30 +231,30 @@ class  Testprinter(unittest.TestCase):
 BUGX : failures/expected/crash.html = CRASH
 BUGX : failures/expected/timeout.html = TIMEOUT
 """
-        printer, err, out = self.get_printer(['--print', 'unexpected-results'])
+        printer, err, out = self.get_printer()
         ur = get_unexpected_results(expected=False, passing=False, flaky=False)
-        printer.print_unexpected_results(ur)
+        printer._print_unexpected_results(ur)
         self.assertEmpty(err)
         self.assertNotEmpty(out)
 
-        printer, err, out = self.get_printer(['--print', 'unexpected-results'])
+        printer, err, out = self.get_printer()
         ur = get_unexpected_results(expected=False, passing=True, flaky=False)
-        printer.print_unexpected_results(ur)
+        printer._print_unexpected_results(ur)
         self.assertEmpty(err)
         self.assertNotEmpty(out)
 
-        # Test handling of --verbose as well.
-        printer, err, out = self.get_printer(['--verbose'])
-        ur = get_unexpected_results(expected=False, passing=False, flaky=False)
-        printer.print_unexpected_results(ur)
-        # FIXME: debug output from the port and scm objects may or may not go
-        # to stderr, so there's no point in testing its contents here.
-        self.assertNotEmpty(out)
-
     def test_print_unexpected_results_buildbot(self):
         # FIXME: Test that print_unexpected_results() produces the printer the
         # buildbot is expecting.
         pass
 
+    def test_details(self):
+        printer, err, _ = self.get_printer(['--details'])
+        result = self.get_result('passes/image.html')
+        printer.print_started_test('passes/image.html')
+        printer.print_finished_test(result, expected=False, exp_str='', got_str='')
+        self.assertNotEmpty(err)
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftest.py b/Tools/Scripts/webkitpy/performance_tests/perftest.py
index 8aac78f3d..b111c9b4b 100644
--- a/Tools/Scripts/webkitpy/performance_tests/perftest.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftest.py
@@ -103,8 +103,6 @@ class PerfTest(object):
         # Following is for html5.html
         re.compile(re.escape("""Blocked access to external URL http://www.whatwg.org/specs/web-apps/current-work/"""))]
 
-    _statistics_keys = ['avg', 'median', 'stdev', 'min', 'max']
-
     def _should_ignore_line_in_parser_test_result(self, line):
         if not line:
             return True
@@ -113,48 +111,65 @@ class PerfTest(object):
                 return True
         return False
 
+    _description_regex = re.compile(r'^Description: (?P<description>.*)$', re.IGNORECASE)
+    _result_classes = ['Time', 'JS Heap', 'FastMalloc']
+    _result_class_regex = re.compile(r'^(?P<resultclass>' + r'|'.join(_result_classes) + '):')
+    _statistics_keys = ['avg', 'median', 'stdev', 'min', 'max', 'unit']
+    _score_regex = re.compile(r'^(?P<key>' + r'|'.join(_statistics_keys) + r')\s+(?P<value>[0-9\.]+)\s*(?P<unit>.*)')
+
     def parse_output(self, output):
-        got_a_result = False
         test_failed = False
         results = {}
-        score_regex = re.compile(r'^(?P<key>' + r'|'.join(self._statistics_keys) + r')\s+(?P<value>[0-9\.]+)\s*(?P<unit>.*)')
-        description_regex = re.compile(r'^Description: (?P<description>.*)$', re.IGNORECASE)
+        ordered_results_keys = []
+        test_name = re.sub(r'\.\w+$', '', self._test_name)
         description_string = ""
-        unit = "ms"
-
+        result_class = ""
         for line in re.split('\n', output.text):
-            description = description_regex.match(line)
+            description = self._description_regex.match(line)
             if description:
                 description_string = description.group('description')
                 continue
 
-            score = score_regex.match(line)
+            result_class_match = self._result_class_regex.match(line)
+            if result_class_match:
+                result_class = result_class_match.group('resultclass')
+                continue
+
+            score = self._score_regex.match(line)
             if score:
-                results[score.group('key')] = float(score.group('value'))
-                if score.group('unit'):
-                    unit = score.group('unit')
+                key = score.group('key')
+                value = float(score.group('value'))
+                unit = score.group('unit')
+                name = test_name
+                if result_class != 'Time':
+                    name += ':' + result_class.replace(' ', '')
+                if name not in ordered_results_keys:
+                    ordered_results_keys.append(name)
+                results.setdefault(name, {})
+                results[name]['unit'] = unit
+                results[name][key] = value
                 continue
 
             if not self._should_ignore_line_in_parser_test_result(line):
                 test_failed = True
                 _log.error(line)
 
-        if test_failed or set(self._statistics_keys) != set(results.keys()):
+        if test_failed or set(self._statistics_keys) != set(results[test_name].keys()):
             return None
 
-        results['unit'] = unit
-
-        test_name = re.sub(r'\.\w+$', '', self._test_name)
-        self.output_statistics(test_name, results, description_string)
-
-        return {test_name: results}
+        for result_name in ordered_results_keys:
+            if result_name == test_name:
+                self.output_statistics(result_name, results[result_name], description_string)
+            else:
+                self.output_statistics(result_name, results[result_name])
+        return results
 
-    def output_statistics(self, test_name, results, description_string):
+    def output_statistics(self, test_name, results, description_string=None):
         unit = results['unit']
         if description_string:
             _log.info('DESCRIPTION: %s' % description_string)
-        _log.info('RESULT %s= %s %s' % (test_name.replace('/', ': '), results['avg'], unit))
-        _log.info(', '.join(['%s= %s %s' % (key, results[key], unit) for key in self._statistics_keys[1:]]))
+        _log.info('RESULT %s= %s %s' % (test_name.replace(':', ': ').replace('/', ': '), results['avg'], unit))
+        _log.info(', '.join(['%s= %s %s' % (key, results[key], unit) for key in self._statistics_keys[1:5]]))
 
 
 class ChromiumStylePerfTest(PerfTest):
@@ -165,7 +180,6 @@ class ChromiumStylePerfTest(PerfTest):
 
     def parse_output(self, output):
         test_failed = False
-        got_a_result = False
         results = {}
         for line in re.split('\n', output.text):
             resultLine = ChromiumStylePerfTest._chromium_style_result_regex.match(line)
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftest_unittest.py b/Tools/Scripts/webkitpy/performance_tests/perftest_unittest.py
index 4fca894da..47fe6231c 100755
--- a/Tools/Scripts/webkitpy/performance_tests/perftest_unittest.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftest_unittest.py
@@ -49,11 +49,12 @@ class MainTest(unittest.TestCase):
             'Running 20 times',
             'Ignoring warm-up run (1115)',
             '',
-            'avg 1100',
-            'median 1101',
-            'stdev 11',
-            'min 1080',
-            'max 1120']), image=None, image_hash=None, audio=None)
+            'Time:',
+            'avg 1100 ms',
+            'median 1101 ms',
+            'stdev 11 ms',
+            'min 1080 ms',
+            'max 1120 ms']), image=None, image_hash=None, audio=None)
         output_capture = OutputCapture()
         output_capture.capture_output()
         try:
@@ -61,6 +62,7 @@ class MainTest(unittest.TestCase):
             self.assertEqual(test.parse_output(output),
                 {'some-test': {'avg': 1100.0, 'median': 1101.0, 'min': 1080.0, 'max': 1120.0, 'stdev': 11.0, 'unit': 'ms'}})
         finally:
+            pass
             actual_stdout, actual_stderr, actual_logs = output_capture.restore_output()
         self.assertEqual(actual_stdout, '')
         self.assertEqual(actual_stderr, '')
@@ -73,11 +75,12 @@ class MainTest(unittest.TestCase):
             '',
             'some-unrecognizable-line',
             '',
-            'avg 1100',
-            'median 1101',
-            'stdev 11',
-            'min 1080',
-            'max 1120']), image=None, image_hash=None, audio=None)
+            'Time:'
+            'avg 1100 ms',
+            'median 1101 ms',
+            'stdev 11 ms',
+            'min 1080 ms',
+            'max 1120 ms']), image=None, image_hash=None, audio=None)
         output_capture = OutputCapture()
         output_capture.capture_output()
         try:
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py
index cda3a6b59..b8a2ee4b3 100755
--- a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py
@@ -49,10 +49,13 @@ _log = logging.getLogger(__name__)
 
 class PerfTestsRunner(object):
     _default_branch = 'webkit-trunk'
-    _EXIT_CODE_BAD_BUILD = -1
-    _EXIT_CODE_BAD_JSON = -2
-    _EXIT_CODE_FAILED_UPLOADING = -3
-    _EXIT_CODE_BAD_PREPARATION = -4
+    EXIT_CODE_BAD_BUILD = -1
+    EXIT_CODE_BAD_SOURCE_JSON = -2
+    EXIT_CODE_BAD_MERGE = -3
+    EXIT_CODE_FAILED_UPLOADING = -4
+    EXIT_CODE_BAD_PREPARATION = -5
+
+    _DEFAULT_JSON_FILENAME = 'PerformanceTestsResults.json'
 
     def __init__(self, args=None, port=None):
         self._options, self._args = PerfTestsRunner._parse_args(args)
@@ -93,10 +96,16 @@ class PerfTestsRunner(object):
                 help="Set the timeout for each test"),
             optparse.make_option("--pause-before-testing", dest="pause_before_testing", action="store_true", default=False,
                 help="Pause before running the tests to let user attach a performance monitor."),
+            optparse.make_option("--no-results", action="store_false", dest="generate_results", default=True,
+                help="Do no generate results JSON and results page."),
             optparse.make_option("--output-json-path",
-                help="Filename of the JSON file that summaries the results."),
+                help="Path to generate a JSON file at; may contain previous results if it already exists."),
             optparse.make_option("--source-json-path",
-                help="Path to a JSON file to be merged into the JSON file when --output-json-path is present."),
+                help="Only used on bots. Path to a JSON file to be merged into the JSON file when --output-json-path is present."),
+            optparse.make_option("--description",
+                help="Add a description to the output JSON file if one is generated"),
+            optparse.make_option("--no-show-results", action="store_false", default=True, dest="show_results",
+                help="Don't launch a browser with results after the tests are done"),
             optparse.make_option("--test-results-server",
                 help="Upload the generated JSON file to the specified server when --output-json-path is present."),
             optparse.make_option("--webkit-test-runner", "-2", action="store_true",
@@ -142,86 +151,104 @@ class PerfTestsRunner(object):
     def run(self):
         if not self._port.check_build(needs_http=False):
             _log.error("Build not up to date for %s" % self._port._path_to_driver())
-            return self._EXIT_CODE_BAD_BUILD
+            return self.EXIT_CODE_BAD_BUILD
 
         tests = self._collect_tests()
         _log.info("Running %d tests" % len(tests))
 
         for test in tests:
             if not test.prepare(self._options.time_out_ms):
-                return self._EXIT_CODE_BAD_PREPARATION
+                return self.EXIT_CODE_BAD_PREPARATION
 
         unexpected = self._run_tests_set(sorted(list(tests), key=lambda test: test.test_name()), self._port)
-
-        options = self._options
-        if self._options.output_json_path:
-            # FIXME: Add --branch or auto-detect the branch we're in
-            test_results_server = options.test_results_server
-            branch = self._default_branch if test_results_server else None
-            build_number = int(options.build_number) if options.build_number else None
-
-            if not self._generate_json(self._timestamp, options.output_json_path, options.source_json_path,
-                not test_results_server,
-                branch, options.platform, options.builder_name, build_number) and not unexpected:
-                return self._EXIT_CODE_BAD_JSON
-
-            if test_results_server and not self._upload_json(test_results_server, options.output_json_path):
-                return self._EXIT_CODE_FAILED_UPLOADING
+        if self._options.generate_results:
+            exit_code = self._generate_and_show_results()
+            if exit_code:
+                return exit_code
 
         return unexpected
 
-    def _generate_json(self, timestamp, output_json_path, source_json_path, should_generate_results_page,
-        branch, platform, builder_name, build_number):
+    def _output_json_path(self):
+        output_json_path = self._options.output_json_path
+        if output_json_path:
+            return output_json_path
+        return self._host.filesystem.join(self._port.perf_results_directory(), self._DEFAULT_JSON_FILENAME)
 
-        contents = {'timestamp': int(timestamp), 'results': self._results}
+    def _generate_and_show_results(self):
+        options = self._options
+        output_json_path = self._output_json_path()
+        output = self._generate_results_dict(self._timestamp, options.description, options.platform, options.builder_name, options.build_number)
+
+        if options.source_json_path:
+            output = self._merge_source_json(options.source_json_path, output)
+            if not output:
+                return self.EXIT_CODE_BAD_SOURCE_JSON
+
+        test_results_server = options.test_results_server
+        results_page_path = None
+        if not test_results_server:
+            output = self._merge_outputs(output_json_path, output)
+            if not output:
+                return self.EXIT_CODE_BAD_MERGE
+            results_page_path = self._host.filesystem.splitext(output_json_path)[0] + '.html'
+
+        self._generate_output_files(output_json_path, results_page_path, output)
+
+        if test_results_server:
+            if not self._upload_json(test_results_server, output_json_path):
+                return self.EXIT_CODE_FAILED_UPLOADING
+        elif options.show_results:
+            self._port.show_results_html_file(results_page_path)
+
+    def _generate_results_dict(self, timestamp, description, platform, builder_name, build_number):
+        contents = {'results': self._results}
+        if description:
+            contents['description'] = description
         for (name, path) in self._port.repository_paths():
             contents[name + '-revision'] = self._host.scm().svn_revision(path)
 
-        for key, value in {'branch': branch, 'platform': platform, 'builder-name': builder_name, 'build-number': build_number}.items():
+        # FIXME: Add --branch or auto-detect the branch we're in
+        for key, value in {'timestamp': int(timestamp), 'branch': self._default_branch, 'platform': platform,
+            'builder-name': builder_name, 'build-number': int(build_number) if build_number else None}.items():
             if value:
                 contents[key] = value
 
-        filesystem = self._host.filesystem
-        succeeded = False
-        if source_json_path:
-            try:
-                source_json_file = filesystem.open_text_file_for_reading(source_json_path)
-                source_json = json.load(source_json_file)
-                contents = dict(source_json.items() + contents.items())
-                succeeded = True
-            except IOError, error:
-                _log.error("Failed to read %s: %s" % (source_json_path, error))
-            except ValueError, error:
-                _log.error("Failed to parse %s: %s" % (source_json_path, error))
-            except TypeError, error:
-                _log.error("Failed to merge JSON files: %s" % error)
-            if not succeeded:
-                return False
-
-        if should_generate_results_page:
-            if filesystem.isfile(output_json_path):
-                existing_contents = json.loads(filesystem.read_text_file(output_json_path))
-                existing_contents.append(contents)
-                contents = existing_contents
-            else:
-                contents = [contents]
+        return contents
 
-        serialized_contents = json.dumps(contents)
-        filesystem.write_text_file(output_json_path, serialized_contents)
+    def _merge_source_json(self, source_json_path, output):
+        try:
+            source_json_file = self._host.filesystem.open_text_file_for_reading(source_json_path)
+            source_json = json.load(source_json_file)
+            return dict(source_json.items() + output.items())
+        except Exception, error:
+            _log.error("Failed to merge source JSON file %s: %s" % (source_json_path, error))
+        return None
+
+    def _merge_outputs(self, output_json_path, output):
+        if not self._host.filesystem.isfile(output_json_path):
+            return [output]
+        try:
+            existing_outputs = json.loads(self._host.filesystem.read_text_file(output_json_path))
+            return existing_outputs + [output]
+        except Exception, error:
+            _log.error("Failed to merge output JSON file %s: %s" % (output_json_path, error))
+        return None
 
-        if should_generate_results_page:
-            jquery_path = filesystem.join(self._port.perf_tests_dir(), 'Dromaeo/resources/dromaeo/web/lib/jquery-1.6.4.js')
-            jquery = filesystem.read_text_file(jquery_path)
+    def _generate_output_files(self, output_json_path, results_page_path, output):
+        filesystem = self._host.filesystem
+
+        json_output = json.dumps(output)
+        filesystem.write_text_file(output_json_path, json_output)
 
+        if results_page_path:
             template_path = filesystem.join(self._port.perf_tests_dir(), 'resources/results-template.html')
             template = filesystem.read_text_file(template_path)
 
-            results_page = template.replace('<?WebKitPerfTestRunnerInsertionPoint?>',
-                '<script>%s</script><script id="json">%s</script>' % (jquery, serialized_contents))
+            absolute_path_to_trunk = filesystem.dirname(self._port.perf_tests_dir())
+            results_page = template.replace('%AbsolutePathToWebKitTrunk%', absolute_path_to_trunk)
+            results_page = results_page.replace('%PeformanceTestsResultsJSON%', json_output)
 
-            filesystem.write_text_file(filesystem.splitext(output_json_path)[0] + '.html', results_page)
-
-        return True
+            filesystem.write_text_file(results_page_path, results_page)
 
     def _upload_json(self, test_results_server, json_path, file_uploader=FileUploader):
         uploader = file_uploader("https://%s/api/test/report" % test_results_server, 120)
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
index 389201521..ef459cd69 100755
--- a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
@@ -87,21 +87,48 @@ Ignoring warm-up run (1502)
 1475
 1471
 
-avg 1489.05
-median 1487
-stdev 14.46
-min 1471
-max 1510
+Time:
+avg 1489.05 ms
+median 1487 ms
+stdev 14.46 ms
+min 1471 ms
+max 1510 ms
 """
             elif driver_input.test_name.endswith('some-parser.html'):
                 text = """Running 20 times
 Ignoring warm-up run (1115)
 
-avg 1100
-median 1101
-stdev 11
-min 1080
-max 1120
+Time:
+avg 1100 ms
+median 1101 ms
+stdev 11 ms
+min 1080 ms
+max 1120 ms
+"""
+            elif driver_input.test_name.endswith('memory-test.html'):
+                text = """Running 20 times
+Ignoring warm-up run (1115)
+
+Time:
+avg 1100 ms
+median 1101 ms
+stdev 11 ms
+min 1080 ms
+max 1120 ms
+
+JS Heap:
+avg 832000 bytes
+median 829000 bytes
+stdev 15000 bytes
+min 811000 bytes
+max 848000 bytes
+
+FastMalloc:
+avg 532000 bytes
+median 529000 bytes
+stdev 13000 bytes
+min 511000 bytes
+max 548000 bytes
 """
             return DriverOutput(text, '', '', '', crash=crash, timeout=timeout)
 
@@ -120,6 +147,9 @@ max 1120
         runner._host.filesystem.maybe_make_directory(runner._base_path, 'inspector')
         runner._host.filesystem.maybe_make_directory(runner._base_path, 'Bindings')
         runner._host.filesystem.maybe_make_directory(runner._base_path, 'Parser')
+
+        filesystem = runner._host.filesystem
+        runner.load_output_json = lambda: json.loads(filesystem.read_text_file(runner._output_json_path()))
         return runner, test_port
 
     def run_test(self, test_name):
@@ -225,6 +255,33 @@ max 1120
         'median= 1101.0 ms, stdev= 11.0 ms, min= 1080.0 ms, max= 1120.0 ms',
         '', '']))
 
+    def test_run_memory_test(self):
+        runner, port = self.create_runner_and_setup_results_template()
+        runner._timestamp = 123456789
+        port.host.filesystem.write_text_file(runner._base_path + '/Parser/memory-test.html', 'some content')
+
+        output = OutputCapture()
+        output.capture_output()
+        try:
+            unexpected_result_count = runner.run()
+        finally:
+            stdout, stderr, log = output.restore_output()
+        self.assertEqual(unexpected_result_count, 0)
+        self.assertEqual(log, '\n'.join([
+            'Running 1 tests',
+            'Running Parser/memory-test.html (1 of 1)',
+            'RESULT Parser: memory-test= 1100.0 ms',
+            'median= 1101.0 ms, stdev= 11.0 ms, min= 1080.0 ms, max= 1120.0 ms',
+            'RESULT Parser: memory-test: JSHeap= 832000.0 bytes',
+            'median= 829000.0 bytes, stdev= 15000.0 bytes, min= 811000.0 bytes, max= 848000.0 bytes',
+            'RESULT Parser: memory-test: FastMalloc= 532000.0 bytes',
+            'median= 529000.0 bytes, stdev= 13000.0 bytes, min= 511000.0 bytes, max= 548000.0 bytes',
+            '', '']))
+        results = runner.load_output_json()[0]['results']
+        self.assertEqual(results['Parser/memory-test'], {'min': 1080.0, 'max': 1120.0, 'median': 1101.0, 'stdev': 11.0, 'avg': 1100.0, 'unit': 'ms'})
+        self.assertEqual(results['Parser/memory-test:JSHeap'], {'min': 811000.0, 'max': 848000.0, 'median': 829000.0, 'stdev': 15000.0, 'avg': 832000.0, 'unit': 'bytes'})
+        self.assertEqual(results['Parser/memory-test:FastMalloc'], {'min': 511000.0, 'max': 548000.0, 'median': 529000.0, 'stdev': 13000.0, 'avg': 532000.0, 'unit': 'bytes'})
+
     def _test_run_with_json_output(self, runner, filesystem, upload_suceeds=True, expected_exit_code=0):
         filesystem.write_text_file(runner._base_path + '/inspector/pass.html', 'some content')
         filesystem.write_text_file(runner._base_path + '/Bindings/event-target-wrapper.html', 'some content')
@@ -246,78 +303,148 @@ max 1120
         finally:
             stdout, stderr, logs = output_capture.restore_output()
 
-        self.assertEqual(logs, '\n'.join([
-            'Running 2 tests',
-            'Running Bindings/event-target-wrapper.html (1 of 2)',
-            'RESULT Bindings: event-target-wrapper= 1489.05 ms',
-            'median= 1487.0 ms, stdev= 14.46 ms, min= 1471.0 ms, max= 1510.0 ms',
-            '',
-            'Running inspector/pass.html (2 of 2)',
-            'RESULT group_name: test_name= 42 ms',
-            '',
-            '']))
+        if not expected_exit_code:
+            self.assertEqual(logs, '\n'.join([
+                'Running 2 tests',
+                'Running Bindings/event-target-wrapper.html (1 of 2)',
+                'RESULT Bindings: event-target-wrapper= 1489.05 ms',
+                'median= 1487.0 ms, stdev= 14.46 ms, min= 1471.0 ms, max= 1510.0 ms',
+                '',
+                'Running inspector/pass.html (2 of 2)',
+                'RESULT group_name: test_name= 42 ms',
+                '',
+                '']))
 
         return uploaded[0]
 
+    _event_target_wrapper_and_inspector_results = {
+        "Bindings/event-target-wrapper": {"max": 1510, "avg": 1489.05, "median": 1487, "min": 1471, "stdev": 14.46, "unit": "ms"},
+        "inspector/pass.html:group_name:test_name": 42}
+
     def test_run_with_json_output(self):
         runner, port = self.create_runner(args=['--output-json-path=/mock-checkout/output.json',
             '--test-results-server=some.host'])
         self._test_run_with_json_output(runner, port.host.filesystem)
-        self.assertEqual(json.loads(port.host.filesystem.read_text_file('/mock-checkout/output.json')), {
-            "timestamp": 123456789, "results":
-            {"Bindings/event-target-wrapper": {"max": 1510, "avg": 1489.05, "median": 1487, "min": 1471, "stdev": 14.46, "unit": "ms"},
-            "inspector/pass.html:group_name:test_name": 42},
-            "webkit-revision": 5678, "branch": "webkit-trunk"})
-
-    def test_run_generates_results_page(self):
-        runner, port = self.create_runner(args=['--output-json-path=/mock-checkout/output.json'])
+        self.assertEqual(runner.load_output_json(), {
+            "timestamp": 123456789, "results": self._event_target_wrapper_and_inspector_results,
+            "webkit-revision": "5678", "branch": "webkit-trunk"})
+
+    def test_run_with_description(self):
+        runner, port = self.create_runner(args=['--output-json-path=/mock-checkout/output.json',
+            '--test-results-server=some.host', '--description', 'some description'])
+        self._test_run_with_json_output(runner, port.host.filesystem)
+        self.assertEqual(runner.load_output_json(), {
+            "timestamp": 123456789, "description": "some description",
+            "results": self._event_target_wrapper_and_inspector_results,
+            "webkit-revision": "5678", "branch": "webkit-trunk"})
+
+    def create_runner_and_setup_results_template(self, args=[]):
+        runner, port = self.create_runner(args)
         filesystem = port.host.filesystem
-        print runner._base_path + '/resources/results-template.html'
         filesystem.write_text_file(runner._base_path + '/resources/results-template.html',
-            'BEGIN<?WebKitPerfTestRunnerInsertionPoint?>END')
-        filesystem.write_text_file(runner._base_path + '/Dromaeo/resources/dromaeo/web/lib/jquery-1.6.4.js',
-            'jquery content')
+            'BEGIN<script src="%AbsolutePathToWebKitTrunk%/some.js"></script>'
+            '<script src="%AbsolutePathToWebKitTrunk%/other.js"></script><script>%PeformanceTestsResultsJSON%</script>END')
+        filesystem.write_text_file(runner._base_path + '/Dromaeo/resources/dromaeo/web/lib/jquery-1.6.4.js', 'jquery content')
+        return runner, port
 
+    def test_run_respects_no_results(self):
+        runner, port = self.create_runner(args=['--output-json-path=/mock-checkout/output.json',
+            '--test-results-server=some.host', '--no-results'])
+        self.assertFalse(self._test_run_with_json_output(runner, port.host.filesystem))
+        self.assertFalse(port.host.filesystem.isfile('/mock-checkout/output.json'))
+
+    def test_run_generates_json_by_default(self):
+        runner, port = self.create_runner_and_setup_results_template()
+        filesystem = port.host.filesystem
+        output_json_path = filesystem.join(port.perf_results_directory(), runner._DEFAULT_JSON_FILENAME)
+        results_page_path = filesystem.splitext(output_json_path)[0] + '.html'
+
+        self.assertFalse(filesystem.isfile(output_json_path))
+        self.assertFalse(filesystem.isfile(results_page_path))
+
+        self._test_run_with_json_output(runner, port.host.filesystem)
+
+        self.assertEqual(json.loads(port.host.filesystem.read_text_file(output_json_path)), [{
+            "timestamp": 123456789, "results": self._event_target_wrapper_and_inspector_results,
+            "webkit-revision": "5678", "branch": "webkit-trunk"}])
+
+        self.assertTrue(filesystem.isfile(output_json_path))
+        self.assertTrue(filesystem.isfile(results_page_path))
+
+    def test_run_generates_and_show_results_page(self):
+        runner, port = self.create_runner_and_setup_results_template(args=['--output-json-path=/mock-checkout/output.json'])
+        page_shown = []
+        port.show_results_html_file = lambda path: page_shown.append(path)
+        filesystem = port.host.filesystem
         self._test_run_with_json_output(runner, filesystem)
 
-        expected_entry = {"timestamp": 123456789, "results": {"Bindings/event-target-wrapper":
-            {"max": 1510, "avg": 1489.05, "median": 1487, "min": 1471, "stdev": 14.46, "unit": "ms"},
-            "inspector/pass.html:group_name:test_name": 42}, "webkit-revision": 5678}
+        expected_entry = {"timestamp": 123456789, "results": self._event_target_wrapper_and_inspector_results,
+            "webkit-revision": "5678", "branch": "webkit-trunk"}
 
         self.maxDiff = None
         json_output = port.host.filesystem.read_text_file('/mock-checkout/output.json')
         self.assertEqual(json.loads(json_output), [expected_entry])
         self.assertEqual(filesystem.read_text_file('/mock-checkout/output.html'),
-            'BEGIN<script>jquery content</script><script id="json">' + json_output + '</script>END')
+            'BEGIN<script src="/test.checkout/some.js"></script><script src="/test.checkout/other.js"></script>'
+            '<script>%s</script>END' % json_output)
+        self.assertEqual(page_shown[0], '/mock-checkout/output.html')
 
         self._test_run_with_json_output(runner, filesystem)
         json_output = port.host.filesystem.read_text_file('/mock-checkout/output.json')
         self.assertEqual(json.loads(json_output), [expected_entry, expected_entry])
         self.assertEqual(filesystem.read_text_file('/mock-checkout/output.html'),
-            'BEGIN<script>jquery content</script><script id="json">' + json_output + '</script>END')
+            'BEGIN<script src="/test.checkout/some.js"></script><script src="/test.checkout/other.js"></script>'
+            '<script>%s</script>END' % json_output)
+
+    def test_run_respects_no_show_results(self):
+        show_results_html_file = lambda path: page_shown.append(path)
+
+        runner, port = self.create_runner_and_setup_results_template(args=['--output-json-path=/mock-checkout/output.json'])
+        page_shown = []
+        port.show_results_html_file = show_results_html_file
+        self._test_run_with_json_output(runner, port.host.filesystem)
+        self.assertEqual(page_shown[0], '/mock-checkout/output.html')
+
+        runner, port = self.create_runner_and_setup_results_template(args=['--output-json-path=/mock-checkout/output.json',
+            '--no-show-results'])
+        page_shown = []
+        port.show_results_html_file = show_results_html_file
+        self._test_run_with_json_output(runner, port.host.filesystem)
+        self.assertEqual(page_shown, [])
+
+    def test_run_with_bad_output_json(self):
+        runner, port = self.create_runner_and_setup_results_template(args=['--output-json-path=/mock-checkout/output.json'])
+        port.host.filesystem.write_text_file('/mock-checkout/output.json', 'bad json')
+        self._test_run_with_json_output(runner, port.host.filesystem, expected_exit_code=PerfTestsRunner.EXIT_CODE_BAD_MERGE)
+        port.host.filesystem.write_text_file('/mock-checkout/output.json', '{"another bad json": "1"}')
+        self._test_run_with_json_output(runner, port.host.filesystem, expected_exit_code=PerfTestsRunner.EXIT_CODE_BAD_MERGE)
 
     def test_run_with_json_source(self):
         runner, port = self.create_runner(args=['--output-json-path=/mock-checkout/output.json',
             '--source-json-path=/mock-checkout/source.json', '--test-results-server=some.host'])
         port.host.filesystem.write_text_file('/mock-checkout/source.json', '{"key": "value"}')
         self._test_run_with_json_output(runner, port.host.filesystem)
-        self.assertEqual(json.loads(port.host.filesystem.files['/mock-checkout/output.json']), {
-            "timestamp": 123456789, "results":
-            {"Bindings/event-target-wrapper": {"max": 1510, "avg": 1489.05, "median": 1487, "min": 1471, "stdev": 14.46, "unit": "ms"},
-            "inspector/pass.html:group_name:test_name": 42},
-            "webkit-revision": 5678, "branch": "webkit-trunk",
-            "key": "value"})
+        self.assertEqual(runner.load_output_json(), {
+            "timestamp": 123456789, "results": self._event_target_wrapper_and_inspector_results,
+            "webkit-revision": "5678", "branch": "webkit-trunk", "key": "value"})
+
+    def test_run_with_bad_json_source(self):
+        runner, port = self.create_runner(args=['--output-json-path=/mock-checkout/output.json',
+            '--source-json-path=/mock-checkout/source.json', '--test-results-server=some.host'])
+        self._test_run_with_json_output(runner, port.host.filesystem, expected_exit_code=PerfTestsRunner.EXIT_CODE_BAD_SOURCE_JSON)
+        port.host.filesystem.write_text_file('/mock-checkout/source.json', 'bad json')
+        self._test_run_with_json_output(runner, port.host.filesystem, expected_exit_code=PerfTestsRunner.EXIT_CODE_BAD_SOURCE_JSON)
+        port.host.filesystem.write_text_file('/mock-checkout/source.json', '["another bad json"]')
+        self._test_run_with_json_output(runner, port.host.filesystem, expected_exit_code=PerfTestsRunner.EXIT_CODE_BAD_SOURCE_JSON)
 
     def test_run_with_multiple_repositories(self):
         runner, port = self.create_runner(args=['--output-json-path=/mock-checkout/output.json',
             '--test-results-server=some.host'])
         port.repository_paths = lambda: [('webkit', '/mock-checkout'), ('some', '/mock-checkout/some')]
         self._test_run_with_json_output(runner, port.host.filesystem)
-        self.assertEqual(json.loads(port.host.filesystem.files['/mock-checkout/output.json']), {
-            "timestamp": 123456789, "results":
-            {"Bindings/event-target-wrapper": {"max": 1510, "avg": 1489.05, "median": 1487, "min": 1471, "stdev": 14.46, "unit": "ms"},
-            "inspector/pass.html:group_name:test_name": 42.0},
-            "webkit-revision": 5678, "some-revision": 5678, "branch": "webkit-trunk"})
+        self.assertEqual(runner.load_output_json(), {
+            "timestamp": 123456789, "results": self._event_target_wrapper_and_inspector_results,
+            "webkit-revision": "5678", "some-revision": "5678", "branch": "webkit-trunk"})
 
     def test_run_with_upload_json(self):
         runner, port = self.create_runner(args=['--output-json-path=/mock-checkout/output.json',
@@ -329,7 +456,7 @@ max 1120
         self.assertEqual(generated_json['builder-name'], 'builder1')
         self.assertEqual(generated_json['build-number'], 123)
 
-        self._test_run_with_json_output(runner, port.host.filesystem, upload_suceeds=False, expected_exit_code=-3)
+        self._test_run_with_json_output(runner, port.host.filesystem, upload_suceeds=False, expected_exit_code=PerfTestsRunner.EXIT_CODE_FAILED_UPLOADING)
 
     def test_upload_json(self):
         runner, port = self.create_runner()
diff --git a/Tools/Scripts/webkitpy/test/finder.py b/Tools/Scripts/webkitpy/test/finder.py
index fcbb0e9cf..21eceac06 100644
--- a/Tools/Scripts/webkitpy/test/finder.py
+++ b/Tools/Scripts/webkitpy/test/finder.py
@@ -25,7 +25,6 @@
 
 import logging
 import re
-import sys
 
 
 _log = logging.getLogger(__name__)
@@ -77,10 +76,14 @@ class Finder(object):
     def __init__(self, filesystem):
         self.filesystem = filesystem
         self.trees = []
+        self._names_to_skip = []
 
     def add_tree(self, top_directory, starting_subdirectory=None):
         self.trees.append(_DirectoryTree(self.filesystem, top_directory, starting_subdirectory))
 
+    def skip(self, names, reason, bugid):
+        self._names_to_skip.append(tuple([names, reason, bugid]))
+
     def additional_paths(self, paths):
         return [tree.top_directory for tree in self.trees if tree.top_directory not in paths]
 
@@ -101,18 +104,15 @@ class Finder(object):
                 return tree.to_module(path)
         return None
 
-    def find_names(self, args, skip_integrationtests, find_all, skip_if_parallel=True):
-        suffixes = ['_unittest.py']
-        if not skip_integrationtests:
-            suffixes.append('_integrationtest.py')
-
+    def find_names(self, args, find_all):
+        suffixes = ['_unittest.py', '_integrationtest.py']
         if args:
             names = []
             for arg in args:
                 names.extend(self._find_names_for_arg(arg, suffixes))
             return names
 
-        return self._default_names(suffixes, find_all, skip_if_parallel)
+        return self._default_names(suffixes, find_all)
 
     def _find_names_for_arg(self, arg, suffixes):
         realpath = self.filesystem.realpath(arg)
@@ -145,7 +145,7 @@ class Finder(object):
                 return tree.find_modules(suffixes, path)
         return []
 
-    def _default_names(self, suffixes, find_all, skip_if_parallel):
+    def _default_names(self, suffixes, find_all):
         modules = []
         for tree in self.trees:
             modules.extend(tree.find_modules(suffixes))
@@ -154,16 +154,9 @@ class Finder(object):
         for module in modules:
             _log.debug("Found: %s" % module)
 
-        # FIXME: Figure out how to move this to test-webkitpy in order to to make this file more generic.
         if not find_all:
-            slow_tests = ('webkitpy.common.checkout.scm.scm_unittest',)
-            self._exclude(modules, slow_tests, 'are really, really slow', 31818)
-
-            if sys.platform == 'win32':
-                win32_blacklist = ('webkitpy.common.checkout',
-                                   'webkitpy.common.config',
-                                   'webkitpy.tool')
-                self._exclude(modules, win32_blacklist, 'fail horribly on win32', 54526)
+            for (names, reason, bugid) in self._names_to_skip:
+                self._exclude(modules, names, reason, bugid)
 
         return modules
 
diff --git a/Tools/Scripts/webkitpy/test/finder_unittest.py b/Tools/Scripts/webkitpy/test/finder_unittest.py
index 386c579c7..5c808a17e 100644
--- a/Tools/Scripts/webkitpy/test/finder_unittest.py
+++ b/Tools/Scripts/webkitpy/test/finder_unittest.py
@@ -79,17 +79,15 @@ class FinderTest(unittest.TestCase):
         self.finder.clean_trees()
         self.assertFalse(self.fs.exists('/foo2/bar2/missing.pyc'))
 
-    def check_names(self, names, expected_names, skip_integrationtests=False, find_all=False):
-        self.assertEquals(self.finder.find_names(names, skip_integrationtests, find_all),
-                          expected_names)
+    def check_names(self, names, expected_names, find_all=True):
+        self.assertEquals(self.finder.find_names(names, find_all), expected_names)
 
     def test_default_names(self):
-        self.check_names([], ['bar.baz_unittest', 'bar2.baz2_integrationtest'])
-        self.check_names([], ['bar.baz_unittest'], skip_integrationtests=True, find_all=True)
-        self.check_names([], ['bar.baz_unittest'], skip_integrationtests=True, find_all=False)
+        self.check_names([], ['bar.baz_unittest', 'bar2.baz2_integrationtest'], find_all=True)
+        self.check_names([], ['bar.baz_unittest', 'bar2.baz2_integrationtest'], find_all=False)
 
         # Should return the names given it, even if they don't exist.
-        self.check_names(['foobar'], ['foobar'], skip_integrationtests=True, find_all=False)
+        self.check_names(['foobar'], ['foobar'], find_all=False)
 
     def test_paths(self):
         self.fs.chdir('/foo/bar')
diff --git a/Tools/Scripts/webkitpy/test/main.py b/Tools/Scripts/webkitpy/test/main.py
index 986af56b8..28de8a6e0 100644
--- a/Tools/Scripts/webkitpy/test/main.py
+++ b/Tools/Scripts/webkitpy/test/main.py
@@ -29,13 +29,14 @@ import optparse
 import os
 import StringIO
 import sys
+import time
 import traceback
 import unittest
 
 from webkitpy.common.system.filesystem import FileSystem
 from webkitpy.test.finder import Finder
 from webkitpy.test.printer import Printer
-from webkitpy.test.runner import Runner
+from webkitpy.test.runner import Runner, unit_test_name
 
 _log = logging.getLogger(__name__)
 
@@ -48,7 +49,11 @@ def main():
     tester.add_tree(os.path.join(webkit_root, 'Tools', 'Scripts'), 'webkitpy')
     tester.add_tree(os.path.join(webkit_root, 'Source', 'WebKit2', 'Scripts'), 'webkit2')
 
-    # FIXME: Do we need to be able to test QueueStatusServer on Windows as well?
+    tester.skip(('webkitpy.common.checkout.scm.scm_unittest',), 'are really, really, slow', 31818)
+    if sys.platform == 'win32':
+        tester.skip(('webkitpy.common.checkout', 'webkitpy.common.config', 'webkitpy.tool'), 'fail horribly on win32', 54526)
+
+    # This only needs to run on Unix, so don't worry about win32 for now.
     appengine_sdk_path = '/usr/local/google_appengine'
     if os.path.exists(appengine_sdk_path):
         if not appengine_sdk_path in sys.path:
@@ -73,24 +78,27 @@ class Tester(object):
     def add_tree(self, top_directory, starting_subdirectory=None):
         self.finder.add_tree(top_directory, starting_subdirectory)
 
+    def skip(self, names, reason, bugid):
+        self.finder.skip(names, reason, bugid)
+
     def _parse_args(self):
         parser = optparse.OptionParser(usage='usage: %prog [options] [args...]')
         parser.add_option('-a', '--all', action='store_true', default=False,
                           help='run all the tests')
         parser.add_option('-c', '--coverage', action='store_true', default=False,
                           help='generate code coverage info (requires http://pypi.python.org/pypi/coverage)')
+        parser.add_option('-i', '--integration-tests', action='store_true', default=False,
+                          help='run integration tests as well as unit tests'),
+        parser.add_option('-j', '--child-processes', action='store', type='int', default=(1 if sys.platform == 'win32' else multiprocessing.cpu_count()),
+                          help='number of tests to run in parallel (default=%default)')
+        parser.add_option('-p', '--pass-through', action='store_true', default=False,
+                          help='be debugger friendly by passing captured output through to the system')
         parser.add_option('-q', '--quiet', action='store_true', default=False,
                           help='run quietly (errors, warnings, and progress only)')
         parser.add_option('-t', '--timing', action='store_true', default=False,
                           help='display per-test execution time (implies --verbose)')
         parser.add_option('-v', '--verbose', action='count', default=0,
                           help='verbose output (specify once for individual test results, twice for debug messages)')
-        parser.add_option('--skip-integrationtests', action='store_true', default=False,
-                          help='do not run the integration tests')
-        parser.add_option('-p', '--pass-through', action='store_true', default=False,
-                          help='be debugger friendly by passing captured output through to the system')
-        parser.add_option('-j', '--child-processes', action='store', type='int', default=(1 if sys.platform == 'win32' else multiprocessing.cpu_count()),
-                          help='number of tests to run in parallel (default=%default)')
 
         parser.epilog = ('[args...] is an optional list of modules, test_classes, or individual tests. '
                          'If no args are given, all the tests will be run.')
@@ -103,7 +111,7 @@ class Tester(object):
 
         self.finder.clean_trees()
 
-        names = self.finder.find_names(args, self._options.skip_integrationtests, self._options.all, self._options.child_processes != 1)
+        names = self.finder.find_names(args, self._options.all)
         if not names:
             _log.error('No tests to run')
             return False
@@ -111,22 +119,51 @@ class Tester(object):
         return self._run_tests(names)
 
     def _run_tests(self, names):
+        # Make sure PYTHONPATH is set up properly.
+        sys.path = self.finder.additional_paths(sys.path) + sys.path
+
+        # We autoinstall everything up so that we can run tests concurrently
+        # and not have to worry about autoinstalling packages concurrently.
+        self.printer.write_update("Checking autoinstalled packages ...")
+        from webkitpy.thirdparty import autoinstall_everything
+        installed_something = autoinstall_everything()
+
+        # FIXME: There appears to be a bug in Python 2.6.1 that is causing multiprocessing
+        # to hang after we install the packages in a clean checkout.
+        if installed_something:
+            _log.warning("We installed new packages, so running things serially at first")
+            self._options.child_processes = 1
+
         if self._options.coverage:
-            try:
-                import webkitpy.thirdparty.autoinstalled.coverage as coverage
-            except ImportError:
-                _log.error("Failed to import 'coverage'; can't generate coverage numbers.")
-                return False
+            import webkitpy.thirdparty.autoinstalled.coverage as coverage
             cov = coverage.coverage()
             cov.start()
 
-        # Make sure PYTHONPATH is set up properly.
-        sys.path = self.finder.additional_paths(sys.path) + sys.path
+        self.printer.write_update("Checking imports ...")
+        if not self._check_imports(names):
+            return False
+
+        self.printer.write_update("Finding the individual test methods ...")
+        loader = _Loader()
+        parallel_tests, serial_tests = self._test_names(loader, names)
 
-        _log.debug("Loading the tests...")
+        self.printer.write_update("Running the tests ...")
+        self.printer.num_tests = len(parallel_tests) + len(serial_tests)
+        start = time.time()
+        test_runner = Runner(self.printer, loader)
+        test_runner.run(parallel_tests, self._options.child_processes)
+        test_runner.run(serial_tests, 1)
 
-        loader = unittest.defaultTestLoader
-        suites = []
+        self.printer.print_result(time.time() - start)
+
+        if self._options.coverage:
+            cov.stop()
+            cov.save()
+            cov.report(show_missing=False)
+
+        return not self.printer.num_errors and not self.printer.num_failures
+
+    def _check_imports(self, names):
         for name in names:
             if self.finder.is_module(name):
                 # if we failed to load a name and it looks like a module,
@@ -138,19 +175,33 @@ class Tester(object):
                     _log.fatal('Failed to import %s:' % name)
                     self._log_exception()
                     return False
+        return True
 
-            suites.append(loader.loadTestsFromName(name, None))
+    def _test_names(self, loader, names):
+        if self._options.integration_tests:
+            loader.test_method_prefixes.append('integration_test_')
 
-        test_suite = unittest.TestSuite(suites)
-        test_runner = Runner(self.printer, self._options, loader)
+        parallel_tests = []
+        if self._options.child_processes > 1:
+            for name in names:
+                parallel_tests.extend(self._all_test_names(loader.loadTestsFromName(name, None)))
+            loader.test_method_prefixes = []
 
-        _log.debug("Running the tests.")
-        result = test_runner.run(test_suite)
-        if self._options.coverage:
-            cov.stop()
-            cov.save()
-            cov.report(show_missing=False)
-        return result.wasSuccessful()
+        serial_tests = []
+        loader.test_method_prefixes.extend(['serial_test_', 'serial_integration_test_'])
+        for name in names:
+            serial_tests.extend(self._all_test_names(loader.loadTestsFromName(name, None)))
+
+        return (parallel_tests, serial_tests)
+
+    def _all_test_names(self, suite):
+        names = []
+        if hasattr(suite, '_tests'):
+            for t in suite._tests:
+                names.extend(self._all_test_names(t))
+        else:
+            names.append(unit_test_name(suite))
+        return names
 
     def _log_exception(self):
         s = StringIO.StringIO()
@@ -158,5 +209,19 @@ class Tester(object):
         for l in s.buflist:
             _log.error('  ' + l.rstrip())
 
+
+class _Loader(unittest.TestLoader):
+    test_method_prefixes = ['test_']
+
+    def getTestCaseNames(self, testCaseClass):
+        def isTestMethod(attrname, testCaseClass=testCaseClass):
+            if not hasattr(getattr(testCaseClass, attrname), '__call__'):
+                return False
+            return (any(attrname.startswith(prefix) for prefix in self.test_method_prefixes))
+        testFnNames = filter(isTestMethod, dir(testCaseClass))
+        testFnNames.sort()
+        return testFnNames
+
+
 if __name__ == '__main__':
     sys.exit(main())
diff --git a/Tools/Scripts/webkitpy/test/main_unittest.py b/Tools/Scripts/webkitpy/test/main_unittest.py
index 61e49a7b9..ca7ebba0e 100644
--- a/Tools/Scripts/webkitpy/test/main_unittest.py
+++ b/Tools/Scripts/webkitpy/test/main_unittest.py
@@ -41,13 +41,13 @@ class TesterTest(unittest.TestCase):
         root_logger.handlers = []
 
         tester.printer.stream = errors
-        tester.finder.find_names = lambda args, skip_integration, run_all, skip_if_parallel: []
+        tester.finder.find_names = lambda args, run_all: []
         oc = OutputCapture()
         try:
             oc.capture_output()
             self.assertFalse(tester.run())
         finally:
-            out, err, logs = oc.restore_output()
+            _, _, logs = oc.restore_output()
             root_logger.handlers = root_handlers
 
         self.assertTrue('No tests to run' in errors.getvalue())
diff --git a/Tools/Scripts/webkitpy/test/printer.py b/Tools/Scripts/webkitpy/test/printer.py
index 042fba13c..0ec3035b3 100644
--- a/Tools/Scripts/webkitpy/test/printer.py
+++ b/Tools/Scripts/webkitpy/test/printer.py
@@ -37,6 +37,8 @@ class Printer(object):
         self.options = options
         self.num_tests = 0
         self.num_completed = 0
+        self.num_errors = 0
+        self.num_failures = 0
         self.running_tests = []
         self.completed_tests = []
         if options:
@@ -102,6 +104,9 @@ class Printer(object):
         if self.options.pass_through:
             outputcapture.OutputCapture.stream_wrapper = _CaptureAndPassThroughStream
 
+    def write_update(self, msg):
+        self.meter.write_update(msg)
+
     def print_started_test(self, source, test_name):
         self.running_tests.append(test_name)
         if len(self.running_tests) > 1:
@@ -116,14 +121,16 @@ class Printer(object):
 
         write(self._test_line(self.running_tests[0], suffix))
 
-    def print_finished_test(self, result, test_name, test_time, failure, err):
+    def print_finished_test(self, source, test_name, test_time, failures, errors):
         write = self.meter.writeln
-        if failure:
-            lines = failure[0][1].splitlines() + ['']
+        if failures:
+            lines = failures[0].splitlines() + ['']
             suffix = ' failed:'
-        elif err:
-            lines = err[0][1].splitlines() + ['']
+            self.num_failures += 1
+        elif errors:
+            lines = errors[0].splitlines() + ['']
             suffix = ' erred:'
+            self.num_errors += 1
         else:
             suffix = ' passed'
             lines = []
@@ -154,13 +161,13 @@ class Printer(object):
     def _test_line(self, test_name, suffix):
         return '[%d/%d] %s%s' % (self.num_completed, self.num_tests, test_name, suffix)
 
-    def print_result(self, result, run_time):
+    def print_result(self, run_time):
         write = self.meter.writeln
-        write('Ran %d test%s in %.3fs' % (result.testsRun, result.testsRun != 1 and "s" or "", run_time))
-        if result.wasSuccessful():
-            write('\nOK\n')
+        write('Ran %d test%s in %.3fs' % (self.num_completed, self.num_completed != 1 and "s" or "", run_time))
+        if self.num_failures or self.num_errors:
+            write('FAILED (failures=%d, errors=%d)\n' % (self.num_failures, self.num_errors))
         else:
-            write('FAILED (failures=%d, errors=%d)\n' % (len(result.failures), len(result.errors)))
+            write('\nOK\n')
 
 
 class _CaptureAndPassThroughStream(object):
diff --git a/Tools/Scripts/webkitpy/test/runner.py b/Tools/Scripts/webkitpy/test/runner.py
index fd8af6fe0..d3f57643c 100644
--- a/Tools/Scripts/webkitpy/test/runner.py
+++ b/Tools/Scripts/webkitpy/test/runner.py
@@ -22,61 +22,47 @@
 
 """code to actually run a list of python tests."""
 
-import logging
 import re
 import time
 import unittest
 
 from webkitpy.common import message_pool
 
-_log = logging.getLogger(__name__)
-
-
 _test_description = re.compile("(\w+) \(([\w.]+)\)")
 
 
-def _test_name(test):
+def unit_test_name(test):
     m = _test_description.match(str(test))
     return "%s.%s" % (m.group(2), m.group(1))
 
 
 class Runner(object):
-    def __init__(self, printer, options, loader):
-        self.options = options
+    def __init__(self, printer, loader):
         self.printer = printer
         self.loader = loader
-        self.result = unittest.TestResult()
+        self.tests_run = 0
+        self.errors = []
+        self.failures = []
         self.worker_factory = lambda caller: _Worker(caller, self.loader)
 
-    def all_test_names(self, suite):
-        names = []
-        if hasattr(suite, '_tests'):
-            for t in suite._tests:
-                names.extend(self.all_test_names(t))
-        else:
-            names.append(_test_name(suite))
-        return names
-
-    def run(self, suite):
-        run_start_time = time.time()
-        all_test_names = self.all_test_names(suite)
-        self.printer.num_tests = len(all_test_names)
-
-        with message_pool.get(self, self.worker_factory, int(self.options.child_processes)) as pool:
-            pool.run(('test', test_name) for test_name in all_test_names)
-
-        self.printer.print_result(self.result, time.time() - run_start_time)
-        return self.result
+    def run(self, test_names, num_workers):
+        if not test_names:
+            return
+        num_workers = min(num_workers, len(test_names))
+        with message_pool.get(self, self.worker_factory, num_workers) as pool:
+            pool.run(('test', test_name) for test_name in test_names)
 
-    def handle(self, message_name, source, test_name, delay=None, result=None):
+    def handle(self, message_name, source, test_name, delay=None, failures=None, errors=None):
         if message_name == 'started_test':
             self.printer.print_started_test(source, test_name)
             return
 
-        self.result.testsRun += 1
-        self.result.errors.extend(result.errors)
-        self.result.failures.extend(result.failures)
-        self.printer.print_finished_test(source, test_name, delay, result.failures, result.errors)
+        self.tests_run += 1
+        if failures:
+            self.failures.append((test_name, failures))
+        if errors:
+            self.errors.append((test_name, errors))
+        self.printer.print_finished_test(source, test_name, delay, failures, errors)
 
 
 class _Worker(object):
@@ -89,13 +75,8 @@ class _Worker(object):
         result = unittest.TestResult()
         start = time.time()
         self._caller.post('started_test', test_name)
-        self._loader.loadTestsFromName(test_name, None).run(result)
 
-        # The tests in the TestResult contain file objects and other unpicklable things; we only
-        # care about the test name, so we rewrite the result to replace the test with the test name.
-        # FIXME: We need an automated test for this, but I don't know how to write an automated
-        # test that will fail in this case that doesn't get picked up by test-webkitpy normally :(.
-        result.failures = [(_test_name(failure[0]), failure[1]) for failure in result.failures]
-        result.errors = [(_test_name(error[0]), error[1]) for error in result.errors]
-
-        self._caller.post('finished_test', test_name, time.time() - start, result)
+        # We will need to rework this if a test_name results in multiple tests.
+        self._loader.loadTestsFromName(test_name, None).run(result)
+        self._caller.post('finished_test', test_name, time.time() - start,
+            [failure[1] for failure in result.failures], [error[1] for error in result.errors])
diff --git a/Tools/Scripts/webkitpy/test/runner_unittest.py b/Tools/Scripts/webkitpy/test/runner_unittest.py
index 07c5c31ea..8fe1b0633 100644
--- a/Tools/Scripts/webkitpy/test/runner_unittest.py
+++ b/Tools/Scripts/webkitpy/test/runner_unittest.py
@@ -27,7 +27,7 @@ import unittest
 
 from webkitpy.tool.mocktool import MockOptions
 from webkitpy.test.printer import Printer
-from webkitpy.test.runner import Runner, _Worker
+from webkitpy.test.runner import Runner
 
 
 class FakeModuleSuite(object):
@@ -65,7 +65,7 @@ class FakeLoader(object):
     def top_suite(self):
         return FakeTopSuite(self._tests)
 
-    def loadTestsFromName(self, name, dummy):
+    def loadTestsFromName(self, name, _):
         return FakeModuleSuite(*self._results[name])
 
 
@@ -84,28 +84,17 @@ class RunnerTest(unittest.TestCase):
         for handler in self.log_handlers:
             handler.level = self.log_levels.pop(0)
 
-    def assert_run(self, verbose=0, timing=False, child_processes=1, quiet=False):
+    def test_run(self, verbose=0, timing=False, child_processes=1, quiet=False):
         options = MockOptions(verbose=verbose, timing=timing, child_processes=child_processes, quiet=quiet, pass_through=False)
         stream = StringIO.StringIO()
         loader = FakeLoader(('test1 (Foo)', '.', ''),
                             ('test2 (Foo)', 'F', 'test2\nfailed'),
                             ('test3 (Foo)', 'E', 'test3\nerred'))
-        runner = Runner(Printer(stream, options), options, loader)
-        result = runner.run(loader.top_suite())
-        self.assertFalse(result.wasSuccessful())
-        self.assertEquals(result.testsRun, 3)
-        self.assertEquals(len(result.failures), 1)
-        self.assertEquals(len(result.errors), 1)
-        # FIXME: check the output from the test
-
-    def test_regular(self):
-        self.assert_run()
-
-    def test_verbose(self):
-        self.assert_run(verbose=1)
-
-    def test_timing(self):
-        self.assert_run(timing=True)
+        runner = Runner(Printer(stream, options), loader)
+        runner.run(['Foo.test1', 'Foo.test2', 'Foo.test3'], 1)
+        self.assertEquals(runner.tests_run, 3)
+        self.assertEquals(len(runner.failures), 1)
+        self.assertEquals(len(runner.errors), 1)
 
 
 if __name__ == '__main__':
diff --git a/Tools/Scripts/webkitpy/thirdparty/__init__.py b/Tools/Scripts/webkitpy/thirdparty/__init__.py
index b1edd4d0b..17ae62a07 100644
--- a/Tools/Scripts/webkitpy/thirdparty/__init__.py
+++ b/Tools/Scripts/webkitpy/thirdparty/__init__.py
@@ -70,6 +70,8 @@ class AutoinstallImportHook(object):
         if '.autoinstalled' not in fullname:
             return
 
+        # Note: all of the methods must follow the "_install_XXX" convention in
+        # order for autoinstall_everything(), below, to work properly.
         if '.mechanize' in fullname:
             self._install_mechanize()
         elif '.pep8' in fullname:
@@ -88,18 +90,19 @@ class AutoinstallImportHook(object):
             self._install_webpagereplay()
 
     def _install_mechanize(self):
-        self._install("http://pypi.python.org/packages/source/m/mechanize/mechanize-0.2.5.tar.gz",
-                      "mechanize-0.2.5/mechanize")
+        return self._install("http://pypi.python.org/packages/source/m/mechanize/mechanize-0.2.5.tar.gz",
+                             "mechanize-0.2.5/mechanize")
 
     def _install_pep8(self):
-        self._install("http://pypi.python.org/packages/source/p/pep8/pep8-0.5.0.tar.gz#md5=512a818af9979290cd619cce8e9c2e2b",
-                      "pep8-0.5.0/pep8.py")
+        return self._install("http://pypi.python.org/packages/source/p/pep8/pep8-0.5.0.tar.gz#md5=512a818af9979290cd619cce8e9c2e2b",
+                             "pep8-0.5.0/pep8.py")
 
     def _install_pylint(self):
+        installed_something = False
         if not self._fs.exists(self._fs.join(_AUTOINSTALLED_DIR, "pylint")):
-            self._install('http://pypi.python.org/packages/source/p/pylint/pylint-0.25.1.tar.gz#md5=728bbc2b339bc3749af013709a7f87a5', 'pylint-0.25.1')
+            installed_something = self._install('http://pypi.python.org/packages/source/p/pylint/pylint-0.25.1.tar.gz#md5=728bbc2b339bc3749af013709a7f87a5', 'pylint-0.25.1')
             self._fs.move(self._fs.join(_AUTOINSTALLED_DIR, "pylint-0.25.1"), self._fs.join(_AUTOINSTALLED_DIR, "pylint"))
-
+        return installed_something
 
     # autoinstalled.buildbot is used by BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py
     # and should ideally match the version of BuildBot used at build.webkit.org.
@@ -111,24 +114,24 @@ class AutoinstallImportHook(object):
         # without including other modules as a side effect.
         jinja_dir = self._fs.join(_AUTOINSTALLED_DIR, "jinja2")
         installer = AutoInstaller(append_to_search_path=True, target_dir=jinja_dir)
-        installer.install(url="http://pypi.python.org/packages/source/J/Jinja2/Jinja2-2.6.tar.gz#md5=1c49a8825c993bfdcf55bb36897d28a2",
-                          url_subpath="Jinja2-2.6/jinja2")
+        installed_something = installer.install(url="http://pypi.python.org/packages/source/J/Jinja2/Jinja2-2.6.tar.gz#md5=1c49a8825c993bfdcf55bb36897d28a2",
+                                                url_subpath="Jinja2-2.6/jinja2")
 
         SQLAlchemy_dir = self._fs.join(_AUTOINSTALLED_DIR, "sqlalchemy")
         installer = AutoInstaller(append_to_search_path=True, target_dir=SQLAlchemy_dir)
-        installer.install(url="http://pypi.python.org/packages/source/S/SQLAlchemy/SQLAlchemy-0.7.7.tar.gz#md5=ddf6df7e014cea318fa981364f3f93b9",
-                          url_subpath="SQLAlchemy-0.7.7/lib/sqlalchemy")
+        installed_something |= installer.install(url="http://pypi.python.org/packages/source/S/SQLAlchemy/SQLAlchemy-0.7.7.tar.gz#md5=ddf6df7e014cea318fa981364f3f93b9",
+                                                 url_subpath="SQLAlchemy-0.7.7/lib/sqlalchemy")
 
-        self._install("http://pypi.python.org/packages/source/b/buildbot/buildbot-0.8.6p1.tar.gz#md5=b6727d2810c692062c657492bcbeac6a", "buildbot-0.8.6p1/buildbot")
+        installed_something |= self._install("http://pypi.python.org/packages/source/b/buildbot/buildbot-0.8.6p1.tar.gz#md5=b6727d2810c692062c657492bcbeac6a", "buildbot-0.8.6p1/buildbot")
+        return installed_something
 
     def _install_coverage(self):
         installer = AutoInstaller(target_dir=_AUTOINSTALLED_DIR)
-        installer.install(url="http://pypi.python.org/packages/source/c/coverage/coverage-3.5.1.tar.gz#md5=410d4c8155a4dab222f2bc51212d4a24", url_subpath="coverage-3.5.1/coverage")
+        return installer.install(url="http://pypi.python.org/packages/source/c/coverage/coverage-3.5.1.tar.gz#md5=410d4c8155a4dab222f2bc51212d4a24", url_subpath="coverage-3.5.1/coverage")
 
     def _install_eliza(self):
         installer = AutoInstaller(target_dir=_AUTOINSTALLED_DIR)
-        installer.install(url="http://www.adambarth.com/webkit/eliza",
-                          target_name="eliza.py")
+        return installer.install(url="http://www.adambarth.com/webkit/eliza", target_name="eliza.py")
 
     def _install_irc(self):
         # Since irclib and ircbot are two top-level packages, we need to import
@@ -136,23 +139,35 @@ class AutoinstallImportHook(object):
         # organization purposes.
         irc_dir = self._fs.join(_AUTOINSTALLED_DIR, "irc")
         installer = AutoInstaller(target_dir=irc_dir)
-        installer.install(url="http://downloads.sourceforge.net/project/python-irclib/python-irclib/0.4.8/python-irclib-0.4.8.zip",
-                          url_subpath="irclib.py")
-        installer.install(url="http://downloads.sourceforge.net/project/python-irclib/python-irclib/0.4.8/python-irclib-0.4.8.zip",
+        installed_something = installer.install(url="http://downloads.sourceforge.net/project/python-irclib/python-irclib/0.4.8/python-irclib-0.4.8.zip",
+                                                url_subpath="irclib.py")
+        installed_something |= installer.install(url="http://downloads.sourceforge.net/project/python-irclib/python-irclib/0.4.8/python-irclib-0.4.8.zip",
                           url_subpath="ircbot.py")
+        return installed_something
 
     def _install_webpagereplay(self):
+        installed_something = False
         if not self._fs.exists(self._fs.join(_AUTOINSTALLED_DIR, "webpagereplay")):
-            self._install("http://web-page-replay.googlecode.com/files/webpagereplay-1.1.2.tar.gz", "webpagereplay-1.1.2")
+            installed_something = self._install("http://web-page-replay.googlecode.com/files/webpagereplay-1.1.2.tar.gz", "webpagereplay-1.1.2")
             self._fs.move(self._fs.join(_AUTOINSTALLED_DIR, "webpagereplay-1.1.2"), self._fs.join(_AUTOINSTALLED_DIR, "webpagereplay"))
 
         init_path = self._fs.join(_AUTOINSTALLED_DIR, "webpagereplay", "__init__.py")
         if not self._fs.exists(init_path):
             self._fs.write_text_file(init_path, "")
+        return installed_something
 
     def _install(self, url, url_subpath):
         installer = AutoInstaller(target_dir=_AUTOINSTALLED_DIR)
-        installer.install(url=url, url_subpath=url_subpath)
+        return installer.install(url=url, url_subpath=url_subpath)
+
+
+_hook = AutoinstallImportHook()
+sys.meta_path.append(_hook)
 
 
-sys.meta_path.append(AutoinstallImportHook())
+def autoinstall_everything():
+    install_methods = [method for method in dir(_hook.__class__) if method.startswith('_install_')]
+    installed_something = False
+    for method in install_methods:
+        installed_something |= getattr(_hook, method)()
+    return installed_something
diff --git a/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py b/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py
index 1150d1dd4..7c1487d7e 100644
--- a/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py
@@ -125,7 +125,7 @@ If you would like to track this test fix with another bug, please close this bug
 component: Tools / Tests
 cc: abarth@webkit.org
 blocked: 50856
-MOCK add_attachment_to_bug: bug_id=60001, description=Failure diff from mock-bot-id filename=failure.diff
+MOCK add_attachment_to_bug: bug_id=60001, description=Failure diff from mock-bot-id filename=failure.diff mimetype=None
 MOCK bug comment: bug_id=50000, cc=None
 --- Begin comment ---
 The dummy-queue encountered the following flaky tests while processing attachment 10000:
diff --git a/Tools/Scripts/webkitpy/tool/bot/irc_command.py b/Tools/Scripts/webkitpy/tool/bot/irc_command.py
index 7d3a6fd5e..1c061a8db 100644
--- a/Tools/Scripts/webkitpy/tool/bot/irc_command.py
+++ b/Tools/Scripts/webkitpy/tool/bot/irc_command.py
@@ -210,18 +210,6 @@ class Whois(IRCCommand):
         return "%s: I'm not sure who you mean?  %s could be '%s'." % (nick, contributors_string, search_string)
 
 
-class Eliza(IRCCommand):
-    therapist = None
-
-    def __init__(self):
-        if not self.therapist:
-            import webkitpy.thirdparty.autoinstalled.eliza as eliza
-            Eliza.therapist = eliza.eliza()
-
-    def execute(self, nick, args, tool, sheriff):
-        return "%s: %s" % (nick, self.therapist.respond(" ".join(args)))
-
-
 class CreateBug(IRCCommand):
     def execute(self, nick, args, tool, sheriff):
         if not args:
diff --git a/Tools/Scripts/webkitpy/tool/bot/irc_command_unittest.py b/Tools/Scripts/webkitpy/tool/bot/irc_command_unittest.py
index 371e308ec..4dec669fd 100644
--- a/Tools/Scripts/webkitpy/tool/bot/irc_command_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/bot/irc_command_unittest.py
@@ -35,11 +35,6 @@ from webkitpy.common.system.executive_mock import MockExecutive
 
 
 class IRCCommandTest(unittest.TestCase):
-    def test_eliza(self):
-        eliza = Eliza()
-        eliza.execute("tom", "hi", None, None)
-        eliza.execute("tom", "bye", None, None)
-
     def test_whois(self):
         whois = Whois()
         self.assertEquals("tom: Usage: whois SEARCH_STRING",
diff --git a/Tools/Scripts/webkitpy/tool/bot/sheriffircbot.py b/Tools/Scripts/webkitpy/tool/bot/ircbot.py
index 7269c2ec5..0c45b97bf 100644
--- a/Tools/Scripts/webkitpy/tool/bot/sheriffircbot.py
+++ b/Tools/Scripts/webkitpy/tool/bot/ircbot.py
@@ -26,14 +26,15 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-from webkitpy.tool.bot import irc_command
 from webkitpy.tool.bot.queueengine import TerminateQueue
+from webkitpy.tool.bot.irc_command import IRCCommand
 from webkitpy.common.net.irc.ircbot import IRCBotDelegate
 from webkitpy.common.thread.threadedmessagequeue import ThreadedMessageQueue
 
 
 class _IRCThreadTearoff(IRCBotDelegate):
-    def __init__(self, password, message_queue, wakeup_event):
+    def __init__(self, name, password, message_queue, wakeup_event):
+        self._name = name
         self._password = password
         self._message_queue = message_queue
         self._wakeup_event = wakeup_event
@@ -45,37 +46,50 @@ class _IRCThreadTearoff(IRCBotDelegate):
         self._wakeup_event.set()
 
     def irc_nickname(self):
-        return "sheriffbot"
+        return self._name
 
     def irc_password(self):
         return self._password
 
 
-class SheriffIRCBot(object):
-    def __init__(self, tool, sheriff):
+class Eliza(IRCCommand):
+    therapist = None
+
+    def __init__(self):
+        if not self.therapist:
+            import webkitpy.thirdparty.autoinstalled.eliza as eliza
+            Eliza.therapist = eliza.eliza()
+
+    def execute(self, nick, args, tool, sheriff):
+        return "%s: %s" % (nick, self.therapist.respond(" ".join(args)))
+
+
+class IRCBot(object):
+    def __init__(self, name, tool, agent, commands):
+        self._name = name
         self._tool = tool
-        self._sheriff = sheriff
+        self._agent = agent
         self._message_queue = ThreadedMessageQueue()
+        self._commands = commands
 
     def irc_delegate(self):
-        return _IRCThreadTearoff(self._tool.irc_password,
-                                 self._message_queue,
-                                 self._tool.wakeup_event)
+        return _IRCThreadTearoff(self._name, self._tool.irc_password,
+            self._message_queue, self._tool.wakeup_event)
 
     def _parse_command_and_args(self, request):
         tokenized_request = request.strip().split(" ")
-        command = irc_command.commands.get(tokenized_request[0])
+        command = self._commands.get(tokenized_request[0])
         args = tokenized_request[1:]
         if not command:
             # Give the peoples someone to talk with.
-            command = irc_command.Eliza
+            command = Eliza
             args = tokenized_request
         return (command, args)
 
     def process_message(self, requester_nick, request):
         command, args = self._parse_command_and_args(request)
         try:
-            response = command().execute(requester_nick, args, self._tool, self._sheriff)
+            response = command().execute(requester_nick, args, self._tool, self._agent)
             if response:
                 self._tool.irc().post(response)
         except TerminateQueue:
diff --git a/Tools/Scripts/webkitpy/tool/bot/sheriffircbot_unittest.py b/Tools/Scripts/webkitpy/tool/bot/ircbot_unittest.py
index 018f1f733..ce9a76bda 100644
--- a/Tools/Scripts/webkitpy/tool/bot/sheriffircbot_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/bot/ircbot_unittest.py
@@ -3,7 +3,7 @@
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
 # met:
-# 
+#
 #     * Redistributions of source code must retain the above copyright
 # notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above
@@ -13,7 +13,7 @@
 #     * Neither the name of Google Inc. nor the names of its
 # contributors may be used to endorse or promote products derived from
 # this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -33,7 +33,8 @@ from webkitpy.common.system.outputcapture import OutputCapture
 from webkitpy.tool.bot import irc_command
 from webkitpy.tool.bot.queueengine import TerminateQueue
 from webkitpy.tool.bot.sheriff import Sheriff
-from webkitpy.tool.bot.sheriffircbot import SheriffIRCBot
+from webkitpy.tool.bot.ircbot import IRCBot
+from webkitpy.tool.bot.ircbot import Eliza
 from webkitpy.tool.bot.sheriff_unittest import MockSheriffBot
 from webkitpy.tool.mocktool import MockTool
 
@@ -41,24 +42,29 @@ from webkitpy.tool.mocktool import MockTool
 def run(message):
     tool = MockTool()
     tool.ensure_irc_connected(None)
-    bot = SheriffIRCBot(tool, Sheriff(tool, MockSheriffBot()))
+    bot = IRCBot("sheriffbot", tool, Sheriff(tool, MockSheriffBot()), irc_command.commands)
     bot._message_queue.post(["mock_nick", message])
     bot.process_pending_messages()
 
 
-class SheriffIRCBotTest(unittest.TestCase):
+class IRCBotTest(unittest.TestCase):
+    def test_eliza(self):
+        eliza = Eliza()
+        eliza.execute("tom", "hi", None, None)
+        eliza.execute("tom", "bye", None, None)
+
     def test_parse_command_and_args(self):
         tool = MockTool()
-        bot = SheriffIRCBot(tool, Sheriff(tool, MockSheriffBot()))
-        self.assertEqual(bot._parse_command_and_args(""), (irc_command.Eliza, [""]))
-        self.assertEqual(bot._parse_command_and_args("   "), (irc_command.Eliza, [""]))
+        bot = IRCBot("sheriffbot", tool, Sheriff(tool, MockSheriffBot()), irc_command.commands)
+        self.assertEqual(bot._parse_command_and_args(""), (Eliza, [""]))
+        self.assertEqual(bot._parse_command_and_args("   "), (Eliza, [""]))
         self.assertEqual(bot._parse_command_and_args(" hi "), (irc_command.Hi, []))
         self.assertEqual(bot._parse_command_and_args(" hi there "), (irc_command.Hi, ["there"]))
 
     def test_exception_during_command(self):
         tool = MockTool()
         tool.ensure_irc_connected(None)
-        bot = SheriffIRCBot(tool, Sheriff(tool, MockSheriffBot()))
+        bot = IRCBot("sheriffbot", tool, Sheriff(tool, MockSheriffBot()), irc_command.commands)
 
         class CommandWithException(object):
             def execute(self, nick, args, tool, sheriff):
diff --git a/Tools/Scripts/webkitpy/tool/commands/__init__.py b/Tools/Scripts/webkitpy/tool/commands/__init__.py
index e0d885f71..4e8eb62e1 100644
--- a/Tools/Scripts/webkitpy/tool/commands/__init__.py
+++ b/Tools/Scripts/webkitpy/tool/commands/__init__.py
@@ -12,6 +12,7 @@ from webkitpy.tool.commands.expectations import OptimizeExpectations
 from webkitpy.tool.commands.findusers import FindUsers
 from webkitpy.tool.commands.gardenomatic import GardenOMatic
 from webkitpy.tool.commands.openbugs import OpenBugs
+from webkitpy.tool.commands.perfalizer import Perfalizer
 from webkitpy.tool.commands.prettydiff import PrettyDiff
 from webkitpy.tool.commands.queries import *
 from webkitpy.tool.commands.queues import *
diff --git a/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem.py b/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem.py
index 639f4d8fc..08c8bf685 100644
--- a/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem.py
+++ b/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem.py
@@ -192,6 +192,14 @@ class ChromiumWindowsEWS(AbstractChromiumEWS):
     name = "cr-win-ews"
 
 
+class ChromiumAndroidEWS(AbstractChromiumEWS):
+    name = "cr-android-ews"
+    port_name = "chromium-android"
+    watchers = AbstractChromiumEWS.watchers + [
+        "peter+ews@chromium.org",
+    ]
+
+
 class MacEWS(AbstractEarlyWarningSystem):
     name = "mac-ews"
     port_name = "mac"
diff --git a/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py b/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py
index 9dbb398ee..7feff0d62 100644
--- a/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py
@@ -82,6 +82,7 @@ class EarlyWarningSytemTest(QueuesTest):
     def test_builder_ewses(self):
         self._test_builder_ews(MacEWS())
         self._test_builder_ews(ChromiumWindowsEWS())
+        self._test_builder_ews(ChromiumAndroidEWS())
         self._test_builder_ews(QtEWS())
         self._test_builder_ews(QtWK2EWS())
         self._test_builder_ews(GtkEWS())
diff --git a/Tools/Scripts/webkitpy/tool/commands/perfalizer.py b/Tools/Scripts/webkitpy/tool/commands/perfalizer.py
new file mode 100644
index 000000000..b9fc6fe5b
--- /dev/null
+++ b/Tools/Scripts/webkitpy/tool/commands/perfalizer.py
@@ -0,0 +1,215 @@
+# Copyright (c) 2012 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from webkitpy.common.system.deprecated_logging import log
+from webkitpy.tool.bot.expectedfailures import ExpectedFailures
+from webkitpy.tool.bot.irc_command import IRCCommand
+from webkitpy.tool.bot.irc_command import Help
+from webkitpy.tool.bot.irc_command import Hi
+from webkitpy.tool.bot.irc_command import Restart
+from webkitpy.tool.bot.ircbot import IRCBot
+from webkitpy.tool.bot.patchanalysistask import PatchAnalysisTask, PatchAnalysisTaskDelegate, UnableToApplyPatch
+from webkitpy.tool.bot.sheriff import Sheriff
+from webkitpy.tool.commands.queues import AbstractQueue
+from webkitpy.tool.commands.stepsequence import StepSequenceErrorHandler
+
+
+class PerfalizerTask(PatchAnalysisTask):
+    def __init__(self, tool, patch, logger):
+        PatchAnalysisTask.__init__(self, self, patch)
+        self._port = tool.port_factory.get()
+        self._tool = tool
+        self._logger = logger
+
+    def _copy_build_product_without_patch(self):
+        filesystem = self._tool.filesystem
+        configuration = filesystem.basename(self._port._build_path())
+        self._build_directory = filesystem.dirname(self._port._build_path())
+        self._build_directory_without_patch = self._build_directory + 'WithoutPatch'
+
+        try:
+            filesystem.rmtree(self._build_directory_without_patch)
+            filesystem.copytree(filesystem.join(self._build_directory, configuration),
+                filesystem.join(self._build_directory_without_patch, configuration))
+            return True
+        except:
+            return False
+
+    def run(self):
+        if not self._patch.committer() and not self._patch.attacher().can_commit:
+            self._logger('The patch %d is not authorized by a commmitter' % self._patch.id())
+            return False
+
+        self._logger('Preparing to run performance tests for the attachment %d...' % self._patch.id())
+        if not self._clean() or not self._update():
+            return False
+
+        head_revision = self._tool.scm().head_svn_revision()
+
+        self._logger('Building WebKit at r%s without the patch' % head_revision)
+        if not self._build():
+            return False
+
+        if not self._port.check_build(needs_http=False):
+            self._logger('Failed to build DumpRenderTree.')
+            return False
+
+        if not self._copy_build_product_without_patch():
+            self._logger('Failed to copy the build product from %s to %s' % (self._build_directory, self._build_directory_without_patch))
+            return False
+
+        self._logger('Building WebKit at r%s with the patch' % head_revision)
+        if not self._apply() or not self._build():
+            return False
+
+        if not self._port.check_build(needs_http=False):
+            self._logger('Failed to build DumpRenderTree.')
+            return False
+
+        filesystem = self._tool.filesystem
+        if filesystem.exists(self._json_path()):
+            filesystem.remove(self._json_path())
+
+        self._logger("Running performance tests...")
+        if self._run_perf_test(self._build_directory_without_patch) < 0:
+            self._logger('Failed to run performance tests without the patch.')
+            return False
+
+        if self._run_perf_test(self._build_directory) < 0:
+            self._logger('Failed to run performance tests with the patch.')
+            return False
+
+        if not filesystem.exists(self._results_page_path()):
+            self._logger('Failed to generate the results page.')
+            return False
+
+        results_page = filesystem.read_text_file(self._results_page_path())
+        self._tool.bugs.add_attachment_to_bug(self._patch.bug_id(), results_page,
+            description="Performance tests results for %d" % self._patch.id(), mimetype='text/html')
+
+        self._logger("Uploaded the results on the bug %d" % self._patch.bug_id())
+        return True
+
+    def parent_command(self):
+        return "perfalizer"
+
+    def run_webkit_patch(self, args):
+        webkit_patch_args = [self._tool.path()]
+        webkit_patch_args.extend(args)
+        return self._tool.executive.run_and_throw_if_fail(webkit_patch_args, cwd=self._tool.scm().checkout_root)
+
+    def _json_path(self):
+        return self._tool.filesystem.join(self._build_directory, 'PerformanceTestResults.json')
+
+    def _results_page_path(self):
+        return self._tool.filesystem.join(self._build_directory, 'PerformanceTestResults.html')
+
+    def _run_perf_test(self, build_path):
+        filesystem = self._tool.filesystem
+        script_path = filesystem.join(filesystem.dirname(self._tool.path()), 'run-perf-tests')
+        perf_test_runner_args = [script_path, '--no-build', '--no-show-results', '--build-directory', build_path,
+            '--output-json-path', self._json_path()]
+        return self._tool.executive.run_and_throw_if_fail(perf_test_runner_args, cwd=self._tool.scm().checkout_root)
+
+    def run_command(self, command):
+        self.run_webkit_patch(command)
+
+    def command_passed(self, message, patch):
+        pass
+
+    def command_failed(self, message, script_error, patch):
+        self._logger(message)
+
+    def refetch_patch(self, patch):
+        return self._tool.bugs.fetch_attachment(patch.id())
+
+    def expected_failures(self):
+        return ExpectedFailures()
+
+    def build_style(self):
+        return "release"
+
+
+class PerfTest(IRCCommand):
+    def execute(self, nick, args, tool, sheriff):
+        if not args:
+            tool.irc().post(nick + ": Please specify an attachment/patch id")
+            return
+
+        patch_id = args[0]
+        patch = tool.bugs.fetch_attachment(patch_id)
+        if not patch:
+            tool.irc().post(nick + ": Could not fetch the patch")
+            return
+
+        task = PerfalizerTask(tool, patch, lambda message: tool.irc().post('%s: %s' % (nick, message)))
+        task.run()
+
+
+class Perfalizer(AbstractQueue, StepSequenceErrorHandler):
+    name = "perfalizer"
+    watchers = AbstractQueue.watchers + ["rniwa@webkit.org"]
+
+    _commands = {
+        "help": Help,
+        "hi": Hi,
+        "restart": Restart,
+        "test": PerfTest,
+    }
+
+    # AbstractQueue methods
+
+    def begin_work_queue(self):
+        AbstractQueue.begin_work_queue(self)
+        self._sheriff = Sheriff(self._tool, self)
+        self._irc_bot = IRCBot("perfalizer", self._tool, self._sheriff, self._commands)
+        self._tool.ensure_irc_connected(self._irc_bot.irc_delegate())
+
+    def work_item_log_path(self, failure_map):
+        return None
+
+    def _is_old_failure(self, revision):
+        return self._tool.status_server.svn_revision(revision)
+
+    def next_work_item(self):
+        self._irc_bot.process_pending_messages()
+        return
+
+    def process_work_item(self, failure_map):
+        return True
+
+    def handle_unexpected_error(self, failure_map, message):
+        log(message)
+
+    # StepSequenceErrorHandler methods
+
+    @classmethod
+    def handle_script_error(cls, tool, state, script_error):
+        # Ideally we would post some information to IRC about what went wrong
+        # here, but we don't have the IRC password in the child process.
+        pass
diff --git a/Tools/Scripts/webkitpy/tool/commands/perfalizer_unittest.py b/Tools/Scripts/webkitpy/tool/commands/perfalizer_unittest.py
new file mode 100644
index 000000000..f519e3f78
--- /dev/null
+++ b/Tools/Scripts/webkitpy/tool/commands/perfalizer_unittest.py
@@ -0,0 +1,111 @@
+# Copyright (C) 2012 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from webkitpy.common.net.buildbot import Builder
+from webkitpy.common.system.executive import ScriptError
+from webkitpy.common.system.outputcapture import OutputCapture
+from webkitpy.layout_tests.port.test import TestPort
+from webkitpy.tool.commands.perfalizer import PerfalizerTask
+from webkitpy.tool.mocktool import MockTool
+
+
+class PerfalizerTaskTest(unittest.TestCase):
+    def _create_and_run_perfalizer(self, commands_to_fail=[]):
+        tool = MockTool()
+        patch = tool.bugs.fetch_attachment(10000)
+
+        logs = []
+
+        def logger(message):
+            logs.append(message)
+
+        def run_webkit_patch(args):
+            if args[0] in commands_to_fail:
+                raise ScriptError
+
+        def run_perf_test(build_path):
+            if 'run-perf-tests' in commands_to_fail:
+                return -1
+            if 'results-page' not in commands_to_fail:
+                tool.filesystem.write_text_file(tool.filesystem.join(build_path, 'PerformanceTestResults.html'), 'results page')
+            return 0
+
+        perfalizer = PerfalizerTask(tool, patch, logger)
+        perfalizer._port = TestPort(tool)
+        perfalizer.run_webkit_patch = run_webkit_patch
+        perfalizer._run_perf_test = run_perf_test
+
+        capture = OutputCapture()
+        capture.capture_output()
+
+        if commands_to_fail:
+            self.assertFalse(perfalizer.run())
+        else:
+            self.assertTrue(perfalizer.run())
+
+        capture.restore_output()
+
+        return logs
+
+    def test_run(self):
+        self.assertEqual(self._create_and_run_perfalizer(), [
+            'Preparing to run performance tests for the attachment 10000...',
+            'Building WebKit at r1234 without the patch',
+            'Building WebKit at r1234 with the patch',
+            'Running performance tests...',
+            'Uploaded the results on the bug 50000'])
+
+    def test_run_with_clean_fails(self):
+        self.assertEqual(self._create_and_run_perfalizer(['clean']), [
+            'Preparing to run performance tests for the attachment 10000...',
+            'Unable to clean working directory'])
+
+    def test_run_with_update_fails(self):
+        logs = self._create_and_run_perfalizer(['update'])
+        self.assertEqual(len(logs), 2)
+        self.assertEqual(logs[-1], 'Unable to update working directory')
+
+    def test_run_with_build_fails(self):
+        logs = self._create_and_run_perfalizer(['build'])
+        self.assertEqual(len(logs), 3)
+
+    def test_run_with_build_fails(self):
+        logs = self._create_and_run_perfalizer(['apply-attachment'])
+        self.assertEqual(len(logs), 4)
+
+    def test_run_with_perf_test_fails(self):
+        logs = self._create_and_run_perfalizer(['run-perf-tests'])
+        self.assertEqual(len(logs), 5)
+        self.assertEqual(logs[-1], 'Failed to run performance tests without the patch.')
+
+    def test_run_without_results_page(self):
+        logs = self._create_and_run_perfalizer(['results-page'])
+        self.assertEqual(len(logs), 5)
+        self.assertEqual(logs[-1], 'Failed to generate the results page.')
diff --git a/Tools/Scripts/webkitpy/tool/commands/queues.py b/Tools/Scripts/webkitpy/tool/commands/queues.py
index b251c0fb6..e8db17c7b 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queues.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queues.py
@@ -379,6 +379,9 @@ class AbstractReviewQueue(AbstractPatchQueue, StepSequenceErrorHandler):
 
     # AbstractPatchQueue methods
 
+    def begin_work_queue(self):
+        AbstractPatchQueue.begin_work_queue(self)
+
     def next_work_item(self):
         return self._next_patch()
 
@@ -413,23 +416,6 @@ class StyleQueue(AbstractReviewQueue, StyleQueueTaskDelegate):
     def __init__(self):
         AbstractReviewQueue.__init__(self)
 
-    def begin_work_queue(self):
-        AbstractReviewQueue.begin_work_queue(self)
-        self.clean_bugzilla()
-
-    def clean_bugzilla(self):
-        try:
-            self._update_status("Cleaning review queue")
-            self.run_webkit_patch(["clean-review-queue"])
-        except ScriptError, e:
-            self._update_status(e)
-
-        try:
-            self._update_status("Cleaning pending commit")
-            self.run_webkit_patch(["clean-pending-commit"])
-        except ScriptError, e:
-            self._update_status(e)
-
     def review_patch(self, patch):
         task = StyleQueueTask(self, patch)
         if not task.validate():
diff --git a/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py b/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
index 2e6b1f07b..450a912e0 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
@@ -173,7 +173,7 @@ class AbstractPatchQueueTest(CommandsTest):
         queue._options = Mock()
         queue._options.port = None
         patch = queue._tool.bugs.fetch_attachment(10001)
-        expected_stderr = """MOCK add_attachment_to_bug: bug_id=50000, description=Archive of layout-test-results from bot filename=layout-test-results.zip
+        expected_stderr = """MOCK add_attachment_to_bug: bug_id=50000, description=Archive of layout-test-results from bot filename=layout-test-results.zip mimetype=None
 -- Begin comment --
 The attached test failures were seen while running run-webkit-tests on the mock-queue.
 Port: MockPort  Platform: MockPlatform 1.0
@@ -405,14 +405,14 @@ The commit-queue just saw foo/bar.html flake (Text diff mismatch) while processi
 Port: MockPort  Platform: MockPlatform 1.0
 --- End comment ---
 
-MOCK add_attachment_to_bug: bug_id=50002, description=Failure diff from bot filename=failure.diff
+MOCK add_attachment_to_bug: bug_id=50002, description=Failure diff from bot filename=failure.diff mimetype=None
 MOCK bug comment: bug_id=50002, cc=None
 --- Begin comment ---
 The commit-queue just saw bar/baz.html flake (Text diff mismatch) while processing attachment 10000 on bug 50000.
 Port: MockPort  Platform: MockPlatform 1.0
 --- End comment ---
 
-MOCK add_attachment_to_bug: bug_id=50002, description=Archive of layout-test-results from bot filename=layout-test-results.zip
+MOCK add_attachment_to_bug: bug_id=50002, description=Archive of layout-test-results from bot filename=layout-test-results.zip mimetype=None
 MOCK bug comment: bug_id=50000, cc=None
 --- Begin comment ---
 The commit-queue encountered the following flaky tests while processing attachment 10000:
@@ -449,11 +449,7 @@ The commit-queue is continuing to process your patch.
 class StyleQueueTest(QueuesTest):
     def test_style_queue_with_style_exception(self):
         expected_stderr = {
-            "begin_work_queue": self._default_begin_work_queue_stderr("style-queue") + """MOCK: update_status: style-queue Cleaning review queue
-MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'clean-review-queue'], cwd=/mock-checkout
-MOCK: update_status: style-queue Cleaning pending commit
-MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'clean-pending-commit'], cwd=/mock-checkout
-""",
+            "begin_work_queue": self._default_begin_work_queue_stderr("style-queue"),
             "next_work_item": "",
             "process_work_item": """MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'clean'], cwd=/mock-checkout
 MOCK: update_status: style-queue Cleaned working directory
@@ -476,11 +472,7 @@ MOCK: release_work_item: style-queue 10000
 
     def test_style_queue_with_watch_list_exception(self):
         expected_stderr = {
-            "begin_work_queue": self._default_begin_work_queue_stderr("style-queue") + """MOCK: update_status: style-queue Cleaning review queue
-MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'clean-review-queue'], cwd=/mock-checkout
-MOCK: update_status: style-queue Cleaning pending commit
-MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'clean-pending-commit'], cwd=/mock-checkout
-""",
+            "begin_work_queue": self._default_begin_work_queue_stderr("style-queue"),
             "next_work_item": "",
             "process_work_item": """MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'clean'], cwd=/mock-checkout
 MOCK: update_status: style-queue Cleaned working directory
diff --git a/Tools/Scripts/webkitpy/tool/commands/rebaseline.py b/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
index ed27ab553..7ccbf565a 100644
--- a/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
+++ b/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
@@ -321,16 +321,13 @@ class RebaselineExpectations(AbstractParallelRebaselineCommand):
     name = "rebaseline-expectations"
     help_text = "Rebaselines the tests indicated in TestExpectations."
 
-    def _update_expectations_file(self, port_name):
+    def _update_expectations_files(self, port_name):
         port = self._tool.port_factory.get(port_name)
 
-        # FIXME: This will intentionally skip over any REBASELINE expectations that were in an overrides file.
-        # This is not good, but avoids having the overrides getting written into the main file.
-        # See https://bugs.webkit.org/show_bug.cgi?id=88456 for context. This will no longer be needed
-        # once we properly support cascading expectations files.
         expectations = TestExpectations(port, include_overrides=False)
-        path = port.path_to_test_expectations_file()
-        self._tool.filesystem.write_text_file(path, expectations.remove_rebaselined_tests(expectations.get_rebaselining_failures()))
+        for path in port.expectations_dict():
+            if self._tool.filesystem.exists(path):
+                self._tool.filesystem.write_text_file(path, expectations.remove_rebaselined_tests(expectations.get_rebaselining_failures(), path))
 
     def _tests_to_rebaseline(self, port):
         tests_to_rebaseline = {}
@@ -361,7 +358,7 @@ class RebaselineExpectations(AbstractParallelRebaselineCommand):
         self._rebaseline(options, self._test_list)
 
         for port_name in tool.port_factory.all_port_names():
-            self._update_expectations_file(port_name)
+            self._update_expectations_files(port_name)
 
 
 class Rebaseline(AbstractParallelRebaselineCommand):
diff --git a/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py b/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
index 433906b8c..93bd5c500 100644
--- a/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
@@ -63,6 +63,8 @@ class TestRebaseline(unittest.TestCase):
         command.bind_to_tool(tool)
 
         lion_port = tool.port_factory.get_from_builder_name("Webkit Mac10.7")
+        # FIXME: work around the chromium skia expectations file to avoid getting a bunch of confusing warnings.
+        tool.filesystem.write_text_file(lion_port.path_from_chromium_base('skia', 'skia_test_expectations.txt'), '')
         for path in lion_port.expectations_files():
             tool.filesystem.write_text_file(path, '')
         tool.filesystem.write_text_file(lion_port.path_to_test_expectations_file(), """BUGB MAC LINUX XP DEBUG : fast/dom/Window/window-postmessage-clone-really-deep-array.html = PASS
@@ -75,7 +77,6 @@ BUGA DEBUG : fast/css/large-list-of-rules-crash.html = TEXT
         expected_logs = """Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-results/userscripts/another-test-actual.png.
 Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-results/userscripts/another-test-actual.wav.
 Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-results/userscripts/another-test-actual.txt.
-Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
 """
         OutputCapture().assert_outputs(self, command._rebaseline_test_and_update_expectations, ["Webkit Mac10.7", "userscripts/another-test.html", None], expected_logs=expected_logs)
 
@@ -227,6 +228,9 @@ MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'user-scri
         tool = MockTool()
         command.bind_to_tool(tool)
 
+        # FIXME: work around the chromium skia expectations file to avoid getting a bunch of confusing warnings.
+        lion_port = tool.port_factory.get_from_builder_name("Webkit Mac10.7")
+        tool.filesystem.write_text_file(lion_port.path_from_chromium_base('skia', 'skia_test_expectations.txt'), '')
         for port_name in tool.port_factory.all_port_names():
             port = tool.port_factory.get(port_name)
             for path in port.expectations_files():
@@ -274,12 +278,6 @@ Retrieving results for qt-linux from Qt Linux Release.
 Retrieving results for win-7sp0 from Apple Win 7 Release (Tests).
     userscripts/another-test.html (txt)
     userscripts/images.svg (png)
-Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
-Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
-Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
-Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
-Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
-Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
 """
 
         expected_stdout = """[(['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Linux 32', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Linux', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Mac10.6', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Mac10.7', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Win7', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Apple Win 7 Release (Tests)', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'EFL Linux 64-bit Release', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Win', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'GTK Linux 64-bit Release', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Qt Linux Release', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Apple Lion Release WK1 (Tests)', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Linux 32', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Linux', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Mac10.6', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Mac10.7', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Win7', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Apple Win 7 Release (Tests)', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'EFL Linux 64-bit Release', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Win', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'GTK Linux 64-bit Release', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Qt Linux Release', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Apple Lion Release WK1 (Tests)', '--test', 'userscripts/images.svg'], '/mock-checkout')]
diff --git a/Tools/Scripts/webkitpy/tool/commands/sheriffbot.py b/Tools/Scripts/webkitpy/tool/commands/sheriffbot.py
index 81f435394..d30da395b 100644
--- a/Tools/Scripts/webkitpy/tool/commands/sheriffbot.py
+++ b/Tools/Scripts/webkitpy/tool/commands/sheriffbot.py
@@ -28,7 +28,8 @@
 
 from webkitpy.common.system.deprecated_logging import log
 from webkitpy.tool.bot.sheriff import Sheriff
-from webkitpy.tool.bot.sheriffircbot import SheriffIRCBot
+from webkitpy.tool.bot.irc_command import commands as irc_commands
+from webkitpy.tool.bot.ircbot import IRCBot
 from webkitpy.tool.commands.queues import AbstractQueue
 from webkitpy.tool.commands.stepsequence import StepSequenceErrorHandler
 
@@ -45,7 +46,7 @@ class SheriffBot(AbstractQueue, StepSequenceErrorHandler):
     def begin_work_queue(self):
         AbstractQueue.begin_work_queue(self)
         self._sheriff = Sheriff(self._tool, self)
-        self._irc_bot = SheriffIRCBot(self._tool, self._sheriff)
+        self._irc_bot = IRCBot("sheriffbot", self._tool, self._sheriff, irc_commands)
         self._tool.ensure_irc_connected(self._irc_bot.irc_delegate())
 
     def work_item_log_path(self, failure_map):
diff --git a/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py b/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py
index 0ab0ede8f..185bb97f3 100644
--- a/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py
@@ -79,7 +79,7 @@ MOCK: user.open_url: http://example.com/50000
         options = MockOptions()
         options.comment = "extra comment"
         options.description = "file description"
-        expected_stderr = """MOCK add_attachment_to_bug: bug_id=50000, description=file description filename=None
+        expected_stderr = """MOCK add_attachment_to_bug: bug_id=50000, description=file description filename=None mimetype=None
 -- Begin comment --
 extra comment
 -- End comment --
@@ -90,7 +90,7 @@ extra comment
         options = MockOptions()
         options.comment = None
         options.description = None
-        expected_stderr = """MOCK add_attachment_to_bug: bug_id=50000, description=file.txt filename=None
+        expected_stderr = """MOCK add_attachment_to_bug: bug_id=50000, description=file.txt filename=None mimetype=None
 """
         self.assert_execute_outputs(AttachToBug(), [50000, "path/to/file.txt"], options=options, expected_stderr=expected_stderr)
 
diff --git a/Tools/Scripts/webkitpy/tool/steps/runtests.py b/Tools/Scripts/webkitpy/tool/steps/runtests.py
index ac5493b4e..aa8729123 100644
--- a/Tools/Scripts/webkitpy/tool/steps/runtests.py
+++ b/Tools/Scripts/webkitpy/tool/steps/runtests.py
@@ -85,8 +85,7 @@ class RunTests(AbstractStep):
                 "--skip-failing-tests",
                 "--exit-after-n-failures=%s" % self.NON_INTERACTIVE_FAILURE_LIMIT_COUNT,
                 "--results-directory=%s" % self._tool.port().results_directory,
-                # We customize the printing options to avoid generating massive logs on the EWS and commit-queue.
-                "--print=actual,config,expected,misc,slowest,unexpected,unexpected-results",
+                "--quiet",
             ])
 
         if self._options.quiet:
diff --git a/Tools/Scripts/webkitpy/tool/steps/runtests_unittest.py b/Tools/Scripts/webkitpy/tool/steps/runtests_unittest.py
index fd89ca946..bf888e505 100644
--- a/Tools/Scripts/webkitpy/tool/steps/runtests_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/steps/runtests_unittest.py
@@ -41,6 +41,6 @@ class RunTestsTest(unittest.TestCase):
         expected_stderr = """Running WebKit unit tests
 MOCK run_and_throw_if_fail: ['mock-run-webkit-unit-tests', '--gtest_output=xml:/mock-results/webkit_unit_tests_output.xml'], cwd=/mock-checkout
 Running run-webkit-tests
-MOCK run_and_throw_if_fail: ['mock-run-webkit-tests', '--no-new-test-results', '--no-launch-safari', '--skip-failing-tests', '--exit-after-n-failures=30', '--results-directory=/mock-results', '--print=actual,config,expected,misc,slowest,unexpected,unexpected-results'], cwd=/mock-checkout
+MOCK run_and_throw_if_fail: ['mock-run-webkit-tests', '--no-new-test-results', '--no-launch-safari', '--skip-failing-tests', '--exit-after-n-failures=30', '--results-directory=/mock-results', '--quiet'], cwd=/mock-checkout
 """
         OutputCapture().assert_outputs(self, step.run, [{}], expected_stderr=expected_stderr)
diff --git a/Tools/Scripts/webkitpy/tool/steps/update_unittest.py b/Tools/Scripts/webkitpy/tool/steps/update_unittest.py
index 19ef949da..c1a934db5 100644
--- a/Tools/Scripts/webkitpy/tool/steps/update_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/steps/update_unittest.py
@@ -28,7 +28,7 @@
 
 import unittest
 
-from webkitpy.common.config.ports import ChromiumPort, ChromiumXVFBPort
+from webkitpy.common.config.ports import ChromiumPort, ChromiumAndroidPort, ChromiumXVFBPort
 from webkitpy.tool.mocktool import MockOptions, MockTool
 from webkitpy.tool.steps.update import Update
 
@@ -47,6 +47,9 @@ class UpdateTest(unittest.TestCase):
         tool._deprecated_port = ChromiumXVFBPort()
         self.assertEqual(["Tools/Scripts/update-webkit", "--chromium", "--force-update"], step._update_command())
 
+        tool._deprecated_port = ChromiumAndroidPort()
+        self.assertEqual(["Tools/Scripts/update-webkit", "--chromium", "--force-update", "--chromium-android"], step._update_command())
+
     def test_update_command_interactive(self):
         tool = MockTool()
         options = MockOptions(non_interactive=False)
@@ -58,3 +61,6 @@ class UpdateTest(unittest.TestCase):
 
         tool._deprecated_port = ChromiumXVFBPort()
         self.assertEqual(["Tools/Scripts/update-webkit", "--chromium"], step._update_command())
+
+        tool._deprecated_port = ChromiumAndroidPort()
+        self.assertEqual(["Tools/Scripts/update-webkit", "--chromium", "--chromium-android"], step._update_command())
diff --git a/Tools/Scripts/webkitpy/webkitpy.pyproj b/Tools/Scripts/webkitpy/webkitpy.pyproj
index 72135a8d4..0bff5fce6 100644
--- a/Tools/Scripts/webkitpy/webkitpy.pyproj
+++ b/Tools/Scripts/webkitpy/webkitpy.pyproj
@@ -378,14 +378,14 @@
     <Compile Include="tool\bot\flakytestreporter_unittest.py" />
     <Compile Include="tool\bot\irc_command.py" />
     <Compile Include="tool\bot\irc_command_unittest.py" />
+    <Compile Include="tool\bot\ircbot.py" />
+    <Compile Include="tool\bot\ircbot_unittest.py" />
     <Compile Include="tool\bot\layouttestresultsreader.py" />
     <Compile Include="tool\bot\layouttestresultsreader_unittest.py" />
     <Compile Include="tool\bot\patchanalysistask.py" />
     <Compile Include="tool\bot\queueengine.py" />
     <Compile Include="tool\bot\queueengine_unittest.py" />
     <Compile Include="tool\bot\sheriff.py" />
-    <Compile Include="tool\bot\sheriffircbot.py" />
-    <Compile Include="tool\bot\sheriffircbot_unittest.py" />
     <Compile Include="tool\bot\sheriff_unittest.py" />
     <Compile Include="tool\bot\stylequeuetask.py" />
     <Compile Include="tool\bot\__init__.py" />
diff --git a/Tools/TestWebKitAPI/CMakeLists.txt b/Tools/TestWebKitAPI/CMakeLists.txt
index 6c3a59d5c..d116b5c0e 100644
--- a/Tools/TestWebKitAPI/CMakeLists.txt
+++ b/Tools/TestWebKitAPI/CMakeLists.txt
@@ -48,6 +48,7 @@ ADD_LIBRARY(TestWebKitAPIInjectedBundle SHARED
     ${TESTWEBKITAPI_DIR}/Tests/WebKit2/WillSendSubmitEvent_Bundle.cpp
 )
 
+TARGET_LINK_LIBRARIES(TestWebKitAPIInjectedBundle ${WTF_LIBRARY_NAME})
 ADD_DEPENDENCIES(TestWebKitAPIInjectedBundle ${WebKit2_LIBRARY_NAME} ${ForwardingHeadersForTestWebKitAPI_NAME} ${ForwardingNetworkHeadersForTestWebKitAPI_NAME})
 
 GET_PROPERTY(TestWebKitAPIInjectedBundle_PATH TARGET TestWebKitAPIInjectedBundle PROPERTY LOCATION)
@@ -65,12 +66,14 @@ SET(test_wtf_LIBRARIES
 ADD_EXECUTABLE(test_wtf
     ${test_main_SOURCES}
     ${TESTWEBKITAPI_DIR}/TestsController.cpp
+    ${TESTWEBKITAPI_DIR}/Tests/WTF/AtomicString.cpp
     ${TESTWEBKITAPI_DIR}/Tests/WTF/CheckedArithmeticOperations.cpp
     ${TESTWEBKITAPI_DIR}/Tests/WTF/Functional.cpp
     ${TESTWEBKITAPI_DIR}/Tests/WTF/HashMap.cpp
     ${TESTWEBKITAPI_DIR}/Tests/WTF/MetaAllocator.cpp
     ${TESTWEBKITAPI_DIR}/Tests/WTF/RedBlackTree.cpp
     ${TESTWEBKITAPI_DIR}/Tests/WTF/StringBuilder.cpp
+    ${TESTWEBKITAPI_DIR}/Tests/WTF/StringImpl.cpp
     ${TESTWEBKITAPI_DIR}/Tests/WTF/StringOperators.cpp
     ${TESTWEBKITAPI_DIR}/Tests/WTF/TemporaryChange.cpp
     ${TESTWEBKITAPI_DIR}/Tests/WTF/Vector.cpp
diff --git a/Tools/TestWebKitAPI/GNUmakefile.am b/Tools/TestWebKitAPI/GNUmakefile.am
index 815c43baf..255a83856 100644
--- a/Tools/TestWebKitAPI/GNUmakefile.am
+++ b/Tools/TestWebKitAPI/GNUmakefile.am
@@ -50,12 +50,14 @@ Programs_TestWebKitAPI_TestWTF_LDFLAGS = \
 	-no-fast-install
 
 Programs_TestWebKitAPI_TestWTF_SOURCES = \
+	Tools/TestWebKitAPI/Tests/WTF/AtomicString.cpp \
 	Tools/TestWebKitAPI/Tests/WTF/CheckedArithmeticOperations.cpp \
 	Tools/TestWebKitAPI/Tests/WTF/Functional.cpp \
 	Tools/TestWebKitAPI/Tests/WTF/HashMap.cpp \
 	Tools/TestWebKitAPI/Tests/WTF/MediaTime.cpp \
 	Tools/TestWebKitAPI/Tests/WTF/RedBlackTree.cpp \
 	Tools/TestWebKitAPI/Tests/WTF/StringBuilder.cpp \
+	Tools/TestWebKitAPI/Tests/WTF/StringImpl.cpp \
 	Tools/TestWebKitAPI/Tests/WTF/StringOperators.cpp \
 	Tools/TestWebKitAPI/Tests/WTF/TemporaryChange.cpp \
 	Tools/TestWebKitAPI/Tests/WTF/VectorBasic.cpp \
diff --git a/Tools/TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp b/Tools/TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp
index ff064a02d..e84386f18 100644
--- a/Tools/TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp
+++ b/Tools/TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp
@@ -132,8 +132,18 @@
                         '--output',
                         '<(PRODUCT_DIR)/TestWebKitAPI_apk',
                         '--ant-args',
+                        '-DANDROID_SDK=<(android_sdk)',
+                        '--ant-args',
+                        '-DANDROID_SDK_ROOT=<(android_sdk_root)',
+                        '--ant-args',
+                        '-DANDROID_SDK_TOOLS=<(android_sdk_tools)',
+                        '--ant-args',
+                        '-DANDROID_SDK_VERSION=<(android_sdk_version)',
+                        '--ant-args',
+                        '-DANDROID_TOOLCHAIN=<(android_toolchain)',
+                        '--ant-args',
                         '-DPRODUCT_DIR=<(ant_build_out)',
-                        '--ant-compile',
+                        '--sdk-build=<(sdk_build)',
                         '--app_abi',
                         '<(android_app_abi)',
                     ],
diff --git a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
index d3664a129..e98410d31 100644
--- a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
+++ b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
@@ -22,9 +22,12 @@
 		1ADBEFE3130C6AA100D61D19 /* simple-accelerated-compositing.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 1ADBEFBC130C6A0100D61D19 /* simple-accelerated-compositing.html */; };
 		1AEDE22613E5E7E700E62FE8 /* InjectedBundleControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AEDE22413E5E7A000E62FE8 /* InjectedBundleControllerMac.mm */; };
 		261516D615B0E60500A2C201 /* SetAndUpdateCacheModel.mm in Sources */ = {isa = PBXBuildFile; fileRef = 261516D515B0E60500A2C201 /* SetAndUpdateCacheModel.mm */; };
+		265AF55015D1E48A00B0CB4A /* WTFString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 265AF54F15D1E48A00B0CB4A /* WTFString.cpp */; };
 		26B2DFF915BDE599004F691D /* HashSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 26B2DFF815BDE599004F691D /* HashSet.cpp */; };
 		26DF5A5E15A29BAA003689C2 /* CancelLoadFromResourceLoadDelegate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 26DF5A5D15A29BAA003689C2 /* CancelLoadFromResourceLoadDelegate.mm */; };
 		26DF5A6315A2A27E003689C2 /* CancelLoadFromResourceLoadDelegate.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 26DF5A6115A2A22B003689C2 /* CancelLoadFromResourceLoadDelegate.html */; };
+		26F1B44415CA434F00D1E4BF /* AtomicString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 26F1B44215CA434F00D1E4BF /* AtomicString.cpp */; };
+		26F1B44515CA434F00D1E4BF /* StringImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 26F1B44315CA434F00D1E4BF /* StringImpl.cpp */; };
 		333B9CE21277F23100FEFCE3 /* PreventEmptyUserAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 333B9CE11277F23100FEFCE3 /* PreventEmptyUserAgent.cpp */; };
 		33BE5AF5137B5A6C00705813 /* MouseMoveAfterCrash.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33BE5AF4137B5A6C00705813 /* MouseMoveAfterCrash.cpp */; };
 		33BE5AF9137B5AAE00705813 /* MouseMoveAfterCrash_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33BE5AF8137B5AAE00705813 /* MouseMoveAfterCrash_Bundle.cpp */; };
@@ -156,9 +159,9 @@
 		C507E8A714C6545B005D6B3B /* InspectorBar.mm in Sources */ = {isa = PBXBuildFile; fileRef = C507E8A614C6545B005D6B3B /* InspectorBar.mm */; };
 		C540F776152E4DA000A40C8C /* SimplifyMarkup.mm in Sources */ = {isa = PBXBuildFile; fileRef = C540F775152E4DA000A40C8C /* SimplifyMarkup.mm */; };
 		C540F784152E5A9A00A40C8C /* verboseMarkup.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = C540F783152E5A7800A40C8C /* verboseMarkup.html */; };
+		CD5497B415857F0C00B5BC30 /* MediaTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD5497B315857F0C00B5BC30 /* MediaTime.cpp */; };
 		E1220DA0155B25480013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1220D9F155B25480013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.mm */; };
 		E1220DCA155B28AA0013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = E1220DC9155B287D0013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.html */; };
-		CD5497B415857F0C00B5BC30 /* MediaTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD5497B315857F0C00B5BC30 /* MediaTime.cpp */; };
 		E490296814E2E3A4002BEDD1 /* TypingStyleCrash.mm in Sources */ = {isa = PBXBuildFile; fileRef = E490296714E2E3A4002BEDD1 /* TypingStyleCrash.mm */; };
 		F3FC3EE313678B7300126A65 /* libgtest.a in Frameworks */ = {isa = PBXBuildFile; fileRef = F3FC3EE213678B7300126A65 /* libgtest.a */; };
 		F660AA0D15A5F061003A1243 /* GetInjectedBundleInitializationUserDataCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F660AA0C15A5F061003A1243 /* GetInjectedBundleInitializationUserDataCallback.cpp */; };
@@ -249,9 +252,12 @@
 		1ADBEFBC130C6A0100D61D19 /* simple-accelerated-compositing.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "simple-accelerated-compositing.html"; sourceTree = "<group>"; };
 		1AEDE22413E5E7A000E62FE8 /* InjectedBundleControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = InjectedBundleControllerMac.mm; sourceTree = "<group>"; };
 		261516D515B0E60500A2C201 /* SetAndUpdateCacheModel.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SetAndUpdateCacheModel.mm; sourceTree = "<group>"; };
+		265AF54F15D1E48A00B0CB4A /* WTFString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WTFString.cpp; path = WTF/WTFString.cpp; sourceTree = "<group>"; };
 		26B2DFF815BDE599004F691D /* HashSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = HashSet.cpp; path = WTF/HashSet.cpp; sourceTree = "<group>"; };
 		26DF5A5D15A29BAA003689C2 /* CancelLoadFromResourceLoadDelegate.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CancelLoadFromResourceLoadDelegate.mm; sourceTree = "<group>"; };
 		26DF5A6115A2A22B003689C2 /* CancelLoadFromResourceLoadDelegate.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = CancelLoadFromResourceLoadDelegate.html; sourceTree = "<group>"; };
+		26F1B44215CA434F00D1E4BF /* AtomicString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AtomicString.cpp; path = WTF/AtomicString.cpp; sourceTree = "<group>"; };
+		26F1B44315CA434F00D1E4BF /* StringImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = StringImpl.cpp; path = WTF/StringImpl.cpp; sourceTree = "<group>"; };
 		333B9CE11277F23100FEFCE3 /* PreventEmptyUserAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PreventEmptyUserAgent.cpp; sourceTree = "<group>"; };
 		33BE5AF4137B5A6C00705813 /* MouseMoveAfterCrash.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MouseMoveAfterCrash.cpp; sourceTree = "<group>"; };
 		33BE5AF8137B5AAE00705813 /* MouseMoveAfterCrash_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MouseMoveAfterCrash_Bundle.cpp; sourceTree = "<group>"; };
@@ -399,9 +405,9 @@
 		C507E8A614C6545B005D6B3B /* InspectorBar.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = InspectorBar.mm; sourceTree = "<group>"; };
 		C540F775152E4DA000A40C8C /* SimplifyMarkup.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SimplifyMarkup.mm; sourceTree = "<group>"; };
 		C540F783152E5A7800A40C8C /* verboseMarkup.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = verboseMarkup.html; sourceTree = "<group>"; };
+		CD5497B315857F0C00B5BC30 /* MediaTime.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = MediaTime.cpp; path = WTF/MediaTime.cpp; sourceTree = "<group>"; };
 		E1220D9F155B25480013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = MemoryCacheDisableWithinResourceLoadDelegate.mm; sourceTree = "<group>"; };
 		E1220DC9155B287D0013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = MemoryCacheDisableWithinResourceLoadDelegate.html; sourceTree = "<group>"; };
-		CD5497B315857F0C00B5BC30 /* MediaTime.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = MediaTime.cpp; path = WTF/MediaTime.cpp; sourceTree = "<group>"; };
 		E490296714E2E3A4002BEDD1 /* TypingStyleCrash.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = TypingStyleCrash.mm; sourceTree = "<group>"; };
 		F3FC3EE213678B7300126A65 /* libgtest.a */ = {isa = PBXFileReference; lastKnownFileType = archive.ar; path = libgtest.a; sourceTree = BUILT_PRODUCTS_DIR; };
 		F660AA0C15A5F061003A1243 /* GetInjectedBundleInitializationUserDataCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetInjectedBundleInitializationUserDataCallback.cpp; sourceTree = "<group>"; };
@@ -621,6 +627,7 @@
 			children = (
 				BC029B1A1486B23800817DA9 /* ns */,
 				C0991C4F143C7D68007998F2 /* cf */,
+				26F1B44215CA434F00D1E4BF /* AtomicString.cpp */,
 				CD5497B315857F0C00B5BC30 /* MediaTime.cpp */,
 				0FC6C4CE141034AD005B7F0C /* MetaAllocator.cpp */,
 				0FC6C4CB141027E0005B7F0C /* RedBlackTree.cpp */,
@@ -629,11 +636,13 @@
 				0BCD833414857CE400EA2003 /* HashMap.cpp */,
 				26B2DFF815BDE599004F691D /* HashSet.cpp */,
 				81B50192140F232300D9EB58 /* StringBuilder.cpp */,
+				26F1B44315CA434F00D1E4BF /* StringImpl.cpp */,
 				C01363C713C3997300EF3964 /* StringOperators.cpp */,
 				0BCD85691485C98B00EA2003 /* TemporaryChange.cpp */,
 				BC55F5F814AD78EE00484BE1 /* Vector.cpp */,
 				BC90964B125561BF00083756 /* VectorBasic.cpp */,
 				37200B9113A16230007A4FAD /* VectorReverse.cpp */,
+				265AF54F15D1E48A00B0CB4A /* WTFString.cpp */,
 			);
 			name = WTF;
 			sourceTree = "<group>";
@@ -861,6 +870,7 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				26F1B44415CA434F00D1E4BF /* AtomicString.cpp in Sources */,
 				BC131885117114B600B69727 /* PlatformUtilitiesMac.mm in Sources */,
 				BC131A9B1171316900B69727 /* main.mm in Sources */,
 				BC131AA9117131FC00B69727 /* TestsController.cpp in Sources */,
@@ -901,6 +911,7 @@
 				C085880013FEC3A6001EF4E5 /* InstanceMethodSwizzler.mm in Sources */,
 				37DC678D140D7C5000ABCCDB /* DOMRangeOfString.mm in Sources */,
 				81B50193140F232300D9EB58 /* StringBuilder.cpp in Sources */,
+				26F1B44515CA434F00D1E4BF /* StringImpl.cpp in Sources */,
 				0FC6C4CC141027E0005B7F0C /* RedBlackTree.cpp in Sources */,
 				0FC6C4CF141034AD005B7F0C /* MetaAllocator.cpp in Sources */,
 				A7A966DB140ECCC8005EF9B4 /* CheckedArithmeticOperations.cpp in Sources */,
@@ -957,6 +968,7 @@
 				26B2DFF915BDE599004F691D /* HashSet.cpp in Sources */,
 				00CD9F6315BE312C002DA2CE /* BackForwardList.mm in Sources */,
 				CD5497B415857F0C00B5BC30 /* MediaTime.cpp in Sources */,
+				265AF55015D1E48A00B0CB4A /* WTFString.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Tools/TestWebKitAPI/Tests/WTF/AtomicString.cpp b/Tools/TestWebKitAPI/Tests/WTF/AtomicString.cpp
new file mode 100644
index 000000000..bddf22c23
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WTF/AtomicString.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <wtf/text/AtomicString.h>
+
+namespace TestWebKitAPI {
+
+TEST(WTF, AtomicStringCreationFromLiteral)
+{
+    AtomicString stringWithTemplate("Template Literal", AtomicString::ConstructFromLiteral);
+    ASSERT_EQ(strlen("Template Literal"), stringWithTemplate.length());
+    ASSERT_TRUE(stringWithTemplate == "Template Literal");
+    ASSERT_TRUE(stringWithTemplate.string().is8Bit());
+    ASSERT_TRUE(stringWithTemplate.impl()->hasTerminatingNullCharacter());
+
+    const char* programmaticStringData = "Explicit Size Literal";
+    AtomicString programmaticString(programmaticStringData, strlen(programmaticStringData), AtomicString::ConstructFromLiteral);
+    ASSERT_EQ(strlen(programmaticStringData), programmaticString.length());
+    ASSERT_TRUE(programmaticStringData == programmaticStringData);
+    ASSERT_TRUE(programmaticString.string().is8Bit());
+    ASSERT_TRUE(programmaticString.impl()->hasTerminatingNullCharacter());
+    ASSERT_EQ(programmaticStringData, reinterpret_cast<const char*>(programmaticString.string().characters8()));
+}
+
+TEST(WTF, AtomicStringCreationFromLiteralUniqueness)
+{
+    AtomicString string1("Template Literal", AtomicString::ConstructFromLiteral);
+    AtomicString string2("Template Literal", AtomicString::ConstructFromLiteral);
+    ASSERT_EQ(string1.impl(), string2.impl());
+
+    AtomicString string3("Template Literal");
+    ASSERT_EQ(string1.impl(), string3.impl());
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WTF/StringImpl.cpp b/Tools/TestWebKitAPI/Tests/WTF/StringImpl.cpp
new file mode 100644
index 000000000..213a655aa
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WTF/StringImpl.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <wtf/text/StringImpl.h>
+
+namespace TestWebKitAPI {
+
+TEST(WTF, StringImplCreationFromLiteral)
+{
+    // Constructor using the template to determine the size.
+    RefPtr<StringImpl> stringWithTemplate = StringImpl::createFromLiteral("Template Literal");
+    ASSERT_EQ(strlen("Template Literal"), stringWithTemplate->length());
+    ASSERT_TRUE(equal(stringWithTemplate.get(), "Template Literal"));
+    ASSERT_TRUE(stringWithTemplate->is8Bit());
+    ASSERT_TRUE(stringWithTemplate->hasTerminatingNullCharacter());
+
+    // Constructor taking the size explicitely.
+    const char* programmaticStringData = "Explicit Size Literal";
+    RefPtr<StringImpl> programmaticString = StringImpl::createFromLiteral(programmaticStringData, strlen(programmaticStringData));
+    ASSERT_EQ(strlen(programmaticStringData), programmaticString->length());
+    ASSERT_TRUE(equal(programmaticString.get(), programmaticStringData));
+    ASSERT_EQ(programmaticStringData, reinterpret_cast<const char*>(programmaticString->characters8()));
+    ASSERT_TRUE(programmaticString->is8Bit());
+    ASSERT_TRUE(programmaticString->hasTerminatingNullCharacter());
+
+    // Constructor without explicit size.
+    const char* stringWithoutLengthLiteral = "No Size Literal";
+    RefPtr<StringImpl> programmaticStringNoLength = StringImpl::createFromLiteral(stringWithoutLengthLiteral);
+    ASSERT_EQ(strlen(stringWithoutLengthLiteral), programmaticStringNoLength->length());
+    ASSERT_TRUE(equal(programmaticStringNoLength.get(), stringWithoutLengthLiteral));
+    ASSERT_EQ(stringWithoutLengthLiteral, reinterpret_cast<const char*>(programmaticStringNoLength->characters8()));
+    ASSERT_TRUE(programmaticStringNoLength->is8Bit());
+    ASSERT_TRUE(programmaticStringNoLength->hasTerminatingNullCharacter());
+}
+
+TEST(WTF, StringImplFromLiteralLoop16BitConversion)
+{
+    RefPtr<StringImpl> controlString = StringImpl::create("Template Literal");
+    for (size_t i = 0; i < 10; ++i) {
+        RefPtr<StringImpl> string = StringImpl::createFromLiteral("Template Literal");
+
+        ASSERT_EQ(0, memcmp(controlString->characters(), string->characters(), controlString->length() * sizeof(UChar)));
+        ASSERT_TRUE(string->has16BitShadow());
+    }
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WTF/WTFString.cpp b/Tools/TestWebKitAPI/Tests/WTF/WTFString.cpp
new file mode 100644
index 000000000..accf452cf
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WTF/WTFString.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <wtf/text/WTFString.h>
+
+namespace TestWebKitAPI {
+
+TEST(WTF, StringCreationFromLiteral)
+{
+    String stringFromLiteral(ASCIILiteral("Explicit construction syntax"));
+    ASSERT_EQ(strlen("Explicit construction syntax"), stringFromLiteral.length());
+    ASSERT_TRUE(stringFromLiteral == "Explicit construction syntax");
+    ASSERT_TRUE(stringFromLiteral.is8Bit());
+    ASSERT_TRUE(stringFromLiteral.impl()->hasTerminatingNullCharacter());
+    ASSERT_TRUE(String("Explicit construction syntax") == stringFromLiteral);
+
+    String stringWithTemplate("Template Literal", String::ConstructFromLiteral);
+    ASSERT_EQ(strlen("Template Literal"), stringWithTemplate.length());
+    ASSERT_TRUE(stringWithTemplate == "Template Literal");
+    ASSERT_TRUE(stringWithTemplate.is8Bit());
+    ASSERT_TRUE(stringWithTemplate.impl()->hasTerminatingNullCharacter());
+    ASSERT_TRUE(String("Template Literal") == stringWithTemplate);
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/WKPreferences.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/WKPreferences.cpp
index 5af01ebb4..bdfa55fcb 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/WKPreferences.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/WKPreferences.cpp
@@ -101,6 +101,7 @@ TEST(WebKit2, WKPreferencesDefaults)
     EXPECT_FALSE(WKPreferencesGetCompositingBordersVisible(preference));
     EXPECT_FALSE(WKPreferencesGetCompositingRepaintCountersVisible(preference));
     EXPECT_FALSE(WKPreferencesGetNeedsSiteSpecificQuirks(preference));
+    EXPECT_FALSE(WKPreferencesGetThirdPartyStorageBlockingEnabled(preference));
 
     WKRelease(preference);
 }
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2ObjC/WKBrowsingContextLoadDelegateTest.mm b/Tools/TestWebKitAPI/Tests/WebKit2ObjC/WKBrowsingContextLoadDelegateTest.mm
index f7f175d2e..6cadf0b14 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2ObjC/WKBrowsingContextLoadDelegateTest.mm
+++ b/Tools/TestWebKitAPI/Tests/WebKit2ObjC/WKBrowsingContextLoadDelegateTest.mm
@@ -35,6 +35,8 @@
 
 #import "PlatformUtilities.h"
 
+namespace {
+
 class WKBrowsingContextLoadDelegateTest : public ::testing::Test { 
 public:
     WKProcessGroup *processGroup;
@@ -63,17 +65,32 @@ public:
     }
 };
 
-
-static bool simpleLoadDone;
+} // namespace
 
 @interface SimpleLoadDelegate : NSObject <WKBrowsingContextLoadDelegate>
+{
+    bool* _simpleLoadDone;
+}
+
+- (id)initWithFlag:(bool*)flag;
+
 @end
 
 @implementation SimpleLoadDelegate
 
+- (id)initWithFlag:(bool*)flag
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    _simpleLoadDone = flag;
+    return self;
+}
+
 - (void)browsingContextControllerDidFinishLoad:(WKBrowsingContextController *)sender
 {
-    simpleLoadDone = true;
+    *_simpleLoadDone = true;
 }
 
 @end
@@ -85,8 +102,10 @@ TEST_F(WKBrowsingContextLoadDelegateTest, Empty)
 
 TEST_F(WKBrowsingContextLoadDelegateTest, SimpleLoad)
 {
+    bool simpleLoadDone = false;
+
     // Add the load delegate.
-    SimpleLoadDelegate *loadDelegate = [[SimpleLoadDelegate alloc] init];
+    SimpleLoadDelegate *loadDelegate = [[SimpleLoadDelegate alloc] initWithFlag:&simpleLoadDone];
     view.browsingContextController.loadDelegate = loadDelegate;
 
     // Load the file.
@@ -101,28 +120,100 @@ TEST_F(WKBrowsingContextLoadDelegateTest, SimpleLoad)
     [loadDelegate release];
 }
 
+TEST_F(WKBrowsingContextLoadDelegateTest, SimpleLoadOfHTMLString)
+{
+    bool simpleLoadDone = false;
+
+    // Add the load delegate.
+    SimpleLoadDelegate *loadDelegate = [[SimpleLoadDelegate alloc] initWithFlag:&simpleLoadDone];
+    view.browsingContextController.loadDelegate = loadDelegate;
+
+    // Load the HTML string.
+    [view.browsingContextController loadHTMLString:@"<html><body>Simple HTML String</body></html>" baseURL:[NSURL URLWithString:@"about:blank"]];
+
+    // Wait for the load to finish.
+    TestWebKitAPI::Util::run(&simpleLoadDone);
+
+    // Tear down the delegate.
+    view.browsingContextController.loadDelegate = nil;
+    [loadDelegate release];
+}
+
+TEST_F(WKBrowsingContextLoadDelegateTest, SimpleLoadOfHTMLString_NilBaseURL)
+{
+    bool simpleLoadDone = false;
+
+    // Add the load delegate.
+    SimpleLoadDelegate *loadDelegate = [[SimpleLoadDelegate alloc] initWithFlag:&simpleLoadDone];
+    view.browsingContextController.loadDelegate = loadDelegate;
+
+    // Load the HTML string, pass nil as the baseURL.
+    [view.browsingContextController loadHTMLString:@"<html><body>Simple HTML String</body></html>" baseURL:nil];
+
+    // Wait for the load to finish.
+    TestWebKitAPI::Util::run(&simpleLoadDone);
+
+    // Tear down the delegate.
+    view.browsingContextController.loadDelegate = nil;
+    [loadDelegate release];
+}
+
+TEST_F(WKBrowsingContextLoadDelegateTest, SimpleLoadOfHTMLString_NilHTMLStringAndBaseURL)
+{
+    bool simpleLoadDone = false;
+
+    // Add the load delegate.
+    SimpleLoadDelegate *loadDelegate = [[SimpleLoadDelegate alloc] initWithFlag:&simpleLoadDone];
+    view.browsingContextController.loadDelegate = loadDelegate;
+
+    // Load the HTML string (as nil).
+    [view.browsingContextController loadHTMLString:nil baseURL:nil];
+
+    // Wait for the load to finish.
+    TestWebKitAPI::Util::run(&simpleLoadDone);
 
-static bool simpleLoadFailDone;
+    // Tear down the delegate.
+    view.browsingContextController.loadDelegate = nil;
+    [loadDelegate release];
+}
 
 @interface SimpleLoadFailDelegate : NSObject <WKBrowsingContextLoadDelegate>
+{
+    bool* _simpleLoadFailDone;
+}
+
+- (id)initWithFlag:(bool*)flag;
+
 @end
 
 @implementation SimpleLoadFailDelegate
 
+- (id)initWithFlag:(bool*)flag
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    _simpleLoadFailDone = flag;
+    return self;
+}
+
 - (void)browsingContextControllerDidFailProvisionalLoad:(WKBrowsingContextController *)sender withError:(NSError *)error
 {
     EXPECT_EQ(-1100, error.code);
     EXPECT_WK_STREQ(NSURLErrorDomain, error.domain);
     
-    simpleLoadFailDone = true;
+    *_simpleLoadFailDone = true;
 }
 
 @end
 
 TEST_F(WKBrowsingContextLoadDelegateTest, SimpleLoadFail)
 {
+    bool simpleLoadFailDone = false;
+
     // Add the load delegate.
-    SimpleLoadFailDelegate *loadDelegate = [[SimpleLoadFailDelegate alloc] init];
+    SimpleLoadFailDelegate *loadDelegate = [[SimpleLoadFailDelegate alloc] initWithFlag:&simpleLoadFailDone];
     view.browsingContextController.loadDelegate = loadDelegate;
 
     // Load a non-existent file.
diff --git a/Tools/TestWebKitAPI/Tests/gtk/InputMethodFilter.cpp b/Tools/TestWebKitAPI/Tests/gtk/InputMethodFilter.cpp
index c2bdcce4b..de408831f 100644
--- a/Tools/TestWebKitAPI/Tests/gtk/InputMethodFilter.cpp
+++ b/Tools/TestWebKitAPI/Tests/gtk/InputMethodFilter.cpp
@@ -27,6 +27,7 @@
 
 #include "GtkInputMethodFilter.h"
 #include "WTFStringUtilities.h"
+#include <gdk/gdkkeysyms.h>
 #include <gtk/gtk.h>
 #include <wtf/gobject/GOwnPtr.h>
 #include <wtf/gobject/GRefPtr.h>
diff --git a/Tools/TestWebKitAPI/config.h b/Tools/TestWebKitAPI/config.h
index e3c2eb02d..97bb958ef 100644
--- a/Tools/TestWebKitAPI/config.h
+++ b/Tools/TestWebKitAPI/config.h
@@ -50,7 +50,7 @@
 #include <stdint.h>
 
 #if !PLATFORM(CHROMIUM) || (PLATFORM(GTK) && defined(BUILDING_WEBKIT2__))
-#include <WebKit2/WebKit2.h>
+#include <WebKit2/WebKit2_C.h>
 #endif
 
 #ifdef __clang__
diff --git a/Tools/TestWebKitAPI/efl/InjectedBundleController.cpp b/Tools/TestWebKitAPI/efl/InjectedBundleController.cpp
index 5d55002cc..c2442bd15 100644
--- a/Tools/TestWebKitAPI/efl/InjectedBundleController.cpp
+++ b/Tools/TestWebKitAPI/efl/InjectedBundleController.cpp
@@ -26,10 +26,13 @@
 #include "config.h"
 #include "InjectedBundleController.h"
 
+#include <wtf/Assertions.h>
+
 namespace TestWebKitAPI {
 
 void InjectedBundleController::platformInitialize()
 {
+    WTFInstallReportBacktraceOnCrashHook();
 }
 
 } // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/efl/main.cpp b/Tools/TestWebKitAPI/efl/main.cpp
index 7c77dbfb2..c69ec450c 100644
--- a/Tools/TestWebKitAPI/efl/main.cpp
+++ b/Tools/TestWebKitAPI/efl/main.cpp
@@ -29,6 +29,7 @@
 #include <Ecore.h>
 #include <Eina.h>
 #include <getopt.h>
+#include <wtf/Assertions.h>
 
 bool useX11Window = false;
 
@@ -48,6 +49,8 @@ static bool checkForUseX11WindowArgument(int argc, char** argv)
 
 int main(int argc, char** argv)
 {
+    WTFInstallReportBacktraceOnCrashHook();
+
     if (!eina_init())
         return EXIT_FAILURE;
 
diff --git a/Tools/Tools.pro b/Tools/Tools.pro
index 6cb07d899..9590c53a9 100644
--- a/Tools/Tools.pro
+++ b/Tools/Tools.pro
@@ -15,9 +15,9 @@ CONFIG += ordered
 
 !no_webkit2 {
     # WTR's InjectedBundle depends currently on WK1's DumpRenderTreeSupport
-    !no_webkit1: SUBDIRS += WebKitTestRunner/WebKitTestRunner.pro
+    !no_webkit1:contains(DEFINES, HAVE_QTQUICK=1): SUBDIRS += WebKitTestRunner/WebKitTestRunner.pro
 
-    SUBDIRS += MiniBrowser/qt/MiniBrowser.pro
+    contains(DEFINES, HAVE_QTQUICK=1): SUBDIRS += MiniBrowser/qt/MiniBrowser.pro
     SUBDIRS += MiniBrowser/qt/raw/MiniBrowserRaw.pro
 }
 
diff --git a/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl b/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl
index 768e89fe1..df608da3a 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl
+++ b/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl
@@ -44,6 +44,7 @@ module WTR {
         void dumpFullScreenCallbacks();
         void dumpFrameLoadCallbacks();
         void dumpProgressFinishedCallback();
+        void dumpResourceResponseMIMETypes();
 
         // Special options.
         void keepWebHistory();
@@ -62,6 +63,8 @@ module WTR {
         void setAuthorAndUserStylesEnabled(in boolean value);
         void addOriginAccessWhitelistEntry(in DOMString sourceOrigin, in DOMString destinationProtocol, in DOMString destinationHost, in boolean allowDestinationSubdomains);
         void removeOriginAccessWhitelistEntry(in DOMString sourceOrigin, in DOMString destinationProtocol, in DOMString destinationHost, in boolean allowDestinationSubdomains);
+        void setUserStyleSheetEnabled(in boolean value);
+        void setUserStyleSheetLocation(in DOMString location);
 
         // Special DOM functions.
         void clearBackForwardList();
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
index 2a940caa6..002e7f901 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
@@ -34,7 +34,7 @@
 #include <WebKit2/WKBundlePagePrivate.h>
 #include <WebKit2/WKBundlePrivate.h>
 #include <WebKit2/WKRetainPtr.h>
-#include <WebKit2/WebKit2.h>
+#include <WebKit2/WebKit2_C.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringBuilder.h>
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
index 16371d1bc..de32cb08d 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
@@ -944,7 +944,17 @@ void InjectedBundlePage::didInitiateLoadForResource(WKBundlePageRef, WKBundleFra
 
 // Resource Load Client Callbacks
 
-WKURLRequestRef InjectedBundlePage::willSendRequestForFrame(WKBundlePageRef, WKBundleFrameRef, uint64_t, WKURLRequestRef request, WKURLResponseRef)
+static inline bool isLocalHost(WKStringRef host)
+{
+    return WKStringIsEqualToUTF8CString(host, "127.0.0.1") || WKStringIsEqualToUTF8CString(host, "localhost");
+}
+
+static inline bool isHTTPOrHTTPSScheme(WKStringRef scheme)
+{
+    return WKStringIsEqualToUTF8CStringIgnoringCase(scheme, "http") || WKStringIsEqualToUTF8CStringIgnoringCase(scheme, "https");
+}
+
+WKURLRequestRef InjectedBundlePage::willSendRequestForFrame(WKBundlePageRef, WKBundleFrameRef frame, uint64_t, WKURLRequestRef request, WKURLResponseRef)
 {
     if (InjectedBundle::shared().isTestRunning() && InjectedBundle::shared().layoutTestController()->willSendRequestReturnsNull())
         return 0;
@@ -954,22 +964,48 @@ WKURLRequestRef InjectedBundlePage::willSendRequestForFrame(WKBundlePageRef, WKB
     WKRetainPtr<WKStringRef> scheme = adoptWK(WKURLCopyScheme(url.get()));
     WKRetainPtr<WKStringRef> urlString = adoptWK(WKURLCopyString(url.get()));
     if (host && !WKStringIsEmpty(host.get())
-        && (WKStringIsEqualToUTF8CStringIgnoringCase(scheme.get(), "http") || WKStringIsEqualToUTF8CStringIgnoringCase(scheme.get(), "https"))
-        && !WKStringIsEqualToUTF8CString(host.get(), "127.0.0.1")
+        && isHTTPOrHTTPSScheme(scheme.get())
         && !WKStringIsEqualToUTF8CString(host.get(), "255.255.255.255") // Used in some tests that expect to get back an error.
-        && !WKStringIsEqualToUTF8CStringIgnoringCase(host.get(), "localhost")) {
-        InjectedBundle::shared().stringBuilder()->append("Blocked access to external URL ");
-        InjectedBundle::shared().stringBuilder()->append(toWTFString(urlString));
-        InjectedBundle::shared().stringBuilder()->append("\n");
-        return 0;
+        && !isLocalHost(host.get())) {
+        bool mainFrameIsExternal = false;
+        if (InjectedBundle::shared().isTestRunning()) {
+            WKBundleFrameRef mainFrame = InjectedBundle::shared().topLoadingFrame();
+            WKRetainPtr<WKURLRef> mainFrameURL = adoptWK(WKBundleFrameCopyURL(mainFrame));
+            if (!mainFrameURL || WKStringIsEqualToUTF8CString(adoptWK(WKURLCopyString(mainFrameURL.get())).get(), "about:blank"))
+                mainFrameURL = adoptWK(WKBundleFrameCopyProvisionalURL(mainFrame));
+
+            WKRetainPtr<WKStringRef> mainFrameHost = WKURLCopyHostName(mainFrameURL.get());
+            WKRetainPtr<WKStringRef> mainFrameScheme = WKURLCopyScheme(mainFrameURL.get());
+            mainFrameIsExternal = isHTTPOrHTTPSScheme(mainFrameScheme.get()) && !isLocalHost(mainFrameHost.get());
+        }
+        if (!mainFrameIsExternal) {
+            InjectedBundle::shared().stringBuilder()->append("Blocked access to external URL ");
+            InjectedBundle::shared().stringBuilder()->append(toWTFString(urlString));
+            InjectedBundle::shared().stringBuilder()->append("\n");
+            return 0;
+        }
     }
 
     WKRetain(request);
     return request;
 }
 
-void InjectedBundlePage::didReceiveResponseForResource(WKBundlePageRef, WKBundleFrameRef, uint64_t, WKURLResponseRef)
+void InjectedBundlePage::didReceiveResponseForResource(WKBundlePageRef, WKBundleFrameRef, uint64_t, WKURLResponseRef response)
 {
+    if (!InjectedBundle::shared().isTestRunning())
+        return;
+
+    if (!InjectedBundle::shared().layoutTestController()->shouldDumpResourceResponseMIMETypes())
+        return;
+
+    WKRetainPtr<WKURLRef> url = adoptWK(WKURLResponseCopyURL(response));
+    WKRetainPtr<WKStringRef> urlString = adoptWK(WKURLCopyLastPathComponent(url.get()));
+    WKRetainPtr<WKStringRef> mimeTypeString = adoptWK(WKURLResponseCopyMIMEType(response));
+
+    InjectedBundle::shared().stringBuilder()->append(toWTFString(urlString));
+    InjectedBundle::shared().stringBuilder()->append(" has MIME type ");
+    InjectedBundle::shared().stringBuilder()->append(toWTFString(mimeTypeString));
+    InjectedBundle::shared().stringBuilder()->append("\n");
 }
 
 void InjectedBundlePage::didReceiveContentLengthForResource(WKBundlePageRef, WKBundleFrameRef, uint64_t, uint64_t)
diff --git a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
index 4981b3c58..cdffcae08 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
@@ -43,7 +43,7 @@
 #include <WebKit2/WKBundleScriptWorld.h>
 #include <WebKit2/WKRetainPtr.h>
 #include <WebKit2/WKSerializedScriptValue.h>
-#include <WebKit2/WebKit2.h>
+#include <WebKit2/WebKit2_C.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/HashMap.h>
 #include <wtf/text/StringBuilder.h>
@@ -77,6 +77,7 @@ LayoutTestController::LayoutTestController()
     , m_dumpFullScreenCallbacks(false)
     , m_dumpFrameLoadCallbacks(false)
     , m_dumpProgressFinishedCallback(false)
+    , m_dumpResourceResponseMIMETypes(false)
     , m_waitToDump(false)
     , m_testRepaint(false)
     , m_testRepaintSweepHorizontally(false)
@@ -85,6 +86,8 @@ LayoutTestController::LayoutTestController()
     , m_policyDelegatePermissive(false)
     , m_globalFlag(false)
     , m_customFullScreenBehavior(false)
+    , m_userStyleSheetEnabled(false)
+    , m_userStyleSheetLocation(adoptWK(WKStringCreateWithUTF8CString("")))
 {
     platformInitialize();
 }
@@ -415,7 +418,6 @@ void LayoutTestController::clearBackForwardList()
 
 void LayoutTestController::makeWindowObject(JSContextRef context, JSObjectRef windowObject, JSValueRef* exception)
 {
-    setProperty(context, windowObject, "layoutTestController", this, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
     setProperty(context, windowObject, "testRunner", this, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
 }
 
@@ -664,4 +666,21 @@ double LayoutTestController::preciseTime()
     return currentTime();
 }
 
+void LayoutTestController::setUserStyleSheetEnabled(bool enabled)
+{
+    m_userStyleSheetEnabled = enabled;
+
+    WKRetainPtr<WKStringRef> emptyUrl = adoptWK(WKStringCreateWithUTF8CString(""));
+    WKStringRef location = enabled ? m_userStyleSheetLocation.get() : emptyUrl.get();
+    WKBundleSetUserStyleSheetLocation(InjectedBundle::shared().bundle(), InjectedBundle::shared().pageGroup(), location);
+}
+
+void LayoutTestController::setUserStyleSheetLocation(JSStringRef location)
+{
+    m_userStyleSheetLocation = adoptWK(WKStringCreateWithJSString(location));
+
+    if (m_userStyleSheetEnabled)
+        setUserStyleSheetEnabled(true);
+}
+
 } // namespace WTR
diff --git a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
index 304396343..517a5160a 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
+++ b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
@@ -29,6 +29,7 @@
 #include "JSWrappable.h"
 #include <JavaScriptCore/JSRetainPtr.h>
 #include <WebKit2/WKBundleScriptWorld.h>
+#include <WebKit2/WKRetainPtr.h>
 #include <string>
 #include <wtf/PassRefPtr.h>
 
@@ -78,6 +79,7 @@ public:
     void dumpFullScreenCallbacks() { m_dumpFullScreenCallbacks = true; }
     void dumpFrameLoadCallbacks() { setShouldDumpFrameLoadCallbacks(true); }
     void dumpProgressFinishedCallback() { setShouldDumpProgressFinishedCallback(true); }
+    void dumpResourceResponseMIMETypes() { m_dumpResourceResponseMIMETypes = true; }
 
     void setShouldDumpFrameLoadCallbacks(bool value) { m_dumpFrameLoadCallbacks = value; }
     void setShouldDumpProgressFinishedCallback(bool value) { m_dumpProgressFinishedCallback = value; }
@@ -100,6 +102,8 @@ public:
     void setCustomPolicyDelegate(bool enabled, bool permissive = false);
     void addOriginAccessWhitelistEntry(JSStringRef sourceOrigin, JSStringRef destinationProtocol, JSStringRef destinationHost, bool allowDestinationSubdomains);
     void removeOriginAccessWhitelistEntry(JSStringRef sourceOrigin, JSStringRef destinationProtocol, JSStringRef destinationHost, bool allowDestinationSubdomains);
+    void setUserStyleSheetEnabled(bool);
+    void setUserStyleSheetLocation(JSStringRef);
 
     // Special DOM functions.
     JSValueRef computedStyleIncludingVisitedInfo(JSValueRef element);
@@ -158,7 +162,9 @@ public:
     bool shouldDumpPixels() const { return m_dumpPixels; }
     bool shouldDumpFullScreenCallbacks() const { return m_dumpFullScreenCallbacks; }
     bool shouldDumpFrameLoadCallbacks() const { return m_dumpFrameLoadCallbacks; }
-    bool shouldDumpProgressFinishedCallback() { return m_dumpProgressFinishedCallback; }
+    bool shouldDumpProgressFinishedCallback() const { return m_dumpProgressFinishedCallback; }
+    bool shouldDumpResourceResponseMIMETypes() const { return m_dumpResourceResponseMIMETypes; }
+
     bool isPolicyDelegateEnabled() const { return m_policyDelegateEnabled; }
     bool isPolicyDelegatePermissive() const { return m_policyDelegatePermissive; }
 
@@ -243,6 +249,7 @@ private:
     bool m_dumpFullScreenCallbacks;
     bool m_dumpFrameLoadCallbacks;
     bool m_dumpProgressFinishedCallback;
+    bool m_dumpResourceResponseMIMETypes;
     bool m_waitToDump; // True if waitUntilDone() has been called, but notifyDone() has not yet been called.
     bool m_testRepaint;
     bool m_testRepaintSweepHorizontally;
@@ -255,6 +262,9 @@ private:
     bool m_globalFlag;
     bool m_customFullScreenBehavior;
 
+    bool m_userStyleSheetEnabled;
+    WKRetainPtr<WKStringRef> m_userStyleSheetLocation;
+
     PlatformTimerRef m_waitToDumpWatchdogTimer;
 };
 
diff --git a/Tools/WebKitTestRunner/InjectedBundle/efl/InjectedBundleEfl.cpp b/Tools/WebKitTestRunner/InjectedBundle/efl/InjectedBundleEfl.cpp
index 961d043f7..119832095 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/efl/InjectedBundleEfl.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/efl/InjectedBundleEfl.cpp
@@ -20,13 +20,13 @@
 #include "config.h"
 #include "InjectedBundle.h"
 
-#include <WebCore/NotImplemented.h>
+#include <wtf/Assertions.h>
 
 namespace WTR {
 
 void InjectedBundle::platformInitialize(WKTypeRef)
 {
-    notImplemented();
+    WTFInstallReportBacktraceOnCrashHook();
 }
 
 } // namespace WTR
diff --git a/Tools/WebKitTestRunner/InjectedBundle/mac/ActivateFonts.mm b/Tools/WebKitTestRunner/InjectedBundle/mac/ActivateFonts.mm
index 01d790bc8..57a08ca47 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/mac/ActivateFonts.mm
+++ b/Tools/WebKitTestRunner/InjectedBundle/mac/ActivateFonts.mm
@@ -139,6 +139,7 @@ static NSSet *allowedFontFamilySet()
         @"Skia",
         @"STFangsong",
         @"STHeiti",
+        @"STIXGeneral",
         @"STKaiti",
         @"STSong",
         @"Symbol",
diff --git a/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp b/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp
index 7164b70d2..845097307 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp
@@ -34,40 +34,8 @@
 #include <wtf/AlwaysInline.h>
 #include <wtf/Assertions.h>
 
-#if HAVE(SIGNAL_H)
-#include <signal.h>
-#endif
-
 namespace WTR {
 
-#if HAVE(SIGNAL_H)
-typedef void (*SignalHandler)(int);
-
-static NO_RETURN void crashHandler(int sig)
-{
-    WTFReportBacktrace();
-    exit(128 + sig);
-}
-
-static void setupSignalHandlers(SignalHandler handler)
-{
-    signal(SIGILL, handler);    /* 4:   illegal instruction (not reset when caught) */
-    signal(SIGTRAP, handler);   /* 5:   trace trap (not reset when caught) */
-    signal(SIGFPE, handler);    /* 8:   floating point exception */
-    signal(SIGBUS, handler);    /* 10:  bus error */
-    signal(SIGSEGV, handler);   /* 11:  segmentation violation */
-    signal(SIGSYS, handler);    /* 12:  bad argument to system call */
-    signal(SIGPIPE, handler);   /* 13:  write on a pipe with no reader */
-    signal(SIGXCPU, handler);   /* 24:  exceeded CPU time limit */
-    signal(SIGXFSZ, handler);   /* 25:  exceeded file size limit */
-}
-
-static void crashHook()
-{
-    setupSignalHandlers(SIG_DFL);
-}
-#endif
-
 void InjectedBundle::platformInitialize(WKTypeRef)
 {
     QWindowsStyle* styleForTests = new QWindowsStyle;
@@ -79,10 +47,7 @@ void InjectedBundle::platformInitialize(WKTypeRef)
     if (qgetenv("QT_WEBKIT2_DEBUG") == "1")
         return;
 
-#if HAVE(SIGNAL_H)
-    setupSignalHandlers(&crashHandler);
-    WTFSetCrashHook(&crashHook);
-#endif
+    WTFInstallReportBacktraceOnCrashHook();
 }
 
 } // namespace WTR
diff --git a/Tools/WebKitTestRunner/PlatformEfl.cmake b/Tools/WebKitTestRunner/PlatformEfl.cmake
index 6c930910b..e967d557c 100644
--- a/Tools/WebKitTestRunner/PlatformEfl.cmake
+++ b/Tools/WebKitTestRunner/PlatformEfl.cmake
@@ -43,6 +43,7 @@ LIST(APPEND WebKitTestRunner_LIBRARIES
     ${EDJE_LIBRARIES}
     ${EFLDEPS_LIBRARIES}
     ${Glib_LIBRARIES}
+    ${OPENGL_LIBRARIES}
     ${WTF_LIBRARY_NAME}
 )
 
diff --git a/Tools/WebKitTestRunner/Target.pri b/Tools/WebKitTestRunner/Target.pri
index b3b5c2c33..199a2a387 100644
--- a/Tools/WebKitTestRunner/Target.pri
+++ b/Tools/WebKitTestRunner/Target.pri
@@ -8,6 +8,7 @@ TEMPLATE = app
 TARGET = WebKitTestRunner
 
 HEADERS += \
+    $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/QtInitializeTestFonts.h \
     EventSenderProxy.h \
     PlatformWebView.h \
     StringFunctions.h \
@@ -15,6 +16,7 @@ HEADERS += \
     TestInvocation.h
 
 SOURCES += \
+    $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/QtInitializeTestFonts.cpp \
     qt/main.cpp \
     qt/EventSenderProxyQt.cpp \
     qt/PlatformWebViewQt.cpp \
@@ -25,12 +27,17 @@ SOURCES += \
 
 DESTDIR = $${ROOT_BUILD_DIR}/bin
 
-QT = core gui widgets network testlib quick quick-private webkit
+QT = core gui gui-private widgets network testlib quick quick-private webkit
 
 WEBKIT += wtf javascriptcore webkit2
 
 DEFINES += USE_SYSTEM_MALLOC=1
 
+contains(DEFINES, HAVE_FONTCONFIG=1): PKGCONFIG += fontconfig
+
+INCLUDEPATH += \
+    $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt
+
 PREFIX_HEADER = WebKitTestRunnerPrefix.h
 *-g++*:QMAKE_CXXFLAGS += "-include $$PREFIX_HEADER"
 *-clang*:QMAKE_CXXFLAGS += "-include $$PREFIX_HEADER"
diff --git a/Tools/WebKitTestRunner/TestController.cpp b/Tools/WebKitTestRunner/TestController.cpp
index d02329927..badb64643 100644
--- a/Tools/WebKitTestRunner/TestController.cpp
+++ b/Tools/WebKitTestRunner/TestController.cpp
@@ -35,7 +35,11 @@
 #include <WebKit2/WKPagePrivate.h>
 #include <WebKit2/WKPreferencesPrivate.h>
 #include <WebKit2/WKRetainPtr.h>
+#include <algorithm>
 #include <cstdio>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string>
 #include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(MAC)
@@ -48,6 +52,9 @@
 
 namespace WTR {
 
+// defaultLongTimeout + defaultShortTimeout should be less than 50,
+// the default timeout value of the test harness so we can detect an
+// unresponsive web process.
 static const double defaultLongTimeout = 30;
 static const double defaultShortTimeout = 15;
 static const double defaultNoTimeout = -1;
@@ -67,8 +74,7 @@ TestController& TestController::shared()
 }
 
 TestController::TestController(int argc, const char* argv[])
-    : m_dumpPixelsForAllTests(false)
-    , m_verbose(false)
+    : m_verbose(false)
     , m_printSeparators(false)
     , m_usingServerMode(false)
     , m_gcBetweenTests(false)
@@ -267,10 +273,6 @@ void TestController::initialize(int argc, const char* argv[])
             continue;
         }
 
-        if (argument == "--pixel-tests") {
-            m_dumpPixelsForAllTests = true;
-            continue;
-        }
         if (argument == "--verbose") {
             m_verbose = true;
             continue;
@@ -463,6 +465,9 @@ bool TestController::resetStateToConsistentValues()
     WKPreferencesSetFullScreenEnabled(preferences, true);
 #endif
     WKPreferencesSetPageCacheEnabled(preferences, false);
+    WKPreferencesSetAsynchronousPluginInitializationEnabled(preferences, false);
+    WKPreferencesSetAsynchronousPluginInitializationEnabledForAllPlugins(preferences, false);
+    WKPreferencesSetArtificialPluginInitializationDelayEnabled(preferences, false);
 
 // [Qt][WK2]REGRESSION(r104881):It broke hundreds of tests
 // FIXME: https://bugs.webkit.org/show_bug.cgi?id=76247
@@ -504,45 +509,97 @@ bool TestController::resetStateToConsistentValues()
     return m_doneResetting;
 }
 
-bool TestController::runTest(const char* test)
-{
-    if (!resetStateToConsistentValues()) {
-#if PLATFORM(MAC)
-        pid_t pid = WKPageGetProcessIdentifier(m_mainWebView->page());
-        fprintf(stderr, "#PROCESS UNRESPONSIVE - WebProcess (pid %ld)\n", static_cast<long>(pid));
-#else
-        fputs("#PROCESS UNRESPONSIVE - WebProcess\n", stderr);
-#endif
-        fflush(stderr);
-        return false;
-    }
+struct TestCommand {
+    TestCommand() : shouldDumpPixels(false) { }
 
-    bool dumpPixelsTest = m_dumpPixelsForAllTests;
-    std::string command(test);
-    std::string pathOrURL = command;
+    std::string pathOrURL;
+    bool shouldDumpPixels;
     std::string expectedPixelHash;
-    size_t firstSeparatorPos = command.find_first_of('\'');
-    size_t secondSeparatorPos = command.find_first_of('\'', firstSeparatorPos + 1);
-    if (firstSeparatorPos != std::string::npos) {
-        pathOrURL = std::string(command, 0, firstSeparatorPos);
-        size_t pixelHashPos = firstSeparatorPos + 1;
-
-        // NRWT passes --pixel-test if we should dump pixels for the test.
-        const std::string expectedPixelTestArg("--pixel-test");
-        std::string argTest = std::string(command, firstSeparatorPos + 1, expectedPixelTestArg.size());
-        if (argTest == expectedPixelTestArg) {
-            dumpPixelsTest = true;
-            pixelHashPos = secondSeparatorPos == std::string::npos ? std::string::npos : secondSeparatorPos + 1;
-        }
-        if (pixelHashPos != std::string::npos && pixelHashPos < command.size())
-            expectedPixelHash = std::string(command, pixelHashPos);
+};
+
+class CommandTokenizer {
+public:
+    explicit CommandTokenizer(const std::string& input)
+        : m_input(input)
+        , m_posNextSeparator(0)
+    {
+        pump();
     }
 
+    bool hasNext() const;
+    std::string next();
+
+private:
+    void pump();
+    static const char kSeparator = '\'';
+    const std::string& m_input;
+    std::string m_next;
+    size_t m_posNextSeparator;
+};
+
+void CommandTokenizer::pump()
+{
+    if (m_posNextSeparator == std::string::npos || m_posNextSeparator == m_input.size()) {
+        m_next = std::string();
+        return;
+    }
+    size_t start = m_posNextSeparator ? m_posNextSeparator + 1 : 0;
+    m_posNextSeparator = m_input.find(kSeparator, start);
+    size_t size = m_posNextSeparator == std::string::npos ? std::string::npos : m_posNextSeparator - start;
+    m_next = std::string(m_input, start, size);
+}
+
+std::string CommandTokenizer::next()
+{
+    ASSERT(hasNext());
+
+    std::string oldNext = m_next;
+    pump();
+    return oldNext;
+}
+
+bool CommandTokenizer::hasNext() const
+{
+    return !m_next.empty();
+}
+
+NO_RETURN static void die(const std::string& inputLine)
+{
+    fprintf(stderr, "Unexpected input line: %s\n", inputLine.c_str());
+    exit(1);
+}
+
+TestCommand parseInputLine(const std::string& inputLine)
+{
+    TestCommand result;
+    CommandTokenizer tokenizer(inputLine);
+    if (!tokenizer.hasNext())
+        die(inputLine);
+
+    result.pathOrURL = tokenizer.next();
+    if (!tokenizer.hasNext())
+        return result;
+
+    std::string arg = tokenizer.next();
+    if (arg != std::string("-p") && arg != std::string("--pixel-test"))
+        die(inputLine);
+    result.shouldDumpPixels = true;
+
+    if (tokenizer.hasNext())
+        result.expectedPixelHash = tokenizer.next();
+
+    return result;
+}
+
+bool TestController::runTest(const char* inputLine)
+{
+    TestCommand command = parseInputLine(std::string(inputLine));
+
     m_state = RunningTest;
 
-    m_currentInvocation = adoptPtr(new TestInvocation(pathOrURL));
-    if (dumpPixelsTest)
-        m_currentInvocation->setIsPixelTest(expectedPixelHash);
+    m_currentInvocation = adoptPtr(new TestInvocation(command.pathOrURL));
+    if (command.shouldDumpPixels)
+        m_currentInvocation->setIsPixelTest(command.expectedPixelHash);
 
     m_currentInvocation->invoke();
     m_currentInvocation.clear();
@@ -568,6 +625,9 @@ void TestController::runTestingServerLoop()
 
 void TestController::run()
 {
+    bool resetDone = resetStateToConsistentValues();
+    ASSERT_UNUSED(resetDone, resetDone);
+
     if (m_usingServerMode)
         runTestingServerLoop();
     else {
diff --git a/Tools/WebKitTestRunner/TestController.h b/Tools/WebKitTestRunner/TestController.h
index a99e16ea8..012ab7e7f 100644
--- a/Tools/WebKitTestRunner/TestController.h
+++ b/Tools/WebKitTestRunner/TestController.h
@@ -62,6 +62,8 @@ public:
     bool beforeUnloadReturnValue() const { return m_beforeUnloadReturnValue; }
     void setBeforeUnloadReturnValue(bool value) { m_beforeUnloadReturnValue = value; }
 
+    bool resetStateToConsistentValues();
+
 private:
     void initialize(int argc, const char* argv[]);
     void run();
@@ -76,8 +78,6 @@ private:
     void initializeInjectedBundlePath();
     void initializeTestPluginDirectory();
 
-    bool resetStateToConsistentValues();
-
     // WKContextInjectedBundleClient
     static void didReceiveMessageFromInjectedBundle(WKContextRef, WKStringRef messageName, WKTypeRef messageBody, const void*);
     static void didReceiveSynchronousMessageFromInjectedBundle(WKContextRef, WKStringRef messageName, WKTypeRef messageBody, WKTypeRef* returnData, const void*);
@@ -104,7 +104,6 @@ private:
 
     OwnPtr<TestInvocation> m_currentInvocation;
 
-    bool m_dumpPixelsForAllTests;
     bool m_verbose;
     bool m_printSeparators;
     bool m_usingServerMode;
diff --git a/Tools/WebKitTestRunner/TestInvocation.cpp b/Tools/WebKitTestRunner/TestInvocation.cpp
index d5c0af64a..d340f0f84 100644
--- a/Tools/WebKitTestRunner/TestInvocation.cpp
+++ b/Tools/WebKitTestRunner/TestInvocation.cpp
@@ -39,6 +39,10 @@
 #include <wtf/PassOwnArrayPtr.h>
 #include <wtf/text/CString.h>
 
+#if PLATFORM(MAC)
+#include <WebKit2/WKPagePrivateMac.h>
+#endif
+
 #if OS(WINDOWS)
 #include <direct.h> // For _getcwd.
 #define getcwd _getcwd // MSDN says getcwd is deprecated.
@@ -160,14 +164,15 @@ void TestInvocation::invoke()
 
     WKContextPostMessageToInjectedBundle(TestController::shared().context(), messageName.get(), beginTestMessageBody.get());
 
+    const char* errorMessage = 0;
     TestController::shared().runUntil(m_gotInitialResponse, TestController::ShortTimeout);
     if (!m_gotInitialResponse) {
-        dump("Timed out waiting for initial response from web process\n");
-        return;
+        errorMessage = "Timed out waiting for initial response from web process\n";
+        goto end;
     }
     if (m_error) {
-        dump("FAIL\n");
-        return;
+        errorMessage = "FAIL\n";
+        goto end;
     }
 
 #if ENABLE(INSPECTOR)
@@ -178,24 +183,53 @@ void TestInvocation::invoke()
     WKPageLoadURL(TestController::shared().mainWebView()->page(), m_url.get());
 
     TestController::shared().runUntil(m_gotFinalMessage, TestController::shared().useWaitToDumpWatchdogTimer() ? TestController::LongTimeout : TestController::NoTimeout);
-    if (!m_gotFinalMessage)
-        dump("Timed out waiting for final message from web process\n");
-    else if (m_error)
-        dump("FAIL\n");
+    if (!m_gotFinalMessage) {
+        errorMessage = "Timed out waiting for final message from web process\n";
+        goto end;
+    }
+    if (m_error) {
+        errorMessage = "FAIL\n";
+        goto end;
+    }
 
+end:
 #if ENABLE(INSPECTOR)
-    WKInspectorClose(WKPageGetInspector(TestController::shared().mainWebView()->page()));
+    if (m_gotInitialResponse)
+        WKInspectorClose(WKPageGetInspector(TestController::shared().mainWebView()->page()));
 #endif // ENABLE(INSPECTOR)
+
+    bool resetDone = TestController::shared().resetStateToConsistentValues();
+    // We expect resetting to not fail if there was no error or timeout.
+    ASSERT(resetDone || errorMessage);
+
+    const char* errorMessageToStderr = 0;
+#if PLATFORM(MAC)
+    char buffer[64];
+    if (!resetDone) {
+        pid_t pid = WKPageGetProcessIdentifier(TestController::shared().mainWebView()->page());
+        sprintf(buffer, "#PROCESS UNRESPONSIVE - WebProcess (pid %ld)\n", static_cast<long>(pid));
+        errorMessageToStderr = buffer;
+    }
+#else
+    if (!resetDone)
+        errorMessageToStderr = "#PROCESS UNRESPONSIVE - WebProcess";
+#endif
+
+    if (errorMessage)
+        dump(errorMessage, errorMessageToStderr, true);
 }
 
-void TestInvocation::dump(const char* stringToDump, bool singleEOF)
+void TestInvocation::dump(const char* textToStdout, const char* textToStderr, bool seenError)
 {
     printf("Content-Type: text/plain\n");
-    printf("%s", stringToDump);
+    printf("%s", textToStdout);
+
+    if (textToStderr)
+        fputs(textToStderr, stderr);
 
     fputs("#EOF\n", stdout);
     fputs("#EOF\n", stderr);
-    if (!singleEOF)
+    if (seenError)
         fputs("#EOF\n", stdout);
     fflush(stdout);
     fflush(stderr);
@@ -254,7 +288,7 @@ void TestInvocation::didReceiveMessageFromInjectedBundle(WKStringRef messageName
         WKArrayRef repaintRects = static_cast<WKArrayRef>(WKDictionaryGetItemForKey(messageBodyDictionary, repaintRectsKey.get()));        
 
         // Dump text.
-        dump(toWTFString(textOutput).utf8().data(), true);
+        dump(toWTFString(textOutput).utf8().data());
 
         // Dump pixels (if necessary).
         if (m_dumpPixels && pixelResult)
diff --git a/Tools/WebKitTestRunner/TestInvocation.h b/Tools/WebKitTestRunner/TestInvocation.h
index 11e135b55..903cf066c 100644
--- a/Tools/WebKitTestRunner/TestInvocation.h
+++ b/Tools/WebKitTestRunner/TestInvocation.h
@@ -45,7 +45,7 @@ public:
     WKRetainPtr<WKTypeRef> didReceiveSynchronousMessageFromInjectedBundle(WKStringRef messageName, WKTypeRef messageBody);
 
 private:
-    void dump(const char*, bool singleEOF = false);
+    static void dump(const char* textToStdout, const char* textToStderr = 0, bool seenError = false);
     void dumpPixelsAndCompareWithExpected(WKImageRef, WKArrayRef repaintRects);
     bool compareActualHashToExpectedAndDumpResults(const char[33]);
     
diff --git a/Tools/WebKitTestRunner/WebKitTestRunnerPrefix.h b/Tools/WebKitTestRunner/WebKitTestRunnerPrefix.h
index f34ec35c0..ac61ad7ec 100644
--- a/Tools/WebKitTestRunner/WebKitTestRunnerPrefix.h
+++ b/Tools/WebKitTestRunner/WebKitTestRunnerPrefix.h
@@ -39,7 +39,7 @@
 #endif /* defined (BUILDING_GTK__) */
 
 #include <wtf/Platform.h>
-#include <WebKit2/WebKit2.h>
+#include <WebKit2/WebKit2_C.h>
 
 
 /* When C++ exceptions are disabled, the C++ library defines |try| and |catch|
diff --git a/Tools/WebKitTestRunner/config.h b/Tools/WebKitTestRunner/config.h
index 11577cd60..838dfa4be 100644
--- a/Tools/WebKitTestRunner/config.h
+++ b/Tools/WebKitTestRunner/config.h
@@ -35,7 +35,7 @@
 #include <runtime/JSExportMacros.h>
 #endif
 
-#include <WebKit2/WebKit2.h>
+#include <WebKit2/WebKit2_C.h>
 
 #if PLATFORM(WIN)
 #define WTF_USE_CF 1 
diff --git a/Tools/WebKitTestRunner/efl/main.cpp b/Tools/WebKitTestRunner/efl/main.cpp
index c864ac13d..98bcde2a7 100644
--- a/Tools/WebKitTestRunner/efl/main.cpp
+++ b/Tools/WebKitTestRunner/efl/main.cpp
@@ -21,6 +21,8 @@
 
 #include "EWebKit2.h"
 #include "TestController.h"
+#include <wtf/Assertions.h>
+#include <stdlib.h>
 
 #ifdef HAVE_ECORE_X
 #include <Ecore_X.h>
@@ -28,13 +30,20 @@
 
 int main(int argc, char** argv)
 {
+    WTFInstallReportBacktraceOnCrashHook();
+
     if (!ewk_init())
         return 1;
 
 #ifdef HAVE_ECORE_X
-    if (!ecore_x_init(0)) {
-        ewk_shutdown();
-        return 1;
+    const char* display = getenv("DISPLAY");
+    int intialized = 0;
+    if (display) {
+        intialized = ecore_x_init(0);
+        if (!intialized) {
+            ewk_shutdown();
+            return 1;
+        }
     }
 #endif
 
@@ -42,7 +51,8 @@ int main(int argc, char** argv)
     WTR::TestController controller(argc, const_cast<const char**>(argv));
 
 #ifdef HAVE_ECORE_X
-    ecore_x_shutdown();
+    if (intialized)
+        ecore_x_shutdown();
 #endif
 
     ewk_shutdown();
diff --git a/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp b/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp
index 05a1cdcf8..86ace4918 100644
--- a/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp
+++ b/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp
@@ -33,6 +33,7 @@
 #include <QtTest/QtTest>
 #include <WebKit2/WKPagePrivate.h>
 #include <WebKit2/WKStringQt.h>
+#include <qpa/qwindowsysteminterface.h>
 
 namespace WTR {
 
diff --git a/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp b/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
index b26e20515..8a752a831 100644
--- a/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
+++ b/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
@@ -77,6 +77,7 @@ PlatformWebView::PlatformWebView(WKContextRef contextRef, WKPageGroupRef pageGro
     QQuickWebViewExperimental experimental(m_view);
     experimental.setRenderToOffscreenBuffer(true);
     m_view->setAllowAnyHTTPSCertificateForLocalHost(true);
+    m_view->componentComplete();
 }
 
 PlatformWebView::~PlatformWebView()
diff --git a/Tools/WebKitTestRunner/qt/main.cpp b/Tools/WebKitTestRunner/qt/main.cpp
index d6d228091..1da12a7b2 100644
--- a/Tools/WebKitTestRunner/qt/main.cpp
+++ b/Tools/WebKitTestRunner/qt/main.cpp
@@ -26,6 +26,7 @@
 
 #include "config.h"
 
+#include "QtInitializeTestFonts.h"
 #include "TestController.h"
 #include "qquickwebview_p.h"
 
@@ -118,6 +119,9 @@ int main(int argc, char** argv)
 
     qputenv("QT_WEBKIT_THEME_NAME", "qstyle");
 
+    WebKit::initializeTestFonts();
+    QCoreApplication::setAttribute(Qt::AA_Use96Dpi, true);
+
     QQuickWebViewExperimental::setFlickableViewportEnabled(false);
     QApplication app(argc, argv);
     Launcher launcher(argc, argv);
diff --git a/Tools/clang/ReportMemoryUsagePlugin/CMakeLists.txt b/Tools/clang/ReportMemoryUsagePlugin/CMakeLists.txt
new file mode 100644
index 000000000..53225f790
--- /dev/null
+++ b/Tools/clang/ReportMemoryUsagePlugin/CMakeLists.txt
@@ -0,0 +1,15 @@
+set(MODULE TRUE)
+
+set( LLVM_LINK_COMPONENTS support mc)
+
+add_clang_library(ReportMemoryUsage ReportMemoryUsage.cpp)
+
+target_link_libraries(ReportMemoryUsage
+  clangFrontend
+  clangAST
+  )
+
+set_target_properties(ReportMemoryUsage
+  PROPERTIES
+  LINKER_LANGUAGE CXX
+  PREFIX "")
diff --git a/Tools/clang/ReportMemoryUsagePlugin/Makefile b/Tools/clang/ReportMemoryUsagePlugin/Makefile
new file mode 100644
index 000000000..97fae1f32
--- /dev/null
+++ b/Tools/clang/ReportMemoryUsagePlugin/Makefile
@@ -0,0 +1,51 @@
+# This file is building the plugin for clang in chromium checkout.
+
+# This file requires the clang build system, at least for now. So to use this
+# Makefile, you should execute the following commands to copy this directory
+# into a clang checkout:
+#
+#   cp -R <this directory> chromium/src/third_party/llvm/tools/clang/tools/report-memory-usage-plugin
+#   cd chromium/src/third_party/llvm/tools/clang/tools/report-memory-usage-plugin
+#   make
+#
+# It can be run with clang build with help of these clang flags:
+#
+#       -Xclang -load \
+#	-Xclang <plugin-libs-dir>/libReportMemoryUsage.so \
+#	-Xclang -plugin \
+#	-Xclang report-memory-usage
+
+CLANG_LEVEL := ../..
+LIBRARYNAME = ReportMemoryUsage
+
+LINK_LIBS_IN_SHARED = 0
+SHARED_LIBRARY = 1
+
+include $(CLANG_LEVEL)/Makefile
+
+ifeq ($(OS),Darwin)
+  LDFLAGS=-Wl,-undefined,dynamic_lookup
+endif
+
+BD=../../../../Release+Asserts
+SRC_DIR=../../../../../llvm/tools/clang/tools/report-memory-usage-plugin
+
+test: all
+	@${BD}/bin/clang++ \
+	-D_GNU_SOURCE \
+	-D_DEBUG \
+	-D__STDC_CONSTANT_MACROS \
+        -D__STDC_FORMAT_MACROS \
+	-D__STDC_LIMIT_MACROS \
+	-D_GNU_SOURCE \
+        -I${BD}/tools/clang/include \
+	-Itools/clang/include \
+	-I${BD}/include \
+	-Iinclude \
+        ${SRC_DIR}/tests/Source/WebCore/Test.cpp \
+	-fsyntax-only \
+        -Xclang -load \
+	-Xclang ${BD}/lib/lib${LIBRARYNAME}.so \
+	-Xclang -plugin \
+	-Xclang report-memory-usage
+
diff --git a/Tools/clang/ReportMemoryUsagePlugin/ReportMemoryUsage.cpp b/Tools/clang/ReportMemoryUsagePlugin/ReportMemoryUsage.cpp
new file mode 100644
index 000000000..f5d45f545
--- /dev/null
+++ b/Tools/clang/ReportMemoryUsagePlugin/ReportMemoryUsage.cpp
@@ -0,0 +1,221 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "clang/AST/AST.h"
+#include "clang/AST/ASTConsumer.h"
+#include "clang/AST/RecursiveASTVisitor.h"
+#include "clang/Frontend/CompilerInstance.h"
+#include "clang/Frontend/FrontendPluginRegistry.h"
+#include "llvm/Support/raw_ostream.h"
+
+using namespace clang;
+
+namespace {
+
+typedef std::vector<std::string> Strings;
+
+Strings instrumentationMethods;
+const std::string instrimentingMethodName("reportMemoryUsage");
+
+class AddMemberCallVisitor : public RecursiveASTVisitor<AddMemberCallVisitor> {
+public:
+    bool VisitCallExpr(CallExpr* callExpr)
+    {
+        CXXMemberCallExpr* methodCallExpr = dyn_cast<CXXMemberCallExpr>(callExpr);
+        bool instrumented = false;
+        if (methodCallExpr) {
+            std::string methodName = methodCallExpr->getMethodDecl()->getNameAsString();
+            Strings::iterator i = find(instrumentationMethods.begin(), instrumentationMethods.end(), methodName);
+            instrumented = i != instrumentationMethods.end();
+        }
+        if (instrumented || !methodCallExpr) {
+            for (CallExpr::arg_iterator i = callExpr->arg_begin(); i != callExpr->arg_end(); ++i) {
+                if (MemberExpr* memberExpr = dyn_cast<MemberExpr>(*i))
+                    m_instrumentedMembers.push_back(memberExpr->getMemberNameInfo().getAsString());
+            }
+        }
+        return true;
+    }
+
+    const Strings& instrumentedMembers() const { return m_instrumentedMembers; }
+
+private:
+    Strings m_instrumentedMembers;
+};
+
+class ReportMemoryUsageVisitor : public RecursiveASTVisitor<ReportMemoryUsageVisitor> {
+public:
+    explicit ReportMemoryUsageVisitor(CompilerInstance& instance, ASTContext* context)
+        : m_instance(instance)
+        , m_context(context) { }
+
+    bool VisitCXXMethodDecl(clang::CXXMethodDecl* decl)
+    {
+        if (decl->doesThisDeclarationHaveABody() && decl->getNameAsString() == instrimentingMethodName) {
+            FullSourceLoc fullLocation = m_context->getFullLoc(decl->getLocStart());
+            if (fullLocation.isValid()) {
+                AddMemberCallVisitor visitor;
+                visitor.TraverseStmt(decl->getBody());
+                CheckMembersCoverage(decl->getParent(), visitor.instrumentedMembers(), decl->getLocStart());
+            }
+        }
+        return true;
+    }
+
+private:
+    void emitWarning(SourceLocation loc, const char* rawError)
+    {
+        FullSourceLoc full(loc, m_instance.getSourceManager());
+        std::string err("[webkit-style] ");
+        err += rawError;
+        DiagnosticsEngine& diagnostic = m_instance.getDiagnostics();
+        DiagnosticsEngine::Level level = diagnostic.getWarningsAsErrors() ? DiagnosticsEngine::Error : DiagnosticsEngine::Warning;
+        unsigned id = diagnostic.getCustomDiagID(level, err);
+        DiagnosticBuilder builder = diagnostic.Report(full, id);
+    }
+
+    CXXMethodDecl* findInstrumentationMethod(CXXRecordDecl* record)
+    {
+        for (CXXRecordDecl::method_iterator m = record->method_begin(); m != record->method_end(); ++m) {
+            if (m->getNameInfo().getAsString() == instrimentingMethodName)
+                return *m;
+        }
+        return 0;
+    }
+
+    bool needsToBeInstrumented(const Type* type)
+    {
+        if (type->isBuiltinType())
+            return false;
+        if (type->isEnumeralType())
+            return false;
+        if (type->isClassType()) {
+            const RecordType* recordType = dyn_cast<RecordType>(type);
+            if (recordType) {
+                CXXRecordDecl* decl = dyn_cast<CXXRecordDecl>(recordType->getDecl());
+                if (decl->getNameAsString() == "String")
+                    return true;
+                if (!decl || !findInstrumentationMethod(decl))
+                    return false;
+            }
+        }
+        if (type->isArrayType()) {
+            const ArrayType* arrayType = dyn_cast<const ArrayType>(type);
+            return needsToBeInstrumented(arrayType->getElementType().getTypePtr());
+        }
+        return true;
+    }
+
+    void CheckMembersCoverage(const CXXRecordDecl* instrumentedClass, const Strings& instrumentedMembers, SourceLocation location)
+    {
+        for (CXXRecordDecl::field_iterator i = instrumentedClass->field_begin(); i != instrumentedClass->field_end(); ++i) {
+            std::string fieldName = i->getNameAsString();
+            if (find(instrumentedMembers.begin(), instrumentedMembers.end(), fieldName) == instrumentedMembers.end()) {
+                if (!needsToBeInstrumented(i->getType().getTypePtr()))
+                    continue;
+                emitWarning(i->getSourceRange().getBegin(), "class member needs to be instrumented in reportMemoryUsage function");
+                emitWarning(location, "located here");
+            }
+        }
+    }
+
+    CompilerInstance& m_instance;
+    ASTContext* m_context;
+};
+
+class ReportMemoryUsageConsumer : public ASTConsumer {
+public:
+    explicit ReportMemoryUsageConsumer(CompilerInstance& instance, ASTContext* context)
+        : m_visitor(instance, context)
+    {
+        instrumentationMethods.push_back("addMember");
+        instrumentationMethods.push_back("addInstrumentedMember");
+        instrumentationMethods.push_back("addVector");
+        instrumentationMethods.push_back("addVectorPtr");
+        instrumentationMethods.push_back("addInstrumentedVector");
+        instrumentationMethods.push_back("addInstrumentedVectorPtr");
+        instrumentationMethods.push_back("addHashSet");
+        instrumentationMethods.push_back("addInstrumentedHashSet");
+        instrumentationMethods.push_back("addHashMap");
+        instrumentationMethods.push_back("addInstrumentedHashMap");
+        instrumentationMethods.push_back("addListHashSet");
+        instrumentationMethods.push_back("addRawBuffer");
+        instrumentationMethods.push_back("addString");
+    }
+
+    virtual void HandleTranslationUnit(clang::ASTContext& context)
+    {
+        m_visitor.TraverseDecl(context.getTranslationUnitDecl());
+    }
+
+private:
+    ReportMemoryUsageVisitor m_visitor;
+};
+
+class ReportMemoryUsageAction : public PluginASTAction {
+protected:
+    ASTConsumer* CreateASTConsumer(CompilerInstance& CI, llvm::StringRef)
+    {
+        return new ReportMemoryUsageConsumer(CI, &CI.getASTContext());
+    }
+
+    bool ParseArgs(const CompilerInstance& CI, const std::vector<std::string>& args)
+    {
+        if (args.size() && args[0] == "help")
+            llvm::errs() << m_helpText;
+        return true;
+    }
+
+    static const char* m_helpText;
+};
+
+const char* ReportMemoryUsageAction::m_helpText =
+    "This plugin is checking native memory instrumentation code.\n"
+    "The class is instrumented if it has reportMemoryUsage member function.\n"
+    "Sample:\n"
+    "class InstrumentedClass {\n"
+    "public:\n"
+    "    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const\n"
+    "    {\n"
+    "        MemoryClassInfo<InstrumentedClass> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);\n"
+    "        info.addMember(m_notInstrumentedPtr);\n"
+    "        info.addInstrumentedMember(m_instrumentedObject);\n"
+    "    }\n"
+    "\n"
+    "private:\n"
+    "    NotInstrumentedClass* m_notInstrumentedPtr;\n"
+    "    InstrumentedClass m_instrumentedObject;\n"
+    "}\n";
+
+}
+
+static FrontendPluginRegistry::Add<ReportMemoryUsageAction>
+X("report-memory-usage", "Checks reportMemoryUsage function consistency");
+
diff --git a/Tools/clang/ReportMemoryUsagePlugin/tests/Source/WebCore/Test.cpp b/Tools/clang/ReportMemoryUsagePlugin/tests/Source/WebCore/Test.cpp
new file mode 100644
index 000000000..cc593e6e1
--- /dev/null
+++ b/Tools/clang/ReportMemoryUsagePlugin/tests/Source/WebCore/Test.cpp
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace aNamespace {
+
+class MemoryInstrumentation {
+public:
+    enum ObjectType {
+        DOM
+    };
+};
+
+class MemoryObjectInfo {
+};
+
+template <typename T>
+class MemoryClassInfo {
+public:
+    MemoryClassInfo(MemoryObjectInfo*, const T*, MemoryInstrumentation::ObjectType) { }
+    template <typename M> void addMember(M&) { }
+    template <typename M> void addInstrumentedMember(M&) { }
+};
+
+// ------ Mocked types
+template <typename T>
+class OwnPtr {
+public:
+    OwnPtr(T* ptr) : m_ptr(ptr) { }
+private:
+    T* m_ptr;
+};
+
+template <typename T>
+class RefPtr {
+public:
+    RefPtr(T* ptr) : m_ptr(ptr) { }
+private:
+    T* m_ptr;
+};
+
+template <typename T>
+class Vector {
+private:
+    T* m_data;
+};
+
+class String {
+private:
+    char* m_data;
+};
+
+// ------ User defined types
+class NotInstrumentedClass {
+public:
+    int m_array[10];
+};
+
+class InstrumentedClass {
+public:
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo<InstrumentedClass> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        info.addMember(m_notInstrumentedPtrReportedNoWarning);
+        info.addInstrumentedMember(m_instrumentedPtrReportedNoWarning);
+    }
+
+private:
+
+    // have to be skipped even if not reported
+    int m_PODNotReportedNoWarning;
+    int m_arrayNotReportedNoWarning[10];
+    NotInstrumentedClass m_notInstrumentedNotReportedNoWarning;
+    NotInstrumentedClass m_notInstrumentedArrayNotReportedNoWarning[10];
+    enum { None } m_enumNotReportedNoWarning;
+    bool m_boolNotReportedNoWarning;
+
+    // reported
+    NotInstrumentedClass* m_notInstrumentedPtrReportedNoWarning;
+    InstrumentedClass* m_instrumentedPtrReportedNoWarning;
+
+    // reported
+    InstrumentedClass* m_instrumentedPtrNotReportedWarning;
+    int* m_rawBufferNotReportedWarning;
+    int* m_intPtrArrayNotReportedWarning[10];
+    NotInstrumentedClass* m_objPtrArrayNotReportedWarning[10];
+    OwnPtr<NotInstrumentedClass> m_ownPtrNotReportedWarning;
+    RefPtr<NotInstrumentedClass> m_refPtrNotReportedWarning;
+    String m_stringNotReportedWarning;
+    Vector<NotInstrumentedClass> m_vectorNotReportedWarning;
+};
+
+}
+
+using namespace aNamespace;
+
+namespace {
+
+class InstrumentedChildClass : public aNamespace::InstrumentedClass {
+public:
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const;
+};
+
+void InstrumentedChildClass::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo<InstrumentedChildClass> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+}
+
+}
+
+class InstrumentedChildChildClass : public InstrumentedChildClass {
+public:
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const;
+};
+
+void InstrumentedChildChildClass::reportMemoryUsage(MemoryObjectInfo*) const
+{
+}
+
+int aGlobalVariable = 0;
+
+int main(int argc, char** argv)
+{
+    return 0;
+}
diff --git a/Tools/efl/jhbuild.modules b/Tools/efl/jhbuild.modules
index c883488c7..82e5da84f 100644
--- a/Tools/efl/jhbuild.modules
+++ b/Tools/efl/jhbuild.modules
@@ -32,8 +32,6 @@
       href="http://ftp.gnome.org"/>
   <repository type="git" name="git.gnome.org"
       href="git://git.gnome.org/"/>
-  <repository type="tarball" name="gnu.org"
-      href="http://ftp.gnu.org/"/>
   <repository type="tarball" name="cairographics.org"
       href="http://cairographics.org"/>
   <repository type="tarball" name="freedesktop.org"
@@ -62,7 +60,6 @@
     </branch>
   </autotools>
 
-
   <autotools id="fonts"
              skip-autogen="true">
     <branch module="downloads/mrobinson/webkitgtk-test-fonts/webkitgtk-test-fonts-0.0.3.tar.gz" version="0.0.3"
@@ -122,7 +119,7 @@
 
   <autotools id="glib-networking">
     <dependencies>
-      <dep package="gnutls"/>
+      <dep package="glib"/>
     </dependencies>
     <branch module="/pub/GNOME/sources/glib-networking/2.33/glib-networking-2.33.2.tar.xz" version="2.33.2"
             repo="ftp.gnome.org"
@@ -130,18 +127,6 @@
             md5sum="5abb364f2a0babe2ec1e3a6d59f69043"/>
   </autotools>
 
-  <autotools id="gnutls"
-             autogenargs="--enable-ld-version-script --enable-cxx --without-lzo --with-libgcrypt">
-    <dependencies>
-      <dep package="libgcrypt"/>
-      <dep package="p11-kit"/>
-    </dependencies>
-    <branch module="/gnu/gnutls/gnutls-2.12.14.tar.bz2" version="2.12.14"
-            repo="gnu.org"
-            hash="sha256:5ee72ba6de7a23cf315792561954451e022dac8730149ca95f93c61e95be2ce3"
-            md5sum="555687a7ffefba0bd9de1e71cb61402c"/>
-  </autotools>
-
   <autotools id="libsoup"
              autogenargs="--without-gnome --disable-introspection">
     <dependencies>
@@ -162,11 +147,11 @@
   </autotools>
 
  <autotools id="harfbuzz" autogen-sh="configure">
-   <branch module="software/harfbuzz/release/harfbuzz-20120627.tar.bz2" version="0.9.0"
-           checkoutdir="harfbuzz-0.9.0"
+   <branch module="software/harfbuzz/release/harfbuzz-0.9.2.tar.bz2" version="0.9.2"
+           checkoutdir="harfbuzz-0.9.2"
            repo="freedesktop.org"
-           hash="sha256:562a187b84a2b5bd38f87e898f5f18aa918a41db62adbc17f6fcfd8fa1755485"
-           md5sum="18e6a8d847259441723a26e299792d55">
+           hash="sha256:c9b581d6357a32043b84ec78179390b582448de790deb487dfdb90b632dc8558"
+           md5sum="f1c1a2793b44b4d6613f58cc92caa366">
    </branch>
  </autotools>
 
@@ -206,6 +191,7 @@
             repo="enlightenment.org"
             revision="73027"/>
     <dependencies>
+      <dep package="libgcrypt"/>
       <dep package="eina"/>
     </dependencies>
   </autotools>
diff --git a/Tools/gtk/jhbuild.modules b/Tools/gtk/jhbuild.modules
index 8413926bd..d6c425726 100644
--- a/Tools/gtk/jhbuild.modules
+++ b/Tools/gtk/jhbuild.modules
@@ -32,8 +32,6 @@
       href="http://ftp.gnome.org"/>
   <repository type="git" name="git.gnome.org"
       href="git://git.gnome.org/"/>
-  <repository type="tarball" name="gnu.org"
-      href="http://ftp.gnu.org/"/>
   <repository type="tarball" name="cairographics.org"
       href="http://cairographics.org"/>
   <repository type="tarball" name="freedesktop.org"
@@ -153,7 +151,6 @@
   <autotools id="glib-networking">
     <dependencies>
       <dep package="glib"/>
-      <dep package="gnutls"/>
     </dependencies>
     <branch module="/pub/GNOME/sources/glib-networking/2.33/glib-networking-2.33.2.tar.xz" version="2.33.2"
             repo="ftp.gnome.org"
@@ -161,14 +158,6 @@
             md5sum="5abb364f2a0babe2ec1e3a6d59f69043"/>
   </autotools>
 
-  <autotools id="gnutls"
-             autogenargs="--enable-ld-version-script --enable-cxx --without-lzo --with-libgcrypt --without-p11-kit">
-    <branch module="/gnu/gnutls/gnutls-2.12.14.tar.bz2" version="2.12.14"
-            repo="gnu.org"
-            hash="sha256:5ee72ba6de7a23cf315792561954451e022dac8730149ca95f93c61e95be2ce3"
-            md5sum="555687a7ffefba0bd9de1e71cb61402c"/>
-  </autotools>
-
   <autotools id="libsoup"
              autogenargs="--without-gnome --disable-introspection">
     <dependencies>
diff --git a/Tools/gtk/run-api-tests b/Tools/gtk/run-api-tests
deleted file mode 100755
index a601a766c..000000000
--- a/Tools/gtk/run-api-tests
+++ /dev/null
@@ -1,329 +0,0 @@
-#!/usr/bin/env python
-#
-# Copyright (C) 2011, 2012 Igalia S.L.
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Library General Public
-# License as published by the Free Software Foundation; either
-# version 2 of the License, or (at your option) any later version.
-#
-# This library is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# Library General Public License for more details.
-#
-# You should have received a copy of the GNU Library General Public License
-# along with this library; see the file COPYING.LIB.  If not, write to
-# the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-# Boston, MA 02110-1301, USA.
-
-import common
-import subprocess
-import os
-import sys
-import optparse
-import re
-from signal import alarm, signal, SIGALRM, SIGKILL
-from gi.repository import Gio, GLib
-
-class SkippedTest:
-    ENTIRE_SUITE = None
-
-    def __init__(self, test, test_case, reason, bug=None):
-        self.test = test
-        self.test_case = test_case
-        self.reason = reason
-        self.bug = bug
-
-    def __str__(self):
-        skipped_test_str = "%s" % self.test
-
-        if not(self.skip_entire_suite()):
-            skipped_test_str += " [%s]" % self.test_case
-
-        skipped_test_str += ": %s " % self.reason
-        if self.bug is not None:
-            skipped_test_str += "(https://bugs.webkit.org/show_bug.cgi?id=%d)" % self.bug
-        return skipped_test_str
-
-    def skip_entire_suite(self):
-        return self.test_case == SkippedTest.ENTIRE_SUITE
-
-class TestTimeout(Exception):
-    pass
-
-class TestRunner:
-    TEST_DIRS = [ "unittests", "WebKit2APITests", "TestWebKitAPI" ]
-
-    SKIPPED = [
-        SkippedTest("unittests/testdownload", "/webkit/download/not-found", "Test fails in GTK Linux 64-bit Release bot", 82329),
-        SkippedTest("unittests/testwebview", "/webkit/webview/icon-uri", "Test times out in GTK Linux 64-bit Release bot", 82328),
-        SkippedTest("unittests/testwebresource", "/webkit/webresource/sub_resource_loading", "Test fails in GTK Linux 64-bit Release bot", 82330),
-        SkippedTest("unittests/testwebinspector", "/webkit/webinspector/close-and-inspect", "Test is flaky in GTK Linux 32-bit Release bot", 82869),
-        SkippedTest("WebKit2APITests/TestWebKitWebView", "/webkit2/WebKitWebView/mouse-target", "Test is flaky in GTK Linux 32-bit Release bot", 82866),
-        SkippedTest("WebKit2APITests/TestResources", "/webkit2/WebKitWebView/resources", "Test is flaky in GTK Linux 32-bit Release bot", 82868),
-        SkippedTest("WebKit2APITests/TestWebKitFindController", "/webkit2/WebKitFindController/next", "Test fails ", 91083),
-        SkippedTest("WebKit2APITests/TestWebKitFindController", "/webkit2/WebKitFindController/previous", "Test fails", 91083),
-        SkippedTest("WebKit2APITests/TestWebKitFindController", "/webkit2/WebKitFindController/hide", "Test  always fails in Xvfb", 89810),
-        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.WKConnection", "Tests fail and time out out", 84959),
-        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.RestoreSessionStateContainingFormData", "Session State is not implemented in GTK+ port", 84960),
-        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.SpacebarScrolling", "Test fails", 84961),
-        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.NewFirstVisuallyNonEmptyLayoutForImages", "Test is flaky", 85066),
-        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.NewFirstVisuallyNonEmptyLayoutFrames", "Test fails", 85037),
-        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.MouseMoveAfterCrash", "Test is flaky", 85066),
-        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.CanHandleRequest", "Test fails", 88453),
-        SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.WKPageGetScaleFactorNotZero", "Test fails and times out", 88455),
-    ]
-
-    def __init__(self, options, tests=[]):
-        self._options = options
-        self._programs_path = common.build_path("Programs")
-        self._tests = self._get_tests(tests)
-        self._skipped_tests = TestRunner.SKIPPED
-
-        # These SPI daemons need to be active for the accessibility tests to work.
-        self._spi_registryd = None
-        self._spi_bus_launcher = None
-
-    def _get_tests(self, tests):
-        if tests:
-            return tests
-
-        tests = []
-        for test_dir in self.TEST_DIRS:
-            absolute_test_dir = os.path.join(self._programs_path, test_dir)
-            if not os.path.isdir(absolute_test_dir):
-                continue
-            for test_file in os.listdir(absolute_test_dir):
-                if not test_file.lower().startswith("test"):
-                    continue
-                test_path = os.path.join(self._programs_path, test_dir, test_file)
-                if os.path.isfile(test_path) and os.access(test_path, os.X_OK):
-                    tests.append(test_path)
-        return tests
-
-    def _lookup_atspi2_binary(self, filename):
-        exec_prefix = common.pkg_config_file_variable('atspi-2', 'exec_prefix')
-        if not exec_prefix:
-            return None
-        for path in ['libexec', 'lib/at-spi2-core', 'lib32/at-spi2-core', 'lib64/at-spi2-core']:
-            filepath = os.path.join(exec_prefix, path, filename)
-            if os.path.isfile(filepath):
-                return filepath
-
-        return None
-
-    def _start_accessibility_daemons(self):
-        return False
-        spi_bus_launcher_path = self._lookup_atspi2_binary('at-spi-bus-launcher')
-        spi_registryd_path = self._lookup_atspi2_binary('at-spi2-registryd')
-        if not spi_bus_launcher_path or not spi_registryd_path:
-            return False
-
-        try:
-            self._ally_bus_launcher = subprocess.Popen([spi_bus_launcher_path], env=self._test_env)
-        except:
-            sys.stderr.write("Failed to launch the accessibility bus\n")
-            sys.stderr.flush()
-            return False
-
-        # We need to wait until the SPI bus is launched before trying to start the SPI
-        # registry, so we spin a main loop until the bus name appears on DBus.
-        loop = GLib.MainLoop()
-        Gio.bus_watch_name(Gio.BusType.SESSION, 'org.a11y.Bus', Gio.BusNameWatcherFlags.NONE,
-                           lambda *args: loop.quit(), None)
-        loop.run()
-
-        try:
-            self._spi_registryd = subprocess.Popen([spi_registryd_path], env=self._test_env)
-        except:
-            sys.stderr.write("Failed to launch the accessibility registry\n")
-            sys.stderr.flush()
-            return False
-
-        return True
-
-    def _setup_testing_environment(self):
-        self._test_env = os.environ
-        self._test_env["DISPLAY"] = self._options.display
-        self._test_env["WEBKIT_INSPECTOR_PATH"] = os.path.abspath(os.path.join(self._programs_path, 'resources', 'inspector'))
-        self._test_env['GSETTINGS_BACKEND'] = 'memory'
-        self._test_env["TEST_WEBKIT_API_WEBKIT2_RESOURCES_PATH"] = common.top_level_path("Tools", "TestWebKitAPI", "Tests", "WebKit2")
-        self._test_env["TEST_WEBKIT_API_WEBKIT2_INJECTED_BUNDLE_PATH"] = common.build_path("Libraries")
-        self._test_env["WEBKIT_EXEC_PATH"] = self._programs_path
-
-        try:
-            self._xvfb = subprocess.Popen(["Xvfb", self._options.display, "-screen", "0", "800x600x24", "-nolisten", "tcp"],
-                                          stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-        except Exception as e:
-            sys.stderr.write("Failed to run Xvfb: %s\n" % e)
-            sys.stderr.flush()
-            return False
-
-        # If we cannot start the accessibility daemons, we can just skip the accessibility tests.
-        if not self._start_accessibility_daemons():
-            print "Could not start accessibility bus, so skipping TestWebKitAccessibility"
-            self._skipped_tests.append(SkippedTest("WebKit2APITests/TestWebKitAccessibility", SkippedTest.ENTIRE_SUITE, "Could not start accessibility bus"))
-        return True
-
-    def _tear_down_testing_environment(self):
-        if self._spi_registryd:
-            self._spi_registryd.terminate()
-        if self._spi_bus_launcher:
-            self._spi_bus_launcher.terminate()
-        self._xvfb.terminate()
-
-    def _test_cases_to_skip(self, test_program):
-        if self._options.skipped_action != 'skip':
-            return []
-
-        test_cases = []
-        for skipped in self._skipped_tests:
-            if test_program.endswith(skipped.test) and not skipped.skip_entire_suite():
-                test_cases.append(skipped.test_case)
-        return test_cases
-
-    def _should_run_test_program(self, test_program):
-        # This is not affected by the command-line arguments, since programs are skipped for
-        # problems in the harness, such as failing to start the accessibility bus.
-        for skipped in self._skipped_tests:
-            if test_program.endswith(skipped.test) and skipped.skip_entire_suite():
-                return False
-        return True
-
-    def _get_child_pid_from_test_output(self, output):
-        if not output:
-            return -1
-        match = re.search(r'\(pid=(?P<child_pid>[0-9]+)\)', output)
-        if not match:
-            return -1
-        return int(match.group('child_pid'))
-
-    def _kill_process(self, pid):
-        try:
-            os.kill(pid, SIGKILL)
-        except OSError:
-            # Process already died.
-            pass
-
-    def _run_test_command(self, command, timeout=-1):
-        def alarm_handler(signum, frame):
-            raise TestTimeout
-
-        p = subprocess.Popen(command, stdout=subprocess.PIPE, env=self._test_env)
-        if timeout > 0:
-            signal(SIGALRM, alarm_handler)
-            alarm(timeout)
-
-        stdout = ""
-        try:
-            stdout = p.communicate()[0]
-            if timeout > 0:
-                alarm(0)
-            sys.stdout.write(stdout)
-            sys.stdout.flush()
-        except TestTimeout:
-            self._kill_process(p.pid)
-            child_pid = self._get_child_pid_from_test_output(stdout)
-            if child_pid > 0:
-                self._kill_process(child_pid)
-            raise
-
-        return not p.returncode
-
-    def _run_test_glib(self, test_program):
-        tester_command = ['gtester']
-        if self._options.verbose:
-            tester_command.append('--verbose')
-        for test_case in self._test_cases_to_skip(test_program):
-            tester_command.extend(['-s', test_case])
-        tester_command.append(test_program)
-
-        return self._run_test_command(tester_command, self._options.timeout)
-
-    def _run_test_google(self, test_program):
-        tester_command = [test_program]
-        skipped_tests_cases = self._test_cases_to_skip(test_program)
-        if skipped_tests_cases:
-            tester_command.append("--gtest_filter=-%s" % ":".join(skipped_tests_cases))
-
-        return self._run_test_command(tester_command, self._options.timeout)
-
-    def _run_test(self, test_program):
-        if "unittests" in test_program or "WebKit2APITests" in test_program:
-            return self._run_test_glib(test_program)
-
-        if "TestWebKitAPI" in test_program:
-            return self._run_test_google(test_program)
-
-        return False
-
-    def run_tests(self):
-        if not self._tests:
-            sys.stderr.write("ERROR: tests not found in %s.\n" % (self._programs_path))
-            sys.stderr.flush()
-            return 1
-
-        if not self._setup_testing_environment():
-            return 1
-
-        # Remove skipped tests now instead of when we find them, because
-        # some tests might be skipped while setting up the test environment.
-        self._tests = [test for test in self._tests if self._should_run_test_program(test)]
-
-        failed_tests = []
-        timed_out_tests = []
-        try:
-            for test in self._tests:
-                success = True
-                try:
-                    success = self._run_test(test)
-                except TestTimeout:
-                    sys.stdout.write("TEST: %s: TIMEOUT\n" % test)
-                    sys.stdout.flush()
-                    timed_out_tests.append(test)
-
-                if not success:
-                    failed_tests.append(test)
-        finally:
-            self._tear_down_testing_environment()
-
-        if failed_tests:
-            names = [test.replace(self._programs_path, '', 1) for test in failed_tests]
-            sys.stdout.write("Tests failed: %s\n" % ", ".join(names))
-            sys.stdout.flush()
-
-        if timed_out_tests:
-            names = [test.replace(self._programs_path, '', 1) for test in timed_out_tests]
-            sys.stdout.write("Tests that timed out: %s\n" % ", ".join(names))
-            sys.stdout.flush()
-
-        if self._skipped_tests and self._options.skipped_action == 'skip':
-            sys.stdout.write("Tests skipped:\n%s\n" % "\n".join([str(skipped) for skipped in self._skipped_tests]))
-            sys.stdout.flush()
-
-        return len(failed_tests)
-
-if __name__ == "__main__":
-    option_parser = optparse.OptionParser(usage='usage: %prog [options] [test...]')
-    option_parser.add_option('-r', '--release',
-                             action='store_true', dest='release',
-                             help='Run in Release')
-    option_parser.add_option('-d', '--debug',
-                             action='store_true', dest='debug',
-                             help='Run in Debug')
-    option_parser.add_option('-v', '--verbose',
-                             action='store_true', dest='verbose',
-                             help='Run gtester in verbose mode')
-    option_parser.add_option('--display', action='store', dest='display', default=':55',
-                             help='Display to run Xvfb')
-    option_parser.add_option('--skipped', action='store', dest='skipped_action',
-                             choices=['skip', 'ignore', 'only'], default='skip',
-                             metavar='skip|ignore|only',
-                             help='Specifies how to treat the skipped tests')
-    option_parser.add_option('-t', '--timeout',
-                             action='store', type='int', dest='timeout', default=10,
-                             help='Time in seconds until a test times out')
-    options, args = option_parser.parse_args()
-
-    sys.exit(TestRunner(options, args).run_tests())
diff --git a/Tools/jhbuild/jhbuild-wrapper b/Tools/jhbuild/jhbuild-wrapper
index 8f852f73d..390fc7821 100755
--- a/Tools/jhbuild/jhbuild-wrapper
+++ b/Tools/jhbuild/jhbuild-wrapper
@@ -17,38 +17,20 @@
 # License along with this library; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 
+import jhbuildutils
 import os
 import shlex
 import subprocess
 import sys
 
-
-top_level_dir = None
-
-
-def top_level_path(*args):
-    global top_level_dir
-    if not top_level_dir:
-        top_level_dir = os.path.join(os.path.dirname(__file__), '..', '..')
-    return os.path.join(*(top_level_dir,) + args)
-
-
 jhbuild_revision = '1eedc423f75c605224b430579e4c303292199507'
 
-if os.environ.has_key('WEBKITOUTPUTDIR'):
-    dependencies_path = os.path.abspath(os.path.join(os.environ['WEBKITOUTPUTDIR'], 'Dependencies'))
-else:
-    dependencies_path = os.path.abspath(top_level_path('WebKitBuild', 'Dependencies'))
-
+dependencies_path = jhbuildutils.get_dependencies_path()
 installation_prefix = os.path.abspath(os.path.join(dependencies_path, 'Root'))
 source_path = os.path.abspath(os.path.join(dependencies_path, 'Source'))
 jhbuild_source_path = os.path.join(source_path, 'jhbuild')
 jhbuild_path = os.path.join(installation_prefix, 'bin', 'jhbuild')
 
-
-platform = None;
-
-
 def jhbuild_installed():
     return os.path.exists(jhbuild_path)
 
@@ -108,8 +90,8 @@ def install_jhbuild():
         raise Exception('jhbuild configure failed with return code: %i' % process.returncode)
 
 
-def update_webkit_libs_jhbuild():
-    process = subprocess.Popen([top_level_path('Tools', 'Scripts', 'update-webkit-libs-jhbuild'), '--' + platform])
+def update_webkit_libs_jhbuild(platform):
+    process = subprocess.Popen([jhbuildutils.top_level_path('Tools', 'Scripts', 'update-webkit-libs-jhbuild'), '--' + platform])
     process.wait()
     if process.returncode != 0:
         raise Exception('jhbuild configure failed with return code: %i' % process.returncode)
@@ -123,12 +105,12 @@ def determine_platform():
     raise ValueError('No platform specified for jhbuild-wrapper.')
 
 
-def ensure_jhbuild():
+def ensure_jhbuild(platform):
     if not jhbuild_cloned():
         clone_jhbuild()
         update_jhbuild()
         install_jhbuild()
-        update_webkit_libs_jhbuild()
+        update_webkit_libs_jhbuild(platform)
     elif not jhbuild_installed() \
             or not jhbuild_at_expected_revision():
         update_jhbuild()
@@ -143,7 +125,6 @@ try:
     platform = determine_platform()
 except ValueError as e:
     sys.exit(e)
-ensure_jhbuild()
-
-os.execve(jhbuild_path, [jhbuild_path, '--no-interact', '-f', top_level_path('Tools', platform, 'jhbuildrc')] + sys.argv[2:], os.environ)
+ensure_jhbuild(platform)
 
+os.execve(jhbuild_path, [jhbuild_path, '--no-interact', '-f', jhbuildutils.get_config_file_for_platform(platform)] + sys.argv[2:], os.environ)
diff --git a/Tools/jhbuild/jhbuildutils.py b/Tools/jhbuild/jhbuildutils.py
new file mode 100644
index 000000000..c9972b85a
--- /dev/null
+++ b/Tools/jhbuild/jhbuildutils.py
@@ -0,0 +1,53 @@
+import glob
+import os.path
+import sys
+import __builtin__
+
+top_level_dir = None
+
+
+def top_level_path(*args):
+    global top_level_dir
+    if not top_level_dir:
+        top_level_dir = os.path.join(os.path.dirname(__file__), '..', '..')
+    return os.path.join(*(top_level_dir,) + args)
+
+
+def get_dependencies_path():
+    if 'WEBKITOUTPUTDIR' in os.environ:
+        return os.path.abspath(os.path.join(os.environ['WEBKITOUTPUTDIR'], 'Dependencies'))
+    else:
+        return os.path.abspath(top_level_path('WebKitBuild', 'Dependencies'))
+
+
+def get_config_file_for_platform(platform):
+    return top_level_path('Tools', platform, 'jhbuildrc')
+
+
+def enter_jhbuild_environment_if_available(platform):
+    if not os.path.exists(get_dependencies_path()):
+        return False
+
+    # Sometimes jhbuild chooses to install in a way that reads the library from the source directory, so fall
+    # back to that method.
+    source_path = os.path.join(get_dependencies_path(), "Source", "jhbuild")
+    sys.path.insert(0, source_path)
+
+    # When loading jhbuild from the source checkout it fails if the SRCDIR variable is not set.
+    __builtin__.__dict__['SRCDIR'] = source_path
+
+    # We don't know the Python version, so we just assume that we can safely take the first one in the list.
+    site_packages_path = glob.glob(os.path.join(get_dependencies_path(), "Root", "lib", "*", "site-packages"))
+    if len(site_packages_path):
+       site_packages_path = site_packages_path[0]
+       sys.path.insert(0, site_packages_path)
+
+    try:
+        import jhbuild.config
+        from jhbuild.errors import FatalError
+        config = jhbuild.config.Config(get_config_file_for_platform(platform))
+    except FatalError, exception:
+        sys.stderr.write('Could not load jhbuild config file: %s\n' % exception.args[0])
+        return False
+
+    return True
diff --git a/Tools/qmake/configure.pri b/Tools/qmake/configure.pri
index 641da9f2c..5057f5740 100644
--- a/Tools/qmake/configure.pri
+++ b/Tools/qmake/configure.pri
@@ -5,7 +5,7 @@
 # See 'Tools/qmake/README' for an overview of the build system
 # -------------------------------------------------------------------
 
-haveQt(5):!quick_check {
+!quick_check {
     load(configure)
     QMAKE_CONFIG_TESTS_DIR = $$PWD/config.tests
 
diff --git a/Tools/qmake/mkspecs/features/default_post.prf b/Tools/qmake/mkspecs/features/default_post.prf
index 78a0a82b4..2b25ac3fa 100644
--- a/Tools/qmake/mkspecs/features/default_post.prf
+++ b/Tools/qmake/mkspecs/features/default_post.prf
@@ -19,8 +19,6 @@ isEmpty(OBJECTS_DIR): OBJECTS_DIR = obj/$$activeBuildConfig()
 DEFINES += \
     BUILDING_QT__=1
 
-haveQt(5): DEFINES += HAVE_QT5=1
-
 CONFIG(release, debug|release): DEFINES *= NDEBUG
 
 CONFIG += depend_includepath
@@ -139,20 +137,16 @@ contains(TEMPLATE, lib) {
 
     DEFINES += QT_ASCII_CAST_WARNINGS
 
-    win32-msvc*|win32-icc: INCLUDEPATH += $$ROOT_WEBKIT_DIR/Source/JavaScriptCore/os-win32
-
     !plugin {
         contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
         unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
     }
 }
 
-contains(QT, webkit) {
-    haveQt(4) {
-        # Qt 4 still uses custom rules to depend on QtWebKit
-        load(qtwebkit)
-    }
+# For anyone trying to include stdint.h
+win32-msvc*|win32-icc: INCLUDEPATH += $$ROOT_WEBKIT_DIR/Source/JavaScriptCore/os-win32
 
+contains(QT, webkit) {
     # In addition to the main shared QtWebKit library we also
     # need to link to any intermediate shared libraries.
     force_static_libs_as_shared {
@@ -238,43 +232,6 @@ for(subdir, SUBDIRS) {
     }
 }
 
-# Doing '$(MAKE) qmake' should recurse through all subdirs. In Qt5, this is
-# automatic (for 'qmake_all', while 'qmake' does not enter subdirs at all).
-haveQt(4):contains(TEMPLATE, subdirs):!no_recursive_qmake {
-    recursive_qmake.target = qmake_all
-
-    # We could do this using CONFIG += recurse but that adds
-    # a dependency for each recursive target on its makefile,
-    # while we want it to depend on *-qmake_all, so that we
-    # don't end up running qmake twice.
-
-    for(subdir, SUBDIRS) {
-        contains(NO_RECURSIVE_QMAKE_SUBDIRS, $${subdir}) {
-            debug(1, Skipping recursive qmake for $${subdir})
-            next()
-        }
-
-        subdir_config = $$eval($${subdir}.CONFIG)
-        contains(subdir_config, no_default_target):next()
-
-        debug(1, "Making qmake recursive for $$subdir")
-
-        variables = $$computeSubdirVariables($${subdir})
-
-        target_name = $$eval($${variables}.target)-recursive_qmake
-
-        eval($${target_name}.target = $$target_name)
-        eval($${target_name}.depends = $$eval($${variables}.target)-qmake_all)
-        commands = $$eval($${variables}.subdir_command) $(MAKE) -f $$eval($${variables}.makefile) qmake
-        eval($${target_name}.commands = $$commands)
-
-        QMAKE_EXTRA_TARGETS += $${target_name}
-        recursive_qmake.depends += $${target_name}
-    }
-
-    !isEmpty(recursive_qmake.depends): QMAKE_EXTRA_TARGETS += recursive_qmake
-}
-
 incremental.target = incremental
 incremental.commands = $(MAKE) -f $(MAKEFILE) qmake_all && $(MAKE) -f $(MAKEFILE)
 QMAKE_EXTRA_TARGETS += incremental
@@ -312,9 +269,4 @@ for(target, $$list($$unique(DEFAULT_TARGETS))) {
 # relative.
 DESTDIR = $$replace(DESTDIR, ^$${ROOT_BUILD_DIR}, $${BUILD_ROOT_RELATIVE_TO_OUT_PWD})
 
-# Since we loaded our own rules for depending on QtWebKit, and we
-# have no more logic that checks contains(QT, webkit), we unset it
-# here so that Qt will not add its own include and library paths.
-haveQt(4): QT -= webkit webkit-private
-
 load(default_post) # Load Qt's defaults
diff --git a/Tools/qmake/mkspecs/features/default_pre.prf b/Tools/qmake/mkspecs/features/default_pre.prf
index a8bb75830..c91aab9b3 100644
--- a/Tools/qmake/mkspecs/features/default_pre.prf
+++ b/Tools/qmake/mkspecs/features/default_pre.prf
@@ -16,21 +16,11 @@ load(moc)
 pro_file = $$_PRO_FILE_ # Checking the variable directly does not work
 isEmpty(pro_file): CONFIG += recursive_include
 
-# We default to release builds
-!build_pass {
-    CONFIG += release
-    CONFIG -= debug
-}
-
 # Resolve root directories for source and build
 ROOT_WEBKIT_DIR = $$replace(PWD, /Tools/qmake/mkspecs/features$,)
 WEBKIT_SUBDIR = $$replace(_PRO_FILE_PWD_, $${ROOT_WEBKIT_DIR},)
 ROOT_BUILD_DIR = $$replace(OUT_PWD, $${WEBKIT_SUBDIR}$,)
 
-# Detect if we're running the initial configure step
-pro_file_name = $$basename(_PRO_FILE_)
-equals(pro_file_name, configure.pro): CONFIG += configure_pass
-
 # We want the QtWebKit API forwarding includes to live in the root build dir.
 MODULE_BASE_DIR = $$ROOT_WEBKIT_DIR
 MODULE_BASE_OUTDIR = $$ROOT_BUILD_DIR
@@ -66,12 +56,6 @@ win32* {
     isEmpty(pwd_starts_with_slash): CONFIG += win_cmd_shell
 }
 
-haveQt(4) {
-    # Make sure QMAKEPATH is set for recursive targets
-    win_cmd_shell: QMAKE_QMAKE = \(set QMAKEPATH=$$(QMAKEPATH)\) && $$QMAKE_QMAKE
-    else: QMAKE_QMAKE = QMAKEPATH=$$(QMAKEPATH) $$QMAKE_QMAKE
-}
-
 # Default location of generated sources
 GENERATED_SOURCES_DESTDIR = generated
 
@@ -92,42 +76,24 @@ win32-msvc*: MAKEFILE_NOOP_COMMAND = @echo >NUL
 scratchbox: PYTHON = python2.6
 else: PYTHON = python
 
-!haveQt(4, 8):!haveQt(5):!recursive_include: error("Building WebKit with Qt versions older than 4.8 is not supported.")
-
-!haveQt(5):!no_webkit2 {
-    root_project_file {
-        message("Building WebKit2 with Qt versions older than 5.0 is not supported. Disabling WebKit2.")
-        message("Read http://www.mail-archive.com/webkit-qt@lists.webkit.org/msg01674.html for more information.")
-    }
-    CONFIG += no_webkit2
-}
+!haveQt(5):!recursive_include: error("Building WebKit with Qt versions older than 5.0 is not supported.")
 
-haveQt(5): {
-    !haveQtModule(widgets)|!haveQtModule(printsupport) {
-        root_project_file: message("WebKit1 requires the QtWidgets and QtPrintSupport modules. Disabling WebKit1.")
-        CONFIG += no_webkit1
-    }
+!haveQtModule(widgets)|!haveQtModule(printsupport) {
+    root_project_file: message("WebKit1 requires the QtWidgets and QtPrintSupport modules. Disabling WebKit1.")
+    CONFIG += no_webkit1
 }
 
 # We use private_tests to detect developer build, since the destdir will
 # always be our webkit build dir. This might change as configure changes.
 contains(QT_CONFIG, private_tests): CONFIG += qt_developer_build
 
-haveQt(4) {
-    # Qt5 will automatically load the module files for us, but for Qt4
-    # we have to do it manually so that the various QT.webkit.foo names
-    # are available.
-    include($${ROOT_WEBKIT_DIR}/Tools/qmake/qt_webkit.pri)
-}
-
 # Set some defaults for specific platforms
 CONFIG += include_webinspector
 
 # Try to locate sqlite3 source (for WebCore)
 SQLITE3SRCDIR = $$(SQLITE3SRCDIR)
 isEmpty(SQLITE3SRCDIR) {
-    haveQt(5): SQLITE3SRCDIR = $$QT.core.sources/../3rdparty/sqlite/
-    else: SQLITE3SRCDIR = $$[QT_INSTALL_PREFIX]/src/3rdparty/sqlite/
+    SQLITE3SRCDIR = $$QT.core.sources/../3rdparty/sqlite/
 }
 
 # --------- Make features available to JSC ------------
@@ -143,9 +109,7 @@ for(define, DEFINES) {
     FEATURE_DEFINES_JAVASCRIPT += $$enabled_feature_define
 }
 
-configure_pass {
-    # Save the base config and defines so we can compute the delta between
-    # what features.prf introduced and what was already there.
-    BASE_CONFIG = $$CONFIG
-    BASE_DEFINES = $$DEFINES
-}
+# Save the base config and defines so we can compute the delta between
+# what features.prf introduced and what was already there.
+BASE_CONFIG = $$CONFIG
+BASE_DEFINES = $$DEFINES
diff --git a/Tools/qmake/mkspecs/features/features.prf b/Tools/qmake/mkspecs/features/features.prf
index 4a6443427..4f6ddca51 100644
--- a/Tools/qmake/mkspecs/features/features.prf
+++ b/Tools/qmake/mkspecs/features/features.prf
@@ -31,30 +31,21 @@ load(mobilityconfig, true)
 # by having the feature disabled in features.pri. Nor do you have to
 # unset the opposite value, that's handled automatically for you.
 
-# For Mac we do not rely on QT_CONFIG, because icu is not officially supported for all of qt.
-haveQt(5):if(contains(QT_CONFIG,icu)|mac) {
-    DEFINES += WTF_USE_ICU_UNICODE=1
-    DEFINES -= WTF_USE_QT4_UNICODE=1
-} else {
-    DEFINES += WTF_USE_QT4_UNICODE=1
-    DEFINES -= WTF_USE_ICU_UNICODE=1
-}
+DEFINES += WTF_USE_ICU_UNICODE=1
+DEFINES -= WTF_USE_QT4_UNICODE=1
 
 !contains(DEFINES, HAVE_QRAWFONT=.) {
     # Use of QRawFont in Qt 5:
-    haveQt(5): DEFINES += HAVE_QRAWFONT=1
+    DEFINES += HAVE_QRAWFONT=1
 }
 
 # We need fontconfig to set up the test fonts for DumpRenderTree and WebKitTestRunner.
-haveQt(5) {
-    config_fontconfig:!mac {
-        DEFINES += HAVE_FONTCONFIG=1
-    }
-} else {
-    # Qt 4
-    unix:!mac:!embedded {
-        DEFINES += HAVE_FONTCONFIG=1
-    }
+config_fontconfig:!mac {
+    DEFINES += HAVE_FONTCONFIG=1
+}
+
+!contains(DEFINES, HAVE_QTQUICK=.) {
+    haveQtModule(quick): DEFINES += HAVE_QTQUICK=1
 }
 
 # We need libxml2 config test to determine to use libxml2 or not
@@ -80,7 +71,7 @@ haveQt(5) {
 
 # Nescape plugins support (NPAPI)
 !contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
-    haveQt(5):xlibAvailable() {
+    xlibAvailable() {
         DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
         CONFIG += plugin_backend_xlib
     } else: unix|win32-*:!embedded:!wince* {
@@ -105,7 +96,7 @@ haveQt(5) {
 }
 
 # QStyle detection
-haveQt(4)|haveQtModule(widgets): DEFINES += HAVE_QSTYLE=1
+haveQtModule(widgets): DEFINES += HAVE_QSTYLE=1
 
 # WebGL support
 !contains(DEFINES, ENABLE_WEBGL=.) {
@@ -134,17 +125,9 @@ haveQt(4)|haveQtModule(widgets): DEFINES += HAVE_QSTYLE=1
 }
 
 # orientation support
-haveQt(5) {
-    haveQtModule(sensors) {
-        !contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=1
-        !contains(DEFINES, ENABLE_DEVICE_ORIENTATION=.): DEFINES += ENABLE_DEVICE_ORIENTATION=1
-    }
-} else {
-    # Qt 4 with Qt Mobility
-    contains(MOBILITY_CONFIG, sensors) {
-        !contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=1
-        !contains(DEFINES, ENABLE_DEVICE_ORIENTATION=.): DEFINES += ENABLE_DEVICE_ORIENTATION=1
-    }
+haveQtModule(sensors) {
+    !contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=1
+    !contains(DEFINES, ENABLE_DEVICE_ORIENTATION=.): DEFINES += ENABLE_DEVICE_ORIENTATION=1
 }
 
 # HTML5 Media Support
@@ -169,29 +152,25 @@ haveQt(5) {
     !no_webkit2: DEFINES += ENABLE_FULLSCREEN_API=1
 }
 
-haveQt(4) {
-    haveQtModule(declarative): DEFINES += HAVE_QQUICK1=1
-} else {
-    # FIXME: Add Qt 5 QQuick1 support once QDeclarativeEngine in QQuick2
-    # is called QmlEngine and it is safe for us to use QQuick1 again.
+# Gamepad API Support
+linux-*:!contains(DEFINES, ENABLE_GAMEPAD=.) {
+    packagesExist(libudev): DEFINES += ENABLE_GAMEPAD=1
 }
 
 # Xcomposite Support
-haveQt(5):linux-*:config_libXcomposite: DEFINES += HAVE_XCOMPOSITE=1
+linux-*:config_libXcomposite: DEFINES += HAVE_XCOMPOSITE=1
 
 # Xrender Support
 haveQt(5):linux-*:config_libXrender: DEFINES += HAVE_XRENDER=1
 
 # GLX Support
-haveQt(5):linux-*:config_glx: DEFINES += HAVE_GLX=1
+haveQt(5):linux-*:config_glx:!contains(QT_CONFIG, opengles2): DEFINES += HAVE_GLX=1
 
 # Support for Graphics Surface
 !contains(DEFINES, WTF_USE_GRAPHICS_SURFACE=.) {
-    haveQt(5) {
-        mac: DEFINES += WTF_USE_GRAPHICS_SURFACE=1
-        # On linux we require GLX, libXcomposite and libXrender to enable graphics surface.
-        linux-*:contains(DEFINES, HAVE_GLX=1):contains(DEFINES, HAVE_XCOMPOSITE=1):contains(DEFINES, HAVE_XRENDER=1): DEFINES += WTF_USE_GRAPHICS_SURFACE=1
-    }
+    mac: DEFINES += WTF_USE_GRAPHICS_SURFACE=1
+    # On linux we require GLX, libXcomposite and libXrender to enable graphics surface.
+    linux-*:contains(DEFINES, HAVE_GLX=1):contains(DEFINES, HAVE_XCOMPOSITE=1):contains(DEFINES, HAVE_XRENDER=1): DEFINES += WTF_USE_GRAPHICS_SURFACE=1
 }
 
 # -------------- Fill in static defaults --------------
@@ -237,12 +216,16 @@ for(define, DEFINES) {
 !contains(DEFINES, WTF_USE_3D_GRAPHICS=.) {
     # Disable USE(3D_GRAPHICS) on Windows temporarily, see https://bugs.webkit.org/show_bug.cgi?id=90850 for details.
     !win32-* {
-        haveQt(5)|contains(QT_CONFIG, opengl): DEFINES += WTF_USE_3D_GRAPHICS=1
+        DEFINES += WTF_USE_3D_GRAPHICS=1
     }
 }
 
-haveQt(4):contains(DEFINES, ENABLE_WEBGL=1):contains(DEFINES, WTF_USE_3D_GRAPHICS=0) {
-    error("WebGL requires Qt to be configured with OpenGL. Please reconfigure Qt with OpenGL, or build WebKit without WebGL.")
+contains(DEFINES, ENABLE_GAMEPAD=1) {
+    !packagesExist(libudev) {
+        error("Gamepad API requires libudev to build. Please install libudev development files, or build WebKit without gamepad.")
+    } else:!linux-* {
+        error("Currently the Gamepad API is supported only on Linux, build WebKit without gamepad.")
+    }
 }
 
 # Slider Touch is sensible to use when compiling WebKit2
diff --git a/Tools/qmake/mkspecs/features/features.pri b/Tools/qmake/mkspecs/features/features.pri
index 4d7f20ee2..97dd7ae41 100644
--- a/Tools/qmake/mkspecs/features/features.pri
+++ b/Tools/qmake/mkspecs/features/features.pri
@@ -24,6 +24,7 @@ FEATURE_DEFAULTS = \
     ENABLE_CSS_EXCLUSIONS=1 \
     ENABLE_CSS_FILTERS=1 \
     ENABLE_CSS_GRID_LAYOUT=0 \
+    ENABLE_CSS_HIERARCHIES=0 \
     ENABLE_CSS_IMAGE_ORIENTATION=0 \
     ENABLE_CSS_IMAGE_RESOLUTION=0 \
     ENABLE_CSS_REGIONS=1 \
diff --git a/Tools/qmake/mkspecs/features/functions.prf b/Tools/qmake/mkspecs/features/functions.prf
index a086e769b..972a2079f 100644
--- a/Tools/qmake/mkspecs/features/functions.prf
+++ b/Tools/qmake/mkspecs/features/functions.prf
@@ -137,51 +137,16 @@ defineTest(addStrictSubdirOrderBetween) {
     first_base_target = sub-$$replace(firstSubdirFile, [^a-zA-Z0-9_], -)
     second_base_target = sub-$$replace(secondSubdirFile, [^a-zA-Z0-9_], -)
 
-    haveQt(4) {
-        # Use a custom target for making the derived sources instead of the default ones,
-        # as the default ones depend on $(MAKEFILE), while we want to depend on *qmake_all.
-        # Without this rule we end up running qmake twice for the derived sources, as well as
-        # introducing a race condition where we run "qmake -o Makefile.DerivedSources" at the
-        # same time as we run "make -f Makefile.DerivedSources", resulting in make reading a
-        # half-written makefile.
-        derived_make_for_qmake.target = $${first_base_target}-make_for_qmake
-        derived_make_for_qmake.depends = $${first_base_target}-qmake_all
-        derived_make_for_qmake.commands = $(MAKE) -f $$eval($${firstSubdir}.makefile)
-        QMAKE_EXTRA_TARGETS += derived_make_for_qmake
-
-        # This target ensures that running "make qmake" will force both qmake and make
-        # to be run on the derived sources before running qmake on the target, so that
-        # qmake can pick up the right dependencies for the target based on the derived
-        # sources that were generated.
-        target_make_qmake.target = $${second_base_target}-qmake_all
-        target_make_qmake.depends = $${derived_make_for_qmake.target}
-        QMAKE_EXTRA_TARGETS += target_make_qmake
-
-        GNUmake {
-            # This target ensures that running make before any makefiles have been created
-            # will still force qmake and make to be run on the derived sources first.
-            target_make.target = $$eval($${secondSubdir}.makefile)
-
-            # We use order-only-prerequisites so that we can run make on the derived sources
-            # without triggering a qmake run on the target due to updated dependencies.
-            target_make.depends = "| $${first_base_target}-make_default-ordered"
-
-            QMAKE_EXTRA_TARGETS += target_make
-        }
-    } else {
-        # Qt5's qmake does most of the above for us already.
-
-        # This target ensures that running "make qmake_all" will force both qmake and make
-        # to be run on the derived sources before running qmake on the target, so that
-        # qmake can pick up the right dependencies for the target based on the derived
-        # sources that were generated. Just "make qmake" is non-recursive anyway.
-        target_make_qmake.target = $${second_base_target}-qmake_all
-        target_make_qmake.depends = $${first_base_target}
-        QMAKE_EXTRA_TARGETS += target_make_qmake
-
-        # Make things work even if qmake -r is used.
-        CONFIG += dont_recurse
-    }
+    # This target ensures that running "make qmake_all" will force both qmake and make
+    # to be run on the derived sources before running qmake on the target, so that
+    # qmake can pick up the right dependencies for the target based on the derived
+    # sources that were generated. Just "make qmake" is non-recursive anyway.
+    target_make_qmake.target = $${second_base_target}-qmake_all
+    target_make_qmake.depends = $${first_base_target}
+    QMAKE_EXTRA_TARGETS += target_make_qmake
+
+    # Make things work even if qmake -r is used.
+    CONFIG += dont_recurse
 
     export(SUBDIRS)
     export(NO_RECURSIVE_QMAKE_SUBDIRS)
@@ -223,7 +188,6 @@ defineTest(haveQtModule) {
     unset(module)
     module = $$1
 
-    haveQt(4):contains(QT_CONFIG, $${module}): return(true)
     haveQt(5):!isEmpty(QT.$${module}.name): return(true)
     return(false)
 }
@@ -310,48 +274,10 @@ defineTest(linkAgainstLibrary) {
     return(true)
 }
 
-defineTest(runSyncQt) {
-
-    build_pass:return(true)
-
-    haveQt(5) {
-        # Qt 5 will run synqt as part of defaults_pre, so no need to do anything
-    } else {
-        # Use our own copy of syncqt from Qt 4.8 to generate forwarding headers
-        syncqt = $$toSystemPath($${ROOT_WEBKIT_DIR}/Tools/qmake/syncqt-4.8)
-        command = $$syncqt
-        win32-msvc*: command = $$command -windows
-
-        outdir = $$toSystemPath($${ROOT_BUILD_DIR})
-
-        # The module root has to be the same as directory of the pro-file that generates
-        # the install rules (api.pri), otherwise the relative paths in the generated
-        # headers.pri will be incorrect.
-        module_rootdir = $$toSystemPath($${_PRO_FILE_PWD_})
-
-        module = $${TARGET}$${DIRLIST_SEPARATOR}$${module_rootdir}$${DIRLIST_SEPARATOR}$$toSystemPath(WebKit/qt/Api)
-        command = perl $${command} -outdir $${outdir} -separate-module $${module}
-        message(Running $$command)
-        !system($$command) {
-            error(Failed to run $${command})
-        }
-    }
-
-    return(true)
-}
-
 defineTest(xlibAvailable) {
-    haveQt(5) {
-        contains(QT_CONFIG, xcb-xlib) {
-            return(true)
-        } else {
-            return(false)
-        }
+    contains(QT_CONFIG, xcb-xlib) {
+        return(true)
     } else {
-        unix:!mac:!embedded {
-            return(true)
-        } else {
-            return(false)
-        }
+        return(false)
     }
 }
diff --git a/Tools/qmake/mkspecs/features/qtwebkit.prf b/Tools/qmake/mkspecs/features/qtwebkit.prf
deleted file mode 100644
index 60e0b8b69..000000000
--- a/Tools/qmake/mkspecs/features/qtwebkit.prf
+++ /dev/null
@@ -1,30 +0,0 @@
-# -------------------------------------------------------------------
-# This file is used by tools that rely on the QtWebKit library
-#
-# It is only used for Qt4, which does not have a module system.
-#
-# See 'Tools/qmake/README' for an overview of the build system
-# -------------------------------------------------------------------
-
-haveQt(4) {
-    QMAKE_LIBDIR = $$ROOT_BUILD_DIR/lib $$QMAKE_LIBDIR
-    QTWEBKITLIBNAME = QtWebKit
-    mac:!static:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework) {
-        LIBS += -framework $$QTWEBKITLIBNAME
-        QMAKE_FRAMEWORKPATH = $$ROOT_BUILD_DIR/lib $$QMAKE_FRAMEWORKPATH
-    } else {
-        build_pass: win32-*|wince* {
-            !CONFIG(release, debug|release): QTWEBKITLIBNAME = $${QTWEBKITLIBNAME}d
-            QTWEBKITLIBNAME = $${QTWEBKITLIBNAME}$${QT_MAJOR_VERSION}
-            win32-g++*: LIBS += -l$$QTWEBKITLIBNAME
-            else: LIBS += $${QTWEBKITLIBNAME}.lib
-        } else {
-            LIBS += -lQtWebKit
-        }
-    }
-
-    DEPENDPATH += $$ROOT_WEBKIT_DIR/Source/WebKit/qt/Api
-    INCLUDEPATH += $${ROOT_BUILD_DIR}/include/QtWebKit
-} else {
-    error(Relying on $$_FILE_ for Qt5 builds are not supported)
-}
diff --git a/Tools/qmake/mkspecs/features/unix/default_pre.prf b/Tools/qmake/mkspecs/features/unix/default_pre.prf
index c23713520..83b7cc4a9 100644
--- a/Tools/qmake/mkspecs/features/unix/default_pre.prf
+++ b/Tools/qmake/mkspecs/features/unix/default_pre.prf
@@ -6,7 +6,7 @@
 
 load(functions)
 
-haveQt(5): CONFIG += object_parallel_to_source
+CONFIG += object_parallel_to_source
 
 # Expose if we are building inside Scratchbox
 SBOX_CHECK = $$(_SBOX_DIR)
diff --git a/Tools/qmake/mkspecs/features/win32/default_pre.prf b/Tools/qmake/mkspecs/features/win32/default_pre.prf
index ad9d9d104..fe8799ad1 100644
--- a/Tools/qmake/mkspecs/features/win32/default_pre.prf
+++ b/Tools/qmake/mkspecs/features/win32/default_pre.prf
@@ -7,3 +7,6 @@
 load(default_pre)
 
 debug: CONFIG += use_all_in_one_files
+
+# WebKit2 not supported on Windows yet
+CONFIG += no_webkit2
diff --git a/WebKit.pro b/WebKit.pro
index ef25ea511..f43dcac9e 100644
--- a/WebKit.pro
+++ b/WebKit.pro
@@ -5,11 +5,36 @@
 # See 'Tools/qmake/README' for an overview of the build system
 # -------------------------------------------------------------------
 
-haveQt(4) {
-    QMAKEPATH = $$(QMAKEPATH)
-    isEmpty(QMAKEPATH)|!exists($${QMAKEPATH}/mkspecs) {
-        error("The environment variable QMAKEPATH needs to point to $WEBKITSRC/Tools/qmake")
-        # Otherwise we won't pick up the feature prf files needed for the build
+!webkit_configured {
+    CONFIG += production_build
+    include(Tools/qmake/configure.pri)
+    the_config = $$CONFIG
+    the_config -= $$BASE_CONFIG $$find(CONFIG, "^(done_)?config_")
+    cache(CONFIG, add, the_config)
+    the_defines = $$DEFINES
+    the_defines -= $$BASE_DEFINES
+    cache(DEFINES, add, the_defines)
+
+    # We inherit the build type from Qt, unless it was specified on the qmake command
+    # line. Note that the perl build script defaults to forcing a release build.
+    contains(the_config, debug|release) {
+        contains(the_config, debug) {
+            contains(the_config, release) {
+                !debug_and_release:cache(CONFIG, add, $$list(debug_and_release))
+            } else {
+                release:cache(CONFIG, del, $$list(release))
+                debug_and_release:cache(CONFIG, del, $$list(debug_and_release))
+            }
+        } else { # release
+            debug:cache(CONFIG, del, $$list(debug))
+            debug_and_release:cache(CONFIG, del, $$list(debug_and_release))
+        }
+    } else {
+        contains(QT_CONFIG, release, debug|release): \
+            cache(CONFIG, add, $$list(release))
+        else: \
+            cache(CONFIG, add, $$list(debug))
+        macx:!debug_and_release:cache(CONFIG, add, $$list(debug_and_release))
     }
 }
 
diff --git a/WebKitLibraries/ChangeLog b/WebKitLibraries/ChangeLog
index 3ed61db6a..a5dd4a4ef 100644
--- a/WebKitLibraries/ChangeLog
+++ b/WebKitLibraries/ChangeLog
@@ -1,3 +1,27 @@
+2012-08-06  Anders Carlsson  <andersca@apple.com>
+
+        If the Apple Java plug-in is blocked and no runtime is installed, don't load it
+        https://bugs.webkit.org/show_bug.cgi?id=93289
+        <rdar://problem/11730092>
+
+        Reviewed by Dan Bernstein.
+
+        Add WKJLIsRuntimeAndWebComponentsInstalled().
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLion.a:
+        * libWebKitSystemInterfaceMountainLion.a:
+
+2012-08-01  Jon Lee  <jonlee@apple.com>
+
+        Update WKSI.
+
+        Reviewed by Mark Rowe.
+
+        * libWebKitSystemInterfaceLion.a:
+        * libWebKitSystemInterfaceMountainLion.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+
 2012-07-29  Rik Cabanier  <cabanier@adobe.com>
 
         Add ENABLE_CSS_COMPOSITING flag
diff --git a/WebKitLibraries/WebKitSystemInterface.h b/WebKitLibraries/WebKitSystemInterface.h
index 0d7727f94..6e99ca5ca 100644
--- a/WebKitLibraries/WebKitSystemInterface.h
+++ b/WebKitLibraries/WebKitSystemInterface.h
@@ -501,6 +501,10 @@ CGFloat WKNSElasticDeltaForReboundDelta(CGFloat delta);
 CGFloat WKNSReboundDeltaForElasticDelta(CGFloat delta);
 #endif
 
+#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
+Boolean WKJLIsRuntimeAndWebComponentsInstalled(void);
+#endif
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/WebKitLibraries/libWebKitSystemInterfaceLion.a b/WebKitLibraries/libWebKitSystemInterfaceLion.a
index 20ff91f52..846cb2dd6 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceLion.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceLion.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a b/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a
index ce7db6a0c..0c24ce03f 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
index c224ee77f..875beefbb 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
diff --git a/configure.ac b/configure.ac
index 2a90aafff..7ea5b95ee 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,14 +2,14 @@ AC_PREREQ(2.60)
 
 m4_define([webkit_major_version], [1])
 m4_define([webkit_minor_version], [9])
-m4_define([webkit_micro_version], [5])
+m4_define([webkit_micro_version], [6])
 
 # This is the version we'll be using as part of our User-Agent string
 # e.g., AppleWebKit/$(webkit_user_agent_version) ...
 #
 # Sourced from Source/WebCore/Configurations/Version.xcconfig
 m4_define([webkit_user_agent_major_version], [537])
-m4_define([webkit_user_agent_minor_version], [1])
+m4_define([webkit_user_agent_minor_version], [4])
 
 AC_INIT([WebKit],[webkit_major_version.webkit_minor_version.webkit_micro_version],[http://bugs.webkit.org/])
 
@@ -35,13 +35,13 @@ AC_CONFIG_SRCDIR([Source/WebCore/config.h])
 
 dnl # Libtool library version, not to confuse with API version
 dnl # see http://www.gnu.org/software/libtool/manual/html_node/Libtool-versioning.html
-LIBWEBKITGTK_VERSION=15:0:15
+LIBWEBKITGTK_VERSION=16:0:16
 AC_SUBST([LIBWEBKITGTK_VERSION])
 
-LIBJAVASCRIPTCOREGTK_VERSION=13:4:13
+LIBJAVASCRIPTCOREGTK_VERSION=13:5:13
 AC_SUBST([LIBJAVASCRIPTCOREGTK_VERSION])
 
-LIBWEBKIT2GTK_VERSION=16:0:16
+LIBWEBKIT2GTK_VERSION=17:0:17
 AC_SUBST([LIBWEBKIT2GTK_VERSION])
 
 AM_INIT_AUTOMAKE([foreign subdir-objects dist-xz no-dist-gzip tar-ustar])
@@ -470,6 +470,18 @@ AC_SUBST(ENCHANT_CFLAGS)
 AC_SUBST(ENCHANT_LIBS)
 fi
 
+# farstream-0.1 depends on gstreamer 0.10 currently. Disable
+# media_stream if gstreamer 0.11 build support is enabled.
+if test "$GST_API_VERSION" = "1.0"; then
+   enable_media_stream=false
+fi
+if test "$enable_media_stream" = "yes"; then
+   PKG_CHECK_MODULES([FARSTREAM], [farstream-0.1],
+                     [have_farstream=yes], [enable_media_stream=false])
+   AC_SUBST([FARSTREAM_CFLAGS])
+   AC_SUBST([FARSTREAM_LIBS])
+fi
+
 PKG_CHECK_MODULES(GAIL, $GAIL_PC_NAME >= $GAIL_REQUIRED_VERSION)
 AC_SUBST(GAIL_CFLAGS)
 AC_SUBST(GAIL_LIBS)
@@ -1412,6 +1424,9 @@ AM_CONDITIONAL([USE_OPENGL], [test "$with_acceleration_backend" = "opengl"])
 AM_CONDITIONAL([ENABLE_INDEXED_DATABASE],[test "$enable_indexed_database" = "yes"])
 AM_CONDITIONAL([USE_LEVELDB],[test "$enable_indexed_database" = "yes"])
 
+# Farstream feature conditional
+AM_CONDITIONAL([USE_FARSTREAM], [test "$have_farstream" = "yes"])
+
 # WebKit feature conditionals
 AM_CONDITIONAL([ENABLE_DEBUG],[test "$enable_debug_features" = "yes"])
 AM_CONDITIONAL([ENABLE_UNSTABLE_FEATURES],[test "$enable_unstable_features" = "yes"])
@@ -1483,6 +1498,7 @@ AM_CONDITIONAL([ENABLE_CSS_EXCLUSIONS],[test "$enable_css_exclusions" = "yes"])
 AM_CONDITIONAL([ENABLE_CSS_REGIONS],[test "$enable_css_regions" = "yes"])
 AM_CONDITIONAL([ENABLE_CSS_FILTERS],[test "$enable_css_filters" = "yes"])
 AM_CONDITIONAL([ENABLE_CSS_COMPOSITING],[test "$enable_css_compositing" = "yes"])
+AM_CONDITIONAL([ENABLE_WIDGET_REGION],[test "$enable_widget_region" = "yes"])
 
 # Gtk conditionals
 AM_CONDITIONAL([ENABLE_INTROSPECTION],[test "$enable_introspection" = "yes"])
@@ -1535,28 +1551,27 @@ Build configuration:
 
 Features:
 =======
- WebGL                                                    : $enable_webgl
  Accelerated Compositing                                  : $enable_accelerated_compositing
  Animation API                                            : $enable_animation_api
  Blob support                                             : $enable_blob
- Color input support                                      : $enable_input_type_color
- CSS3 Flexbox support                                     : $enable_css3_flexbox
- CSS box-decoration-break support                         : $enable_css_box_decoration_break
+ CSS Compositing support                                  : $enable_css_compositing
  CSS Exclusions support                                   : $enable_css_exclusions
- CSS Regions support                                      : $enable_css_regions
  CSS Filters support                                      : $enable_css_filters
- CSS Compositing support                                  : $enable_css_compositing
+ CSS Regions support                                      : $enable_css_regions
+ CSS box-decoration-break support                         : $enable_css_box_decoration_break
+ CSS3 Flexbox support                                     : $enable_css3_flexbox
+ Color input support                                      : $enable_input_type_color
+ DOM mutation observer support                            : $enable_mutation_observers
  DeviceOrientation support                                : $enable_device_orientation
  Directory upload                                         : $enable_directory_upload
- DOM mutation observer support                            : $enable_mutation_observers
  Fast Mobile Scrolling                                    : $enable_fast_mobile_scrolling
  Filters support                                          : $enable_filters
  Fullscreen API support                                   : $enable_fullscreen_api
  Gamepad support                                          : $enable_gamepad
  Geolocation support                                      : $enable_geolocation
+ HTML5 FileSystem API support                             : $enable_file_system
  HTML5 channel messaging support                          : $enable_channel_messaging
  HTML5 data transfer items support                        : $enable_data_transfer_items
- HTML5 FileSystem API support                             : $enable_file_system
  HTML5 iframe seamless attribute support                  : $enable_iframe_seamless
  HTML5 meter element support                              : $enable_meter_tag
  HTML5 microdata support                                  : $enable_microdata
@@ -1564,35 +1579,36 @@ Features:
  HTML5 track element support                              : $enable_video_track
  HTML5 video element support                              : $enable_video
  Icon database support                                    : $enable_icon_database
- JavaScript debugger/profiler support                     : $enable_javascript_debugger
  JIT compilation                                          : $enable_jit
+ JavaScript debugger/profiler support                     : $enable_javascript_debugger
  Legacy WebKitBlobBuilder support                         : $enable_legacy_webkit_blob_builder
  Link prefetch support                                    : $enable_link_prefetch
+ MHTML support                                            : $enable_mhtml
  MathML support                                           : $enable_mathml
  Media source                                             : $enable_media_source
  Media statistics                                         : $enable_media_statistics
  Media stream support                                     : $enable_media_stream
- MHTML support                                            : $enable_mhtml
  Opcode stats                                             : $enable_opcode_stats
  Page Visibility API support                              : $enable_page_visibility_api
  Quota API support                                        : $enable_quota
  Register Protocol Handler support                        : $enable_register_protocol_handler
  RequestAnimationFrame support                            : $enable_request_animation_frame
+ SQL client-side database storage support                 : $enable_sql_database
+ SVG fonts support                                        : $enable_svg_fonts
+ SVG support                                              : $enable_svg
  Scripted speech support                                  : $enable_scripted_speech
  Shadow DOM support                                       : $enable_shadow_dom
  SharedWorkers support                                    : $enable_shared_workers
  Speech input support                                     : $enable_input_speech
  Spellcheck support                                       : $enable_spellcheck
- SQL client-side database storage support                 : $enable_sql_database
- SVG fonts support                                        : $enable_svg_fonts
- SVG support                                              : $enable_svg
  Text Autosizing support                                  : $enable_text_autosizing
  Touch Icon Loading support                               : $enable_touch_icon_loading
  Web Audio support                                        : $enable_web_audio
- WebGL                                                    : $enable_webgl
  Web Sockets support                                      : $enable_web_sockets
  Web Timing support                                       : $enable_web_timing
  Web Workers support                                      : $enable_workers
+ WebGL                                                    : $enable_webgl
+ Widget region support                                    : $enable_widget_region
  XSLT support                                             : $enable_xslt
 
 WebKit2 support: